cc-safety-net 2.4.6 → 2.4.8

package/dist/chunks/index-c989ehp9.js

@@ -1,45 +0,0 @@
-var Vs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Wn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",te="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var js={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},lo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...js},processedCandidateBytes:{cap:4194304,...js},pathEnvironmentExpansion:{cap:64,...js},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...lo},trackedHeredocFiles:{cap:64,...lo},controlFlowStates:{cap:64,...lo},wrapperPeelIterations:{cap:20,...lo},derivedCommandShape:lo});class s extends Error{kind;name="AnalysisLimit";constructor(O){super(a[O].reason);this.kind=O}}function mn(){let O=new Map;return{counters:O,resolvedPaths:new Map,charge(D,B=1){let Q=(O.get(D)??0)+B;if(O.set(D,Q),Q>a[D].cap)throw new s(D)}}}import{lstatSync as Fg,realpathSync as zg,statSync as Bg}from"node:fs";import{homedir as $g,tmpdir as Ug}from"node:os";import{statSync as Lg}from"node:fs";import{join as Wg}from"node:path";import{basename as Ic,dirname as og,isAbsolute as ig,join as sg,normalize as ag,resolve as Ac}from"node:path";var lg=256,ai=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(O,D=process.platform){if(D!=="win32")return O;return O.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qn(O,D=process.platform){if(D!=="win32")return!1;return(O[0]==="/"||O[0]==="\\")&&(O[1]==="/"||O[1]==="\\")}function Zs(O,D){return Ks(O,0,D)}function Ks(O,D,B){let Q="",ee=0;while(ee<O.length){if(O[ee]!=="$"){Q+=O[ee],ee++;continue}if(O[ee+1]==="{"){let je=qs(O,ee+2),at=cg(O,ee,D);if(at===null){if(ai.has(je))throw new s("pathEnvironmentExpansion");Q+=O.slice(ee);break}let lt=O.slice(ee,at+1);Q+=ug(lt,D,B),ee=at+1;continue}let he=qs(O,ee+1);if(!he){Q+="$",ee++;continue}Q+=Ys(he,B)??`$${he}`,ee+=he.length+1}return Q}function cg(O,D,B){let Q=1;for(let ee=D+2;ee<O.length;ee++){if(O[ee]==="\\"){ee++;continue}if(O[ee]==="$"&&O[ee+1]==="{"){if(Q++,B+Q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ee++;continue}if(O[ee]!=="}")continue;if(Q--,Q===0)return ee}return null}function ug(O,D,B){let Q=O.slice(2,-1),ee=qs(Q,0);if(!ee)return O;let he=Q.slice(ee.length);if(!he)return Ys(ee,B)??O;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(ai.has(ee))throw new s("pathEnvironmentExpansion");return O}if(!ai.has(ee))return O;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=Ys(ee,B),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":Ks(he.slice(je.length),D+1,B);return lt?Ks(he.slice(je.length),D+1,B):""}function qs(O,D){if(!/[A-Za-z_]/.test(O[D]??""))return"";let B=D+1;while(/[A-Za-z0-9_]/.test(O[B]??""))B++;return O.slice(D,B)}function Ys(O,D){if(!ai.has(O))return null;if(O==="HOME")return D.env.get("HOME")??D.home;return D.env.get(O)??null}function Lt(O,D,B){if(!O)return O;let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;let ee=[],he=O;while(!0){kc(B,he);let je=D.realpath(he);if(je!==null)return Tc(B,O,je,ee);let at=og(he);if(at===he||ee.length>=lg)return Tc(B,O,he,ee);ee.push(Ic(he)),he=at}}function Tc(O,D,B,Q){let ee=Q.length===0?B:sg(B,...Q.reverse());return O.resolvedPaths.set(D,ee),ee}function dg(O,D,B){let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;kc(B,O);let ee=D.realpath(O);if(ee!==null)B.resolvedPaths.set(O,ee);return ee}function kc(O,D){O.charge("realpathAttempts"),O.charge("processedCandidateBytes",Buffer.byteLength(D))}function tn(O,D,B,Q){let ee=Mc(O,D,B);if(!ee)return"";return Lt(ee,B.paths,Q).replace(/\\/g,"/")}function Oc(O,D,B,Q,ee){let he=Mc(O,D,B);if(!he)return null;if(ee(Ic(he)))return Lt(he,B.paths,Q).replace(/\\/g,"/");let je=dg(he,B.paths,Q);return je===null?null:je.replace(/\\/g,"/")}function Mc(O,D,B){let Q=B.home,ee=Zs(O.trim(),B).replace(/\\/g,"/");if(!ee)return"";let he=ee==="~"?Q:ee.startsWith("~/")?Ac(Q,ee.slice(2)):ee,je=pn(he);return ag(ig(je)?je:Ac(D,je))}import{spawnSync as fg}from"node:child_process";import{existsSync as uo,lstatSync as mg,readFileSync as fo,realpathSync as Nr,statSync as co}from"node:fs";import{dirname as Xs,isAbsolute as Js,join as Lr,resolve as li}from"node:path";var pg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],gg=5000;function Nc(O,D=Og(),B=gg){let Q=hg(O),ee=Q===null?null:yg(Q);if(Q===null||ee===null)return null;let he=Ig(Q,ee,D,B);return he===null?null:{recursiveSubmodules:he}}function hg(O){try{let D=Nr(li(O));return co(D).isDirectory()?D:null}catch{return null}}function yg(O){let D=Tg(O);if(!D)return null;try{let B=mg(D);if(B.isSymbolicLink()||!B.isFile())return null;let Q=Qs(D);if(!Q?.commonDir)return null;if(!Cg(Q.gitDir,D))return null;return vg(Q.gitDir,Xs(D))?{gitDir:Q.gitDir,commonDir:Q.commonDir}:null}catch{return null}}function Qs(O){try{let D=bg(O);if(!D)return null;let B=Nr(Js(D)?D:li(Xs(O),D));if(!co(B).isDirectory())return null;return{gitDir:B,commonDir:Sg(B)}}catch{return null}}function bg(O){let D=fo(O,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!D.startsWith("gitdir:"))return null;return D.slice(7).trim()||null}function Sg(O){try{let D=fo(Lr(O,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!D)return null;let B=Nr(Js(D)?D:li(O,D));return co(B).isDirectory()?B:null}catch{return null}}function Cg(O,D){let B=Eg(O);return B===null?!1:Lc(O,B,D)}function vg(O,D){let B=xg(O);return B===null?!0:Lc(O,B,D)}function Eg(O){let D=Lr(O,"gitdir");if(!uo(D))return null;let B=fo(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return B===""?null:B}function xg(O){let D=Lr(O,"config.worktree");return uo(D)?_g(D):null}function Lc(O,D,B){try{return Rg(Js(D)?D:li(O,D),B)}catch{return!1}}function Rg(O,D){try{let B=co(O),Q=co(D);if(B.ino!==0&&Q.ino!==0&&B.dev===Q.dev&&B.ino===Q.ino)return!0}catch{}return Dc(Nr.native(O))===Dc(Nr.native(D))}function Dc(O){let D=O.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),B=D.length>1&&D.endsWith("/")?D.slice(0,-1):D;return process.platform==="win32"?B.toLowerCase():B}function _g(O){let D=fo(O,"utf-8"),B=!1,Q=null;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){B=/^\[core\]$/i.test(he);continue}if(!B)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)Q=wg(je[1]??"")}return Q}function wg(O){let D=O.trim();if(!D.startsWith('"')||!D.endsWith('"'))return D;return Ag(D.slice(1,-1))}var Pg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Ag(O){return O.replace(/\\(.?)/gs,(D,B)=>B===""?D:Pg[B]??D)}function Tg(O){try{return ea(Nr(O))}catch{return null}}function ea(O){let D=O;while(!0){let B=Lr(D,".git");if(uo(B))return B;let Q=Xs(D);if(Q===D)return null;D=Q}}function Ig(O,D,B,Q){if(kg(D))return!0;if(B===null)return!0;let ee=fg(B,["config","--get","submodule.recurse"],{cwd:O,encoding:"utf8",env:Mg(process.env),stdio:["ignore","pipe","ignore"],timeout:Q});if(ee.error!==void 0||ee.status!==0&&ee.status!==1)return null;return ee.status===0&&Wc(ee.stdout.trim())}function kg(O){return[Lr(O.commonDir,"config"),Lr(O.gitDir,"config.worktree")].filter((D)=>uo(D)).some((D)=>Dg(D))}function Og(){return pg.find((O)=>uo(O))??null}function mo(O){return O==="GIT_CONFIG_COUNT"||O==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(O)}function Mg(O){return Object.fromEntries(Object.entries(O).filter(([D])=>!mo(D)))}function Dg(O){let D;try{D=fo(O,"utf-8")}catch{return!0}let B="",Q=!1;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){B=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if(Ng(B)&&lt==="path")return!0;if(B==="submodule"&&lt==="recurse")Q=Wc(ct)}return Q}function Ng(O){return O==="include"||O.startsWith("includeif ")}function Wc(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Gc(O,D){if(O==="")return null;let B=mn(),Q=ea(tn(O,O,D,B)),ee=Q?Gg(Q,O,D,B):null;if(!ee)return null;return Object.freeze({entries:Object.freeze([ee.entry]),markerFiles:Object.freeze(ee.markerFile?[ee.markerFile]:[]),directories:Object.freeze(ee.directories),hooksDirectories:Object.freeze(ee.hooksDirectories)})}function Gg(O,D,B,Q){try{let ee=tn(O,D,B,Q),he=Lg(O),je=he.isFile()?ee:null,at=he.isFile()?Qs(O):null,lt=(he.isDirectory()?[ee]:[at?.gitDir,at?.commonDir]).flatMap((ut)=>ut?[Wr(tn(ut,D,B,Q))]:[]),ct=[...new Set(he.isDirectory()?[Wr(O.replace(/\\/g,"/")),...lt]:lt)];return{entry:Wr(ee),markerFile:je?Wr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((ut)=>{let ft=Wr(Wg(ut,"hooks").replace(/\\/g,"/"));return[ft,Wr(tn(ft,D,B,Q))]}))]}}catch{return null}}function Wr(O){return process.platform==="win32"?O.toLowerCase():O}var Hg={realpath:(O)=>{try{return zg(O)}catch{return null}},entryKind:(O)=>{let D=Fg(O,{throwIfNoEntry:!1});if(!D)return"missing";return D.isSymbolicLink()?"symlink":"present"},isDirectory:(O)=>{try{return Bg(O).isDirectory()}catch{return!1}}};function c(){return jg({env:new Map(Object.entries(process.env).flatMap(([O,D])=>D===void 0?[]:[[O,D]])),home:pn(process.env.HOME||$g()),tmpdir:Ug(),paths:Hg})}function jg(O,D={}){let B=new Map,Q=new Map,ee={...O,gitMetadata:(he)=>Fc(B,he,()=>Gc(he,ee)),worktreeFacts:(he)=>Fc(Q,he,()=>Nc(he)),...D};return ee}function Fc(O,D,B){let Q=O.get(D);if(Q!==void 0)return Q;let ee=B();return O.set(D,ee),ee}import{accessSync as Sh,constants as nu,statSync as Ch}from"node:fs";import{isAbsolute as ou,relative as vh,resolve as Eh,sep as xh}from"node:path";var Vg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function z(O){return ke(O.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(O){return Vg.reduce((D,B)=>D.replace(B,"<redacted>"),O.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(O){return zc(O).reduceRight((D,B)=>`${D.slice(0,B.valueStart)}<redacted>${D.slice(B.valueEnd)}`,O)}function k(O){return ke(Ue(O))}function Ze(O){return zc(O).map((D)=>O.slice(D.valueStart,D.valueEnd))}function Ge(O){return/[A-Za-z_][A-Za-z0-9_]*=/.test(O)}function zc(O){return[...O.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((D)=>{let B=O[D.index-1];if(D.index>0&&B&&!/[\s"'([{]/.test(B))return[];let Q=D.index+D[0].length;if(Q>=O.length)return[];return[{valueStart:Q,valueEnd:Kg(O,Q)}]})}function Kg(O,D){if(O.startsWith("$(",D))return qg(O,D);let B=O[D];if(B==='"'||B==="'"){for(let ee=D+1;ee<O.length;ee++){if(B==='"'&&O[ee]==="\\"){ee++;continue}if(O[ee]===B)return ee+1}return O.length}let Q=D;while(Q<O.length&&!/\s/.test(O[Q]??""))Q++;return Q}function qg(O,D){let B=0,Q;for(let ee=D;ee<O.length;ee++){let he=O[ee];if(Q){if(Q==='"'&&he==="\\"){ee++;continue}if(he===Q)Q=void 0;continue}if(he==='"'||he==="'"){Q=he;continue}if(he==="$"&&O[ee+1]==="("){B++,ee++;continue}if(he!==")")continue;if(B--,B===0)return ee+1}return O.length}var Yg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Zg(O){let D=O.maxLen??200,B=O.redact??((ee)=>ee),Q=(ee)=>ee.length>D?`${ee.slice(0,D)}...`:ee;return[O.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${B(O.reason)}`,O.ruleId?`Rule: ${O.ruleId}`:void 0,O.toolName?`Tool: ${O.toolName}`:void 0,O.command?`Command: ${Q(B(O.command))}`:void 0,O.segment&&O.segment!==O.command?`Segment: ${Q(B(O.segment))}`:void 0,O.configWarning?`Config warning: ${B(O.configWarning)}`:void 0,O.askUser?"Approve only if you expected this command.":Yg[O.intent??"manual_only"]].filter((ee)=>ee!==void 0).join(`
-
-`)}function ye(O,D){if(O.decision.kind!=="deny")return;let B=D.includeEvidence?O.decision.evidence:void 0;return{reason:O.decision.reason,ruleId:O.decision.ruleId,intent:O.decision.intent,command:B?.command,segment:B?.segment,toolName:D.toolName,...O.configFallback?{configWarning:O.configFallback.reason}:{},...O.decision.ask?{ask:!0}:{}}}function P(O={}){return{reason:te,intent:"stop_and_explain",command:O.command,segment:O.segment??O.command,toolName:O.toolName}}function be(O){return Zg({...O,redact:z})}function Xe(O){return z(O instanceof Error?O.message:String(O))}import{types as Xg}from"node:util";var Jg=new Set(["applypatch","patch"]),Qg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),eh=new Set(["grep","grepsearch","rg"]),th=new Set(["find","findbyname","glob"]),nh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),rh=new Set(["command","diff","input","patch","patchtext"]),Bc=new TextEncoder,oh=new TextDecoder,ih=/\s/,sh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var po=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Vc(O){return O.replace(/[-_\s]/g,"").toLowerCase()}function ui(O){return nh.has(Vc(O))}function V(O){let D=Vc(O);if(Jg.has(D))return"patch";if(eh.has(D))return"grep";if(th.has(D))return"glob";if(Qg.has(D))return"path";return"unknown"}function ne(O){if(!O||typeof O!=="object")return;Qc(O);let D=Object.getOwnPropertyDescriptor(O,"command");if(!D){if("command"in O)Gn();return}if(D.get||D.set)Gn();let B=D.value;return typeof B==="string"&&B!==""?B:void 0}function Kc(O,D){return qc(O,D,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function qc(O,D,B,Q){let ee=Jc(O,B,Q);if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>{let lt=qc(at,D,B,Q+1);return typeof at==="string"&&D.has(Yc(je))?[at]:lt});return B.ancestors.delete(ee.object),he}function Yc(O){return O.replace(/-/g,"_").toLowerCase()}function Zc(O){return Xc(O,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(lh)}function Xc(O,D,B,Q){let ee=Jc(O,B,Q);if(typeof O==="string")return D?[O]:[];if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>Xc(at,ee.array?D:rh.has(Yc(je)),B,Q+1));return B.ancestors.delete(ee.object),he}function ah(O,D,B){if(D.nodes++,O!==null&&typeof O==="object"&&B>po.maxDepth||D.nodes>po.maxNodes)Gn();if(typeof O!=="string")return;let Q=Buffer.byteLength(O);if(D.stringBytes+=Q,Q>po.maxStringBytes||D.stringBytes>po.maxAggregateStringBytes)Gn()}function Jc(O,D,B){if(ah(O,D,B),!O||typeof O!=="object")return null;let Q=Qc(O);if(D.ancestors.has(O))Gn();let ee=Reflect.ownKeys(O);if(D.keys+=ee.length,D.keys>po.maxKeys)Gn();let he=ee.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(O,je);if(!at||at.get||at.set)Gn();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return D.ancestors.add(O),{object:O,array:Q,entries:he}}function Qc(O){if(Xg.isProxy(O))Gn();let D=Array.isArray(O),B=Object.getPrototypeOf(O);if(D&&B!==Array.prototype||!D&&B!==Object.prototype&&B!==null)Gn();return D}function Gn(){throw new f}function lh(O){let D=[],B=O.split(/\r?\n/),Q=!1,ee=!1,he=null,je=null,at=()=>{ee=!1,he=null,je=null};for(let lt=0;lt<B.length;lt++){let ct=B[lt]??"";if(ct==="*** Begin Patch"){Q=!0,at();continue}if(ct==="*** End Patch"){Q=!1,at();continue}if(ct.startsWith("@@")){let ut=ch(ct);if(ee=!0,he=ut?.oldLines??null,je=ut?.newLines??null,he===0&&je===0)at();continue}if(ee&&he!==null&&je!==null){let ut=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-ut),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),D.push(...ta(ct));continue}if(ee)continue;if(ct.startsWith("diff --git ")){D.push(...ta(ct));continue}if(ct.startsWith("--- ")){let ut=B[lt+1]??"";if(!ut.startsWith("+++ "))continue;D.push(...ra(ci(ct.slice(4),!0),ci(ut.slice(4),!0))),lt++;continue}if(!Q)D.push(...ta(ct))}return D}function ch(O){let D=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(O);if(!D)return null;return{oldLines:Number(D[1]??1),newLines:Number(D[2]??1)}}function ta(O){let D=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(O);if(D?.[1])return jc(D[1]);let B=/^\*\*\* Move to: (.+)$/.exec(O);if(B?.[1])return jc(B[1]);if(O.startsWith("diff --git "))return uh(O.slice(11));let Q=/^--- (.+)$/.exec(O);if(Q?.[1])return Hc(Q[1]);let ee=/^\+\+\+ (.+)$/.exec(O);if(ee?.[1])return Hc(ee[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(O);if(he?.[1])return yh(he[1]);return[]}function uh(O){let D=dh(O);if(D.length===2&&D[0]&&D[1])return ra(D[0],D[1]);let B=fh(O);return B?ra(O.slice(B.oldStart,B.oldEnd),O.slice(B.newStart,B.newEnd)):[]}function dh(O){let D=[],B=0;while(B<O.length&&D.length<2){while(dr(O[B]))B++;if(B>=O.length)break;let Q=O[B]==='"'||O[B]==="'"?O[B]:void 0;if(!Q){let he=B;while(B<O.length&&!dr(O[B]))B++;D.push(O.slice(he,B));continue}let ee=eu(O,B,Q);if(!ee)return[];D.push(ee.value),B=ee.end}while(dr(O[B]))B++;return B===O.length?D:[]}function fh(O){let D=0;while(D<O.length&&dr(O[D]))D++;let B=O.length;while(B>D&&dr(O[B-1]))B--;let Q=0,ee=D;while(ee<B){if(!dr(O[ee])){ee++;continue}let he=ee;while(ee<B&&dr(O[ee]))ee++;if(he===D||ee===B)continue;if(Q++,Q>sh)Gn();if(mh(O,D,he,ee,B))return{oldStart:D,oldEnd:he,newStart:ee,newEnd:B}}return null}function mh(O,D,B,Q,ee){if(na(O,D,B,Q,ee))return!0;let he=$c(O,"/",D,B),je=$c(O,"/",Q,ee);if(he<=D||je<=Q)return!1;if(na(O,D,he,Q,je))return!1;return na(O,he+1,B,je+1,ee)}function na(O,D,B,Q,ee){if(B-D!==ee-Q)return!1;for(let he=0;he<B-D;he++)if(O[D+he]!==O[Q+he])return!1;return!0}function $c(O,D,B,Q){for(let ee=B;ee<Q;ee++)if(O[ee]===D)return ee;return-1}function dr(O){return O!==void 0&&ih.test(O)}function eu(O,D,B){let Q=[],ee=D+1;while(ee<O.length){let he=String.fromCodePoint(O.codePointAt(ee)??0);if(he===B)return{value:oh.decode(Uint8Array.from(Q)),end:ee+1};if(he!=="\\"||B==="'"){Q.push(...Bc.encode(he)),ee+=he.length;continue}let je=O.slice(ee+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){Q.push(Number.parseInt(at,8)),ee+=at.length+1;continue}Q.push(...Bc.encode(ph(je[0]??""))),ee+=2}return null}function ph(O){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[O]??O}function gh(O){return go(bh(O))}function ra(O,D){if(O==="/dev/null")return Uc(D);if(D==="/dev/null")return Uc(O);if(O.startsWith("a/")&&D.startsWith("b/"))return[O.slice(2),D.slice(2)].flatMap(go);let B=hh(O,D)??(O===D?tu(O):null);return[O,D,...B?[B]:[]].flatMap(go)}function Uc(O){let D=tu(O);return[O,...D?[D]:[]].flatMap(go)}function tu(O){let D=O.indexOf("/");return D>0&&D<O.length-1?O.slice(D+1):null}function hh(O,D){let B=O.indexOf("/"),Q=D.indexOf("/");if(B<1||Q<1)return null;if(O.slice(0,B)===D.slice(0,Q))return null;let ee=O.slice(B+1);return ee===D.slice(Q+1)?ee:null}function Hc(O){return gh(ci(O,!0))}function yh(O){return go(ci(O,!1))}function ci(O,D){let B=O.trim(),Q=B[0]==='"'||B[0]==="'"?B[0]:void 0;if(Q){let ee=eu(B,0,Q);if(ee&&(D||B.slice(ee.end).trim()===""))return ee.value}return D?B.split("\t",1)[0]?.trim()??"":B}function bh(O){return O.startsWith("a/")||O.startsWith("b/")?O.slice(2):O}function go(O){return O===""||O==="/dev/null"?[]:[O]}function jc(O){let D=O.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return D===""||D==="/dev/null"?[]:[D]}function ce(O){try{if(!Ch(O).isDirectory())return!1;return Sh(O,nu.R_OK|nu.X_OK),!0}catch{return!1}}function et(O,D,B){if(Qn(O))return;let Q=D.flatMap((he)=>ru(he,B));if(!Q[0])return;let ee=ru(ou(O)?O:Eh(Q[0],O),B)[0];if(!ee)return;return Q.some((he)=>Rh(ee,he))?ee:void 0}function ru(O,D){let B=D.realpath(O);if(B===null)return[];return D.isDirectory(B)?[B]:[]}function Rh(O,D){let B=vh(D,O);return B===""||B!==".."&&!B.startsWith(`..${xh}`)&&!ou(B)}var _h=8388608;async function We(O){let D=[],B=0;for await(let Q of O){let ee=typeof Q==="string"?Buffer.from(Q,"utf-8"):Buffer.from(Q.buffer,Q.byteOffset,Q.byteLength);if(B+=ee.byteLength,B>_h)throw wh(O),Error("hook input byte limit exceeded");D.push(ee)}return Buffer.concat(D,B).toString("utf-8")}function wh(O){let D=O.destroy??O.cancel;if(!D)return;try{Promise.resolve(D.call(O)).catch(()=>{})}catch{}}function d(O,D,B,Q,ee){if(B.kind!=="command")return{toolName:O,input:D,route:B,context:Q};return{toolName:O,input:D,route:B,context:Q,command:ee}}var Gr=["fail_closed","paranoid_rm","paranoid_interpreters"],di={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},fi=["standard","strict","paranoid"];function Ph(O,D){if(!D)return O;return fi.indexOf(D)>fi.indexOf(O)?D:O}function Ah(O){let D=ve(o.level,O);if(D===void 0||D==="")return;if(fi.includes(D))return D;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(D.slice(0,40))}. Use ${fi.join(", ")}.`);return}function He(O){if(O===void 0||O==="all")return"all";if(O==="blocked")return"blocked";return"invalid"}function xe(O){return He(ve(o.auditScope,O))==="all"}function oa(O){if(O.failClosed&&O.paranoidRm&&O.paranoidInterpreters)return"paranoid";if(O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"strict";if(!O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"standard";return"custom"}function R(O={},D){let B=O.safety?.level??"standard",Q=Ah(D),ee=Ph(B,Q),he=di[ee],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:ee===B?"preset":"environment",paranoidRm:ee===B?"preset":"environment",paranoidInterpreters:ee===B?"preset":"environment"},lt={failClosed:[`policy safety.level=${B}`],paranoidRm:[`policy safety.level=${B}`],paranoidInterpreters:[`policy safety.level=${B}`]};if(ee!==B)lt.failClosed.push(`env ${o.level.name}=${Q}`),lt.paranoidRm.push(`env ${o.level.name}=${Q}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${Q}`);if(O.safety?.overrides?.failClosed!==void 0)je.failClosed=O.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(O.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=O.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(O.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=O.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,D))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,D))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,D))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,D))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!O.worktreeMode||L(o.worktree,D);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:oa(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(O,D){let B=typeof O==="string"?ho(O,D):ve(O,D);return B==="1"||B?.toLowerCase()==="true"}function ho(O,D){return D.get(O)}function ve(O,D){let B=ho(O.name,D);if(B!==void 0)return B;if(O.legacyName)return ho(O.legacyName,D);return}function Qe(O,D){return ho(O.name,D)!==void 0||!!O.legacyName&&ho(O.legacyName,D)!==void 0}import{dirname as hr}from"node:path";import{closeSync as Th,constants as yo,fstatSync as ia,fsyncSync as Ih,lstatSync as vn,mkdirSync as iu,openSync as su,readdirSync as aa,readFileSync as kh,realpathSync as Fr,renameSync as Oh,rmdirSync as au,statSync as sa,unlinkSync as la,writeFileSync as Mh}from"node:fs";import{isAbsolute as lu,join as fr,normalize as Dh,parse as mi,relative as ca,resolve as ua,sep as pi}from"node:path";function Re(){let O=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${O()}${O()}`}var Nh=Symbol("PolicyFilesystemScope"),Lh=Symbol("PolicyFilesystemTarget"),cu=yo.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(O){super(`Unable to access ${O} filesystem safely.`)}}function v(O,D){return{[Nh]:!0,root:ua(O),label:D}}function bo(O,D){let B=Dh(D);if(D===""||lu(D)||B===".."||B.startsWith(`..${pi}`))throw new r(O.label);return{[Lh]:!0,scope:O,relativePath:B,path:fr(O.root,B)}}function i(O,D){return bo(O,ca(O.root,ua(D)))}function re(O,D="rules policy"){let B=ua(O),Q=mi(B).dir;return bo(v(Q,D),ca(Q,B))}function n(O){return $n(O.scope.label,()=>{if(!Zt(O))return null;let D=su(O.path,yo.O_RDONLY|cu);return du(D,()=>{let B=ia(D);if(!B.isFile())throw new r(O.scope.label);let Q=kh(D,"utf-8"),ee=vn(O.path);if(!ee.isFile()||ee.isSymbolicLink()||B.dev!==ee.dev||B.ino!==ee.ino)throw new r(O.scope.label);return Zt(O),Q})})}function g(O,D,B=384,Q){let ee=`${O.path}.${Re()}.tmp`;$n(O.scope.label,()=>{Gh(O),Zt(O);let he=su(ee,yo.O_CREAT|yo.O_EXCL|yo.O_WRONLY|cu,B),je=du(he,()=>{let at=ia(he);if(!at.isFile())throw new r(O.scope.label);Mh(he,D,"utf-8"),Ih(he);let lt=ia(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(O.scope.label);return lt});Zt(O),zh(O,ee,je.dev,je.ino),Oh(ee,O.path),Q?.(O.path),Zt(O)},()=>Bh(ee))}function uu(O,D){if(O.path===D.path)return!0;return $n(O.scope.label,()=>{if(!Zt(O)||!Zt(D))return!1;let B=(Q)=>fr(Fr(mi(Q).dir),mi(Q).base);return B(O.path)===B(D.path)})}function le(O){let D=$n(O.scope.label,()=>{if(!Zt(O,"directory"))return null;let B=aa(O.path);return Zt(O,"directory"),B});if(!D)return null;return $n(O.scope.label,()=>{let B=D.map((Q)=>{let ee=bo(O.scope,fr(O.relativePath,Q)),he=vn(ee.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(O.scope.label);return gi(da(O.scope),Fr(ee.path),O.scope.label),{name:Q,kind:he.isDirectory()?"directory":"file"}});return Zt(O,"directory"),B})}function N(O){$n(O.scope.label,()=>{if(!Zt(O))return;la(O.path),Zt(O)})}function tt(O){$n(O.scope.label,()=>{if(!Wh(O))return;mu(O),Zt(O,"directory")})}function nt(O){$n(O.scope.label,()=>{if(!Zt(O,"directory"))return;au(O.path),Zt(O,"directory")})}function Wh(O){return $n(O.scope.label,()=>{if(!Zt(O,"directory"))return!1;return fu(O),!0})}function $n(O,D,B){try{return D()}catch(Q){if(B?.(),Q instanceof r)throw Q;throw new r(O)}}function du(O,D){try{return D()}finally{Th(O)}}function Zt(O,D="file"){let B=pu(O.scope);if(!B)return!1;let Q=O.relativePath.split(pi);for(let ee of Q.keys()){let he=fr(O.scope.root,...Q.slice(0,ee+1)),je=vn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(O.scope.label);if(ee<Q.length-1&&!je.isDirectory())throw new r(O.scope.label);if(ee===Q.length-1&&(D==="file"?!je.isFile():!je.isDirectory()))throw new r(O.scope.label);gi(B,Fr(he),O.scope.label)}return!0}function fu(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new r(O.scope.label);if(Q.isDirectory())fu(B)}Zt(O,"directory")}function mu(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink())throw new r(O.scope.label);if(Q.isDirectory()){mu(B);continue}if(!Q.isFile())throw new r(O.scope.label);la(B.path)}au(O.path)}function Gh(O){Fh(O.scope);let D=da(O.scope),B=O.relativePath.split(pi).slice(0,-1);for(let Q of B.keys()){let ee=fr(O.scope.root,...B.slice(0,Q+1));if(!vn(ee,{throwIfNoEntry:!1}))iu(ee,{mode:448});let he=vn(ee);if(!he.isDirectory()||he.isSymbolicLink())throw new r(O.scope.label);gi(D,Fr(ee),O.scope.label)}}function Fh(O){if(vn(O.root,{throwIfNoEntry:!1})){if(!sa(O.root).isDirectory())throw new r(O.label);return}let D=[],B=O.root;while(!vn(B,{throwIfNoEntry:!1})){D.unshift(B);let Q=mi(B).dir;if(Q===B)throw new r(O.label);B=Q}if(!sa(B).isDirectory())throw new r(O.label);for(let Q of D){iu(Q,{mode:448});let ee=vn(Q);if(!ee.isDirectory()||ee.isSymbolicLink())throw new r(O.label)}}function pu(O){if(!vn(O.root,{throwIfNoEntry:!1}))return null;if(!sa(O.root).isDirectory())throw new r(O.label);return Fr(O.root)}function da(O){let D=pu(O);if(!D)throw new r(O.label);return D}function zh(O,D,B,Q){let ee=vn(D);if(!ee.isFile()||ee.isSymbolicLink()||ee.dev!==B||ee.ino!==Q)throw new r(O.scope.label);gi(da(O.scope),Fr(D),O.scope.label)}function gi(O,D,B){let Q=ca(O,D);if(Q===".."||Q.startsWith(`..${pi}`)||lu(Q))throw new r(B)}function Bh(O){try{la(O)}catch{}}import{dirname as mr,isAbsolute as Vh,join as gr,relative as Kh,resolve as pr,sep as qh}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var gu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,$h=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,hu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Uh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Hh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${Uh}/(${l.source.slice(1,-1)})/${Hh}$`);function jh(O){return`.cc-safety-net/rules/${O}/rulebook.json`}function yu(O){if(S(O))try{return A(O),null}catch(D){return D instanceof Error?D.message:String(D)}return l.test(O)?null:`Local rulebook sources must be bare names matching ${l}: ${O}`}function A(O){if(O.startsWith("github:"))throw Error(`Invalid rulebook source: ${O}`);let D=O.match(gu);if(!D?.[1]||!D[2]||!D[3])throw Error(`Invalid GitHub rulebook source: ${O}`);let B=D[3].lastIndexOf("/");if(B<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);let Q=D[3].slice(0,B),ee=D[3].slice(B+1);if(!Q||!hu.test(Q))throw Error(`GitHub rulebook refs must use valid path segments: ${O}`);if(!ee||!l.test(ee))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);return{owner:D[1],repo:D[2],ref:Q,path:jh(ee),name:ee}}function q(O){return $h.test(O)}function oe(O){return hu.test(O)}function S(O){return gu.test(O)}function ot(O){if(!l.test(O))throw Error(`Local rulebook sources must be bare names matching ${l}: ${O}`)}var bu="rule.json",hi="policy.json",Su=".cc-safety-net",Yh="rules",Zh="CC_SAFETY_NET_HOME",Cu="`cc-safety-net rule update`";function Xh(O){return pr(O,de)}function F(O){return gr(Xh(O),bu)}function b(O){return gr(pr(O),Su,hi)}function Se(O,D={}){return D.userConfigDir??(D.userConfigPath?mr(D.userConfigPath):gr(Jh(O),Yh))}function Jh(O){let D=O.env.get(Zh);return D?pr(pn(D)):gr(O.home,Su)}function M(O,D={}){return gr(Se(O,D),bu)}function u(O,D={}){return gr(mr(Se(O,D)),hi)}function K(O,D){let B=D.userConfigPath??M(O,D),Q=D.projectConfigPath??F(D.cwd),ee=Be(O,D),he=ze(Q,D.cwd);return{userConfigPath:B,projectConfigPath:Q,userScope:ee,projectScope:he,userConfigTarget:i(ee,B),projectConfigTarget:i(he,Q)}}function Be(O,D){let B=D.userConfigPath?mr(mr(pr(D.userConfigPath))):mr(pr(D.userConfigDir??Se(O,D)));return v(B,"user policy")}function ze(O,D){let B=pr(D),Q=pr(O),ee=Kh(B,Q);if(ee!==".."&&!ee.startsWith(`..${qh}`)&&!Vh(ee))return v(B,"project policy");return v(mr(mr(Q)),"project policy")}function I(O,D){return gr(O,D,ue)}var gn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Kt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),vu=new Set(["python","python3","python2","node","ruby","perl"]),yi=/^python(?:[23](?:\.\d+)*)?$/,En=new Set(["awk","gawk","nawk","mawk"]),bi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Eu="Rulebook exceeds CC Safety Net's safe validation limits.",xu="Additional rulebook validation errors were omitted.",Pn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ru(O){if(fa(O.allowed_commands,Pn.maxAllowedCommands)||fa(O.rules,Pn.maxRules)||fa(O.tests,Pn.maxTests))return!1;let{maxAggregateStringCodeUnits:D,maxTotalBlockArgs:B}=Pn,Q=(ee,he=!1)=>{if(typeof ee!=="string")return!0;if(ee.length>Pn.maxStringCodeUnits||he&&ee.length>Pn.maxFixtureCommandCodeUnits||ee.length>D)return!1;return D-=ee.length,!0};if(!Q(O.name)||!Q(O.version)||!Q(O.description)||!Q(O.author)||!Q(O.migrated_from))return!1;if(Array.isArray(O.allowed_commands)){for(let ee of O.allowed_commands)if(!Q(ee))return!1}if(Array.isArray(O.rules))for(let ee of O.rules){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.name)||!Q(he.command)||!Q(he.subcommand)||!Q(he.reason)||!Q(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>Pn.maxBlockArgsPerRule||at.length>B)return!1;B-=at.length;for(let lt of at)if(!Q(lt))return!1}}if(Array.isArray(O.tests))for(let ee of O.tests){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.command,!0)||!Q(he.expect)||!Q(he.rule))return!1}return!0}function fa(O,D){return Array.isArray(O)&&O.length>D}var ma=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function kt(O){return Tt(O).toLowerCase()}function Tt(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}function an(O,D){let B=new Set,Q=!1;for(let ee of O){if(ee==="--"){Q=!0;continue}if(Q)continue;if(ee.startsWith("-")&&!ee.startsWith("--")&&ee.length>1)for(let he=1;he<ee.length;he++){let je=ee[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(B.add(at),D?.shortOptsWithValue?.has(at))break}}return B}var Qh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},pa=new Set(["--init-file","--rcfile"]);function ga(O,D,B,Q){let ee=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<D.length;ct++){let ut=D[ct];if(ut===void 0)break;if(O==="ksh"&&ut==="o"&&ct+1<D.length){if(Q==="argv"){let ft=D.slice(ct+1);if(D[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(O==="ksh"&&ut==="o"&&ct+1===D.length&&(B?.startsWith("-")||B?.startsWith("+")))break;if(O==="zsh"&&ut==="o"&&ct+1<D.length)break;if(Q==="startup"&&ut==="i")ee=D[0]==="-";if(Q==="argv"&&D[0]==="-"&&ut==="c")je=!0;if(Q==="argv"&&ut==="n")lt=D[0]==="-";if(Q==="argv"&&ut==="s")at=D[0]==="-";if(!Qh[O]?.includes(ut))continue;if(ct+1===D.length)he++;break}return{interactive:ee,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function hn(O){let D=Tt(O[0]??"").toLowerCase(),B=!1,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--"){let lt=B&&O[he+1]!==void 0?he+1:null;return{command:lt===null?null:O[lt]??null,commandIndex:lt,scriptIndex:!B&&!Q&&O[he+1]!==void 0?he+1:null,readsStdinAsCommands:!B&&(Q||O[he+1]===void 0),syntaxCheck:ee}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:B?je:null,commandIndex:B?he:null,scriptIndex:!B&&!Q&&je!=="-"?he:null,readsStdinAsCommands:!B&&(Q||je==="-"),syntaxCheck:ee};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(D==="bash"&&pa.has(lt)&&!je.includes("="))he++;continue}let at=ga(D,je,O[he+1],"argv");if(at.commandSelected)B=!0;if(at.syntaxCheck)ee=!0;if(at.stdinMode)Q=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!B,syntaxCheck:ee}}function So(O,D){if(D.escaped)return D.escaped=!1,!0;if(O==="\\"&&!D.inSingle)return D.escaped=!0,!0;if(O==="'"&&!D.inDouble)return D.inSingle=!D.inSingle,!0;if(O==='"'&&!D.inSingle)return D.inDouble=!D.inDouble,!0;return!1}function Si(O){let D={inSingle:!1,inDouble:!1,escaped:!1};for(let B of ey(O))So(B,D);return D.inSingle||D.inDouble}function ey(O){let D="",B={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,ee=!0;for(let he=0;he<O.length;he++){let je=O[he];if(!je)break;if(Q){if(je===`
-`||je==="\r")D+=je,Q=!1,B.escaped=!1;continue}if(je==="#"&&!B.inSingle&&!B.inDouble&&ee){Q=!0;continue}if(D+=je,!B.inSingle&&!B.inDouble&&!B.escaped)ee=/[\s;&|()<>]/.test(je);So(je,B)}return D}var ha=new Set(["rm","find","xargs","parallel"]),ty=new Set(["git","busybox",...ha,...Kt,...vu,...En]),ny=new Set(["python","node","ruby","perl"]);function Le(O){let D=kt(O);return ty.has(D)||An(D)}function An(O){return ny.has(ry(O))}function ry(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(O){try{let D=n(oy(O));if(D===null)return{config:null,errors:[]};if(!D.trim())return{config:null,errors:["Config file is empty"]};let B=JSON.parse(D),Q=Ve(B);if(Q.errors.length>0)return{config:null,errors:Q.errors};return{config:{version:1,rules:B.rules??[],overrides:B.overrides??{},transparent_wrappers:B.transparent_wrappers??[]},errors:[]}}catch(D){if(D instanceof r)return{config:null,errors:[D.message]};let B=D instanceof Error?D.message:String(D);return{config:null,errors:[D instanceof SyntaxError?"Invalid JSON":B]}}}function oy(O){return typeof O==="string"?re(O):O}var e=(O,D)=>({path:O,message:D,kind:"typed"}),Xt=(O,D)=>({path:O,message:D,kind:"custom"});function Te(O){let D=new Set;return O.flatMap((B,Q)=>{let ee=zr(B)?B.name:void 0;if(typeof ee!=="string")return[];if(D.has(ee.toLowerCase()))return[Xt(["rules",Q,"name"],`duplicate rule name "${ee}"`)];return D.add(ee.toLowerCase()),[]})}var we=`must be one of ${ma.join(", ")}`,iy=/^[^/]+\/[^/]+$/,sy=["version","rules","overrides","transparent_wrappers"];function Ve(O){let D=ay(O);return{errors:ie(qe(D,sy,(B)=>B.kind==="custom"),": "," "),sources:gy(O,D)}}function ay(O){if(!zr(O))return[e([],"Config must be an object")];let D=Array.isArray(O.rules)&&O.rules.length>pe;return[...O.version===1?[]:[e(["version"],"must be 1")],...ly(O.rules,D),...dy(O.overrides),...my(O.transparent_wrappers),...D?[]:uy(O.rules),...zr(O.overrides)?Object.keys(O.overrides).filter((B)=>!iy.test(B)).map((B)=>Xt(["overrides",B],"must use <rulebook-name>/<rule-name>")):[],...py(O.transparent_wrappers)]}function ly(O,D){if(O===void 0)return[];if(!Array.isArray(O))return[e(["rules"],"must be an array of rulebook source strings"),..._u(O,pe)?[e(["rules"],fe)]:[]];if(D)return[{path:["rules"],message:fe,kind:"limit"}];return O.flatMap((B,Q)=>{if(typeof B!=="string")return[e(["rules",Q],"must be a rulebook source string"),...cy(B,1)?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]];return B===""?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]})}function _u(O,D){let B=wu(O);return B!==void 0&&!(B<=D)}function cy(O,D){let B=wu(O);return B!==void 0&&!(B>=D)}function wu(O){if(O===null||O===void 0)return;let D=O.length;return D===void 0?void 0:Number(D)}function uy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||B==="")return[];if(B.trim()==="")return[Xt(["rules",Q],"must be a non-empty rulebook source string")];let ee=yu(B);if(ee)return[Xt(["rules",Q],ee)];if(D.has(B))return[Xt(["rules",Q],`duplicate rulebook source "${B}"`)];return D.add(B),[]})}function dy(O){if(O===void 0)return[];if(!zr(O))return[e(["overrides"],"must be an object if provided")];return Object.keys(O).flatMap((D)=>{let B=O[D];if(B==="off")return[];if(!zr(B))return[e(["overrides",D],'must be "off" or an object')];return[...fy(B.reason,["overrides",D,"reason"]),...B.intent===void 0||Ce(B.intent)?[]:[e(["overrides",D,"intent"],we)]]})}function fy(O,D){if(typeof O!=="string")return[e(D,"required non-empty string"),..._u(O,T)?[e(D,`must be at most ${T} characters`)]:[]];if(O==="")return[e(D,"required non-empty string")];return O.length>T?[e(D,`must be at most ${T} characters`)]:[]}function my(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["transparent_wrappers"],"must be an array of command strings")];return O.flatMap((D,B)=>{if(typeof D!=="string")return[e(["transparent_wrappers",B],"must be a command string")];return w.test(D)?[]:[e(["transparent_wrappers",B],"must match command pattern")]})}function py(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["transparent_wrappers",Q],`duplicate command "${B}"`)];if(Le(B))return[Xt(["transparent_wrappers",Q],`reserved command "${B}" cannot be a wrapper`)];return D.add(B),[]})}function gy(O,D){let B=zr(O)?O.rules:void 0;if(!Array.isArray(B))return new Set;if(D.some((ee)=>ee.path.length===1&&ee.path[0]==="rules"))return new Set;let Q=new Set(D.filter((ee)=>ee.path[0]==="rules"&&typeof ee.path[1]==="number").map((ee)=>ee.path[1]));return new Set(B.filter((ee,he)=>typeof ee==="string"&&!Q.has(he)))}function qe(O,D,B){let Q=O.map((je)=>je.path[1]),ee=[...new Set(Q.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:D.indexOf(String(je.path[0])),typeof at==="number"?at:ee.indexOf(String(at)),B(je)?0:1];return O.map((je,at)=>({issue:je,rank:he(je,Q[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(O,D,B){return[...new Set(O.map((Q)=>{let ee=ya(Q.path);if(Q.kind==="unknownKeys")return`${ee?`${ee}.`:""}unknown field "${Q.message}"`;if(Q.kind==="key"||Q.kind==="limit"||Q.path.length===0)return Q.message;return`${ee}${Q.path.length===1?B:D}${Q.message}`}))]}function ya(O){return O.map((D,B)=>{if(typeof D==="number")return`[${D}]`;return B===0?String(D):`.${String(D)}`}).join("")}function Ce(O){return ma.includes(O)}function zr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function se(O){let D=by(O);if(D.errors.length>0)throw Error(D.errors.join("; "));return O}var hy=`required non-empty string up to ${T} characters`,Pu="must be a non-empty array of unique non-empty strings",yy="required non-empty array of non-empty strings";function by(O){if(!er(O))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ru(O))return{errors:[Eu],ruleNames:new Set};let D=[...O.rulebook_version===1||O.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(Sy(O,O.rulebook_version===2),": ",": ")];return{errors:D.length>Pn.maxValidationErrors?[...D.slice(0,Pn.maxValidationErrors),xu]:D,ruleNames:new Set(_e(O).map((B)=>B.toLowerCase()))}}function _e(O){let D=er(O)?O.rules:void 0;return(Array.isArray(D)?D:[]).flatMap((B)=>{let Q=er(B)?B.name:void 0;return typeof Q==="string"?[Q]:[]})}function Sy(O,D){return[...typeof O.name==="string"&&l.test(O.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof O.version==="string"&&O.version!==""?[]:[e(["version"],"required non-empty string")],...Cy(O.allowed_commands),...vy(O.rules,D),..._y(O.tests),...wy(O),...Py(O)]}function Cy(O){if(!Array.isArray(O))return[e(["allowed_commands"],"required array")];let D=new Set;return[...O.flatMap((B,Q)=>typeof B==="string"&&w.test(B)?[]:[e(["allowed_commands",Q],"must match command pattern")]),...O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["allowed_commands",Q],`duplicate command "${B}"`)];return D.add(B),[]})]}function vy(O,D){if(!Array.isArray(O))return[e(["rules"],"required array")];return[...O.flatMap((B,Q)=>{if(!er(B))return[e(["rules",Q],"must be an object")];return D?xy(B,["rules",Q]):Ey(B,["rules",Q])}),...Te(O)]}function Ey(O,D){return[...Au(O.name,D),...Tu(O.command,D),...O.subcommand===void 0||typeof O.subcommand==="string"&&w.test(O.subcommand)?[]:[e([...D,"subcommand"],"must match command pattern")],...Ci(O.block_args,[...D,"block_args"],"required non-empty array",!1),...Iu(O.reason,D),...ku(O.intent,D)]}function xy(O,D){return[...Au(O.name,D),...Tu(O.command,D),...Iu(O.reason,D),...ku(O.intent,D),...Ry(O.match,[...D,"match"]),...O.subcommand===void 0?[]:[e([...D,"subcommand"],"not supported in rulebook_version 2")],...O.block_args===void 0?[]:[e([...D,"block_args"],"not supported in rulebook_version 2")]]}function Au(O,D){if(typeof O!=="string")return[e([...D,"name"],"required string")];return l.test(O)?[]:[e([...D,"name"],"must match rule name pattern")]}function Tu(O,D){return typeof O==="string"&&w.test(O)?[]:[e([...D,"command"],"required string matching command pattern")]}function Iu(O,D){return typeof O==="string"&&O!==""&&O.length<=T?[]:[e([...D,"reason"],hy)]}function ku(O,D){return O===void 0||Ce(O)?[]:[e([...D,"intent"],we)]}function Ry(O,D){if(!er(O))return[e(D,"required object")];return[...Ci(O.command_path,[...D,"command_path"],yy,!1),...O.any_args===void 0?[]:Ci(O.any_args,[...D,"any_args"],Pu,!0),...O.exclude_args===void 0?[]:Ci(O.exclude_args,[...D,"exclude_args"],Pu,!0)]}function Ci(O,D,B,Q){if(!Array.isArray(O))return[e(D,B)];let ee=O.flatMap((he,je)=>{if(typeof he!=="string")return[e([...D,je],"must be a non-empty string")];return he===""?[Xt([...D,je],"must be a non-empty string")]:[]});if(O.some((he)=>typeof he!=="string"))return ee;return[...ee,...O.length===0?[Xt(D,B)]:[],...Q&&new Set(O).size!==O.length?[Xt(D,"must not contain duplicate values")]:[]]}function _y(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["tests"],"must be an array if provided")];return O.flatMap((D,B)=>{if(!er(D))return[e(["tests",B],"must be an object")];return[...typeof D.command==="string"&&D.command.trim()!==""?[]:[e(["tests",B,"command"],"required non-empty string")],...D.expect==="blocked"||D.expect==="allowed"?[]:[e(["tests",B,"expect"],'must be "blocked" or "allowed"')],...D.rule===void 0||typeof D.rule==="string"?[]:[e(["tests",B,"rule"],"must be a string if provided")],...D.expect==="blocked"&&typeof D.rule!=="string"?[Xt(["tests",B,"rule"],"required string for blocked fixtures")]:[]]})}function wy(O){if(!Array.isArray(O.tests))return[];let D=new Set(_e(O));return[...new Set(O.tests.flatMap((B)=>er(B)&&B.expect==="blocked"&&typeof B.rule==="string"?[B.rule]:[]))].filter((B)=>!D.has(B)).map((B)=>Xt(["tests"],`blocked fixture references unknown rule "${B}"`))}function Py(O){if(!Array.isArray(O.allowed_commands)||!Array.isArray(O.rules))return[];let D=new Set(O.allowed_commands.filter((B)=>typeof B==="string"));return O.rules.flatMap((B,Q)=>{let ee=er(B)?B.command:void 0;if(typeof ee!=="string"||D.has(ee))return[];return[Xt(["rules",Q,"command"],`"${ee}" must be listed in allowed_commands`)]})}function er(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function J(O,D){let B=K(O,D),Q;try{Q=uu(B.userConfigTarget,B.projectConfigTarget)}catch(mt){if(mt instanceof r)return Ly(B,mt.message);throw mt}let ee=m(B.userConfigTarget),he=Q?{config:null,errors:[]}:m(B.projectConfigTarget),je=Mu(B.userConfigPath,ee.errors),at=Mu(B.projectConfigPath,he.errors),lt=new Set,ct=ee.config?ba(ee.config,hr(B.userConfigPath),"user",B.userScope,lt):Du(),ut=he.config?ba(he.config,hr(B.projectConfigPath),"project",B.projectScope,lt):Du(),ft=ee.config?.overrides??{},dt=he.config?.overrides??{};return{rules:[...Ou(ct.rules,ft),...Ou(ut.rules,dt)],transparent_wrappers:Dy(ee.config,he.config),rulebooks:[...ct.rulebooks,...ut.rulebooks],errors:[...je,...at,...ct.errors,...ut.errors],warnings:[...ct.warnings,...ut.warnings,...ct.canValidateOverrides?Sa(ft,ct.knownRuleIds,B.userConfigPath):[],...ct.canValidateOverrides?Ny(dt,ct.knownRuleIds,B.projectConfigPath):[],...ut.canValidateOverrides?Sa(dt,ut.knownRuleIds,B.projectConfigPath):[]],userConfig:ee.config??void 0,projectConfig:he.config??void 0,...B}}function j(O,D){let B=Ay(O,D);if(!B)return[];return[...B.scope.errors,...B.scope.warnings,...Ty(B.config,B.scope,O)]}function Ay(O,D){let B=D??v(hr(hr(O)),"rules policy"),Q=m(i(B,O)).config;if(!Q)return null;return{config:Q,scope:ba(Q,hr(O),"project",B)}}function Ty(O,D,B){return D.canValidateOverrides?Sa(O.overrides??{},D.knownRuleIds,B):[]}function ba(O,D,B,Q=v(hr(hr(D)),B==="user"?"user policy":"project policy"),ee=new Set){let he=[],je=[],at=O.rules.flatMap((ct)=>{let ut=ky(ct,D,Q);if(ut.errors.length>0||!ut.rulebook)return he.push(...ut.errors),[];let ft=ut.rulebook;if(ee.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ee.add(ft.name),[{rules:Iy(ft),rulebook:{source:B,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((dt)=>`${ft.name}/${dt.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function Iy(O){if(O.rulebook_version===2)return O.rules.map((D)=>({name:`${O.name}/${D.name}`,command:D.command,block_args:[],match:D.match,reason:D.reason,intent:D.intent}));return O.rules.map((D)=>({...D,name:`${O.name}/${D.name}`,match:void 0}))}function ky(O,D,B){let Q=Pe(O),ee=I(D,Q),he=My(ee,B);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${ee} for ${O}; ${Oy(O)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${ee}: ${je.problem}; fix that file`]};if(je.rulebook.name!==Q)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${ee} must match source "${O}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(O){return S(O)?A(O).name:O}function Oy(O){return S(O)?`run ${Cu} to vendor ${O}`:"create that file or remove that source from the rules config"}function My(O,D){try{return{content:n(i(D,O))}}catch(B){if(B instanceof r)return{error:B.message};throw B}}function me(O){let D;try{D=JSON.parse(O)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(D)}}catch(B){return{problem:B instanceof Error?B.message:"invalid rulebook"}}}function Dy(O,D){return[...new Set([...O?.transparent_wrappers??[],...D?.transparent_wrappers??[]])]}function Ou(O,D){return O.flatMap((B)=>{let Q=D[B.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...B,intent:Q.intent??B.intent,reason:Q.reason}];return[B]})}function Sa(O,D,B){return Object.keys(O).filter((Q)=>!D.has(Q)).map((Q)=>`unknown override key "${Q}" in ${B}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Ny(O,D,B){return Object.keys(O).filter((Q)=>D.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${B}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Mu(O,D){return D.map((B)=>B.startsWith("Unable to access ")?B:`${O}: ${B}`)}function Ly(O,D){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[D],warnings:[],userConfigPath:O.userConfigPath,projectConfigPath:O.projectConfigPath}}function Du(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as qy,readFileSync as Yy}from"node:fs";var Nu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ca=new Set(Nu.map((O)=>O.id)),U=Nu,Wy=new Map(U.map((O)=>[O.id,O.intent]));function St(O,D){return{id:O,reason:D,intent:Wy.get(O)??"manual_only"}}var va=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],vi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Gy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Fy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ea=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Fy.flatMap((O)=>Gy.map((D)=>({id:["secret.home",O.idSlug,D.slice(1)].join("."),category:"Home path",label:[O.label,D].join(""),description:["Blocks home ",O.label,D," credential backup files."].join(""),suffixParts:[...O.directoryParts,[O.basename,D].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ei=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Lu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],zy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],xa=Lu.map((O)=>({id:`secret.variant.${O.slug}.separator`,category:"Variant",label:`${O.label}-* / ${O.label}_*`,description:`Blocks ${O.label} variants with dash or underscore suffixes.`,prefix:O.prefix})),Ra=Lu.flatMap((O)=>zy.map((D)=>({id:`secret.variant.${O.slug}.${D.slice(1)}`,category:"Variant",label:`${O.label}${D}`,description:`Blocks ${O.label}${D} private credential variants.`,prefix:O.prefix,suffix:D}))),Co={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},_a=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((O)=>({id:`secret.ext.${O}`,category:"Extension",label:`.${O}`,description:`Blocks files with the .${O} extension.`,extension:O})),wa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...va,vi,...Ea,...xa,...Ra,Co,..._a,...wa,...Ei].map((O)=>({id:O.id,category:O.category,label:O.label,...O.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in O?{paths:O.paths}:{description:O.description}})),xi=new Set(Ei.flatMap((O)=>O.category==="Coding CLI config"?[O.id]:[])),Pa=new Set(Ke.map((O)=>O.id));import{isAbsolute as Aa,join as By,normalize as $y,sep as Ri}from"node:path";var Wu=process.platform==="win32",Uy=/[*?]/;function vo(O,D){if(O==="~")return D;if(O.startsWith("~/"))return`${D}${O.slice(1)}`;return O}function Ta(O,D){if(typeof O!=="string"||O.trim()==="")return"must be a non-empty path string";let B=vo(O.trim(),D);if(!Aa(B))return"must be an absolute path or start with ~/";return Eo(B,D)}function Ia(O,D){let B=Gu(O,D);if(B===null)return"must be a non-empty path string";if(!Aa(B))return null;if(Eo(B,D)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Hy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",jy="cannot cover the guard's own configuration";function Gu(O,D){if(typeof O!=="string"||O.trim()==="")return null;return vo(O.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),D)}function ka(O,D){let B=Gu(O,D);if(B===null)return"must be a non-empty path string";if(Uy.test(B))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Aa(B))return null;if(Eo(B,D)!==null)return Hy;return Vy(B,D)?jy:null}function Vy(O,D){let B=_i(O),Q=_i(By(D,".cc-safety-net"));return B===Q||B.startsWith(`${Q}${Ri}`)}function Eo(O,D){let B=_i(O),Q=_i(D);if(B===Q)return"cannot be the home directory";let ee=B.endsWith(Ri)?B:`${B}${Ri}`;if(Q.startsWith(ee))return"cannot contain the home directory";return null}function _i(O){let D=$y(O);if(Wu)D=D.replace(/\//g,"\\").toLowerCase();if(D.length>(Wu?3:1)&&D.endsWith(Ri))D=D.slice(0,-1);return D}var Fu=30,wi=1,Pi=365;function zu(O){if(typeof O!=="number"||!Number.isInteger(O))return 30;if(O<1)return 1;return O>365?365:O}var Bu=new Set(U.filter((O)=>O.catastrophic).map((O)=>O.id));function wt(O,D){if(!O)return null;if(Bu.has(O.id))return O;if(D?.destructiveCommandProtectionEnabled===!1)return null;let B=D?.effectiveDestructiveCommandRules[O.id];return B&&!B.enabled?null:O}function Jt(O,D,B){if(Bu.has(D))return!0;if(O?.destructiveCommandProtectionEnabled===!1)return!1;return O?.effectiveDestructiveCommandRules[D]?.enabled??B}function G(O,D){return Object.freeze(Object.fromEntries(U.map((B)=>{let Q=B.activationCapability?D[B.activationCapability]:void 0,ee=Q?.enabled??!0,he=O.destructiveCommandRuleOverrides[B.id],je=B.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:O.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:ee,changesInherited:he==="on"!==ee,source:"rule_override",...B.activationCapability?{activationCapability:B.activationCapability}:{},override:he}:{enabled:ee,inheritedEnabled:ee,changesInherited:!1,source:Q?.source??"built_in_default",...B.activationCapability?{activationCapability:B.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ee,changesInherited:!1,source:"master_disabled",...B.activationCapability?{activationCapability:B.activationCapability}:{},...he?{override:he}:{}};return[B.id,Object.freeze(je)]})))}function $u(O,D){return Object.freeze({...O,effectiveDestructiveCommandRules:G(O,D)})}var Uu={standard:0,strict:1,paranoid:2};function Y(O,D){return{policy:{version:1,safety:{level:D.safety?.level??O.safety.level,overrides:{...O.safety.overrides,...D.safety?.overrides}},workflow:{worktree_mode:D.workflow?.worktree_mode??O.workflow.worktree_mode},destructive_command_protection:{enabled:D.destructive_command_protection?.enabled??O.destructive_command_protection.enabled,overrides:{...O.destructive_command_protection.overrides,...D.destructive_command_protection?.overrides},allow_paths:Oa(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths)},secret_protection:{enabled:D.secret_protection?.enabled??O.secret_protection.enabled,overrides:{...O.secret_protection.overrides,...D.secret_protection?.overrides},deny_paths:Oa(O.secret_protection.deny_paths,D.secret_protection?.deny_paths),allow_paths:Oa(O.secret_protection.allow_paths,D.secret_protection?.allow_paths)},audit:O.audit},weakenings:Ky(O,D)}}function Oa(O,D){return[...new Set([...O,...D??[]])]}function Ky(O,D){let B=D.safety?.level,Q=di[O.safety.level];return[...B&&Uu[B]<Uu[O.safety.level]?[`project policy lowers level: ${O.safety.level} -> ${B}`]:[],...Gr.flatMap((ee)=>D.safety?.overrides?.[ee]===!1&&(O.safety.overrides[ee]??Q[ee])?[`project policy disables ${ee}`]:[]),...D.workflow?.worktree_mode===!0&&!O.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...D.destructive_command_protection?.enabled===!1&&O.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...D.secret_protection?.enabled===!1&&O.secret_protection.enabled?["project policy disables secret protection"]:[],...Hu(D.destructive_command_protection?.overrides,(ee)=>O.destructive_command_protection.enabled&&O.destructive_command_protection.overrides[ee]!=="off"),...Hu(D.secret_protection?.overrides,(ee)=>O.secret_protection.enabled&&(O.secret_protection.overrides[ee]==="on"?!0:O.secret_protection.overrides[ee]!=="off"&&!xi.has(ee))),...O.destructive_command_protection.enabled?ju(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths).map((ee)=>`project policy adds destructive allow path: ${ee}`):[],...O.secret_protection.enabled?ju(O.secret_protection.allow_paths,D.secret_protection?.allow_paths).map((ee)=>`project policy adds secret allow path: ${ee}`):[]]}function Hu(O,D){return Object.entries(O??{}).flatMap(([B,Q])=>Q==="off"&&D(B)?[`project policy disables rule ${B}`]:[])}function ju(O,D){return(D??[]).filter((B)=>!O.includes(B))}var Na=new Set(["standard","strict","paranoid"]),Z={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Fu}};function Yu(O,D){let B=tb(u(O,D),O.home),Q=Ie(b(D.cwd),O.home),ee=ae(Q.parsed,O.home),he=Object.keys(ee.policy).length>0?Y(B.gui??Z,ee.policy):void 0,je=[...B.errors,...Q.errors,...ee.diagnostics],at=(B.fallback==="defaults"&&he?"salvaged":B.fallback)??(B.gui?void 0:Q.fallback)??(je.length>0?"salvaged":void 0),lt=ee.policy.safety?.level?"project":B.levelPresent?"user":"default";return{...he?Da(he.policy):B.policy,errors:je,...at?{fallback:at}:{},...Q.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var Zy="project policy audit settings are ignored; audit is user scope only";function ae(O,D){if(!yn(O))return{policy:{},diagnostics:[]};let B=yn(O.safety)?O.safety:{},Q=yn(O.workflow)?O.workflow:{},ee=yn(O.destructive_command_protection)?O.destructive_command_protection:{},he=yn(O.secret_protection)?O.secret_protection:{},je={...Na.has(B.level)?{level:B.level}:{},...yn(B.overrides)?Vu({overrides:Zu(B.overrides,Gr,["safety","overrides"],yr)}):{}},at={...typeof ee.enabled==="boolean"?{enabled:ee.enabled}:{},...ee.overrides!==void 0?{overrides:Ai(ee.overrides,Ca,Ju,yr)}:{},...ee.allow_paths!==void 0?{allow_paths:$r(ee.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],yr)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:Ai(he.overrides,Pa,Qu,yr)}:{},...he.deny_paths!==void 0?{deny_paths:$r(he.deny_paths,Ia,D,["secret_protection","deny_paths"],yr)}:{},...he.allow_paths!==void 0?{allow_paths:$r(he.allow_paths,ka,D,["secret_protection","allow_paths"],yr)}:{}};return{policy:Vu({safety:je,workflow:typeof Q.worktree_mode==="boolean"?{worktree_mode:Q.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:O.audit===void 0?[]:[Zy]}}function Zu(O,D,B,Q){return Object.fromEntries(D.flatMap((ee)=>{let he=O[ee];if(typeof he==="boolean")return[[ee,he]];if(he!==void 0)Q(e([...B,ee],La));return[]}))}function Vu(O){return Object.fromEntries(Object.entries(O).flatMap((D)=>Object.keys(D[1]).length>0?[D]:[]))}var yr=()=>{return},La="must be a boolean",Wa="must be an object if provided",Xu=`must be an integer between ${wi} and ${Pi}`,Ju={path:["destructive_command_protection","overrides"],label:"destructive command"},Qu={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(O,D){let B=[];return{policy:ed(O,D,(ee)=>{B.push(ee)}),issues:B}}function C(O,D){return ed(O,D,yr)}function ed(O,D,B){if(!yn(O))return B(e([],"Config must be an object")),H();if(O.version!==1)B(e(["version"],"must be 1"));let Q=Br(O.safety,["safety"],["level","overrides"],B),ee=Br(Q.overrides,["safety","overrides"],Gr,B),he=Br(O.workflow,["workflow"],["worktree_mode"],B),je=Br(O.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],B),at=Br(O.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],B),lt=Br(O.audit,["audit"],["retention_days"],B);return td(O,Je,[],B),{version:1,safety:{level:Xy(Q.level,B),overrides:Zu(ee,Gr,["safety","overrides"],B)},workflow:{worktree_mode:Ma(he.worktree_mode,["workflow","worktree_mode"],!1,B)},destructive_command_protection:{enabled:Ma(je.enabled,["destructive_command_protection","enabled"],!0,B),overrides:Ai(je.overrides,Ca,Ju,B),allow_paths:$r(je.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],B)},secret_protection:{enabled:Ma(at.enabled,["secret_protection","enabled"],!0,B),overrides:Ai(at.overrides,Pa,Qu,B),deny_paths:$r(at.deny_paths,Ia,D,["secret_protection","deny_paths"],B),allow_paths:$r(at.allow_paths,ka,D,["secret_protection","allow_paths"],B)},audit:{retention_days:Jy(lt.retention_days,B)}}}function Br(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(D,Wa)),{};return td(O,B,D,Q),O}function td(O,D,B,Q){for(let ee of Object.keys(O).filter((he)=>!D.includes(he)))Q({path:B,message:ee,kind:"unknownKeys"})}function Xy(O,D){if(O===void 0)return"standard";if(Na.has(O))return O;return D(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ma(O,D,B,Q){if(typeof O==="boolean")return O;if(O!==void 0)Q(e(D,La));return B}function Jy(O,D){if(!(O===void 0||typeof O==="number"&&Number.isInteger(O)&&O>=wi&&O<=Pi))D(e(["audit","retention_days"],Xu));return zu(O)}function Ai(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(B.path,Wa)),{};return Object.fromEntries(Object.entries(O).flatMap(([ee,he])=>{if(!D.has(ee))return Q({path:[...B.path,ee],message:`unknown ${B.label} rule id "${ee}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[ee,he]];return Q(e([...B.path,ee],'must be "on" or "off"')),[]}))}function $r(O,D,B,Q,ee){if(O===void 0)return[];if(!Array.isArray(O))return ee(e(Q,"must be an array of paths")),[];return O.flatMap((he,je)=>{let at=D(he,B);if(at===null)return[he];return ee(typeof he==="string"?Xt([...Q,je],at):e([...Q,je],at)),[]})}function yn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function H(){return structuredClone(Z)}function Ae(O,D){let B=R({safety:De(O.safety)},D),Q=G({destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides},B.capabilities),ee=Object.values(Q),he=ee.filter((je)=>je.source!=="catastrophic");return{selectedPreset:O.safety.level,effectiveLevel:B.effectiveLevel,capabilities:B.capabilities,rules:Q,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:ee.filter((je)=>je.changesInherited).length}}}function Ie(O,D){if(!qy(O))return{exists:!1,policy:H(),errors:[]};try{let B=Yy(O,"utf-8");if(!B.trim())return{exists:!0,policy:H(),errors:[`${O}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(B),ee=Ye(Q,D);if(ee.issues.length===0)return{exists:!0,parsed:Q,policy:ee.policy,errors:[]};return{exists:!0,parsed:Q,policy:ee.policy,errors:ee.issues.map((he)=>`${O}: ${eb(he)}`),fallback:yn(Q)?"salvaged":"defaults"}}catch(B){let Q=B instanceof Error?B.message:String(B);return{exists:!0,policy:H(),errors:[`${O}: ${B instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}var Qy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Wa,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[La,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Xu,`not an integer between ${wi} and ${Pi}`]]);function eb(O){let D=ya(O.path);if(O.kind==="unknownKeys")return`${D===""?"":`${D}.`}${O.message}: unknown field`;if(O.kind==="key")return`${D}: unknown rule id`;let B=Qy.get(O.message)??O.message;return D===""?B:`${D}: ${B}`}function tb(O,D){let B=Ie(O,D);if(!B.exists){let Q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!yn(Q))return{policy:qu(),errors:[]};let ee=C(Q,D);return{policy:Da(ee),gui:ee,errors:[],levelPresent:Ku(Q)}}if(B.parsed===void 0)return{policy:qu(),errors:B.errors,...B.fallback?{fallback:B.fallback}:{}};return{policy:Da(B.policy),gui:B.policy,errors:B.errors,...B.fallback?{fallback:B.fallback}:{},levelPresent:Ku(B.parsed)}}function Ku(O){let D=yn(O)&&yn(O.safety)?O.safety:{};return Na.has(D.level)}function Oe(O){let D=Object.entries(O),B=new Set(D.flatMap(([Q,ee])=>ee==="on"?[Q]:[]));return[...new Set([...[...xi].filter((Q)=>!B.has(Q)),...D.flatMap(([Q,ee])=>ee==="off"?[Q]:[])])]}function qu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function Da(O){return{safety:De(O.safety),worktreeMode:O.workflow.worktree_mode,destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides,destructiveCommandAllowPaths:O.destructive_command_protection.allow_paths,secretProtection:{enabled:O.secret_protection.enabled,disabledRules:Oe(O.secret_protection.overrides),denyPaths:O.secret_protection.deny_paths,allowPaths:O.secret_protection.allow_paths}}}function De(O){let D={...O.overrides.fail_closed!==void 0?{failClosed:O.overrides.fail_closed}:{},...O.overrides.paranoid_rm!==void 0?{paranoidRm:O.overrides.paranoid_rm}:{},...O.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:O.overrides.paranoid_interpreters}:{}};return{level:O.level,...Object.keys(D).length>0?{overrides:D}:{}}}function E(O,D){let B=J(O,D),Q=Yu(O,D),ee={rules:B.rules,transparentWrappers:B.transparent_wrappers,safety:Q.safety,worktreeMode:Q.worktreeMode,destructiveCommandProtectionEnabled:Q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:Q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:Q.destructiveCommandAllowPaths,secretProtection:{enabled:Q.secretProtection.enabled??!0,disabledRules:Q.secretProtection.disabledRules??[],denyPaths:Q.secretProtection.denyPaths,allowPaths:Q.secretProtection.allowPaths??[]}},he={...B.userConfig?.overrides,...B.projectConfig?.overrides},je=Object.freeze(Object.fromEntries(ee.rules.map((at)=>{let lt=B.rulebooks.find((ut)=>ut.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...ib(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(ee,nb(B,Q),je,Q.policyScopes)}function Ne(O){if(O.state==="ready")return{state:O.state};return{state:O.state,reason:O.reason}}function nb(O,D){let B=ob(D);if(O.errors.length===0&&O.warnings.length===0&&!B)return;return{diagnostics:[...O.errors,...O.warnings,...D.errors],reason:sb(O.errors.length>0?rb(O.errors):void 0,O.warnings.length>0?Fa(O.warnings.join("; ")):void 0,B)}}function rb(O){return`${Fa(O.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ob(O){if(O.errors.length===0)return;let D=O.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${O.errors.join("; ")}. Enforcing ${D}; the invalid values are not active. Fix the policy file manually`}function ib(O){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(O)}function Ee(O,D,B=Object.freeze({}),Q){let ee=Ga(structuredClone(O)),he=Q?{policyScopes:Ga(structuredClone(Q))}:{};if(!D)return Object.freeze({state:"ready",policy:ee,diagnostics:Object.freeze([]),ruleMetadata:B,...he});return Object.freeze({state:"degraded",policy:ee,diagnostics:Object.freeze([...D.diagnostics]),reason:D.reason,ruleMetadata:B,...he})}function Ga(O){if(typeof O!=="object"||O===null)return O;for(let D of Object.values(O))Ga(D);return Object.freeze(O)}function sb(...O){return Fa(O.filter((D)=>!!D).join("; "))}function Fa(O){return/[.!?]$/.test(O)?O:`${O}.`}function Fe(O){let D=O.effectiveCapabilities,B=O.strict??D.fail_closed.enabled,Q=O.paranoidRm??D.paranoid_rm.enabled,ee=O.paranoidInterpreters??D.paranoid_interpreters.enabled,he={fail_closed:za(D.fail_closed,O.strict,"strict"),paranoid_rm:za(D.paranoid_rm,O.paranoidRm,"paranoidRm"),paranoid_interpreters:za(D.paranoid_interpreters,O.paranoidInterpreters,"paranoidInterpreters")};return{policy:$u(O.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:oa({failClosed:B,paranoidRm:Q,paranoidInterpreters:ee}),strict:B,paranoidRm:Q,paranoidInterpreters:ee,worktreeMode:O.worktreeMode??!1}}function za(O,D,B){if(D===void 0||D===O.enabled)return O;return{enabled:D,source:"capability_override",sources:[...O.sources,`analysis options.${B}`]}}function xo(O,D){if(O!=="powershell")return D[0]?.provenance==="command-substitution";let B=D[0]?.text==="&"||D[0]?.text==="."?1:0,Q=D[B]?.provenance;return Q!==void 0&&Q!=="literal"}var ab=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ti(O,D){return O?.provenance==="literal"&&!O.quoted&&O.raw===D&&O.text===D}function Ro(O){let D=Ti(O.words[0],"time")?1:0,B=D===1&&Ti(O.words[D],"-p")?D+1:D,Q=D===1&&Ti(O.words[B],"--")?B+1:B,ee=Ti(O.words[Q],"!")?Q+1:Q,he=O.words.slice(ee).find((je)=>!ab.test(je.text));return he?.provenance==="literal"?he.text:void 0}var tr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Ii(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function lb(O){return Object.freeze({...O,span:Object.freeze(O.span),words:Object.freeze(O.words),redirections:Object.freeze(O.redirections.map((D)=>Object.freeze({...D,span:Object.freeze(D.span),...D.heredoc?{heredoc:Object.freeze({...D.heredoc,bodySpan:Object.freeze(D.heredoc.bodySpan),terminatorSpan:Object.freeze(D.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(O.nested.map((D)=>ln(D)))})}function ki(O,D,B){O.push(B),D.reset()}function Oi(O){let D=[];return{parts:D,push:(B,Q,ee)=>{if(Q<=B)return;D.push({raw:O.slice(B,Q),span:{start:B,end:Q},provenance:ee})}}}function Ba(O){let D=O.parts??[{raw:O.raw,span:O.span,provenance:O.provenance}];return Object.freeze({kind:"word",...O,span:Object.freeze(O.span),parts:Object.freeze(D.map((B)=>Object.freeze({...B,span:Object.freeze(B.span)})))})}function Ur(O,D,B,Q,ee,he,je){return Ba({text:Q,raw:O.slice(D,B),span:{start:D,end:B},provenance:ee,quoted:he,...je?{parts:je}:{}})}function ln(O){return Object.freeze({...O,span:Object.freeze(O.span),issues:Object.freeze(O.issues.map((D)=>Object.freeze({...D}))),nodes:Object.freeze(O.nodes.map((D)=>{if(D.kind==="command")return lb(D);if(D.kind==="group"||D.kind==="function")return Object.freeze({...D,span:Object.freeze(D.span),body:ln(D.body)});return Object.freeze({...D,span:Object.freeze(D.span)})}))})}function $a(O,D,B){if(D>=B||rd(O[D]??""))return null;let Q="",ee=!1,he=!1,je=D;while(je<B&&!rd(O[je]??"")){let at=O[je]??"";if(at==="'"){ee=!0;let lt=nd(O,je+1,B,"'");Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){ee=!0;let lt=nd(O,je+1,B,'"');Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){ee=!0;let lt=O[je+1];if(!lt||lt===`
-`||lt==="\r"){he=!0;break}Q+=lt,je+=2;continue}if(at==="`"||O.startsWith("$(",je)||O.startsWith("${",je)||O.startsWith("<(",je)||O.startsWith(">(",je))he=!0;Q+=at,je++}return{delimiter:Q,quoted:ee,next:je,ambiguous:he}}function Ua(O,D,B,Q){let ee=[],he=D;for(let je of Q){let at=he,lt=!1;while(he<B){let ct=cb(O,he,B);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?ub(O.slice(at,he)):O.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return ee.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:B,issues:ee,terminated:!1}}return{next:he,issues:ee,terminated:!0}}function nd(O,D,B,Q){let ee="",he=D;while(he<B&&O[he]!==`
-`&&O[he]!=="\r"){let je=O[he]??"";if(je===Q)return{text:ee,next:he+1,closed:!0};if(Q==='"'&&je==="\\"&&O[he+1]){let at=O[he+1]??"";ee+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}ee+=je,he++}return{text:ee,next:he,closed:!1}}function rd(O){return O!=="\r"&&(/[\s;&|<>)]/u.test(O)||O==="`")}function cb(O,D,B){let Q=D;while(Q<B&&O[Q]!==`
-`)Q++;let ee=Q>=B?B:Q+1;return{text:O.slice(D,Q),contentEnd:Q,next:ee}}function ub(O){return O.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ad=new Set(["&&","||","|","|&"]);function ld(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"posix",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Ni(O,0,O.length,D,{used:0,max:D.maxWords},0);return ln({kind:"program",dialect:"posix",source:O,span:B,status:Gi(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Ni(O,D,B,Q,ee,he,je){let at=[],lt=[],ct=Ii(),ut=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((gt)=>gt.text);ki(at,ct,{kind:"command",dialect:"posix",source:O.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?O.slice(D,B):pt.join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(je&&mt===je)return ft(),sd(at,lt),{nodes:at,issues:lt,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ut};if(Wi(mt)){if(mt===`
-`||mt==="\r"){ft();let vt=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1,Pt=at.at(-1);if(Pt?.kind!=="connector"||!ad.has(Pt.operator))at.push(Object.freeze({kind:"connector",operator:O.slice(dt,vt),span:Object.freeze({start:dt,end:vt})}));if(ut.length>0){let xt=Ua(O,vt,B,ut.splice(0));lt.push(...xt.issues),dt=xt.next;continue}dt=vt;continue}dt++;continue}if(mt==="#"){while(dt<B&&O[dt]!==`
-`&&O[dt]!=="\r")dt++;continue}let pt=ct.start===-1?kb(O,dt,B):void 0;if(pt){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);if(!Ha(ee))return Hr(at,lt,dt,"word-limit",Q.maxWords);let vt=Ni(O,pt.braceIndex+1,B,Q,ee,he+1,"}"),Pt=vt.next,xt={start:pt.braceIndex+1,end:vt.closed?Pt-1:Pt},_t=od(O,xt,vt);if(at.push({kind:"function",name:pt.name,span:{start:dt,end:Pt},body:_t}),lt.push(...vt.issues),vt.pendingHeredocs.length>0||wo(vt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ut.push(...vt.pendingHeredocs),vt.limited)return Di(at,lt,vt.next);if(!vt.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});dt=Pt;continue}let gt=Li(O,dt);if(gt){if(ft(),!hd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${gt} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:gt,span:Object.freeze({start:dt,end:dt+gt.length})})),dt+=gt.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:dt,end:dt+1}}),dt++;continue}if((mt==="("||mt==="{"&&bb(O,dt,B))&&ct.start===-1){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);let vt=mt==="("?")":"}",Pt=Ni(O,dt+1,B,Q,ee,he+1,vt),xt=Pt.next,_t={start:dt+1,end:Pt.closed?xt-1:xt},Ut=od(O,_t,Pt);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:dt,end:xt},body:Ut}),lt.push(...Pt.issues),Pt.pendingHeredocs.length>0||wo(Pt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ut.push(...Pt.pendingHeredocs),Pt.limited)return Di(at,lt,Pt.next);if(!Pt.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});dt=xt;continue}let ht=(mt==="<"||mt===">")&&O[dt+1]!=="("?pb(O,dt):null;if(ht){let vt=ct.words.at(-1),Pt=vt&&vt.span.end===dt&&/^[0-9]+$/.test(vt.raw)?Number(vt.raw):void 0;if(Pt!==void 0)ct.words.pop();let xt=Pt===void 0?dt:vt?.span.start??dt;ct.start=ct.start===-1?dt:ct.start;let _t=dt+ht.length;while(_t<B&&/[ \t]/.test(O[_t]??""))_t++;let Ut=O[_t],jt=_t>dt+ht.length&&Ut==="#",qt=!Ut||Wi(Ut)||!!Li(O,_t)||Ut===je||Ut===")"||jt||(Ut==="<"||Ut===">")&&O[_t+1]!=="(",Vt=ht==="<<"||ht==="<<-",Ft=Vt?$a(O,_t,B):void 0,Ot=Ft?{word:Ur(O,_t,Ft.next,Ft.delimiter,"literal",Ft.quoted),nested:[],issues:[],next:Ft.next,limited:!1}:!qt?Va(O,_t,B,Q,ee,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Di(at,lt,Ot.next);if(!Ha(ee))return Hr(at,lt,Ot.next,"word-limit",Q.maxWords)}let on=Ot?.next??dt+ht.length,Cn={kind:"redirection",operator:ht,span:{start:xt,end:on},...Pt===void 0?{}:{fd:Pt},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Cn),Vt&&!Ft)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Ft){if(Ft.ambiguous||Ft.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Bn=ct.nested;ut.push({delimiter:Ft.delimiter,quotedDelimiter:Ft.quoted,stripTabs:ht==="<<-",attach:(wn)=>{if(Cn.heredoc=wn,wn.quotedDelimiter)return;Bn.push(...fb(O,wn.bodySpan.start,wn.bodySpan.end,Q,ee,he+1))}})}if(!Vt&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${ht} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=on,dt=on;continue}if(ct.start===-1)ja(at,lt);let yt=Va(O,dt,B,Q,ee,he);if(lt.push(...yt.issues),yt.limited)return Di(at,lt,yt.next);let Ct=vb(ct.words)?wb(O,yt.word,ee.max-ee.used,Q.maxDepth,Q.maxInputLength):void 0;if(Ct?.limitCode)return Hr(at,lt,yt.next,Ct.limitCode,Ct.limitCode==="word-limit"?Q.maxWords:Ct.limitCode==="depth-limit"?Q.maxDepth:Q.maxInputLength);let Et=Ct?.words??[yt.word];for(let vt of Et){if(!Ha(ee))return Hr(at,lt,yt.next,"word-limit",Q.maxWords);ct.words.push(vt)}ct.start=ct.start===-1?dt:ct.start,ct.end=yt.next,ct.nested.push(...yt.nested),dt=yt.next>dt?yt.next:dt+1}return ft(),sd(at,lt),lt.push(...Ob(ut)),{nodes:at,issues:lt,next:dt,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function od(O,D,B){return{kind:"program",dialect:"posix",source:O.slice(D.start,D.end),span:D,status:Gi(B.issues,B.limited),issues:B.issues,nodes:B.nodes}}function Va(O,D,B,Q,ee,he){let je="",at=D,lt=!1,ct="literal",ut=[],ft=[],dt=!1;while(at<B){let mt=O[at],pt=(mt==="<"||mt===">")&&O[at+1]==="(";if(!mt||Wi(mt)||(mt===";"||mt==="|"||mt==="&")&&Li(O,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let ht=O.indexOf("'",at+1);if(ht===-1||ht>=B){je+=O.slice(at+1,B),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=B;break}je+=O.slice(at+1,ht),at=ht+1;continue}if(mt==='"'){lt=!0;let ht=db(O,at,B,Q,ee,he);if(je+=ht.text,ut.push(...ht.nested),ft.push(...ht.issues),dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(O.startsWith("$'",at)){lt=!0;let ht=gb(O,at+2,B);if(je+=ht.text,ft.push(...ht.issues),!ht.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=ht.next;continue}if(mt==="\\"){let ht=O[at+1];if(!ht){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(ht===`
-`){at+=2;continue}je+=ht,at+=2;continue}let gt=mt==="$"||mt==="<"||mt===">"||mt==="`"?Fi(O,at,B,Q,ee,he):null;if(gt){let ht=cd(gt,ut,ft);if(dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(mt==="$"){let ht=fd(O,at,B,je,ct);je=ht.text,ct=ht.provenance,at=ht.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=_o(ct,"glob");je+=mt,at++}return{word:Ur(O,D,at,je,ct,lt,ct==="literal"?void 0:yb(O,D,at)),nested:ut,issues:ft,next:at,limited:dt}}function db(O,D,B,Q,ee,he){let je="",at="literal",lt=[],ct=[],ut=!1,ft=D+1;while(ft<B){let dt=O[ft];if(dt==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:ut};if(dt==="\\"&&O[ft+1]){let pt=O[ft+1]??"";if(pt===`
-`){ft+=2;continue}if(pt==="\r"&&O[ft+2]===`
-`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(O.startsWith("$((",ft)){let pt=Ka(O,ft+3,B,"))"),gt=pt===-1?B:pt+2;if(je+=O.slice(ft,gt),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=gt;continue}let mt=Fi(O,ft,B,Q,ee,he);if(mt){let pt=cd(mt,lt,ct);if(ft=pt.next,ut||=pt.limited,at=_o(at,pt.provenance),ut)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:ut};continue}if(dt==="$"){let pt=fd(O,ft,B,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=dt??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:B,limited:ut}}function Fi(O,D,B,Q,ee,he){let je=O.startsWith("$((",D),at=O.startsWith("$(",D)&&!je,lt=O.startsWith("<(",D)||O.startsWith(">(",D),ct=O[D]==="`";if(!je&&!at&&!lt&&!ct)return null;let ut=je?3:ct?1:2,ft=je?"))":ct?"`":")",dt=Ka(O,D+ut,B,ft),mt=dt===-1?B:dt,pt=dt===-1?B:dt+ft.length;if(he>=Q.maxDepth)return{program:Ib(O,D+ut,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let Ct=[],Et=[],vt=!1,Pt=D+ut;while(Pt<mt){let xt=Fi(O,Pt,mt,Q,ee,he+1);if(!xt){Pt++;continue}if(Ct.push(...xt.program.nodes),Et.push(...xt.program.issues),vt||=xt.program.status==="limited",Pt=xt.next,vt)break}if(dt===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Gi(Et,vt),issues:Et,nodes:Ct}),next:pt,provenance:"arithmetic"}}let gt=Ni(O,D+ut,mt,Q,ee,he+1),ht=dt===-1?[{code:"unclosed-command-substitution",message:`${O.slice(D,D+ut)} substitution is not closed`}]:[],yt=(ct||lt)&&wo(gt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Gi([...gt.issues,...ht,...yt],gt.limited),issues:[...gt.issues,...ht,...yt],nodes:gt.nodes}),next:pt,provenance:"command-substitution"}}function fb(O,D,B,Q,ee,he){let je=[],at=D;while(at<B){let lt=O[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?Fi(O,at,B,Q,ee,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function cd(O,D,B){return D.push(O.program),B.push(...O.program.issues),{provenance:O.provenance,next:O.next,limited:O.program.status==="limited"}}function Ka(O,D,B,Q){if(Q==="`"){for(let at=D;at<B;at++){if(O[at]==="\\"){at++;continue}if(O[at]==="`")return at}return-1}let ee=1,he={single:!1,double:!1},je=[];for(let at=D;at<B;at++){let lt=O[at];if((lt===`
-`||lt==="\r")&&je.length>0){let ut=lt==="\r"&&O[at+1]===`
-`?at+2:at+1,ft=Ua(O,ut,B,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=ud(O,at,D,B,he);if(ct!==null){at=ct;continue}if(!he.double&&O.startsWith("$((",at)){let ut=mb(O,at+3,B);if(ut===-1)return-1;at=ut+1;continue}if(Q===")"&&!he.double&&lt==="<"&&O[at+1]==="<"&&O[at+2]!=="<"){let ut=O[at+2]==="-",ft=at+(ut?3:2);while(ft<B&&/[ \t]/.test(O[ft]??""))ft++;let dt=$a(O,ft,B);if(dt){je.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ut,attach:()=>{return}}),at=dt.next-1;continue}}if(O.startsWith("$(",at)&&!O.startsWith("$((",at)){ee++,at++;continue}if(lt==="("&&!he.double)ee++;if(lt===")"&&!he.double){if(ee--,ee===0)return Q==="))"&&O[at+1]!==")"?-1:at}}return-1}function mb(O,D,B){let Q=1,ee={single:!1,double:!1};for(let he=D;he<B;he++){let je=O[he],at=ud(O,he,D,B,ee);if(at!==null){he=at;continue}if(O.startsWith("$(",he)&&!O.startsWith("$((",he)){Q++,he++;continue}if(je==="("&&!ee.double)Q++;if(je!==")"||ee.double)continue;if(Q--,Q===0)return O[he+1]===")"?he:-1}return-1}function ud(O,D,B,Q,ee){let he=O[D];if(he==="\\"&&!ee.single)return D+1;if(!ee.double&&he==="'")ee.single=!ee.single;if(!ee.single&&he==='"')ee.double=!ee.double;if(ee.single)return D;if(ee.double||he!=="#"||!Mb(O,D,B))return null;let je=D;while(je+1<Q&&O[je+1]!==`
-`&&O[je+1]!=="\r")je++;return je}function Li(O,D){let B=O[D];if(B===";")return";";if(B==="&")return O[D+1]==="&"?"&&":"&";if(B==="|")return O[D+1]==="|"?"||":O[D+1]==="&"?"|&":"|";return null}function pb(O,D){let B=O[D];if(B===">"){if(O[D+1]===">")return">>";if(O[D+1]==="&")return">&";return O[D+1]==="|"?">|":">"}if(B!=="<")return null;if(O.startsWith("<<<",D))return"<<<";if(O.startsWith("<<-",D))return"<<-";if(O[D+1]==="<")return"<<";if(O[D+1]==="&")return"<&";if(O[D+1]===">")return"<>";return"<"}function Wi(O){let D=O.charCodeAt(0);if(D===32||D>=9&&D<=13)return!0;if(D<128)return!1;return/\s/u.test(O)}function dd(O,D,B){if(O[D+1]==="{"){let ee=O.indexOf("}",D+2);return ee===-1||ee>=B?B:ee+1}let Q=D+1;while(Q<B&&/[A-Za-z0-9_?@#$!*-]/.test(O[Q]??""))Q++;return Q===D+1?D+1:Q}function gb(O,D,B){let Q="",ee=[],he=D;while(he<B){let je=O[he];if(je==="'")return{text:Q,next:he+1,closed:!0,issues:ee};if(je!=="\\"){Q+=je??"",he++;continue}let at=hb(O,he+1,B);if(Q+=at.text,at.invalidCodePoint!==void 0)ee.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:Q,next:B,closed:!1,issues:ee}}function hb(O,D,B){let Q=O[D];if(!Q||D>=B)return{text:"\\",next:D};let ee=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ee.has(Q))return{text:ee.get(Q)??Q,next:D+1};if(Q==="x")return Mi(O,D+1,B,16,2,D+1);if(Q==="u")return Mi(O,D+1,B,16,4,D+1);if(Q==="U")return Mi(O,D+1,B,16,8,D+1);if(/[0-7]/.test(Q))return Mi(O,D,B,8,3,D+1);return{text:Q,next:D+1}}function Mi(O,D,B,Q,ee,he){let je=Q===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=D;while(lt<B&&at.length<ee&&je.test(O[lt]??""))at+=O[lt],lt++;if(!at)return{text:O[he-1]??"",next:he};let ct=Number.parseInt(at,Q);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function Gi(O,D=!1){if(D)return"limited";if(O.some((B)=>B.code==="invalid-ansi-c-code-point"||B.code==="missing-heredoc-delimiter"||B.code==="ambiguous-heredoc-delimiter"||B.code==="unterminated-heredoc"||B.code==="unsupported-heredoc-context"))return"invalid";return O.length>0?"partial":"complete"}function fd(O,D,B,Q,ee){let he=dd(O,D,B);return{text:Q+O.slice(D,he),provenance:_o(ee,"variable"),next:he}}function yb(O,D,B){let Q=Oi(O),ee=D,he=!1,je=!1,at=D;while(at<B){let lt=O[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=O.startsWith("$((",at),ut=O.startsWith("$(",at)&&!ct,ft=!je&&(O.startsWith("<(",at)||O.startsWith(">(",at)),dt=lt==="`";if(ct||ut||ft||dt){let mt=ct?3:dt?1:2,pt=ct?"))":dt?"`":")",gt=Ka(O,at+mt,B,pt),ht=gt===-1?B:gt+pt.length;Q.push(ee,at,"literal"),Q.push(at,ht,ct?"arithmetic":"command-substitution"),at=ht,ee=ht;continue}if(lt==="$"){let mt=dd(O,at,B);if(mt>at+1){Q.push(ee,at,"literal"),Q.push(at,mt,"variable"),at=mt,ee=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){Q.push(ee,at,"literal"),Q.push(at,at+1,"glob"),at++,ee=at;continue}at++}return Q.push(ee,B,"literal"),Q.parts}function _o(O,D){if(D==="command-substitution"||O==="command-substitution")return"command-substitution";if(D==="arithmetic"||O==="arithmetic")return"arithmetic";if(D==="variable"||O==="variable")return"variable";if(D==="glob"||O==="glob")return"glob";return O}function bb(O,D,B){return D+1>=B||Wi(O[D+1]??"")||Li(O,D+1)!==null}var Sb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Cb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function vb(O){let D=0;while(D<=O.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(O[D]?.text??""))D++;if(D===O.length)return!0;let B=Eb(O,D);if(B===void 0||B===null)return!1;D=B}return!1}function Eb(O,D){let B=O[D]?.text.toLowerCase();if(B==="command")return xb(O,D);if(B==="env")return Rb(O,D);if(B==="sudo")return _b(O,D);return}function xb(O,D){if(O[D+1]?.text==="-v")return null;for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return B}return O.length}function Rb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Sb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return B}return O.length}function _b(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Cb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-"))continue;return B}return O.length}function md(O,D,B,Q){if(O.provenance!=="literal"||!O.raw.includes("{"))return;let ee=pd(O.raw,D,B,Q,!0);if(!ee)return;if("limited"in ee)return{limited:!0};let he=ee.values.map((je)=>gd(je,B));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function wb(O,D,B,Q,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let he=pd(D.raw,B,Q,ee,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>gd(at,Q));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Ur(O,D.span.start,D.span.end,at,"literal",!1))}}function pd(O,D,B,Q,ee){let he=[O],je=O.length,at=0;while(!0){let lt=he.findIndex((mt)=>id(mt,ee));if(lt===-1)break;if(++at>B)return{limited:"expansions"};let ct=he[lt]??"",ut=id(ct,ee);if(!ut||ut.kind==="range")return{limited:"expansions"};let ft=ut.start+ct.length-ut.end,dt=ut.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+dt>Q)return{limited:"length"};if(he.length-1+ut.alternatives.length>D)return{limited:"words"};he.splice(lt,1,...Pb(ct,ut)),je+=dt-ct.length}return at===0?void 0:{values:he}}function id(O,D){let B=[],Q,ee=null,he=!1;for(let je=0;je<O.length;je++){let at=O[je];if(he){he=!1;continue}if(at==="\\"&&ee!=="'"){he=!0;continue}if(at===ee){ee=null;continue}if(ee===null&&(at==="'"||at==='"')){ee=at;continue}if(ee!==null)continue;if(at==="{"){B.push({start:je,commas:[]});continue}if(at===","&&B.length>0){B.at(-1)?.commas.push(je);continue}if(at!=="}"||B.length===0)continue;let lt=B.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:D&&Tb(O.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!Q||ct.start<Q.start))Q=ct}if(!Q||Q.kind==="range")return Q;return{kind:Q.kind,start:Q.start,end:Q.end,alternatives:Ab(O,Q)}}function Pb(O,D){return D.alternatives.map((B)=>`${O.slice(0,D.start)}${B}${O.slice(D.end)}`)}function Ab(O,D){let B=[D.start,...D.commas,D.end-1];return B.slice(0,-1).map((Q,ee)=>O.slice(Q+1,B[ee+1]))}function Tb(O){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(O)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(O)}function gd(O,D){let B=`x${O}`,Q=Va(B,0,B.length,{maxInputLength:B.length,maxWords:1,maxDepth:D},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==B.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function Ib(O,D,B,Q){return ln({kind:"program",dialect:"posix",source:O.slice(D,B),span:{start:D,end:B},status:"limited",issues:[{code:Q,message:"command structure exceeds parser limit"}],nodes:[]})}function Hr(O,D,B,Q,ee){return{nodes:O,issues:[...D,{code:Q,message:`command structure exceeds parser limit ${ee}`}],next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Di(O,D,B){return{nodes:O,issues:D,next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Ha(O){return O.used++,O.used<=O.max}function kb(O,D,B){let Q=O.slice(D,B),ee=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(Q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(Q),he=ee?.[1];if(!ee||!he)return;return{name:he,braceIndex:D+ee[0].lastIndexOf("{")}}function wo(O){return O.some((D)=>{if(D.kind==="command")return D.redirections.some((B)=>B.heredoc)||D.nested.some((B)=>wo(B.nodes));return(D.kind==="group"||D.kind==="function")&&wo(D.body.nodes)})}function Ob(O){return O.map((D)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${D.delimiter} was not found`}))}function hd(O){return O?.kind==="command"||O?.kind==="group"||O?.kind==="function"}function sd(O,D){let B=O.at(-1);if(B?.kind!=="connector"||!ad.has(B.operator))return;D.push({code:"missing-command-after-connector",message:`connector ${B.operator} requires a following command`})}function ja(O,D){if(!hd(O.at(-1)))return;D.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Mb(O,D,B){return D===B||/[\s;&|()]/u.test(O[D-1]??"")}var bd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Db=new Set(["gc","cat","type","cp","mv","rm"]),Sd=["-rec","-for","-path","-literalpath","-whatif"],Nb=/^\$env:\w/i,Lb=/^(?:\$\{?\w+\}?|~)\\./;function Cd(O,D){let B=O.toLowerCase().replaceAll("`","");if(![...bd].some((ee)=>B.includes(ee))&&!(B.includes("rm")&&Sd.some((ee)=>B.includes(ee)))&&!B.includes("<#")&&!Wb(B))return!1;let Q=Xa(O,D);if(vd(Q))return!1;return Q.issues.some((ee)=>ee.code==="unclosed-block-comment"||ee.code==="comment-depth-limit")||Za(Q).some(Gb)}function vd(O){return O.nodes.some((D)=>{if(D.kind==="group")return vd(D.body);if(D.kind!=="command")return!1;return D.redirections.some((B)=>B.operator==="<<")})}function Wb(O){if(O.includes("$env:"))return!0;return O.includes("\\")&&(O.includes("$")||O.includes("~"))}function Gb(O){let D=O[0]==="&"||O[0]==="."?1:0,B=O[D]?.toLowerCase();if(B&&bd.has(B))return!0;let Q=O.slice(D+1);if(B&&Db.has(B)&&Q.some(Fb))return!0;if(B!=="rm")return!1;return Q.some((ee)=>{let he=ee.toLowerCase().split(":",1)[0]??"";return Sd.some((je)=>he.startsWith(je))})}function Fb(O){return Nb.test(O)||Lb.test(O)}function Xa(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"powershell",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Ja(O,0,O.length,D,0);return ln({kind:"program",dialect:"powershell",source:O,span:B,status:Hb(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Ja(O,D,B,Q,ee,he=!1){let je=[],at=[],lt=Ii(),ct=0,ut=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};ki(je,lt,{kind:"command",dialect:"powershell",source:O.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:dt+1,closed:!0,words:ct,limited:ut};let pt=Ub(O,dt,B,Q.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};dt=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
-`){ft();let yt=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1;je.push(qa(O,dt,yt)),dt=yt;continue}dt++;continue}let gt=Rd(O,dt);if(gt){ft(),je.push(qa(O,dt,dt+gt.length)),dt+=gt.length;continue}if(mt==="{"){if(ft(),ee>=Q.maxDepth)return at.push(xd(Q.maxDepth)),{nodes:je,issues:at,next:B,closed:!1,words:ct,limited:!0};let yt=Ja(O,dt+1,B,Q,ee+1,!0),Ct=yt.closed?yt.next-1:yt.next,Et=ln({kind:"program",dialect:"powershell",source:O.slice(dt+1,Ct),span:{start:dt+1,end:Ct},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:yt.next}),body:Et})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,ut||=yt.limited,dt=yt.next;continue}if(mt==="}"){ft(),je.push(qa(O,dt,dt+1)),dt++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?dt:lt.start;let yt=O[dt+1]===mt?dt+2:dt+1,Ct=yt;while(/[ \t]/.test(O[Ct]??""))Ct++;let Et=Ct<B?yd(O,Ct,B,Q,ee):void 0,vt=Et?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:O.slice(dt,yt),span:Object.freeze({start:dt,end:vt}),...Et?{target:Et.word}:{}})),Et)at.push(...Et.issues),lt.nested.push(...Et.nested),ct+=Et.words,ut||=Et.limited;lt.end=vt,dt=vt;continue}if(mt===","){lt.start=lt.start===-1?dt:lt.start,lt.words.push(Ba({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),lt.end=++dt;continue}let ht=yd(O,dt,B,Q,ee);if(lt.start=lt.start===-1?dt:lt.start,lt.end=ht.next,lt.words.push(ht.word),at.push(...ht.issues),lt.nested.push(...ht.nested),ct+=1+ht.words,ut||=ht.limited,ct>Q.maxWords)return at.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`}),ft(),{nodes:je,issues:at,next:ht.next,closed:!1,words:ct,limited:!0};dt=ht.next>dt?ht.next:dt+1}return ft(),{nodes:je,issues:at,next:dt,closed:!he,words:ct,limited:ut}}function yd(O,D,B,Q,ee){let he="",je="literal",at=!1,lt=[],ct=[],ut=0,ft=!1,dt=(pt)=>{let gt=zb(O,pt,B,Q,ee);return he+=O.slice(pt,gt.next),ct.push(gt.program),lt.push(...gt.program.issues),ut+=Ya(gt.program),ft||=gt.program.status==="limited",je="command-substitution",gt.next},mt=D;while(mt<B){let pt=O[mt];if(!pt||/\s/.test(pt)||Rd(O,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let gt=O[mt+1];if(!gt){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=gt,mt+=2;continue}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(pt==="'"){at=!0,mt++;let gt=!1;while(mt<O.length){if(O[mt]==="'"&&O[mt+1]==="'"){he+="'",mt+=2;continue}if(O[mt]==="'"){gt=!0,mt++;break}he+=O[mt]??"",mt++}if(!gt)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let gt=!1;while(mt<B){let ht=O[mt];if(ht==="`"&&O[mt+1]){he+=O[mt+1],mt+=2;continue}if(ht==='"'){gt=!0,mt++;break}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(ht==="$")je=O[mt+1]==="("?"command-substitution":"variable";he+=ht??"",mt++}if(!gt)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=O[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===D)je="variable";he+=pt,mt++}return{word:Ur(O,D,mt,he,je,at,je==="literal"?void 0:Bb(O,D,mt)),next:mt,issues:lt,nested:ct,words:ut,limited:ft}}function zb(O,D,B,Q,ee){let he=Ed(O,D+2,B),je=he===-1?B:he,at=he===-1?B:he+1;if(ee>=Q.maxDepth)return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:"limited",issues:[xd(Q.maxDepth)],nodes:[]}),next:at};let lt=Ja(O,D+2,je,Q,ee+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function Ed(O,D,B){let Q=1,ee=!1,he=!1;for(let je=D;je<B;je++){let at=O[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(ee&&O[je+1]==="'"){je++;continue}ee=!ee;continue}if(!ee&&at==='"'){he=!he;continue}if(ee)continue;if(O.startsWith("$(",je)){Q++,je++;continue}if(!he&&at==="(")Q++;if(at!==")")continue;if(Q--,Q===0)return je}return-1}function Ya(O){let D=0;for(let B of O.nodes){if(B.kind==="group")D+=Ya(B.body);if(B.kind==="command"){D+=B.words.length;for(let Q of B.nested)D+=Ya(Q)}}return D}function Bb(O,D,B){let Q=Oi(O),ee=D,he=!1,je=D;while(je<B){let at=O[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&O[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(O.startsWith("$(",je)){let lt=Ed(O,je+2,B),ct=lt===-1?B:lt+1;Q.push(ee,je,"literal"),Q.push(je,ct,"command-substitution"),je=ct,ee=ct;continue}if(at==="$"||at==="@"&&je===D){let lt=$b(O,je+1,B);Q.push(ee,je,"literal"),Q.push(je,lt,"variable"),je=lt,ee=lt;continue}je++}return Q.push(ee,B,"literal"),Q.parts}function $b(O,D,B){if(O[D]==="{"){let ee=O.indexOf("}",D+1);return ee===-1||ee>=B?B:ee+1}let Q=D;while(Q<B&&/[A-Za-z0-9_:?]/.test(O[Q]??""))Q++;return Q}function xd(O){return{code:"depth-limit",message:`command structure exceeds parser limit ${O}`}}function Za(O){return O.nodes.flatMap((D)=>{if(D.kind==="group")return Za(D.body);if(D.kind!=="command")return[];return[[...D.words,...D.redirections.flatMap((B)=>B.target?[B.target]:[])].sort((B,Q)=>B.span.start-Q.span.start).filter((B)=>B.text!==""&&B.raw!==",").map((B)=>B.text),...D.nested.flatMap(Za)]})}function Rd(O,D){for(let B of["&&","||",";","|"])if(O.startsWith(B,D))return B;return null}function Ub(O,D,B,Q){if(O[D]==="#"&&O[D+1]!==">"){let je=D+1;while(je<B&&O[je]!=="\r"&&O[je]!==`
-`)je++;return{next:je,limited:!1}}if(!O.startsWith("<#",D))return null;let ee=1,he=D+2;while(he<B){if(O.startsWith("<#",he)){if(ee++,ee>Q)return{next:B,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`},limited:!0};he+=2;continue}if(O.startsWith("#>",he)){if(ee--,he+=2,ee===0)return{next:he,limited:!1};continue}he++}return{next:B,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Hb(O,D){if(D)return"limited";if(O.some((B)=>B.code==="unclosed-block-comment"))return"invalid";return O.length>0?"partial":"complete"}function qa(O,D,B){return Object.freeze({kind:"connector",operator:O.slice(D,B),span:Object.freeze({start:D,end:B})})}function h(O,D="auto",B=tr){if(D==="powershell"||D==="auto"&&Cd(O.slice(0,B.maxInputLength),B))return Xa(O,B);return ld(O,B)}function t(O){return O.provenance==="command-substitution"?O.raw:O.text}function X(O,D){return O==="posix"?D:$t(D.map((B)=>B.text))}function zi(O,D){return O&&O.provenance!=="unknown"?O.provenance==="literal":!/[$`*?[\]]/.test(D)}function $t(O){return O.map((D)=>({kind:"word",text:D,raw:D,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Qa(O,D){return{value:O,work:D}}function bt(O,D){if(O.work)O.work.units=Math.min(Number.MAX_SAFE_INTEGER,O.work.units+1);return O.value[D]}function Ht(O){return O.value.length}function Po(O,D,B=1){if(O)O.units=Math.min(Number.MAX_SAFE_INTEGER,O.units+D.length*B)}function bn(O,D){Po(O,D)}function br(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=48&&D<=57||D>=65&&D<=90||D===95||D>=97&&D<=122}function zt(O){if(!O)return!1;let D=O.charCodeAt(0);return D===9||D===10||D===11||D===12||D===13||D===32||D===160||D===65279||D===5760||D>=8192&&D<=8202||D===8232||D===8233||D===8239||D===8287||D===12288}function el(O){return O===`
-`||O==="\r"||O==="\u2028"||O==="\u2029"}function Bt(O,D,B){if(D+B.length>Ht(O))return!1;for(let Q=0;Q<B.length;Q++)if(bt(O,D+Q)!==B[Q])return!1;return!0}function Un(O,D,B){return!br(bt(O,D-1))&&Bt(O,D,B)&&!br(bt(O,D+B.length))}function Hn(O,D){return br(bt(O,D-1))!==br(bt(O,D))}function Qt(O){return O===`
-`||O===";"||O==="&"||O==="|"}function jr(O){return O==="|"||O===";"}function Bi(O,D,B){let Q=Qa(O,B);if(D==="rm")return jb(Q);if(D==="dd")return Kb(Q);return Id(Q,!0)}function $i(O,D,B){let Q=Qa(O,B);if(D==="rm")return qb(Q);if(D==="reset-hard")return Ad(Q,"--ha","rd");if(D==="reset-merge")return Ad(Q,"--me","rge");if(D==="clean")return Jb(Q);if(D==="checkout")return eS(Q);if(D==="push-force")return tS(Q);if(D==="push-refspec")return nS(Q);if(D==="push-delete")return rS(Q);if(D==="branch")return oS(Q);if(D==="tag")return aS(Q);if(D==="restore")return lS(Q);return Id(Q,!1)}function jb(O){let D=!1,B=!1,Q=!1,ee=-1;for(let he=0;he<=Ht(O);he++){let je=bt(O,he);if(!D){let lt=bt(O,he+2);if(Un(O,he,"rm")&&zt(lt)&&lt!==`
-`)D=!0,he++;continue}let at=Vb(O,he);if(je===`
-`||at!==-1){if(D=!1,B=!1,Q=!1,ee=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===Ht(O)){if(ee>=0){let lt=_d(O,ee,he);B||=lt.recursive,Q||=lt.force}if(B&&Q)return!0;D=!1,B=!1,Q=!1,ee=-1;continue}if(zt(je)){if(ee<0)continue;if(Bt(O,ee,"--")&&he-ee===2){D=!1,B=!1,Q=!1,ee=-1;continue}let lt=_d(O,ee,he);if(B||=lt.recursive,Q||=lt.force,B&&Q)return!0;ee=-1;continue}if(ee<0)ee=he}return!1}function Vb(O,D){if(bt(O,D)!=="\\"||bt(O,D-1)==="\\")return-1;if(Bt(O,D,String.raw`\n`))return D+2;if(Bt(O,D,String.raw`\x0a`)||Bt(O,D,String.raw`\x0A`))return D+5;if(Bt(O,D,String.raw`\u000a`)||Bt(O,D,String.raw`\u000A`))return D+7;return Bt(O,D,String.raw`\012`)?D+4:-1}function _d(O,D,B){if(wd(O,D,B,"recursive"))return{recursive:!0,force:!1};if(wd(O,D,B,"force"))return{recursive:!1,force:!0};if(bt(O,D)!=="-"||bt(O,D+1)==="-")return{recursive:!1,force:!1};let Q=!1,ee=!1;for(let he=D+1;he<B;he++){let je=bt(O,he);Q||=je==="r"||je==="R",ee||=je==="f"||je==="F"}return{recursive:Q,force:ee}}function wd(O,D,B,Q){let ee=B-D-2;if(ee<1||ee>Q.length||!Bt(O,D,"--"))return!1;for(let he=0;he<ee;he++)if(bt(O,D+he+2)!==Q[he])return!1;return!0}function Kb(O){let D=!1;for(let B=0;B<Ht(O);B++){if(Qt(bt(O,B))){D=!1;continue}if(Un(O,B,"dd")){D=!0,B++;continue}if(!D||!Un(O,B,"of")||!Bt(O,B,"of=/dev/"))continue;let Q=B+8;if(Q<Ht(O)&&!zt(bt(O,Q))&&bt(O,Q)!=="'"&&bt(O,Q)!=='"')return!0}return!1}function qb(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);){let he=bt(O,ee);if(ee===Ht(O)||Qt(he)){D=!1,B=!1,Q=!1,ee++;continue}let je=Zb(O,ee);if(je>=0){if(Yb(O,je))return!0;let at=je,lt=!1;while(zt(bt(O,at)))lt||=bt(O,at)===`
-`,at++;if(lt)B=!1,Q=!1;D=!0,ee=at;continue}if(!D){ee++;continue}if(Bt(O,ee,"--")&&(ee===0||zt(bt(O,ee-1)))&&(!bt(O,ee+2)||zt(bt(O,ee+2))||Qt(bt(O,ee+2)))){D=!1,B=!1,Q=!1,ee+=2;continue}if(B||=Bt(O,ee,"--recursive")&&Hn(O,ee+11)||tl(O,ee,"recursive"),Q||=Bt(O,ee,"--force")&&Hn(O,ee+7)||tl(O,ee,"force"),B&&Q)return!0;ee++}return!1}function tl(O,D,B){if(!Bt(O,D,"--"))return!1;let Q=0;while(Q<=B.length){let ee=bt(O,D+Q+2);if(!ee||zt(ee)||Qt(ee))break;if(ee!==B[Q])return!1;Q++}return Q>0&&Hn(O,D+Q+2)}function Yb(O,D){let B=D,Q=!1,ee=!1;while(B<Ht(O)){while(zt(bt(O,B)))B++;let he=B;while(B<Ht(O)&&!zt(bt(O,B)))B++;if(bt(O,he)!=="-"||B-he===2&&Bt(O,he,"--"))return!1;let je=Pd(O,he,"recursive"),at=Pd(O,he,"force");if(Q&&at||ee&&je)return!0;if(Q||=je,ee||=at,bt(O,he+1)==="-")continue;let lt=Xb(O,he,B);if(lt.combined||Q&&lt.forceAtBoundary||ee&&lt.recursiveAtBoundary)return!0;Q||=lt.recursive,ee||=lt.force}return!1}function Pd(O,D,B){return Bt(O,D,`--${B}`)&&Hn(O,D+B.length+2)||tl(O,D,B)}function Zb(O,D){if(D>0&&br(bt(O,D-1)))return-1;let B=D;if(bt(O,B)==="\\")B++;if(bt(O,B)!=="r")return-1;if(B++,bt(O,B)==="\\")B++;if(bt(O,B)!=="m"||!zt(bt(O,B+1)))return-1;return B+1}function Xb(O,D,B){let Q=!1,ee=!1,he=!1,je=!1,at=!1;if(bt(O,D)!=="-")return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=D+1;ct<B;ct++){let ut=bt(O,ct)??"",ft=(ut==="r"||ut==="f")&&Hn(O,ct+1);Q||=ut==="r",ee||=ut==="f",he||=ut==="r"&&ft,je||=ut==="f"&&ft,at||=(lt==="r"&&ut==="f"||lt==="f"&&ut==="r")&&ft,lt=ut}return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function Ad(O,D,B){return To(O,"reset",jr,!0,(Q)=>bt(O,Q)==="-"&&Vr(O,Q,D,B)?!0:Q)}function Jb(O){return To(O,"clean",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(Vr(O,D,"--fo","rce"))return!0;let B=Ao(O,D,jr);for(let Q=D+1;Q<B;Q++)if(bt(O,Q)==="f")return!0;return B-1})}function Ui(O,D,B){if(!Un(O,D,"git"))return null;let Q=D+3;if(!zt(bt(O,Q)))return{commandEnd:-1,next:Q};while(zt(bt(O,Q)))Q++;while(Q<Ht(O)){if(Qt(bt(O,Q)))return{commandEnd:-1,next:Q};let ee=Ao(O,Q,Qt);if(Un(O,Q,B))return{commandEnd:Q+B.length,next:ee};if(bt(O,Q)!=="-")return{commandEnd:-1,next:ee};let he=ee-Q===2&&Bt(O,Q,"--"),je=Qb(O,Q,ee);Q=ee;while(zt(bt(O,Q)))Q++;if(he)return{commandEnd:Un(O,Q,B)?Q+B.length:-1,next:Ao(O,Q,Qt)};if(!je)continue;if(Q>=Ht(O)||Qt(bt(O,Q)))return{commandEnd:-1,next:Q};Q=Ao(O,Q,Qt);while(zt(bt(O,Q)))Q++}return{commandEnd:-1,next:Q}}function Qb(O,D,B){for(let Q of gn)if(B-D===Q.length&&Bt(O,D,Q))return!0;return!1}function eS(O){return Td(O,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function tS(O){return To(O,"push",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(bt(O,D+1)==="f"&&!br(bt(O,D+2))&&!Bt(O,D+2,"-with-lease"))return!0;let B=kd(O,D,"--fo","rce");if(B>=0&&!Bt(O,B,"-with-lease"))return!0;return D})}function nS(O){return To(O,"push",Qt,!1,(D)=>{if(zt(bt(O,D))&&bt(O,D+1)==="+"&&D+2<Ht(O)&&!Qt(bt(O,D+2))&&!zt(bt(O,D+2)))return!0;if(bt(O,D)===":"&&bt(O,D+1)==="+")return!0;return D})}function rS(O){return To(O,"push",Qt,!1,(D)=>{if(bt(O,D)==="-"&&Vr(O,D,"--de","lete"))return!0;if(zt(bt(O,D))&&bt(O,D+1)===":"&&D+2<Ht(O)&&!zt(bt(O,D+2))&&!Qt(bt(O,D+2)))return!0;return D})}function oS(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);ee++){if(ee===Ht(O)||Qt(bt(O,ee))){if(B&&Q)return!0;D=!1,B=!1,Q=!1;continue}if(!D){let at=Ui(O,ee,"branch");if(at){D=at.commandEnd>=0,ee=Math.max(ee,(D?at.commandEnd:at.next)-1);continue}}if(!D||bt(O,ee)!=="-")continue;let he=Ao(O,ee,Qt),je=iS(O,ee,he);if(B||=je.deletion,Q||=je.force,B&&Q)return!0;ee=he-1}return!1}function iS(O,D,B){let Q=!1,ee=!1;for(let he=D;he<B;he++){if(bt(O,he)!=="-")continue;if(Vr(O,he,"--de","lete"))Q=!0;if(Vr(O,he,"--fo","rce"))ee=!0;if(bt(O,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<B&&sS(bt(O,je))){let ut=bt(O,je);at||=ut==="d"||ut==="D",lt||=ut==="f",ct||=ut==="D",je++}if(!Hn(O,je))continue;Q||=at,ee||=lt||ct}return{deletion:Q,force:ee}}function sS(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=65&&D<=90||D>=97&&D<=122}function aS(O){return Td(O,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Td(O,D){let B=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=B[B.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&ee==="\\",!je&&ee==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&ee==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(ee==="$"&&bt(O,Q+1)==="("&&(B.length===1||!je&&he.quote!=="'")){B.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!je&&!he.quote&&B.length>1&&ee==="("){he.depth++;continue}if(!je&&!he.quote&&B.length>1&&ee===")"){if(he.depth--,he.depth===0)B.pop();continue}if(zt(ee))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=Ui(O,Q,D.command);if(at){he.outerActive=at.commandEnd>=0&&zt(bt(O,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,Q=Math.max(Q,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&ee==="-"){if(Vr(O,Q,D.longPrefix,D.longOptional))return!0;he.shortActive||=!D.excludedShortStarts.includes(bt(O,Q+1)??"")}if(he.hasShortFlag||=he.shortActive&&ee===D.shortFlag,he.hasShortFlag&&Hn(O,Q+1))return!0;if(jr(ee))he.outerActive=!1}return!1}function To(O,D,B,Q,ee){let he=!1;for(let je=0;je<Ht(O);je++){let at=bt(O,je),lt=B(at);if(!he&&!lt){let ct=Ui(O,je,D);if(ct){he=ct.commandEnd>=0&&(!Q||zt(bt(O,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=ee(je);if(ct===!0)return!0;for(let ut=je;ut<=ct;ut++)if(B(bt(O,ut)))he=!1;je=ct}if(lt)he=!1}return!1}function lS(O){let D=!1;for(let B=0;B<Ht(O);B++){if(el(bt(O,B))){if(D)return!0;D=!1;continue}if(!D){let Q=Ui(O,B,"restore");if(Q){D=Q.commandEnd>=0,B=Math.max(B,(D?Q.commandEnd:Q.next)-1);continue}}if(D&&bt(O,B)==="-"&&bt(O,B+1)==="-"&&(Bt(O,B+2,"staged")||Bt(O,B+2,"help")))D=!1}return D}function Id(O,D){let B=!1;for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=D?el(ee):Qt(ee);if(B&&zt(ee)&&bt(O,Q+1)==="-"&&Un(O,Q+2,"delete"))return!0;if(he){B=!1;continue}if(Un(O,Q,"find"))B=!0,Q+=3}return!1}function Ao(O,D,B){let Q=D;while(Q<Ht(O)&&!zt(bt(O,Q))&&!B(bt(O,Q)))Q++;return Q}function kd(O,D,B,Q){if(!Bt(O,D,B))return-1;let ee=D+B.length;for(let he=0;he<Q.length&&bt(O,ee)===Q[he];he++)ee++;return Hn(O,ee)?ee:-1}function Vr(O,D,B,Q){return kd(O,D,B,Q)>=0}function xn(O,D){Po(D,O,2);let B=O.toLowerCase(),Q=B.trimStart(),ee=Q.startsWith("echo ")||Q.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&ee)continue;let at=je.caseSensitive?O:B;if(je.regex)bn(D,at);if((je.regex?.test(at)??!1)||je.scan&&$i(at,je.scan,D))return St("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var cS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Md(O,D,B){let Q=O.words[0];if(!D||!Q||O.words.length!==1||O.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let ee=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!ee)return!1;Po(B,D.source,2);let he={anchored:new RegExp(`^\\$\\{?${ee}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ee}(?![A-Za-z0-9_])`)};return Dd(D.nodes,Q,he)}function Dd(O,D,B){return O.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return Dd(Q.body.nodes,D,B);if(Q.kind==="unknown")return!B.loose.test(Q.source);return uS(Q,D,B)})}function uS(O,D,B){if(O.nested.some((ee)=>B.loose.test(ee.source)))return!1;let Q=O.words.findIndex((ee)=>!cS.test(ee.text));return O.words.every((ee,he)=>ee===D||Od(ee.raw,B.anchored,he!==Q))&&O.redirections.every((ee)=>(!ee.heredoc||ee.heredoc.quotedDelimiter||!B.loose.test(ee.heredoc.body))&&(!ee.target||Od(ee.target.raw,B.anchored,!0)))}function Od(O,D,B){let Q=!1,ee=!1;for(let he=0;he<O.length;he++){let je=O[he];if(je==="\\"&&!Q){he++;continue}if(!ee&&je==="'"){Q=!Q;continue}if(!Q&&je==='"'){ee=!ee;continue}if(Q||je!=="$")continue;if(!D.test(O.slice(he)))continue;if(!ee||!B)return!1}return!0}import{isAbsolute as dS,resolve as Nd}from"node:path";function Io(O,D,B,Q){let ee=dS(O)?Nd(O):D?Nd(D,O):void 0;if(!ee)return;try{return Lt(ee,B,Q)}catch{return ee}}function Ld(O){return!["/dev","/proc","/sys"].some((D)=>O===D||O.startsWith(`${D}/`))}var Kr="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ko="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",rl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),fS=new Set(["-p","--print"]),mS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),pS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),gS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),hS=new Map([["python",new Set(["m"])]]),yS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),bS=new Set(["always","default","never"]),SS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),CS=/\\\r?\n/g,vS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Wd(O){return ji(O).code}function Hi(O){return ji(O).sources}function Gd(O){return vS.get(il(O))??[]}function ji(O){let D=il(O[0]??"");if(!rl.has(D))return{code:null,sources:[],optionsOpen:!1};let B=[],Q=[],ee=!0;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--")return Tn(D,B,Q,ee,O[he+1]===void 0?void 0:he+1,O[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return Tn(D,B,Q,ee,he,je);if(D==="node"&&fS.has(je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(ft.startsWith("-"))continue;B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(xS(D,je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),D==="python")return Tn(D,B,Q,ee);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(RS(D)&&at){let ft=at[1]??"";B.push({tokenIndex:he,value:ft}),Q.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(D==="node"){let ft=ES(je);if(ft){if(ft.attached){if(ee&&=ft.value!=="",ft.value!=="")Q.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let dt=O[he+1];if(dt===void 0||dt.startsWith("-"))return ee=!1,Tn(D,B,Q,ee);Q.push({tokenIndex:he+1,kind:"module-file",value:dt}),he++;continue}}if(D==="python"&&je.startsWith("--check-hash-based-pycs=")||D==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||D==="ruby"&&(je==="--disable="||je==="--enable="))return Tn(D,B,Q,ee);if(yS.get(D)?.has(je)){let ft=O[he+1];if(ft===void 0||ft.startsWith("-")&&!(D==="ruby"&&SS.has(je))||D==="python"&&!bS.has(ft))return Tn(D,B,Q,ee);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let dt=je[ft];if(dt===void 0)break;if(hS.get(D)?.has(dt)){let mt=je.slice(ft+1),pt=mt||O[he+1];if(pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return Tn(D,B,Q,ee)}if(mS.get(D)?.has(dt)){lt=je.slice(ft+1)||O[he+1],ct=ft+1===je.length;break}if(D==="node"&&dt==="r"){if(ee&&=je==="-r",je==="-r"){let mt=O[he+1];if(ee&&=mt!==void 0&&!mt.startsWith("-"),ee&&mt!==void 0)Q.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(D==="ruby"&&dt==="r"){let mt=je.slice(ft+1),pt=mt||O[he+1];if(ee&&=pt!==void 0,pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(D==="perl"&&(dt==="M"||dt==="m")){let mt=je.slice(ft+1);if(!mt){if(ee=!1,ft+1===je.length)he++;break}Q.push({tokenIndex:he,kind:"module-file",value:mt});break}if(pS.get(D)?.has(dt)){if(ft+1===je.length)he++;break}if(gS.get(D)?.has(dt)&&ft+1<je.length)break}if(lt===void 0)continue;let ut=ct?he+1:he;if(B.push({tokenIndex:ut,value:lt}),Q.push({tokenIndex:ut,kind:"inline-code",value:lt}),D==="python")return Tn(D,B,Q,ee);if(ct)he++}return Tn(D,B,Q,ee,void 0,void 0,!0)}function Tn(O,D,B,Q,ee,he,je=!1){let at=O==="node"?D.slice(-1):D,lt=new Set(at.map((ut)=>ut.tokenIndex)),ct=B.filter((ut)=>ut.kind!=="inline-code"||lt.has(ut.tokenIndex));if(Q&&D.length===0&&ee!==void 0&&he!==void 0)ct.push({tokenIndex:ee,kind:"main-script",value:he});return{code:(O==="node"?at[0]?.value:at.map((ut)=>ut.value).join(`
-`))||null,sources:Q?ct:[],optionsOpen:Q&&je}}function ES(O){for(let D of["--import","--loader","--experimental-loader","--require"]){if(O===D)return{attached:!1,value:""};if(O.startsWith(`${D}=`))return{attached:!0,value:O.slice(D.length+1)}}return}function ol(O,D){return il(O)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(D)}function il(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}function xS(O,D){return rl.get(O)?.has(D)??!1}function RS(O){return rl.get(O)?.has("--eval")??!1}function Oo(O,D,B=!1){let Q=PS(O,D);if(!nl(Q,D))return!1;bn(D,Q);let ee=wS(Q);if(nl(ee,D))return!0;if(bn(D,ee),!Fd.test(ee))return!1;return!B||_S(Q,D)}function _S(O,D){if(/`|%x|\bqx\b/.test(O))return!0;let B=O.split(""),Q=[];for(let je=0;je<O.length;je++){let at=O[je];if(at!=="'"&&at!=='"')continue;let lt=O.startsWith(at.repeat(3),je)?at.repeat(3):at,ct=je+lt.length,ut=ct;while(ut<O.length&&!O.startsWith(lt,ut))ut+=O[ut]==="\\"?2:1;if(ut>=O.length)return!0;Q.push({start:ct,text:O.slice(ct,ut)}),B.fill(" ",je,ut+lt.length),je=ut+lt.length-1}let ee=B.join(""),he=Array.from(ee.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((je)=>Fd.test(je[1]??"")).map((je)=>{let at=je.index+je[0].length;return{start:at,end:sl(ee,at)}});if(he.some((je)=>al(ee,je.start)))return!0;return Q.some((je)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(ee.slice(0,je.start))||he.some((at)=>je.start>=at.start&&je.start<at.end))&&nl(je.text,D))}function sl(O,D){let B=1;for(let Q=D;Q<O.length;Q++){if(O[Q]==="(")B++;if(O[Q]===")")B--;if(B===0)return Q}return O.length}function al(O,D){let B=0;for(let Q=D;Q<O.length;Q++){let ee=O[Q]??"";if("([{".includes(ee))B++;if(")]}".includes(ee)&&B--===0)return!1;if(ee===","&&B===0)return!1;if(/[A-Za-z_$]/.test(ee))return!0}return!1}var Fd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function wS(O){let D=[],B=0,Q=0;while(Q<O.length){let ee=O[Q];if(ee!=="'"&&ee!=='"'){Q++;continue}let he=O.startsWith(ee.repeat(3),Q)?ee.repeat(3):ee,je=Q+he.length;while(je<O.length&&!O.startsWith(he,je))je+=O[je]==="\\"?2:1;if(je>=O.length)break;D.push(O.slice(B,Q)," "),Q=je+he.length,B=Q}return D.push(O.slice(B)),D.join("")}function nl(O,D){if(Bi(O,"rm",D))return!0;for(let Q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(bn(D,O),Q.test(O))return!0;if(Bi(O,"dd",D))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(bn(D,O),Q.test(O))return!0;if(Bi(O,"find",D))return!0;let B=O.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>(bn(D,O),B.some((ee)=>$i(ee,Q))))}function PS(O,D){return bn(D,O),O.replace(CS,"")}import{isAbsolute as ff,relative as mf}from"node:path";import{isAbsolute as Vd,parse as WS}from"node:path";import{dirname as AS,isAbsolute as TS,parse as IS,sep as kS}from"node:path";function nr(O,D,B){if(Qn(D))throw Error("Unsupported Windows namespace path");let Q=TS(D)?IS(D).root:"",ee=Q||O;for(let he of MS(Q?D.slice(Q.length):D)){if(he===""||he===".")continue;if(he===".."){ee=AS(ee);continue}let je=OS(ee,he),at=B.entryKind(je),lt=at==="symlink"?B.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);ee=lt}return ee}function OS(O,D){return O.endsWith("/")||O.endsWith("\\")?`${O}${D}`:`${O}${kS}${D}`}function MS(O){let D=process.platform==="win32"?/[\\/]+/:/\/+/;return O.split(D)}var ll=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],DS=new Set(ll),NS=1024,zd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Bd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),LS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Vi(O){return DS.has(O)}function cl(O){return Vi(O)||zd.has(O)||Bd.has(O)||mo(O)}function jn(O,D,B){return B?.has(O)?B.get(O):D.get(O)}function $d(O,D){let B=jn("GIT_CONFIG_COUNT",O,D);if(B===void 0)return{state:"absent"};if(B==="")return{state:"valid",count:0};if(!/^\d+$/.test(B))return{state:"invalid"};let Q=Number(B);return Number.isSafeInteger(Q)&&Q<=NS?{state:"valid",count:Q}:{state:"invalid"}}function Ki(O,D,B){let ee=O.match(LS)?.[1];if(!ee||!cl(ee))return null;let he=O.indexOf("=");return{name:ee,value:`${jn(ee,D,B)??""}${O.slice(he+1)}`}}function Ud(O){return jd(O,Bd)}function Hd(O){return jd(O,zd)}function jd(O,D){if(!O)return!1;for(let B of O.keys())if(D.has(B))return!0;return!1}var qd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rn(O){if(!qd.test(O))return null;let D=O.indexOf("=");return{name:O.slice(0,D),value:O.slice(D+1)}}function ge(O){let D=new Map,B=0;while(B<O.length){let Q=O[B];if(!Q)break;let ee=Rn(t(Q));if(!ee)break;D.set(ee.name,ee.value),B++}return{words:O.slice(B),envAssignments:D}}function Yd(O){let D=O.toLowerCase();return O.includes("=")||D==="sudo"||D==="env"||D==="command"||D==="builtin"}function Sr(O,D,B,Q){if(!Yd(qr(O)))return{words:O,envAssignments:new Map,cwd:B,rewritten:!1};let ee=new Set(O),he=O,je=new Map,at=new Map(Q??[]),lt=[],ct=B;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let dt=Kd(he),mt=ge(he);for(let[gt,ht]of mt.envAssignments)je.set(gt,ht),at.set(gt,ht);if(he=mt.words,he.length===0)break;while(he.length>0&&qr(he).includes("=")&&!FS(he)){let gt=zS(qr(he),at,D.env)??Ki(qr(he),D.env,at);if(gt)je.set(gt.name,gt.value),at.set(gt.name,gt.value);he=he.slice(1)}if(he.length===0)break;let pt=qr(he).toLowerCase();if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let gt=$S(he,D.paths,ct);if(he=gt.words,gt.cwd!==void 0)ct=gt.cwd}if(pt==="env"){let gt=jS(he,ct,at,D);if(lt.push(...gt.envSplitValues??[]),he=gt.words,gt.cwd!==void 0)ct=gt.cwd;for(let[ht,yt]of gt.envAssignments)je.set(ht,yt),at.set(ht,yt)}if(pt==="command")he=VS(he);if(pt==="builtin")he=he.slice(In(he,1)==="--"?2:1);if(Kd(he)===dt)break}let ut=ge(he);for(let[ft,dt]of ut.envAssignments)je.set(ft,dt),at.set(ft,dt);return{words:ut.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:GS(ut.words,ee)}}function GS(O,D){return O.some((B)=>!D.has(B))}function Kd(O){return O.map(t).join(" ")}function qr(O){let D=O[0];return D?t(D):""}function In(O,D){let B=O[D];return B?t(B):void 0}function FS(O){return qd.test(qr(O))}function zS(O,D,B){if(!O.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${D.get("TMPDIR")??B.get("TMPDIR")??""}${O.slice(8)}`}}var BS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function $S(O,D,B){let Q=1,ee=B;while(Q<O.length){let he=In(O,Q);if(!he)break;if(he==="--")return{words:O.slice(Q+1),cwd:ee};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=In(O,Q+1);ee=je?Mo(ee,je,D):null,Q+=2;continue}if(he.startsWith("--chdir=")){ee=Mo(ee,he.slice(8),D),Q++;continue}if(he.startsWith("-D")&&he.length>2){ee=Mo(ee,he.slice(2),D),Q++;continue}if(he==="-i"||he==="--login"){ee=null,Q++;continue}if(BS.has(he)){Q+=2;continue}Q++}return{words:O.slice(Q),cwd:ee}}var US=new Set(["-i","-0","--null"]),HS=new Set(["-u","--unset","-C","--chdir","-P"]);function jS(O,D,B,Q){let ee=new Map,he=[],je=D,at=1,lt=(ct)=>({words:O.slice(ct),envAssignments:ee,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<O.length){let ct=In(O,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){ee.clear();for(let ft of B.keys())ee.set(ft,"");ee.set("TMPDIR",""),at++;continue}if(US.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=In(O,at+1);if(ft!==void 0)ee.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){ee.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){ee.set(ct.slice(8),""),at++;continue}let ut=ct==="-S"||ct==="--split-string"?{value:In(O,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(ut){if(ut.value!==void 0)he.push(ut.value);return je=null,lt(at+ut.consumed)}if(HS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=In(O,at+1);je=ft?Mo(je,ft,Q.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=Mo(je,ft,Q.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!Rn(ct))break;while(at<O.length){let ft=Rn(In(O,at)??"");if(!ft)break;ee.set(ft.name,ft.value),at++}if(In(O,at)==="--")at++;return lt(at)}return lt(at)}function Mo(O,D,B){if(D==="")return null;if(!O&&!Vd(D))return null;let Q=Vd(D)?WS(D).root:B.realpath(O??"/");if(Q===null)return null;try{return nr(Q,D,B)}catch{return null}}function VS(O){if(In(O,1)==="-v")return[...$t(["type"]),...O.slice(2)];let D=1;while(D<O.length){let B=In(O,D);if(!B)break;if(B==="-p"||B==="-v"||B==="-V"){D++;continue}if(B==="--")return O.slice(D+1);if(B.startsWith("-")&&!B.startsWith("--")&&B.length>1){if(!/^[pvV]+$/.test(B.slice(1)))break;D++;continue}break}return O.slice(D)}var KS=/['"\\$`{}#]/;function qi(O,D){if(O.some((Q)=>KS.test(Q)))return null;let B=[...O.flatMap((Q)=>Q.split(/\s+/).filter((ee)=>ee.length>0)),...D];return B.length<=64?B:null}function rr(O,D,B){return Yi(O,D,B).tokens}function qS(O){let D=[],B="",Q=0;while(Q<O.length){let ee=O.charAt(Q);if(ee==='"'||ee==="'"){let he=O.indexOf(ee,Q+1);if(he===-1)return O.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);B+=O.slice(Q+1,he),Q=he+1;continue}if(/\s/.test(ee)){if(B.length>0)D.push(B);B="",Q++;continue}B+=ee,Q++}if(B.length>0)D.push(B);return D}function Cr(O,D,B,Q=0){let ee=Yi(O,D,B),he=(ee.envSplitValues??[]).flatMap(qS);if(he.length===0)return ee.tokens;let je=[...he,...ee.tokens];if(Q>=8)return je;return Cr(je,D,B,Q+1)}function Yi(O,D,B,Q){if(!Yd(O[0]??""))return{tokens:[...O],envAssignments:new Map,cwd:B};let ee=Sr($t(O),D,B,Q);return{tokens:ee.words.map(t),envAssignments:ee.envAssignments,cwd:ee.cwd,envSplitValues:ee.envSplitValues}}var ml=Symbol("adopt-as-operand"),YS=new Set(["env","sudo","command","builtin"]),ZS=new Set(["&&","||","|&","|","&",";"]),XS=new Set(["<<","<<<",">|"]),JS=new Set(["|","|&"]),QS=/[*@#?$!_-]/,eC=/^\w+(?::\w+)*/,tC=Object.freeze([]),Do=Object.freeze({kind:"scope",edge:"enter"}),No=Object.freeze({kind:"scope",edge:"exit"}),nC=Object.freeze([]),rC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Lo=new Set(["bash","sh","zsh","dash","ksh"]),oC=256,ef=new WeakMap;function tf(O,D){let B=D.status==="complete"?new Set(fl(D)):new Set,Q=aC(O,B);if(Si(Q))return Zi("unclosed-quote",Q,D);let ee={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=vr(D,{source:Q,suppressed:B,flags:ee,depth:0,functions:new Map,powershell:D.dialect==="powershell"});if(ee.limited)return Zi("structural-limit",Q,D);if(ee.invalid)return Zi("invalid",Q,D);let je=Zi("complete",Q,D,ee.assignmentFallbacks);return ef.set(je,Object.freeze(he)),je}function Ji(O,D,B,Q,ee){let he=ee.word??((ft)=>ft),je={cwd:D,variables:new Map,previous:null},at=[],lt=new Set,ct=null,ut=[];for(let ft of nf(O)){if(ft.kind==="scope"){if(ft.edge==="enter"){ut.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let dt=ee.segment(at,je,ct,null,lt);if(dt)return dt;let mt=ut.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let dt=ee.segment(at,je,ct,ft.operator,lt);if(dt)return dt;je=iC(at,je,B,Q),ct=at.length>0&&JS.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let dt=ee.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(dt===ml){lt.add(at.length),at.push(he(ft.target));continue}if(dt)return dt;continue}at.push(he(ft.text))}return ee.segment(at,je,ct,null,lt)}function Qi(O){return nf(O).flatMap((D)=>{if(D.kind==="word")return[{kind:"word",text:D.text}];if(D.kind==="operator")return[{kind:"operator",boundary:D.boundary}];if(D.kind==="redirection")return[{kind:"redirection",target:D.target}];return[]})}function cn(O,D){return O.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(B,Q,ee,he)=>{let je=D.get(Q);if(je===void 0)return B;let at=ee.startsWith(":")?je!=="":!0;if(ee.endsWith("-"))return at?je:cn(he,D);return at?cn(he,D):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(B,Q)=>D.get(Q)??B).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(B,Q)=>D.get(Q)??B)}function Wo(O){return O.length>0&&O.every((D)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(D))}function iC(O,D,B,Q){let ee=Wo(O)?new Map([...D.variables,...sC(O,D.variables)]):D.variables,he=rr([...O],B),je=Tt(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...D,variables:ee};if(je==="-"){if(D.previous===null)return{...D,variables:ee};return{cwd:D.previous,variables:ee,previous:D.cwd}}return{cwd:tn(cn(je,ee),D.cwd,B,Q),variables:ee,previous:D.cwd}}function sC(O,D){return O.flatMap((B)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(B),ee=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&ee!==void 0?[[Q[1],cn(ee,D)]]:[]})}function nf(O){return ef.get(O)??tC}function aC(O,D){return[...D].reduce((B,Q)=>B.slice(0,Q.start)+" ".repeat(Q.end-Q.start)+B.slice(Q.end),O)}function Zi(O,D,B,Q=nC){return Object.freeze({status:O,source:D,program:B,assignmentFallbacks:Object.freeze(Q)})}function vr(O,D){return O.nodes.flatMap((B,Q)=>lC(B,O,Q,D)).sort((B,Q)=>B.start-Q.start).flatMap((B)=>[...B.events])}function lC(O,D,B,Q){if(O.kind==="connector")return[{start:O.span.start,events:[kn(mC(O.operator))]}];if(O.kind==="unknown")return[{start:O.span.start,events:[kn(O.source)]}];if(O.kind==="function")return Q.functions.set(O.name,O.body),[];if(O.kind==="group"){let he=O.style!=="subshell",je=Q.source[O.span.end-1]===(he?"}":")"),at=he?Q:{...Q,functions:new Map(Q.functions)};return[{start:O.span.start,events:he?[Xi("{"),...vr(O.body,at),...je?[Xi("}")]:[]]:[Do,kn("("),...vr(O.body,at),...je?[kn(")")]:[],No]}]}let ee=yC(O,Q.functions);if(ee){if(Q.depth>=tr.maxDepth||++Q.flags.expansions>oC)return Q.flags.limited=!0,[];return[{start:O.span.start,events:[...Zd(O,Q),Xi(";"),...vr(ee,{...Q,depth:Q.depth+1}),Xi(";")]},...Xd(O,D,B,Q)]}return[{start:O.span.start,events:Zd(O,Q)},...Xd(O,D,B,Q)]}function Zd(O,D){return[...O.words.map((B)=>({start:B.span.start,events:of(B,O,D,!1)})),...O.redirections.map((B)=>({start:B.span.start,events:cC(B,O,D)}))].sort((B,Q)=>B.start-Q.start).flatMap((B)=>B.events)}function cC(O,D,B){let Q=O.operator==="<<-"?"<<":O.operator,ee=O.target?of(O.target,D,B,!0):[],he=ee[0],je=he?.kind==="word"?he.text:void 0;return[...O.fd===void 0?[]:[pl(String(O.fd))],Object.freeze({kind:"redirection",operator:Q,...O.fd===void 0?{}:{fd:O.fd},role:pC(Q),targetOrder:XS.has(Q)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...O.heredoc&&B.suppressed.has(O.heredoc.bodySpan)?{body:O.heredoc.body,consumer:af(D)}:{}}),...je===void 0?ee:ee.slice(1)]}function Xd(O,D,B,Q){let ee=O.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...ee.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[pl(je.delimiter),.../[\r\n]/.test(Q.source[je.terminatorSpan.end]??"")?[kn(";")]:[]];if(Q.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...rf(Q.source.slice(je.bodySpan.start,je.bodySpan.end),Q),...at]}]}),...ee.some((he)=>!he.heredoc&&he.target)?uC(D,B,Q):[]]}function uC(O,D,B){let Q=O.nodes.slice(D+1).find((ee)=>ee.kind==="connector");if(!Q||Q.span.end>=O.span.end)return[];return[{start:Q.span.end,events:rf(B.source.slice(Q.span.end,O.span.end),B)}]}function rf(O,D){if(D.depth>=tr.maxDepth)return D.flags.limited=!0,[];let B=h(O,"posix");if(B.status==="limited")return D.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:D.flags.expansions,assignmentFallbacks:D.flags.assignmentFallbacks},ee=vr(B,{source:O,suppressed:new Set,flags:Q,depth:D.depth+1,functions:new Map,powershell:!1});return D.flags.limited||=Q.limited,D.flags.expansions=Q.expansions,ee}function of(O,D,B,Q){let ee=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!Q?kn("glob"):je!==""||O.quoted&&ee.length===0?pl(je):void 0;if(ct)ee.push(ct);je="",at=!1};for(let ct of O.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of ul(ct.raw,he,B.flags,B.powershell)){if(typeof mt==="string"){lt(),ee.push(kn(mt));continue}je+=mt.text,at||=mt.glob}continue}let ut=D.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=B.source.slice(ct.span.start,ct.span.end);je+=ul(mt,{single:!1,double:!0},B.flags,B.powershell).map((gt)=>typeof gt==="string"?gt:gt.text).join("");let pt=ut?vr(ut,B).filter((gt)=>gt.kind==="redirection"&&gt.body!==void 0):[];if(pt.length>0)ee.push(Do,...pt,No);continue}let ft=ut?vr(ut,B):[];if(ct.raw.startsWith("`")){je+="${}",lt(),ee.push(Do,...ft,No);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),ee.push(ct.raw.startsWith("<(")?kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Do,...ft,...ct.raw.endsWith(")")?[kn(")")]:[],No);continue}let dt=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),ee.push(...Array.from({length:dt},()=>kn("(")),...dt===1?[Do]:[],...ft,...ct.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>kn(")")):[],...dt===1?[No]:[])}return lt(),ee}function ul(O,D,B,Q){let ee=[],he="",je=!1,at=0;while(at<O.length){let lt=O[at]??"";if(!D.single&&!D.double&&(lt==="("||lt===")")){ee.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(Q&&lt==="`"&&!D.single){he+=O[at+1]??"",at+=2;continue}if(D.single&&lt==="'"){D.single=!1,at++;continue}if(D.single){he+=lt,at++;continue}if(D.double){if(lt==='"'){D.double=!1,at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=Jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){D.single=lt==="'",D.double=lt==='"',at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=Jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...ee,{text:he,glob:je}]}function Jd(O,D,B,Q,ee){let he=O[D+1];if(he==="{"){let at=fC(O,D+2);if(at===-1)return Q.invalid=!0,{text:"",next:O.length};let lt=O.slice(D,at+1);return dC(lt,B,Q,ee),{text:lt,next:at+1}}if(he!==void 0&&QS.test(he))return{text:`\${${he}}`,next:D+2};let je=(ee?eC:/^\w*/).exec(O.slice(D+1))?.[0]??"";return{text:`\${${je}}`,next:D+1+je.length}}function dC(O,D,B,Q){let ee=O.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ee)?.[0];if(!he)return;let je=ee.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=ul(je.slice(at.length),{...D},B,Q);B.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function fC(O,D){let B=1,Q=D;while(B>0&&Q<O.length){if(O[Q]==="{"&&O[Q-1]==="$")B++;if(O[Q]==="}")B--;Q++}return B===0?Q-1:-1}function mC(O){return/^[\r\n]+$/.test(O)?";":O}function kn(O){return Object.freeze({kind:"operator",operator:O,boundary:ZS.has(O)})}function Xi(O){return Object.freeze({kind:"operator",operator:O,boundary:!0})}function pl(O){return Object.freeze({kind:"word",text:O})}function pC(O){if(O==="<<"||O==="<<<")return"here-data";if(O==="<"||O==="<&")return"file-read";return"file-write"}function Go(O){return rC.has(O)||/^python\d/.test(O)}var gC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function sf(O,D){let B=D[0];if(B===void 0||!B.startsWith("-"))return D;let Q=gC.get(O)?.has(B)??!1;return sf(O,D.slice(Q?2:1))}function dl(O){let D=O[0];if(D===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D))return dl(O.slice(1));if(!YS.has(D))return[...O];return dl(sf(D,O.slice(1)))}function af(O){let D=Ro(O),B=O.words.findIndex((Q)=>Q.provenance==="literal"&&Q.text===D);return dl(B<0?[]:O.words.slice(B).map((Q)=>Q.text))}function hC(O){let D=af(O)[0];if(D===void 0)return!1;let B=Tt(D).toLowerCase();return Go(B)&&!Lo.has(B)}function fl(O){return O.nodes.flatMap((D,B)=>{if(D.kind==="group"||D.kind==="function")return fl(D.body);if(D.kind!=="command")return[];let Q=D.nested.flatMap((at)=>fl(at)),ee=D.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(hC(D))return[...Q,...ee];let he=O.nodes[B+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!SC(D))return Q;return[...Q,...ee]})}function yC(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function or(O,D){return O!==void 0&&O.provenance==="literal"&&!O.quoted&&O.raw===O.text&&O.text===D}function bC(O){if(or(O.words[0],"git"))return or(O.words[1],"commit");if(!or(O.words[0],"gh")||!or(O.words[2],"create"))return!1;return or(O.words[1],"pr")||or(O.words[1],"issue")}function SC(O){return(or(O.words[0],"cat")||or(O.words[0],"tee")||bC(O))&&!O.words.some(Qd)&&!O.redirections.some((B)=>Qd(B.target))}function Qd(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}var lf=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),cf=new Set([...lf,"glob"]),CC=new Set([...cf,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Fo(O){let D=vC(),B=ne(O.input),Q=[];if((O.route.kind==="command"||O.route.kind==="unknown")&&B)Q.push({usage:"input-candidate",source:B});if(O.route.kind==="command"&&"command"in O&&O.command)Q.push({usage:"declared-command",source:O.command});let ee=Q.reduce((he,je)=>{let at=he.findIndex((ut)=>ut.source===je.source);if(at!==-1){let ut=he[at];if(!ut)return he;return he[at]={...ut,usages:[...ut.usages,je.usage]},he}let lt=O.route.kind==="command"?O.route.shell:process.platform==="win32"?"powershell":"posix",ct=D.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:D.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:O.toolName,route:O.route,context:O.context},commands:ee,paths:EC(O),store:D}}function un(O,D){return O.commands.find((B)=>B.usages.includes(D))}function Vn(O,D){if(!O.includes("$"))return O;return Zs(O,D)}function vC(){let O=new Map,D=new Map,B=new WeakMap,Q=(he,je)=>{let at=`${je}\x00${he}`,lt=D.get(at);if(lt)return lt;let ct=h(he,je);return D.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??Q(he,"posix");if(at.status==="limited"){let ut=B.get(at);if(ut)return ut;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return B.set(at,ft),ft}let lt=O.get(he);if(lt)return lt;let ct=tf(he,at);return O.set(he,ct),ct},getCommandProgram:Q}}function EC(O){let D=O.route.kind==="grep"?cf:O.route.kind==="glob"?CC:lf;return[...Kc(O.input,D),...O.route.kind==="patch"?Zc(O.input):[]]}var xC=new Set(["-S","--suffix"]);function Yr(O,D,B,Q,ee){if(O.status==="structural-limit")throw new y;if(O.status!=="complete")return ee.findMalformedTarget(O.source);return Ji(O,D,B,Q,{segment:(he,je)=>ee.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&ee.isRedirectionTarget(cn(he.target,je.variables),je)?he.target:null})}function es(O){let D=[],B=null,Q=!1;for(let ee=0;ee<O.length;ee++){let he=O[ee];if(he===void 0)break;if(!Q&&he==="--"){Q=!0;continue}if(!Q&&(he==="-t"||he==="--target-directory")){B=O[++ee]??null;continue}if(!Q&&he.startsWith("--target-directory=")){B=he.slice(19);continue}if(!Q&&he.startsWith("-t")&&he.length>2){B=he.slice(2);continue}if(!Q&&xC.has(he)){ee++;continue}if(!Q&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!Q&&he.startsWith("-"))continue;D.push(he)}return B?{sources:D,destination:B}:{sources:D.slice(0,-1),destination:D.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function pf(O,D,B,Q){let ee=O.invocation.context.executionCwd;if(!D)return null;if(O.invocation.route.kind==="patch"||O.invocation.route.kind==="path"||O.invocation.route.kind==="unknown"){if(ui(O.invocation.toolName))return null;let at=O.paths.find((lt)=>uf(lt,ee,D,B,Q,D.entries));return at?{target:at}:null}if(O.invocation.route.kind!=="command")return null;let he=un(O,"input-candidate");if(!he)return null;let je=Yr(he.shell,ee,B,Q,{findSegmentTarget:(at,lt)=>PC(at,lt,D,B,Q),isRedirectionTarget:(at,lt)=>uf(at,lt.cwd,D,B,Q,D.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Er(O,D,B,Q,ee,he,je=!1){if(!B)return!1;let at=ns(tn(O,D,ee,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(gl(lt,B))return!0;let ct=je||at.slice(lt.length).includes("/."),ut=(ft)=>ct?ts(ft,lt):RC(ft,lt);if(B.markerFiles.some(ut))return!0;return Q&&df(B).some(ut)}if(gl(at,B))return!0;return Q&&df(B).some((ct)=>ts(ct,at))}function RC(O,D){let B=mf(D,O);if(B===""||B.startsWith("..")||ff(B))return!1;return!B.split(/[\\/]/)[0]?.startsWith(".")}function _C(O,D,B,Q,ee){return Er(O,D,B,!0,Q,ee)}function wC(O,D,B,Q,ee){if(!B)return!1;return gl(ns(tn(O,D,Q,ee)),B)}function uf(O,D,B,Q,ee,he){let je=ns(tn(O,D,Q,ee));return he.includes(je)||hf(je,B)}function gf(O,D,B,Q,ee){if(!B)return!1;return B.hooksDirectories.some((he)=>O.some((je)=>ts(he,ns(tn(je,D,Q,ee)))))}function gl(O,D){return D.entries.includes(O)||D.directories.includes(O)||hf(O,D)}function hf(O,D){return D.hooksDirectories.some((B)=>ts(O,B))}function df(O){return[...O.entries,...O.directories,...O.hooksDirectories]}function ts(O,D){let B=mf(D,O);return B===""||!/^\.\.(?:[\\/]|$)/.test(B)&&!ff(B)}function ns(O){return process.platform==="win32"?O.toLowerCase():O}function PC(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q);if(Tt(he[0]??"").toLowerCase()!=="mv")return null;let je=es(he.slice(1)),at=je.sources.find((lt)=>_C(cn(lt,D.variables),D.cwd,B,Q,ee));if(at)return at;return je.destination&&wC(cn(je.destination,D.variables),D.cwd,B,Q,ee)?je.destination:null}import{isAbsolute as as,normalize as NC,parse as LC,posix as Rf,resolve as Rr,sep as Sl}from"node:path";import{isAbsolute as AC,join as yf,normalize as Cf,parse as TC,sep as bf}from"node:path";var IC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],kC=` 	
-`;function zo(O,D){if(ir(O,D))return!0;if(!O.has("TMPDIR"))return!1;return!hl(O.get("TMPDIR")??"",D)}function xr(O,D){if(O.has("TMPDIR"))return hl(O.get("TMPDIR")??"",D);let B=yl(O,D);if(B===void 0)return!0;return hl(B,D)}function yl(O,D){return Ef(O,D,"TMPDIR")}function hl(O,D){if(!O)return!1;if(MC(O))return!1;return Zr(O,D)}function ir(O,D){let B=Ef(O,D,"IFS");return B!==void 0&&B!==""&&B!==kC}function Zr(O,D){let B=rs(O,D.paths);if(B===null)return!1;return vf(D).some((Q)=>ss(B,Q))}function is(O,D){let B=rs(O,D.paths);if(B===null)return!1;return vf(D).some((Q)=>os(Q)===os(B))}var Sf=new WeakMap;function vf(O){let D=Sf.get(O);if(D)return D;let B=OC(O);return Sf.set(O,B),B}function OC(O){let D=IC.map((Q)=>rs(Q,O.paths)??Cf(Q)),B=rs(O.tmpdir,O.paths);if(!B)return D;if(process.platform==="win32")return[...D,B];if(process.platform==="darwin"&&DC(B))return[...D,B];return D}function MC(O){return/[\s$`*?[]/.test(O)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(O)||/[+@!]\([^)]*\)/.test(O)}function Ef(O,D,B){return O.has(B)?O.get(B):D.env.get(B)}function DC(O){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(O)}function rs(O,D){try{let B=Cf(O);if(!AC(B))return B;let Q=TC(B).root,ee=B.slice(Q.length).split(/[\\/]+/).filter(Boolean),he=Q;for(let je=0;je<ee.length;je++){let at=yf(he,ee[je]??"");if(D.entryKind(at)==="missing")return yf(at,...ee.slice(je+1));let lt=D.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function ss(O,D){let B=os(O),Q=os(D);if(B===Q)return!0;let ee=Q.endsWith(bf)?Q:`${Q}${bf}`;return B.startsWith(ee)}function os(O){return process.platform==="win32"?O.toLowerCase():O}var WC=process.platform==="win32",xf=64,GC=16384;function Bo(O,D,B,Q){if(O.kind==="temp_target")return null;let ee=Q[O.kind];if(O.kind==="dynamic_target"&&!Jt(B,ee.id,D.strict))return null;if(O.kind==="within_anchored_cwd"&&!Jt(B,ee.id,D.paranoid))return null;return St(ee.id,ee.reason)}function $o(O){let D=md(O,xf,xf,GC);return{expandedTargets:D&&"words"in D?D.words:void 0,unsafeBraceExpansion:D!==void 0&&"limited"in D,targetIsLiteral:D===void 0&&O.provenance==="literal"&&(O.quoted||O.raw!==O.text),tmpdirWordSplittingProtected:FC(O)}}function FC(O){let D=O.parts.filter((B)=>B.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(B.raw));return D.length>0&&D.every((B)=>zC(O.raw,B.span.start-O.span.start))}function zC(O,D){let B=null,Q=!1;for(let ee=0;ee<D;ee++){let he=O[ee];if(Q){Q=!1;continue}if(he==="\\"&&B!=="'"){Q=!0;continue}if(B===he){B=null;continue}if(B===null&&(he==="'"||he==='"'))B=he}return B==='"'}function _r(O){let D=O.environment.home,B=O.environment.paths,Q=O.budget??mn();return{anchoredCwd:O.originalCwd??O.cwd??null,resolvedCwd:O.cwd??null,strict:O.strict??!1,paranoid:O.paranoid??!1,trustTmpdirVar:O.allowTmpdirVar??!0,posixShell:O.posixShell??!1,tmpdirWordSplittingUnsafe:O.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:O.trustedTmpdirValue??O.allowTmpdirVar??!0,environment:O.environment,allowRoots:VC(O.allowPaths,D,B,Q),protectedGitMetadata:O.protectedGitMetadata,budget:Q}}function On(O,D,B={}){let Q=B.targetIsLiteral??!1;if(!Q&&D.tmpdirWordSplittingUnsafe&&!B.tmpdirWordSplittingProtected&&qC(O))return{kind:"outside_anchored_cwd"};let ee=!Q&&wf(O,D.posixShell);if(Qn(O))return{kind:"outside_anchored_cwd"};if(Cl(O,Q))return{kind:"root_or_home_target"};if($C(O,D,Q))return{kind:"root_or_home_target"};if(D.resolvedCwd&&Er(O,D.resolvedCwd,D.protectedGitMetadata,!0,D.environment,D.budget,!D.posixShell))return{kind:"git_metadata_target"};if(UC(O,D.trustTmpdirVar,D.posixShell,ee,Q,B.tmpdirWordSplittingProtected??!1,D.trustedTmpdirValue,D.environment))return{kind:"temp_target"};if(ee)return{kind:"dynamic_target"};if(KC(O,D,Q))return{kind:"temp_target"};let he=D.anchoredCwd;if(he){if(!B.skipHomeCwd&&JC(he,D.environment.home,D.environment.paths,D.budget))return{kind:"home_cwd_target"};if(!B.skipCwdSelf&&[D.resolvedCwd??he,he].some((je)=>QC(O,D.resolvedCwd??he,D.environment.paths,D.budget,je)))return{kind:"cwd_self_target"};if(ev(O,he,D.resolvedCwd??he,ee,Q,D.environment.paths,D.budget))return{kind:"within_anchored_cwd"}}if(BC(O,D,ee))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function BC(O,D,B){let Q=O.trim();if(B||!D.resolvedCwd||!D.anchoredCwd||!Q)return!1;if(as(Q)||Q.startsWith("~"))return!1;if(vl(Q))return!1;if(Pf(D.resolvedCwd,D.anchoredCwd,D.environment.paths,D.budget))return!1;return Zr(Rr(D.resolvedCwd,Q),D.environment)}function _f(O,D,B={}){let{containmentTarget:Q,...ee}=B;if(On(O,D,ee).kind!=="temp_target")return!1;let he=O.trim();if(jC(he))return!1;if(is(he,D.environment))return!1;return![D.anchoredCwd,D.resolvedCwd].some((je)=>Pf(Q??he,je,D.environment.paths,D.budget))}function Cl(O,D=!1){let B=O.trim(),Q=Rf.normalize(B),ee=B.replace(/\\/g,"/"),he=Q==="/"?Q:Q.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ee)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ee))return!0;if(!D&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!D&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!D&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function $C(O,D,B){let Q=O.trim(),ee=B?Q:Q==="*"?".":Q.endsWith("/*")?Q.slice(0,-2):Q;if(!ee)return!1;try{let he=as(ee)?ee:D.resolvedCwd?Rr(D.resolvedCwd,ee):null;if(!he)return!1;let je=dn(Lt(he,D.environment.paths,D.budget));if(je===LC(je).root)return!0;return je===dn(Lt(D.environment.home,D.environment.paths,D.budget))}catch{return!1}}function dn(O){let D=NC(O);if(WC){if(D=D.replace(/\//g,"\\").toLowerCase(),D.length>3&&D.endsWith("\\"))D=D.slice(0,-1);return D}if(D.length>1&&D.endsWith("/"))D=D.slice(0,-1);return D}function UC(O,D,B,Q,ee,he,je,at){let lt=O.trim();if(vl(lt))return!1;if(!Q&&Zr(lt,at))return!0;return(D||he&&je)&&B&&!ee&&HC(lt,B)}function HC(O,D){return["$TMPDIR","${TMPDIR}"].some((B)=>{if(O===B)return!0;if(!O.startsWith(`${B}/`))return!1;return!wf(O.slice(B.length+1),D)})}function jC(O){let D=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(O);if(!D)return!1;return Rf.normalize(`/${D[1]??""}`)==="/"}function vl(O){return O.split(/[\\/]+/).includes("..")}function VC(O,D,B,Q){if(!O?.length)return[];return O.flatMap((ee)=>{let he=vo(ee.trim(),D);if(!as(he))return[];try{let je=Lt(he,B,Q);if(Eo(je,Lt(D,B,Q)))return[];return[dn(je)]}catch{return[]}})}function KC(O,D,B){if(D.allowRoots.length===0)return!1;let Q=O.trim();if(vl(Q))return!1;let ee=B?Q:vo(Q,D.environment.home),he=D.resolvedCwd??D.anchoredCwd,je=as(ee)?ee:he?Rr(he,ee):null;if(!je)return!1;try{let at=dn(Lt(je,D.environment.paths,D.budget));return D.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(Sl)?lt:`${lt}${Sl}`))}catch{return!1}}function qC(O){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(O)}function wf(O,D=!1){return O.includes("$")||O.includes("`")||YC(O)||D&&ZC(O)}function YC(O){let D=!1;for(let B of O){if(D){D=!1;continue}if(B==="\\"){D=!0;continue}if(B==="*"||B==="?"||B==="[")return!0}return!1}function ZC(O){let D=!1;for(let B=0;B<O.length;B++){let Q=O[B];if(D){D=!1;continue}if(Q==="\\"){D=!0;continue}if(Q==="{"&&XC(O,B)||(Q==="+"||Q==="@"||Q==="!")&&O[B+1]==="(")return!0}return!1}function XC(O,D){let B=O.indexOf("}",D+1);if(B===-1)return!1;let Q=O.slice(D+1,B);return Q.includes(",")||Q.includes("..")}function JC(O,D,B,Q){try{return dn(Lt(O,B,Q))===dn(Lt(D,B,Q))}catch{try{return dn(O)===dn(D)}catch{return!1}}}function QC(O,D,B,Q,ee=D){if(ee===D&&(O==="."||O==="./"||O===".\\"))return!0;try{return dn(Lt(Rr(D,O),B,Q))===dn(Lt(ee,B,Q))}catch{try{return dn(Rr(D,O))===dn(ee)}catch{return!1}}}function ev(O,D,B,Q,ee,he,je){let at=B??D;if(!ee&&(O.startsWith("~")||O.startsWith("$HOME")||O.startsWith("${HOME}")))return!1;if(Q)return!1;if(O.startsWith("/")||/^[A-Za-z]:[\\/]/.test(O))try{return bl(O,D,he,je)}catch{return!1}if(O.startsWith("./")||O.startsWith(".\\")||!O.includes("/")&&!O.includes("\\"))try{return bl(Rr(at,O),D,he,je)}catch{return!1}if(O.startsWith("../"))return!1;try{return bl(Rr(at,O),D,he,je)}catch{return!1}}function bl(O,D,B,Q){try{return Af(Lt(O,B,Q),Lt(D,B,Q))}catch{return!1}}function Pf(O,D,B,Q){if(!D)return!1;try{return Af(Lt(D,B,Q),Lt(O,B,Q))}catch{return!0}}function Af(O,D){let B=dn(O),Q=dn(D);return B.startsWith(`${Q}${Sl}`)||B===Q}var tv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Tf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",If="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",kf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",rv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",ov="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",iv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:kf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:If},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:rv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Tf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:nv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Tf}};function Of(O,D,B,Q=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths})){return sv(O.words.map((ee)=>({kind:"word",text:ee.text,dynamic:ee.provenance!=="literal"})),D,Q,B.policy)}function sv(O,D,B,Q){let ee=O.filter((lt)=>lt.kind==="word"),he=lv(ee),je=ee[he];if(!je||!tv.has(yv(je.text)))return null;let at=av(ee.slice(he+1));if(at.whatIfProtected)return null;if(Jt(Q,"powershell.remove-item-pipeline-dynamic-target",B.strict)&&D&&(at.targets.length===0||at.recursive))return St("powershell.remove-item-pipeline-dynamic-target",ov);for(let lt of at.targets)if(!Qn(lt.text)&&Cl(xl(lt.text)))return St(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",kf);for(let lt of at.targets)if(B.resolvedCwd&&Er(xl(lt.text),B.resolvedCwd,B.protectedGitMetadata,at.recursive,B.environment,B.budget,!0))return St("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(Q,"powershell.remove-item-recursive-force-dynamic-target",B.strict)&&(at.hasDynamicTarget||at.targets.length===0))return St("powershell.remove-item-recursive-force-dynamic-target",If);for(let lt of at.targets){let ct=Bo(On(xl(lt.text),B),B,Q,iv);if(ct)return ct}return null}function av(O){let D=[],B=!1,Q=!1,ee=!1,he=!1,je=!1;for(let at=0;at<O.length;at++){let lt=O[at];if(!lt||lt.kind!=="word")continue;if(cv(lt))continue;if(je){D.push(El(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=dv(lt.text);if(!ct){D.push(El(lt)),he=he||lt.dynamic;continue}if(fv(ct.name)){let ut=ct.value?uv(ct.value,lt):O[++at];if(ut?.kind==="word"){D.push(El(ut)),he=he||ut.dynamic;continue}he=!0;continue}if(mv(ct.name)){B=!0;continue}if(pv(ct.name)){Q=!0;continue}if(gv(ct.name))ee=hv(ct.value)}return{targets:D,recursive:B,force:Q,whatIfProtected:ee,hasDynamicTarget:he}}function lv(O){let D=O[0];if(D?.kind==="word"&&D.text==="&"||D?.text===".")return O.length>1?1:0;return 0}function El(O){return{text:O.kind==="word"?O.text:"",dynamic:O.kind==="word"&&O.dynamic}}function cv(O){return O.kind==="word"&&O.text===","}function xl(O){let D=O.replace(/\\/g,"/"),B=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(D);return B?`$HOME${D.slice(B[0].length)}`:D}function uv(O,D){return{kind:"word",text:O,dynamic:D.kind==="word"&&(D.dynamic||O.includes("$"))}}function dv(O){if(!O.startsWith("-")||O==="-")return null;let D=O.slice(1),B=D.indexOf(":");if(B===-1)return{name:D.toLowerCase()};return{name:D.slice(0,B).toLowerCase(),value:D.slice(B+1)}}function fv(O){return"path".startsWith(O)||"literalpath".startsWith(O)}function mv(O){return"recurse".startsWith(O)}function pv(O){return O.length>=2&&"force".startsWith(O)}function gv(O){return O==="wi"||"whatif".startsWith(O)}function hv(O){if(O===void 0||O==="")return!0;let D=O.toLowerCase();return D==="$true"||D==="true"}function yv(O){return O.toLowerCase()}var Xr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ls="Unsupported heredoc syntax",Uo="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Mf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var bv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Sv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Cv=new Set(["-o","--output","--query","--subscription"]),vv=new Set;function Df(O){if(O==="aws")return bv;if(O==="gcloud")return Sv;if(O==="az")return Cv;return vv}var Ev=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),xv=new Set;function Nf(O){if(O==="git")return gn;if(O==="docker")return Ev;return xv}function _(O,D){if(O.length===0||D.length===0)return null;let B=kt(O[0]??""),Q=an(O);for(let ee of D){if(!wv(B,ee.command))continue;if(ee.match){if(Rv(B,O,ee.match))return Lf(ee);continue}if(!Pv(B,O,ee.subcommand))continue;if(Tv(O,new Set(ee.block_args),Q))return Lf(ee)}return null}function Lf(O){return{id:`custom.${O.name}`,reason:`[${O.name}] ${O.reason}`,intent:O.intent??"manual_only"}}function Rv(O,D,B){let Q=D.slice(1);if(B.exclude_args?.some((ee)=>Q.includes(ee)))return!1;if(B.any_args&&!B.any_args.some((ee)=>Q.includes(ee)))return!1;return _v(Q,B.command_path,Df(O))}function _v(O,D,B){let Q=0,ee=!1;for(let he of O){if(Q>=D.length)return!0;if(ee){ee=!1;continue}if(he.startsWith("-")){ee=!he.includes("=")&&B.has(he);continue}if(he!==D[Q])return!1;Q++}return Q>=D.length}function wv(O,D){return O===kt(D)}function Pv(O,D,B){if(!B)return!0;return Wf(D,1,B,Nf(O))}function Wf(O,D,B,Q){let ee=!1;for(let he=D;he<O.length;he++){let je=O[he];if(!je)continue;if(ee){ee=!1;continue}if(je==="--"){let at=O[he+1];if(at&&!at.startsWith("-"))return at===B;return!1}if(Q.has(je)){ee=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&Av(O,he,B,Q))return!0;continue}return je===B}return!1}function Av(O,D,B,Q){let ee=O[D+1];if(!ee||ee.startsWith("-"))return!1;return Wf(O,D+2,B,Q)}function Tv(O,D,B){return O.some((Q)=>D.has(Q))||[...B].some((Q)=>D.has(Q))}var Iv=new Set(["-e","--source"]),kv=new Set(["-F","-v","--assign","--field-separator"]),Gf=new Set(["-f","--file"]),Ov=new Set(["print","printf","return"]),Ff=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Mv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function zf(O,D,B){let Q=!1;for(let ee of Dv(O)){let he=Nv(ee,B);if(!he)continue;for(let je of he.commands){let at=D(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))Q=!0}Q||=he.dynamic}return Q?St("awk.system-dynamic",Mv):null}function _l(O){let D=[],B=!1,Q=!1,ee=!0,he=!0;for(let je=1;je<O.length;je++){let at=O[je];if(at===void 0)break;if(ee&&at==="--"){ee=!1;continue}if(ee&&Iv.has(at)){B=!0;let lt=O[je+1];if(he&&=lt!==void 0,lt!==void 0)D.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(ee&&at.startsWith("--source=")){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(ee&&at.startsWith("-e")&&at.length>2){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(ee&&(kv.has(at)||Gf.has(at))){let lt=O[je+1];if(he&&=lt!==void 0,Gf.has(at)){if(Q=!0,lt!==void 0)D.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(ee&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(ee&&at.startsWith("-f")&&at.length>2){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(ee&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(ee&&at.startsWith("--file=")){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(ee&&at.startsWith("-")&&at!=="-")continue;if(!B&&!Q)D.push({tokenIndex:je,kind:"main-program",value:at});return{sources:D,optionsOpen:!1}}return{sources:he?D:[],optionsOpen:ee&&he}}function jo(O){return _l(O).sources}function Dv(O){return jo(O).filter((D)=>D.kind!=="program-file").map((D)=>D.value)}function Nv(O,D){bn(D,O);let B=O.includes("system")?wl(O,D):null,Q=Lv(O,D);if(!B&&!Q)return null;return{dynamic:!!B?.dynamic||!!Q?.dynamic,commands:[...B?.commands??[],...Q?.commands??[]]}}function wl(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0;while(he<O.length){let je=O[he];if(je==='"'||je==="'"){he=us(O,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Bf(O,he+1);continue}if(je==="/"&&$f(O,he)){he=Uf(O,he+1)??he+1;continue}if(!O.startsWith("system",he)){he++;continue}let at=he;if(he+=6,Ho(O[at-1])||Ho(O[he]))continue;let lt=cs(O,he);if(O[lt]!=="(")continue;lt=cs(O,lt+1);let ct=O[lt];if(ct!=='"'&&ct!=="'"){Q=!0,ee=!0;continue}let ut=us(O,lt,ct);if(!ut){Q=!0,ee=!0;continue}if(lt=cs(O,ut.endIndex),Q=!0,O[lt]!==")"){ee=!0,he=ut.endIndex;continue}B.push(ut.value),he=lt+1}if(!Q)return null;return{dynamic:ee,commands:B}}function Lv(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<O.length){let ut=O[he];if(!ut)break;if(ut==='"'||ut==="'"){let mt=us(O,he,ut);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(ut==="#"){he=Bf(O,he+1),je=he,at=null,lt=null,ct=he;continue}if(ut==="/"&&$f(O,he)){let mt=Uf(O,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
-{}`.includes(ut)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(Rl(O,he,"print")||Rl(O,he,"printf")))at=he;if(ut!=="|"||O[he-1]==="|"||O[he+1]==="|"){if(!/\s/.test(ut))ct=he+1;he++;continue}let ft=O[he+1]==="&"?he+2:he+1,dt=cs(O,ft);if(Rl(O,dt,"getline")){ee=!0;let mt=Fv(je,lt,ct);if(Q||=mt===null,mt!==null)B.push(mt);ct=ft,he=ft;continue}if(Bv(je,at)){ee=!0;let mt=Gv(O,dt);if(!mt){Q=!0,ct=ft,he=ft;continue}if(!Wv(O,mt.endIndex)){Q=!0,ct=mt.endIndex,he=mt.endIndex;continue}B.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!ee)return null;return{dynamic:Q,commands:B}}function Ho(O){return!!O&&/[A-Za-z0-9_]/.test(O)}function cs(O,D){let B=D;while(/\s/.test(O[B]??""))B++;return B}function Wv(O,D){let B=D;while(/[\t\f\v\r ]/.test(O[B]??""))B++;let Q=O[B];return!Q||`;
-}#`.includes(Q)}function us(O,D,B){let Q="",ee=!1;for(let he=D+1;he<O.length;he++){let je=O[he];if(!je)break;if(ee){let at=zv(O,he);if(!at)return null;Q+=at.value,he=at.endIndex,ee=!1;continue}if(je==="\\"){ee=!0;continue}if(je===B)return{value:Q,endIndex:he+1};Q+=je}return null}function Gv(O,D){let B=O[D];if(B!=='"'&&B!=="'")return null;return us(O,D,B)}function Fv(O,D,B){if(!D)return null;return D.startIndex>=O&&D.endIndex===B?D.value:null}function zv(O,D){let B=O[D];if(!B)return null;if(B==="x"){let ee=O.slice(D+1,D+3);if(!/^[0-9A-Fa-f]{2}$/.test(ee))return null;return{value:String.fromCharCode(Number.parseInt(ee,16)),endIndex:D+2}}if(/[0-7]/.test(B)){let ee=/^[0-7]{1,3}/.exec(O.slice(D));if(!ee)return null;return{value:String.fromCharCode(Number.parseInt(ee[0],8)),endIndex:D+ee[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[B]??B,endIndex:D}}function Rl(O,D,B){return O.startsWith(B,D)&&!Ho(O[D-1])&&!Ho(O[D+B.length])}function Bv(O,D){return D!==null&&D>=O}function Bf(O,D){let B=O.indexOf(`
-`,D);return B===-1?O.length:B+1}function $f(O,D){let B=$v(O,D);if(B===-1)return!0;if("{([,;!~=".includes(O[B]??""))return!0;let Q=B;while(Ho(O[Q-1]))Q--;return Ov.has(O.slice(Q,B+1))}function $v(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return B;return-1}function Uf(O,D){let B=!1;for(let Q=D;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="/")return Q+1}return null}var Uv=new Set(["sudo","env","command","builtin"]);function ds(O,D){let B=O[0];if(!B||!D.transparentWrappers.includes(Tt(B)))return null;let Q=Tt(B),ee=O[1]==="--"?2:1,he=Hv(O,ee,Q,D),je=he[0];if(je===void 0)return null;return{wrapper:Q,tokens:O.slice(je),childIndex:je,alternativeChildIndices:he.slice(1)}}function Hv(O,D,B,Q){let ee=O[1]==="--",he=[];for(let je=D;je<O.length;je++){let at=O[je];if(!at)continue;let lt=Tt(at)!==B&&jv(at,Q);if(lt)he.push(je);if(!lt&&bi.has(kt(at)))break;if(ee)break}return he}function jv(O,D){let B=Tt(O),Q=kt(O);return Q==="git"||B==="busybox"||wr(O)||ha.has(B)||D.transparentWrappers.includes(B)||Kt.has(Q)||O==="$SHELL"||An(Q)||En.has(Q)||D.rules.some((ee)=>ee.command===B)}function wr(O){return Uv.has(O.toLowerCase())}function Pr(O,D){return{embedded:!1,cwd:O.cwd,originalCwd:D.originalCwd,effectiveCwd:O.cwd,envAssignments:O.envAssignments,allowTmpdirVar:D.allowTmpdirVar,worktreeMode:D.worktreeMode,wrappedByTransparent:!1}}function Mn(O,D){let B=D.policy??{rules:[],transparentWrappers:[]};return fs([...O],D.environment,D.cwd,D.cwd,new Map,new Map(D.envAssignments??[]),B,{iterations:0},!1)}function*fs(O,D,B,Q,ee,he,je,at,lt){let ct=Yi(O,D,B,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),ee.set(mt,pt);let{tokens:ut,cwd:ft}=ct;if(ct.envSplitValues){let mt=qi(ct.envSplitValues,ut);if(!mt)throw new s("derivedCommandShape");Pl(at),yield*fs(mt,D,ft,Q,ee,he,je,at,lt);return}if(wr(ut[0]??""))throw new s("wrapperPeelIterations");let dt=ds(ut,je);if(dt){for(let mt of[dt.childIndex,...dt.alternativeChildIndices])Pl(at),yield*fs(mt===dt.childIndex?dt.tokens:ut.slice(mt),D,ft,Q,new Map(ee),new Map(he),je,at,!0);return}if(Kv(ut)){Pl(at),yield*fs(ut.slice(1),D,ft,Q,ee,he,je,at,lt);return}yield Vv(ut,ft,Q,ee,he,lt)}function Vv(O,D,B,Q,ee,he){return{tokens:O,cwd:D===null?void 0:D??B,wrapperCwd:D,wrapperEnvAssignments:Q,envAssignments:ee,head:Tt(O[0]??"").toLowerCase(),wrappedByTransparent:he}}function Pl(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function Kv(O){return Tt(O[0]??"").toLowerCase()==="busybox"&&O.length>1}function Al(O,D){let B=[],Q=D;while(Q<O.length){let ee=O[Q];if(ee===void 0||ee===":::")break;B.push(ee),Q++}return{markerIndex:Q<O.length&&O[Q]===":::"?Q:-1,templateTokens:B}}function Dn(O){let D=!1,B=!1;for(let Q of O){if(Q==="--")break;if(Q==="-r"||Q==="-R"||Tl(Q,"recursive")){D=!0;continue}if(Q==="-f"||Tl(Q,"force")){B=!0;continue}if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))D=!0;if(Q.includes("f"))B=!0}}return D&&B}function Hf(O){let D=O.indexOf("--");return O.slice(1,D===-1?void 0:D).some((B)=>Tl(B,"recursive")||/^-[A-Za-z]+$/.test(B)&&/[rR]/.test(B.slice(1)))}function Tl(O,D){return O.length>2&&O.startsWith("--")&&D.startsWith(O.slice(2))}var qv="find -delete permanently removes files. Use -print first to preview.",Yv="find -exec rm -rf is dangerous. Use explicit file list instead.",Zv=new Set(["-exec","-execdir","-ok","-okdir"]),Xv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((O)=>[O,1]),["-fprintf",2]]);function jf(O,D){let B=O.map(t),Q=Jv(O,B,D);if(Q)return Q;if(ps(B,1)&&!eE(O,B,D)){let je=wt(St("find.delete",qv),D.policy);if(je)return je}let ee=D.budget??mn(),he=0;while(he<B.length){let je=B[he],at=sr(je??"");if(at>0){he+=at+1;continue}if(!Kn(je)){he++;continue}ee.charge("derivedTokens",B.length-he-1);let lt=Vo(B,he);he=lt.nextIndex;let ct=nE(lt.tokens,D.environment);if(ct){let mt=wt(ct,D.policy);if(mt)return mt}let ut=je==="-execdir"||je==="-okdir",ft=D.analyzeTokens?D.analyzeTokens(lt.tokens,ut?null:D.cwd):D.analyzeNested?D.analyzeNested(lt.tokens.join(" "),{effectiveCwd:ut?void 0:D.cwd,envAssignments:D.envAssignments}):null,dt=ft?.id.startsWith("custom.")?ft:wt(ft,D.policy);if(dt)return dt}return null}function Jv(O,D,B){if(!ps(D,1)&&!Il(D,B.environment))return null;let ee=ms(O)??$t(["."]),he=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of ee){let at=$o(je);for(let lt of at.expandedTargets??[t(je)]){let ct=On(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target")return St("find.delete-git-metadata",x)}}if(Qv(D)&&he.resolvedCwd&&gf(ee.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return St("find.delete-git-metadata",x);return null}function Il(O,D){let B=0;while(B<O.length){if(!Kn(O[B])){B++;continue}let Q=Vo(O,B),ee=Cr([...Q.tokens],D),he=Tt(ee[0]??"").toLowerCase();if((he==="rm"||he==="rmdir")&&ee.some((je)=>je.includes("{}")))return!0;B=Q.nextIndex}return!1}function Qv(O){return O.some((D,B)=>{if(!["-name","-iname"].includes(D))return!1;return O[B+1]?.toLowerCase()==="hooks"})}function eE(O,D,B){if(D.includes("-L")||D.includes("-f")||D.includes("-follow"))return!1;let Q=ms(O);if(!Q)return!1;let ee=B.envAssignments??new Map,he=yl(ee,B.environment),je=B.trustedTmpdirValue??xr(ee,B.environment),at=B.allowTmpdirVar??!zo(ee,B.environment),lt=_r({environment:B.environment,protectedGitMetadata:B.protectedGitMetadata,cwd:B.cwd,originalCwd:B.originalCwd,strict:B.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:B.tmpdirWordSplittingUnsafe??ir(ee,B.environment),trustedTmpdirValue:je,budget:B.budget});return Q.every((ct)=>{let ut=$o(ct);if(ut.unsafeBraceExpansion)return!1;return(ut.expandedTargets??[t(ct)]).every((ft)=>_f(ft,lt,{containmentTarget:tE(ft,he),targetIsLiteral:ut.expandedTargets!==void 0||ut.targetIsLiteral,tmpdirWordSplittingProtected:ut.tmpdirWordSplittingProtected}))})}function tE(O,D){if(!D)return O;return O.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>D)}function ms(O){let D=(ee)=>{let he=O[ee];return he?t(he):void 0},B=1;while(D(B)==="-H"||D(B)==="-P")B++;if(D(B)==="--")B++;let Q=[];while(B<O.length){let ee=D(B),he=O[B];if(!ee||!he||ee.startsWith("-")||["!","(",")"].includes(ee))break;Q.push(he),B++}return Q.length>0?Q:null}function nE(O,D){let B=rr([...O],D);if(B.length===0)return null;let Q=Tt(B[0]??"");if(Q==="busybox"&&B.length>1)B=B.slice(1),Q=Tt(B[0]??"");if(Q==="rm"&&Dn(B))return St("find.exec-rm-recursive-force",Yv);return null}function Vo(O,D){let B=D+1;while(B<O.length&&O[B]!==";"&&!(O[B]==="+"&&O[B-1]==="{}"))B++;return{tokens:O.slice(D+1,B),nextIndex:Math.min(B+1,O.length)}}function ps(O,D){let B=D;while(B<O.length){let Q=O[B];if(!Q){B++;continue}if(Kn(Q)){B=Vo(O,B).nextIndex;continue}let ee=sr(Q);if(ee>0){B+=ee+1;continue}if(Q==="-delete")return!0;B++}return!1}function sr(O){return Xv.get(O)??(/^-newer[A-Za-z]{2}$/.test(O)?1:0)}function Kn(O){return O!==void 0&&Zv.has(O)}import{resolve as Ix}from"node:path";function*kl(O){for(let D of O.nodes)yield*oE(D)}function rE(O){return Object.freeze([...kl(O)])}function st(O){return Object.freeze(rE(O).map((D)=>Object.freeze(D.words.map((B)=>B.text))))}function Ko(O){let D=h(O,"posix");if(D.status!=="complete"||D.nodes.length!==1)return null;let B=D.nodes[0];if(B?.kind!=="command")return null;if(B.redirections.length>0||B.nested.length>0)return null;if(B.words.some((Q)=>Q.provenance==="command-substitution"))return null;return B.words.map((Q)=>Q.text)}function*oE(O){if(O.kind==="command"){yield O;for(let D of O.nested)yield*kl(D);return}if(O.kind==="group")yield*kl(O.body)}var iE=5,Ol="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(O){let D=O.indexOf("--");if(D===-1)return{index:-1,before:O,after:[]};return{index:D,before:O.slice(0,D),after:O.slice(D+1)}}function Kf(O,D,B){let Q=gs(O,D,B),ee=sE(Q.entries);if(ee.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:O};let he=O,je=!1;for(let at=0;at<iE;at++){let{subcommand:lt,rest:ct}=Sn(he),ut=lt?.toLowerCase();if(!ut||!ee.has(ut))return{blockedReason:Q.blockedReason,expanded:je,tokens:he};let ft=ee.get(ut),dt=dE(ft);if(dt===null||dt.length===0)return{blockedReason:Ol,expanded:!0,tokens:he};he=["git",...dt,...ct],je=!0}return{blockedReason:Ol,expanded:!0,tokens:he}}function qf(O,D,B){return gs(O,D,B).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function Sn(O){if(O.length===0)return{subcommand:null,rest:[]};let D=O[0];if((D?Tt(D).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--"){let he=O[Q+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:O.slice(Q+2)};return{subcommand:null,rest:O.slice(Q+1)}}if(!ee.startsWith("-"))return{subcommand:ee,rest:O.slice(Q+1)};Q+=gn.has(ee)?2:1}return{subcommand:null,rest:[]}}function sE(O){let D=new Map;for(let B of O){let Q=B.key.toLowerCase();if(!Q.startsWith("alias."))continue;let ee=Q.slice(6);if(ee!=="")D.set(ee,B.value)}return D}function gs(O,D,B){if(O.length===0)return{blockedReason:null,entries:[]};let Q=O[0];if((Q?Tt(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=lE(D,B);return{blockedReason:he.blockedReason,entries:[...he.entries,...aE(O,D,B)]}}function aE(O,D,B){let Q=[],ee=1;while(ee<O.length){let he=O[ee];if(!he||he==="--"||!he.startsWith("-"))return Q;if(he==="-c"){let je=Ml(O[ee+1]);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=Ml(he.slice(2));if(je)Q.push(je);ee++;continue}if(he==="--config-env"){let je=Vf(O[ee+1],D,B);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("--config-env=")){let je=Vf(he.slice(13),D,B);if(je)Q.push(je);ee++;continue}if(gn.has(he)){ee+=2;continue}ee++}return Q}function lE(O,D){let B=cE(O,D),Q=uE(O,D);return{blockedReason:B===null||Q===null?Ol:null,entries:[...B??[],...Q??[]]}}function cE(O,D){let B=jn("GIT_CONFIG_PARAMETERS",O,D);if(B===void 0)return[];let Q=[],ee=Ko(B);if(!ee)return null;for(let he of ee){let je=Ml(he);if(!je)return null;Q.push(je)}return Q}function uE(O,D){let B=$d(O,D);if(B.state==="absent")return[];if(B.state==="invalid")return null;let Q=[];for(let ee=0;ee<B.count;ee++){let he=jn(`GIT_CONFIG_KEY_${ee}`,O,D)?.trim(),je=jn(`GIT_CONFIG_VALUE_${ee}`,O,D);if(!he||je===void 0)return null;Q.push({key:he,value:je})}return Q}function Ml(O){if(!O)return null;let D=O.indexOf("=");return{key:(D===-1?O:O.slice(0,D)).trim(),value:D===-1?void 0:O.slice(D+1)}}function Vf(O,D,B){let Q=O?.indexOf("=")??-1;if(!O||Q===-1)return null;return{key:O.slice(0,Q).trim(),value:jn(O.slice(Q+1),D,B)}}function dE(O){let D=O?.trimStart();if(!D||D.startsWith("!"))return null;return Ko(D)}var fE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",pE="git checkout --force discards uncommitted changes. Use 'git stash' first.",gE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",hE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",yE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",bE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",SE="git switch --force discards uncommitted changes. Use 'git stash' first.",CE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",vE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",EE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",xE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",RE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",_E="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",wE="git push --force destroys remote history. Use --force-with-lease for safer force push.",PE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",AE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",TE="git branch -D force-deletes without merge check. Use -d for safe delete.",IE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",kE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",OE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",ME="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",DE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",NE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",LE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",WE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),GE=new Set(["--recurse-submodules","--track","-t"]),Dl=new Set(["-b","-B","-U"]),Nl=new Set(["-c","-C"]),FE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function It(O,D){let B=O.split("=",1)[0]??O;return B.length>=4&&D.startsWith(B)&&B.startsWith("--")&&B.slice(2).length>=2}var Jr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zf(O,D){let{subcommand:B,rest:Q}=Sn(O);if(!B)return null;switch(B.toLowerCase()){case"checkout":return ar(zE(Q,D));case"switch":return ar($E(Q));case"restore":return ar(HE(Q));case"reset":return VE(Q);case"clean":return ar(qE(Q));case"rm":return ar(YE(Q));case"push":return Ar(ZE(Q));case"branch":return Ar(QE(Q));case"stash":return Ar(ox(Q));case"worktree":return Ar(ix(Q));case"rebase":return ar(ex(Q));case"merge":return ar(tx(Q));case"tag":return Ar(nx(Q));case"reflog":return Ar(rx(Q));default:return null}}function ar(O){return O?{...O,localDiscard:!0}:null}function Ar(O){return O?{...O,localDiscard:!1}:null}function zE(O,D){let{index:B,before:Q}=en(O),ee=an(Q,{shortOptsWithValue:Dl});if(Q.some((at)=>It(at,"--force"))||ee.has("-f"))return St("git.checkout-force",pE);for(let at of O){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(It(at,"--pathspec-from-file"))return St("git.checkout-pathspec-from-file",hE)}if(B!==-1){if(Q.some((lt)=>!lt.startsWith("-")))return St("git.checkout-ref-path",gE);return St("git.checkout-double-dash",fE)}let he=UE(O);if(he.length>=2)return St("git.checkout-ambiguous",yE);let je=he[0];if(je===void 0||ee.has("-d")||ee.has("-t")||O.some((at)=>It(at,"--detach")||It(at,"--track")))return null;if(BE(je)||D(je))return St("git.checkout-double-dash",mE);return null}function BE(O){return O==="."||O===".."||/^\.\.?[/\\]/.test(O)||/^([/\\]|[A-Za-z]:[/\\])/.test(O)||O.endsWith("/")||O.startsWith(":")||/[*?[]/.test(O)}function $E(O){let{before:D}=en(O);if(D.some((Q)=>It(Q,"--discard-changes")))return St("git.switch-discard-changes",bE);let B=an(D,{shortOptsWithValue:Nl});if(D.some((Q)=>It(Q,"--force"))||B.has("-f"))return St("git.switch-force",SE);return null}function UE(O){let D=[],B=0;while(B<O.length){let Q=O[B];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-")){D.push(Q),B++;continue}if(WE.has(Q)){B+=2;continue}if(GE.has(Q)){let ee=O[B+1],he=Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];B+=ee&&!ee.startsWith("-")&&he.includes(ee)?2:1;continue}B++}return D}function HE(O){let D=jE(O);if(D.isTerminal||!D.hasPathspec&&!D.hasPatch||!D.hasWorktree)return null;return D.hasExplicitLocation?St("git.restore-worktree",vE):St("git.restore-unstaged",CE)}function jE(O){let D=!1,B=!1,Q=!0,ee=!1,he=(je)=>{if(!ee)Q=!1,ee=!0;if(je!==void 0)Q=je};for(let je=0;je<O.length;je++){let at=O[je];if(at===void 0)break;if(at==="--"){D||=je+1<O.length;break}if(at==="--pathspec-from-file"){D=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){D=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){B=!0;continue}if(at==="--no-patch"){B=!1;continue}if(FE.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){D=!0;continue}if(!at.startsWith("-")){D=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){B=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!1}}function VE(O){let D=null;for(let B of O){if(It(B,"--hard")){D=St("git.reset-hard",EE);break}if(It(B,"--merge")){D=St("git.reset-merge",xE);break}}if(!D)return null;return KE(O)?Ar(D):ar(D)}function KE(O){for(let D of O){if(D==="--")return!1;if(!D.startsWith("-"))return!0}return!1}function qE(O){for(let B of O)if(B==="-n"||It(B,"--dry-run"))return null;let D=an(O.filter((B)=>B!=="--"));if(O.some((B)=>It(B,"--force"))||D.has("-f"))return St("git.clean-force",RE);return null}function YE(O){let D=!1,B=!1,Q=!1;for(let ee of en(O).before){if(It(ee,"--no-force")){D=!1;continue}if(It(ee,"--force")){D=!0;continue}if(It(ee,"--no-cached")){B=!1;continue}if(It(ee,"--cached")){B=!0;continue}if(It(ee,"--no-dry-run")){Q=!1;continue}if(It(ee,"--dry-run")){Q=!0;continue}let he=an([ee]);D||=he.has("-f"),Q||=he.has("-n")}return D&&!B&&!Q?St("git.rm-force",_E):null}function ZE(O){let{before:D,after:B}=en(O),Q=an(D);if(D.some((je)=>It(je,"--mirror")))return St("git.push-mirror",AE);if(D.some((je)=>It(je,"--force"))||Q.has("-f")||Yf(D,B).some(XE))return St("git.push-force",wE);if(D.some((je)=>It(je,"--delete"))||Q.has("-d")||Yf(D,B).some(JE))return St("git.push-delete",PE);return null}function Yf(O,D){return[...O.filter((B)=>B!==""&&!B.startsWith("-")),...D]}function XE(O){return O.startsWith("+")||O.includes(":+")}function JE(O){return O.length>1&&O.startsWith(":")}function QE(O){let{before:D}=en(O),B=an(D),Q=B.has("-D")||B.has("-d")||D.some((he)=>It(he,"--delete")),ee=B.has("-D")||B.has("-f")||D.some((he)=>It(he,"--force"));if(Q&&ee)return St("git.branch-force-delete",TE);return null}function ex(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.rebase-abort",IE):null}function tx(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.merge-abort",kE):null}function nx(O){let{before:D}=en(O);return an(D).has("-d")||D.some((Q)=>It(Q,"--delete"))?St("git.tag-delete",OE):null}function rx(O){return O[0]==="delete"?St("git.reflog-delete",ME):null}function ox(O){for(let D of O){if(D==="drop")return St("git.stash-drop",DE);if(D==="clear")return St("git.stash-clear",NE)}return null}function ix(O){let{before:D}=en(O);if(!D.includes("remove"))return null;let Q=an(D);if(D.some((ee)=>It(ee,"--force"))||Q.has("-f"))return St("git.worktree-remove-force",LE);return null}import{dirname as _x,isAbsolute as wx,join as dm,resolve as Px}from"node:path";var Wl="TMPDIR",Gl="IFS",Jf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qf=/^[A-Za-z_][A-Za-z0-9_]*$/,em=new Set(["export","typeset","declare","readonly"]),sx=new Set(["builtin","command","time"]),tm=new Set(["do","then","else"]),ax=new Set(["do","then","case"]),Xf=new Set(["done","fi","esac"]),lx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function nm(O,D){return O.map((B)=>B.provenance==="variable"&&lm(B.text)?qo(B.text,D.shellAssignments):t(B))}function qo(O,D){return O.replace(lx,(B,Q,ee)=>D.get(Q??ee??"")??B)}function rm(O,D){return{env:O,effectiveEnvAssignments:fx(O,D),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function om(O){return{env:O.env,effectiveEnvAssignments:O.effectiveEnvAssignments?new Map(O.effectiveEnvAssignments):void 0,shellAssignments:new Map(O.shellAssignments),bodyDepth:O.bodyDepth,bodyAssignments:new Set(O.bodyAssignments)}}function Fl(O,D){let B=sm(O,D),Q=O[0]??"";if(ax.has(Q))D.bodyDepth+=1;if(Q==="elif"||Xf.has(Q))D.bodyDepth=Math.max(0,D.bodyDepth-1);if(Xf.has(Q)&&D.bodyDepth===0)D.bodyAssignments.forEach((at)=>{D.shellAssignments.delete(at)}),D.bodyAssignments.clear();B.assignments.filter((at)=>at.persists).forEach((at)=>{if(D.shellAssignments.set(at.name,at.value),D.bodyDepth>0)D.bodyAssignments.add(at.name);zl(D,at)});let ee=B.commandIndex;if(ee!==-1&&em.has(O[ee]??""))O.filter((at)=>Qf.test(at)&&Ll(at)).forEach((at)=>{mx(D,at)});let he=ee===-1?-1:am(O,ee);if(he===-1||O[he]!=="unset")return;let je=gx(O,he);if(je===null)return;O.slice(je).forEach((at)=>{if(tm.has(Q)){D.shellAssignments.set(at,"");return}px(D,at)})}function im(O,D){let B=sm(O,D).assignments;if(B.length===0)return D.effectiveEnvAssignments;let Q=new Map(D.effectiveEnvAssignments??[]);return B.forEach((ee)=>{Q.set(ee.name,ee.value)}),Q}function sm(O,D){let B=tm.has(O[0]??"")?1:0,Q=O.findIndex((at,lt)=>lt>=B&&!lm(at)),ee=Q!==-1&&em.has(O[am(O,Q)]??""),he=dx(D);return{assignments:O.flatMap((at,lt)=>{let ct=cx(at,he,D.env);if(!ct)return[];if(Q!==-1&&lt>Q&&!ee&&!Vi(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:Q===-1||ee}]}),commandIndex:Q}}function am(O,D){let B=D;while(sx.has(O[B]??"")){B+=1;while(O[B]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(O[B]??""))return D;B+=1}}return B}function lm(O){return Rn(O)!==null||Jf.test(O)}function cx(O,D,B){return Rn(O)??ux(O,D,B)}function ux(O,D,B){let Q=Ki(O,B,D);if(Q)return Q;let ee=O.match(Jf)?.[1];if(!ee)return null;let he=O.indexOf("=");return{name:ee,value:`${D.has(ee)?D.get(ee):B.get(ee)??""}${O.slice(he+1)}`}}function Ll(O){return O===Wl||O===Gl||cl(O)}function dx(O){return new Map([...O.effectiveEnvAssignments??[],...O.shellAssignments])}function fx(O,D){let B=[Wl,Gl].map((Q)=>{let ee=O.get(Q);return ee===void 0?null:[Q,ee]}).filter((Q)=>Q!==null);if(B.length===0)return D;return new Map([...B,...D??[]])}function zl(O,D){let B=new Map(O.effectiveEnvAssignments??[]);B.set(D.name,D.value),O.effectiveEnvAssignments=B}function mx(O,D){zl(O,{name:D,value:O.shellAssignments.get(D)??O.effectiveEnvAssignments?.get(D)??O.env.get(D)??""})}function px(O,D){if(!Ll(D)&&!Qf.test(D))return;if(O.shellAssignments.set(D,""),Vi(D)&&O.env.has(D)){let Q=new Map(O.env);Q.delete(D),O.env=Q}if(!Ll(D)||D===Wl||D===Gl||mo(D)){zl(O,{name:D,value:""});return}if(!O.effectiveEnvAssignments?.has(D))return;let B=new Map(O.effectiveEnvAssignments);B.delete(D),O.effectiveEnvAssignments=B.size===0?void 0:B}function gx(O,D){let B=D+1;while(B<O.length){let Q=O[B];if(!Q)return null;if(Q==="--")return B+1;if(Q==="-v"){B++;continue}if(Q.startsWith("-"))return null;return B}return B}import{resolve as hx}from"node:path";function hs(O,D){return ll.some((B)=>D?.has(B)||O.has(B))}function Qr(O,D,B){if(!D)return{gitCwd:null,hasExplicitGitContext:!1};let Q=B.realpath(hx(D));if(Q===null||!B.isDirectory(Q))return{gitCwd:null,hasExplicitGitContext:!1};let ee=Q,he=!1,je=1;while(je<O.length){let at=O[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=O[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=cm(ee,lt,B);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};ee=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=cm(ee,at.slice(2),B);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};ee=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=gn.has(at)?2:1}return{gitCwd:ee,hasExplicitGitContext:he}}function cm(O,D,B){try{let Q=nr(O,D,B);return B.isDirectory(Q)?Q:null}catch{return null}}function um(O,D,B){if(!D.localDiscard||!B.worktreeMode||hs(B.environment.env,B.envAssignments))return null;let Q=Qr(O,B.cwd,B.environment.paths);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;let ee=B.environment.worktreeFacts(Q.gitCwd);if(!ee)return null;if(Bl(O,B,ee))return null;return{kind:"worktree",originalReason:D.reason,gitCwd:Q.gitCwd}}function Bl(O,D,B){let{subcommand:Q,rest:ee}=Sn(O),he=Q?.toLowerCase();if(D.dynamicArguments||yx(ee)||Ex(O,D.environment.env,D.envAssignments,B)||Cx(ee)||bx(he,ee))return!0;return he==="clean"&&vx(ee)>1}function yx(O){return O.some((D)=>/[$*?[]/.test(D))}function bx(O,D){if(O==="checkout"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Dl}),ee=B.some((je)=>It(je,"--force"))||Q.has("-f"),he=Q.has("-B")||B.some((je)=>je==="-B"||je.startsWith("-B"));return ee&&he}if(O==="switch"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Nl}),ee=B.some((je)=>It(je,"--force"))||B.some((je)=>It(je,"--discard-changes"))||Q.has("-f"),he=B.some((je)=>je==="-C"||je.startsWith("-C")||Sx(je))||Q.has("-C");return ee&&he}return!1}function Sx(O){let D=O.split("=",1)[0]??O;return D==="--force-create"||D.length>=9&&"--force-create".startsWith(D)}function Cx(O){return O.some((D)=>D.startsWith("--recurse-sub"))}function vx(O){let D=0;for(let B of O){if(B==="--force"){D++;continue}if(B.startsWith("-")&&!B.startsWith("--")){for(let Q of B.slice(1))if(Q==="f")D++}}return D}function Ex(O,D,B,Q){if(jn("GIT_CONFIG_PARAMETERS",D,B)!==void 0)return!0;let ee=gs(O,D,B);if(ee.blockedReason!==null)return!0;let he=ee.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>Rx(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||xx(je.value);if(Hd(B))return!0;return Q.recursiveSubmodules}function xx(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Rx(O){return O==="include.path"||O.startsWith("includeif.")&&O.endsWith(".path")}function fm(O,D,B){let Q=O.map(t),ee=B.environment.paths,he=Qr(Q,B.cwd,ee),je=B.originalCwd?ee.realpath(Px(B.originalCwd)):null;if(D.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||hs(B.environment.env,B.envAssignments))return null;let at=D.id==="git.worktree-remove-force"?Tx(O,B.shellAssignments,ee):mm(he.gitCwd,ee);if(at===null||D.id!=="git.worktree-remove-force"&&!Ax(at,Q,D,B)||!Zr(at,B.environment)||is(at,B.environment)||ss(je,at)||ss(at,je))return null;return{kind:"temp-root",originalReason:D.reason,gitCwd:he.gitCwd}}function Ax(O,D,B,Q){let ee=Q.environment.paths,he=dm(O,".git");if(ee.entryKind(he)!=="present")return!1;if(ee.isDirectory(he))return!0;let je=B.localDiscard?Q.environment.worktreeFacts(O):null;return je!==null&&!Bl(D,Q,je)}function Tx(O,D,B){let Q=Sn(O.map(t)).rest,{before:ee,after:he}=en(Q.slice(Q.indexOf("remove")+1)),je=[...ee.filter((ut)=>!ut.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=O.find((ut)=>ut.text===at),ct=lt?.provenance==="variable"&&lt.parts.every((ut)=>ut.provenance!=="literal"||!/[$`]/.test(ut.raw))?qo(at,D??new Map):at;if(!wx(ct)||/[\s$`*?[]/.test(ct)||B.entryKind(ct)!=="present"||!B.isDirectory(ct))return null;return B.realpath(ct)}function mm(O,D){if(D.entryKind(dm(O,".git"))!=="missing")return O;let B=_x(O);return B===O?null:mm(B,D)}var kx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Ox=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ys(O,D){return pm(O,D)}function pm(O,D,B){let Q=O.map(t),ee=Kf(Q,D.environment.env,D.envAssignments),he=ee.blockedReason?wt(St("git.alias-config",ee.blockedReason),D.policy):null;if(he)return he;let je=ee.tokens;if((Ud(D.envAssignments)||qf(Q,D.environment.env,D.envAssignments))&&Mx(je))return St("git.ssh-env",kx);let at=Zf(je,(ct)=>{let ut=Qr(Q,D.cwd,D.environment.paths).gitCwd;return ut!==null&&D.environment.paths.entryKind(Ix(ut,ct))!=="missing"});if(!at)return null;if(ee.expanded||ee.blockedReason)return at;let lt=um(Q,at,D)??fm(O,at,D);if(!lt)return at;return B?.(lt),null}function gm(O,D){let B=null;return{match:pm(O,D,(ee)=>{B=ee}),relaxation:B}}function Mx(O){let{subcommand:D,rest:B}=Sn(O),Q=D?.toLowerCase();if(!Q)return!1;if(Ox.has(Q))return!0;if(Q==="archive")return en(B).before.some((ee)=>It(ee,"--remote"));return Q==="remote"&&Dx(B)}function Dx(O){return O.find((D)=>!Nx(D))?.toLowerCase()==="update"}function Nx(O){return O==="-v"||It(O,"--verbose")||It(O,"--no-verbose")}import{isAbsolute as hR}from"node:path";function hm(O,D,B,Q){let ee=O.slice(0,D),he=O.slice(D+B);return Q.startsWith(ee)&&Q.endsWith(he)?Q.slice(ee.length,Q.length-he.length):null}function bs(O,D,B){let Q=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,ee=new Set(O.map(Q));return Array.from(D).some((he)=>B(he).some((je)=>!ee.has(Q(je))))}var ym="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Wx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Sm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Gx="rm -rf in home directory is dangerous. Change to a project directory first.",bm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Sm},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Wx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Gx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:ym},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Lx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:ym}};function Ss(O,D){let B=_r({...D,allowPaths:D.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=O.map(t),ee=Dn(Q),he=Hf(Q),je=zx(O);for(let at of je){let lt=$o(at.word);if(ee&&lt.unsafeBraceExpansion){let ct=wt(Bo({kind:"outside_anchored_cwd"},B,D.policy,bm),D.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let ut=pn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&B.resolvedCwd&&Er(ut,B.resolvedCwd,B.protectedGitMetadata,he,B.environment,B.budget))return St("rm.git-metadata",x);if(he&&!ee){let dt=On(ut,B,ft);if(dt.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home",Sm);if(dt.kind==="git_metadata_target")return St("rm.git-metadata",x);continue}if(!ee)continue;for(let dt of Fx(ut,B,ft)){let mt=Bo(dt,B,D.policy,bm),pt=wt(mt,D.policy);if(pt)return pt}}}return null}function Fx(O,D,B){let Q=On(O,D,B);if(Q.kind==="cwd_self_target")return[Q,On(O,D,{...B,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let ee=On(O,D,{...B,skipHomeCwd:!0});if(ee.kind!=="cwd_self_target")return[Q,ee];return[Q,ee,On(O,D,{...B,skipHomeCwd:!0,skipCwdSelf:!0})]}function zx(O){let D=[],B=!1;for(let Q of O.slice(1)){let ee=t(Q);if(!ee)continue;if(ee==="--"){B=!0;continue}if(B){D.push({text:ee,word:Q});continue}if(!ee.startsWith("-"))D.push({text:ee,word:Q})}return D}var lr={kind:"none"},Tr={kind:"dynamic"},Bx=new Set(["<","<<","<<-","<<<","<&","<>"]),vm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,$x=/^(?:[0-9]+|[@*])$/,Ux=tr.maxWords,Hx=tr.maxInputLength;function Em(O){if(!O||Tt(kt(O.words[0]?.text??""))!=="printf")return;if(O.words.some((ee)=>ee.provenance!=="literal"))return;let D=O.words.slice(O.words[1]?.text==="--"?2:1),B=D[0]?.text;if(B===void 0)return"";let Q=D.slice(1).map((ee)=>ee.text);if(B==="%s")return Q.join("");if(B==="%s\\n"||B===`%s
-`)return`${Q.join(`
-`)}
-`;if(B.includes("%")||/\\(?![\\nrt])/.test(B))return;return B.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Cs(O){let D=Yo(O[1])==="--"?2:1;if(O.length<=D)return lr;let B=O.slice(D);if(!B.every(Es))return Tr;return{kind:"literal",source:B.map(t).join(" ")}}function xm(O){let D=Yo(O[1])==="--"?2:1,B=O[D],Q=Yo(B);if(B===void 0||O.length<=D+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return lr;if(!Es(B))return Tr;return{kind:"literal",source:Q}}function vs(O,D){let B=Vx(O);if(B===-1)return lr;let Q=Kx(D);if(!Q)return lr;let ee=[],he=Q.command?.length??0;for(let je of Q.references){let at=Yx(je,O,B,Q.ifs);if(!at)return Tr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),ee.length+at.length>Ux||he>Hx)return Tr;ee.push(...at)}if(Q.command==="eval")return{kind:"literal",source:ee.join(" ")};if(ee.length===0||/\s/.test(ee[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...ee.map(Xx)].filter((je)=>je!==null).join(" ")}}function Rm(O,D,B,Q){if(!hn(O.map(t)).readsStdinAsCommands)return lr;let ee=D.filter((he)=>(he.fd===void 0||he.fd===0)&&Bx.has(he.operator)).at(-1);if(ee){if(ee.operator==="<<"||ee.operator==="<<-")return lr;if(ee.operator!=="<<<"||ee.target?.provenance!=="literal")return Tr;return{kind:"literal",source:ee.target.text}}if(!B)return lr;return Q===void 0?Tr:{kind:"literal",source:Q}}function qn(O){let D=hn(O.map(t)).scriptIndex;if(D===null)return lr;let B=O[D],Q=Yo(B);return zi(B,Q)?{kind:"literal",source:Q}:Tr}var jx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function jl(O){if(O.words.length!==2||O.redirections.length!==0||O.nested.length!==1)return!1;let D=O.words[0],B=O.words[1];if(!D||D.provenance!=="literal"||D.quoted||D.raw!==D.text||!B)return!1;if(!(D.text==="eval"&&B.quoted&&B.parts.length===3&&B.parts[0]?.raw==='"'&&B.parts[1]?.provenance==="command-substitution"&&B.parts[1].raw.startsWith("$(")&&B.parts[2]?.raw==='"'||D.text==="eval"&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("$(")||(D.text==="source"||D.text===".")&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("<(")))return!1;let ee=O.nested[0];if(ee?.status!=="complete"||ee.nodes.length!==1)return!1;let he=ee.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||Rn(je)!==null)return!1;let at=Tt(kt(je));return!jx.has(at)&&!Kt.has(at)&&!wr(at)}function Vx(O){return hn(O.map(t)).commandIndex??-1}function Kx(O){let D=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(O.trim()),B=D?.[4]??O.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(B),ee=(Q?.[3]??B).split(/\s+/).map(qx);if(ee.length===0||ee.some((he)=>he===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:ee.filter((he)=>!!he),ifs:D?D[1]??D[2]??D[3]??"":` 	
-`}}function qx(O){let D=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(O),B=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(O),Q=D??B;if(!Q)return null;let ee=Q[1]??Q[2];return{parameter:ee==="@"||ee==="*"?ee:Number(ee),quoted:D!==null}}function Yx(O,D,B,Q){let ee=D.slice(B+2);if(O.parameter==="@")return O.quoted?$l(ee):Zx(ee,Q);if(O.parameter==="*"){let at=$l(ee);if(!at)return;let lt=at.join(Q[0]??"");return O.quoted?[lt]:Ul(lt,Q)}let he=D[B+1+O.parameter];if(he&&!Es(he))return;let je=Yo(he);return O.quoted?[je]:Ul(je,Q)}function $l(O){return O.every(Es)?O.map(t):void 0}function Zx(O,D){let B=$l(O);if(!B)return;let Q=B.map((ee)=>Ul(ee,D));return Q.some((ee)=>ee===void 0)?void 0:Q.flatMap((ee)=>ee??[])}function Ul(O,D){if(["*","?","[","]"].some((B)=>O.includes(B)))return;if(D==="")return O===""?[]:[O];if(D===` 	
-`)return O.trim().split(/\s+/).filter(Boolean);if(D.length!==1)return;return D===" "||D==="\t"||D===`
-`?O.trim().split(/\s+/).filter(Boolean):O.split(D).filter(Boolean)}function Es(O){if(!O)return!0;return O.provenance==="unknown"?!/[$`]/.test(t(O)):O.provenance==="literal"}function Yo(O){return O?t(O):""}function Xx(O){return`'${O.replaceAll("'",`'"'"'`)}'`}function Vl(O,D){return Hl(h(O,"posix"),D)}function Xo(O){return Vl(O,new Set(Array.from(O.matchAll(vm)).flatMap((D)=>{let B=D[1]??D[2];return B===void 0?[]:[B]})))}function Hl(O,D){if(O.status==="invalid"||O.status==="limited")return!1;let B=new Set(D);for(let Q of O.nodes){if(Q.kind==="group"){if(Hl(Q.body,B))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((ee)=>Hl(ee,B))||_m(Q.words,B))return!0;nR(Q,B)}return!1}function _m(O,D){let B=O.findIndex((je)=>Rn(je.text)===null);if(B===-1)return!1;let Q=O[B];if(!Q)return!1;if(Zo(Q,D))return!0;let ee=kt(Q.text);if(ee==="source"||ee==="."){let je=O[B+1]?.text==="--"?B+2:B+1;return Cm(O[je],D)}if(Kt.has(ee)){let je=O.slice(B),at=hn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&Cm(je[lt],D)}let he=Jx(O,B,D);if(he===null)return!1;if(he===-1)return!0;return _m(O.slice(he),D)}function Jx(O,D,B){let Q=kt(O[D]?.text??"");if(Q==="command")return Qx(O,D+1);if(Q==="exec")return eR(O,D+1);if(Q==="env")return tR(O,D+1,B);return null}function Qx(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return B}return null}function eR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(Q==="-a"){B++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return B}return null}function tR(O,D,B){for(let Q=D;Q<O.length;Q++){let ee=O[Q],he=ee?.text??"";if(he==="--")return O[Q+1]?Q+1:null;if(he==="-S"||he==="--split-string")return Zo(O[Q+1],B)?-1:Q+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return Zo(ee,B)?-1:Q+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){Q++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(Rn(he))continue;return Q}return null}function nR(O,D){if(!O.words.every((B)=>Rn(B.text)!==null))return;for(let B of O.words){let Q=Rn(B.text);if(!Q)continue;if(Zo(B,D))D.add(Q.name)}}function Zo(O,D){if(!O)return!1;return O.parts.filter((B)=>B.provenance==="variable").some((B)=>Array.from(B.raw.matchAll(vm)).some((Q)=>{let ee=Q[1]??Q[2];return ee!==void 0&&($x.test(ee)||D.has(ee))}))}function Cm(O,D){return!!O&&(O.parts.some((B)=>B.provenance!=="literal"&&B.provenance!=="variable")||Zo(O,D))}var rR=["--init-file","--rcfile"],oR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Yn(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B)continue;if(B==="-c")return wm(O,D,!0);if(B.startsWith("-")&&B.includes("c")&&!B.startsWith("--")){let Q=wm(O,D,!1);if(Q!==null)return Q}}return null}function Zn(O){let D=Tt(O[0]??"").toLowerCase();if(D==="zsh"||D==="ksh")return hn(O).syntaxCheck;let B=!1;for(let Q of O.slice(1)){if(Q==="--")return B;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))B=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return B;let ee=Q.slice(1);if(ee.includes("n"))B=!0;if(ee.includes("c"))return B}return B}function wm(O,D,B){if(O[D+1]==="--")return O[D+2]||null;let Q=O[D+1];if(!Q||!B&&Q.startsWith("-"))return null;return Q}function Pm(O){let D=Tt(O[0]??"").toLowerCase(),B=iR(O,D),Q=oR.get(D)??null,ee=B.argvSource?.kind!=="absent";return{argvSource:D==="bash"?B.argvSource:null,argvSourceApplies:D==="bash"&&B.interactive&&B.argvSource?.kind==="literal",envName:Q,envSourceApplies:ee&&(Q==="BASH_ENV"?!B.interactive:Q==="ENV"&&B.interactive)}}function iR(O,D){let B=hn(O),Q=B.commandIndex??B.scriptIndex??O.length,ee=[],he=!1,je=!0;for(let at=1;at<Q;at++){let lt=O[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(D==="bash"&&je?rR.find((dt)=>lt===dt):void 0){let dt=O[at+1];ee.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(D==="bash"&&pa.has(ft)&&!lt.includes("="))at++;continue}if(D==="bash")je=!1;let ct=ga(D,lt,O[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:ee.at(-1)??null,interactive:he}}var Kl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ql="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",sR="__CC_SAFETY_NET_XARGS_INPUT__",xs="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Rs="rm",aR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,lR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,cR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uR=/^(?:[0-9]+|[@*])$/;function Im(O,D){let B=O.map(t),{childStart:Q,replacementToken:ee}=Ir(B),he=B.slice(Q),je=St("xargs.shell-dynamic",ql);if(fR(he,ee,D)&&wt(je,D.policy))return wt(je,D.policy);for(let at of Mn(he,D)){let lt=at.tokens,ct=ee!==null&&lt[0]!==he[0]&&(lt[0]?.includes(ee)??!1)?wt(je,D.policy):null;if(ct)return ct;let ut=Lm(lt,ee,at.wrapperEnvAssignments),ft=at.head==="rm"&&ee!==null&&Dm(lt,ee),dt=D.analyzeChild(lt,{...Pr(at,D),dynamicInput:ut,dynamicSourceInput:ft||Om(lt,at.head,ee,at.wrapperEnvAssignments,ut,D.environment,D.strict?void 0:D.analyzeNested),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:St("xargs.rm-recursive-force-dynamic",Kl)});if(dt)return dt;let mt=dR(lt,ee,D.policy?.rules??[],wt(je,D.policy));if(mt)return mt;if(at.head==="git"){let gt=ee===null?[...lt,sR]:lt,ht=ee!==null&&(lt.some((Ct)=>Ct.includes(ee))||Array.from(at.envAssignments.values()).some((Ct)=>Ct.includes(ee))),yt=D.analyzeChild(gt,{...Pr(at,D),worktreeMode:ee===null||ht?!1:D.worktreeMode});if(yt)return yt}let pt=_(lt,D.policy?.rules??[]);if(pt)return pt}return null}function dR(O,D,B,Q){if(B.length===0)return null;if(D===null){for(let he of B){let je=_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],B);if(je)return je}return null}let ee=kt(O[0]??"");if(!B.some((he)=>kt(he.command)===ee))return null;return O.slice(1).some((he)=>he.includes(D))?Q:null}function km(O,D,B){let Q=O.indexOf(D);if(Q===-1||O.indexOf(D,Q+D.length)!==-1)return[];let ee=hm(O,Q,D.length,B);return ee===null?[]:[ee]}function Om(O,D,B,Q,ee,he,je){if(Kt.has(D)){if(Zn(O))return!1;if(B!==null&&mR(O,B,je))return!0;let at=Yn(O);if(!at){let lt=qn($t(O));if(lt.kind==="literal")return B!==null&&lt.source.includes(B);return lt.kind==="none"&&ee}if(B!==null&&at.includes(B)&&!Mm(at,B,je))return!0;if(xn(at))return!0;return pR(at,B,Q)}if(An(D))return Am(O,B,ji,Gd(D));if(En.has(D))return Am(O,B,_l,Ff);if(D==="eval"){let at=Cs($t(O));if(at.kind==="dynamic")return!0;if(B!==null)return at.kind==="literal"&&at.source.includes(B);return ee}if(D==="find")return gR(O,B,he);if(D==="git"){let at=Sn(O);return B===null?at.subcommand===null:(at.subcommand?.includes(B)??!1)||at.subcommand!==null&&Jr.has(at.subcommand.toLowerCase())&&Nm(at.rest,B).some((lt)=>lt.includes(B))}return!1}function Mm(O,D,B){if(B===void 0)return!1;let Q=D.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${Q}`).test(O)||/\bcase\b/.test(O))return!1;let he=O.replaceAll(D,"/");return xn(he)===null&&B(he)===null}function Am(O,D,B,Q){let ee=B(O);if(D===null)return ee.optionsOpen||B([...O,xs]).sources.some((at)=>at.value===xs);if(ee.sources.some((at)=>at.value.includes(D)))return!0;let he=Q.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${xs}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${xs}`]:[]]),je=new Set(he.flatMap((at)=>O.flatMap((lt)=>km(lt,D,at))));return bs(ee.sources,je,(at)=>B(O.map((lt)=>lt.replaceAll(D,at))).sources)}function fR(O,D,B){if(O.length===0||(O[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(Mn(O,B),(he)=>he.head)),ee=D===null?[...O,Rs]:O.map((he,je)=>je===0?he:he.replaceAll(D,Rs));return Array.from(Mn(ee,B)).some((he)=>he.head===Rs&&!Q.has(Rs))}function Dm(O,D){return Nm(O.slice(1),D).some((B)=>B.includes(D)&&(B.startsWith("-")||B.startsWith(D)))}function Nm(O,D){let B=O.findIndex((Q)=>Q==="--"&&!Q.includes(D));return B===-1?O:O.slice(0,B)}function Lm(O,D,B){if(D===null)return!0;return O.some((Q)=>Q.includes(D))||Array.from(B.values()).some((Q)=>Q.includes(D))}function mR(O,D,B){let Q=hn(O),ee=Q.commandIndex===null?"":O[Q.commandIndex]??"";if(ee.includes(D)&&!Mm(ee,D,B)||Q.scriptIndex!==null&&(O[Q.scriptIndex]??"").includes(D))return!0;return["-c","-nc","-cn",`--${D}`,D].some((je)=>O.some((at,lt)=>{if(lt===0||!at.includes(D))return!1;return km(at,D,je).some((ut)=>{let ft=O.map((mt,pt)=>pt===lt?mt.replaceAll(D,ut):mt),dt=hn(ft);if(dt.commandIndex===null&&dt.scriptIndex===null)return!1;if(Q.commandIndex===null&&dt.commandIndex!==null)return!0;if(Q.scriptIndex===null&&dt.scriptIndex!==null)return!0;if(dt.commandIndex!==null&&(ft[dt.commandIndex]??"").includes(ut))return!0;return dt.scriptIndex!==null&&(ft[dt.scriptIndex]??"").includes(ut)})}))}function pR(O,D,B){let Q=new Set(D===null?[]:Array.from(B).filter(([,ee])=>ee.includes(D)).map(([ee])=>ee));for(let ee of O.matchAll(aR))if(Tm(ee,Q))return!0;for(let ee of O.matchAll(lR))for(let he of(ee[1]??"").matchAll(cR))if(Tm(he,Q))return!0;return Vl(O,Q)}function Tm(O,D){let B=O[1]??O[2];return B!==void 0&&(uR.test(B)||D.has(B))}function gR(O,D,B){if(D===null)return!0;let Q=!1,ee=0;for(let he=1;he<O.length;he++){let je=O[he]??"";if(!Q&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(D)===0)return!0;continue}if(Q=!0,ee>0){ee--;continue}if(Kn(je)){let lt=Vo(O,he);he=lt.nextIndex-1;for(let ct of Mn(lt.tokens,{environment:B,cwd:void 0})){let ut=Lm(ct.tokens,D,ct.wrapperEnvAssignments);if(ct.head==="rm"&&Dm(ct.tokens,D)||Om(ct.tokens,ct.head,D,ct.wrapperEnvAssignments,ut,B))return!0}continue}let at=sr(je);if(at>0){if(ee=at,je.includes(D))return!0;continue}if(je.includes(D))return!0}return!1}function Ir(O){let D=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),B=null,Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--")return{childStart:Q+1,replacementToken:B};if(!ee.startsWith("-"))return{childStart:Q,replacementToken:B};if(ee==="-I"){B=O[Q+1]??"{}",Q+=2;continue}if(ee.startsWith("-I")&&ee.length>2){B=ee.slice(2),Q++;continue}if(ee==="--replace"){B="{}",Q++;continue}if(ee.startsWith("--replace=")){let he=ee.slice(10);B=he===""?"{}":he,Q++;continue}if(ee==="-J"){B=O[Q+1]??"{}",Q+=2;continue}Q+=D.has(ee)?2:1}return{childStart:O.length,replacementToken:B}}var Jo="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Qo="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",yR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",bR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ws=/\{[^{}\s]*\}/g,Wm=/\{\}|\{-?\d+\}/g,SR=["e","f","source","file","-e","-f","--source","--file"],CR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],vR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),ER=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Gm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),xR=new Set(["--workdir","--wd"]),Fm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function _n(O,D){for(let B of O){let Q=D(B);if(Q)return Q}return null}function Hm(O){return _n([...O],(D)=>xn(D))}function jm(O,D){let B=O.map(t);if((D.envAssignments?.has("PARALLEL")?D.envAssignments.get("PARALLEL"):D.environment.env.get("PARALLEL"))?.trim()){let pt=eo(D);if(pt)return pt}if(B.length===2&&(B[1]==="--version"||B[1]==="--help"))return null;let ee=ep(B),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:ut,dryRun:ft}=ee;if(ct){let pt=eo(D);if(pt)return pt;let gt=Hm(D.envAssignments?.values()??[]);if(gt)return gt}if(lt){let pt=TR(D);if(pt)return pt}if(ut!==void 0&&at){let pt=eo(D);if(pt)return pt}let dt=IR(ut,D.cwd,D.environment.paths);if(dt===null){let pt=eo(D);if(pt)return pt}let mt=at?{...D,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===D.cwd?D:{...D,cwd:dt};if(ft){if([...Mn(he,mt)].flatMap((gt)=>[...gt.envAssignments.values()]).some(Xl)){let gt=eo(D);if(gt)return gt}return null}if(he.length===0){let pt=je.map((ht)=>ht[0]??"");D.budget.charge("derivedTokens",pt.length);let gt=Ym(mt.envAssignments,mt.cwd,at);return _n(pt,(ht)=>D.analyzeNested(ht,gt))}return _n(Mn(he,mt),(pt)=>RR(pt,ee,D,mt))}function RR(O,D,B,Q){let{jobs:ee,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=D,lt=O.tokens,ct=[...O.envAssignments.values()];if(ct.some(Jm)){let ht=eo(B);if(ht)return ht}let ut=Hm(ct);if(ut)return ut;let ft=ct.some(Nt),dt=he||ft,mt=at&&dt,pt=Ym(O.envAssignments,O.wrapperCwd,je||mt);if(Kt.has(O.head)){let ht=()=>{if(!he||ee.length===0)return null;return _n(ee,(Et)=>B.analyzeChild(_s(lt,Et,B.budget),Pr(O,Q)))};if(Zn(lt))return ht();let yt=Yn(lt);if(yt){if(Qm(yt)){let xt=cr(B);if(xt)return xt;if(ee.length===0)return null;return _n(ee,(_t)=>B.analyzeNested($m(yt,_t,B.budget),pt))}if(Nt(yt)){if(ee.length>0)return _n(ee,(Ut)=>B.analyzeNested($m(yt,Ut,B.budget),pt));let xt=Ko(yt);if(xt?.[0]&&kt(xt[0])==="rm"&&Dn(xt)){let Ut=Bm(B);if(Ut)return Ut}let _t=xt?B.analyzeChild(xt,{...Pr(O,Q),dynamicInput:at,shellDynamicMatch:St("parallel.shell-dynamic",Qo),rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)}):null;if(_t)return _t;return B.analyzeNested(yt,pt)}let Et=!ft&&(!he||ee.length>0)?(ee.length>0?ee:[void 0]).map((xt)=>vs($t(xt===void 0?lt:he?lt.map((_t)=>Zm(_t,xt)):[...lt,...xt]),yt)):[];if(Et.some((xt)=>xt.kind==="dynamic")){let xt=cr(B);if(xt)return xt}let vt=Et.flatMap((xt)=>xt.kind==="literal"?[xt.source]:[]);if(vt.length>0)return B.budget.charge("derivedTokens",vt.length),_n(vt,(xt)=>B.analyzeNested(xt,pt));if(Xo(yt)){let xt=cr(B);if(xt)return xt}let Pt=B.analyzeNested(yt,pt);if(Pt)return Pt;if(dt)return cr(B);return null}let Ct=qn($t(lt));if(Ct.kind==="dynamic"||Ct.kind==="literal"&&Nt(Ct.source))return cr(B)??ht();if(Ct.kind==="literal")return ht();if(ee.length>0){let Et=cr(B);if(Et)return Et;let vt=ht();if(vt)return vt;if(he)return null;let Pt=ee.flatMap((xt)=>xt[0]===void 0?[]:[xt[0]]);return B.budget.charge("derivedTokens",Pt.length),_n(Pt,(xt)=>B.analyzeNested(xt,pt))}if(dt||at)return cr(B)??ht();return null}if(O.head==="rm"&&Dn(lt)){if(he&&ee.length>0)return _n(ee,(yt)=>Yl(_s(lt,yt,B.budget,Wm),O.cwd,Q));if(ee.length>0)return _n(ee,(yt)=>Yl(Um(lt,yt,B.budget),O.cwd,Q));let ht=Yl(lt.flatMap((yt,Ct)=>{if(Ct===0||!Nt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Wm,"")]:[]}),O.cwd,Q);if(ht)return ht;return Bm(B)}let gt=ee.length>0?ee:[void 0];return _n(gt,(ht)=>{let yt=ht===void 0?lt:he?_s(lt,ht,B.budget):Um(lt,ht,B.budget),Ct=St("parallel.shell-dynamic",Qo),Et=at&&O.head==="find"?AR(yt,Q):null,vt=Km(yt,at,B)??Et?.customResult??null,Pt=kt(O.head),xt=at&&(Pt==="rm"&&Zl(yt)||Pt==="xargs"&&qm(yt)||Et?.rmOptions===!0),_t=at&&(xt||Et?.executedSource===!0||Et===null&&Vm(yt,Pt)),Ut=B.analyzeChild(yt,{...Pr(O,Q),worktreeMode:je||at||dt?!1:B.worktreeMode,dynamicInput:at||dt,dynamicRmInput:xt,dynamicSourceInput:vt!==null||_t,shellDynamicMatch:Ct,dynamicSourceMatch:Ct,rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)});if(_t){let jt=wt(Ct,B.policy);if(jt)return jt}return Ut??vt??_(yt,B.policy?.rules??[])})}function Vm(O,D){if(Nt(O[0]??""))return!0;if(D==="eval"||D==="source"||D===".")return!0;if(D==="parallel"||D==="xargs")return!0;if(Kt.has(D))return PR(O);if(D==="git")return _R(O);if(D==="find")return!0;if(En.has(D))return zm(O,SR,jo);if(An(D))return zm(O,CR,Hi);return!1}function Zl(O){let D=O.indexOf("--"),B=O.slice(1,D===-1?void 0:D);if(!O.some(Nt))return D===-1;return B.some((ee)=>Nt(ee)&&(ee.startsWith("-")||Qm(ee)))}function _R(O){if(wR(O))return!0;let D=Sn(O);if(D.subcommand===null||Nt(D.subcommand))return!0;if(!Jr.has(D.subcommand.toLowerCase()))return!1;let B=D.rest.indexOf("--"),Q=D.rest.slice(0,B===-1?void 0:B);if(!O.some(Nt))return B===-1;return Q.some(Nt)}function wR(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B||B==="--"||!B.startsWith("-"))return!1;if(B==="-c"||B==="--config-env"){if(Nt(O[D+1]??""))return!0;D++;continue}if(B.startsWith("-c")&&B.length>2||B.startsWith("--config-env=")){if(Nt(B))return!0;continue}if(Nt(B))return!0}return!1}function PR(O){if(Zn(O))return!1;let D=Yn(O);if(D!==null)return Nt(D);let B=qn($t(O));if(B.kind==="literal")return Nt(B.source);if(B.kind==="dynamic")return!0;return!O.some(Nt)}function zm(O,D,B){let Q=B(O);if(Q.some((ee)=>Nt(ee.value)))return!0;if(!O.some(Nt))return B([...O,Fm]).some((ee)=>ee.value===Fm);return bs(Q,D,(ee)=>B(O.map((he)=>Zm(he,[ee]))))}function Km(O,D,B){let Q=B.policy?.rules??[];if(!D||Q.length===0)return null;let ee=Q.filter((he)=>kt(he.command)===kt(O[0]??""));if(ee.length===0)return null;if(O.slice(1).some(Nt))return cr(B);return _n(ee,(he)=>_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function AR(O,D){let B={customResult:null,executedSource:!O.some(Nt),rmOptions:!1},Q=!1,ee=0,he=null,je=()=>{if(!he?.some(Nt))return;for(let at of Mn(he,D))B.executedSource||=Vm(at.tokens,at.head),B.rmOptions||=at.head==="rm"&&Zl(at.tokens)||at.head==="xargs"&&qm(at.tokens),B.customResult??=Km(at.tokens,!0,D)};for(let at of O.slice(1)){if(!Q&&!at.startsWith("-")&&at!=="!"&&at!=="("){B.executedSource||=Nt(at);continue}if(Q=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(ee>0){ee--;continue}if(Kn(at)){he=[],B.executedSource||=Nt(at);continue}let lt=sr(at);if(lt>0){ee=lt,B.executedSource||=Nt(at);continue}B.executedSource||=Nt(at)}return je(),B}function qm(O){let D=O.slice(Ir(O).childStart);return kt(D[0]??"")==="rm"&&Zl(D)}function Ps(O,D){return(B)=>wt(St(O,D),B.policy)}var cr=Ps("parallel.shell-dynamic",Qo),TR=Ps("parallel.command-stream-dynamic",yR),eo=Ps("parallel.command-stream-dynamic",bR),Bm=Ps("parallel.rm-recursive-force-dynamic",Jo);function Yl(O,D,B){return wt(Ss($t(O),{environment:B.environment,cwd:D,budget:B.budget,originalCwd:B.originalCwd,strict:B.strict,paranoid:B.paranoidRm,allowTmpdirVar:B.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(B.envAssignments??new Map,B.environment),trustedTmpdirValue:xr(B.envAssignments??new Map,B.environment),protectedGitMetadata:B.protectedGitMetadata,policy:B.policy}),B.policy)}function Ym(O,D,B){let Q={};if(O)Q.envAssignments=O;if(B)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(D!==void 0)Q.effectiveCwd=D;return Object.keys(Q).length>0?Q:void 0}function Zm(O,D){return O.replace(ws,(B)=>Xm(B,D))}function _s(O,D,B,Q=ws){return B.charge("derivedTokens",O.reduce((ee,he)=>ee+1+Math.floor(he.length/64),0)),O.map((ee)=>ee.replace(Q,(he)=>{let je=Xm(he,D);return B.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function $m(O,D,B){return _s([O],D,B)[0]??""}function Um(O,D,B){return B.charge("derivedTokens",O.length+D.length),[...O,...D]}function Xm(O,D){let B=/^\{(-?\d+)[^{}\s]*\}$/.exec(O)?.[1];if(B===void 0)return D[0]??"";let Q=Number(B);return D[Q>0?Q-1:D.length+Q]??""}function Nt(O){return O.search(ws)!==-1}function Jm(O){if(Xl(O))return!0;for(let D of O.matchAll(ws))if(!/^(?:\{\}|\{\d+\})$/.test(D[0]))return!0;return!1}function Xl(O){let D=O.indexOf("{=");return D!==-1&&O.indexOf("=}",D+2)!==-1}function Qm(O){return/^\{[^{}\s]*\}$/.test(O)}function IR(O,D,B){if(O===void 0)return;if(O==="..."||/^~|[{}$`*?[]/.test(O))return null;if(!D&&!hR(O))return null;try{return nr(D??O,O,B)}catch{return null}}function ep(O){let D=1,B=[],Q=O.length,ee=-1,he=!1,je=!1,at,lt=!1,ct=O.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(D<O.length){let pt=O[D];if(pt===void 0)break;if(pt===":::"){ee=D;break}if(pt==="--"){let Et=Al(O,D+1);B.push(...Et.templateTokens),Q=D+1,ee=Et.markerIndex;break}if(!pt.startsWith("-")){let Et=Al(O,D);B.push(...Et.templateTokens),Q=D,ee=Et.markerIndex;break}let gt=O[D+1],ht=pt.indexOf("="),yt=ht===-1?pt:pt.slice(0,ht),Ct=ht===-1?void 0:pt.slice(ht+1);if(pt==="--dry-run"){lt=!0,D++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?gt:pt.slice(2))!=="{}",D+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,D+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let Et=yt==="--replace"?Ct:pt.slice(2);ct||=Et!==""&&Et!=="{}",D++;continue}if(pt==="-a"||ER.has(yt)){ct=!0,D+=Ct===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,D++;continue}if(yt==="--env"){ct=!0,D+=Ct===void 0?2:1;continue}if(Gm.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,D+=Gm.has(pt)?2:1;continue}if(xR.has(yt)){ct=!0;let Et=Ct??gt;if(Et===void 0||Et===":::"||Et==="--"){D++;continue}at=Et,D+=Ct===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){D++;continue}if(pt.startsWith("--")&&Ct!==void 0){D++;continue}if(vR.has(pt)){if(gt===void 0||gt===":::"||gt==="--"){ct=!0,D++;continue}D+=2;continue}D+=pt==="-j"||pt==="--jobs"?2:1}ct||=B.some(lt?Xl:Jm);let ut=[];if(ee!==-1){let pt=[];for(let gt=ee+1;gt<O.length;gt++){let ht=O[gt];if(ht===":::"){ut.push(pt),pt=[];continue}if(ht!==void 0)pt.push(ht)}ut.push(pt)}ct||=ut.length>1;let ft=kR(ut),dt=B.some(Nt),mt=B.length===0&&ee===-1;return{template:B,jobs:ft,childStart:Q,templateHasPlaceholder:dt,runsRemotely:he,usesStdin:je||ee===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function kR(O){if(O.length===0||O.some((B)=>B.length===0))return[];let D=[[]];for(let[B,Q]of O.entries()){if(Q.length===1){let he=Q[0];if(he===void 0)return[];for(let je of D)je.push(he);if(D.length*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ee=[];for(let he of D)for(let je of Q){if((ee.length+1)*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");ee.push([...he,je])}D=ee}return D}function tp(O){return ep(O).childStart}var OR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",As="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ql(O){return O?.parts.some((D)=>D.provenance==="command-substitution")??!1}function Jl(O){return O?.parts.some((D)=>D.provenance==="literal"&&D.raw.replace(/^["']/,"").startsWith("-"))??!1}function rp(O,D,B,Q,ee=!1,he){let at=(xo(O,D)||Q&&O!=="powershell"&&D[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",ee)?St("shell.dynamic-executable",OR):null;return wt(at,he)??op(O,D,B,ee,he)}function op(O,D,B,Q,ee){if(D.length<2)return null;let he=D.flatMap((at,lt)=>Ql(at)?[lt]:[]);if(he.length===0)return null;let je=kt(D[0]?.text??"");if(je==="git"){let at=X(O,D),lt=DR(at);if(Jt(ee,"shell.dynamic-structure",Q)&&he.some((ft)=>ft<=lt))return wt(St("shell.dynamic-structure",As),ee);if(wt(ys(at,{environment:B}),ee))return null;let ct=D[lt]?.text.toLowerCase(),ut=at.findIndex((ft,dt)=>dt>lt&&t(ft)==="--");if(Jt(ee,"shell.dynamic-structure",Q)&&ct&&Jr.has(ct)&&he.some((ft)=>ft>lt&&(ut===-1||ft<ut)))return wt(St("shell.dynamic-structure",As),ee);return null}if(je==="find")return Jt(ee,"shell.dynamic-structure",Q)&&NR(D)?wt(St("shell.dynamic-structure",As),ee):null;if(je==="rm"){let at=D.findIndex((ct,ut)=>ut>0&&t(ct)==="--"),lt=Dn(D.map(t));return Jt(ee,"shell.dynamic-structure",Q)&&he.some((ct)=>(at===-1||ct<at)&&(ct<D.length-1||!lt))?wt(St("shell.dynamic-structure",As),ee):null}if(je==="xargs")return np(O,D.slice(Ir(D.map(t)).childStart),"xargs",B,Q,ee);if(je==="parallel")return np(O,D.slice(tp(D.map(t))),"parallel",B,Q,ee);return null}function np(O,D,B,Q,ee,he){if(D.length===0)return null;let je=MR(D,Q);if(xo(O,je)){let lt=wt(St(`${B}.shell-dynamic`,B==="xargs"?ql:Qo),he);if(lt)return lt}let at=op(O,je,Q,ee,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>Ql(lt)&&Jl(lt)))return wt(St(`${B}.rm-recursive-force-dynamic`,B==="xargs"?Kl:Jo),he);return null}function MR(O,D){let B=Sr(O,D),Q=B.rewritten?$t(B.words.map(t)):B.words,ee=Q[0];return ee&&t(ee)==="busybox"?Q.slice(1):Q}function DR(O){let D=1;while(D<O.length){let B=O[D],Q=B?t(B):"";if(gn.has(Q)){D+=2;continue}if(Q.startsWith("-")){D++;continue}return D}return D}function NR(O){let D=!1,B=0,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(!je)continue;let at=Ql(je);if(B>0){B--;continue}if(ee){if(je.text===";"||je.text==="+"){ee=!1,D=!0,Q=!1;continue}if(at&&(Q||Jl(je)))return!0;Q=!1;continue}if(!D&&!je.text.startsWith("-")){if(at&&(he>1||Jl(je)))return!0;continue}if(D=!0,at)return!0;let lt=sr(je.text);if(lt>0){B=lt;continue}if(Kn(je.text))ee=!0,Q=!0}return!1}function ec(O,D){return O.some((B)=>{if(B.value==="-"&&(B.kind==="main-script"||B.kind==="program-file"))return!0;return!zi(D[B.tokenIndex],B.value)})}var LR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",WR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",GR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function ip(O,D){let B=D.slice(1);if(O==="dd"&&B.some((Q)=>/^of=\/dev\/.+/.test(Q)))return St("dd.device-write",LR);if((O==="mkfs"||O.startsWith("mkfs."))&&B.some((Q)=>Q.startsWith("/dev/")))return St("mkfs.device",WR);if(O==="shred"&&B.length>0)return St("shred.target",GR);return null}var ap=[{heads:new Set(["rm","rmdir"]),analyze:(O)=>Ss(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoid:O.options.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,policy:O.options.policy,budget:O.options.budget})},{heads:new Set(["git"]),analyze:(O)=>ys(O.words,tc(O))},{heads:new Set(["find"]),analyze:(O)=>jf(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,policy:O.options.policy,analyzeTokens:O.analyzeChildTokens,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["xargs"]),analyze:(O)=>Im(O.words,{...sp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["parallel"]),analyze:(O)=>jm(O.words,{...sp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})}];function sp(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoidRm:O.options.paranoidRm,paranoidInterpreters:O.options.paranoidInterpreters,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,worktreeMode:O.options.worktreeMode,policy:O.options.policy}}function kr(O){return O?{id:O.ruleId??"",reason:O.reason,intent:O.intent??"manual_only"}:null}function tc(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,dynamicArguments:O.dynamicArguments,envAssignments:O.envAssignments,shellAssignments:O.options.shellAssignments,policy:O.options.policy,worktreeMode:O.options.worktreeMode}}function dp(O){return ap.find((D)=>D.heads.has(O))?.analyze}function no(O,D,B){let Q=B.trace;if(O.length===0)return null;let ee=B.commandView?.dialect??"posix",he=(Rt)=>Rt.map((At)=>ee==="posix"?t(At):At.text),je=B.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=B.effectiveCwd===null,ut=je?je.cwd:ct?void 0:B.effectiveCwd??B.cwd,ft=je?je.originalCwd:ct?void 0:B.cwd,dt=ge(O);if(dt.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:he(O),envVars:[...dt.envAssignments.keys()],output:he(dt.words)});let mt=Sr(dt.words,B.environment,ut,new Map([...B.envAssignments??[],...dt.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let Rt=[...pt,...he(mt.words)].join(" "),At=xn(Rt);if(At)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:At.reason}),sn(At);if(B.strict)return fn(Q);let Mt=qi(pt,he(mt.words));if(Mt){B.budget.charge("derivedTokens",Mt.length);let Yt=B.analyzeNested(Mt.join(" "),{effectiveCwd:mt.cwd===void 0?B.effectiveCwd:mt.cwd,envAssignments:new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let gt=mt.rewritten?$t(he(mt.words)):X(ee,mt.words),ht=he(gt),yt={...B,wrapperNormalizationBudget:B.wrapperNormalizationBudget??{iterations:0}};if(Q&&dt.words.length>gt.length){let Rt=he(dt.words);Q.recordSegment({type:"leading-tokens-stripped",input:Rt,removed:Rt.slice(0,Rt.length-gt.length),output:ht})}let Ct=new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments]),Et=ht[0];if(!Et)return null;if(wr(Et))throw new s("wrapperPeelIterations");let vt=kt(Et),Pt=mt.cwd===null?void 0:mt.cwd??ut,xt=mt.cwd===null?void 0:ft,_t=mt.cwd===void 0?B.effectiveCwd:mt.cwd,Ut=je?je.allowTmpdirVar:!zo(Ct,B.environment),jt=rp(ee,mt.words,B.environment,D===0,B.strict,B.policy);if(jt)return Q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:jt.reason}),sn(jt);let qt=ds(ht,B.policy);if(qt){for(let Rt of[qt.childIndex,...qt.alternativeChildIndices]){lp(yt.wrapperNormalizationBudget);let At=gt.slice(Rt);Q?.recordSegment({type:"transparent-wrapper",wrapper:qt.wrapper,output:he(At)});let Mt=no(At,D,{...yt,effectiveCwd:_t,envAssignments:Ct});if(Mt)return Mt}return null}let Vt=lt?void 0:vt==="eval"?Cs(gt):vt==="trap"&&!at?xm(gt):void 0;if(at&&je&&vt==="eval"){if(Vt?.kind==="dynamic")return to(je,B.policy);if(Vt?.kind==="literal"){let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct});if(Rt)return Rt}return ro(je,B.policy)}if(Vt?.kind==="dynamic"&&(B.strict||!B.commandView||!jl(B.commandView)))return fn(Q);if(Vt?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:vt==="eval"?"shell-eval":"shell-trap",innerCommand:Vt.source,depth:D+1});let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct,functionDefinitions:B.functionDefinitions});if(Rt)return Rt}if(at?Kt.has(vt):mp(Et,vt)){if(Zn(ht))return null;if(at&&je){let Rt=Yn(ht);if(Rt){if(je.dynamicSourceInput??je.dynamicInput){let Mt=to(je,B.policy);if(Mt)return Mt}if(Xo(Rt)){let Mt=to(je,B.policy);if(Mt)return Mt}return B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct})}let At=qn(gt);if(At.kind==="dynamic")return to(je,B.policy);if(At.kind==="literal")return je.dynamicSourceInput?to(je,B.policy):null;return je.dynamicSourceInput??je.dynamicInput?to(je,B.policy):null}if(lt){let Rt=Yn(ht),At=Rt?B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct}):qn(gt).kind==="dynamic"?fn(Q):null;if(At)return At}if(je===void 0){let Rt=$R(ht,Ct,_t,B,Q,D);if(Rt)return Rt;let At=Yn(ht);if(At){let Dr=vs(gt,At);if(Dr.kind==="dynamic")return fn(Q);let Hs=Dr.kind==="literal"?Dr.source:At,wc=UR(Hs);Q?.recordSegment({type:"shell-wrapper",wrapper:vt,innerCommand:wc}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:wc,depth:D+1});let Pc=B.analyzeNested(Hs,{effectiveCwd:_t,envAssignments:Ct});if(Pc)return Pc;return Xo(Hs)?fn(Q):null}let Mt=qn(gt);if(Mt.kind==="dynamic")return fn(Q);if(Mt.kind==="literal")return Ts(Mt.source,_t,Ct,B,Q,D);let Yt=Rm(gt,B.commandView?.redirections??[],B.hasPipelineInput??!1,B.literalShellInput);if(Yt.kind==="dynamic")return fn(Q);if(Yt.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:D+1}),B.analyzeNested(Yt.source,{effectiveCwd:_t,envAssignments:Ct})}}if(!je&&(vt==="source"||vt===".")){let Rt=ht[1]==="-p"?2:null;if(Rt!==null){let Dr=B.commandView?gt[Rt]:void 0;if(!Dr)return null;if(Dr.provenance!=="literal")return fn(Q)}let At=Rt===null?1:3,Mt=ht[At]==="--"?At+1:At,Yt=B.commandView?gt[Mt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return Ts(Yt.text,_t,Ct,B,Q,D);if(B.strict||!B.commandView||!jl(B.commandView))return fn(Q)}if(En.has(vt)&&!lt){if(!je&&B.strict&&ec(jo(ht),gt))return fn(Q);let Rt=zf(ht,(Mt)=>kr(B.analyzeNested(Mt,{effectiveCwd:_t,envAssignments:Ct}))),At=wt(Rt,B.policy);if(At)return Q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:At.reason}),sn(At)}if(An(vt)&&!lt){if(!je&&B.strict&&ec(Hi(ht),gt))return fn(Q);let Rt=Wd(ht);if(at&&je)return zR(vt,Rt,_t,Ct,B,je);if(Rt){let At=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:vt,codeArg:Rt,paranoidBlocked:At}),At){let Yt=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(Yt)return sn(Yt)}if(ol(vt,Rt))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rt,depth:D+1});let Mt=B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct});if(Mt&&!fp(Mt,Rt))return Mt;if(Oo(Rt,void 0,!B.strict)){let Yt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(Yt)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Kr}),sn(Yt)}Q=void 0}}if(vt==="busybox"&&ht.length>1)return lp(yt.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:ht[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:ht.slice(1).join(" "),depth:D+1}),no(gt.slice(1),D,{...yt,effectiveCwd:_t,envAssignments:Ct});let Ot=je?null:wt(ip(vt,ht),B.policy);if(Ot)return Q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ot.reason}),sn(Ot);let on=Q===yt.trace?yt:{...yt,trace:Q},Cn={words:gt,head:vt,cwd:Pt,originalCwd:xt,envAssignments:Ct,allowTmpdirVar:Ut,dynamicArguments:mt.words.some((Rt)=>Rt.provenance==="command-substitution"),depth:D,effectiveCwd:_t,options:on,analyzeChildTokens:(Rt,At)=>at&&je?nc(Rt,D,on,{...je,cwd:At??void 0,effectiveCwd:At??void 0}):kr(no($t(Rt),D+1,{...on,child:void 0,commandView:void 0,effectiveCwd:At,envAssignments:Ct}))??_(Rt,on.policy.rules),analyzeChild:(Rt,At)=>nc(Rt,D,on,At)},Bn=je&&(vt==="xargs"||vt==="parallel")?void 0:dp(vt);if(vt==="rm"||vt==="xargs"||vt==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:Ct.has("TMPDIR")||B.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ut});let wn=Q&&vt==="git"?gm(Cn.words,tc(Cn)):void 0,$s=cp(wn?wn.match:Bn?.(Cn)??null,B.policy);if(Q)HR(Cn,$s,wn?.relaxation??null);if($s)return sn($s);if(at&&je&&(vt==="rm"||vt==="rmdir")){if(!(vt==="rm"&&(Dn(ht)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?ro(je,B.policy):null)??BR(je,B.policy)}let Rc=Bn!==void 0,_c=!je&&!Rc&&!bi.has(vt),Us=Q&&_c?[]:void 0;if(_c)for(let Rt=1;Rt<ht.length;Rt++){let At=ht[Rt];if(!At)continue;Us?.push(At);let Mt=cp(FR(ht,Rt,D,on,Pt,xt,_t,Ct),B.policy);if(Mt)return Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[],embeddedCommandFound:kt(At)}),sn(Mt)}if(Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[]}),lt&&je&&!je.wrappedByTransparent)return null;if(!je&&D!==0&&Rc)return Q?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let si=_(ht,B.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:B.policy.rules.length>0,matched:!!si,reason:si?.reason}),si)return sn(si);return at&&je?ro(je,B.policy):null}function nc(O,D,B,Q){return kr(no($t(O),D+1,{...B,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:Q.originalCwd,effectiveCwd:Q.effectiveCwd,envAssignments:Q.envAssignments,worktreeMode:Q.dynamicInput?!1:Q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:Q}))}function FR(O,D,B,Q,ee,he,je,at){for(let lt of Mn(O.slice(D),{environment:Q.environment,cwd:ee,envAssignments:at,policy:Q.policy})){let ct=lt.tokens[0];if(!ct)continue;let ut=kt(ct);if(mp(ct,ut)||dp(ut)!==void 0&&ut!=="xargs"&&ut!=="parallel"||lt.wrappedByTransparent&&Q.policy.rules.length>0)Q.budget.charge("derivedTokens",O.length-D);let dt=nc(lt.tokens,B,Q,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!zo(lt.envAssignments,Q.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(dt)return dt}return null}function zR(O,D,B,Q,ee,he){if(!D)return ro(he,ee.policy);if(Jt(ee.policy,"interpreter.one-liner-paranoid",!!ee.paranoidInterpreters)){let at=wt(St("interpreter.one-liner-paranoid",ko),ee.policy);if(at)return sn(at)}if(ol(O,D))return ro(he,ee.policy);let je=ee.analyzeNested(D,{effectiveCwd:B,envAssignments:Q});if(je&&!fp(je,D))return je;if(Oo(D,void 0,!ee.strict)){let at=wt(St("interpreter.dangerous-command",Kr),ee.policy);if(at)return sn(at)}return ro(he,ee.policy)}function fp(O,D){if(O.ruleId==="raw-text.dangerous-command")return!0;return(O.reason.startsWith(ls)||O.reason===Xr)&&!Si(D)}function to(O,D){let B=O.shellDynamicMatch?wt(O.shellDynamicMatch,D):null;return B?sn(B):null}function ro(O,D){let B=O.dynamicSourceInput&&O.dynamicSourceMatch?wt(O.dynamicSourceMatch,D):null;return B?sn(B):null}function BR(O,D){let B=O.dynamicInput&&O.rmDynamicMatch?wt(O.rmDynamicMatch,D):null;return B?sn(B):null}function $R(O,D,B,Q,ee,he){let je=Pm(O);if(je.argvSource?.kind==="absent")return fn(ee);if(je.argvSourceApplies&&je.argvSource){let lt=Ts(je.argvSource.value,B,D,Q,ee,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=D.get(je.envName);if(!at)return null;return Ts(at,B,D,Q,ee,he,!0)}function Ts(O,D,B,Q,ee,he,je=!1){if(je&&/[$`*?[\]]/.test(O))return fn(ee);let at=Io(O,D,Q.environment.paths,Q.budget),lt=at?Q.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?fn(ee):null;return Q.budget.charge("derivedTokens",1),ee?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),Q.analyzeNested(lt,{effectiveCwd:D,envAssignments:B})}function UR(O){let D=O[0];return O.length>=2&&(D==='"'||D==="'")&&O.at(-1)===D?O.slice(1,-1):O}function HR(O,D,B){let Q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[O.head];if(!Q)return;if(O.options.trace?.recordSegment({type:"rule-check",rule:Q,matched:!!D||!!B,reason:D?.reason??B?.originalReason}),B)O.options.trace?.recordSegment({type:B.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:B.originalReason,gitCwd:B.gitCwd})}function lp(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function sn(O){return{reason:O.reason,ruleId:O.id||void 0,intent:O.intent}}function fn(O){return O?.recordSegment({type:"error",message:Uo}),sn(jR())}function jR(){return{id:"",reason:Uo,intent:"stop_and_explain"}}function mp(O,D){return Kt.has(D)||O==="$SHELL"||O==="${SHELL}"||Kt.has(Tt(D))}function cp(O,D){return O?.id.startsWith("custom.")||O?.id==="raw-text.dangerous-command"?O:wt(O,D)}var VR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,KR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function qR(O,D){let B=hp(O,D);if(B.length===0)return!1;let Q=B[gp(B)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return VR.test(O.join(" "))}function pp(O,D,B,Q,ee){if(O.dialect==="powershell"){let ht=ZR(O.words,ee);if(ht.kind==="none")return;if(!D||ht.kind==="unknown")return null;return up(e_(ht.target),D,B.paths)}let he=O.words.map(t),je=he.some((ht)=>/^CDPATH\+?=/.test(ht));if(!qR(he,B))return je?null:void 0;if(!D)return null;let at=hp(he,B,D),lt=gp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),ut=ct.findIndex((ht)=>ht.length<=1||!ht.startsWith("-")||ht==="--");if((ut===-1?ct:ct.slice(0,ut)).some((ht)=>!/^-[LP]+$/.test(ht)))return null;let dt=ut===-1?[]:ct.slice(ut),mt=dt[0]==="--"?dt.slice(1):dt;if(mt.length!==1)return null;let pt=mt[0]??"",gt=O.words.some((ht)=>ht.provenance==="variable"&&ht.text===pt)?YR(pt,Q):pt;if(gt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(gt)&&(je||B.env.has("CDPATH")))return null;return up(gt,D,B.paths)}function YR(O,D){let B=qo(O,D);return B.startsWith("~")||/[\s$`*?[]/.test(B)?null:B}function up(O,D,B){if(!O||O==="-"||O.includes("$")||O.includes("`"))return null;try{return nr(D,O,B)}catch{return null}}function ZR(O,D){let B=XR(O[0])?1:0,Q=O[B];if(!JR(Q,B===1))return{kind:"none"};let ee=Q.text.toLowerCase(),he=ee.split(/[\\/]/).pop()??ee;if(!KR.has(he))return{kind:"none"};if(ee!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return QR(O.slice(B+1),D)}function XR(O){return O?.provenance==="literal"&&!O.quoted&&O.raw===O.text&&(O.text==="&"||O.text===".")}function JR(O,D){return O?.provenance==="literal"&&(D||!O.quoted&&O.raw===O.text)}function QR(O,D){let B;for(let Q of O){if(Q.provenance!=="literal"||B!==void 0)return{kind:"unknown"};B=Q.text}if(B!==void 0)return{kind:"target",target:B};return D===void 0?{kind:"unknown"}:{kind:"target",target:D}}function e_(O){return O.includes("::")?void 0:O.replaceAll("\\","/")}function gp(O){let D=0;if(O[0]==="builtin"&&O.length>1)D=1;if(O[D]!=="time")return D;let B=D+1;while(O[B]?.startsWith("-"))B++;return B}function hp(O,D,B){let Q=t_(O);return rr([...Q],D,B)}function t_(O){let D=0;while(D<O.length){let B=O[D];if(B!=="{"&&B!=="("&&B!=="$(")break;D++}return O.slice(D)}var n_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Or="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ac(O,D,B,Q){if(D>=a.recursionDepth.cap)return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};let ee=Q??B.factStore?.getCommandProgram(O,B.shell??"auto")??h(O,B.shell);if(ee.status==="limited")return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};if(ee.status==="invalid"){let ct=ee.issues.find((ut)=>ut.code.includes("heredoc"));if(ct){if(!B.strict)return sc(O,B);let ut=`${ls}: ${ct.message}`;return B.trace?.recordGlobal({type:"error",message:ut}),{reason:ut,segment:O,intent:"stop_and_explain"}}return Ep(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"}}if(B.strict&&ee.status==="partial")return Ep(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"};if(ee.issues.some((ct)=>ct.code.includes("quote")))return sc(O,B);let je=B.cwd,at=B.effectiveCwd!==void 0?B.effectiveCwd:B.cwd,lt=rm(B.environment.env,B.envAssignments);return Os(ee,D,{...B,rootProgram:ee},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(B.literalHeredocFiles),functionDefinitions:new Map(B.functionDefinitions)}]).result}function Os(O,D,B,Q,ee){let he=[...ee],je,at;for(let[lt,ct]of O.nodes.entries()){if(ct.kind==="connector"){at=ct.operator;continue}let ut=O.nodes[lt+1],ft=ut?.kind==="connector"?ut.operator:void 0,dt=r_(O,lt,ct,at,ft),mt=at==="&&"||at==="||",pt=mt?je:void 0,gt=at==="&&"?pt?.success??he:at==="||"?pt?.failure??he:he,ht=at==="||"?pt?.success??[]:[],yt=at==="&&"?pt?.failure??[]:[],Ct=mt||io(ft);if(ct.kind==="function"){let jt=gt.flatMap((Vt)=>{let Ft=so(Vt);return Ft.functionDefinitions.set(ct.name,ct.body),rc(Vt,[Ft],dt,ft==="&",io(ft))}),qt=oc(jt,[],ht,yt,at,ft);he=qt.states,je=qt.conditionalStates,at=void 0;continue}if(ct.kind==="group"){let jt=[],qt=[];for(let Ft of gt){let Ot=Os(ct.body,D,B,Q,[so(Ft)]);if(Ot.result)return Ot;if(jt.push(...rc(Ft,Ot.states,dt,ft==="&",io(ft))),Ct)qt.push(Ft,...dt?Ot.states.map((on)=>Is(Ft,on)):Ot.states)}let Vt=oc(jt,qt,ht,yt,at,ft);he=Vt.states,je=Vt.conditionalStates,at=void 0;continue}if(ct.kind!=="command")continue;let Et=B.trace?.flattenNested?B.trace.currentSegmentIndex:B.trace?.allocateSegment(),vt=O.nodes[lt-2],Pt=Ms(at)&&vt?.kind==="command"?Em(vt)??i_(vt):void 0,xt=[],_t=[];for(let jt of gt){let qt=s_(ct,D,B,Q,[so(jt)]);if(qt.result)return{result:qt.result,states:he};let Vt=O.dialect==="powershell"?qt.states:qt.states.map((Ft)=>Is(jt,Ft));for(let Ft of Vt){let Ot=so(Ft),on=c_(ct,D,B.trace?{...B,trace:xp(B.trace,Et)}:B,Q,Ot,Ms(at),Pt);if(on)return{result:on,states:he};let Cn=__(ct,Ot.functionDefinitions);if(Cn)B.budget.charge("derivedTokens",Ds(Cn));let Bn=Cn?D+1>=a.recursionDepth.cap?ic(ct.displayText,B,[Ot]):Os(Cn,D+1,B,Q,[Ot]):{result:null,states:x_(ct,Ot)};if(Bn.result)return Bn;if(xt.push(...rc(jt,Bn.states,dt,ft==="&",io(ft))),Ct)_t.push(jt),_t.push(...Bn.states.map((wn)=>dt?Is(jt,wn):wn))}}let Ut=oc(xt,_t,ht,yt,at,ft);he=Ut.states,je=Ut.conditionalStates,at=void 0}return{result:null,states:he}}function r_(O,D,B,Q,ee){if(B.kind==="group"&&B.style==="subshell")return!0;if(O.dialect==="posix"&&(Ms(Q)||Ms(ee)))return!0;if(ee==="&")return!0;return O.dialect==="powershell"&&B.kind==="group"&&B.style==="brace"&&o_(O,D)}function rc(O,D,B,Q,ee){let he=B?D.map((at)=>Is(O,at)):[...D],je=ee?he.flatMap((at)=>oo(O.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(O.literalHeredocFiles)},at]):he;return Q?[O,...je]:je}function Is(O,D){return{...O,literalHeredocFiles:new Map(D.literalHeredocFiles)}}function o_(O,D){let B=O.nodes.slice(0,D).reverse().find((ee)=>ee.kind==="command"||ee.kind==="connector");if(!B||B.kind!=="command")return!0;let Q=B.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(a_(B))return!0;return B.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Ms(O){return O==="|"||O==="|&"}function i_(O){if(O?.dialect!=="powershell")return;if(O.words.length===1&&O.words[0]?.quoted&&O.words[0].provenance==="literal")return O.words[0].text;if(O.words[0]?.text.toLowerCase()==="write-output"&&O.words.length===2&&O.words[1]?.provenance==="literal")return O.words[1].text;return}function io(O){return O==="&&"||O==="||"}function oc(O,D,B,Q,ee,he){let je={success:ks([...B,...O]),failure:ks([...Q,...D])},at=io(he)?je:void 0;return{states:io(ee)||at?ks([...je.success,...je.failure]):je.success,conditionalStates:at}}function xp(O,D,B=O.flattenNested){return{currentSegmentIndex:D,flattenNested:B,allocateSegment:O.allocateSegment,getNextSegmentIndex:O.getNextSegmentIndex,recordGlobal:O.recordGlobal,recordSegment:(Q,ee=D)=>O.recordSegment(Q,ee)}}function s_(O,D,B,Q,ee){let he=O.nested.map((je)=>({program:je,depth:D}));if(O.dialect==="powershell"){let je=l_(O);if(je){if(D+1>=a.recursionDepth.cap)return ic(je,B,ee);let at=h(je,"powershell");if(at.status==="limited")return ic(je,B,ee);if(at.status!=="complete")return yp(he,B,Q,ee);B.budget.charge("derivedTokens",Ds(at)),he.push({program:at,depth:D+1})}}return yp(he,B,Q,ee)}function a_(O){let D=O.words[0];return D?.provenance==="variable"&&O.words.at(-1)?.text==="="?D.text.toLowerCase():void 0}function yp(O,D,B,Q){let ee=[...Q];for(let he of O){let je=[];for(let at of ee){let lt=Os(he.program,he.depth,D,B,[so(at)]);if(lt.result)return lt;je.push(...lt.states)}ee=ks(je)}return{result:null,states:ee}}function l_(O){let D=O.words[0]?.provenance==="literal"&&!O.words[0].quoted&&O.words[0].raw===O.words[0].text&&(O.words[0].text==="&"||O.words[0].text==="."),B=D?1:0,Q=O.words[B];if(Q?.provenance!=="literal"||!D&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let ee=O.words.slice(B+1),he=ee[0]&&!ee[0].quoted&&ee[0].raw===ee[0].text&&["-c","-command"].includes(ee[0].text.toLowerCase())?1:0,je=ee[he];return ee.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Ds(O){return O.nodes.reduce((D,B)=>D+(B.kind==="command"?B.words.length+B.nested.reduce((Q,ee)=>Q+Ds(ee),0):B.kind==="group"||B.kind==="function"?Ds(B.body):0),0)}function ic(O,D,B){return D.trace?.recordSegment({type:"error",message:Wn}),{result:{reason:Wn,segment:O,intent:"stop_and_explain"},states:[...B]}}function c_(O,D,B,Q,ee,he,je){let at={...B,environment:{...B.environment,env:ee.shellGitContextState.env}},lt=h_(O,!at.strict);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:O.source,intent:"stop_and_explain"};Rp(O,ee,"before-consumer",at.environment.paths,at.budget);let ct=X(O.dialect,O.words),ut=ct.map(t),ft=O.displayText,dt=nm(ct,ee.shellGitContextState),mt=im(dt,ee.shellGitContextState);if(O.dialect==="powershell"){let ht=wt(Of(O,he,P_(at,ee.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ht,reason:ht?.reason}),ht)return w_(ft,ht)}if(ut.length===1&&ut[0]?.includes(" ")&&!xo(O.dialect,O.words)){let ht=wt(xn(ut[0]),at.policy),yt=ht!==null&&!at.strict&&Md(O,at.rootProgram);if(ht&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!0,reason:ht.reason}),{reason:ht.reason,segment:ft,ruleId:ht.id,intent:ht.intent};at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!1});let Ct=bp(O,lt,ee,mt,je,at);if(Ct)return Ct;return Fl(dt,ee.shellGitContextState),null}let pt=no(O.words,D,{...at,commandView:O,cwd:Q,effectiveCwd:ee.effectiveCwd,envAssignments:mt,shellAssignments:ee.shellGitContextState.shellAssignments,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:ee.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(ht,yt)=>{let Ct=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:ee.effectiveCwd,Et=ac(ht,D+1,{...at,effectiveCwd:Ct,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?xp(at.trace,at.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent}:null}});if(pt)return{...pt,segment:ft};let gt=bp(O,lt,ee,mt,je,at);if(gt)return gt;return Fl(dt,ee.shellGitContextState),null}function bp(O,D,B,Q,ee,he){let je=y_(O,D,B,Q??new Map,he);if(je)return je;return Rp(O,B,"after-consumer",he.environment.paths,he.budget),B.literalHeredocFiles.clear(),f_(O,D,B,he.environment.paths,he.budget),C_(O,B,ee,he.environment,he.trace),null}var u_=new Set([">>","<>"]);function Rp(O,D,B,Q,ee){for(let je of O.redirections){if(!(B==="before-consumer"?d_(je):u_.has(je.operator)))continue;Sp(je.target,D,Q,ee)}if(B!=="before-consumer"||!nn(O.words[0],"tee"))return;let he=_p(O.words.slice(1));if(!he)return;for(let je of he.operands)Sp(je,D,Q,ee)}function d_(O){if(O.operator===">"||O.operator===">|")return!0;return O.operator===">&"&&O.fd===void 0&&O.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(O.target.text)}function Sp(O,D,B,Q){let ee=O?.provenance==="literal"?Io(O.text,D.effectiveCwd,B,Q):void 0;if(!ee)return;D.literalHeredocFiles.delete(ee)}function f_(O,D,B,Q,ee){if(D)return;let he=O.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he)return;for(let je of m_(O)){let at=Io(je.text,B.effectiveCwd,Q,ee);if(!at||!Ld(at))continue;if(!B.literalHeredocFiles.has(at)&&B.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");B.literalHeredocFiles.set(at,he.body)}}function m_(O){let D=g_(O.redirections)?.target,B=Cp(D)?[D]:[];if(nn(O.words[0],"cat"))return p_(O.words)?B:[];if(!nn(O.words[0],"tee"))return[];let Q=_p(O.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(Cp))return[];return[...Q.operands,...B]}function p_(O){let D=!1;for(let B of O.slice(1)){if(D||B.provenance!=="literal")return!1;if(B.text==="--"){D=!0;continue}if(!/^-u+$/.test(B.text))return!1}return!0}function g_(O){let D=O.findLast((B)=>(B.fd??([">",">|",">>",">&"].includes(B.operator)?1:0))===1);return D?.operator===">"||D?.operator===">|"?D:void 0}function _p(O){let D=[],B=!0,Q=!1,ee=!1;for(let he of O){if(he.provenance!=="literal")return;if(B&&nn(he,"--")){B=!1;continue}if(B&&!he.quoted&&he.raw===he.text&&/^-[^-]/.test(he.text)){Q||=he.text.slice(1).includes("a"),ee||=Array.from(he.text.slice(1)).some((je)=>je!=="a"&&je!=="i");continue}if(B&&!he.quoted&&he.raw===he.text&&he.text.startsWith("--")){Q||=he.text==="--append",ee||=he.text!=="--append"&&he.text!=="--ignore-interrupts";continue}D.push(he)}return{operands:D,append:Q,hasUnsupportedOptions:ee}}function Cp(O){if(!O||O.provenance!=="literal"||O.text.length===0)return!1;if(O.quoted||O.raw!==O.text)return!0;return!O.raw.startsWith("~")&&!/[{}]/.test(O.raw)}function nn(O,D){return O?.text===D&&O.raw===D&&O.provenance==="literal"&&!O.quoted}function lc(O){return O.quotedDelimiter||!/[$`\\]/.test(O.body)}function h_(O,D){let B=O.redirections.filter((at)=>at.operator==="<<"||at.operator==="<<-");if(B.length===0)return;if(B.length!==1)return Or;let Q=B[0];if(!Q?.heredoc)return Or;if(!lc(Q.heredoc)&&!(D&&!/\$\(|`/.test(Q.heredoc.body)))return n_;if(Q.fd!==void 0&&Q.fd!==0)return Or;if(O.redirections.some((at)=>at!==Q&&["<","<<","<<-","<<<","<&","<>"].includes(at.operator)))return Or;let ee=O.redirections.some((at)=>at!==Q&&vp(at.target));if(nn(O.words[0],"cat"))return ee?Or:void 0;if(nn(O.words[0],"tee"))return ee||O.words.slice(1).some(vp)?Or:void 0;let he=O.words[0],je=O.words[1];if(nn(he,"git")&&(nn(je,"apply")||nn(je,"commit")))return;if(nn(he,"gh")&&(nn(je,"pr")||nn(je,"issue"))&&nn(O.words[2],"create"))return;return Or}function vp(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}function y_(O,D,B,Q,ee){if(!D)return null;let he=O.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(S_(O,he,B,Q,ee))return null;let at=b_(O,he,ee);if(at!==void 0)return at?{reason:at.reason,segment:O.displayText,ruleId:at.id,intent:at.intent}:null;let lt=sc(je.length===he.length?je.join(`
-`):O.source,ee);return lt?{...lt,segment:O.displayText}:null}function b_(O,D,B){let Q=D.length===1?D[0]:void 0;if(!Q?.heredoc||!lc(Q.heredoc)||Q.fd!==void 0&&Q.fd!==0)return;let ee=nn(O.words[0],"uv")&&nn(O.words[1],"run")?O.words.slice(2):O.words,he=ee[0];if(he?.provenance!=="literal"||!An(he.text))return;let je=ee.findIndex((ft)=>nn(ft,"-"));if(!ee.slice(1,je===-1?void 0:je).every((ft)=>ft.provenance==="literal"&&ft.text.startsWith("-")))return;let lt=Q.heredoc.body,ct=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(B.trace?.recordSegment({type:"interpreter",interpreter:he.text,codeArg:lt,paranoidBlocked:ct}),ct){let ft=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(ft)return ft}if(!Oo(lt,void 0,!B.strict))return null;let ut=wt(St("interpreter.dangerous-command",Kr),B.policy);if(!ut)return null;return B.trace?.recordSegment({type:"dangerous-text",token:lt,matched:!0,reason:ut.reason}),ut}function S_(O,D,B,Q,ee){let he=D.length===1?D[0]:void 0;if(!he?.heredoc||!lc(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=Sr(O.words,ee.environment,B.effectiveCwd,Q),at=je.words.map(t),lt=kt(at[0]??"");if((je.envSplitValues?.length??0)>0||!Kt.has(lt)&&!Kt.has(Tt(lt)))return!1;return Zn(at)}function C_(O,D,B,Q,ee){let he=pp(O,D.effectiveCwd,Q,D.shellGitContextState.shellAssignments,B);if(he===null)ee?.recordSegment({type:"cwd-change",segment:O.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)D.effectiveCwd=he}var v_=/^[A-Za-z_][A-Za-z0-9_]*$/,E_=8;function x_(O,D){let B=O.words[1]?.text;if(O.dialect!=="posix"||O.words[0]?.text!=="for"||B===void 0||!v_.test(B))return[D];let Q=O.words.slice(3);if(!(O.words[2]?.text==="in"&&Q.length>=1&&Q.length<=E_&&Q.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return D.shellGitContextState.shellAssignments.delete(B),[D];return Q.map((he)=>{let je=so(D);return je.shellGitContextState.shellAssignments.set(B,he.text),je})}function so(O){return{effectiveCwd:O.effectiveCwd,shellGitContextState:om(O.shellGitContextState),literalHeredocFiles:new Map(O.literalHeredocFiles),functionDefinitions:new Map(O.functionDefinitions)}}function ks(O){let D=[];for(let B of O){if(!D.some((Q)=>R_(Q,B)))D.push(B);if(D.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return D}function R_(O,D){return O.effectiveCwd===D.effectiveCwd&&oo(O.shellGitContextState.env,D.shellGitContextState.env)&&oo(O.literalHeredocFiles,D.literalHeredocFiles)&&oo(O.functionDefinitions,D.functionDefinitions)&&oo(O.shellGitContextState.effectiveEnvAssignments,D.shellGitContextState.effectiveEnvAssignments)&&oo(O.shellGitContextState.shellAssignments,D.shellGitContextState.shellAssignments)&&O.shellGitContextState.bodyDepth===D.shellGitContextState.bodyDepth&&O.shellGitContextState.bodyAssignments.size===D.shellGitContextState.bodyAssignments.size&&[...O.shellGitContextState.bodyAssignments].every((B)=>D.shellGitContextState.bodyAssignments.has(B))}function oo(O,D){if(O===D)return!0;if(!O||!D||O.size!==D.size)return!1;return[...O].every(([B,Q])=>D.get(B)===Q&&D.has(B))}function __(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function w_(O,D){if(!D)return null;return{reason:D.reason,segment:O,ruleId:D.id,intent:D.intent}}function P_(O,D=O.effectiveCwd){let B=D===null;return{environment:O.environment,cwd:B?void 0:D??O.cwd,originalCwd:B?void 0:O.cwd,strict:O.strict,paranoid:O.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.protectedGitMetadata,policy:O.policy,budget:O.budget}}function sc(O,D){let B=wt(xn(O),D.policy),Q=D.trace?.currentSegmentIndex??D.trace?.allocateSegment(),ee={type:"dangerous-text",token:O,matched:!!B,reason:B?.reason};if(D.trace?.recordSegment(ee,Q),!B&&/^(?:cd|pushd)\s/.test(O))D.trace?.recordSegment({type:"cwd-change",segment:O,effectiveCwdNowUnknown:!0},Q);return B?{reason:B.reason,segment:O,ruleId:B.id,intent:B.intent}:null}function Ep(O,D){let B={type:"strict-unparseable",rawCommand:O,reason:Xr},Q=D.trace?.currentSegmentIndex;if(Q===void 0)D.trace?.recordGlobal(B);if(Q!==void 0)D.trace?.recordSegment(B)}var A_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function wp(O,D,B,Q){let ee=ac(O,0,{...D,...Fe(D),budget:D.budget??mn(),factStore:Q},B);if(!ee)return null;return{kind:"deny",reason:ee.reason,intent:ee.intent??"manual_only",...ee.ruleId?{ruleId:ee.ruleId}:{},evidence:{command:O,segment:ee.segment}}}function Pp(O,D,B){try{return{decision:O()}}catch(Q){let ee=T_(Q,D,B);if(!ee)throw Q;return ee}}function T_(O,D,B){if(!(O instanceof s)||!A_.has(O.kind))return null;let Q=a[O.kind];if(B?.currentSegmentIndex!==void 0)B.recordSegment({type:"error",message:Q.reason});if(B?.currentSegmentIndex===void 0)B?.recordGlobal({type:"error",message:Q.reason});return{decision:{kind:"deny",reason:Q.reason,intent:"stop_and_explain",evidence:{command:D,segment:D}},errorCode:Q.errorCode}}var I_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),uc=new Set(["cc-safety-net","ccsn"]),k_=new Set(["bunx","npx","pnpx"]),O_=new Set(["pnpm","yarn"]),M_=new Set(["npm","pnpm","yarn"]),D_=new Set(["bun","node"]);function Ls(O,D,B={}){if(uc.has(O))return 0;if(k_.has(O)){if(B.broad)return cc(D);let ee=D[0]==="-y"||D[0]==="--yes"?1:0;return Ns(D[ee])?ee+1:null}let Q=B.broad?D.findIndex((ee)=>!ee.startsWith("-")):0;if(Q!==-1&&M_.has(O)&&B.broad&&D[Q]==="exec"){let ee=cc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(O_.has(O)){if(O==="yarn"&&!B.broad)return null;if(!B.broad)return D[0]==="dlx"&&Ns(D[1])?2:null;if(Q===-1||D[Q]!=="dlx")return null;let ee=cc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(D_.has(O)){let ee=B.broad&&Q!==-1?Q:0;if(Ap(D[ee]))return ee+1;if(O==="bun"&&D[ee]==="run"&&Ap(D[ee+1]))return ee+2}return null}function cc(O){let D=O.findIndex((Q)=>Ns(Q));if(D===-1)return null;let B=D;while(B<O.length){let Q=O[B]??"";if(!Q.startsWith("-")&&!Ns(Q))break;B++}return B}function Ns(O){if(!O)return!1;let D=O.indexOf("@");if(D===-1)return uc.has(O);if(D===0)return!1;let B=O.slice(D+1);if(B===""||B.includes("/")||B.includes(":"))return!1;return uc.has(O.slice(0,D))}function Ap(O){let D=O?.replaceAll("\\","/");return[...I_].some((B)=>D===B||D?.endsWith(`/${B}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Tp(O,D,B){let Q=un(O,"input-candidate");if(!Q)return null;let ee=Yr(Q.shell,O.invocation.context.executionCwd,D,B,{findSegmentTarget:(he)=>N_(he,D),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ee?{target:ee}:null}function N_(O,D){let B=rr([...O],D),Q=B.slice(1),ee=Ls(Tt(B[0]??"").toLowerCase(),Q,{broad:!0});if(ee===null)return null;let he=Q.slice(ee).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?B.join(" "):null}import{dirname as Ws}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",L_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Mp(O,D,B){let Q=$_(O.invocation.context,D,B);if(O.invocation.route.kind==="patch")return Ip(O.paths,!1,O.invocation.context.executionCwd,Q,D,B);let ee=un(O,"input-candidate");if(O.invocation.route.kind==="command")return ee?kp(ee.shell,O.invocation.context.executionCwd,Q,D,B):null;if(O.invocation.route.kind==="unknown"&&ee){let he=kp(ee.shell,O.invocation.context.executionCwd,Q,D,B);if(he)return he}return Ip(O.paths,O.invocation.route.kind==="grep"||O.invocation.route.kind==="glob"||ui(O.invocation.toolName),O.invocation.context.executionCwd,Q,D,B)}function Ip(O,D,B,Q,ee,he){if(D)return null;let je=O.find((at)=>ei(at,B,Q,ee,he));return je?{target:je}:null}function kp(O,D,B,Q,ee){let he=Yr(O,D,Q,ee,{findSegmentTarget:(je,at)=>W_(je,at,B,Q,ee)?.target??null,isRedirectionTarget:(je,at)=>ei(je,at.cwd,B,Q,ee),findMalformedTarget:(je)=>B_(je,D,B,Q,ee)?.target??null});return he?{target:he}:null}function W_(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q),je=Tt(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&G_(at)){let lt=F_(at).find((ct)=>Op(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(je==="find"){if(ps(he,1)||Il(he,Q)){let ct=(ms($t(he))??$t(["."])).find((ut)=>{let ft=cn(ut.text,D.variables);return ei(ft,D.cwd,B,Q,ee)||Op(ft,D.cwd,B,Q,ee)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=es(at).sources.find((ct)=>U_(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(z_(he,je))return null;for(let lt of[...O,...he])for(let ct of Dp(lt))if(ei(cn(ct,D.variables),D.cwd,B,Q,ee))return{target:ct};return null}function G_(O){return O.some((D)=>D==="--recursive"||D.startsWith("-")&&!D.startsWith("--")&&/[rR]/.test(D.slice(1)))}function F_(O){let D=O.indexOf("--");if(D!==-1)return[...O.slice(0,D).filter((B)=>!B.startsWith("-")),...O.slice(D+1)];return O.filter((B)=>!B.startsWith("-"))}function z_(O,D){if(!L_.has(D))return!1;if(D!=="sed")return!0;return!O.slice(1).some((B)=>B.startsWith("-i")||B==="--in-place"||B.startsWith("--in-place="))}function B_(O,D,B,Q,ee){for(let he of O.split(/\s+/))for(let je of Dp(he))if(ei(je,D,B,Q,ee))return{target:je};return null}function Dp(O){let D=O.trim().replace(/^['"]|['"]$/g,""),B=D.indexOf("=");return B===-1||B===D.length-1?[D]:[D,D.slice(B+1)]}function $_(O,D,B){let Q=(at)=>ti(tn(at,O.executionCwd,D,B)),ee=Q(u(D)),he=[Q(b(O.executionCwd)),Q(b(O.configCwd))],je=new Set(he.map((at)=>Ws(at)));for(let at=Ws(ee);;at=Ws(at))if(je.add(at),Ws(at)===at)break;return{files:new Set([ee,...he]),directoriesAndAncestors:je}}function ei(O,D,B,Q,ee){let he=Oc(O,D,Q,ee,(je)=>ti(je)===hi);return he!==null&&B.files.has(ti(he))}function Op(O,D,B,Q,ee){return B.directoriesAndAncestors.has(ti(tn(O,D,Q,ee)))}function U_(O,D,B,Q,ee){let he=ti(tn(O,D,Q,ee));return B.files.has(he)||B.directoriesAndAncestors.has(he)}function ti(O){return process.platform==="win32"?O.toLowerCase():O}import{isAbsolute as Gs,posix as H_,resolve as zs,win32 as j_}from"node:path";import{fileURLToPath as V_}from"node:url";var Vp="Access to a sensitive path is not allowed.",Kp=new Set(["echo","printf"]),K_=new Set(["find"]),q_=new Set(["!","do","elif","else","if","then","until","while"]),Y_=new Set(["-exec","-execdir"]),Z_=new Set([";","+"]),X_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),J_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),qp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Q_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),ew=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Yp=new Set(["-c","-e","-r","-E","--eval","--exec"]),tw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),nw=new Set(["grep","rg"]),rw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),ow=new Set(["commit","merge","notes","stash","tag"]),iw=new Set(["-m","--message"]),sw=new Set(["--grep"]),Np=new Set(["jq","gojq","jaq"]),Lp="f",Wp="file",aw="files",lw=new Set(["e","f"]),cw=new Set(["regexp","file"]),uw=new Set(["e","f","A","B","C","m"]),dw=new Set(["regexp","file","after-context","before-context","context","max-count"]),dc="__CC_SAFETY_NET_PIPE_INPUT__",mc=/[\w./~@+-]*[./~][\w./~@+-]*/g,fw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,mw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,pw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Gp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Fp=/\b(?:system|exec|spawn|popen)\s*$/,gw=/\b(?:eval|exec)\s*\(/g,hw=/\b(?:eval|exec)\s*$/,yw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zp(O,D,B,Q,ee,he){for(let je of O){let at=je.target;if(pP(at,je.cwd,D?.denyPaths??[],B,Q,ee))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=fP(at,je.cwd,D,Q,ee);if(lt){let ct=!lt.startsWith("secret.home.")&&!lt.startsWith("secret.cli.");if(he&&(ct&&Q.paths.isDirectory(ng(at,je.cwd,Q,ee))||ct&&je.written===!0&&!at.includes("$")&&!gc(at,je.cwd,Q,ee)||ct&&/\s/.test(at)&&!at.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(at)&&!gc(at,je.cwd,Q,ee)))continue;if(!lt.startsWith("secret.cli.")&&gP(at,je.cwd,D?.allowPaths??[],B,Q,ee))continue;return{target:at,ruleId:lt}}}return null}function Zp(O,D,B,Q,ee={}){let he=Bp(O,B,Q),je=zp(he,D,O.invocation.context.configCwd,B,Q);if(je===null||je.ruleId==="secret.deny-path"||ee.strict!==!1)return je;let at=zp(he,D,O.invocation.context.configCwd,B,Q,new Set(Bp(O,B,Q,{standard:!0}).map((lt)=>lt.target)));return at?.ruleId!=="secret.deny-path"&&bw(O,B)?null:at}function bw(O,D){let B=un(O,"input-candidate")??un(O,"declared-command");if(!B)return!1;if(B.program.nodes.some((je)=>je.kind==="command"&&je.nested.length>0))return!1;let Q=[];for(let je of Qi(B.shell)){if(je.kind==="operator"&&je.boundary)return!1;if(je.kind==="redirection")return!1;if(je.kind==="operator")continue;Q.push(Vn(je.text,D))}let ee=Jn(Q);if(ee.length===0)return!1;let he=Ln(ee[0]??"").toLowerCase();if(O.invocation.route.kind==="unknown")return B.program.dialect==="powershell"&&(he==="ls"||he==="stat");return hc(he,ee.slice(1))}function hc(O,D){if(O==="ls"||O==="stat")return!0;if(O==="test")return D.length===2&&(D[0]==="-e"||D[0]==="-f");if(O==="[")return D.length===3&&(D[0]==="-e"||D[0]==="-f")&&D[2]==="]";if(O==="git")return D[0]==="check-ignore";if(O!=="find")return!1;return!D.some((B)=>X_.has(B))}function Bp(O,D,B,Q={}){let ee=O.invocation.context.executionCwd,he=O.invocation.route.kind;if(he!=="command"&&he!=="unknown")return O.paths.map((at)=>({target:at,cwd:ee}));let je=un(O,"input-candidate");return[...je?ao(je.shell,O.store,Q,D,ee,B,Sw(je)):[],...he==="unknown"?O.paths.map((at)=>({target:at,cwd:ee})):[]]}function Sw(O){return O.program.dialect==="powershell"}function ao(O,D,B,Q,ee,he,je=!1){if(O.status==="structural-limit")throw new y;if(O.status==="unclosed-quote")return[];if(O.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...O.assignmentFallbacks.map((ct)=>({target:ct,cwd:ee})),...Yw(Vn(O.source,Q),D,B,Q,ee,he)],lt=(ct)=>Vn(Iw(ct,je),Q);return Ji(O,ee,Q,he,{word:lt,segment:(ct,ut,ft,dt,mt)=>{if(ct.length===0)return null;if(at.push(...Bs(ct,D,B,Q,ut.cwd,he,mt)),ft!==null)at.push(...vw(ft,ct,D,B,Q,ut.cwd,he));return null},redirection:(ct,ut)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...Xp(ct.consumer,[ct.body],D,B,Q,ut.cwd,he,(ft)=>Ew(ct.consumer??[],ft,D,B,Q,ut.cwd,he)));if(ct.targetOrder==="legacy-segment")return ml;return at.push({target:lt(ct.target),cwd:ut.cwd,...ct.role==="file-write"?{written:!0}:{}}),null}}),at}function yc(O,D,B,Q,ee,he){let je=D.getShellSyntax(O);if(je.status==="structural-limit")throw new y;return je.status==="complete"?ao(je,D,B,Q,ee,he):null}function Bs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:ee});if(je?.size){let gt=O.filter((ht,yt)=>!je.has(yt));if(Np.has(Ln(Jn(gt)[0]??"").toLowerCase()))return[...O.filter((ht,yt)=>je.has(yt)).map(at),...Bs(gt,D,B,Q,ee,he)]}let lt=Tw(O).map(at),ct=Jn(O);if(ct.length===0)return lt;let ut=ct[0]??"",ft=Ln(ut).toLowerCase(),dt=ct.slice(1),mt=ct.findIndex((gt)=>!q_.has(gt));if(B.standard===!0&&mt!==-1&&hc(Ln(ct[mt]??"").toLowerCase(),ct.slice(mt+1)))return lt;let pt=Cw(ut,ft,dt);if(pt)return[...lt,...pt.map(at)];if(Kp.has(ft))return B.capturedOutput===!0?[...lt,...Jp(O).map(at)]:lt;if(ft==="eval")return[...lt,...yc(dt.join(" "),D,B,Q,ee,he)??dt.map(at)];if(ft==="export")return[...lt,...dt.flatMap((gt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(gt)?[gt.slice(gt.indexOf("=")+1)]:zn(ft,gt)).map(at)];if(ft==="git")return[...lt,...Ow(dt).map(at)];if(ft==="gh")return[...lt,...pc(ft,dt,rw).map(at)];if(Np.has(ft))return[...lt,...kw(dt).map(at)];if(nw.has(ft))return[...lt,...rP(dt).map(at)];if(K_.has(ft))return[...lt,...Lw(dt,D,B,Q,ee,he).map(at)];if(En.has(ft))return[...lt,...dt.flatMap((gt)=>zn("awk",gt)).map(at),...dt.flatMap((gt)=>Gw(gt,D,B,Q,ee,he)),...dt.flatMap(Fw).map(at)];if(ft==="curl")return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at),...Mw(dt).map(at)];if(Go(ft)){let gt=Lo.has(ft)?hn([ft,...dt]):null;if(gt!==null&&gt.command!==null&&gt.commandIndex!==null){let ht=D.getShellSyntax(gt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...ao(ht,D,B,Q,ee,he),...dt.slice(gt.commandIndex).filter((yt)=>!yt.startsWith("-")).map(at)]}return[...lt,...Ww(ft,dt,D,B,Q,ee,he)]}return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at)]}function Cw(O,D,B){let Q=Ls(D,B);if(Q===null||B[Q]!=="explain")return null;let ee=[O,...B.slice(0,Q)],he=B.slice(Q+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))ee.push(lt);je++;continue}return ee}return ee}function vw(O,D,B,Q,ee,he,je){if(ww(D,B,Q,ee,he,je)){let at=Jn(O),lt=hc(Ln(at[0]??"").toLowerCase(),at.slice(1))?at.slice(1).filter((ct)=>!ct.startsWith("-")):[];return[...Jp(O),...lt].map((ct)=>({target:ct,cwd:he}))}return Xp(D,xw(O),B,Q,ee,he,je,()=>[])}function Ew(O,D,B,Q,ee,he,je){let at=Jn(O);if(!Go(Ln(at[0]??"").toLowerCase()))return[];return yc(D,B,Q,ee,he,je)??[{target:D,cwd:he}]}function Xp(O,D,B,Q,ee,he,je,at){let lt=Pw(O);if(lt===null)return D.flatMap(at);return D.flatMap((ct)=>Lo.has(lt)?ao(B.getShellSyntax(ct),B,Q,ee,he,je):Fs(lt,ct,B,Q,ee,he,je))}function Jp(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase();if(!Kp.has(B))return[];let Q=D[D[1]==="--"?2:1];if(B==="printf"&&Q!==void 0&&!Q.startsWith("-")&&!Q.replaceAll("%%","").includes("%"))return[bc(Q.replaceAll("%%","%"))];return D.slice(1)}function xw(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase(),Q=D.slice(1);if(B==="echo"){let ee=Q.findIndex((he)=>!/^-[neE]+$/.test(he));return[(ee===-1?[]:Q.slice(ee)).join(" ")]}if(B==="printf")return Rw(Q);return[]}function Rw(O){let D=O[0];if(D===void 0)return[];let B=(D.match(/%%|%[bqs]/g)??[]).filter((ee)=>ee!=="%%").length;if(B===0||O.length===1)return[bc(D)];let Q=O.slice(1);return Array.from({length:Math.ceil(Q.length/B)},(ee,he)=>_w(D,Q.slice(he*B,(he+1)*B)))}function _w(O,D){let B=0;return bc(O.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let ee=D[B]??"";return B++,ee}))}function bc(O){return O.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function ww(O,D,B,Q,ee,he){let je=Jn(O);if(je.length===0||Ln(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Ir(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,ut=ct===null?[...lt,dc]:lt.map((ft)=>ft.split(ct).join(dc));return Bs(ut,D,B,Q,ee,he).some((ft)=>ft.target.includes(dc))}function Pw(O){let D=Jn(O);if(D.length===0)return null;let B=Ln(D[0]??"").toLowerCase();if(!Go(B))return null;return Aw(B,D.slice(1))?B:null}function Aw(O,D){let B=Sc(O);for(let Q=0;Q<D.length;Q++){let ee=D[Q];if(ee===void 0)break;if(Yp.has(ee)||Qp(O,ee)||/^--(?:eval|exec)=/.test(ee))return!1;if(ee==="-")return!0;if(ee.startsWith("-")){if(B==="python"&&ee==="-m")return!1;if(yw.get(B)?.has(ee))Q++;continue}return!1}return!0}function Sc(O){return/^python\d/.test(O)?"python":O}function Tw(O){let D=[];for(let B of O){if(tg(B))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(B);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")D.push(Q[1])}return D}var $p=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Iw(O,D){if(!D||!$p.test(O))return O;return`~${O.replace($p,"").replace(/\\/g,"/")}`}function zn(O,D){if(D==="--")return[];let B=[],Q=D.indexOf("=");if(Q>0&&Q<D.length-1)B.push(D.slice(Q+1));if(D.startsWith("-"))return B;if(O==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(D))return B;if(O==="zip"&&/\.zip$/i.test(D))return B;return B.push(D),B}function kw(O){let D=-1,B=!1;for(let Q=0;Q<O.length;Q++){let ee=O[Q]??"";if(!B&&ee==="--"){B=!0;continue}if(B||!/^-(?:[A-Za-z]|-)/.test(ee)){if(D===-1)D=Q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ee)){Q+=2;continue}if(ee==="--indent"||ee==="-L"){Q++;continue}if(ee.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ee)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ee))continue;return O.flatMap((he)=>zn("jq",he))}return O.flatMap((Q,ee)=>ee===D?[]:zn("jq",Q))}function Ow(O){let D=[];for(let B=0;B<O.length;B++){let Q=O[B]??"";if(Q==="--"||!Q.startsWith("-"))return[...D,...ow.has(Q)?pc("git",O.slice(B).map((he)=>/^-[aeinopqsv]+m$/.test(he)?"-m":he),iw):pc("git",O.slice(B),sw)];if(D.push(...zn("git",Q)),!gn.has(Q))continue;let ee=O[B+1];if(ee===void 0)break;D.push(...Q==="-c"&&ee.includes("=")?[ee.slice(ee.indexOf("=")+1)]:zn("git",ee)),B++}return D}function pc(O,D,B){let Q=[];for(let ee=0;ee<D.length;ee++){let he=D[ee]??"";if(he==="--")return[...Q,...D.slice(ee).flatMap((je)=>zn(O,je))];if(B.has(he)){ee++;continue}if(he.includes("=")&&B.has(he.slice(0,he.indexOf("="))))continue;Q.push(...zn(O,he))}return Q}function Mw(O){return O.flatMap((D,B)=>{let Q=Nw(D);if(Q!==null)return Up(Q.flag,Q.value);let ee=Dw(O[B-1]);return ee===null?[]:Up(ee,D)})}function Up(O,D){if(O==="-F"||O==="--form"){let B=D.indexOf("="),Q=B===-1?D:D.slice(B+1);if(!Q.startsWith("@")&&!Q.startsWith("<"))return[];return fc(Q.slice(1).split(";")[0]??"")}if(O==="--data-urlencode"){let B=D.indexOf("@"),Q=D.indexOf("=");if(B===-1||Q!==-1&&Q<B)return[];return fc(D.slice(B+1))}return D.startsWith("@")?fc(D.slice(1)):[]}function Dw(O){if(O===void 0)return null;if(qp.has(O))return O;return/^-[A-Za-z]+[dF]$/.test(O)?`-${O.slice(-1)}`:null}function Nw(O){let D=O.slice(0,2);if(O.length>2&&(D==="-d"||D==="-F"))return{flag:D,value:O.slice(2)};let B=O.indexOf("=");if(B===-1)return null;let Q=O.slice(0,B);return qp.has(Q)?{flag:Q,value:O.slice(B+1)}:null}function fc(O){return O===""||O==="-"?[]:[O]}function Lw(O,D,B,Q,ee,he){let je=O.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...O.slice(0,je===-1?O.length:je),...O.flatMap((lt,ct)=>lt==="-files0-from"&&O[ct+1]!==void 0?[O[ct+1]??""]:[])];for(let lt=0;lt<O.length;lt++){if(!Y_.has(O[lt]??""))continue;let ct=O.slice(lt+1),ut=ct.findIndex((mt)=>Z_.has(mt)),ft=ut===-1?ct:ct.slice(0,ut),dt=Bs(ft,D,B,Q,ee,he).map((mt)=>mt.target);if(at.push(...dt.filter((mt)=>mt!=="{}")),!dt.includes("{}"))continue;at.push(...O.slice(0,lt).flatMap((mt,pt,gt)=>{if(!J_.has(mt))return[];let ht=gt[pt+1];return ht===void 0?[]:[ht,ht.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function Ww(O,D,B,Q,ee,he,je){let at=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(Yp.has(ct)||Qp(O,ct)){let ft=D[lt+1];if(ft!==void 0)at.push(...Fs(O,ft,B,Q,ee,he,je)),lt++;continue}let ut=/^--(?:eval|exec)=(.*)$/.exec(ct);if(ut!==null&&ut[1]!==void 0){at.push(...Fs(O,ut[1],B,Q,ee,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function Qp(O,D){if(!D.startsWith("-")||D.startsWith("--")||D.length<=2)return!1;return tw.get(D[D.length-1]??"")?.has(Sc(O))??!1}function Gw(O,D,B,Q,ee,he){if(!O.includes("system"))return[];return wl(O)?.commands.flatMap((je)=>ao(D.getShellSyntax(je),D,B,Q,ee,he))??[]}function Fw(O){return Array.from(O.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((D)=>D[1]).filter((D)=>D!==void 0&&D!=="")}function zw(O){let D=Array.from(O.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((B)=>B[2]).filter((B)=>B!==void 0&&B!=="");return[...D,...D.flatMap(Cc),...O.match(mc)??[]]}function Fs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:he}),lt=$w(D,Bw(O));if(lt===null)return zw(D).map(at);let ct=lt.masked.match(Gp)!==null||lt.literals.some((gt)=>Fp.test(lt.masked.slice(0,gt.start))),ut=lt.masked.match(gw)!==null||lt.literals.some((gt)=>hw.test(lt.masked.slice(0,gt.start))),ft=Q.standard===!0&&!Lo.has(O),dt=ft&&!(Vw(lt.masked)||ct||ut)?[]:lt.literals,mt=ft?Array.from(lt.masked.matchAll(Gp),(gt)=>{let ht=gt.index+gt[0].length;return{start:ht,end:sl(lt.masked,ht)}}):[],pt=!ft||mt.some((gt)=>al(lt.masked,gt.start))?lt.literals:lt.literals.filter((gt)=>Fp.test(lt.masked.slice(0,gt.start))||mt.some((ht)=>gt.start>=ht.start&&gt.start<ht.end));return[...dt.map((gt)=>gt.text).filter((gt)=>gt!=="").map(at),...dt.flatMap((gt)=>Cc(gt.text)).map(at),...ft?[]:lt.literals.flatMap((gt)=>gt.text.match(mc)??[]).map(at),...ct?pt.flatMap((gt)=>yc(gt.text,B,Q,ee,he,je)??[at(gt.text)]):[],...ut?lt.literals.flatMap((gt)=>Fs(O,gt.text.replace(/\\(.)/g,(ht,yt)=>yt==="n"?`
-`:yt),B,Q,ee,he,je)):[],...(lt.masked.match(mc)??[]).map(at)]}function Bw(O){let D=Sc(O);if(D==="python")return"python";if(D==="osascript")return"opaque";return D==="node"||D==="bun"||D==="deno"?"javascript":"simple"}function $w(O,D){if(D==="opaque")return null;let B=O.split(""),Q=[];for(let ee=0;ee<O.length;ee++){let he=O[ee]??"";if(D==="simple"&&(he==="`"||he==="%"||he==="<")){if(mw.test(O.slice(ee)))return null}let je=he==="'"||he==='"'||D==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&jw(O,ee))return null;let at=D==="python"?Uw(O,ee):"",lt=D==="python"&&O.startsWith(je.repeat(3),ee)?je.repeat(3):je,ct=ee+lt.length,ut=Hw(O,ct,lt);if(ut===null)return null;let ft=O.slice(ct,ut);if(/[fF]/.test(at)&&ft.includes("{"))return null;if(D==="simple"&&je==='"'&&pw.test(ft))return null;Q.push({start:ct,text:ft});for(let dt=ee;dt<ut+lt.length;dt++)B[dt]=" ";ee=ut+lt.length-1}return{masked:B.join(""),literals:Q}}function Uw(O,D){return fw.exec(O.slice(Math.max(0,D-3),D))?.[1]??""}function Hw(O,D,B){let Q=B==="`",ee=Q||B.length===3;for(let he=D;he<O.length;he++){let je=O[he];if(je==="\\"){he++;continue}if(Q&&je==="$"&&O[he+1]==="{")return null;if(!ee&&(je===`
-`||je==="\r"))return null;if(O.startsWith(B,he))return he}return null}function jw(O,D){for(let B=D-1;B>=0;B--){let Q=O[B];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function Vw(O){for(let D of O.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let B=D[0],Q=D.index;if(Q_.has(B.toLowerCase()))return!0;let ee=B.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!ee.some((he)=>ew.has(he)))continue;if(ee.length>1)return!0;if(Kw(O,Q)===".")return!0;if(qw(O,Q+B.length)==="(")return!0}return!1}function Kw(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return O[B];return}function qw(O,D){for(let B=D;B<O.length;B++)if(!/\s/.test(O[B]??""))return O[B];return}function Yw(O,D,B,Q,ee,he){return eP(O).flatMap((je)=>{let at=D.getShellSyntax(je);if(at.status==="invalid")return[];return[...ao(at,D,{...B,capturedOutput:!0},Q,ee,he),...Zw(at,Q)?Xw(at,Q).map((lt)=>({target:lt,cwd:ee})):[]]})}function Zw(O,D){let B=Qi(O);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee?.kind!=="word"||Ln(Vn(ee.text,D)).toLowerCase()!=="base64")continue;for(let he=Q+1;he<B.length;he++){let je=B[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=Vn(je.text,D);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function Xw(O,D){return Qi(O).flatMap((B)=>B.kind==="word"?[Vn(B.text,D)]:B.kind==="redirection"&&B.target?[Vn(B.target,D)]:[]).flatMap(Cc)}function Cc(O){let D=Qw(O);if(D===null)return[];let B=Buffer.from(D,"base64").toString("utf8");if(B===""||Jw(B))return[];return Buffer.from(B,"utf8").toString("base64").replace(/=+$/g,"")===D.replace(/=+$/g,"")?[B]:[]}function Jw(O){return Array.from(O).some((D)=>{let B=D.charCodeAt(0);return B<32||B===127})}function Qw(O){if(O.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(O))return null;if(/=/.test(O.replace(/=+$/g,"")))return null;let D=O.replace(/=+$/g,"");if(D.length%4===1)return null;return`${D.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-D.length%4)%4)}`}function eP(O){let D=[],B={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(So(ee,B))continue;if(eg(O,Q,B)){let he=tP(O,Q+1);if(he!==null)D.push(he.body),Q=he.endIndex;continue}if(!B.inSingle&&ee==="`"){let he=nP(O,Q);if(he!==null)D.push(he.body),Q=he.endIndex}}return D}function tP(O,D){let B={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let ee=D+1;ee<O.length;ee++){let he=O[ee];if(!he)break;if(So(he,B))continue;if(eg(O,ee,B)){Q++,ee++;continue}if(!B.inSingle&&!B.inDouble&&he===")"){if(Q--,Q===0)return{body:O.slice(D+1,ee),endIndex:ee}}}return null}function nP(O,D){let B=!1;for(let Q=D+1;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="`")return{body:O.slice(D+1,Q),endIndex:Q}}return null}function eg(O,D,B){return!B.inSingle&&O[D]==="$"&&O[D+1]==="("&&O[D+2]!=="("}function rP(O){let D=[],B=[],Q=!1,ee=!1,he=!1;for(let lt=0;lt<O.length;lt++){let ct=O[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){B.push(ct);continue}let ut=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(ut!==null){let ft=ut[1]??"",dt=ut[2];if(ft===aw)ee=!0;if(cw.has(ft))Q=!0;if(dt!==void 0){if(ft===Wp)D.push(dt);continue}if(dw.has(ft)){let mt=O[lt+1];if(ft===Wp&&mt!==void 0)D.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),dt="",mt="";for(let gt=0;gt<ft.length;gt++){let ht=ft[gt]??"";if(lw.has(ht))Q=!0;if(uw.has(ht)){dt=ht,mt=ft.slice(gt+1);break}}if(dt==="")continue;if(mt.length>0){if(dt===Lp)D.push(mt);continue}let pt=O[lt+1];if(dt===Lp&&pt!==void 0)D.push(pt);lt++;continue}B.push(ct)}let at=!Q&&!ee?B.slice(1):B;return[...D,...at]}function Jn(O){let D=O.findIndex((B)=>!tg(B)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(B));return D===-1?[]:O.slice(D)}function tg(O){return O==="env"||O==="command"||O==="builtin"||O==="sudo"}var oP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),iP=".env.",sP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),aP=[".env.example.",".env.sample."];function lP(O){let D;try{D=new URL(O.trim())}catch{return!1}return D.protocol!=="file:"&&D.host!==""}function cP(O){return O.length>0&&!/\s/.test(O)}function gc(O,D,B,Q){let ee=ng(O,D,B,Q);return ee!==""&&B.paths.entryKind(ee)!=="missing"}function ng(O,D,B,Q){try{return oi(O,D,B,Q)}catch(ee){if(ee instanceof s)throw ee;return""}}var uP=new Set(["node_modules","__pycache__"]),dP=[["vendor","bundle"],["vendor","cache"]];function fP(O,D,B,Q,ee){if(lP(O))return null;let he=Fn(O,D,Q,ee);if(!he)return null;let je=Gt(he.split("/").pop()??""),at=Gt(he),lt=()=>cP(je)||gc(O,D,Q,ee);if(sP.has(je)||aP.some((dt)=>je.startsWith(dt)))return null;let ct=Gt(bP(O,D,Q,ee));for(let dt of Ea){let mt=`~/${dt.suffixParts.join("/")}`;if((jp(at,mt)||jp(ct,mt))&&Xn(dt.id,B))return dt.id}let ut=mP(he,D,B,Q,ee);if(ut)return ut;if(oP.has(je))return null;for(let dt of va)if(je===dt.basename&&Xn(dt.id,B))return dt.id;if(je.startsWith(iP)&&Xn(vi.id,B)&&lt())return vi.id;for(let dt of xa)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){let mt=je.slice(dt.prefix.length)[0];if((mt==="-"||mt==="_")&&Xn(dt.id,B)&&lt())return dt.id}for(let dt of Ra)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){if(je.slice(dt.prefix.length)===dt.suffix&&Xn(dt.id,B))return dt.id}if(hP(at))return null;if(!je.includes(".")&&Co.pattern.test(je)&&Xn(Co.id,B))return Co.id;let ft=yP(je,B);if(ft)return ft;return null}function mP(O,D,B,Q,ee){return Ei.find((he)=>{if(!Xn(he.id,B))return!1;switch(he.id){case"secret.cli.claude-code":return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Gt(O).split("/");return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),["settings.json","settings.local.json"])||ri(O,"~/.claude.json",D,Q,ee)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Dt(O,Fn("~/.gemini/config",D,Q,ee),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee);return Dt(O,je,["auth.json",".credentials.json"])||ni(O,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee),at=Gt(O).split("/").at(-1)??"";return Dt(O,je,["config.toml"])||at.endsWith(".config.toml")&&Dt(O,je,[at])}case"secret.cli.gemini":return Dt(O,rn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Gt(O).split("/"),at=Q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=Q.env.get("ProgramData")?[rn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"gemini-cli")]:[];return Dt(O,rn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?ri(O,at,D,Q,ee):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Dt(O,Fn(ct,D,Q,ee),["settings.json"]))}case"secret.cli.copilot-cli":{let je=Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee);return Dt(O,je,["config.json"])||ni(O,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Dt(O,Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),at=Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee);return Dt(O,je,["server.token"])||ni(O,je,["credentials"])||ni(O,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Gt(O).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Dt(O,Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),je)||Dt(O,Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=rn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"opencode"),at=Gt(O).split("/").at(-1)??"",lt=Q.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Dt(O,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Dt(O,je,[at])||ct.some((ut)=>ri(O,ut,D,Q,ee))}case"secret.cli.opencode.config":{let je=Q.env.get("OPENCODE_CONFIG_DIR")?Wt(Q.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",D,Q,ee):rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"opencode"),at=Q.env.get("ProgramData")?[rn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=Q.env.get("OPENCODE_CONFIG");return lt.includes(Gt(O).split("/").at(-1)??"")||Dt(O,je,lt)||(ct?.trim()?ri(O,ct,D,Q,ee):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((ut)=>Dt(O,Fn(ut,D,Q,ee),lt))}case"secret.cli.pi":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["auth.json"]);case"secret.cli.pi.config":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["models.json"]);case"secret.cli.amp":{let je=Fn("~",D,Q,ee);return[rn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"amp"),rn(je,".local","share","amp")].some((lt)=>Dt(O,lt,["secrets.json"]))||ni(O,rn(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"amp"),rn(Fn("~",D,Q,ee),".config","amp")],lt=Gt(O).split("/"),ct=Q.env.get("AMP_SETTINGS_FILE");return at.some((ut)=>Dt(O,ut,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?ri(O,ct,D,Q,ee):!1)}case"secret.cli.cursor":{let je=rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"cursor"),at=rn(Wt(Q.env.get("CURSOR_DATA_DIR"),"~/.cursor",D,Q,ee),"projects");return Dt(O,Fn("~/.cursor",D,Q,ee),["auth.json"])||Dt(O,je,["auth.json"])||Gt(O).split("/").at(-1)==="mcp-auth.json"&&Mr(Gt(O),Gt(at))}case"secret.cli.cursor.config":{let je=Gt(O).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Gt(O).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["config.toml","managed_config.toml","requirements.toml"])||Dt(O,Fn("/etc/grok",D,Q,ee),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Hp=new WeakMap;function Wt(O,D,B,Q,ee){let he=Hp.get(ee)??new Map;Hp.set(ee,he);let je=`${B}\x00${O??""}\x00${D}`,at=he.get(je);if(at!==void 0)return at;let lt=Fn(O?.trim()?O:D,B,Q,ee);return he.set(je,lt),lt}function Dt(O,D,B){return B.some((Q)=>rg(O,rn(D,Q)))}function ni(O,D,B){return B.some((Q)=>Mr(Gt(O),Gt(rn(D,Q))))}function ri(O,D,B,Q,ee){return rg(O,Fn(D,B,Q,ee))}function rg(O,D){return Gt(O)===Gt(D)}function rn(O,...D){return Nn([O,...D].filter(Boolean).join("/"))}function pP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(oi(O,D,ee,he));return B.some((at)=>Mr(je,Gt(oi(at,Q,ee,he))))}function gP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(oi(O,D,ee,he));if(!je)return!1;let at=ee.env.get("HOME")??ee.home,lt=at?Nn(Lt(pn(at),ee.paths,he)):"",ct=Gt(lt),ut=ee.env.get("CC_SAFETY_NET_HOME"),ft=Gt(ut?Nn(Lt(zs(pn(ut)),ee.paths,he)):lt&&Nn(Lt(`${lt}/.cc-safety-net`,ee.paths,he)));if(ft&&Mr(je,ft))return!1;return B.some((dt)=>{let mt=Gt(oi(dt,Q,ee,he));if(!mt)return!1;if(ct&&(ct===mt||ct.startsWith(mt.endsWith("/")?mt:`${mt}/`)))return!1;return Mr(je,mt)})}function hP(O){let D=O.split("/");return D.some((B)=>uP.has(B))||dP.some(([B,Q])=>D.some((ee,he)=>ee===B&&D[he+1]===Q))}function yP(O,D){let B=O.lastIndexOf("."),Q=B>0&&B<O.length-1?O.slice(B+1):"";if(Q==="")return null;for(let ee of _a)if(Q===ee.extension&&Xn(ee.id,D))return ee.id;for(let ee of wa)if(ee.pattern.test(Q)&&Xn(ee.id,D))return ee.id;return null}function Gt(O){return O.toLowerCase()}function Xn(O,D){return!D?.disabledRules?.includes(O)}function Fn(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he)return"";if(!ee)return he;let je=Ec(he,ee),at=Gs(je)?je:Nn(zs(D,je)),lt=Nn(Lt(at,B.paths,Q));if(!Mr(lt,ee)){if(Gs(je))return lt;return lt===at?he:lt}let ct=lt.slice(ee.length);return ct?`~${ct}`:"~"}function jp(O,D){return O===D||O.startsWith(`${D}/`)}function bP(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he||!ee)return"";let je=Ec(he,ee),at=H_.normalize(Gs(je)?je:Nn(zs(D,je))),lt=Nn(pn(B.env.get("HOME")??B.home)),ct=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ut=[ee,lt].find((dt)=>dt!==""&&Mr(ct(at),ct(dt)));if(ut===void 0)return"";let ft=at.slice(ut.length);return ft?`~${ft}`:"~"}function oi(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he)return"";let je=ee?Ec(he,ee):he;return Nn(Lt(Gs(je)?je:zs(D,je),B.paths,Q))}function vc(O,D,B){let Q=D.env.get("HOME")??D.home,ee=Q?Nn(Lt(pn(Q),D.paths,B)):"",he=Nn(pn(SP(Vn(O,D))));return{home:ee,normalized:he}}function SP(O){if(!O.trim().toLowerCase().startsWith("file:"))return O;try{return V_(O)}catch{return O}}function Ec(O,D){if(O==="~")return D;if(O.startsWith("~/"))return rn(D,O.slice(2));return O}function CP(O){if(process.platform==="win32")return!0;return j_.parse(O).root.length>1}function Nn(O){let D=O.trim(),B=(D.includes("\\")&&CP(D)?D.replace(/\\/g,"/"):D).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(B==="/")return B;return B.replace(/\/+$/g,"")}function Mr(O,D){return O===D||O.startsWith(D.endsWith("/")?D:`${D}/`)}function Ln(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(O,D,B){super(`CC Safety Net ${O} dependency failed`,{cause:B});this.stage=O;this.evaluation=D}}var vP={findPolicyMutation:Mp,findGitMetadataMutation:pf,resolveGitMetadata:EP,loadPolicySnapshot:E,findSensitiveTarget:Zp,analyzeCommand:wp,getModes:R};function W(O,D){let B={...vP,...D.dependencies},Q=_P(O),ee=ii(O)?O.command:Q,he=ur("policy-protection",ee,()=>Fo(O)),je=un(he,"input-candidate"),at=un(he,"declared-command");if(ii(O)&&O.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Wn,intent:"stop_and_explain",evidence:{command:O.command,segment:O.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Mf,intent:"stop_and_explain"}};let lt=mn(),ct=ur("policy-protection",ee,()=>B.resolveGitMetadata([O.context.executionCwd,O.context.configCwd],D.environment)),ut=ur("policy-protection",ee,()=>B.findPolicyMutation(he,D.environment,lt));if(ut){let Et=ee??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:Et,segment:ut.target}}}}let ft=ur("policy-protection",ee,()=>Tp(he,D.environment,lt));if(ft){let Et=ee??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:Et,segment:ft.target}}}}let dt=ur("policy-protection",ee,()=>B.findGitMetadataMutation(he,ct,D.environment,lt));if(dt){let Et=ee??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Et,segment:dt.target}}}}let mt=ur("config-load",ee,()=>B.loadPolicySnapshot(D.environment,{...D.policyOptions,cwd:O.context.configCwd})),pt=mt.policy,gt=B.getModes(pt,D.environment.env),ht={level:gt.effectiveLevel,...xP(mt)},yt=pt.secretProtection.enabled===!1?null:ur("secret-protection",ee,()=>B.findSensitiveTarget(he,pt.secretProtection,D.environment,lt,{strict:ii(O)||je?.program.dialect==="powershell"?gt.strict:void 0}));if(yt){let Et=ee??yt.target;return{stage:"secret-protection",...ht,decision:{kind:"deny",reason:Vp,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:Et,segment:yt.target}}}}if(!ii(O))return{stage:"non-command",...ht,decision:{kind:"allow"}};if(!O.command||O.command.trim()==="")return{...xc("command-validation",ee),...ht};let Ct=ur("command-analysis",ee,()=>Pp(()=>B.analyzeCommand(O.command,{cwd:O.context.executionCwd,shell:O.route.shell,policySnapshot:mt,environment:D.environment,protectedGitMetadata:ct,effectiveCapabilities:gt.capabilities,strict:gt.strict,paranoidRm:gt.paranoidRm,paranoidInterpreters:gt.paranoidInterpreters,worktreeMode:gt.worktreeMode,budget:lt,...D.trace?{trace:D.trace}:{}},RP(he),he.store),O.command,D.trace));if(Ct.decision){let Et=!gt.strict&&Ct.decision.kind==="deny"&&(Ct.decision.ruleId==="raw-text.dangerous-command"||Ct.decision.reason===Uo&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(Ct.decision.evidence?.segment??"")&&xn(O.command)===null);return{stage:"command-analysis",...ht,..."errorCode"in Ct?{errorCode:Ct.errorCode}:{},decision:Et?{...Ct.decision,ask:!0}:Ct.decision}}return{stage:"command-analysis",...ht,decision:{kind:"allow"}}}function EP(O,D){let B=[...new Set(O.filter((Q)=>typeof Q==="string"&&Q!==""))].flatMap((Q)=>D.gitMetadata(Q)??[]);if(B.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(B.flatMap((Q)=>Q.entries))]),markerFiles:Object.freeze([...new Set(B.flatMap((Q)=>Q.markerFiles))]),directories:Object.freeze([...new Set(B.flatMap((Q)=>Q.directories))]),hooksDirectories:Object.freeze([...new Set(B.flatMap((Q)=>Q.hooksDirectories))])})}function xP(O){if(O.state==="ready")return{};return{configFallback:{reason:O.reason}}}function RP(O){return un(O,"declared-command")?.program}function _P(O){try{return ne(O.input)}catch(D){let B=ii(O)?O.command:void 0;throw new p("policy-protection",xc("policy-protection",D instanceof f?void 0:B,D),D)}}function ur(O,D,B){try{return B()}catch(Q){throw new p(O,xc(O,Q instanceof f?void 0:D,Q),Q)}}function xc(O,D,B){let Q=B instanceof s||B instanceof y;return{stage:O,decision:{kind:"deny",reason:Q?Vs:te,intent:"stop_and_explain",...D?{evidence:{command:D,segment:D}}:{}}}}function ii(O){return O.route.kind==="command"}
-export{te,a,s,z,ke,Ue,k,Ze,Ge,ye,P,be,Xe,c,o,He,xe,R,L,ve,Qe,f,V,ne,ce,et,We,d,Re,r,v,i,re,n,g,le,N,tt,nt,l,ue,de,rt,A,q,oe,S,ot,F,b,Se,M,u,K,Be,ze,I,w,T,pe,fe,Le,it,m,e,Te,we,Ve,qe,ie,Ce,se,_e,J,j,Pe,me,U,Ke,G,Y,Z,ae,Je,Ye,C,H,Ae,Ie,Oe,De,E,Ne,Ee,Fe,h,t,X,ge,y,x,_,st,Me,$e,p,W};