cc-safety-net 2.4.6 → 2.4.8

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.6
+// version: 2.4.8
 // @bun
-var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",wn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},_n={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,..._n},trackedHeredocFiles:{cap:64,..._n},controlFlowStates:{cap:64,..._n},wrapperPeelIterations:{cap:20,..._n},derivedCommandShape:_n});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var wp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return Ap(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ap(e){return wp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Pp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Tp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Pp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",wn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},_n={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,..._n},trackedHeredocFiles:{cap:64,..._n},controlFlowStates:{cap:64,..._n},wrapperPeelIterations:{cap:20,..._n},derivedCommandShape:_n});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return Tp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Tp(e){return Pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Ip={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function kp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Ip[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function hl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function An(e={}){return{reason:wn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function yl(e){return Tp({...e,redact:lt})}function bl(e){return lt(e instanceof Error?e.message:String(e))}import{types as Ip}from"util";var kp=new Set(["applypatch","patch"]),Op=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Mp=new Set(["grep","grepsearch","rg"]),Dp=new Set(["find","findbyname","glob"]),Np=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Lp=new Set(["command","diff","input","patch","patchtext"]),Cl=new TextEncoder,Wp=new TextDecoder,Fp=/\s/,Gp=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Rl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Ar(e){return Np.has(Rl(e))}function Ei(e){let t=Rl(e);if(kp.has(t))return"patch";if(Mp.has(t))return"grep";if(Dp.has(t))return"glob";if(Op.has(t))return"path";return"unknown"}function In(e){if(!e||typeof e!=="object")return;kl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function _l(e,t){return wl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function wl(e,t,n,r){let o=Il(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=wl(a,t,n,r+1);return typeof a==="string"&&t.has(Al(s))?[a]:l});return n.ancestors.delete(o.object),i}function Al(e){return e.replace(/-/g,"_").toLowerCase()}function Pl(e){return Tl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Bp)}function Tl(e,t,n,r){let o=Il(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Tl(a,o.array?t:Lp.has(Al(s)),n,r+1));return n.ancestors.delete(o.object),i}function zp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)je()}function Il(e,t,n){if(zp(e,t,n),!e||typeof e!=="object")return null;let r=kl(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function kl(e){if(Ip.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Bp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=$p(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ci(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ci(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...vi(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ci(c))}return t}function $p(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ci(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return xl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return xl(n[1]);if(e.startsWith("diff --git "))return Up(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return El(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return El(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Zp(i[1]);return[]}function Up(e){let t=Hp(e);if(t.length===2&&t[0]&&t[1])return vi(t[0],t[1]);let n=jp(e);return n?vi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Hp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=Ol(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function jp(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Gp)je();if(Vp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Vp(e,t,n,r,o){if(Si(e,t,n,r,o))return!0;let i=Sl(e,"/",t,n),s=Sl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Si(e,t,i,r,s))return!1;return Si(e,i+1,n,s+1,o)}function Si(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Sl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&Fp.test(e)}function Ol(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Wp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Cl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Cl.encode(Kp(s[0]??""))),o+=2}return null}function Kp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function qp(e){return Tn(Xp(e))}function vi(e,t){if(e==="/dev/null")return vl(t);if(t==="/dev/null")return vl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Tn);let n=Yp(e,t)??(e===t?Ml(e):null);return[e,t,...n?[n]:[]].flatMap(Tn)}function vl(e){let t=Ml(e);return[e,...t?[t]:[]].flatMap(Tn)}function Ml(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Yp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function El(e){return qp(wr(e,!0))}function Zp(e){return Tn(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Ol(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Xp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Tn(e){return e===""||e==="/dev/null"?[]:[e]}function xl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Pi,relative as sg,resolve as zl,sep as ag}from"path";import{basename as Ll,dirname as Jp,isAbsolute as Qp,join as eg,normalize as tg,resolve as Dl}from"path";var ng=256,Pr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function wi(e,t){return xi(e,0,t)}function xi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ri(e,o+2),a=rg(e,o,t);if(a===null){if(Pr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=og(l,t,n),o=a+1;continue}let i=Ri(e,o+1);if(!i){r+="$",o++;continue}r+=_i(i,n)??`$${i}`,o+=i.length+1}return r}function rg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function og(e,t,n){let r=e.slice(2,-1),o=Ri(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return _i(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Pr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Pr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=_i(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":xi(i.slice(s.length),t+1,n);return l?xi(i.slice(s.length),t+1,n):""}function Ri(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function _i(e,t){if(!Pr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Wl(n,i);let s=t.realpath(i);if(s!==null)return Nl(n,e,s,o);let a=Jp(i);if(a===i||o.length>=ng)return Nl(n,e,i,o);o.push(Ll(i)),i=a}}function Nl(e,t,n,r){let o=r.length===0?n:eg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function ig(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Wl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Wl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=Gl(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function Fl(e,t,n,r,o){let i=Gl(e,t,n);if(!i)return null;if(o(Ll(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=ig(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Gl(e,t,n){let r=n.home,o=wi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Dl(r,o.slice(2)):o,s=Ce(i);return tg(Qp(s)?s:Dl(t,s))}function Bl(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Ai(i,n));if(!r[0])return;let o=Ai(Pi(e)?e:zl(r[0],e),n)[0];if(!o)return;return r.some((i)=>lg(o,i))?o:void 0}function $l(e,t,n){if(Ze(e))return;return Ai(Pi(e)?e:zl(t,e),n)[0]}function Ai(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function lg(e,t){let n=sg(t,e);return n===""||n!==".."&&!n.startsWith(`..${ag}`)&&!Pi(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Lg,realpathSync as Wg,statSync as Fg}from"fs";import{homedir as Gg,tmpdir as zg}from"os";import{statSync as Mg}from"fs";import{join as Dg}from"path";import{spawnSync as cg}from"child_process";import{existsSync as On,lstatSync as ug,readFileSync as Mn,realpathSync as Zt,statSync as kn}from"fs";import{dirname as Ti,isAbsolute as Ii,join as Xt,resolve as Tr}from"path";var dg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],mg=5000;function Hl(e,t=Tg(),n=mg){let r=fg(e),o=r===null?null:pg(r);if(r===null||o===null)return null;let i=Ag(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function fg(e){try{let t=Zt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function pg(e){let t=wg(e);if(!t)return null;try{let n=ug(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ki(t);if(!r?.commonDir)return null;if(!yg(r.gitDir,t))return null;return bg(r.gitDir,Ti(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function ki(e){try{let t=gg(e);if(!t)return null;let n=Zt(Ii(t)?t:Tr(Ti(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:hg(n)}}catch{return null}}function gg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function hg(e){try{let t=Mn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(Ii(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function yg(e,t){let n=Cg(e);return n===null?!1:jl(e,n,t)}function bg(e,t){let n=Sg(e);return n===null?!0:jl(e,n,t)}function Cg(e){let t=Xt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Sg(e){let t=Xt(e,"config.worktree");return On(t)?Eg(t):null}function jl(e,t,n){try{return vg(Ii(t)?t:Tr(e,t),n)}catch{return!1}}function vg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ul(Zt.native(e))===Ul(Zt.native(t))}function Ul(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Eg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=xg(s[1]??"")}return r}function xg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return _g(t.slice(1,-1))}var Rg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function _g(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Rg[n]??t)}function wg(e){try{return Oi(Zt(e))}catch{return null}}function Oi(e){let t=e;while(!0){let n=Xt(t,".git");if(On(n))return n;let r=Ti(t);if(r===t)return null;t=r}}function Ag(e,t,n,r){if(Pg(t))return!0;if(n===null)return!0;let o=cg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Ig(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Vl(o.stdout.trim())}function Pg(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>kg(t))}function Tg(){return dg.find((e)=>On(e))??null}function Dn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Ig(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Dn(t)))}function kg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Og(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Vl(c)}return r}function Og(e){return e==="include"||e.startsWith("includeif ")}function Vl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Kl(e,t){if(e==="")return null;let n=be(),r=Oi(se(e,e,t,n)),o=r?Ng(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Ng(e,t,n,r){try{let o=se(e,t,n,r),i=Mg(e),s=i.isFile()?o:null,a=i.isFile()?ki(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt(Dg(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var Bg={realpath:(e)=>{try{return Wg(e)}catch{return null}},entryKind:(e)=>{let t=Lg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Fg(e).isDirectory()}catch{return!1}}};function Yl(){return $g({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||Gg()),tmpdir:zg(),paths:Bg})}function $g(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>ql(n,i,()=>Kl(i,o)),worktreeFacts:(i)=>ql(r,i,()=>Hl(i)),...t};return o}function ql(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function Ug(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function Hg(e){let t=Li(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function jg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Zl(e){return jg(Li(Q.auditScope,e))==="all"}function Di(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Ni(e={},t){let n=e.safety?.level??"standard",r=Hg(t),o=Ug(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Di(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?Mi(e,t):Li(e,t);return n==="1"||n?.toLowerCase()==="true"}function Mi(e,t){return t.get(e)}function Li(e,t){let n=Mi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Mi(e.legacyName,t);return}import{dirname as zr}from"path";import{closeSync as Vg,constants as Xl,fstatSync as Kg,fsyncSync as hP,lstatSync as Gi,mkdirSync as yP,openSync as qg,readdirSync as bP,readFileSync as Yg,realpathSync as zi,renameSync as CP,rmdirSync as SP,statSync as Zg,unlinkSync as vP,writeFileSync as EP}from"fs";import{isAbsolute as Jl,join as Bi,normalize as Xg,parse as Fi,relative as $i,resolve as Ui,sep as Hi}from"path";function Wi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Jg=Symbol("PolicyFilesystemScope"),Qg=Symbol("PolicyFilesystemTarget"),eh=Xl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Rt(e,t){return{[Jg]:!0,root:Ui(e),label:t}}function Ql(e,t){let n=Xg(t);if(t===""||Jl(t)||n===".."||n.startsWith(`..${Hi}`))throw new ae(e.label);return{[Qg]:!0,scope:e,relativePath:n,path:Bi(e.root,n)}}function Nn(e,t){return Ql(e,$i(e.root,Ui(t)))}function ec(e,t="rules policy"){let n=Ui(e),r=Fi(n).dir;return Ql(Rt(r,t),$i(r,n))}function Mr(e){return nc(e.scope.label,()=>{if(!Or(e))return null;let t=qg(e.path,Xl.O_RDONLY|eh);return th(t,()=>{let n=Kg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Yg(t,"utf-8"),o=Gi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function tc(e,t){if(e.path===t.path)return!0;return nc(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>Bi(zi(Fi(r).dir),Fi(r).base);return n(e.path)===n(t.path)})}function nc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function th(e,t){try{return t()}finally{Vg(e)}}function Or(e,t="file"){let n=nh(e.scope);if(!n)return!1;let r=e.relativePath.split(Hi);for(let o of r.keys()){let i=Bi(e.scope.root,...r.slice(0,o+1)),s=Gi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);rh(n,zi(i),e.scope.label)}return!0}function nh(e){if(!Gi(e.root,{throwIfNoEntry:!1}))return null;if(!Zg(e.root).isDirectory())throw new ae(e.label);return zi(e.root)}function rh(e,t,n){let r=$i(e,t);if(r===".."||r.startsWith(`..${Hi}`)||Jl(r))throw new ae(n)}import{dirname as wt,isAbsolute as lh,join as Pt,relative as ch,resolve as At,sep as uh}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,rc="rulebook.json",oc=".cc-safety-net/rules";var ic=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var oh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,ih=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),sh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),wP=new RegExp(`^${ih}/(${_t.source.slice(1,-1)})/${sh}$`);function ah(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function sc(e){if(Dr(e))try{return ji(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function ji(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(ic);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!oh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:ah(o),name:o}}function Dr(e){return ic.test(e)}var ac="rule.json",Nr="policy.json",lc=".cc-safety-net",dh="rules",mh="CC_SAFETY_NET_HOME",cc="`cc-safety-net rule update`";function fh(e){return At(e,oc)}function ph(e){return Pt(fh(e),ac)}function Ln(e){return Pt(At(e),lc,Nr)}function Vi(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):Pt(gh(e),dh))}function gh(e){let t=e.env.get(mh);return t?At(Ce(t)):Pt(e.home,lc)}function hh(e,t={}){return Pt(Vi(e,t),ac)}function en(e,t={}){return Pt(wt(Vi(e,t)),Nr)}function uc(e,t){let n=t.userConfigPath??hh(e,t),r=t.projectConfigPath??ph(t.cwd),o=yh(e,t),i=bh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function yh(e,t){let n=t.userConfigPath?wt(wt(At(t.userConfigPath))):wt(At(t.userConfigDir??Vi(e,t)));return Rt(n,"user policy")}function bh(e,t){let n=At(t),r=At(e),o=ch(n,r);if(o!==".."&&!o.startsWith(`..${uh}`)&&!lh(o))return Rt(n,"project policy");return Rt(wt(wt(r)),"project policy")}function dc(e,t){return Pt(e,t,rc)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),mc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var fc="Rulebook exceeds CC Safety Net's safe validation limits.",pc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function gc(e){if(Ki(e.allowed_commands,Oe.maxAllowedCommands)||Ki(e.rules,Oe.maxRules)||Ki(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ki(e,t){return Array.isArray(e)&&e.length>t}var qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Yi=64,Zi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Ch={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Xi=new Set(["--init-file","--rcfile"]);function Ji(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Ch[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Xi.has(l)&&!s.includes("="))i++;continue}let a=Ji(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Fr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Sh(e))Wn(n,t);return t.inSingle||t.inDouble}function Sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Qi=new Set(["rm","find","xargs","parallel"]),vh=new Set(["git","busybox",...Qi,...J,...mc,...we]),Eh=new Set(["python","node","ruby","perl"]);function hc(e){let t=M(e);return vh.has(t)||Me(t)}function Me(e){return Eh.has(xh(e))}function xh(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function es(e){try{let t=Mr(Rh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ah(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Rh(e){return typeof e==="string"?ec(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function yc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ts=`must be one of ${qi.join(", ")}`,_h=/^[^/]+\/[^/]+$/,wh=["version","rules","overrides","transparent_wrappers"];function Ah(e){let t=Ph(e);return{errors:ns(Wh(t,wh,(n)=>n.kind==="custom"),": "," "),sources:Lh(e,t)}}function Ph(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Yi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Th(e.rules,t),...Oh(e.overrides),...Dh(e.transparent_wrappers),...t?[]:kh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!_h.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Nh(e.transparent_wrappers)]}function Th(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...bc(e,Yi)?[_(["rules"],Zi)]:[]];if(t)return[{path:["rules"],message:Zi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Ih(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function bc(e,t){let n=Cc(e);return n!==void 0&&!(n<=t)}function Ih(e,t){let n=Cc(e);return n!==void 0&&!(n>=t)}function Cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function kh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=sc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Oh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Mh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||os(n.intent)?[]:[_(["overrides",t,"intent"],ts)]]})}function Mh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...bc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Dh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Nh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(hc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Lh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Wh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ns(e,t,n){return[...new Set(e.map((r)=>{let o=rs(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function rs(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function os(e){return qi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function vc(e){let t=zh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Fh=`required non-empty string up to ${ut} characters`,Sc="must be a non-empty array of unique non-empty strings",Gh="required non-empty array of non-empty strings";function zh(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!gc(e))return{errors:[fc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ns(Bh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),pc]:t,ruleNames:new Set(Ec(e).map((n)=>n.toLowerCase()))}}function Ec(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Bh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...$h(e.allowed_commands),...Uh(e.rules,t),...Kh(e.tests),...qh(e),...Yh(e)]}function $h(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Uh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?jh(n,["rules",r]):Hh(n,["rules",r])}),...yc(e)]}function Hh(e,t){return[...xc(e.name,t),...Rc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),..._c(e.reason,t),...wc(e.intent,t)]}function jh(e,t){return[...xc(e.name,t),...Rc(e.command,t),..._c(e.reason,t),...wc(e.intent,t),...Vh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function xc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function Rc(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function _c(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],Fh)]}function wc(e,t){return e===void 0||os(e)?[]:[_([...t,"intent"],ts)]}function Vh(e,t){if(!dt(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],Gh,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],Sc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],Sc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Kh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function qh(e){if(!Array.isArray(e.tests))return[];let t=new Set(Ec(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Yh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Oc(e,t){let n=uc(e,t),r;try{r=tc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return oy(n,f.message);throw f}let o=es(n.userConfigTarget),i=r?{config:null,errors:[]}:es(n.projectConfigTarget),s=Ic(n.userConfigPath,o.errors),a=Ic(n.projectConfigPath,i.errors),l=new Set,c=o.config?Ac(o.config,zr(n.userConfigPath),"user",n.userScope,l):kc(),u=i.config?Ac(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):kc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Pc(c.rules,m),...Pc(u.rules,d)],transparent_wrappers:ny(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Tc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?ry(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Tc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Ac(e,t,n,r=Rt(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Xh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Zh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Zh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Xh(e,t,n){let r=Jh(e),o=dc(t,r),i=ey(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Qh(e)}`]};let s=ty(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Jh(e){return Dr(e)?ji(e).name:e}function Qh(e){return Dr(e)?`run ${cc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ey(e,t){try{return{content:Mr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function ty(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:vc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ny(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Pc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Tc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function ry(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ic(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function oy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function kc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as yy,readFileSync as by}from"fs";var Mc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],is=new Set(Mc.map((e)=>e.id)),Br=Mc,iy=new Map(Br.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:iy.get(e)??"manual_only"}}var ss=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},sy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],ay=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],as=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...ay.flatMap((e)=>sy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Dc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],ly=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ls=Dc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),cs=Dc.flatMap((e)=>ly.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Fn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},us=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ds=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],cy=[...ss,$r,...as,...ls,...cs,Fn,...us,...ds,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ms=new Set(cy.map((e)=>e.id));import{isAbsolute as fs,join as uy,normalize as dy,sep as jr}from"path";var Nc=process.platform==="win32",my=/[*?]/;function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ps(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!fs(n))return"must be an absolute path or start with ~/";return zn(n,t)}function gs(e,t){let n=Lc(e,t);if(n===null)return"must be a non-empty path string";if(!fs(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var fy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",py="cannot cover the guard's own configuration";function Lc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Gn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function hs(e,t){let n=Lc(e,t);if(n===null)return"must be a non-empty path string";if(my.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!fs(n))return null;if(zn(n,t)!==null)return fy;return gy(n,t)?py:null}function gy(e,t){let n=Vr(e),r=Vr(uy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Vr(e),r=Vr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Vr(e){let t=dy(e);if(Nc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Nc?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Wc=30,Kr=1,qr=365;function Fc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Gc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Gc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Gc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function zc(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Bc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:zc(e,t)})}var $c={standard:0,strict:1,paranoid:2};function jc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ys(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ys(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ys(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:hy(e,t)}}function ys(e,t){return[...new Set([...e,...t??[]])]}function hy(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&$c[n]<$c[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Uc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Uc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?Hc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Hc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Uc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Hc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Ss=new Set(["standard","strict","paranoid"]),Yc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Wc}};function Zc(e,t){let n=Py(en(e,t),e.home),r=Xr(Ln(t.cwd),e.home),o=Sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?jc(n.gui??Yc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?Cs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Cy="project policy audit settings are ignored; audit is user scope only";function Sy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Ss.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Vc({overrides:Xc(n.overrides,Qt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Zr(o.overrides,is,Qc,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,ps,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Zr(i.overrides,ms,eu,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,gs,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,hs,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:Vc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Cy]}}function Xc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],vs));return[]}))}function Vc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},vs="must be a boolean",Es="must be an object if provided",Jc=`must be an integer between ${Kr} and ${qr}`,Qc={path:["destructive_command_protection","overrides"],label:"destructive command"},eu={path:["secret_protection","overrides"],label:"secret protection"},vy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ey(e,t){let n=[];return{policy:tu(e,t,(o)=>{n.push(o)}),issues:n}}function xy(e,t){return tu(e,t,Tt)}function tu(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Yr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return nu(e,vy,[],n),{version:1,safety:{level:Ry(r.level,n),overrides:Xc(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:bs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:bs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Zr(s.overrides,is,Qc,n),allow_paths:rn(s.allow_paths,ps,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:bs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Zr(a.overrides,ms,eu,n),deny_paths:rn(a.deny_paths,gs,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,hs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:_y(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Es)),{};return nu(e,n,t,r),e}function nu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Ry(e,t){if(e===void 0)return"standard";if(Ss.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function bs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,vs));return n}function _y(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Kr&&e<=qr))t(_(["audit","retention_days"],Jc));return Fc(e)}function Zr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Es)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Yr(){return structuredClone(Yc)}function Xr(e,t){if(!yy(e))return{exists:!1,policy:Yr(),errors:[]};try{let n=by(e,"utf-8");if(!n.trim())return{exists:!0,policy:Yr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ey(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Ay(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Yr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var wy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Es,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[vs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Jc,`not an integer between ${Kr} and ${qr}`]]);function Ay(e){let t=rs(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=wy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Py(e,t){let n=Xr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:qc(),errors:[]};let o=xy(r,t);return{policy:Cs(o),gui:o,errors:[],levelPresent:Kc(r)}}if(n.parsed===void 0)return{policy:qc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Cs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Kc(n.parsed)}}function Kc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Ss.has(t.level)}function ru(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function qc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:ru({}),denyPaths:[],allowPaths:[]}}}function Cs(e){return{safety:Ty(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:ru(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ty(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function ou(e,t){let n=Oc(e,t),r=Zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...My(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Dy(o,Iy(n,r),s,r.policyScopes)}function Iy(e,t){let n=Oy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Ny(e.errors.length>0?ky(e.errors):void 0,e.warnings.length>0?Rs(e.warnings.join("; ")):void 0,n)}}function ky(e){return`${Rs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Oy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function My(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Dy(e,t,n=Object.freeze({}),r){let o=xs(structuredClone(e)),i=r?{policyScopes:xs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function xs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))xs(t);return Object.freeze(e)}function Ny(...e){return Rs(e.filter((t)=>!!t).join("; "))}function Rs(e){return/[.!?]$/.test(e)?e:`${e}.`}function iu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:_s(t.fail_closed,e.strict,"strict"),paranoid_rm:_s(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:_s(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Bc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Di({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function _s(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ly=/^[A-Za-z_][A-Za-z0-9_]*=/;function Jr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Jr(e.words[0],"time")?1:0,n=t===1&&Jr(e.words[t],"-p")?t+1:t,r=t===1&&Jr(e.words[n],"--")?n+1:n,o=Jr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ly.test(s.text));return i?.provenance==="literal"?i.text:void 0}var mt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Qr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Wy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function eo(e,t,n){e.push(n),t.reset()}function to(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ws(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return ws({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Wy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function As(e,t,n){if(t>=n||au(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!au(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=su(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=su(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ps(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Fy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Gy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function su(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function au(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Fy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Gy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var du=new Set(["&&","||","|","|&"]);function mu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=oo(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:ao(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function oo(e,t,n,r,o,i,s){let a=[],l=[],c=Qr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);eo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),uu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(so(f)){if(f===`
+`)}function yl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function An(e={}){return{reason:wn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function bl(e){return kp({...e,redact:lt})}function Cl(e){return lt(e instanceof Error?e.message:String(e))}import{types as Op}from"util";var Mp=new Set(["applypatch","patch"]),Dp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Np=new Set(["grep","grepsearch","rg"]),Lp=new Set(["find","findbyname","glob"]),Wp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Fp=new Set(["command","diff","input","patch","patchtext"]),Sl=new TextEncoder,Gp=new TextDecoder,zp=/\s/,Bp=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function _l(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Ar(e){return Wp.has(_l(e))}function xi(e){let t=_l(e);if(Mp.has(t))return"patch";if(Np.has(t))return"grep";if(Lp.has(t))return"glob";if(Dp.has(t))return"path";return"unknown"}function In(e){if(!e||typeof e!=="object")return;Ol(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function wl(e,t){return Al(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Al(e,t,n,r){let o=kl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Al(a,t,n,r+1);return typeof a==="string"&&t.has(Pl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Pl(e){return e.replace(/-/g,"_").toLowerCase()}function Tl(e){return Il(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Up)}function Il(e,t,n,r){let o=kl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Il(a,o.array?t:Fp.has(Pl(s)),n,r+1));return n.ancestors.delete(o.object),i}function $p(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)je()}function kl(e,t,n){if($p(e,t,n),!e||typeof e!=="object")return null;let r=Ol(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Ol(e){if(Op.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Up(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Hp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Si(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Si(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ei(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Si(c))}return t}function Hp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Si(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Rl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Rl(n[1]);if(e.startsWith("diff --git "))return jp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return xl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return xl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Jp(i[1]);return[]}function jp(e){let t=Vp(e);if(t.length===2&&t[0]&&t[1])return Ei(t[0],t[1]);let n=Kp(e);return n?Ei(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Vp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=Ml(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function Kp(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Bp)je();if(qp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function qp(e,t,n,r,o){if(vi(e,t,n,r,o))return!0;let i=vl(e,"/",t,n),s=vl(e,"/",r,o);if(i<=t||s<=r)return!1;if(vi(e,t,i,r,s))return!1;return vi(e,i+1,n,s+1,o)}function vi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function vl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&zp.test(e)}function Ml(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Gp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Sl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Sl.encode(Yp(s[0]??""))),o+=2}return null}function Yp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Zp(e){return Tn(Qp(e))}function Ei(e,t){if(e==="/dev/null")return El(t);if(t==="/dev/null")return El(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Tn);let n=Xp(e,t)??(e===t?Dl(e):null);return[e,t,...n?[n]:[]].flatMap(Tn)}function El(e){let t=Dl(e);return[e,...t?[t]:[]].flatMap(Tn)}function Dl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Xp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function xl(e){return Zp(wr(e,!0))}function Jp(e){return Tn(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Ml(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Qp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Tn(e){return e===""||e==="/dev/null"?[]:[e]}function Rl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ti,relative as lg,resolve as Bl,sep as cg}from"path";import{basename as Wl,dirname as eg,isAbsolute as tg,join as ng,normalize as rg,resolve as Nl}from"path";var og=256,Pr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=_i(e,o+2),a=ig(e,o,t);if(a===null){if(Pr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=sg(l,t,n),o=a+1;continue}let i=_i(e,o+1);if(!i){r+="$",o++;continue}r+=wi(i,n)??`$${i}`,o+=i.length+1}return r}function ig(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function sg(e,t,n){let r=e.slice(2,-1),o=_i(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return wi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Pr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Pr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=wi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function _i(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function wi(e,t){if(!Pr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Fl(n,i);let s=t.realpath(i);if(s!==null)return Ll(n,e,s,o);let a=eg(i);if(a===i||o.length>=og)return Ll(n,e,i,o);o.push(Wl(i)),i=a}}function Ll(e,t,n,r){let o=r.length===0?n:ng(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function ag(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Fl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Fl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=zl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function Gl(e,t,n,r,o){let i=zl(e,t,n);if(!i)return null;if(o(Wl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=ag(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function zl(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Nl(r,o.slice(2)):o,s=Ce(i);return rg(tg(s)?s:Nl(t,s))}function $l(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Pi(i,n));if(!r[0])return;let o=Pi(Ti(e)?e:Bl(r[0],e),n)[0];if(!o)return;return r.some((i)=>ug(o,i))?o:void 0}function Ul(e,t,n){if(Ze(e))return;return Pi(Ti(e)?e:Bl(t,e),n)[0]}function Pi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function ug(e,t){let n=lg(t,e);return n===""||n!==".."&&!n.startsWith(`..${cg}`)&&!Ti(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Fg,realpathSync as Gg,statSync as zg}from"fs";import{homedir as Bg,tmpdir as $g}from"os";import{statSync as Ng}from"fs";import{join as Lg}from"path";import{spawnSync as dg}from"child_process";import{existsSync as On,lstatSync as mg,readFileSync as Mn,realpathSync as Zt,statSync as kn}from"fs";import{dirname as Ii,isAbsolute as ki,join as Xt,resolve as Tr}from"path";var fg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],pg=5000;function jl(e,t=kg(),n=pg){let r=gg(e),o=r===null?null:hg(r);if(r===null||o===null)return null;let i=Tg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function gg(e){try{let t=Zt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function hg(e){let t=Pg(e);if(!t)return null;try{let n=mg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Oi(t);if(!r?.commonDir)return null;if(!Cg(r.gitDir,t))return null;return Sg(r.gitDir,Ii(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Oi(e){try{let t=yg(e);if(!t)return null;let n=Zt(ki(t)?t:Tr(Ii(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:bg(n)}}catch{return null}}function yg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function bg(e){try{let t=Mn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(ki(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Cg(e,t){let n=vg(e);return n===null?!1:Vl(e,n,t)}function Sg(e,t){let n=Eg(e);return n===null?!0:Vl(e,n,t)}function vg(e){let t=Xt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Eg(e){let t=Xt(e,"config.worktree");return On(t)?Rg(t):null}function Vl(e,t,n){try{return xg(ki(t)?t:Tr(e,t),n)}catch{return!1}}function xg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Hl(Zt.native(e))===Hl(Zt.native(t))}function Hl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Rg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=_g(s[1]??"")}return r}function _g(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Ag(t.slice(1,-1))}var wg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Ag(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:wg[n]??t)}function Pg(e){try{return Mi(Zt(e))}catch{return null}}function Mi(e){let t=e;while(!0){let n=Xt(t,".git");if(On(n))return n;let r=Ii(t);if(r===t)return null;t=r}}function Tg(e,t,n,r){if(Ig(t))return!0;if(n===null)return!0;let o=dg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Og(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Kl(o.stdout.trim())}function Ig(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>Mg(t))}function kg(){return fg.find((e)=>On(e))??null}function Dn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Og(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Dn(t)))}function Mg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Dg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Kl(c)}return r}function Dg(e){return e==="include"||e.startsWith("includeif ")}function Kl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ql(e,t){if(e==="")return null;let n=be(),r=Mi(se(e,e,t,n)),o=r?Wg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Wg(e,t,n,r){try{let o=se(e,t,n,r),i=Ng(e),s=i.isFile()?o:null,a=i.isFile()?Oi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt(Lg(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var Ug={realpath:(e)=>{try{return Gg(e)}catch{return null}},entryKind:(e)=>{let t=Fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return zg(e).isDirectory()}catch{return!1}}};function Zl(){return Hg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||Bg()),tmpdir:$g(),paths:Ug})}function Hg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Yl(n,i,()=>ql(i,o)),worktreeFacts:(i)=>Yl(r,i,()=>jl(i)),...t};return o}function Yl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function jg(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function Vg(e){let t=Wi(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function Kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Xl(e){return Kg(Wi(Q.auditScope,e))==="all"}function Ni(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Li(e={},t){let n=e.safety?.level??"standard",r=Vg(t),o=jg(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ni(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?Di(e,t):Wi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Di(e,t){return t.get(e)}function Wi(e,t){let n=Di(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Di(e.legacyName,t);return}import{dirname as zr}from"path";import{closeSync as qg,constants as Jl,fstatSync as Yg,fsyncSync as yP,lstatSync as zi,mkdirSync as bP,openSync as Zg,readdirSync as CP,readFileSync as Xg,realpathSync as Bi,renameSync as SP,rmdirSync as vP,statSync as Jg,unlinkSync as EP,writeFileSync as xP}from"fs";import{isAbsolute as Ql,join as $i,normalize as Qg,parse as Gi,relative as Ui,resolve as Hi,sep as ji}from"path";function Fi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var eh=Symbol("PolicyFilesystemScope"),th=Symbol("PolicyFilesystemTarget"),nh=Jl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Rt(e,t){return{[eh]:!0,root:Hi(e),label:t}}function ec(e,t){let n=Qg(t);if(t===""||Ql(t)||n===".."||n.startsWith(`..${ji}`))throw new ae(e.label);return{[th]:!0,scope:e,relativePath:n,path:$i(e.root,n)}}function Nn(e,t){return ec(e,Ui(e.root,Hi(t)))}function tc(e,t="rules policy"){let n=Hi(e),r=Gi(n).dir;return ec(Rt(r,t),Ui(r,n))}function Mr(e){return rc(e.scope.label,()=>{if(!Or(e))return null;let t=Zg(e.path,Jl.O_RDONLY|nh);return rh(t,()=>{let n=Yg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Xg(t,"utf-8"),o=zi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function nc(e,t){if(e.path===t.path)return!0;return rc(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>$i(Bi(Gi(r).dir),Gi(r).base);return n(e.path)===n(t.path)})}function rc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function rh(e,t){try{return t()}finally{qg(e)}}function Or(e,t="file"){let n=oh(e.scope);if(!n)return!1;let r=e.relativePath.split(ji);for(let o of r.keys()){let i=$i(e.scope.root,...r.slice(0,o+1)),s=zi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);ih(n,Bi(i),e.scope.label)}return!0}function oh(e){if(!zi(e.root,{throwIfNoEntry:!1}))return null;if(!Jg(e.root).isDirectory())throw new ae(e.label);return Bi(e.root)}function ih(e,t,n){let r=Ui(e,t);if(r===".."||r.startsWith(`..${ji}`)||Ql(r))throw new ae(n)}import{dirname as wt,isAbsolute as uh,join as Pt,relative as dh,resolve as At,sep as mh}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,oc="rulebook.json",ic=".cc-safety-net/rules";var sc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var sh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,ah=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),lh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),AP=new RegExp(`^${ah}/(${_t.source.slice(1,-1)})/${lh}$`);function ch(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function ac(e){if(Dr(e))try{return Vi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function Vi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(sc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!sh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:ch(o),name:o}}function Dr(e){return sc.test(e)}var lc="rule.json",Nr="policy.json",cc=".cc-safety-net",fh="rules",ph="CC_SAFETY_NET_HOME",uc="`cc-safety-net rule update`";function gh(e){return At(e,ic)}function hh(e){return Pt(gh(e),lc)}function Ln(e){return Pt(At(e),cc,Nr)}function Ki(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):Pt(yh(e),fh))}function yh(e){let t=e.env.get(ph);return t?At(Ce(t)):Pt(e.home,cc)}function bh(e,t={}){return Pt(Ki(e,t),lc)}function en(e,t={}){return Pt(wt(Ki(e,t)),Nr)}function dc(e,t){let n=t.userConfigPath??bh(e,t),r=t.projectConfigPath??hh(t.cwd),o=Ch(e,t),i=Sh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function Ch(e,t){let n=t.userConfigPath?wt(wt(At(t.userConfigPath))):wt(At(t.userConfigDir??Ki(e,t)));return Rt(n,"user policy")}function Sh(e,t){let n=At(t),r=At(e),o=dh(n,r);if(o!==".."&&!o.startsWith(`..${mh}`)&&!uh(o))return Rt(n,"project policy");return Rt(wt(wt(r)),"project policy")}function mc(e,t){return Pt(e,t,oc)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),fc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var pc="Rulebook exceeds CC Safety Net's safe validation limits.",gc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function hc(e){if(qi(e.allowed_commands,Oe.maxAllowedCommands)||qi(e.rules,Oe.maxRules)||qi(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function qi(e,t){return Array.isArray(e)&&e.length>t}var Yi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Zi=64,Xi="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var vh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ji=new Set(["--init-file","--rcfile"]);function Qi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!vh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ji.has(l)&&!s.includes("="))i++;continue}let a=Qi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Fr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Eh(e))Wn(n,t);return t.inSingle||t.inDouble}function Eh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var es=new Set(["rm","find","xargs","parallel"]),xh=new Set(["git","busybox",...es,...J,...fc,...we]),Rh=new Set(["python","node","ruby","perl"]);function yc(e){let t=O(e);return xh.has(t)||Me(t)}function Me(e){return Rh.has(_h(e))}function _h(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function ts(e){try{let t=Mr(wh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Th(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function wh(e){return typeof e==="string"?tc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function bc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ns=`must be one of ${Yi.join(", ")}`,Ah=/^[^/]+\/[^/]+$/,Ph=["version","rules","overrides","transparent_wrappers"];function Th(e){let t=Ih(e);return{errors:rs(Gh(t,Ph,(n)=>n.kind==="custom"),": "," "),sources:Fh(e,t)}}function Ih(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Zi;return[...e.version===1?[]:[_(["version"],"must be 1")],...kh(e.rules,t),...Dh(e.overrides),...Lh(e.transparent_wrappers),...t?[]:Mh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ah.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Wh(e.transparent_wrappers)]}function kh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Cc(e,Zi)?[_(["rules"],Xi)]:[]];if(t)return[{path:["rules"],message:Xi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Oh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Cc(e,t){let n=Sc(e);return n!==void 0&&!(n<=t)}function Oh(e,t){let n=Sc(e);return n!==void 0&&!(n>=t)}function Sc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Mh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=ac(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Dh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Nh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||is(n.intent)?[]:[_(["overrides",t,"intent"],ns)]]})}function Nh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Cc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Lh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Wh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(yc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Fh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Gh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function rs(e,t,n){return[...new Set(e.map((r)=>{let o=os(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function os(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function is(e){return Yi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e){let t=$h(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var zh=`required non-empty string up to ${ut} characters`,vc="must be a non-empty array of unique non-empty strings",Bh="required non-empty array of non-empty strings";function $h(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!hc(e))return{errors:[pc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...rs(Uh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),gc]:t,ruleNames:new Set(xc(e).map((n)=>n.toLowerCase()))}}function xc(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Uh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Hh(e.allowed_commands),...jh(e.rules,t),...Yh(e.tests),...Zh(e),...Xh(e)]}function Hh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function jh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?Kh(n,["rules",r]):Vh(n,["rules",r])}),...bc(e)]}function Vh(e,t){return[...Rc(e.name,t),..._c(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...wc(e.reason,t),...Ac(e.intent,t)]}function Kh(e,t){return[...Rc(e.name,t),..._c(e.command,t),...wc(e.reason,t),...Ac(e.intent,t),...qh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Rc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function _c(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function wc(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],zh)]}function Ac(e,t){return e===void 0||is(e)?[]:[_([...t,"intent"],ns)]}function qh(e,t){if(!dt(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],Bh,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],vc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],vc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Yh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Zh(e){if(!Array.isArray(e.tests))return[];let t=new Set(xc(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Xh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Mc(e,t){let n=dc(e,t),r;try{r=nc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return sy(n,f.message);throw f}let o=ts(n.userConfigTarget),i=r?{config:null,errors:[]}:ts(n.projectConfigTarget),s=kc(n.userConfigPath,o.errors),a=kc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Pc(o.config,zr(n.userConfigPath),"user",n.userScope,l):Oc(),u=i.config?Pc(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):Oc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Tc(c.rules,m),...Tc(u.rules,d)],transparent_wrappers:oy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Ic(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?iy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Ic(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Pc(e,t,n,r=Rt(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Qh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Jh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Jh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Qh(e,t,n){let r=ey(e),o=mc(t,r),i=ny(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${ty(e)}`]};let s=ry(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function ey(e){return Dr(e)?Vi(e).name:e}function ty(e){return Dr(e)?`run ${uc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ny(e,t){try{return{content:Mr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function ry(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Ec(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function oy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Tc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Ic(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function iy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function kc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function sy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Oc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as by,readFileSync as Cy}from"fs";var Dc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ss=new Set(Dc.map((e)=>e.id)),Br=Dc,ay=new Map(Br.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:ay.get(e)??"manual_only"}}var as=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},ly=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],cy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ls=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...cy.flatMap((e)=>ly.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Nc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],uy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],cs=Nc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),us=Nc.flatMap((e)=>uy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Fn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ds=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ms=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],dy=[...as,$r,...ls,...cs,...us,Fn,...ds,...ms,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),fs=new Set(dy.map((e)=>e.id));import{isAbsolute as ps,join as my,normalize as fy,sep as jr}from"path";var Vr=process.platform==="win32",Lc=/[*?]/;function gs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Vr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Lc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function hs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!ps(n))return"must be an absolute path or start with ~/";return zn(n,t)}function ys(e,t){let n=Wc(e,t);if(n===null)return"must be a non-empty path string";if(!ps(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var py="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",gy="cannot cover the guard's own configuration";function Wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=Vr?n.replaceAll("\\","/"):n;return Gn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function bs(e,t){let n=Wc(e,t);if(n===null)return"must be a non-empty path string";let r=gs(n)?.root??n;if(Lc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!ps(r))return null;if(zn(r,t)!==null)return py;return hy(r,t)?gy:null}function hy(e,t){let n=Kr(e),r=Kr(my(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Kr(e),r=Kr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Kr(e){let t=fy(e);if(Vr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Vr?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Fc=30,qr=1,Yr=365;function Gc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var zc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(zc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(zc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Bc(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function $c(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Bc(e,t)})}var Uc={standard:0,strict:1,paranoid:2};function Vc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:yy(e,t)}}function Cs(e,t){return[...new Set([...e,...t??[]])]}function yy(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&Uc[n]<Uc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Hc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Hc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?jc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?jc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Hc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function jc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Es=new Set(["standard","strict","paranoid"]),Zc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Fc}};function Xc(e,t){let n=Ty(en(e,t),e.home),r=Jr(Ln(t.cwd),e.home),o=vy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Vc(n.gui??Zc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?vs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Sy="project policy audit settings are ignored; audit is user scope only";function vy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Es.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Kc({overrides:Jc(n.overrides,Qt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Xr(o.overrides,ss,eu,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,hs,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Xr(i.overrides,fs,tu,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,ys,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,bs,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:Kc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Sy]}}function Jc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],xs));return[]}))}function Kc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},xs="must be a boolean",Rs="must be an object if provided",Qc=`must be an integer between ${qr} and ${Yr}`,eu={path:["destructive_command_protection","overrides"],label:"destructive command"},tu={path:["secret_protection","overrides"],label:"secret protection"},Ey=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function xy(e,t){let n=[];return{policy:nu(e,t,(o)=>{n.push(o)}),issues:n}}function Ry(e,t){return nu(e,t,Tt)}function nu(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Zr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return ru(e,Ey,[],n),{version:1,safety:{level:_y(r.level,n),overrides:Jc(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:Ss(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ss(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Xr(s.overrides,ss,eu,n),allow_paths:rn(s.allow_paths,hs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ss(a.enabled,["secret_protection","enabled"],!0,n),overrides:Xr(a.overrides,fs,tu,n),deny_paths:rn(a.deny_paths,ys,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,bs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:wy(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Rs)),{};return ru(e,n,t,r),e}function ru(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function _y(e,t){if(e===void 0)return"standard";if(Es.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ss(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,xs));return n}function wy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=qr&&e<=Yr))t(_(["audit","retention_days"],Qc));return Gc(e)}function Xr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Rs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Zr(){return structuredClone(Zc)}function Jr(e,t){if(!by(e))return{exists:!1,policy:Zr(),errors:[]};try{let n=Cy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Zr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=xy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Py(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Zr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Ay=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Rs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[xs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Qc,`not an integer between ${qr} and ${Yr}`]]);function Py(e){let t=os(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Ay.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Ty(e,t){let n=Jr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:Yc(),errors:[]};let o=Ry(r,t);return{policy:vs(o),gui:o,errors:[],levelPresent:qc(r)}}if(n.parsed===void 0)return{policy:Yc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:vs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:qc(n.parsed)}}function qc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Es.has(t.level)}function ou(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Yc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:ou({}),denyPaths:[],allowPaths:[]}}}function vs(e){return{safety:Iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:ou(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function iu(e,t){let n=Mc(e,t),r=Xc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Dy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ny(o,ky(n,r),s,r.policyScopes)}function ky(e,t){let n=My(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Ly(e.errors.length>0?Oy(e.errors):void 0,e.warnings.length>0?ws(e.warnings.join("; ")):void 0,n)}}function Oy(e){return`${ws(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function My(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Dy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ny(e,t,n=Object.freeze({}),r){let o=_s(structuredClone(e)),i=r?{policyScopes:_s(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function _s(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))_s(t);return Object.freeze(e)}function Ly(...e){return ws(e.filter((t)=>!!t).join("; "))}function ws(e){return/[.!?]$/.test(e)?e:`${e}.`}function su(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:As(t.fail_closed,e.strict,"strict"),paranoid_rm:As(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:As(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:$c(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ni({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function As(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Wy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Qr(e.words[0],"time")?1:0,n=t===1&&Qr(e.words[t],"-p")?t+1:t,r=t===1&&Qr(e.words[n],"--")?n+1:n,o=Qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Wy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var mt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function eo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Fy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function to(e,t,n){e.push(n),t.reset()}function no(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ps(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return Ps({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Fy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ts(e,t,n){if(t>=n||lu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!lu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=au(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=au(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Is(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Gy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?zy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function au(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function lu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Gy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function zy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var mu=new Set(["&&","||","|","|&"]);function fu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=io(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:lo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function io(e,t,n,r,o,i,s){let a=[],l=[],c=eo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);to(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),du(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(ao(f)){if(f===`
 `||f==="\r"){m();let v=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!du.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Ps(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?sb(e,d,n):void 0;if(p){if(Is(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!Ts(o))return sn(a,l,d,"word-limit",r.maxWords);let v=oo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=lu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return ro(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=io(e,d);if(g){if(m(),!Su(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Ky(e,d,n))&&c.start===-1){if(Is(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let v=f==="("?")":"}",T=oo(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=lu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return ro(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Uy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||so(q)||!!io(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?As(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?ks(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return ro(a,l,N.next);if(!Ts(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ue=N?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...By(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ue,d=ue;continue}if(c.start===-1)Is(a,l);let y=ks(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return ro(a,l,y.next);let S=Zy(c.words)?tb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return sn(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!Ts(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),uu(a,l),l.push(...ab(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function lu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ao(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ks(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||so(f)||(f===";"||f==="|"||f==="&")&&io(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=zy(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=Hy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?lo(e,a,n,r,o,i):null;if(g){let h=fu(g,u,m);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=hu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:Vy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function zy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!mu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Is(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?ab(e,d,n):void 0;if(p){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!ks(o))return sn(a,l,d,"word-limit",r.maxWords);let v=io(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=cu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return oo(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=so(e,d);if(g){if(m(),!vu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&qy(e,d,n))&&c.start===-1){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let v=f==="("?")":"}",T=io(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=cu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return oo(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Hy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||ao(q)||!!so(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?Ts(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ms(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return oo(a,l,N.next);if(!ks(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ue=N?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...$y(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ue,d=ue;continue}if(c.start===-1)Os(a,l);let y=Ms(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return oo(a,l,y.next);let S=Xy(c.words)?nb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return sn(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!ks(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),du(a,l),l.push(...lb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function cu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ms(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ao(f)||(f===";"||f==="|"||f==="&")&&so(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=By(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=jy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?co(e,a,n,r,o,i):null;if(g){let h=pu(g,u,m);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=yu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:Ky(e,t,a)),nested:u,issues:m,next:a,limited:d}}function By(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
 `){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Os(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=lo(e,m,n,r,o,i);if(f){let p=fu(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=hu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function lo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Os(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:ib(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<f){let x=lo(e,T,f,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ao(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=oo(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ao([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function By(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?lo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function fu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Os(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Ds(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=co(e,m,n,r,o,i);if(f){let p=pu(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=yu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Ds(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:sb(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<f){let x=co(e,T,f,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=io(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function $y(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function pu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Ds(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ps(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=pu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=$y(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=As(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function $y(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=pu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function pu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!lb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function io(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Uy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function so(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function gu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Hy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=jy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function jy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return no(e,t+1,n,16,2,t+1);if(r==="u")return no(e,t+1,n,16,4,t+1);if(r==="U")return no(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return no(e,t,n,8,3,t+1);return{text:r,next:t+1}}function no(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ao(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function hu(e,t,n,r,o){let i=gu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Vy(e,t,n){let r=to(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",g=Os(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=gu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Ky(e,t,n){return t+1>=n||so(e[t+1]??"")||io(e,t+1)!==null}var qy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Yy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Zy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Xy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Xy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Jy(e,t);if(n==="env")return Qy(e,t);if(n==="sudo")return eb(e,t);return}function Jy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Qy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(qy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function eb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Yy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function yu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=bu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function tb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=bu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function bu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>cu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=cu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...nb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function cu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&ob(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:rb(e,r)}}function nb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function rb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function ob(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Cu(e,t){let n=`x${e}`,r=ks(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function ib(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ro(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ts(e){return e.used++,e.used<=e.max}function sb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function ab(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Su(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function uu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!du.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Is(e,t){if(!Su(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function lb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Eu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),cb=new Set(["gc","cat","type","cp","mv","rm"]),xu=["-rec","-for","-path","-literalpath","-whatif"],ub=/^\$env:\w/i,db=/^(?:\$\{?\w+\}?|~)\\./;function Ru(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Eu].some((o)=>n.includes(o))&&!(n.includes("rm")&&xu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!mb(n))return!1;let r=Ls(e,t);if(_u(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ns(r).some(fb)}function _u(e){return e.nodes.some((t)=>{if(t.kind==="group")return _u(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function mb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function fb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Eu.has(n))return!0;let r=e.slice(t+1);if(n&&cb.has(n)&&r.some(pb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return xu.some((s)=>i.startsWith(s))})}function pb(e){return ub.test(e)||db.test(e)}function Ls(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ws(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Cb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ws(e,t,n,r,o,i=!1){let s=[],a=[],l=Qr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};eo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=bb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`?a+2:a+1,m=Is(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=gu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Uy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Ts(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Uy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=gu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function gu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!cb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function so(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Hy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ao(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function hu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function jy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return ro(e,t+1,n,16,2,t+1);if(r==="u")return ro(e,t+1,n,16,4,t+1);if(r==="U")return ro(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return ro(e,t,n,8,3,t+1);return{text:r,next:t+1}}function ro(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function yu(e,t,n,r,o){let i=hu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Ky(e,t,n){let r=no(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",g=Ds(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=hu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function qy(e,t,n){return t+1>=n||ao(e[t+1]??"")||so(e,t+1)!==null}var Yy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Zy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Xy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Jy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Jy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Qy(e,t);if(n==="env")return eb(e,t);if(n==="sudo")return tb(e,t);return}function Qy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function eb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Yy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function tb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Zy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function bu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Cu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Su(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function nb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Cu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Su(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function Cu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>uu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=uu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...rb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function uu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&ib(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:ob(e,r)}}function rb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function ob(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function ib(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Su(e,t){let n=`x${e}`,r=Ms(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function sb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function oo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ks(e){return e.used++,e.used<=e.max}function ab(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function lb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function vu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function du(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!mu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Os(e,t){if(!vu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function cb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var xu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),ub=new Set(["gc","cat","type","cp","mv","rm"]),Ru=["-rec","-for","-path","-literalpath","-whatif"],db=/^\$env:\w/i,mb=/^(?:\$\{?\w+\}?|~)\\./;function _u(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...xu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Ru.some((o)=>n.includes(o)))&&!n.includes("<#")&&!fb(n))return!1;let r=Fs(e,t);if(wu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ws(r).some(pb)}function wu(e){return e.nodes.some((t)=>{if(t.kind==="group")return wu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function fb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function pb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&xu.has(n))return!0;let r=e.slice(t+1);if(n&&ub.has(n)&&r.some(gb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Ru.some((s)=>i.startsWith(s))})}function gb(e){return db.test(e)||mb.test(e)}function Fs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Gs(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Sb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Gs(e,t,n,r,o,i=!1){let s=[],a=[],l=eo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};to(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=Cb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
 `){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Ms(e,d,y)),d=y;continue}d++;continue}let g=Pu(e,d);if(g){m(),s.push(Ms(e,d,d+g.length)),d+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Au(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ws(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ms(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?vu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(ws({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=vu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function vu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let g=gb(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ds(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Pu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:hb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function gb(e,t,n,r,o){let i=wu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Au(r.maxDepth)],nodes:[]}),next:a};let l=Ws(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function wu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ds(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ds(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ds(r)}}return t}function hb(e,t,n){let r=to(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=wu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=yb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function yb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Au(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ns(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ns(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ns)]})}function Pu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function bb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Cb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ms(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=mt){if(t==="powershell"||t==="auto"&&Ru(e.slice(0,n.maxInputLength),n))return Ls(e,n);return mu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function co(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Fs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Gs(e){return e===`
+`?d+2:d+1;s.push(Ns(e,d,y)),d=y;continue}d++;continue}let g=Tu(e,d);if(g){m(),s.push(Ns(e,d,d+g.length)),d+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Pu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Gs(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ns(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?Eu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ps({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Eu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Eu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let g=hb(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ls(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Tu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:yb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function hb(e,t,n,r,o){let i=Au(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Pu(r.maxDepth)],nodes:[]}),next:a};let l=Gs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Au(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ls(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ls(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ls(r)}}return t}function yb(e,t,n){let r=no(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Au(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=bb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function bb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Pu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ws(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ws(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ws)]})}function Tu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Cb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Sb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ns(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=mt){if(t==="powershell"||t==="auto"&&_u(e.slice(0,n.maxInputLength),n))return Fs(e,n);return fu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function uo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function zs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Bs(e){return e===`
 `||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function Xe(e,t,n){return!It(b(e,t-1))&&j(e,t,n)&&!It(b(e,t+n.length))}function Je(e,t){return It(b(e,t-1))!==It(b(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function uo(e,t,n){let r=Fs(e,n);if(t==="rm")return Sb(r);if(t==="dd")return Eb(r);return Du(r,!0)}function mo(e,t,n){let r=Fs(e,n);if(t==="rm")return xb(r);if(t==="reset-hard")return Ou(r,"--ha","rd");if(t==="reset-merge")return Ou(r,"--me","rge");if(t==="clean")return Ab(r);if(t==="checkout")return Tb(r);if(t==="push-force")return Ib(r);if(t==="push-refspec")return kb(r);if(t==="push-delete")return Ob(r);if(t==="branch")return Mb(r);if(t==="tag")return Lb(r);if(t==="restore")return Wb(r);return Du(r,!1)}function Sb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(Xe(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=vb(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=Tu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Tu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function vb(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Tu(e,t,n){if(Iu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Iu(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Iu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function Eb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(Xe(e,n,"dd")){t=!0,n++;continue}if(!t||!Xe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function xb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=_b(e,o);if(s>=0){if(Rb(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Je(e,o+11)||zs(e,o,"recursive"),r||=j(e,o,"--force")&&Je(e,o+7)||zs(e,o,"force"),n&&r)return!0;o++}return!1}function zs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Je(e,t+r+2)}function Rb(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=ku(e,i,"recursive"),a=ku(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=wb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function ku(e,t,n){return j(e,t,`--${n}`)&&Je(e,t+n.length+2)||zs(e,t,n)}function _b(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function wb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&Je(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Ou(e,t,n){return Kn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function Ab(e){return Kn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=Vn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function fo(e,t,n){if(!Xe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Xe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=Pb(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:Xe(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function Pb(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function Tb(e){return Mu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Ib(e){return Kn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Nu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function kb(e){return Kn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Ob(e){return Kn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Mb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=fo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Vn(e,o,oe),s=Db(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Db(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&Nb(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Je(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function Nb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Lb(e){return Mu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Mu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=fo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Je(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=fo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Wb(e){let t=!1;for(let n=0;n<Y(e);n++){if(Gs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=fo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Du(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Gs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&Xe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Xe(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Nu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Je(e,o)?o:-1}function cn(e,t,n,r){return Nu(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&mo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Fb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Wu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Fu(t.nodes,r,i)}function Fu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Fu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Gb(r,t,n)})}function Gb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Fb.test(o.text));return e.words.every((o,i)=>o===t||Lu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Lu(o.target.raw,n.anchored,!0)))}function Lu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as zb,resolve as Gu}from"path";function qn(e,t,n,r){let o=zb(e)?Gu(e):t?Gu(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function zu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",$s=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Bb=new Set(["-p","--print"]),$b=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Ub=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Hb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),jb=new Map([["python",new Set(["m"])]]),Vb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Kb=new Set(["always","default","never"]),qb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Yb=/\\\r?\n/g,Zb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Bu(e){return go(e).code}function po(e){return go(e).sources}function $u(e){return Zb.get(Hs(e))??[]}function go(e){let t=Hs(e[0]??"");if(!$s.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&Bb.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Jb(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Qb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Xb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(Vb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&qb.has(s))||t==="python"&&!Kb.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(jb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if($b.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Ub.get(t)?.has(d)){if(m+1===s.length)i++;break}if(Hb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Xb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Us(e,t){return Hs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Hs(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function Jb(e,t){return $s.get(e)?.has(t)??!1}function Qb(e){return $s.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=nC(e,t);if(!Bs(r,t))return!1;xe(t,r);let o=tC(r);if(Bs(o,t))return!0;if(xe(t,o),!Uu.test(o))return!1;return!n||eC(r,t)}function eC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>Uu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:js(o,a)}});if(i.some((s)=>Vs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Bs(s.text,t))}function js(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Vs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Uu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function tC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Bs(e,t){if(uo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(uo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(uo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>mo(o,r))))}function nC(e,t){return xe(t,e),e.replace(Yb,"")}import{isAbsolute as gd,relative as hd}from"path";import{isAbsolute as Zu,parse as mC}from"path";import{dirname as rC,isAbsolute as oC,parse as iC,sep as sC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=oC(t)?iC(t).root:"",o=r||e;for(let i of lC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=rC(o);continue}let s=aC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function aC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${sC}${t}`}function lC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ks=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],cC=new Set(Ks),uC=1024,Hu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ju=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),dC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ho(e){return cC.has(e)}function qs(e){return ho(e)||Hu.has(e)||ju.has(e)||Dn(e)}function Qe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Vu(e,t){let n=Qe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=uC?{state:"valid",count:r}:{state:"invalid"}}function yo(e,t,n){let o=e.match(dC)?.[1];if(!o||!qs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Qe(o,t,n)??""}${e.slice(i+1)}`}}function Ku(e){return Yu(e,ju)}function qu(e){return Yu(e,Hu)}function Yu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ju=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Ju.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function bo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Qu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!Qu(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Xu(i),f=bo(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!pC(i)){let g=gC(dn(i),a,t.env)??yo(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=dn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=yC(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=SC(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=vC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Xu(i)===d)break}let u=bo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:fC(u.words,o)}}function fC(e,t){return e.some((n)=>!t.has(n))}function Xu(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function pC(e){return Ju.test(dn(e))}function gC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var hC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function yC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(hC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var bC=new Set(["-i","-0","--null"]),CC=new Set(["-u","--unset","-C","--chdir","-P"]);function SC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(bC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(CC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Zu(t))return null;let r=Zu(t)?mC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function vC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var EC=/['"\\$`{}#]/;function Co(e,t){if(e.some((r)=>EC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return So(e,t,n).tokens}function xC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=So(e,t,n),i=(o.envSplitValues??[]).flatMap(xC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function So(e,t,n,r){if(!Qu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Js=Symbol("adopt-as-operand"),RC=new Set(["env","sudo","command","builtin"]),_C=new Set(["&&","||","|&","|","&",";"]),wC=new Set(["<<","<<<",">|"]),AC=new Set(["|","|&"]),PC=/[*@#?$!_-]/,TC=/^\w+(?::\w+)*/,IC=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),kC=Object.freeze([]),OC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),MC=256,od=new WeakMap;function id(e,t){let n=t.status==="complete"?new Set(Xs(t)):new Set,r=LC(e,n);if(Fr(r))return vo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return vo("structural-limit",r,t);if(o.invalid)return vo("invalid",r,t);let s=vo("complete",r,t,o.assignmentFallbacks);return od.set(s,Object.freeze(i)),s}function xo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of sd(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=DC(a,s,n,r),c=a.length>0&&AC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Js){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Ro(e){return sd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function DC(e,t,n,r){let o=tr(e)?new Map([...t.variables,...NC(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function NC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function sd(e){return od.get(e)??IC}function LC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function vo(e,t,n,r=kC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>WC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function WC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We($C(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Eo("{"),...Mt(e.body,a),...s?[Eo("}")]:[]]:[Jn,We("("),...Mt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=VC(e,r.functions);if(o){if(r.depth>=mt.maxDepth||++r.flags.expansions>MC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ed(e,r),Eo(";"),...Mt(o,{...r,depth:r.depth+1}),Eo(";")]},...td(e,t,n,r)]}return[{start:e.span.start,events:ed(e,r)},...td(e,t,n,r)]}function ed(e,t){return[...e.words.map((n)=>({start:n.span.start,events:ld(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:FC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function FC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?ld(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:UC(r),targetOrder:wC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ud(t)}:{}}),...s===void 0?o:o.slice(1)]}function td(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ad(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?GC(t,n,r):[]]}function GC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ad(n.source.slice(r.span.end,e.span.end),n)}]}function ad(e,t){if(t.depth>=mt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function ld(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Ys(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Ys(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Mt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Ys(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function nd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=BC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return zC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&PC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?TC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function zC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ys(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function BC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function $C(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:_C.has(e)})}function Eo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Qs(e){return Object.freeze({kind:"word",text:e})}function UC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return OC.has(e)||/^python\d/.test(e)}var HC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=HC.get(e)?.has(n)??!1;return cd(e,t.slice(r?2:1))}function Zs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Zs(e.slice(1));if(!RC.has(t))return[...e];return Zs(cd(t,e.slice(1)))}function ud(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Zs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function jC(e){let t=ud(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Xs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Xs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Xs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(jC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!qC(t))return r;return[...r,...o]})}function VC(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function KC(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function qC(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||KC(e))&&!e.words.some(rd)&&!e.redirections.some((n)=>rd(n.target))}function rd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var dd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),md=new Set([...dd,"glob"]),YC=new Set([...md,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=ZC(),n=In(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:XC(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function et(e,t){if(!e.includes("$"))return e;return wi(e,t)}function ZC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=id(i,a);return e.set(i,c),c},getCommandProgram:r}}function XC(e){let t=e.route.kind==="grep"?md:e.route.kind==="glob"?YC:dd;return[..._l(e.input,t),...e.route.kind==="patch"?Pl(e.input):[]]}var JC=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return xo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function _o(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&JC.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function yd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Ar(e.invocation.toolName))return null;let a=e.paths.find((l)=>fd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>nS(a,l,t,n,r),isRedirectionTarget:(a,l)=>fd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ao(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ea(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?wo(m,l):QC(m,l);if(n.markerFiles.some(u))return!0;return r&&pd(n).some(u)}if(ea(a,n))return!0;return r&&pd(n).some((c)=>wo(c,a))}function QC(e,t){let n=hd(t,e);if(n===""||n.startsWith("..")||gd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function eS(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function tS(e,t,n,r,o){if(!n)return!1;return ea(Ao(se(e,t,r,o)),n)}function fd(e,t,n,r,o,i){let s=Ao(se(e,t,r,o));return i.includes(s)||Cd(s,n)}function bd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>wo(i,Ao(se(s,t,r,o)))))}function ea(e,t){return t.entries.includes(e)||t.directories.includes(e)||Cd(e,t)}function Cd(e,t){return t.hooksDirectories.some((n)=>wo(e,n))}function pd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function wo(e,t){let n=hd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!gd(n)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}function nS(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=_o(i.slice(1)),a=s.sources.find((l)=>eS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&tS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Oo,normalize as uS,parse as dS,posix as Ad,resolve as Lt,sep as oa}from"path";import{isAbsolute as rS,join as Sd,normalize as xd,parse as oS,sep as vd}from"path";var iS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],sS=` 	
-`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ta(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return ta(e.get("TMPDIR")??"",t);let n=na(e,t);if(n===void 0)return!0;return ta(n,t)}function na(e,t){return _d(e,t,"TMPDIR")}function ta(e,t){if(!e)return!1;if(lS(e))return!1;return fn(e,t)}function ht(e,t){let n=_d(e,t,"IFS");return n!==void 0&&n!==""&&n!==sS}function fn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return Rd(t).some((r)=>ko(n,r))}function Io(e,t){let n=Po(e,t.paths);if(n===null)return!1;return Rd(t).some((r)=>To(r)===To(n))}var Ed=new WeakMap;function Rd(e){let t=Ed.get(e);if(t)return t;let n=aS(e);return Ed.set(e,n),n}function aS(e){let t=iS.map((r)=>Po(r,e.paths)??xd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&cS(n))return[...t,n];return t}function lS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function _d(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function cS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=xd(e);if(!rS(n))return n;let r=oS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Sd(i,o[s]??"");if(t.entryKind(a)==="missing")return Sd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function ko(e,t){let n=To(e),r=To(t);if(n===r)return!0;let o=r.endsWith(vd)?r:`${r}${vd}`;return n.startsWith(o)}function To(e){return process.platform==="win32"?e.toLowerCase():e}var mS=process.platform==="win32",wd=64,fS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function sr(e){let t=yu(e,wd,wd,fS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:pS(e)}}function pS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>gS(e.raw,n.span.start-e.span.start))}function gS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:vS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&xS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Td(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(ia(e,r))return{kind:"root_or_home_target"};if(yS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(bS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(ES(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&AS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>PS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(TS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(hS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function hS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Oo(r)||r.startsWith("~"))return!1;if(sa(r))return!1;if(Id(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function Pd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(SS(i))return!1;if(Io(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Id(r??i,s,t.environment.paths,t.budget))}function ia(e,t=!1){let n=e.trim(),r=Ad.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function yS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Oo(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(G(i,t.environment.paths,t.budget));if(s===dS(s).root)return!0;return s===he(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=uS(e);if(mS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function bS(e,t,n,r,o,i,s,a){let l=e.trim();if(sa(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&CS(l,n)}function CS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Td(e.slice(n.length+1),t)})}function SS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ad.normalize(`/${t[1]??""}`)==="/"}function sa(e){return e.split(/[\\/]+/).includes("..")}function vS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Oo(i))return[];try{let s=G(i,n,r);if(zn(s,G(t,n,r)))return[];return[he(s)]}catch{return[]}})}function ES(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(sa(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Oo(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=he(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(oa)?l:`${l}${oa}`))}catch{return!1}}function xS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Td(e,t=!1){return e.includes("$")||e.includes("`")||RS(e)||t&&_S(e)}function RS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function _S(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&wS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function wS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function AS(e,t,n,r){try{return he(G(e,n,r))===he(G(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function PS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(G(Lt(t,e),n,r))===he(G(o,n,r))}catch{try{return he(Lt(t,e))===he(o)}catch{return!1}}}function TS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ra(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ra(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ra(Lt(a,e),t,i,s)}catch{return!1}}function ra(e,t,n,r){try{return kd(G(e,n,r),G(t,n,r))}catch{return!1}}function Id(e,t,n,r){if(!t)return!1;try{return kd(G(t,n,r),G(e,n,r))}catch{return!0}}function kd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${oa}`)||n===r}var IS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Od="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Md="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Dd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",OS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",MS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",DS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Dd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Md},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:OS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Od},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:kS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Od}};function Nd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return NS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function NS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=WS(o),s=o[i];if(!s||!IS.has(VS(s.text)))return null;let a=LS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",MS);for(let l of a.targets)if(!Ze(l.text)&&ia(la(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Dd);for(let l of a.targets)if(n.resolvedCwd&&Dt(la(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",Md);for(let l of a.targets){let c=ir(Ge(la(l.text),n),n,r,DS);if(c)return c}return null}function LS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(FS(l))continue;if(s){t.push(aa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=zS(l.text);if(!c){t.push(aa(l)),i=i||l.dynamic;continue}if(BS(c.name)){let u=c.value?GS(c.value,l):e[++a];if(u?.kind==="word"){t.push(aa(u)),i=i||u.dynamic;continue}i=!0;continue}if($S(c.name)){n=!0;continue}if(US(c.name)){r=!0;continue}if(HS(c.name))o=jS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function WS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function aa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function FS(e){return e.kind==="word"&&e.text===","}function la(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function GS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function zS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function BS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function $S(e){return"recurse".startsWith(e)}function US(e){return e.length>=2&&"force".startsWith(e)}function HS(e){return e==="wi"||"whatif".startsWith(e)}function jS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function VS(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Mo="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Ld="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var KS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),qS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),YS=new Set(["-o","--output","--query","--subscription"]),ZS=new Set;function Wd(e){if(e==="aws")return KS;if(e==="gcloud")return qS;if(e==="az")return YS;return ZS}var XS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),JS=new Set;function Fd(e){if(e==="git")return Se;if(e==="docker")return XS;return JS}function tt(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=me(e);for(let o of t){if(!tv(n,o.command))continue;if(o.match){if(QS(n,e,o.match))return Gd(o);continue}if(!nv(n,e,o.subcommand))continue;if(ov(e,new Set(o.block_args),r))return Gd(o)}return null}function Gd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function QS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return ev(r,n.command_path,Wd(e))}function ev(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function tv(e,t){return e===M(t)}function nv(e,t,n){if(!n)return!0;return zd(t,1,n,Fd(e))}function zd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&rv(e,i,n,r))return!0;continue}return s===n}return!1}function rv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return zd(e,t+2,n,r)}function ov(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var iv=new Set(["-e","--source"]),sv=new Set(["-F","-v","--assign","--field-separator"]),Bd=new Set(["-f","--file"]),av=new Set(["print","printf","return"]),$d=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],lv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ud(e,t,n){let r=!1;for(let o of cv(e)){let i=uv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",lv):null}function ua(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&iv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(sv.has(a)||Bd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Bd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return ua(e).sources}function cv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function uv(e,t){xe(t,e);let n=e.includes("system")?da(e,t):null,r=dv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function da(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=No(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Hd(e,i+1);continue}if(s==="/"&&jd(e,i)){i=Vd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=Do(e,i);if(e[l]!=="(")continue;l=Do(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=No(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Do(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function dv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=No(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Hd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&jd(e,i)){let f=Vd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ca(e,i,"print")||ca(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Do(e,m);if(ca(e,d,"getline")){o=!0;let f=pv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(hv(s,a)){o=!0;let f=fv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!mv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Do(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function mv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function No(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=gv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function fv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return No(e,t,n)}function pv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function gv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ca(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function hv(e,t){return t!==null&&t>=e}function Hd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function jd(e,t){let n=yv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return av.has(e.slice(r,n+1))}function yv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Vd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var bv=new Set(["sudo","env","command","builtin"]);function Lo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=Cv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Cv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&Sv(a,r);if(l)i.push(s);if(!l&&Wr.has(M(a)))break;if(o)break}return i}function Sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Qi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return bv.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Wo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Wo(e,t,n,r,o,i,s,a,l){let c=So(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Co(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");ma(a),yield*Wo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new D("wrapperPeelIterations");let d=Lo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])ma(a),yield*Wo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Ev(u)){ma(a),yield*Wo(u.slice(1),t,m,r,o,i,s,a,l);return}yield vv(u,m,r,o,i,l)}function vv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ma(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Ev(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function fa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||pa(r,"recursive")){t=!0;continue}if(r==="-f"||pa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Kd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>pa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function pa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var xv="find -delete permanently removes files. Use -print first to preview.",Rv="find -exec rm -rf is dangerous. Use explicit file list instead.",_v=new Set(["-exec","-execdir","-ok","-okdir"]),wv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function qd(e,t){let n=e.map(w),r=Av(e,n,t);if(r)return r;if(Go(n,1)&&!Tv(e,n,t)){let s=P(C("find.delete",xv),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=kv(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function Av(e,t,n){if(!Go(t,1)&&!ga(t,n.environment))return null;let o=Fo(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Te)}}if(Pv(t)&&i.resolvedCwd&&bd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Te);return null}function ga(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Tv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Fo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=na(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Pd(m,l,{containmentTarget:Iv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function Iv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Fo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function kv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return C("find.exec-rm-recursive-force",Rv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Go(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return wv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&_v.has(e)}import{resolve as rx}from"path";function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Ov=5,ha="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Zd(e,t,n){let r=zo(e,t,n),o=Mv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Ov;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Fv(m);if(d===null||d.length===0)return{blockedReason:ha,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:ha,expanded:!0,tokens:i}}function Xd(e,t,n){return zo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function Mv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function zo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Nv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Dv(e,t,n)]}}function Dv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ya(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ya(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Yd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Yd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Nv(e,t){let n=Lv(e,t),r=Wv(e,t);return{blockedReason:n===null||r===null?ha:null,entries:[...n??[],...r??[]]}}function Lv(e,t){let n=Qe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ya(i);if(!s)return null;r.push(s)}return r}function Wv(e,t){let n=Vu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Qe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Qe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ya(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Yd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Qe(e.slice(r+1),t,n)}}function Fv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Gv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",zv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Bv="git checkout --force discards uncommitted changes. Use 'git stash' first.",$v="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Uv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Hv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",jv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Vv="git switch --force discards uncommitted changes. Use 'git stash' first.",Kv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",qv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Yv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Zv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Xv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Jv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Qv="git push --force destroys remote history. Use --force-with-lease for safer force push.",eE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",tE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",nE="git branch -D force-deletes without merge check. Use -d for safe delete.",rE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",oE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",iE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",sE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",aE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",lE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",cE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",uE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),dE=new Set(["--recurse-submodules","--track","-t"]),ba=new Set(["-b","-B","-U"]),Ca=new Set(["-c","-C"]),mE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Qd(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return bt(fE(r,t));case"switch":return bt(gE(r));case"restore":return bt(yE(r));case"reset":return CE(r);case"clean":return bt(vE(r));case"rm":return bt(EE(r));case"push":return zt(xE(r));case"branch":return zt(wE(r));case"stash":return zt(kE(r));case"worktree":return zt(OE(r));case"rebase":return bt(AE(r));case"merge":return bt(PE(r));case"tag":return zt(TE(r));case"reflog":return zt(IE(r));default:return null}}function bt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function fE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:ba});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return C("git.checkout-force",Bv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Uv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return C("git.checkout-ref-path",$v);return C("git.checkout-double-dash",Gv)}let i=hE(e);if(i.length>=2)return C("git.checkout-ambiguous",Hv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(pE(s)||t(s))return C("git.checkout-double-dash",zv);return null}function pE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function gE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return C("git.switch-discard-changes",jv);let n=me(t,{shortOptsWithValue:Ca});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return C("git.switch-force",Vv);return null}function hE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(uE.has(r)){n+=2;continue}if(dE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function yE(e){let t=bE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",qv):C("git.restore-unstaged",Kv)}function bE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(mE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function CE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=C("git.reset-hard",Yv);break}if(O(n,"--merge")){t=C("git.reset-merge",Zv);break}}if(!t)return null;return SE(e)?zt(t):bt(t)}function SE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function vE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return C("git.clean-force",Xv);return null}function EE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",Jv):null}function xE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>O(s,"--mirror")))return C("git.push-mirror",tE);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Jd(t,n).some(RE))return C("git.push-force",Qv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Jd(t,n).some(_E))return C("git.push-delete",eE);return null}function Jd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function RE(e){return e.startsWith("+")||e.includes(":+")}function _E(e){return e.length>1&&e.startsWith(":")}function wE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return C("git.branch-force-delete",nE);return null}function AE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.rebase-abort",rE):null}function PE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.merge-abort",oE):null}function TE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>O(r,"--delete"))?C("git.tag-delete",iE):null}function IE(e){return e[0]==="delete"?C("git.reflog-delete",sE):null}function kE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",aE);if(t==="clear")return C("git.stash-clear",lE)}return null}function OE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",cE);return null}import{dirname as JE,isAbsolute as QE,join as pm,resolve as ex}from"path";var va="TMPDIR",Ea="IFS",tm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,nm=/^[A-Za-z_][A-Za-z0-9_]*$/,rm=new Set(["export","typeset","declare","readonly"]),ME=new Set(["builtin","command","time"]),om=new Set(["do","then","else"]),DE=new Set(["do","then","case"]),em=new Set(["done","fi","esac"]),NE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function im(e,t){return e.map((n)=>n.provenance==="variable"&&dm(n.text)?mr(n.text,t.shellAssignments):w(n))}function mr(e,t){return e.replace(NE,(n,r,o)=>t.get(r??o??"")??n)}function sm(e,t){return{env:e,effectiveEnvAssignments:GE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function am(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function xa(e,t){let n=cm(e,t),r=e[0]??"";if(DE.has(r))t.bodyDepth+=1;if(r==="elif"||em.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(em.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Ra(t,a)});let o=n.commandIndex;if(o!==-1&&rm.has(e[o]??""))e.filter((a)=>nm.test(a)&&Sa(a)).forEach((a)=>{zE(t,a)});let i=o===-1?-1:um(e,o);if(i===-1||e[i]!=="unset")return;let s=$E(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(om.has(r)){t.shellAssignments.set(a,"");return}BE(t,a)})}function lm(e,t){let n=cm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function cm(e,t){let n=om.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!dm(a)),o=r!==-1&&rm.has(e[um(e,r)]??""),i=FE(t);return{assignments:e.flatMap((a,l)=>{let c=LE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!ho(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function um(e,t){let n=t;while(ME.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function dm(e){return Pe(e)!==null||tm.test(e)}function LE(e,t,n){return Pe(e)??WE(e,t,n)}function WE(e,t,n){let r=yo(e,n,t);if(r)return r;let o=e.match(tm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Sa(e){return e===va||e===Ea||qs(e)}function FE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function GE(e,t){let n=[va,Ea].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ra(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function zE(e,t){Ra(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function BE(e,t){if(!Sa(t)&&!nm.test(t))return;if(e.shellAssignments.set(t,""),ho(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Sa(t)||t===va||t===Ea||Dn(t)){Ra(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function $E(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as UE}from"path";function Bo(e,t){return Ks.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(UE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=mm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=mm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function mm(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function fm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Bo(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(_a(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function _a(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||HE(o)||YE(e,t.environment.env,t.envAssignments,n)||KE(o)||jE(i,o))return!0;return i==="clean"&&qE(o)>1}function HE(e){return e.some((t)=>/[$*?[]/.test(t))}function jE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:ba}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Ca}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||VE(s))||r.has("-C");return o&&i}return!1}function VE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function KE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function qE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function YE(e,t,n,r){if(Qe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=zo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>XE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||ZE(s.value);if(qu(n))return!0;return r.recursiveSubmodules}function ZE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function XE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function gm(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(ex(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Bo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?nx(e,n.shellAssignments,o):hm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!tx(a,r,t,n)||!fn(a,n.environment)||Io(a,n.environment)||ko(s,a)||ko(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function tx(e,t,n,r){let o=r.environment.paths,i=pm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!_a(t,r,s)}function nx(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?mr(a,t??new Map):a;if(!QE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function hm(e,t){if(t.entryKind(pm(e,".git"))!=="missing")return e;let n=JE(e);return n===e?null:hm(n,t)}var ox="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",ix=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function $o(e,t){return ym(e,t)}function ym(e,t,n){let r=e.map(w),o=Zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(C("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Ku(t.envAssignments)||Xd(r,t.environment.env,t.envAssignments))&&sx(s))return C("git.ssh-env",ox);let a=Qd(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(rx(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=fm(r,a,t)??gm(e,a,t);if(!l)return a;return n?.(l),null}function bm(e,t){let n=null;return{match:ym(e,t,(o)=>{n=o}),relaxation:n}}function sx(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(ix.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&ax(n)}function ax(e){return e.find((t)=>!lx(t))?.toLowerCase()==="update"}function lx(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Ux}from"path";function Cm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Uo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Sm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",cx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ux="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Em="rm -rf targeting root or home directory is extremely dangerous and always blocked.",dx="rm -rf in home directory is dangerous. Change to a project directory first.",vm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Em},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ux},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:dx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Sm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:cx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Sm}};function Ho(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Kd(r),s=fx(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,vm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Te);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",Em);if(d.kind==="git_metadata_target")return C("rm.git-metadata",Te);continue}if(!o)continue;for(let d of mx(u,n,m)){let f=ir(d,n,t.policy,vm),p=P(f,t.policy);if(p)return p}}}return null}function mx(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function fx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},px=new Set(["<","<<","<<-","<<<","<&","<>"]),Rm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,gx=/^(?:[0-9]+|[@*])$/,hx=mt.maxWords,yx=mt.maxInputLength;function _m(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function mo(e,t,n){let r=zs(e,n);if(t==="rm")return vb(r);if(t==="dd")return xb(r);return Nu(r,!0)}function fo(e,t,n){let r=zs(e,n);if(t==="rm")return Rb(r);if(t==="reset-hard")return Mu(r,"--ha","rd");if(t==="reset-merge")return Mu(r,"--me","rge");if(t==="clean")return Pb(r);if(t==="checkout")return Ib(r);if(t==="push-force")return kb(r);if(t==="push-refspec")return Ob(r);if(t==="push-delete")return Mb(r);if(t==="branch")return Db(r);if(t==="tag")return Wb(r);if(t==="restore")return Fb(r);return Nu(r,!1)}function vb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(Xe(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=Eb(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=Iu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Iu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Eb(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Iu(e,t,n){if(ku(e,t,n,"recursive"))return{recursive:!0,force:!1};if(ku(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function ku(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function xb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(Xe(e,n,"dd")){t=!0,n++;continue}if(!t||!Xe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function Rb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=wb(e,o);if(s>=0){if(_b(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Je(e,o+11)||$s(e,o,"recursive"),r||=j(e,o,"--force")&&Je(e,o+7)||$s(e,o,"force"),n&&r)return!0;o++}return!1}function $s(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Je(e,t+r+2)}function _b(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Ou(e,i,"recursive"),a=Ou(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=Ab(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Ou(e,t,n){return j(e,t,`--${n}`)&&Je(e,t+n.length+2)||$s(e,t,n)}function wb(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function Ab(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&Je(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Mu(e,t,n){return Kn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function Pb(e){return Kn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=Vn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function po(e,t,n){if(!Xe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Xe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=Tb(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:Xe(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function Tb(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function Ib(e){return Du(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function kb(e){return Kn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Lu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function Ob(e){return Kn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Mb(e){return Kn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Db(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=po(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Vn(e,o,oe),s=Nb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Nb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&Lb(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Je(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function Lb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Wb(e){return Du(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Du(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=po(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Je(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=po(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Fb(e){let t=!1;for(let n=0;n<Y(e);n++){if(Bs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=po(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Nu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Bs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&Xe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Xe(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Lu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Je(e,o)?o:-1}function cn(e,t,n,r){return Lu(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&fo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Gb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Fu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Gu(t.nodes,r,i)}function Gu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Gu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return zb(r,t,n)})}function zb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Gb.test(o.text));return e.words.every((o,i)=>o===t||Wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Wu(o.target.raw,n.anchored,!0)))}function Wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Bb,resolve as zu}from"path";function qn(e,t,n,r){let o=Bb(e)?zu(e):t?zu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function Bu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Hs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),$b=new Set(["-p","--print"]),Ub=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Hb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),jb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Vb=new Map([["python",new Set(["m"])]]),Kb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),qb=new Set(["always","default","never"]),Yb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Zb=/\\\r?\n/g,Xb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function $u(e){return ho(e).code}function go(e){return ho(e).sources}function Uu(e){return Xb.get(Vs(e))??[]}function ho(e){let t=Vs(e[0]??"");if(!Hs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&$b.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Qb(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(eC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Jb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(Kb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Yb.has(s))||t==="python"&&!qb.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(Vb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(Ub.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Hb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(jb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function Jb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function js(e,t){return Vs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Vs(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function Qb(e,t){return Hs.get(e)?.has(t)??!1}function eC(e){return Hs.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=rC(e,t);if(!Us(r,t))return!1;xe(t,r);let o=nC(r);if(Us(o,t))return!0;if(xe(t,o),!Hu.test(o))return!1;return!n||tC(r,t)}function tC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>Hu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:Ks(o,a)}});if(i.some((s)=>qs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Us(s.text,t))}function Ks(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function qs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Hu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function nC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Us(e,t){if(mo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(mo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(mo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>fo(o,r))))}function rC(e,t){return xe(t,e),e.replace(Zb,"")}import{isAbsolute as hd,relative as yd}from"path";import{isAbsolute as Xu,parse as fC}from"path";import{dirname as oC,isAbsolute as iC,parse as sC,sep as aC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=iC(t)?sC(t).root:"",o=r||e;for(let i of cC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=oC(o);continue}let s=lC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function lC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${aC}${t}`}function cC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ys=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],uC=new Set(Ys),dC=1024,ju=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Vu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),mC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function yo(e){return uC.has(e)}function Zs(e){return yo(e)||ju.has(e)||Vu.has(e)||Dn(e)}function Qe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ku(e,t){let n=Qe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=dC?{state:"valid",count:r}:{state:"invalid"}}function bo(e,t,n){let o=e.match(mC)?.[1];if(!o||!Zs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Qe(o,t,n)??""}${e.slice(i+1)}`}}function qu(e){return Zu(e,Vu)}function Yu(e){return Zu(e,ju)}function Zu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Qu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Qu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Co(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ed(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!ed(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Ju(i),f=Co(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!gC(i)){let g=hC(dn(i),a,t.env)??bo(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(dn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=bC(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=vC(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=EC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Ju(i)===d)break}let u=Co(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:pC(u.words,o)}}function pC(e,t){return e.some((n)=>!t.has(n))}function Ju(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function gC(e){return Qu.test(dn(e))}function hC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var yC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function bC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(yC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var CC=new Set(["-i","-0","--null"]),SC=new Set(["-u","--unset","-C","--chdir","-P"]);function vC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(CC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(SC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Xu(t))return null;let r=Xu(t)?fC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function EC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var xC=/['"\\$`{}#]/;function So(e,t){if(e.some((r)=>xC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return vo(e,t,n).tokens}function RC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=vo(e,t,n),i=(o.envSplitValues??[]).flatMap(RC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function vo(e,t,n,r){if(!ed(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ea=Symbol("adopt-as-operand"),_C=new Set(["env","sudo","command","builtin"]),wC=new Set(["&&","||","|&","|","&",";"]),AC=new Set(["<<","<<<",">|"]),PC=new Set(["|","|&"]),TC=/[*@#?$!_-]/,IC=/^\w+(?::\w+)*/,kC=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),OC=Object.freeze([]),MC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),DC=256,id=new WeakMap;function sd(e,t){let n=t.status==="complete"?new Set(Qs(t)):new Set,r=WC(e,n);if(Fr(r))return Eo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Eo("structural-limit",r,t);if(o.invalid)return Eo("invalid",r,t);let s=Eo("complete",r,t,o.assignmentFallbacks);return id.set(s,Object.freeze(i)),s}function Ro(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of ad(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=NC(a,s,n,r),c=a.length>0&&PC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ea){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function _o(e){return ad(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function NC(e,t,n,r){let o=tr(e)?new Map([...t.variables,...LC(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function LC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function ad(e){return id.get(e)??kC}function WC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Eo(e,t,n,r=OC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>FC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function FC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(UC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[xo("{"),...Mt(e.body,a),...s?[xo("}")]:[]]:[Jn,We("("),...Mt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=KC(e,r.functions);if(o){if(r.depth>=mt.maxDepth||++r.flags.expansions>DC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...td(e,r),xo(";"),...Mt(o,{...r,depth:r.depth+1}),xo(";")]},...nd(e,t,n,r)]}return[{start:e.span.start,events:td(e,r)},...nd(e,t,n,r)]}function td(e,t){return[...e.words.map((n)=>({start:n.span.start,events:cd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:GC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function GC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?cd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ta(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:HC(r),targetOrder:AC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:dd(t)}:{}}),...s===void 0?o:o.slice(1)]}function nd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ta(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ld(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?zC(t,n,r):[]]}function zC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ld(n.source.slice(r.span.end,e.span.end),n)}]}function ld(e,t){if(t.depth>=mt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function cd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ta(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Xs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Xs(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Mt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Xs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=rd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=rd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function rd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=$C(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return BC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&TC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?IC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function BC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Xs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function $C(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function UC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:wC.has(e)})}function xo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ta(e){return Object.freeze({kind:"word",text:e})}function HC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return MC.has(e)||/^python\d/.test(e)}var jC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function ud(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=jC.get(e)?.has(n)??!1;return ud(e,t.slice(r?2:1))}function Js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Js(e.slice(1));if(!_C.has(t))return[...e];return Js(ud(t,e.slice(1)))}function dd(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function VC(e){let t=dd(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Qs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Qs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Qs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(VC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!YC(t))return r;return[...r,...o]})}function KC(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function qC(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function YC(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||qC(e))&&!e.words.some(od)&&!e.redirections.some((n)=>od(n.target))}function od(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var md=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),fd=new Set([...md,"glob"]),ZC=new Set([...fd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=XC(),n=In(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:JC(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function et(e,t){if(!e.includes("$"))return e;return Ai(e,t)}function XC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=sd(i,a);return e.set(i,c),c},getCommandProgram:r}}function JC(e){let t=e.route.kind==="grep"?fd:e.route.kind==="glob"?ZC:md;return[...wl(e.input,t),...e.route.kind==="patch"?Tl(e.input):[]]}var QC=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ro(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function wo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&QC.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function bd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Ar(e.invocation.toolName))return null;let a=e.paths.find((l)=>pd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>rS(a,l,t,n,r),isRedirectionTarget:(a,l)=>pd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Po(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(na(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Ao(m,l):eS(m,l);if(n.markerFiles.some(u))return!0;return r&&gd(n).some(u)}if(na(a,n))return!0;return r&&gd(n).some((c)=>Ao(c,a))}function eS(e,t){let n=yd(t,e);if(n===""||n.startsWith("..")||hd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function tS(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function nS(e,t,n,r,o){if(!n)return!1;return na(Po(se(e,t,r,o)),n)}function pd(e,t,n,r,o,i){let s=Po(se(e,t,r,o));return i.includes(s)||Sd(s,n)}function Cd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Ao(i,Po(se(s,t,r,o)))))}function na(e,t){return t.entries.includes(e)||t.directories.includes(e)||Sd(e,t)}function Sd(e,t){return t.hooksDirectories.some((n)=>Ao(e,n))}function gd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Ao(e,t){let n=yd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!hd(n)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}function rS(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=wo(i.slice(1)),a=s.sources.find((l)=>tS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&nS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Mo,normalize as dS,parse as mS,posix as Pd,resolve as Lt,sep as sa}from"path";import{isAbsolute as oS,join as vd,normalize as Rd,parse as iS,sep as Ed}from"path";var sS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],aS=` 	
+`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ra(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return ra(e.get("TMPDIR")??"",t);let n=oa(e,t);if(n===void 0)return!0;return ra(n,t)}function oa(e,t){return wd(e,t,"TMPDIR")}function ra(e,t){if(!e)return!1;if(cS(e))return!1;return fn(e,t)}function ht(e,t){let n=wd(e,t,"IFS");return n!==void 0&&n!==""&&n!==aS}function fn(e,t){let n=To(e,t.paths);if(n===null)return!1;return _d(t).some((r)=>Oo(n,r))}function ko(e,t){let n=To(e,t.paths);if(n===null)return!1;return _d(t).some((r)=>Io(r)===Io(n))}var xd=new WeakMap;function _d(e){let t=xd.get(e);if(t)return t;let n=lS(e);return xd.set(e,n),n}function lS(e){let t=sS.map((r)=>To(r,e.paths)??Rd(r)),n=To(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&uS(n))return[...t,n];return t}function cS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function wd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function uS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function To(e,t){try{let n=Rd(e);if(!oS(n))return n;let r=iS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=vd(i,o[s]??"");if(t.entryKind(a)==="missing")return vd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Oo(e,t){let n=Io(e),r=Io(t);if(n===r)return!0;let o=r.endsWith(Ed)?r:`${r}${Ed}`;return n.startsWith(o)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}var fS=process.platform==="win32",Ad=64,pS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function sr(e){let t=bu(e,Ad,Ad,pS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:gS(e)}}function gS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>hS(e.raw,n.span.start-e.span.start))}function hS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:ES(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&RS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Id(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(aa(e,r))return{kind:"root_or_home_target"};if(bS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(CS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(xS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&PS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>TS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(IS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(yS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function yS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Mo(r)||r.startsWith("~"))return!1;if(la(r))return!1;if(kd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function Td(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(vS(i))return!1;if(ko(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>kd(r??i,s,t.environment.paths,t.budget))}function aa(e,t=!1){let n=e.trim(),r=Pd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function bS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Mo(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===mS(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=dS(e);if(fS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function CS(e,t,n,r,o,i,s,a){let l=e.trim();if(la(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&SS(l,n)}function SS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Id(e.slice(n.length+1),t)})}function vS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Pd.normalize(`/${t[1]??""}`)==="/"}function la(e){return e.split(/[\\/]+/).includes("..")}function ES(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Mo(i))return[];try{let s=z(i,n,r);if(zn(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function xS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(la(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Mo(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(sa)?l:`${l}${sa}`))}catch{return!1}}function RS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Id(e,t=!1){return e.includes("$")||e.includes("`")||_S(e)||t&&wS(e)}function _S(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function wS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&AS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function AS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function PS(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function TS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Lt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Lt(t,e))===he(o)}catch{return!1}}}function IS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ia(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ia(Lt(a,e),t,i,s)}catch{return!1}}function ia(e,t,n,r){try{return Od(z(e,n,r),z(t,n,r))}catch{return!1}}function kd(e,t,n,r){if(!t)return!1;try{return Od(z(t,n,r),z(e,n,r))}catch{return!0}}function Od(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${sa}`)||n===r}var kS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Md="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",OS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Dd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Nd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",MS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",DS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",NS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Nd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Dd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:MS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Md},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:OS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Md}};function Ld(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return LS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function LS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=FS(o),s=o[i];if(!s||!kS.has(KS(s.text)))return null;let a=WS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",DS);for(let l of a.targets)if(!Ze(l.text)&&aa(ua(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Nd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ua(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",Dd);for(let l of a.targets){let c=ir(Ge(ua(l.text),n),n,r,NS);if(c)return c}return null}function WS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(GS(l))continue;if(s){t.push(ca(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=BS(l.text);if(!c){t.push(ca(l)),i=i||l.dynamic;continue}if($S(c.name)){let u=c.value?zS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ca(u)),i=i||u.dynamic;continue}i=!0;continue}if(US(c.name)){n=!0;continue}if(HS(c.name)){r=!0;continue}if(jS(c.name))o=VS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function FS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ca(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function GS(e){return e.kind==="word"&&e.text===","}function ua(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function zS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function BS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function $S(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function US(e){return"recurse".startsWith(e)}function HS(e){return e.length>=2&&"force".startsWith(e)}function jS(e){return e==="wi"||"whatif".startsWith(e)}function VS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function KS(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Do="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var qS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),YS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),ZS=new Set(["-o","--output","--query","--subscription"]),XS=new Set;function Fd(e){if(e==="aws")return qS;if(e==="gcloud")return YS;if(e==="az")return ZS;return XS}var JS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),QS=new Set;function Gd(e){if(e==="git")return Se;if(e==="docker")return JS;return QS}function tt(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!nv(n,o.command))continue;if(o.match){if(ev(n,e,o.match))return zd(o);continue}if(!rv(n,e,o.subcommand))continue;if(iv(e,new Set(o.block_args),r))return zd(o)}return null}function zd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function ev(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return tv(r,n.command_path,Fd(e))}function tv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function nv(e,t){return e===O(t)}function rv(e,t,n){if(!n)return!0;return Bd(t,1,n,Gd(e))}function Bd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&ov(e,i,n,r))return!0;continue}return s===n}return!1}function ov(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Bd(e,t+2,n,r)}function iv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var sv=new Set(["-e","--source"]),av=new Set(["-F","-v","--assign","--field-separator"]),$d=new Set(["-f","--file"]),lv=new Set(["print","printf","return"]),Ud=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],cv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Hd(e,t,n){let r=!1;for(let o of uv(e)){let i=dv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",cv):null}function ma(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&sv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(av.has(a)||$d.has(a))){let l=e[s+1];if(i&&=l!==void 0,$d.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return ma(e).sources}function uv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function dv(e,t){xe(t,e);let n=e.includes("system")?fa(e,t):null,r=mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function fa(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Lo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=jd(e,i+1);continue}if(s==="/"&&Vd(e,i)){i=Kd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=No(e,i);if(e[l]!=="(")continue;l=No(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Lo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=No(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function mv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Lo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=jd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Vd(e,i)){let f=Kd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(da(e,i,"print")||da(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=No(e,m);if(da(e,d,"getline")){o=!0;let f=gv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(yv(s,a)){o=!0;let f=pv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!fv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function No(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function fv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Lo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=hv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function pv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Lo(e,t,n)}function gv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function hv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function da(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function yv(e,t){return t!==null&&t>=e}function jd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Vd(e,t){let n=bv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return lv.has(e.slice(r,n+1))}function bv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Kd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Cv=new Set(["sudo","env","command","builtin"]);function Wo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=Sv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Sv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&vv(a,r);if(l)i.push(s);if(!l&&Wr.has(O(a)))break;if(o)break}return i}function vv(e,t){let n=k(e),r=O(e);return r==="git"||n==="busybox"||Ft(e)||es.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return Cv.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Fo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Fo(e,t,n,r,o,i,s,a,l){let c=vo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=So(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");pa(a),yield*Fo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new D("wrapperPeelIterations");let d=Wo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])pa(a),yield*Fo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(xv(u)){pa(a),yield*Fo(u.slice(1),t,m,r,o,i,s,a,l);return}yield Ev(u,m,r,o,i,l)}function Ev(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function pa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function xv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ga(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ha(r,"recursive")){t=!0;continue}if(r==="-f"||ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function qd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Rv="find -delete permanently removes files. Use -print first to preview.",_v="find -exec rm -rf is dangerous. Use explicit file list instead.",wv=new Set(["-exec","-execdir","-ok","-okdir"]),Av=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Yd(e,t){let n=e.map(w),r=Pv(e,n,t);if(r)return r;if(zo(n,1)&&!Iv(e,n,t)){let s=P(C("find.delete",Rv),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Ov(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function Pv(e,t,n){if(!zo(t,1)&&!ya(t,n.environment))return null;let o=Go(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Te)}}if(Tv(t)&&i.resolvedCwd&&Cd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Te);return null}function ya(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Tv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Iv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Go(e);if(!r)return!1;let o=n.envAssignments??new Map,i=oa(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Td(m,l,{containmentTarget:kv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function kv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Go(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Ov(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return C("find.exec-rm-recursive-force",_v);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function zo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return Av.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&wv.has(e)}import{resolve as ox}from"path";function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Mv=5,ba="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Xd(e,t,n){let r=Bo(e,t,n),o=Dv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Mv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Gv(m);if(d===null||d.length===0)return{blockedReason:ba,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:ba,expanded:!0,tokens:i}}function Jd(e,t,n){return Bo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function Dv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Bo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Lv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Nv(e,t,n)]}}function Nv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Zd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Zd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Lv(e,t){let n=Wv(e,t),r=Fv(e,t);return{blockedReason:n===null||r===null?ba:null,entries:[...n??[],...r??[]]}}function Wv(e,t){let n=Qe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=Ca(i);if(!s)return null;r.push(s)}return r}function Fv(e,t){let n=Ku(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Qe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Qe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Zd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Qe(e.slice(r+1),t,n)}}function Gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var zv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Bv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",$v="git checkout --force discards uncommitted changes. Use 'git stash' first.",Uv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Hv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",jv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Vv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Kv="git switch --force discards uncommitted changes. Use 'git stash' first.",qv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Yv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Zv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Xv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Jv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Qv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",eE="git push --force destroys remote history. Use --force-with-lease for safer force push.",tE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",nE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",rE="git branch -D force-deletes without merge check. Use -d for safe delete.",oE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",iE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",sE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",aE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",lE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",cE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",uE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",dE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),mE=new Set(["--recurse-submodules","--track","-t"]),Sa=new Set(["-b","-B","-U"]),va=new Set(["-c","-C"]),fE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function em(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return bt(pE(r,t));case"switch":return bt(hE(r));case"restore":return bt(bE(r));case"reset":return SE(r);case"clean":return bt(EE(r));case"rm":return bt(xE(r));case"push":return zt(RE(r));case"branch":return zt(AE(r));case"stash":return zt(OE(r));case"worktree":return zt(ME(r));case"rebase":return bt(PE(r));case"merge":return bt(TE(r));case"tag":return zt(IE(r));case"reflog":return zt(kE(r));default:return null}}function bt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function pE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:Sa});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return C("git.checkout-force",$v);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Hv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return C("git.checkout-ref-path",Uv);return C("git.checkout-double-dash",zv)}let i=yE(e);if(i.length>=2)return C("git.checkout-ambiguous",jv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(gE(s)||t(s))return C("git.checkout-double-dash",Bv);return null}function gE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function hE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return C("git.switch-discard-changes",Vv);let n=me(t,{shortOptsWithValue:va});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return C("git.switch-force",Kv);return null}function yE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(dE.has(r)){n+=2;continue}if(mE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function bE(e){let t=CE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",Yv):C("git.restore-unstaged",qv)}function CE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(fE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function SE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=C("git.reset-hard",Zv);break}if(M(n,"--merge")){t=C("git.reset-merge",Xv);break}}if(!t)return null;return vE(e)?zt(t):bt(t)}function vE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function EE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return C("git.clean-force",Jv);return null}function xE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",Qv):null}function RE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return C("git.push-mirror",nE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Qd(t,n).some(_E))return C("git.push-force",eE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Qd(t,n).some(wE))return C("git.push-delete",tE);return null}function Qd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function _E(e){return e.startsWith("+")||e.includes(":+")}function wE(e){return e.length>1&&e.startsWith(":")}function AE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return C("git.branch-force-delete",rE);return null}function PE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?C("git.rebase-abort",oE):null}function TE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?C("git.merge-abort",iE):null}function IE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?C("git.tag-delete",sE):null}function kE(e){return e[0]==="delete"?C("git.reflog-delete",aE):null}function OE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",lE);if(t==="clear")return C("git.stash-clear",cE)}return null}function ME(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",uE);return null}import{dirname as QE,isAbsolute as ex,join as gm,resolve as tx}from"path";var xa="TMPDIR",Ra="IFS",nm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rm=/^[A-Za-z_][A-Za-z0-9_]*$/,om=new Set(["export","typeset","declare","readonly"]),DE=new Set(["builtin","command","time"]),im=new Set(["do","then","else"]),NE=new Set(["do","then","case"]),tm=new Set(["done","fi","esac"]),LE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function sm(e,t){return e.map((n)=>n.provenance==="variable"&&mm(n.text)?mr(n.text,t.shellAssignments):w(n))}function mr(e,t){return e.replace(LE,(n,r,o)=>t.get(r??o??"")??n)}function am(e,t){return{env:e,effectiveEnvAssignments:zE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function lm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function _a(e,t){let n=um(e,t),r=e[0]??"";if(NE.has(r))t.bodyDepth+=1;if(r==="elif"||tm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(tm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);wa(t,a)});let o=n.commandIndex;if(o!==-1&&om.has(e[o]??""))e.filter((a)=>rm.test(a)&&Ea(a)).forEach((a)=>{BE(t,a)});let i=o===-1?-1:dm(e,o);if(i===-1||e[i]!=="unset")return;let s=UE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(im.has(r)){t.shellAssignments.set(a,"");return}$E(t,a)})}function cm(e,t){let n=um(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function um(e,t){let n=im.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!mm(a)),o=r!==-1&&om.has(e[dm(e,r)]??""),i=GE(t);return{assignments:e.flatMap((a,l)=>{let c=WE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!yo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function dm(e,t){let n=t;while(DE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function mm(e){return Pe(e)!==null||nm.test(e)}function WE(e,t,n){return Pe(e)??FE(e,t,n)}function FE(e,t,n){let r=bo(e,n,t);if(r)return r;let o=e.match(nm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ea(e){return e===xa||e===Ra||Zs(e)}function GE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function zE(e,t){let n=[xa,Ra].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function BE(e,t){wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function $E(e,t){if(!Ea(t)&&!rm.test(t))return;if(e.shellAssignments.set(t,""),yo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ea(t)||t===xa||t===Ra||Dn(t)){wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function UE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as HE}from"path";function $o(e,t){return Ys.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(HE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=fm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=fm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function fm(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function pm(e,t,n){if(!t.localDiscard||!n.worktreeMode||$o(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Aa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Aa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||jE(o)||ZE(e,t.environment.env,t.envAssignments,n)||qE(o)||VE(i,o))return!0;return i==="clean"&&YE(o)>1}function jE(e){return e.some((t)=>/[$*?[]/.test(t))}function VE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Sa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:va}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||KE(s))||r.has("-C");return o&&i}return!1}function KE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function qE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function YE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ZE(e,t,n,r){if(Qe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Bo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>JE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||XE(s.value);if(Yu(n))return!0;return r.recursiveSubmodules}function XE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function JE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function hm(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(tx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||$o(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?rx(e,n.shellAssignments,o):ym(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!nx(a,r,t,n)||!fn(a,n.environment)||ko(a,n.environment)||Oo(s,a)||Oo(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function nx(e,t,n,r){let o=r.environment.paths,i=gm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Aa(t,r,s)}function rx(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?mr(a,t??new Map):a;if(!ex(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function ym(e,t){if(t.entryKind(gm(e,".git"))!=="missing")return e;let n=QE(e);return n===e?null:ym(n,t)}var ix="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",sx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Uo(e,t){return bm(e,t)}function bm(e,t,n){let r=e.map(w),o=Xd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(C("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((qu(t.envAssignments)||Jd(r,t.environment.env,t.envAssignments))&&ax(s))return C("git.ssh-env",ix);let a=em(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(ox(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=pm(r,a,t)??hm(e,a,t);if(!l)return a;return n?.(l),null}function Cm(e,t){let n=null;return{match:bm(e,t,(o)=>{n=o}),relaxation:n}}function ax(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(sx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&lx(n)}function lx(e){return e.find((t)=>!cx(t))?.toLowerCase()==="update"}function cx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as Hx}from"path";function Sm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Ho(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var vm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ux="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",xm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",mx="rm -rf in home directory is dangerous. Change to a project directory first.",Em={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:xm},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:dx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:mx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:vm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:ux},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:vm}};function jo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=qd(r),s=px(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,Em),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Te);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",xm);if(d.kind==="git_metadata_target")return C("rm.git-metadata",Te);continue}if(!o)continue;for(let d of fx(u,n,m)){let f=ir(d,n,t.policy,Em),p=P(f,t.policy);if(p)return p}}}return null}function fx(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function px(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},gx=new Set(["<","<<","<<-","<<<","<&","<>"]),_m=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,hx=/^(?:[0-9]+|[@*])$/,yx=mt.maxWords,bx=mt.maxInputLength;function wm(e){if(!e||k(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function jo(e){let t=fr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Ko))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function wm(e){let t=fr(e[1])==="--"?2:1,n=e[t],r=fr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Ko(n))return Bt;return{kind:"literal",source:r}}function Vo(e,t){let n=Cx(e);if(n===-1)return Ct;let r=Sx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Ex(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>hx||i>yx)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Rx)].filter((s)=>s!==null).join(" ")}}function Am(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&px.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function rt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=fr(n);return co(n,r)?{kind:"literal",source:r}:Bt}var bx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ta(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!bx.has(a)&&!J.has(a)&&!Ft(a)}function Cx(e){return ve(e.map(w)).commandIndex??-1}function Sx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(vx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function vx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Ex(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?wa(o):xx(o,r);if(e.parameter==="*"){let a=wa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Aa(l,r)}let i=t[n+1+e.parameter];if(i&&!Ko(i))return;let s=fr(i);return e.quoted?[s]:Aa(s,r)}function wa(e){return e.every(Ko)?e.map(w):void 0}function xx(e,t){let n=wa(e);if(!n)return;let r=n.map((o)=>Aa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Aa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=fr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(qo))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Am(e){let t=fr(e[1])==="--"?2:1,n=e[t],r=fr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!qo(n))return Bt;return{kind:"literal",source:r}}function Ko(e,t){let n=Sx(e);if(n===-1)return Ct;let r=vx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=xx(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>yx||i>bx)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(_x)].filter((s)=>s!==null).join(" ")}}function Pm(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&gx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function rt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=fr(n);return uo(n,r)?{kind:"literal",source:r}:Bt}var Cx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ka(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(O(s));return!Cx.has(a)&&!J.has(a)&&!Ft(a)}function Sx(e){return ve(e.map(w)).commandIndex??-1}function vx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Ex);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function Ex(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function xx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Pa(o):Rx(o,r);if(e.parameter==="*"){let a=Pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ta(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=fr(i);return e.quoted?[s]:Ta(s,r)}function Pa(e){return e.every(qo)?e.map(w):void 0}function Rx(e,t){let n=Pa(e);if(!n)return;let r=n.map((o)=>Ta(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ta(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Ko(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function fr(e){return e?w(e):""}function Rx(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Ia(e,t){return Pa(De(e,"posix"),t)}function gr(e){return Ia(e,new Set(Array.from(e.matchAll(Rm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Pa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Pa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Pa(o,n))||Pm(r.words,n))return!0;Tx(r,n)}return!1}function Pm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return xm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&xm(s[l],t)}let i=_x(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Pm(e.slice(i),t)}function _x(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return wx(e,t+1);if(r==="exec")return Ax(e,t+1);if(r==="env")return Px(e,t+1,n);return null}function wx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Ax(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Px(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Tx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Rm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(gx.test(o)||t.has(o))}))}function xm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var Ix=["--init-file","--rcfile"],kx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function ot(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Tm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Tm(e,t,!1);if(r!==null)return r}}return null}function it(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Tm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Im(e){let t=k(e[0]??"").toLowerCase(),n=Ox(e,t),r=kx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Ox(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Ix.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Xi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Ji(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ka="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Oa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Mx="__CC_SAFETY_NET_XARGS_INPUT__",qo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Yo="rm",Dx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Nx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Lx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Wx=/^(?:[0-9]+|[@*])$/;function Mm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=C("xargs.shell-dynamic",Oa);if(Gx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Gm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Wm(l,o),d=t.analyzeChild(l,{...Gt(a,t),dynamicInput:u,dynamicSourceInput:m||Nm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",ka)});if(d)return d;let f=Fx(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,Mx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...Gt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=tt(l,t.policy?.rules??[]);if(p)return p}return null}function Fx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Dm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Cm(e,r,t.length,n);return o===null?[]:[o]}function Nm(e,t,n,r,o,i,s){if(J.has(t)){if(it(e))return!1;if(n!==null&&zx(e,n,s))return!0;let a=ot(e);if(!a){let l=rt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Lm(a,n,s))return!0;if(Ae(a))return!0;return Bx(a,n,r)}if(Me(t))return km(e,n,go,$u(t));if(we.has(t))return km(e,n,ua,$d);if(t==="eval"){let a=jo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return $x(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&gn.has(a.subcommand.toLowerCase())&&Fm(a.rest,n).some((l)=>l.includes(n))}return!1}function Lm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function km(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,qo]).sources.some((a)=>a.value===qo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${qo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${qo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Dm(l,t,a))));return Uo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Gx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Yo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Yo));return Array.from(ze(o,n)).some((i)=>i.head===Yo&&!r.has(Yo))}function Wm(e,t){return Fm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Fm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Gm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function zx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Lm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Dm(a,t,s).some((u)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,u):f),d=ve(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function Bx(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Dx))if(Om(o,r))return!0;for(let o of e.matchAll(Nx))for(let i of(o[1]??"").matchAll(Lx))if(Om(i,r))return!0;return Ia(e,r)}function Om(e,t){let n=e[1]??e[2];return n!==void 0&&(Wx.test(n)||t.has(n))}function $x(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(nt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Gm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Wm(c.tokens,t)||Nm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Hx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",jx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Xo=/\{[^{}\s]*\}/g,zm=/\{\}|\{-?\d+\}/g,Vx=["e","f","source","file","-e","-f","--source","--file"],Kx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],qx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Yx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Bm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Zx=new Set(["--workdir","--wd"]),$m="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Km(e){return Ie([...e],(t)=>Ae(t))}function qm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=yn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=rf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=yn(t);if(p)return p;let g=Km(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=nR(t);if(p)return p}if(u!==void 0&&a){let p=yn(t);if(p)return p}let d=rR(u,t.cwd,t.environment.paths);if(d===null){let p=yn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(Na)){let g=yn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Jm(f.envAssignments,f.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,f),(p)=>Xx(p,o,t,f))}function Xx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(tf)){let h=yn(n);if(h)return h}let u=Km(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,p=Jm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Zo(l,E,n.budget),Gt(e,r)))};if(it(l))return h();let y=ot(l);if(y){if(nf(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(jm(y,A,n.budget),p))}if(F(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(jm(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&M(x[0])==="rm"&&Be(x)){let q=Hm(n);if(q)return q}let A=x?n.analyzeChild(x,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",yr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Vo(K(x===void 0?l:i?l.map((A)=>Qm(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=rt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&F(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Ma(Zo(l,y,n.budget,zm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Ma(Vm(l,y,n.budget),e.cwd,r));let h=Ma(l.flatMap((y,S)=>{if(S===0||!F(y))return[y];return y.startsWith("-")?[y.replace(zm,"")]:[]}),e.cwd,r);if(h)return h;return Hm(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Zo(l,h,n.budget):Vm(l,h,n.budget),S=C("parallel.shell-dynamic",yr),E=a&&e.head==="find"?tR(y,r):null,v=Zm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Da(y)||T==="xargs"&&Xm(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Ym(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??tt(y,n.policy?.rules??[])})}function Ym(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return eR(e);if(t==="git")return Jx(e);if(t==="find")return!0;if(we.has(t))return Um(e,Vx,cr);if(Me(t))return Um(e,Kx,po);return!1}function Da(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||nf(o)))}function Jx(e){if(Qx(e))return!0;let t=Re(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function Qx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function eR(e){if(it(e))return!1;let t=ot(e);if(t!==null)return F(t);let n=rt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function Um(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,$m]).some((o)=>o.value===$m);return Uo(r,t,(o)=>n(e.map((i)=>Qm(i,[o]))))}function Zm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return St(n);return Ie(o,(i)=>tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function tR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=Ym(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Da(a.tokens)||a.head==="xargs"&&Xm(a.tokens),n.customResult??=Zm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=F(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Xm(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&Da(t)}function Jo(e,t){return(n)=>P(C(e,t),n.policy)}var St=Jo("parallel.shell-dynamic",yr),nR=Jo("parallel.command-stream-dynamic",Hx),yn=Jo("parallel.command-stream-dynamic",jx),Hm=Jo("parallel.rm-recursive-force-dynamic",hr);function Ma(e,t,n){return P(Ho(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Jm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Qm(e,t){return e.replace(Xo,(n)=>ef(n,t))}function Zo(e,t,n,r=Xo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=ef(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function jm(e,t,n){return Zo([e],t,n)[0]??""}function Vm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function ef(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Xo)!==-1}function tf(e){if(Na(e))return!0;for(let t of e.matchAll(Xo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Na(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function nf(e){return/^\{[^{}\s]*\}$/.test(e)}function rR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Ux(e))return null;try{return ft(t??e,e,n)}catch{return null}}function rf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=fa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=fa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Yx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if(Bm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Bm.has(p)?2:1;continue}if(Zx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(qx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Na:tf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let m=oR(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function oR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function of(e){return rf(e).childStart}var iR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Wa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function La(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function af(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",iR):null;return P(a,i)??lf(e,t,n,o,i)}function lf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Wa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=aR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(C("shell.dynamic-structure",Qo),o);if(P($o(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(C("shell.dynamic-structure",Qo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&lR(t)?P(C("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(C("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return sf(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return sf(e,t.slice(of(t.map(w))),"parallel",n,r,o);return null}function sf(e,t,n,r,o,i){if(t.length===0)return null;let s=sR(t,r);if(Bn(e,s)){let l=P(C(`${n}.shell-dynamic`,n==="xargs"?Oa:yr),i);if(l)return l}let a=lf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Wa(l)&&La(l)))return P(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ka:hr),i);return null}function sR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function aR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function lR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Wa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||La(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||La(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function Fa(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!co(t[n.tokenIndex],n.value)})}var cR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",uR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",dR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function cf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",cR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",uR);if(e==="shred"&&n.length>0)return C("shred.target",dR);return null}var df=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ho(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>$o(e.words,Ga(e))},{heads:new Set(["find"]),analyze:(e)=>qd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Mm(e.words,{...uf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>qm(e.words,{...uf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function uf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ga(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function gf(e){return df.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=bo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=kt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=Co(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?K(i(f.words)):an(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new D("wrapperPeelIterations");let v=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=af(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Lo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){mf(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?jo(g):v==="trap"&&!a?wm(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return bn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return Sn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ta(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):yf(E,v)){if(it(h))return null;if(a&&s){let R=ot(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(gr(R)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=rt(g);if(I.kind==="dynamic")return bn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let R=ot(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):rt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=gR(h,S,A,n,r,t);if(R)return R;let I=ot(h);if(I){let qt=Vo(g,I);if(qt.kind==="dynamic")return ye(r);let hi=qt.kind==="literal"?qt.source:I,pl=hR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:pl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:pl,depth:t+1});let gl=n.analyzeNested(hi,{effectiveCwd:A,envAssignments:S});if(gl)return gl;return gr(hi)?ye(r):null}let L=rt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ei(L.source,A,S,n,r,t);let te=Am(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ei(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!Ta(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&Fa(cr(h),g))return ye(r);let R=Ud(h,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&Fa(po(h),g))return ye(r);let R=Bu(h);if(a&&s)return fR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(Us(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!hf(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(C("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:un}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return mf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let N=s?null:P(cf(v,h),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),de(N);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?za(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??tt(R,ue.policy.rules),analyzeChild:(R,I)=>za(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:gf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?bm(_e.words,Ga(_e)):void 0,pi=ff(ke?ke.match:qe?.(_e)??null,n.policy);if(r)yR(_e,pi,ke?.relaxation??null);if(pi)return de(pi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Sn(s,n.policy):null)??pR(s,n.policy)}let ml=qe!==void 0,fl=!s&&!ml&&!Wr.has(v),gi=r&&fl?[]:void 0;if(fl)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;gi?.push(I);let L=ff(mR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&ml)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let _r=tt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?Sn(s,n.policy):null}function za(e,t,n,r){return Ut(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function mR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(yf(c,u)||gf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=za(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function fR(e,t,n,r,o,i){if(!t)return Sn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(C("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(Us(e,t))return Sn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!hf(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(C("interpreter.dangerous-command",un),o.policy);if(a)return de(a)}return Sn(i,o.policy)}function hf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Mo)||e.reason===pn)&&!Fr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function Sn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function pR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function gR(e,t,n,r,o,i){let s=Im(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ei(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ei(a,n,t,r,o,i,!0)}function ei(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function hR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function yR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function mf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(bR())}function bR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function yf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function ff(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var CR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,SR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function vR(e,t){let n=Sf(e,t);if(n.length===0)return!1;let r=n[Cf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return CR.test(e.join(" "))}function bf(e,t,n,r,o){if(e.dialect==="powershell"){let h=xR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return pf(AR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!vR(i,n))return s?null:void 0;if(!t)return null;let a=Sf(i,n,t),l=Cf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?ER(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return pf(g,t,n.paths)}function ER(e,t){let n=mr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function pf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function xR(e,t){let n=RR(e[0])?1:0,r=e[n];if(!_R(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!SR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return wR(e.slice(n+1),t)}function RR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function _R(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function wR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function AR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Cf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Sf(e,t,n){let r=PR(e);return pt([...r],t,n)}function PR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var TR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ja(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ha(e,n);let u=`${Mo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return wf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return wf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ha(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=sm(n.environment.env,n.envAssignments);return ri(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ri(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=IR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=f||En(m);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=xn(X);return U.functionDefinitions.set(c.name,c.body),Ba(X,[U],d,m==="&",En(m))}),ee=$a(Z,[],h,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let N=ri(c.body,t,n,r,[xn(U)]);if(N.result)return N;if(Z.push(...Ba(U,N.states,d,m==="&",En(m))),S)ee.push(U,...d?N.states.map((ue)=>ti(U,ue)):N.states)}let X=$a(Z,ee,h,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=oi(a)&&v?.kind==="command"?_m(v)??OR(v):void 0,x=[],A=[];for(let Z of g){let ee=MR(c,t,n,r,[xn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ti(Z,U));for(let U of X){let N=xn(U),ue=LR(c,t,n.trace?{...n,trace:Af(n.trace,E)}:n,r,N,oi(a),T);if(ue)return{result:ue,states:i};let _e=JR(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",ii(_e));let qe=_e?t+1>=V.recursionDepth.cap?Ua(c.displayText,n,[N]):ri(_e,t+1,n,r,[N]):{result:null,states:ZR(c,N)};if(qe.result)return qe;if(x.push(...Ba(Z,qe.states,d,m==="&",En(m))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ti(Z,ke):ke))}}let q=$a(x,A,h,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function IR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(oi(r)||oi(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&kR(e,t)}function Ba(e,t,n,r,o){let i=n?t.map((a)=>ti(e,a)):[...t],s=o?i.flatMap((a)=>vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ti(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function kR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(DR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function oi(e){return e==="|"||e==="|&"}function OR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function $a(e,t,n,r,o,i){let s={success:ni([...n,...e]),failure:ni([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ni([...s.success,...s.failure]):s.success,conditionalStates:a}}function Af(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function MR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=NR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ua(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Ua(s,n,o);if(a.status!=="complete")return vf(i,n,r,o);n.budget.charge("derivedTokens",ii(a)),i.push({program:a,depth:t+1})}}return vf(i,n,r,o)}function DR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function vf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ri(i.program,i.depth,t,n,[xn(a)]);if(l.result)return l;s.push(...l.states)}o=ni(s)}return{result:null,states:o}}function NR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ii(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ii(o),0):n.kind==="group"||n.kind==="function"?ii(n.body):0),0)}function Ua(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function LR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=UR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Pf(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=im(c,o.shellGitContextState),f=lm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Nd(e,i,e_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return QR(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Wu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=Ef(e,l,o,f,s,a);if(S)return S;return xa(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=ja(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Af(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let g=Ef(e,l,o,f,s,a);if(g)return g;return xa(d,o.shellGitContextState),null}function Ef(e,t,n,r,o,i){let s=HR(e,t,n,r??new Map,i);if(s)return s;return Pf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),GR(e,t,n,i.environment.paths,i.budget),KR(e,n,o,i.environment,i.trace),null}var WR=new Set([">>","<>"]);function Pf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?FR(s):WR.has(s.operator)))continue;xf(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Tf(e.words.slice(1));if(!i)return;for(let s of i.operands)xf(s,t,r,o)}function FR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function xf(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function GR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of zR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!zu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function zR(e){let t=$R(e.redirections)?.target,n=Rf(t)?[t]:[];if(le(e.words[0],"cat"))return BR(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=Tf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(Rf))return[];return[...r.operands,...n]}function BR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function $R(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Tf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function Rf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Va(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function UR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Ht;let r=n[0];if(!r?.heredoc)return Ht;if(!Va(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return TR;if(r.fd!==void 0&&r.fd!==0)return Ht;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return Ht;let o=e.redirections.some((a)=>a!==r&&_f(a.target));if(le(e.words[0],"cat"))return o?Ht:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(_f)?Ht:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return Ht}function _f(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function HR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(VR(e,i,n,r,o))return null;let a=jR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ha(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function jR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Va(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>le(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(m)return m}if(!Zn(l,void 0,!n.strict))return null;let u=P(C("interpreter.dangerous-command",un),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function VR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Va(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return it(a)}function KR(e,t,n,r,o){let i=bf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var qR=/^[A-Za-z_][A-Za-z0-9_]*$/,YR=8;function ZR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!qR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=YR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=xn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function xn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:am(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ni(e){let t=[];for(let n of e){if(!t.some((r)=>XR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function XR(e,t){return e.effectiveCwd===t.effectiveCwd&&vn(e.shellGitContextState.env,t.shellGitContextState.env)&&vn(e.literalHeredocFiles,t.literalHeredocFiles)&&vn(e.functionDefinitions,t.functionDefinitions)&&vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function JR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function QR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function e_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ha(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function wf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var t_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function If(e,t,n,r){let o=ja(e,0,{...t,...iu(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function kf(e,t,n){try{return{decision:e()}}catch(r){let o=n_(r,t,n);if(!o)throw r;return o}}function n_(e,t,n){if(!(e instanceof D)||!t_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var r_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),qa=new Set(["cc-safety-net","ccsn"]),o_=new Set(["bunx","npx","pnpx"]),i_=new Set(["pnpm","yarn"]),s_=new Set(["npm","pnpm","yarn"]),a_=new Set(["bun","node"]);function ai(e,t,n={}){if(qa.has(e))return 0;if(o_.has(e)){if(n.broad)return Ka(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&s_.has(e)&&n.broad&&t[r]==="exec"){let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(i_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(a_.has(e)){let o=n.broad&&r!==-1?r:0;if(Of(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Of(t[o+1]))return o+2}return null}function Ka(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return qa.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return qa.has(e.slice(0,t))}function Of(e){let t=e?.replaceAll("\\","/");return[...r_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Mf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Df(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>l_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function l_(e,t){let n=pt([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"path";var Ff="This path contains the protected policy config and you must not modify or delete it.",c_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Gf(e,t,n){let r=g_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Nf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Lf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Lf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Nf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Ar(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Nf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Lf(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>u_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>p_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function u_(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&d_(a)){let l=m_(a).find((c)=>Wf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Go(i,1)||ga(i,r)){let c=(Fo(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return br(m,t.cwd,n,r,o)||Wf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=_o(a).sources.find((c)=>h_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(f_(i,s))return null;for(let l of[...e,...i])for(let c of zf(l))if(br(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function d_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function m_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function f_(e,t){if(!c_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function p_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of zf(i))if(br(s,t,n,r,o))return{target:s};return null}function zf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function g_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Fl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Wf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function h_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as y_,resolve as di,win32 as b_}from"path";import{fileURLToPath as C_}from"url";var Jf="Access to a sensitive path is not allowed.",Qf=new Set(["echo","printf"]),S_=new Set(["find"]),v_=new Set(["!","do","elif","else","if","then","until","while"]),E_=new Set(["-exec","-execdir"]),x_=new Set([";","+"]),R_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),__=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ep=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),w_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),A_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),tp=new Set(["-c","-e","-r","-E","--eval","--exec"]),P_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),T_=new Set(["grep","rg"]),I_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),k_=new Set(["commit","merge","notes","stash","tag"]),O_=new Set(["-m","--message"]),M_=new Set(["--grep"]),Bf=new Set(["jq","gojq","jaq"]),$f="f",Uf="file",D_="files",N_=new Set(["e","f"]),L_=new Set(["regexp","file"]),W_=new Set(["e","f","A","B","C","m"]),F_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ya="__CC_SAFETY_NET_PIPE_INPUT__",Xa=/[\w./~@+-]*[./~][\w./~@+-]*/g,G_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,z_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,B_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Hf=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,jf=/\b(?:system|exec|spawn|popen)\s*$/,$_=/\b(?:eval|exec)\s*\(/g,U_=/\b(?:eval|exec)\s*$/,H_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Vf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Bw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Gw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(lp(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!Qa(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Qa(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&$w(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function np(e,t,n,r,o={}){let i=Kf(e,n,r),s=Vf(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Vf(i,t,e.invocation.context.configCwd,n,r,new Set(Kf(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&j_(e,n)?null:a}function j_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Ro(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(et(s.text,t))}let o=at(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return el(i,o.slice(1))}function el(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>R_.has(n))}function Kf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Rn(s.shell,e.store,r,t,o,n,V_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function V_(e){return e.program.dialect==="powershell"}function Rn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(et(e.source,r),t,n,r,o,i)],l=(c)=>et(rw(c,s),r);return xo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...rp(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Js;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function tl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Rn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(Bf.has(Ue(at(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...mi(g,t,n,r,o,i)]}let l=nw(e).map(a),c=at(e);if(c.length===0)return l;let u=c[0]??"",m=Ue(u).toLowerCase(),d=c.slice(1),f=c.findIndex((g)=>!v_.has(g));if(n.standard===!0&&f!==-1&&el(Ue(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=K_(u,m,d);if(p)return[...l,...p.map(a)];if(Qf.has(m))return n.capturedOutput===!0?[...l,...op(e).map(a)]:l;if(m==="eval")return[...l,...tl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(m,g)).map(a)];if(m==="git")return[...l,...iw(d).map(a)];if(m==="gh")return[...l,...Ja(m,d,I_).map(a)];if(Bf.has(m))return[...l,...ow(d).map(a)];if(T_.has(m))return[...l,...Iw(d).map(a)];if(S_.has(m))return[...l,...cw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>dw(g,t,n,r,o,i)),...d.flatMap(mw).map(a)];if(m==="curl")return[...l,...d.flatMap((g)=>Ke(m,g)).map(a),...sw(d).map(a)];if(nr(m)){let g=er.has(m)?ve([m,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Rn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...uw(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(m,g)).map(a)]}function K_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s)){let a=at(e),l=el(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...op(e),...l].map((c)=>({target:c,cwd:i}))}return rp(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=at(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return tl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function rp(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?Rn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function op(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!Qf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[nl(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[nl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return nl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function nl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=at(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ya]:l.map((m)=>m.split(c).join(Ya));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(Ya))}function ew(e){let t=at(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=rl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(tp.has(o)||ip(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(H_.get(n)?.has(o))r++;continue}return!1}return!0}function rl(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(ap(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var qf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!qf.test(e))return e;return`~${e.replace(qf,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...k_.has(r)?Ja("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),O_):Ja("git",e.slice(n),M_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function Ja(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Yf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Yf(o,t)})}function Yf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Za(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Za(t.slice(n+1))}return t.startsWith("@")?Za(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(ep.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ep.has(r)?{flag:r,value:e.slice(n+1)}:null}function Za(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!E_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>x_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!__.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(tp.has(c)||ip(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ip(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return P_.get(t[t.length-1]??"")?.has(rl(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return da(e)?.commands.flatMap((s)=>Rn(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ol),...e.match(Xa)??[]]}function ui(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(Hf)!==null||l.literals.some((g)=>jf.test(l.masked.slice(0,g.start))),u=l.masked.match($_)!==null||l.literals.some((g)=>U_.test(l.masked.slice(0,g.start))),m=r.standard===!0&&!er.has(e),d=m&&!(Cw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(Hf),(g)=>{let h=g.index+g[0].length;return{start:h,end:js(l.masked,h)}}):[],p=!m||f.some((g)=>Vs(l.masked,g.start))?l.literals:l.literals.filter((g)=>jf.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ol(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(Xa)??[]).map(a),...c?p.flatMap((g)=>tl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>ui(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(Xa)??[]).map(a)]}function pw(e){let t=rl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(z_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&bw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=yw(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&B_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return G_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function bw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(w_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>A_.has(i)))continue;if(o.length>1)return!0;if(Sw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function Sw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Rn(a,t,{...n,capturedOutput:!0},r,o,i),...xw(a,r)?Rw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function xw(e,t){let n=Ro(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Rw(e,t){return Ro(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(ol)}function ol(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(sp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(sp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function sp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===D_)o=!0;if(L_.has(m))r=!0;if(d!==void 0){if(m===Uf)t.push(d);continue}if(F_.has(m)){let f=e[l+1];if(m===Uf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(N_.has(h))r=!0;if(W_.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===$f)t.push(f);continue}let p=e[l+1];if(d===$f&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function at(e){let t=e.findIndex((n)=>!ap(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function ap(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function Qa(e,t,n,r){let o=lp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function lp(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var Ww=new Set(["node_modules","__pycache__"]),Fw=[["vendor","bundle"],["vendor","cache"]];function Gw(e,t,n,r,o){if(Nw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Lw(s)||Qa(e,t,r,o);if(Mw.has(s)||Dw.some((d)=>s.startsWith(d)))return null;let c=B(jw(e,t,r,o));for(let d of as){let f=`~/${d.suffixParts.join("/")}`;if((Xf(a,f)||Xf(c,f))&&st(d.id,n))return d.id}let u=zw(i,t,n,r,o);if(u)return u;if(kw.has(s))return null;for(let d of ss)if(s===d.basename&&st(d.id,n))return d.id;if(s.startsWith(Ow)&&st($r.id,n)&&l())return $r.id;for(let d of ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&st(d.id,n)&&l())return d.id}for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&st(d.id,n))return d.id}if(Uw(a))return null;if(!s.includes(".")&&Fn.pattern.test(s)&&st(Fn.id,n))return Fn.id;let m=Hw(s,n);if(m)return m;return null}function zw(e,t,n,r,o){return Ur.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&jt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Zf=new WeakMap;function z(e,t,n,r,o){let i=Zf.get(o)??new Map;Zf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>cp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>jt(B(e),B(ce(t,r))))}function vr(e,t,n,r,o){return cp(e,Ve(t,n,r,o))}function cp(e,t){return B(e)===B(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Bw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Er(e,t,o,i));return n.some((a)=>jt(s,B(Er(a,r,o,i))))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(G(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?$e(G(di(Ce(u)),o.paths,i)):l&&$e(G(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=B(Er(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return jt(s,f)})}function Uw(e){let t=e.split("/");return t.some((n)=>Ww.has(n))||Fw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Hw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of us)if(r===o.extension&&st(o.id,t))return o.id;for(let o of ds)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";if(!o)return i;let s=sl(i,o),a=ci(s)?s:$e(di(t,s)),l=$e(G(a,n.paths,r));if(!jt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Xf(e,t){return e===t||e.startsWith(`${t}/`)}function jw(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i||!o)return"";let s=sl(i,o),a=y_.normalize(ci(s)?s:$e(di(t,s))),l=$e(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";let s=o?sl(i,o):i;return $e(G(ci(s)?s:di(t,s),n.paths,r))}function il(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(G(Ce(r),t.paths,n)):"",i=$e(Ce(Vw(et(e,t))));return{home:o,normalized:i}}function Vw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return C_(e)}catch{return e}}function sl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Kw(e){if(process.platform==="win32")return!0;return b_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var qw={findPolicyMutation:Gf,findGitMetadataMutation:yd,resolveGitMetadata:Yw,loadPolicySnapshot:ou,findSensitiveTarget:np,analyzeCommand:If,getModes:Ni};function up(e,t){let n={...qw,...t.dependencies},r=Jw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Ld,intent:"stop_and_explain"}};let l=be(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ff,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Df(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Mf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Zw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Jf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...al("command-validation",o),...h};let S=vt("command-analysis",o,()=>kf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Xw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function Yw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Zw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Xw(e){return ge(e,"declared-command")?.program}function Jw(e){try{return In(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Vt("policy-protection",al("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,al(e,r instanceof Ye?void 0:t,r),r)}}function al(e,t,n){let r=n instanceof D||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?bi:wn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as dA,mkdirSync as mA}from"fs";import{isAbsolute as fA,join as ul}from"path";import{lstatSync as mp,readdirSync as Qw,readFileSync as eA,rmdirSync as tA,statSync as fp,unlinkSync as nA,utimesSync as rA,writeFileSync as oA}from"fs";import{join as Rr}from"path";function dp(e,t={}){return Xr(en(e,t),e.home).policy.audit.retention_days}var cl=86400000,iA=".last-prune",sA=/^\d{4}-\d{2}$/,aA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,pp=(e)=>Math.floor(e/cl);function hp(e,t,n=()=>new Date){try{let r=n().getTime();if(!fp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,iA),i=fp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&pp(i)===pp(r))return;let s=r-dp(e)*cl,a=new Date(r).toISOString().slice(0,7);for(let l of ll(t)){if(l.isDirectory()){lA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))cA(Rr(t,l.name),s)}oA(o,"",{mode:384}),rA(o,r/1000,r/1000)}catch{}}function lA(e,t,n){for(let r of ll(e)){if(!r.isDirectory()||!sA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ll(o)){if(!i.isFile())continue;let s=aA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+cl;if(!Number.isFinite(a)||a>=t)continue;yp(Rr(o,i.name))}if(r.name!==n)gp(o)}gp(e)}function cA(e,t){try{let n=mp(e);if(n.mtimeMs>=t)return;let r=eA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(uA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(mp(e).mtimeMs!==n.mtimeMs)return;yp(e)}catch{}}function uA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ll(e){try{return Qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function yp(e){try{nA(e)}catch{}}function gp(e){try{tA(e)}catch{}}var pA="2.4.6",gA=1e4,hA=2000,yA=256,bA=32768;function CA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function SA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function dl(e,t,n,r,o,i,s={}){let a=CA(t);if(!a)return;let l=EA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:gA),m=fi(lt(r),hA),d=s.toolName?fi(lt(s.toolName),yA):void 0,f=i===null?void 0:fi(lt(i),bA),p=ul(l,SA(f?.value??null),c.slice(0,7));mA(p,{recursive:!0,mode:448});let g=ul(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Wi)(),v:pA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};dA(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),hp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function vA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&fA(n)?n:null}function EA(e){let t=vA(e);return t?ul(t,".cc-safety-net","logs"):null}function Cp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=bp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?bp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function bp(e){return"command"in e?e.command??"":""}function Sp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function vp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function xp(e,t,n){try{let r=up(t,{environment:e,...n.guard});return Ep(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Ep(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:xA(r.cause)}),r}}function Ep(e,t,n,r,o=!0,i){Sp(e,Cp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:An(t),cwd:e}}function Rp(e,t={}){return(n,r)=>{try{return RA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(An())}}}function RA(e,t,n,r){let o=Yl();if(n.cancelled?.(t))return n.block(An());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return vp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=hl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=xp(o,i,{guard:{auditAllowed:Zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${bl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var _A={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>AA(e,t,n),getSessionId:(e)=>IA(e),allow:{action:"allow"},block:(e)=>kA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},_p=wA();function wA(e={}){return Rp(_A,e)}function AA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=PA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=TA(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:Ei(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?$l(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function PA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Bl(".",[r],t)}catch{return}}function TA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function IA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function kA(e){return{action:"reject-and-continue",message:yl(e)}}function OA(e){e.on("tool.call",(t)=>_p(t,e))}export{OA as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function fr(e){return e?w(e):""}function _x(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Oa(e,t){return Ia(De(e,"posix"),t)}function gr(e){return Oa(e,new Set(Array.from(e.matchAll(_m)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ia(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ia(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ia(o,n))||Tm(r.words,n))return!0;Ix(r,n)}return!1}function Tm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Rm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Rm(s[l],t)}let i=wx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Tm(e.slice(i),t)}function wx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Ax(e,t+1);if(r==="exec")return Px(e,t+1);if(r==="env")return Tx(e,t+1,n);return null}function Ax(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Px(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Tx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Ix(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(_m)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(hx.test(o)||t.has(o))}))}function Rm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var kx=["--init-file","--rcfile"],Ox=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function ot(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Im(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Im(e,t,!1);if(r!==null)return r}}return null}function it(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Im(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function km(e){let t=k(e[0]??"").toLowerCase(),n=Mx(e,t),r=Ox.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Mx(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?kx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Ji.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Qi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Ma="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Da="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Dx="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",Nx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Lx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Wx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Fx=/^(?:[0-9]+|[@*])$/;function Dm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=C("xargs.shell-dynamic",Da);if(zx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=zm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Fm(l,o),d=t.analyzeChild(l,{...Gt(a,t),dynamicInput:u,dynamicSourceInput:m||Lm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",Ma)});if(d)return d;let f=Gx(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,Dx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...Gt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=tt(l,t.policy?.rules??[]);if(p)return p}return null}function Gx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Nm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Sm(e,r,t.length,n);return o===null?[]:[o]}function Lm(e,t,n,r,o,i,s){if(J.has(t)){if(it(e))return!1;if(n!==null&&Bx(e,n,s))return!0;let a=ot(e);if(!a){let l=rt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Wm(a,n,s))return!0;if(Ae(a))return!0;return $x(a,n,r)}if(Me(t))return Om(e,n,ho,Uu(t));if(we.has(t))return Om(e,n,ma,Ud);if(t==="eval"){let a=Vo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Ux(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&gn.has(a.subcommand.toLowerCase())&&Gm(a.rest,n).some((l)=>l.includes(n))}return!1}function Wm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Om(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((a)=>a.value===Yo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Yo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Yo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Nm(l,t,a))));return Ho(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function zx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(ze(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Fm(e,t){return Gm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Gm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function zm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Bx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Wm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Nm(a,t,s).some((u)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,u):f),d=ve(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function $x(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Nx))if(Mm(o,r))return!0;for(let o of e.matchAll(Lx))for(let i of(o[1]??"").matchAll(Wx))if(Mm(i,r))return!0;return Oa(e,r)}function Mm(e,t){let n=e[1]??e[2];return n!==void 0&&(Fx.test(n)||t.has(n))}function Ux(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(nt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=zm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Fm(c.tokens,t)||Lm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",jx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Vx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Jo=/\{[^{}\s]*\}/g,Bm=/\{\}|\{-?\d+\}/g,Kx=["e","f","source","file","-e","-f","--source","--file"],qx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Yx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Zx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),$m=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Xx=new Set(["--workdir","--wd"]),Um="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function qm(e){return Ie([...e],(t)=>Ae(t))}function Ym(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=yn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=of(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=yn(t);if(p)return p;let g=qm(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=rR(t);if(p)return p}if(u!==void 0&&a){let p=yn(t);if(p)return p}let d=oR(u,t.cwd,t.environment.paths);if(d===null){let p=yn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(Wa)){let g=yn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Qm(f.envAssignments,f.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,f),(p)=>Jx(p,o,t,f))}function Jx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(nf)){let h=yn(n);if(h)return h}let u=qm(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,p=Qm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Xo(l,E,n.budget),Gt(e,r)))};if(it(l))return h();let y=ot(l);if(y){if(rf(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Vm(y,A,n.budget),p))}if(F(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Vm(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let q=jm(n);if(q)return q}let A=x?n.analyzeChild(x,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",yr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Ko(K(x===void 0?l:i?l.map((A)=>ef(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=rt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&F(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Na(Xo(l,y,n.budget,Bm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Na(Km(l,y,n.budget),e.cwd,r));let h=Na(l.flatMap((y,S)=>{if(S===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Bm,"")]:[]}),e.cwd,r);if(h)return h;return jm(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Xo(l,h,n.budget):Km(l,h,n.budget),S=C("parallel.shell-dynamic",yr),E=a&&e.head==="find"?nR(y,r):null,v=Xm(y,a,n)??E?.customResult??null,T=O(e.head),x=a&&(T==="rm"&&La(y)||T==="xargs"&&Jm(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Zm(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??tt(y,n.policy?.rules??[])})}function Zm(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return tR(e);if(t==="git")return Qx(e);if(t==="find")return!0;if(we.has(t))return Hm(e,Kx,cr);if(Me(t))return Hm(e,qx,go);return!1}function La(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||rf(o)))}function Qx(e){if(eR(e))return!0;let t=Re(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function eR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function tR(e){if(it(e))return!1;let t=ot(e);if(t!==null)return F(t);let n=rt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function Hm(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Um]).some((o)=>o.value===Um);return Ho(r,t,(o)=>n(e.map((i)=>ef(i,[o]))))}function Xm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return St(n);return Ie(o,(i)=>tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function nR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=Zm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&La(a.tokens)||a.head==="xargs"&&Jm(a.tokens),n.customResult??=Xm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=F(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Jm(e){let t=e.slice($t(e).childStart);return O(t[0]??"")==="rm"&&La(t)}function Qo(e,t){return(n)=>P(C(e,t),n.policy)}var St=Qo("parallel.shell-dynamic",yr),rR=Qo("parallel.command-stream-dynamic",jx),yn=Qo("parallel.command-stream-dynamic",Vx),jm=Qo("parallel.rm-recursive-force-dynamic",hr);function Na(e,t,n){return P(jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Qm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function ef(e,t){return e.replace(Jo,(n)=>tf(n,t))}function Xo(e,t,n,r=Jo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=tf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Vm(e,t,n){return Xo([e],t,n)[0]??""}function Km(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function tf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Jo)!==-1}function nf(e){if(Wa(e))return!0;for(let t of e.matchAll(Jo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Wa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function rf(e){return/^\{[^{}\s]*\}$/.test(e)}function oR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Hx(e))return null;try{return ft(t??e,e,n)}catch{return null}}function of(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ga(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ga(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Zx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if($m.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=$m.has(p)?2:1;continue}if(Xx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(Yx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Wa:nf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let m=iR(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function iR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function sf(e){return of(e).childStart}var sR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ei="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ga(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Fa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function lf(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",sR):null;return P(a,i)??cf(e,t,n,o,i)}function cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ga(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=lR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(C("shell.dynamic-structure",ei),o);if(P(Uo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(C("shell.dynamic-structure",ei),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&cR(t)?P(C("shell.dynamic-structure",ei),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(C("shell.dynamic-structure",ei),o):null}if(s==="xargs")return af(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return af(e,t.slice(sf(t.map(w))),"parallel",n,r,o);return null}function af(e,t,n,r,o,i){if(t.length===0)return null;let s=aR(t,r);if(Bn(e,s)){let l=P(C(`${n}.shell-dynamic`,n==="xargs"?Da:yr),i);if(l)return l}let a=cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ga(l)&&Fa(l)))return P(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ma:hr),i);return null}function aR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function lR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function cR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ga(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Fa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Fa(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function za(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!uo(t[n.tokenIndex],n.value)})}var uR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",dR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",mR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function uf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",uR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",dR);if(e==="shred"&&n.length>0)return C("shred.target",mR);return null}var mf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Uo(e.words,Ba(e))},{heads:new Set(["find"]),analyze:(e)=>Yd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Dm(e.words,{...df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Ym(e.words,{...df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function df(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ba(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function hf(e){return mf.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Co(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=kt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=So(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?K(i(f.words)):an(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new D("wrapperPeelIterations");let v=O(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=lf(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Wo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ff(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?Vo(g):v==="trap"&&!a?Am(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return bn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return Sn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ka(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):bf(E,v)){if(it(h))return null;if(a&&s){let R=ot(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(gr(R)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=rt(g);if(I.kind==="dynamic")return bn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let R=ot(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):rt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=hR(h,S,A,n,r,t);if(R)return R;let I=ot(h);if(I){let qt=Ko(g,I);if(qt.kind==="dynamic")return ye(r);let yi=qt.kind==="literal"?qt.source:I,gl=yR(yi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:gl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:gl,depth:t+1});let hl=n.analyzeNested(yi,{effectiveCwd:A,envAssignments:S});if(hl)return hl;return gr(yi)?ye(r):null}let L=rt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ti(L.source,A,S,n,r,t);let te=Pm(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ti(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!ka(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&za(cr(h),g))return ye(r);let R=Hd(h,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&za(go(h),g))return ye(r);let R=$u(h);if(a&&s)return pR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(js(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!yf(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(C("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:un}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return ff(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let N=s?null:P(uf(v,h),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),de(N);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?$a(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??tt(R,ue.policy.rules),analyzeChild:(R,I)=>$a(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:hf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Cm(_e.words,Ba(_e)):void 0,gi=pf(ke?ke.match:qe?.(_e)??null,n.policy);if(r)bR(_e,gi,ke?.relaxation??null);if(gi)return de(gi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Sn(s,n.policy):null)??gR(s,n.policy)}let pl=!s&&qe===void 0&&!Wr.has(v),hi=r&&pl?[]:void 0;if(pl)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;hi?.push(I);let L=pf(fR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[],embeddedCommandFound:O(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[]}),l&&s&&!s.wrappedByTransparent)return null;let _r=tt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?Sn(s,n.policy):null}function $a(e,t,n,r){return Ut(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function fR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(bf(c,u)||hf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=$a(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function pR(e,t,n,r,o,i){if(!t)return Sn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(C("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(js(e,t))return Sn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!yf(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(C("interpreter.dangerous-command",un),o.policy);if(a)return de(a)}return Sn(i,o.policy)}function yf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Do)||e.reason===pn)&&!Fr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function Sn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function gR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function hR(e,t,n,r,o,i){let s=km(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function yR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function bR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ff(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(CR())}function CR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function bf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function pf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var SR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,vR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function ER(e,t){let n=vf(e,t);if(n.length===0)return!1;let r=n[Sf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return SR.test(e.join(" "))}function Cf(e,t,n,r,o){if(e.dialect==="powershell"){let h=RR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return gf(PR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!ER(i,n))return s?null:void 0;if(!t)return null;let a=vf(i,n,t),l=Sf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?xR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return gf(g,t,n.paths)}function xR(e,t){let n=mr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function gf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function RR(e,t){let n=_R(e[0])?1:0,r=e[n];if(!wR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!vR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return AR(e.slice(n+1),t)}function _R(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function wR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function AR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function PR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Sf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function vf(e,t,n){let r=TR(e);return pt([...r],t,n)}function TR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var IR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ka(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Va(e,n);let u=`${Do}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Af(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Af(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Va(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=am(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=kR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=f||En(m);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=xn(X);return U.functionDefinitions.set(c.name,c.body),Ua(X,[U],d,m==="&",En(m))}),ee=Ha(Z,[],h,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let N=oi(c.body,t,n,r,[xn(U)]);if(N.result)return N;if(Z.push(...Ua(U,N.states,d,m==="&",En(m))),S)ee.push(U,...d?N.states.map((ue)=>ni(U,ue)):N.states)}let X=Ha(Z,ee,h,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=ii(a)&&v?.kind==="command"?wm(v)??MR(v):void 0,x=[],A=[];for(let Z of g){let ee=DR(c,t,n,r,[xn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ni(Z,U));for(let U of X){let N=xn(U),ue=WR(c,t,n.trace?{...n,trace:Pf(n.trace,E)}:n,r,N,ii(a),T);if(ue)return{result:ue,states:i};let _e=QR(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let qe=_e?t+1>=V.recursionDepth.cap?ja(c.displayText,n,[N]):oi(_e,t+1,n,r,[N]):{result:null,states:XR(c,N)};if(qe.result)return qe;if(x.push(...Ua(Z,qe.states,d,m==="&",En(m))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ni(Z,ke):ke))}}let q=Ha(x,A,h,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function kR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&OR(e,t)}function Ua(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function OR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(NR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function MR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function Ha(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Pf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function DR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=LR(e);if(s){if(t+1>=V.recursionDepth.cap)return ja(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return ja(s,n,o);if(a.status!=="complete")return Ef(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return Ef(i,n,r,o)}function NR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Ef(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[xn(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function LR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function ja(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function WR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=HR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Tf(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=sm(c,o.shellGitContextState),f=cm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Ld(e,i,t_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return e_(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Fu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=xf(e,l,o,f,s,a);if(S)return S;return _a(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ka(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Pf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let g=xf(e,l,o,f,s,a);if(g)return g;return _a(d,o.shellGitContextState),null}function xf(e,t,n,r,o,i){let s=jR(e,t,n,r??new Map,i);if(s)return s;return Tf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),zR(e,t,n,i.environment.paths,i.budget),qR(e,n,o,i.environment,i.trace),null}var FR=new Set([">>","<>"]);function Tf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?GR(s):FR.has(s.operator)))continue;Rf(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=If(e.words.slice(1));if(!i)return;for(let s of i.operands)Rf(s,t,r,o)}function GR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Rf(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function zR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of BR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Bu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function BR(e){let t=UR(e.redirections)?.target,n=_f(t)?[t]:[];if(le(e.words[0],"cat"))return $R(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=If(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(_f))return[];return[...r.operands,...n]}function $R(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function UR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function If(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function _f(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function qa(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function HR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Ht;let r=n[0];if(!r?.heredoc)return Ht;if(!qa(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return IR;if(r.fd!==void 0&&r.fd!==0)return Ht;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return Ht;let o=e.redirections.some((a)=>a!==r&&wf(a.target));if(le(e.words[0],"cat"))return o?Ht:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(wf)?Ht:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return Ht}function wf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function jR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(KR(e,i,n,r,o))return null;let a=VR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Va(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function VR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!qa(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>le(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(m)return m}if(!Zn(l,void 0,!n.strict))return null;let u=P(C("interpreter.dangerous-command",un),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function KR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!qa(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return it(a)}function qR(e,t,n,r,o){let i=Cf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var YR=/^[A-Za-z_][A-Za-z0-9_]*$/,ZR=8;function XR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!YR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=ZR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=xn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function xn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:lm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>JR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function JR(e,t){return e.effectiveCwd===t.effectiveCwd&&vn(e.shellGitContextState.env,t.shellGitContextState.env)&&vn(e.literalHeredocFiles,t.literalHeredocFiles)&&vn(e.functionDefinitions,t.functionDefinitions)&&vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function QR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function e_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function t_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Va(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Af(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var n_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function kf(e,t,n,r){let o=Ka(e,0,{...t,...su(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Of(e,t,n){try{return{decision:e()}}catch(r){let o=r_(r,t,n);if(!o)throw r;return o}}function r_(e,t,n){if(!(e instanceof D)||!n_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var o_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Za=new Set(["cc-safety-net","ccsn"]),i_=new Set(["bunx","npx","pnpx"]),s_=new Set(["pnpm","yarn"]),a_=new Set(["npm","pnpm","yarn"]),l_=new Set(["bun","node"]);function li(e,t,n={}){if(Za.has(e))return 0;if(i_.has(e)){if(n.broad)return Ya(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ai(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&a_.has(e)&&n.broad&&t[r]==="exec"){let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(s_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ai(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(l_.has(e)){let o=n.broad&&r!==-1?r:0;if(Mf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Mf(t[o+1]))return o+2}return null}function Ya(e){let t=e.findIndex((r)=>ai(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ai(r))break;n++}return n}function ai(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Za.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Za.has(e.slice(0,t))}function Mf(e){let t=e?.replaceAll("\\","/");return[...o_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Df="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Nf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>c_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function c_(e,t){let n=pt([...e],t),r=n.slice(1),o=li(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ci}from"path";var Gf="This path contains the protected policy config and you must not modify or delete it.",u_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function zf(e,t,n){let r=h_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Lf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Lf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Ar(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Lf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Wf(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>d_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>g_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function d_(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&m_(a)){let l=f_(a).find((c)=>Ff(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(zo(i,1)||ya(i,r)){let c=(Go(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return br(m,t.cwd,n,r,o)||Ff(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=wo(a).sources.find((c)=>y_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(p_(i,s))return null;for(let l of[...e,...i])for(let c of Bf(l))if(br(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function m_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function f_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function p_(e,t){if(!u_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function g_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Bf(i))if(br(s,t,n,r,o))return{target:s};return null}function Bf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function h_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>ci(a)));for(let a=ci(o);;a=ci(a))if(s.add(a),ci(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Ff(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function y_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ui,posix as Qf,resolve as mi,win32 as b_}from"path";import{fileURLToPath as C_}from"url";var ep="Access to a sensitive path is not allowed.",tp=new Set(["echo","printf"]),S_=new Set(["find"]),v_=new Set(["!","do","elif","else","if","then","until","while"]),E_=new Set(["-exec","-execdir"]),x_=new Set([";","+"]),R_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),__=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),np=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),w_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),A_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),rp=new Set(["-c","-e","-r","-E","--eval","--exec"]),P_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),T_=new Set(["grep","rg"]),I_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),k_=new Set(["commit","merge","notes","stash","tag"]),O_=new Set(["-m","--message"]),M_=new Set(["--grep"]),$f=new Set(["jq","gojq","jaq"]),Uf="f",Hf="file",D_="files",N_=new Set(["e","f"]),L_=new Set(["regexp","file"]),W_=new Set(["e","f","A","B","C","m"]),F_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Xa="__CC_SAFETY_NET_PIPE_INPUT__",Qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,G_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,z_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,B_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,jf=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Vf=/\b(?:system|exec|spawn|popen)\s*$/,$_=/\b(?:eval|exec)\s*\(/g,U_=/\b(?:eval|exec)\s*$/,H_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Kf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Bw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Gw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(up(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!tl(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!tl(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&$w(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function op(e,t,n,r,o={}){let i=qf(e,n,r),s=Kf(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Kf(i,t,e.invocation.context.configCwd,n,r,new Set(qf(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&j_(e,n)?null:a}function j_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of _o(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(et(s.text,t))}let o=at(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return nl(i,o.slice(1))}function nl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>R_.has(n))}function qf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Rn(s.shell,e.store,r,t,o,n,V_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function V_(e){return e.program.dialect==="powershell"}function Rn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(et(e.source,r),t,n,r,o,i)],l=(c)=>et(rw(c,s),r);return Ro(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...ip(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ea;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function rl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Rn(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if($f.has(Ue(at(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...fi(g,t,n,r,o,i)]}let l=nw(e).map(a),c=at(e);if(c.length===0)return l;let u=c[0]??"",m=Ue(u).toLowerCase(),d=c.slice(1),f=c.findIndex((g)=>!v_.has(g));if(n.standard===!0&&f!==-1&&nl(Ue(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=K_(u,m,d);if(p)return[...l,...p.map(a)];if(tp.has(m))return n.capturedOutput===!0?[...l,...sp(e).map(a)]:l;if(m==="eval")return[...l,...rl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(m,g)).map(a)];if(m==="git")return[...l,...iw(d).map(a)];if(m==="gh")return[...l,...el(m,d,I_).map(a)];if($f.has(m))return[...l,...ow(d).map(a)];if(T_.has(m))return[...l,...Iw(d).map(a)];if(S_.has(m))return[...l,...cw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>dw(g,t,n,r,o,i)),...d.flatMap(mw).map(a)];if(m==="curl")return[...l,...d.flatMap((g)=>Ke(m,g)).map(a),...sw(d).map(a)];if(nr(m)){let g=er.has(m)?ve([m,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Rn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...uw(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(m,g)).map(a)]}function K_(e,t,n){let r=li(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s)){let a=at(e),l=nl(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...sp(e),...l].map((c)=>({target:c,cwd:i}))}return ip(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=at(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return rl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function ip(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?Rn(n.getShellSyntax(c),n,r,o,i,s):di(l,c,n,r,o,i,s))}function sp(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!tp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ol(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ol(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return ol(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ol(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=at(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Xa]:l.map((m)=>m.split(c).join(Xa));return fi(u,t,n,r,o,i).some((m)=>m.target.includes(Xa))}function ew(e){let t=at(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=il(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(rp.has(o)||ap(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(H_.get(n)?.has(o))r++;continue}return!1}return!0}function il(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(cp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Yf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Yf.test(e))return e;return`~${e.replace(Yf,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...k_.has(r)?el("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),O_):el("git",e.slice(n),M_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function el(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Zf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Zf(o,t)})}function Zf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ja(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ja(t.slice(n+1))}return t.startsWith("@")?Ja(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(np.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return np.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ja(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!E_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>x_.has(f)),m=u===-1?c:c.slice(0,u),d=fi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!__.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(rp.has(c)||ap(e,c)){let m=t[l+1];if(m!==void 0)a.push(...di(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...di(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ap(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return P_.get(t[t.length-1]??"")?.has(il(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return fa(e)?.commands.flatMap((s)=>Rn(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(sl),...e.match(Qa)??[]]}function di(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(jf)!==null||l.literals.some((g)=>Vf.test(l.masked.slice(0,g.start))),u=l.masked.match($_)!==null||l.literals.some((g)=>U_.test(l.masked.slice(0,g.start))),m=r.standard===!0&&!er.has(e),d=m&&!(Cw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(jf),(g)=>{let h=g.index+g[0].length;return{start:h,end:Ks(l.masked,h)}}):[],p=!m||f.some((g)=>qs(l.masked,g.start))?l.literals:l.literals.filter((g)=>Vf.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>sl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(Qa)??[]).map(a),...c?p.flatMap((g)=>rl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>di(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(Qa)??[]).map(a)]}function pw(e){let t=il(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(z_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&bw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=yw(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&B_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return G_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function bw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(w_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>A_.has(i)))continue;if(o.length>1)return!0;if(Sw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function Sw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Rn(a,t,{...n,capturedOutput:!0},r,o,i),...xw(a,r)?Rw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function xw(e,t){let n=_o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Rw(e,t){return _o(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(sl)}function sl(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(lp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(lp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function lp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===D_)o=!0;if(L_.has(m))r=!0;if(d!==void 0){if(m===Hf)t.push(d);continue}if(F_.has(m)){let f=e[l+1];if(m===Hf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(N_.has(h))r=!0;if(W_.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===Uf)t.push(f);continue}let p=e[l+1];if(d===Uf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function at(e){let t=e.findIndex((n)=>!cp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function cp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function tl(e,t,n,r){let o=up(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function up(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var Ww=new Set(["node_modules","__pycache__"]),Fw=[["vendor","bundle"],["vendor","cache"]];function Gw(e,t,n,r,o){if(Nw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=G(i.split("/").pop()??""),a=G(i),l=()=>Lw(s)||tl(e,t,r,o);if(Mw.has(s)||Dw.some((d)=>s.startsWith(d)))return null;let c=G(jw(e,t,r,o));for(let d of ls){let f=`~/${d.suffixParts.join("/")}`;if((Jf(a,f)||Jf(c,f))&&st(d.id,n))return d.id}let u=zw(i,t,n,r,o);if(u)return u;if(kw.has(s))return null;for(let d of as)if(s===d.basename&&st(d.id,n))return d.id;if(s.startsWith(Ow)&&st($r.id,n)&&l())return $r.id;for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&st(d.id,n)&&l())return d.id}for(let d of us)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&st(d.id,n))return d.id}if(Uw(a))return null;if(!s.includes(".")&&Fn.pattern.test(s)&&st(Fn.id,n))return Fn.id;let m=Hw(s,n);if(m)return m;return null}function zw(e,t,n,r,o){return Ur.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=G(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=G(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=G(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=G(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=G(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(G(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=G(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||G(e).split("/").at(-1)==="mcp-auth.json"&&jt(G(e),G(a))}case"secret.cli.cursor.config":{let s=G(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=G(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Xf=new WeakMap;function B(e,t,n,r,o){let i=Xf.get(o)??new Map;Xf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>dp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>jt(G(e),G(ce(t,r))))}function vr(e,t,n,r,o){return dp(e,Ve(t,n,r,o))}function dp(e,t){return G(e)===G(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Bw(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));return n.some((a)=>jt(s,G(Er(a,r,o,i))))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(z(Ce(a),o.paths,i)):"",c=G(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=G(u?$e(z(mi(Ce(u)),o.paths,i)):l&&$e(z(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=gs(d);if(f&&Qf.basename(s)!==G(f.name))return!1;let p=G(Er(f?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return jt(s,p)&&!(f&&s===p)})}function Uw(e){let t=e.split("/");return t.some((n)=>Ww.has(n))||Fw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Hw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ds)if(r===o.extension&&st(o.id,t))return o.id;for(let o of ms)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function G(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";if(!o)return i;let s=ll(i,o),a=ui(s)?s:$e(mi(t,s)),l=$e(z(a,n.paths,r));if(!jt(l,o)){if(ui(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Jf(e,t){return e===t||e.startsWith(`${t}/`)}function jw(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i||!o)return"";let s=ll(i,o),a=Qf.normalize(ui(s)?s:$e(mi(t,s))),l=$e(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";let s=o?ll(i,o):i;return $e(z(ui(s)?s:mi(t,s),n.paths,r))}function al(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(z(Ce(r),t.paths,n)):"",i=$e(Ce(Vw(et(e,t))));return{home:o,normalized:i}}function Vw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return C_(e)}catch{return e}}function ll(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Kw(e){if(process.platform==="win32")return!0;return b_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var qw={findPolicyMutation:zf,findGitMetadataMutation:bd,resolveGitMetadata:Yw,loadPolicySnapshot:iu,findSensitiveTarget:op,analyzeCommand:kf,getModes:Li};function mp(e,t){let n={...qw,...t.dependencies},r=Jw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Wd,intent:"stop_and_explain"}};let l=be(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Gf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Nf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Zw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:ep,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...cl("command-validation",o),...h};let S=vt("command-analysis",o,()=>Of(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Xw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function Yw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Zw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Xw(e){return ge(e,"declared-command")?.program}function Jw(e){try{return In(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Vt("policy-protection",cl("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,cl(e,r instanceof Ye?void 0:t,r),r)}}function cl(e,t,n){let r=n instanceof D||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ci:wn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as dA,mkdirSync as mA}from"fs";import{isAbsolute as fA,join as ml}from"path";import{lstatSync as pp,readdirSync as Qw,readFileSync as eA,rmdirSync as tA,statSync as gp,unlinkSync as nA,utimesSync as rA,writeFileSync as oA}from"fs";import{join as Rr}from"path";function fp(e,t={}){return Jr(en(e,t),e.home).policy.audit.retention_days}var dl=86400000,iA=".last-prune",sA=/^\d{4}-\d{2}$/,aA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,hp=(e)=>Math.floor(e/dl);function bp(e,t,n=()=>new Date){try{let r=n().getTime();if(!gp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,iA),i=gp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&hp(i)===hp(r))return;let s=r-fp(e)*dl,a=new Date(r).toISOString().slice(0,7);for(let l of ul(t)){if(l.isDirectory()){lA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))cA(Rr(t,l.name),s)}oA(o,"",{mode:384}),rA(o,r/1000,r/1000)}catch{}}function lA(e,t,n){for(let r of ul(e)){if(!r.isDirectory()||!sA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ul(o)){if(!i.isFile())continue;let s=aA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+dl;if(!Number.isFinite(a)||a>=t)continue;Cp(Rr(o,i.name))}if(r.name!==n)yp(o)}yp(e)}function cA(e,t){try{let n=pp(e);if(n.mtimeMs>=t)return;let r=eA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(uA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(pp(e).mtimeMs!==n.mtimeMs)return;Cp(e)}catch{}}function uA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ul(e){try{return Qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Cp(e){try{nA(e)}catch{}}function yp(e){try{tA(e)}catch{}}var pA="2.4.8",gA=1e4,hA=2000,yA=256,bA=32768;function CA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function SA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function fl(e,t,n,r,o,i,s={}){let a=CA(t);if(!a)return;let l=EA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=pi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:gA),m=pi(lt(r),hA),d=s.toolName?pi(lt(s.toolName),yA):void 0,f=i===null?void 0:pi(lt(i),bA),p=ml(l,SA(f?.value??null),c.slice(0,7));mA(p,{recursive:!0,mode:448});let g=ml(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Fi)(),v:pA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};dA(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),bp(e,l,s.now)}catch{}}function pi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function vA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&fA(n)?n:null}function EA(e){let t=vA(e);return t?ml(t,".cc-safety-net","logs"):null}function vp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Sp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Sp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Sp(e){return"command"in e?e.command??"":""}function Ep(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function xp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function _p(e,t,n){try{let r=mp(t,{environment:e,...n.guard});return Rp(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Rp(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:xA(r.cause)}),r}}function Rp(e,t,n,r,o=!0,i){Ep(e,vp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:An(t),cwd:e}}function wp(e,t={}){return(n,r)=>{try{return RA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(An())}}}function RA(e,t,n,r){let o=Zl();if(n.cancelled?.(t))return n.block(An());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return xp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=yl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=_p(o,i,{guard:{auditAllowed:Xl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Cl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var _A={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>AA(e,t,n),getSessionId:(e)=>IA(e),allow:{action:"allow"},block:(e)=>kA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Ap=wA();function wA(e={}){return wp(_A,e)}function AA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=PA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=TA(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:xi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?Ul(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function PA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return $l(".",[r],t)}catch{return}}function TA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function IA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function kA(e){return{action:"reject-and-continue",message:bl(e)}}function OA(e){e.on("tool.call",(t)=>Ap(t,e))}export{OA as default};