cc-safety-net 2.4.9 → 2.4.11

package/dist/chunks/index-mzkasrgh.js

@@ -0,0 +1,45 @@
+var qs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Gn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",te="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ks={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},uo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...Ks},processedCandidateBytes:{cap:4194304,...Ks},pathEnvironmentExpansion:{cap:64,...Ks},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...uo},trackedHeredocFiles:{cap:64,...uo},controlFlowStates:{cap:64,...uo},wrapperPeelIterations:{cap:20,...uo},derivedCommandShape:uo});class s extends Error{kind;name="AnalysisLimit";constructor(O){super(a[O].reason);this.kind=O}}function mn(){let O=new Map;return{counters:O,resolvedPaths:new Map,charge(D,B=1){let Q=(O.get(D)??0)+B;if(O.set(D,Q),Q>a[D].cap)throw new s(D)}}}import{lstatSync as Vg,realpathSync as Kg,statSync as qg}from"node:fs";import{homedir as Yg,tmpdir as Zg}from"node:os";import{statSync as Ug}from"node:fs";import{join as Hg}from"node:path";import{basename as Mc,dirname as dg,isAbsolute as fg,join as mg,normalize as pg,resolve as kc}from"node:path";var gg=256,ci=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(O,D=process.platform){if(D!=="win32")return O;return O.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function er(O,D=process.platform){if(D!=="win32")return!1;return(O[0]==="/"||O[0]==="\\")&&(O[1]==="/"||O[1]==="\\")}function Js(O,D){return Ys(O,0,D)}function Ys(O,D,B){let Q="",ee=0;while(ee<O.length){if(O[ee]!=="$"){Q+=O[ee],ee++;continue}if(O[ee+1]==="{"){let je=Zs(O,ee+2),at=hg(O,ee,D);if(at===null){if(ci.has(je))throw new s("pathEnvironmentExpansion");Q+=O.slice(ee);break}let lt=O.slice(ee,at+1);Q+=yg(lt,D,B),ee=at+1;continue}let he=Zs(O,ee+1);if(!he){Q+="$",ee++;continue}Q+=Xs(he,B)??`$${he}`,ee+=he.length+1}return Q}function hg(O,D,B){let Q=1;for(let ee=D+2;ee<O.length;ee++){if(O[ee]==="\\"){ee++;continue}if(O[ee]==="$"&&O[ee+1]==="{"){if(Q++,B+Q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ee++;continue}if(O[ee]!=="}")continue;if(Q--,Q===0)return ee}return null}function yg(O,D,B){let Q=O.slice(2,-1),ee=Zs(Q,0);if(!ee)return O;let he=Q.slice(ee.length);if(!he)return Xs(ee,B)??O;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(ci.has(ee))throw new s("pathEnvironmentExpansion");return O}if(!ci.has(ee))return O;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=Xs(ee,B),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":Ys(he.slice(je.length),D+1,B);return lt?Ys(he.slice(je.length),D+1,B):""}function Zs(O,D){if(!/[A-Za-z_]/.test(O[D]??""))return"";let B=D+1;while(/[A-Za-z0-9_]/.test(O[B]??""))B++;return O.slice(D,B)}function Xs(O,D){if(!ci.has(O))return null;if(O==="HOME")return D.env.get("HOME")??D.home;return D.env.get(O)??null}function Wt(O,D,B){if(!O)return O;let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;let ee=[],he=O;while(!0){Dc(B,he);let je=D.realpath(he);if(je!==null)return Oc(B,O,je,ee);let at=dg(he);if(at===he||ee.length>=gg)return Oc(B,O,he,ee);ee.push(Mc(he)),he=at}}function Oc(O,D,B,Q){let ee=Q.length===0?B:mg(B,...Q.reverse());return O.resolvedPaths.set(D,ee),ee}function bg(O,D,B){let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;Dc(B,O);let ee=D.realpath(O);if(ee!==null)B.resolvedPaths.set(O,ee);return ee}function Dc(O,D){O.charge("realpathAttempts"),O.charge("processedCandidateBytes",Buffer.byteLength(D))}function tn(O,D,B,Q){let ee=Lc(O,D,B);if(!ee)return"";return Wt(ee,B.paths,Q).replace(/\\/g,"/")}function Nc(O,D,B,Q,ee){let he=Lc(O,D,B);if(!he)return null;if(ee(Mc(he)))return Wt(he,B.paths,Q).replace(/\\/g,"/");let je=bg(he,B.paths,Q);return je===null?null:je.replace(/\\/g,"/")}function Lc(O,D,B){let Q=B.home,ee=Js(O.trim(),B).replace(/\\/g,"/");if(!ee)return"";let he=ee==="~"?Q:ee.startsWith("~/")?kc(Q,ee.slice(2)):ee,je=pn(he);return pg(fg(je)?je:kc(D,je))}import{spawnSync as Sg}from"node:child_process";import{existsSync as mo,lstatSync as Cg,readFileSync as po,realpathSync as Nr,statSync as fo}from"node:fs";import{dirname as Qs,isAbsolute as ea,join as Lr,resolve as ui}from"node:path";var vg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Eg=5000;function Gc(O,D=Fg(),B=Eg){let Q=xg(O),ee=Q===null?null:Rg(Q);if(Q===null||ee===null)return null;let he=Wg(Q,ee,D,B);return he===null?null:{recursiveSubmodules:he}}function xg(O){try{let D=Nr(ui(O));return fo(D).isDirectory()?D:null}catch{return null}}function Rg(O){let D=Lg(O);if(!D)return null;try{let B=Cg(D);if(B.isSymbolicLink()||!B.isFile())return null;let Q=ta(D);if(!Q?.commonDir)return null;if(!Pg(Q.gitDir,D))return null;return Ag(Q.gitDir,Qs(D))?{gitDir:Q.gitDir,commonDir:Q.commonDir}:null}catch{return null}}function ta(O){try{let D=_g(O);if(!D)return null;let B=Nr(ea(D)?D:ui(Qs(O),D));if(!fo(B).isDirectory())return null;return{gitDir:B,commonDir:wg(B)}}catch{return null}}function _g(O){let D=po(O,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!D.startsWith("gitdir:"))return null;return D.slice(7).trim()||null}function wg(O){try{let D=po(Lr(O,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!D)return null;let B=Nr(ea(D)?D:ui(O,D));return fo(B).isDirectory()?B:null}catch{return null}}function Pg(O,D){let B=Tg(O);return B===null?!1:Fc(O,B,D)}function Ag(O,D){let B=Ig(O);return B===null?!0:Fc(O,B,D)}function Tg(O){let D=Lr(O,"gitdir");if(!mo(D))return null;let B=po(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return B===""?null:B}function Ig(O){let D=Lr(O,"config.worktree");return mo(D)?Og(D):null}function Fc(O,D,B){try{return kg(ea(D)?D:ui(O,D),B)}catch{return!1}}function kg(O,D){try{let B=fo(O),Q=fo(D);if(B.ino!==0&&Q.ino!==0&&B.dev===Q.dev&&B.ino===Q.ino)return!0}catch{}return Wc(Nr.native(O))===Wc(Nr.native(D))}function Wc(O){let D=O.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),B=D.length>1&&D.endsWith("/")?D.slice(0,-1):D;return process.platform==="win32"?B.toLowerCase():B}function Og(O){let D=po(O,"utf-8"),B=!1,Q=null;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){B=/^\[core\]$/i.test(he);continue}if(!B)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)Q=Mg(je[1]??"")}return Q}function Mg(O){let D=O.trim();if(!D.startsWith('"')||!D.endsWith('"'))return D;return Ng(D.slice(1,-1))}var Dg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Ng(O){return O.replace(/\\(.?)/gs,(D,B)=>B===""?D:Dg[B]??D)}function Lg(O){try{return na(Nr(O))}catch{return null}}function na(O){let D=O;while(!0){let B=Lr(D,".git");if(mo(B))return B;let Q=Qs(D);if(Q===D)return null;D=Q}}function Wg(O,D,B,Q){if(Gg(D))return!0;if(B===null)return!0;let ee=Sg(B,["config","--get","submodule.recurse"],{cwd:O,encoding:"utf8",env:zg(process.env),stdio:["ignore","pipe","ignore"],timeout:Q});if(ee.error!==void 0||ee.status!==0&&ee.status!==1)return null;return ee.status===0&&zc(ee.stdout.trim())}function Gg(O){return[Lr(O.commonDir,"config"),Lr(O.gitDir,"config.worktree")].filter((D)=>mo(D)).some((D)=>Bg(D))}function Fg(){return vg.find((O)=>mo(O))??null}function go(O){return O==="GIT_CONFIG_COUNT"||O==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(O)}function zg(O){return Object.fromEntries(Object.entries(O).filter(([D])=>!go(D)))}function Bg(O){let D;try{D=po(O,"utf-8")}catch{return!0}let B="",Q=!1;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){B=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if($g(B)&&lt==="path")return!0;if(B==="submodule"&&lt==="recurse")Q=zc(ct)}return Q}function $g(O){return O==="include"||O.startsWith("includeif ")}function zc(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Bc(O,D){if(O==="")return null;let B=mn(),Q=na(tn(O,O,D,B)),ee=Q?jg(Q,O,D,B):null;if(!ee)return null;return Object.freeze({entries:Object.freeze([ee.entry]),markerFiles:Object.freeze(ee.markerFile?[ee.markerFile]:[]),directories:Object.freeze(ee.directories),hooksDirectories:Object.freeze(ee.hooksDirectories)})}function jg(O,D,B,Q){try{let ee=tn(O,D,B,Q),he=Ug(O),je=he.isFile()?ee:null,at=he.isFile()?ta(O):null,lt=(he.isDirectory()?[ee]:[at?.gitDir,at?.commonDir]).flatMap((ut)=>ut?[Wr(tn(ut,D,B,Q))]:[]),ct=[...new Set(he.isDirectory()?[Wr(O.replace(/\\/g,"/")),...lt]:lt)];return{entry:Wr(ee),markerFile:je?Wr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((ut)=>{let ft=Wr(Hg(ut,"hooks").replace(/\\/g,"/"));return[ft,Wr(tn(ft,D,B,Q))]}))]}}catch{return null}}function Wr(O){return process.platform==="win32"?O.toLowerCase():O}var Xg={realpath:(O)=>{try{return Kg(O)}catch{return null}},entryKind:(O)=>{let D=Vg(O,{throwIfNoEntry:!1});if(!D)return"missing";return D.isSymbolicLink()?"symlink":"present"},isDirectory:(O)=>{try{return qg(O).isDirectory()}catch{return!1}}};function c(){return Jg({env:new Map(Object.entries(process.env).flatMap(([O,D])=>D===void 0?[]:[[O,D]])),home:pn(process.env.HOME||Yg()),tmpdir:Zg(),paths:Xg})}function Jg(O,D={}){let B=new Map,Q=new Map,ee={...O,gitMetadata:(he)=>$c(B,he,()=>Bc(he,ee)),worktreeFacts:(he)=>$c(Q,he,()=>Gc(he)),...D};return ee}function $c(O,D,B){let Q=O.get(D);if(Q!==void 0)return Q;let ee=B();return O.set(D,ee),ee}import{accessSync as wh,constants as iu,statSync as Ph}from"node:fs";import{isAbsolute as au,relative as Ah,resolve as Th,sep as Ih}from"node:path";var Qg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function z(O){return ke(O.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(O){return Qg.reduce((D,B)=>D.replace(B,"<redacted>"),O.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(O){return Uc(O).reduceRight((D,B)=>`${D.slice(0,B.valueStart)}<redacted>${D.slice(B.valueEnd)}`,O)}function k(O){return ke(Ue(O))}function Ze(O){return Uc(O).map((D)=>O.slice(D.valueStart,D.valueEnd))}function Ge(O){return/[A-Za-z_][A-Za-z0-9_]*=/.test(O)}function Uc(O){return[...O.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((D)=>{let B=O[D.index-1];if(D.index>0&&B&&!/[\s"'([{]/.test(B))return[];let Q=D.index+D[0].length;if(Q>=O.length)return[];return[{valueStart:Q,valueEnd:eh(O,Q)}]})}function eh(O,D){if(O.startsWith("$(",D))return th(O,D);let B=O[D];if(B==='"'||B==="'"){for(let ee=D+1;ee<O.length;ee++){if(B==='"'&&O[ee]==="\\"){ee++;continue}if(O[ee]===B)return ee+1}return O.length}let Q=D;while(Q<O.length&&!/\s/.test(O[Q]??""))Q++;return Q}function th(O,D){let B=0,Q;for(let ee=D;ee<O.length;ee++){let he=O[ee];if(Q){if(Q==='"'&&he==="\\"){ee++;continue}if(he===Q)Q=void 0;continue}if(he==='"'||he==="'"){Q=he;continue}if(he==="$"&&O[ee+1]==="("){B++,ee++;continue}if(he!==")")continue;if(B--,B===0)return ee+1}return O.length}var nh={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function rh(O){let D=O.maxLen??200,B=O.redact??((ee)=>ee),Q=(ee)=>ee.length>D?`${ee.slice(0,D)}...`:ee;return[O.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${B(O.reason)}`,O.ruleId?`Rule: ${O.ruleId}`:void 0,O.toolName?`Tool: ${O.toolName}`:void 0,O.command?`Command: ${Q(B(O.command))}`:void 0,O.segment&&O.segment!==O.command?`Segment: ${Q(B(O.segment))}`:void 0,O.configWarning?`Config warning: ${B(O.configWarning)}`:void 0,O.askUser?"Approve only if you expected this command.":nh[O.intent??"manual_only"]].filter((ee)=>ee!==void 0).join(`
+
+`)}function ye(O,D){if(O.decision.kind!=="deny")return;let B=D.includeEvidence?O.decision.evidence:void 0;return{reason:O.decision.reason,ruleId:O.decision.ruleId,intent:O.decision.intent,command:B?.command,segment:B?.segment,toolName:D.toolName,...O.configFallback?{configWarning:O.configFallback.reason}:{},...O.decision.ask?{ask:!0}:{}}}function P(O={}){return{reason:te,intent:"stop_and_explain",command:O.command,segment:O.segment??O.command,toolName:O.toolName}}function be(O){return rh({...O,redact:z})}function Xe(O){return z(O instanceof Error?O.message:String(O))}import{types as oh}from"node:util";var ih=new Set(["applypatch","patch"]),sh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),ah=new Set(["grep","grepsearch","rg"]),lh=new Set(["find","findbyname","glob"]),ch=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),uh=new Set(["command","diff","input","patch","patchtext"]),Hc=new TextEncoder,dh=new TextDecoder,fh=/\s/,mh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var ho=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Yc(O){return O.replace(/[-_\s]/g,"").toLowerCase()}function fi(O){return ch.has(Yc(O))}function V(O){let D=Yc(O);if(ih.has(D))return"patch";if(ah.has(D))return"grep";if(lh.has(D))return"glob";if(sh.has(D))return"path";return"unknown"}function ne(O){if(!O||typeof O!=="object")return;nu(O);let D=Object.getOwnPropertyDescriptor(O,"command");if(!D){if("command"in O)Fn();return}if(D.get||D.set)Fn();let B=D.value;return typeof B==="string"&&B!==""?B:void 0}function Zc(O,D){return Xc(O,D,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Xc(O,D,B,Q){let ee=tu(O,B,Q);if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>{let lt=Xc(at,D,B,Q+1);return typeof at==="string"&&D.has(Jc(je))?[at]:lt});return B.ancestors.delete(ee.object),he}function Jc(O){return O.replace(/-/g,"_").toLowerCase()}function Qc(O){return eu(O,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(gh)}function eu(O,D,B,Q){let ee=tu(O,B,Q);if(typeof O==="string")return D?[O]:[];if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>eu(at,ee.array?D:uh.has(Jc(je)),B,Q+1));return B.ancestors.delete(ee.object),he}function ph(O,D,B){if(D.nodes++,O!==null&&typeof O==="object"&&B>ho.maxDepth||D.nodes>ho.maxNodes)Fn();if(typeof O!=="string")return;let Q=Buffer.byteLength(O);if(D.stringBytes+=Q,Q>ho.maxStringBytes||D.stringBytes>ho.maxAggregateStringBytes)Fn()}function tu(O,D,B){if(ph(O,D,B),!O||typeof O!=="object")return null;let Q=nu(O);if(D.ancestors.has(O))Fn();let ee=Reflect.ownKeys(O);if(D.keys+=ee.length,D.keys>ho.maxKeys)Fn();let he=ee.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(O,je);if(!at||at.get||at.set)Fn();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return D.ancestors.add(O),{object:O,array:Q,entries:he}}function nu(O){if(oh.isProxy(O))Fn();let D=Array.isArray(O),B=Object.getPrototypeOf(O);if(D&&B!==Array.prototype||!D&&B!==Object.prototype&&B!==null)Fn();return D}function Fn(){throw new f}function gh(O){let D=[],B=O.split(/\r?\n/),Q=!1,ee=!1,he=null,je=null,at=()=>{ee=!1,he=null,je=null};for(let lt=0;lt<B.length;lt++){let ct=B[lt]??"";if(ct==="*** Begin Patch"){Q=!0,at();continue}if(ct==="*** End Patch"){Q=!1,at();continue}if(ct.startsWith("@@")){let ut=hh(ct);if(ee=!0,he=ut?.oldLines??null,je=ut?.newLines??null,he===0&&je===0)at();continue}if(ee&&he!==null&&je!==null){let ut=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-ut),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),D.push(...ra(ct));continue}if(ee)continue;if(ct.startsWith("diff --git ")){D.push(...ra(ct));continue}if(ct.startsWith("--- ")){let ut=B[lt+1]??"";if(!ut.startsWith("+++ "))continue;D.push(...ia(di(ct.slice(4),!0),di(ut.slice(4),!0))),lt++;continue}if(!Q)D.push(...ra(ct))}return D}function hh(O){let D=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(O);if(!D)return null;return{oldLines:Number(D[1]??1),newLines:Number(D[2]??1)}}function ra(O){let D=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(O);if(D?.[1])return qc(D[1]);let B=/^\*\*\* Move to: (.+)$/.exec(O);if(B?.[1])return qc(B[1]);if(O.startsWith("diff --git "))return yh(O.slice(11));let Q=/^--- (.+)$/.exec(O);if(Q?.[1])return Kc(Q[1]);let ee=/^\+\+\+ (.+)$/.exec(O);if(ee?.[1])return Kc(ee[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(O);if(he?.[1])return Rh(he[1]);return[]}function yh(O){let D=bh(O);if(D.length===2&&D[0]&&D[1])return ia(D[0],D[1]);let B=Sh(O);return B?ia(O.slice(B.oldStart,B.oldEnd),O.slice(B.newStart,B.newEnd)):[]}function bh(O){let D=[],B=0;while(B<O.length&&D.length<2){while(fr(O[B]))B++;if(B>=O.length)break;let Q=O[B]==='"'||O[B]==="'"?O[B]:void 0;if(!Q){let he=B;while(B<O.length&&!fr(O[B]))B++;D.push(O.slice(he,B));continue}let ee=ru(O,B,Q);if(!ee)return[];D.push(ee.value),B=ee.end}while(fr(O[B]))B++;return B===O.length?D:[]}function Sh(O){let D=0;while(D<O.length&&fr(O[D]))D++;let B=O.length;while(B>D&&fr(O[B-1]))B--;let Q=0,ee=D;while(ee<B){if(!fr(O[ee])){ee++;continue}let he=ee;while(ee<B&&fr(O[ee]))ee++;if(he===D||ee===B)continue;if(Q++,Q>mh)Fn();if(Ch(O,D,he,ee,B))return{oldStart:D,oldEnd:he,newStart:ee,newEnd:B}}return null}function Ch(O,D,B,Q,ee){if(oa(O,D,B,Q,ee))return!0;let he=jc(O,"/",D,B),je=jc(O,"/",Q,ee);if(he<=D||je<=Q)return!1;if(oa(O,D,he,Q,je))return!1;return oa(O,he+1,B,je+1,ee)}function oa(O,D,B,Q,ee){if(B-D!==ee-Q)return!1;for(let he=0;he<B-D;he++)if(O[D+he]!==O[Q+he])return!1;return!0}function jc(O,D,B,Q){for(let ee=B;ee<Q;ee++)if(O[ee]===D)return ee;return-1}function fr(O){return O!==void 0&&fh.test(O)}function ru(O,D,B){let Q=[],ee=D+1;while(ee<O.length){let he=String.fromCodePoint(O.codePointAt(ee)??0);if(he===B)return{value:dh.decode(Uint8Array.from(Q)),end:ee+1};if(he!=="\\"||B==="'"){Q.push(...Hc.encode(he)),ee+=he.length;continue}let je=O.slice(ee+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){Q.push(Number.parseInt(at,8)),ee+=at.length+1;continue}Q.push(...Hc.encode(vh(je[0]??""))),ee+=2}return null}function vh(O){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[O]??O}function Eh(O){return yo(_h(O))}function ia(O,D){if(O==="/dev/null")return Vc(D);if(D==="/dev/null")return Vc(O);if(O.startsWith("a/")&&D.startsWith("b/"))return[O.slice(2),D.slice(2)].flatMap(yo);let B=xh(O,D)??(O===D?ou(O):null);return[O,D,...B?[B]:[]].flatMap(yo)}function Vc(O){let D=ou(O);return[O,...D?[D]:[]].flatMap(yo)}function ou(O){let D=O.indexOf("/");return D>0&&D<O.length-1?O.slice(D+1):null}function xh(O,D){let B=O.indexOf("/"),Q=D.indexOf("/");if(B<1||Q<1)return null;if(O.slice(0,B)===D.slice(0,Q))return null;let ee=O.slice(B+1);return ee===D.slice(Q+1)?ee:null}function Kc(O){return Eh(di(O,!0))}function Rh(O){return yo(di(O,!1))}function di(O,D){let B=O.trim(),Q=B[0]==='"'||B[0]==="'"?B[0]:void 0;if(Q){let ee=ru(B,0,Q);if(ee&&(D||B.slice(ee.end).trim()===""))return ee.value}return D?B.split("\t",1)[0]?.trim()??"":B}function _h(O){return O.startsWith("a/")||O.startsWith("b/")?O.slice(2):O}function yo(O){return O===""||O==="/dev/null"?[]:[O]}function qc(O){let D=O.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return D===""||D==="/dev/null"?[]:[D]}function ce(O){try{if(!Ph(O).isDirectory())return!1;return wh(O,iu.R_OK|iu.X_OK),!0}catch{return!1}}function et(O,D,B){if(er(O))return;let Q=D.flatMap((he)=>su(he,B));if(!Q[0])return;let ee=su(au(O)?O:Th(Q[0],O),B)[0];if(!ee)return;return Q.some((he)=>kh(ee,he))?ee:void 0}function su(O,D){let B=D.realpath(O);if(B===null)return[];return D.isDirectory(B)?[B]:[]}function kh(O,D){let B=Ah(D,O);return B===""||B!==".."&&!B.startsWith(`..${Ih}`)&&!au(B)}var Oh=8388608;async function We(O){let D=[],B=0;for await(let Q of O){let ee=typeof Q==="string"?Buffer.from(Q,"utf-8"):Buffer.from(Q.buffer,Q.byteOffset,Q.byteLength);if(B+=ee.byteLength,B>Oh)throw Mh(O),Error("hook input byte limit exceeded");D.push(ee)}return Buffer.concat(D,B).toString("utf-8")}function Mh(O){let D=O.destroy??O.cancel;if(!D)return;try{Promise.resolve(D.call(O)).catch(()=>{})}catch{}}function d(O,D,B,Q,ee){if(B.kind!=="command")return{toolName:O,input:D,route:B,context:Q};return{toolName:O,input:D,route:B,context:Q,command:ee}}var Gr=["fail_closed","paranoid_rm","paranoid_interpreters"],mi={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},pi=["standard","strict","paranoid"];function Dh(O,D){if(!D)return O;return pi.indexOf(D)>pi.indexOf(O)?D:O}function Nh(O){let D=ve(o.level,O);if(D===void 0||D==="")return;if(pi.includes(D))return D;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(D.slice(0,40))}. Use ${pi.join(", ")}.`);return}function He(O){if(O===void 0||O==="all")return"all";if(O==="blocked")return"blocked";return"invalid"}function xe(O){return He(ve(o.auditScope,O))==="all"}function sa(O){if(O.failClosed&&O.paranoidRm&&O.paranoidInterpreters)return"paranoid";if(O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"strict";if(!O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"standard";return"custom"}function R(O={},D){let B=O.safety?.level??"standard",Q=Nh(D),ee=Dh(B,Q),he=mi[ee],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:ee===B?"preset":"environment",paranoidRm:ee===B?"preset":"environment",paranoidInterpreters:ee===B?"preset":"environment"},lt={failClosed:[`policy safety.level=${B}`],paranoidRm:[`policy safety.level=${B}`],paranoidInterpreters:[`policy safety.level=${B}`]};if(ee!==B)lt.failClosed.push(`env ${o.level.name}=${Q}`),lt.paranoidRm.push(`env ${o.level.name}=${Q}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${Q}`);if(O.safety?.overrides?.failClosed!==void 0)je.failClosed=O.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(O.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=O.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(O.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=O.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,D))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,D))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,D))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,D))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!O.worktreeMode||L(o.worktree,D);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:sa(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(O,D){let B=typeof O==="string"?bo(O,D):ve(O,D);return B==="1"||B?.toLowerCase()==="true"}function bo(O,D){return D.get(O)}function ve(O,D){let B=bo(O.name,D);if(B!==void 0)return B;if(O.legacyName)return bo(O.legacyName,D);return}function Qe(O,D){return bo(O.name,D)!==void 0||!!O.legacyName&&bo(O.legacyName,D)!==void 0}import{dirname as yr}from"node:path";import{closeSync as Lh,constants as So,fstatSync as aa,fsyncSync as Wh,lstatSync as vn,mkdirSync as lu,openSync as cu,readdirSync as ca,readFileSync as Gh,realpathSync as Fr,renameSync as Fh,rmdirSync as uu,statSync as la,unlinkSync as ua,writeFileSync as zh}from"node:fs";import{isAbsolute as du,join as mr,normalize as Bh,parse as gi,relative as da,resolve as fa,sep as hi}from"node:path";function Re(){let O=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${O()}${O()}`}var $h=Symbol("PolicyFilesystemScope"),Uh=Symbol("PolicyFilesystemTarget"),fu=So.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(O){super(`Unable to access ${O} filesystem safely.`)}}function v(O,D){return{[$h]:!0,root:fa(O),label:D}}function Co(O,D){let B=Bh(D);if(D===""||du(D)||B===".."||B.startsWith(`..${hi}`))throw new r(O.label);return{[Uh]:!0,scope:O,relativePath:B,path:mr(O.root,B)}}function i(O,D){return Co(O,da(O.root,fa(D)))}function re(O,D="rules policy"){let B=fa(O),Q=gi(B).dir;return Co(v(Q,D),da(Q,B))}function n(O){return Hn(O.scope.label,()=>{if(!Zt(O))return null;let D=cu(O.path,So.O_RDONLY|fu);return pu(D,()=>{let B=aa(D);if(!B.isFile())throw new r(O.scope.label);let Q=Gh(D,"utf-8"),ee=vn(O.path);if(!ee.isFile()||ee.isSymbolicLink()||B.dev!==ee.dev||B.ino!==ee.ino)throw new r(O.scope.label);return Zt(O),Q})})}function g(O,D,B=384,Q){let ee=`${O.path}.${Re()}.tmp`;Hn(O.scope.label,()=>{jh(O),Zt(O);let he=cu(ee,So.O_CREAT|So.O_EXCL|So.O_WRONLY|fu,B),je=pu(he,()=>{let at=aa(he);if(!at.isFile())throw new r(O.scope.label);zh(he,D,"utf-8"),Wh(he);let lt=aa(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(O.scope.label);return lt});Zt(O),Kh(O,ee,je.dev,je.ino),Fh(ee,O.path),Q?.(O.path),Zt(O)},()=>qh(ee))}function mu(O,D){if(O.path===D.path)return!0;return Hn(O.scope.label,()=>{if(!Zt(O)||!Zt(D))return!1;let B=(Q)=>mr(Fr(gi(Q).dir),gi(Q).base);return B(O.path)===B(D.path)})}function le(O){let D=Hn(O.scope.label,()=>{if(!Zt(O,"directory"))return null;let B=ca(O.path);return Zt(O,"directory"),B});if(!D)return null;return Hn(O.scope.label,()=>{let B=D.map((Q)=>{let ee=Co(O.scope,mr(O.relativePath,Q)),he=vn(ee.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(O.scope.label);return yi(ma(O.scope),Fr(ee.path),O.scope.label),{name:Q,kind:he.isDirectory()?"directory":"file"}});return Zt(O,"directory"),B})}function N(O){Hn(O.scope.label,()=>{if(!Zt(O))return;ua(O.path),Zt(O)})}function tt(O){Hn(O.scope.label,()=>{if(!Hh(O))return;hu(O),Zt(O,"directory")})}function nt(O){Hn(O.scope.label,()=>{if(!Zt(O,"directory"))return;uu(O.path),Zt(O,"directory")})}function Hh(O){return Hn(O.scope.label,()=>{if(!Zt(O,"directory"))return!1;return gu(O),!0})}function Hn(O,D,B){try{return D()}catch(Q){if(B?.(),Q instanceof r)throw Q;throw new r(O)}}function pu(O,D){try{return D()}finally{Lh(O)}}function Zt(O,D="file"){let B=yu(O.scope);if(!B)return!1;let Q=O.relativePath.split(hi);for(let ee of Q.keys()){let he=mr(O.scope.root,...Q.slice(0,ee+1)),je=vn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(O.scope.label);if(ee<Q.length-1&&!je.isDirectory())throw new r(O.scope.label);if(ee===Q.length-1&&(D==="file"?!je.isFile():!je.isDirectory()))throw new r(O.scope.label);yi(B,Fr(he),O.scope.label)}return!0}function gu(O){for(let D of ca(O.path)){let B=Co(O.scope,mr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new r(O.scope.label);if(Q.isDirectory())gu(B)}Zt(O,"directory")}function hu(O){for(let D of ca(O.path)){let B=Co(O.scope,mr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink())throw new r(O.scope.label);if(Q.isDirectory()){hu(B);continue}if(!Q.isFile())throw new r(O.scope.label);ua(B.path)}uu(O.path)}function jh(O){Vh(O.scope);let D=ma(O.scope),B=O.relativePath.split(hi).slice(0,-1);for(let Q of B.keys()){let ee=mr(O.scope.root,...B.slice(0,Q+1));if(!vn(ee,{throwIfNoEntry:!1}))lu(ee,{mode:448});let he=vn(ee);if(!he.isDirectory()||he.isSymbolicLink())throw new r(O.scope.label);yi(D,Fr(ee),O.scope.label)}}function Vh(O){if(vn(O.root,{throwIfNoEntry:!1})){if(!la(O.root).isDirectory())throw new r(O.label);return}let D=[],B=O.root;while(!vn(B,{throwIfNoEntry:!1})){D.unshift(B);let Q=gi(B).dir;if(Q===B)throw new r(O.label);B=Q}if(!la(B).isDirectory())throw new r(O.label);for(let Q of D){lu(Q,{mode:448});let ee=vn(Q);if(!ee.isDirectory()||ee.isSymbolicLink())throw new r(O.label)}}function yu(O){if(!vn(O.root,{throwIfNoEntry:!1}))return null;if(!la(O.root).isDirectory())throw new r(O.label);return Fr(O.root)}function ma(O){let D=yu(O);if(!D)throw new r(O.label);return D}function Kh(O,D,B,Q){let ee=vn(D);if(!ee.isFile()||ee.isSymbolicLink()||ee.dev!==B||ee.ino!==Q)throw new r(O.scope.label);yi(ma(O.scope),Fr(D),O.scope.label)}function yi(O,D,B){let Q=da(O,D);if(Q===".."||Q.startsWith(`..${hi}`)||du(Q))throw new r(B)}function qh(O){try{ua(O)}catch{}}import{dirname as pr,isAbsolute as Qh,join as hr,relative as ey,resolve as gr,sep as ty}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var bu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,Yh=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Su=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Zh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Xh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${Zh}/(${l.source.slice(1,-1)})/${Xh}$`);function Jh(O){return`.cc-safety-net/rules/${O}/rulebook.json`}function Cu(O){if(S(O))try{return A(O),null}catch(D){return D instanceof Error?D.message:String(D)}return l.test(O)?null:`Local rulebook sources must be bare names matching ${l}: ${O}`}function A(O){if(O.startsWith("github:"))throw Error(`Invalid rulebook source: ${O}`);let D=O.match(bu);if(!D?.[1]||!D[2]||!D[3])throw Error(`Invalid GitHub rulebook source: ${O}`);let B=D[3].lastIndexOf("/");if(B<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);let Q=D[3].slice(0,B),ee=D[3].slice(B+1);if(!Q||!Su.test(Q))throw Error(`GitHub rulebook refs must use valid path segments: ${O}`);if(!ee||!l.test(ee))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);return{owner:D[1],repo:D[2],ref:Q,path:Jh(ee),name:ee}}function q(O){return Yh.test(O)}function oe(O){return Su.test(O)}function S(O){return bu.test(O)}function ot(O){if(!l.test(O))throw Error(`Local rulebook sources must be bare names matching ${l}: ${O}`)}var vu="rule.json",bi="policy.json",Eu=".cc-safety-net",ny="rules",ry="CC_SAFETY_NET_HOME",xu="`cc-safety-net rule update`";function oy(O){return gr(O,de)}function F(O){return hr(oy(O),vu)}function b(O){return hr(gr(O),Eu,bi)}function Se(O,D={}){return D.userConfigDir??(D.userConfigPath?pr(D.userConfigPath):hr(iy(O),ny))}function iy(O){let D=O.env.get(ry);return D?gr(pn(D)):hr(O.home,Eu)}function M(O,D={}){return hr(Se(O,D),vu)}function u(O,D={}){return hr(pr(Se(O,D)),bi)}function K(O,D){let B=D.userConfigPath??M(O,D),Q=D.projectConfigPath??F(D.cwd),ee=Be(O,D),he=ze(Q,D.cwd);return{userConfigPath:B,projectConfigPath:Q,userScope:ee,projectScope:he,userConfigTarget:i(ee,B),projectConfigTarget:i(he,Q)}}function Be(O,D){let B=D.userConfigPath?pr(pr(gr(D.userConfigPath))):pr(gr(D.userConfigDir??Se(O,D)));return v(B,"user policy")}function ze(O,D){let B=gr(D),Q=gr(O),ee=ey(B,Q);if(ee!==".."&&!ee.startsWith(`..${ty}`)&&!Qh(ee))return v(B,"project policy");return v(pr(pr(Q)),"project policy")}function I(O,D){return hr(O,D,ue)}var gn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Ht=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Ru=new Set(["python","python3","python2","node","ruby","perl"]),Si=/^python(?:[23](?:\.\d+)*)?$/,En=new Set(["awk","gawk","nawk","mawk"]),Ci=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var _u="Rulebook exceeds CC Safety Net's safe validation limits.",wu="Additional rulebook validation errors were omitted.",Pn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Pu(O){if(pa(O.allowed_commands,Pn.maxAllowedCommands)||pa(O.rules,Pn.maxRules)||pa(O.tests,Pn.maxTests))return!1;let{maxAggregateStringCodeUnits:D,maxTotalBlockArgs:B}=Pn,Q=(ee,he=!1)=>{if(typeof ee!=="string")return!0;if(ee.length>Pn.maxStringCodeUnits||he&&ee.length>Pn.maxFixtureCommandCodeUnits||ee.length>D)return!1;return D-=ee.length,!0};if(!Q(O.name)||!Q(O.version)||!Q(O.description)||!Q(O.author)||!Q(O.migrated_from))return!1;if(Array.isArray(O.allowed_commands)){for(let ee of O.allowed_commands)if(!Q(ee))return!1}if(Array.isArray(O.rules))for(let ee of O.rules){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.name)||!Q(he.command)||!Q(he.subcommand)||!Q(he.reason)||!Q(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>Pn.maxBlockArgsPerRule||at.length>B)return!1;B-=at.length;for(let lt of at)if(!Q(lt))return!1}}if(Array.isArray(O.tests))for(let ee of O.tests){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.command,!0)||!Q(he.expect)||!Q(he.rule))return!1}return!0}function pa(O,D){return Array.isArray(O)&&O.length>D}var ga=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function It(O){return At(O).toLowerCase()}function At(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}function an(O,D){let B=new Set,Q=!1;for(let ee of O){if(ee==="--"){Q=!0;continue}if(Q)continue;if(ee.startsWith("-")&&!ee.startsWith("--")&&ee.length>1)for(let he=1;he<ee.length;he++){let je=ee[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(B.add(at),D?.shortOptsWithValue?.has(at))break}}return B}var sy={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ha=new Set(["--init-file","--rcfile"]);function ya(O,D,B,Q){let ee=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<D.length;ct++){let ut=D[ct];if(ut===void 0)break;if(O==="ksh"&&ut==="o"&&ct+1<D.length){if(Q==="argv"){let ft=D.slice(ct+1);if(D[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(O==="ksh"&&ut==="o"&&ct+1===D.length&&(B?.startsWith("-")||B?.startsWith("+")))break;if(O==="zsh"&&ut==="o"&&ct+1<D.length)break;if(Q==="startup"&&ut==="i")ee=D[0]==="-";if(Q==="argv"&&D[0]==="-"&&ut==="c")je=!0;if(Q==="argv"&&ut==="n")lt=D[0]==="-";if(Q==="argv"&&ut==="s")at=D[0]==="-";if(!sy[O]?.includes(ut))continue;if(ct+1===D.length)he++;break}return{interactive:ee,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function hn(O){let D=At(O[0]??"").toLowerCase(),B=!1,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--"){let lt=B&&O[he+1]!==void 0?he+1:null;return{command:lt===null?null:O[lt]??null,commandIndex:lt,scriptIndex:!B&&!Q&&O[he+1]!==void 0?he+1:null,readsStdinAsCommands:!B&&(Q||O[he+1]===void 0),syntaxCheck:ee}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:B?je:null,commandIndex:B?he:null,scriptIndex:!B&&!Q&&je!=="-"?he:null,readsStdinAsCommands:!B&&(Q||je==="-"),syntaxCheck:ee};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(D==="bash"&&ha.has(lt)&&!je.includes("="))he++;continue}let at=ya(D,je,O[he+1],"argv");if(at.commandSelected)B=!0;if(at.syntaxCheck)ee=!0;if(at.stdinMode)Q=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!B,syntaxCheck:ee}}function vo(O,D){if(D.escaped)return D.escaped=!1,!0;if(O==="\\"&&!D.inSingle)return D.escaped=!0,!0;if(O==="'"&&!D.inDouble)return D.inSingle=!D.inSingle,!0;if(O==='"'&&!D.inSingle)return D.inDouble=!D.inDouble,!0;return!1}function vi(O){let D={inSingle:!1,inDouble:!1,escaped:!1};for(let B of ay(O))vo(B,D);return D.inSingle||D.inDouble}function ay(O){let D="",B={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,ee=!0;for(let he=0;he<O.length;he++){let je=O[he];if(!je)break;if(Q){if(je===`
+`||je==="\r")D+=je,Q=!1,B.escaped=!1;continue}if(je==="#"&&!B.inSingle&&!B.inDouble&&ee){Q=!0;continue}if(D+=je,!B.inSingle&&!B.inDouble&&!B.escaped)ee=/[\s;&|()<>]/.test(je);vo(je,B)}return D}var ba=new Set(["rm","find","xargs","parallel"]),ly=new Set(["git","busybox",...ba,...Ht,...Ru,...En]),cy=new Set(["python","node","ruby","perl"]);function Le(O){let D=It(O);return ly.has(D)||An(D)}function An(O){return cy.has(uy(O))}function uy(O){let D=At(O).toLowerCase();return Si.test(D)?"python":D}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(O){try{let D=n(dy(O));if(D===null)return{config:null,errors:[]};if(!D.trim())return{config:null,errors:["Config file is empty"]};let B=JSON.parse(D),Q=Ve(B);if(Q.errors.length>0)return{config:null,errors:Q.errors};return{config:{version:1,rules:B.rules??[],overrides:B.overrides??{},transparent_wrappers:B.transparent_wrappers??[]},errors:[]}}catch(D){if(D instanceof r)return{config:null,errors:[D.message]};let B=D instanceof Error?D.message:String(D);return{config:null,errors:[D instanceof SyntaxError?"Invalid JSON":B]}}}function dy(O){return typeof O==="string"?re(O):O}var e=(O,D)=>({path:O,message:D,kind:"typed"}),Xt=(O,D)=>({path:O,message:D,kind:"custom"});function Te(O){let D=new Set;return O.flatMap((B,Q)=>{let ee=zr(B)?B.name:void 0;if(typeof ee!=="string")return[];if(D.has(ee.toLowerCase()))return[Xt(["rules",Q,"name"],`duplicate rule name "${ee}"`)];return D.add(ee.toLowerCase()),[]})}var we=`must be one of ${ga.join(", ")}`,fy=/^[^/]+\/[^/]+$/,my=["version","rules","overrides","transparent_wrappers"];function Ve(O){let D=py(O);return{errors:ie(qe(D,my,(B)=>B.kind==="custom"),": "," "),sources:Ey(O,D)}}function py(O){if(!zr(O))return[e([],"Config must be an object")];let D=Array.isArray(O.rules)&&O.rules.length>pe;return[...O.version===1?[]:[e(["version"],"must be 1")],...gy(O.rules,D),...by(O.overrides),...Cy(O.transparent_wrappers),...D?[]:yy(O.rules),...zr(O.overrides)?Object.keys(O.overrides).filter((B)=>!fy.test(B)).map((B)=>Xt(["overrides",B],"must use <rulebook-name>/<rule-name>")):[],...vy(O.transparent_wrappers)]}function gy(O,D){if(O===void 0)return[];if(!Array.isArray(O))return[e(["rules"],"must be an array of rulebook source strings"),...Au(O,pe)?[e(["rules"],fe)]:[]];if(D)return[{path:["rules"],message:fe,kind:"limit"}];return O.flatMap((B,Q)=>{if(typeof B!=="string")return[e(["rules",Q],"must be a rulebook source string"),...hy(B,1)?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]];return B===""?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]})}function Au(O,D){let B=Tu(O);return B!==void 0&&!(B<=D)}function hy(O,D){let B=Tu(O);return B!==void 0&&!(B>=D)}function Tu(O){if(O===null||O===void 0)return;let D=O.length;return D===void 0?void 0:Number(D)}function yy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||B==="")return[];if(B.trim()==="")return[Xt(["rules",Q],"must be a non-empty rulebook source string")];let ee=Cu(B);if(ee)return[Xt(["rules",Q],ee)];if(D.has(B))return[Xt(["rules",Q],`duplicate rulebook source "${B}"`)];return D.add(B),[]})}function by(O){if(O===void 0)return[];if(!zr(O))return[e(["overrides"],"must be an object if provided")];return Object.keys(O).flatMap((D)=>{let B=O[D];if(B==="off")return[];if(!zr(B))return[e(["overrides",D],'must be "off" or an object')];return[...Sy(B.reason,["overrides",D,"reason"]),...B.intent===void 0||Ce(B.intent)?[]:[e(["overrides",D,"intent"],we)]]})}function Sy(O,D){if(typeof O!=="string")return[e(D,"required non-empty string"),...Au(O,T)?[e(D,`must be at most ${T} characters`)]:[]];if(O==="")return[e(D,"required non-empty string")];return O.length>T?[e(D,`must be at most ${T} characters`)]:[]}function Cy(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["transparent_wrappers"],"must be an array of command strings")];return O.flatMap((D,B)=>{if(typeof D!=="string")return[e(["transparent_wrappers",B],"must be a command string")];return w.test(D)?[]:[e(["transparent_wrappers",B],"must match command pattern")]})}function vy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["transparent_wrappers",Q],`duplicate command "${B}"`)];if(Le(B))return[Xt(["transparent_wrappers",Q],`reserved command "${B}" cannot be a wrapper`)];return D.add(B),[]})}function Ey(O,D){let B=zr(O)?O.rules:void 0;if(!Array.isArray(B))return new Set;if(D.some((ee)=>ee.path.length===1&&ee.path[0]==="rules"))return new Set;let Q=new Set(D.filter((ee)=>ee.path[0]==="rules"&&typeof ee.path[1]==="number").map((ee)=>ee.path[1]));return new Set(B.filter((ee,he)=>typeof ee==="string"&&!Q.has(he)))}function qe(O,D,B){let Q=O.map((je)=>je.path[1]),ee=[...new Set(Q.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:D.indexOf(String(je.path[0])),typeof at==="number"?at:ee.indexOf(String(at)),B(je)?0:1];return O.map((je,at)=>({issue:je,rank:he(je,Q[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(O,D,B){return[...new Set(O.map((Q)=>{let ee=Sa(Q.path);if(Q.kind==="unknownKeys")return`${ee?`${ee}.`:""}unknown field "${Q.message}"`;if(Q.kind==="key"||Q.kind==="limit"||Q.path.length===0)return Q.message;return`${ee}${Q.path.length===1?B:D}${Q.message}`}))]}function Sa(O){return O.map((D,B)=>{if(typeof D==="number")return`[${D}]`;return B===0?String(D):`.${String(D)}`}).join("")}function Ce(O){return ga.includes(O)}function zr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function se(O){let D=_y(O);if(D.errors.length>0)throw Error(D.errors.join("; "));return O}var xy=`required non-empty string up to ${T} characters`,Iu="must be a non-empty array of unique non-empty strings",Ry="required non-empty array of non-empty strings";function _y(O){if(!tr(O))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Pu(O))return{errors:[_u],ruleNames:new Set};let D=[...O.rulebook_version===1||O.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(wy(O,O.rulebook_version===2),": ",": ")];return{errors:D.length>Pn.maxValidationErrors?[...D.slice(0,Pn.maxValidationErrors),wu]:D,ruleNames:new Set(_e(O).map((B)=>B.toLowerCase()))}}function _e(O){let D=tr(O)?O.rules:void 0;return(Array.isArray(D)?D:[]).flatMap((B)=>{let Q=tr(B)?B.name:void 0;return typeof Q==="string"?[Q]:[]})}function wy(O,D){return[...typeof O.name==="string"&&l.test(O.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof O.version==="string"&&O.version!==""?[]:[e(["version"],"required non-empty string")],...Py(O.allowed_commands),...Ay(O.rules,D),...Oy(O.tests),...My(O),...Dy(O)]}function Py(O){if(!Array.isArray(O))return[e(["allowed_commands"],"required array")];let D=new Set;return[...O.flatMap((B,Q)=>typeof B==="string"&&w.test(B)?[]:[e(["allowed_commands",Q],"must match command pattern")]),...O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["allowed_commands",Q],`duplicate command "${B}"`)];return D.add(B),[]})]}function Ay(O,D){if(!Array.isArray(O))return[e(["rules"],"required array")];return[...O.flatMap((B,Q)=>{if(!tr(B))return[e(["rules",Q],"must be an object")];return D?Iy(B,["rules",Q]):Ty(B,["rules",Q])}),...Te(O)]}function Ty(O,D){return[...ku(O.name,D),...Ou(O.command,D),...O.subcommand===void 0||typeof O.subcommand==="string"&&w.test(O.subcommand)?[]:[e([...D,"subcommand"],"must match command pattern")],...Ei(O.block_args,[...D,"block_args"],"required non-empty array",!1),...Mu(O.reason,D),...Du(O.intent,D)]}function Iy(O,D){return[...ku(O.name,D),...Ou(O.command,D),...Mu(O.reason,D),...Du(O.intent,D),...ky(O.match,[...D,"match"]),...O.subcommand===void 0?[]:[e([...D,"subcommand"],"not supported in rulebook_version 2")],...O.block_args===void 0?[]:[e([...D,"block_args"],"not supported in rulebook_version 2")]]}function ku(O,D){if(typeof O!=="string")return[e([...D,"name"],"required string")];return l.test(O)?[]:[e([...D,"name"],"must match rule name pattern")]}function Ou(O,D){return typeof O==="string"&&w.test(O)?[]:[e([...D,"command"],"required string matching command pattern")]}function Mu(O,D){return typeof O==="string"&&O!==""&&O.length<=T?[]:[e([...D,"reason"],xy)]}function Du(O,D){return O===void 0||Ce(O)?[]:[e([...D,"intent"],we)]}function ky(O,D){if(!tr(O))return[e(D,"required object")];return[...Ei(O.command_path,[...D,"command_path"],Ry,!1),...O.any_args===void 0?[]:Ei(O.any_args,[...D,"any_args"],Iu,!0),...O.exclude_args===void 0?[]:Ei(O.exclude_args,[...D,"exclude_args"],Iu,!0)]}function Ei(O,D,B,Q){if(!Array.isArray(O))return[e(D,B)];let ee=O.flatMap((he,je)=>{if(typeof he!=="string")return[e([...D,je],"must be a non-empty string")];return he===""?[Xt([...D,je],"must be a non-empty string")]:[]});if(O.some((he)=>typeof he!=="string"))return ee;return[...ee,...O.length===0?[Xt(D,B)]:[],...Q&&new Set(O).size!==O.length?[Xt(D,"must not contain duplicate values")]:[]]}function Oy(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["tests"],"must be an array if provided")];return O.flatMap((D,B)=>{if(!tr(D))return[e(["tests",B],"must be an object")];return[...typeof D.command==="string"&&D.command.trim()!==""?[]:[e(["tests",B,"command"],"required non-empty string")],...D.expect==="blocked"||D.expect==="allowed"?[]:[e(["tests",B,"expect"],'must be "blocked" or "allowed"')],...D.rule===void 0||typeof D.rule==="string"?[]:[e(["tests",B,"rule"],"must be a string if provided")],...D.expect==="blocked"&&typeof D.rule!=="string"?[Xt(["tests",B,"rule"],"required string for blocked fixtures")]:[]]})}function My(O){if(!Array.isArray(O.tests))return[];let D=new Set(_e(O));return[...new Set(O.tests.flatMap((B)=>tr(B)&&B.expect==="blocked"&&typeof B.rule==="string"?[B.rule]:[]))].filter((B)=>!D.has(B)).map((B)=>Xt(["tests"],`blocked fixture references unknown rule "${B}"`))}function Dy(O){if(!Array.isArray(O.allowed_commands)||!Array.isArray(O.rules))return[];let D=new Set(O.allowed_commands.filter((B)=>typeof B==="string"));return O.rules.flatMap((B,Q)=>{let ee=tr(B)?B.command:void 0;if(typeof ee!=="string"||D.has(ee))return[];return[Xt(["rules",Q,"command"],`"${ee}" must be listed in allowed_commands`)]})}function tr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function J(O,D){let B=K(O,D),Q;try{Q=mu(B.userConfigTarget,B.projectConfigTarget)}catch(mt){if(mt instanceof r)return Uy(B,mt.message);throw mt}let ee=m(B.userConfigTarget),he=Q?{config:null,errors:[]}:m(B.projectConfigTarget),je=Lu(B.userConfigPath,ee.errors),at=Lu(B.projectConfigPath,he.errors),lt=new Set,ct=ee.config?Ca(ee.config,yr(B.userConfigPath),"user",B.userScope,lt):Wu(),ut=he.config?Ca(he.config,yr(B.projectConfigPath),"project",B.projectScope,lt):Wu(),ft=ee.config?.overrides??{},dt=he.config?.overrides??{};return{rules:[...Nu(ct.rules,ft),...Nu(ut.rules,dt)],transparent_wrappers:By(ee.config,he.config),rulebooks:[...ct.rulebooks,...ut.rulebooks],errors:[...je,...at,...ct.errors,...ut.errors],warnings:[...ct.warnings,...ut.warnings,...ct.canValidateOverrides?va(ft,ct.knownRuleIds,B.userConfigPath):[],...ct.canValidateOverrides?$y(dt,ct.knownRuleIds,B.projectConfigPath):[],...ut.canValidateOverrides?va(dt,ut.knownRuleIds,B.projectConfigPath):[]],userConfig:ee.config??void 0,projectConfig:he.config??void 0,...B}}function j(O,D){let B=Ny(O,D);if(!B)return[];return[...B.scope.errors,...B.scope.warnings,...Ly(B.config,B.scope,O)]}function Ny(O,D){let B=D??v(yr(yr(O)),"rules policy"),Q=m(i(B,O)).config;if(!Q)return null;return{config:Q,scope:Ca(Q,yr(O),"project",B)}}function Ly(O,D,B){return D.canValidateOverrides?va(O.overrides??{},D.knownRuleIds,B):[]}function Ca(O,D,B,Q=v(yr(yr(D)),B==="user"?"user policy":"project policy"),ee=new Set){let he=[],je=[],at=O.rules.flatMap((ct)=>{let ut=Gy(ct,D,Q);if(ut.errors.length>0||!ut.rulebook)return he.push(...ut.errors),[];let ft=ut.rulebook;if(ee.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ee.add(ft.name),[{rules:Wy(ft),rulebook:{source:B,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((dt)=>`${ft.name}/${dt.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function Wy(O){if(O.rulebook_version===2)return O.rules.map((D)=>({name:`${O.name}/${D.name}`,command:D.command,block_args:[],match:D.match,reason:D.reason,intent:D.intent}));return O.rules.map((D)=>({...D,name:`${O.name}/${D.name}`,match:void 0}))}function Gy(O,D,B){let Q=Pe(O),ee=I(D,Q),he=zy(ee,B);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${ee} for ${O}; ${Fy(O)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${ee}: ${je.problem}; fix that file`]};if(je.rulebook.name!==Q)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${ee} must match source "${O}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(O){return S(O)?A(O).name:O}function Fy(O){return S(O)?`run ${xu} to vendor ${O}`:"create that file or remove that source from the rules config"}function zy(O,D){try{return{content:n(i(D,O))}}catch(B){if(B instanceof r)return{error:B.message};throw B}}function me(O){let D;try{D=JSON.parse(O)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(D)}}catch(B){return{problem:B instanceof Error?B.message:"invalid rulebook"}}}function By(O,D){return[...new Set([...O?.transparent_wrappers??[],...D?.transparent_wrappers??[]])]}function Nu(O,D){return O.flatMap((B)=>{let Q=D[B.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...B,intent:Q.intent??B.intent,reason:Q.reason}];return[B]})}function va(O,D,B){return Object.keys(O).filter((Q)=>!D.has(Q)).map((Q)=>`unknown override key "${Q}" in ${B}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function $y(O,D,B){return Object.keys(O).filter((Q)=>D.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${B}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Lu(O,D){return D.map((B)=>B.startsWith("Unable to access ")?B:`${O}: ${B}`)}function Uy(O,D){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[D],warnings:[],userConfigPath:O.userConfigPath,projectConfigPath:O.projectConfigPath}}function Wu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as eb,readFileSync as tb}from"node:fs";var Gu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ea=new Set(Gu.map((O)=>O.id)),U=Gu,Hy=new Map(U.map((O)=>[O.id,O.intent]));function St(O,D){return{id:O,reason:D,intent:Hy.get(O)??"manual_only"}}var xa=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],xi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},jy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Vy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ra=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Vy.flatMap((O)=>jy.map((D)=>({id:["secret.home",O.idSlug,D.slice(1)].join("."),category:"Home path",label:[O.label,D].join(""),description:["Blocks home ",O.label,D," credential backup files."].join(""),suffixParts:[...O.directoryParts,[O.basename,D].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ri=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Fu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ky=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],_a=Fu.map((O)=>({id:`secret.variant.${O.slug}.separator`,category:"Variant",label:`${O.label}-* / ${O.label}_*`,description:`Blocks ${O.label} variants with dash or underscore suffixes.`,prefix:O.prefix})),wa=Fu.flatMap((O)=>Ky.map((D)=>({id:`secret.variant.${O.slug}.${D.slice(1)}`,category:"Variant",label:`${O.label}${D}`,description:`Blocks ${O.label}${D} private credential variants.`,prefix:O.prefix,suffix:D}))),Eo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Pa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((O)=>({id:`secret.ext.${O}`,category:"Extension",label:`.${O}`,description:`Blocks files with the .${O} extension.`,extension:O})),Aa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...xa,xi,...Ra,..._a,...wa,Eo,...Pa,...Aa,...Ri].map((O)=>({id:O.id,category:O.category,label:O.label,...O.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in O?{paths:O.paths}:{description:O.description}})),_i=new Set(Ri.flatMap((O)=>O.category==="Coding CLI config"?[O.id]:[])),Ta=new Set(Ke.map((O)=>O.id));import{isAbsolute as Ia,join as qy,normalize as Yy,sep as wi}from"node:path";var Pi=process.platform==="win32",zu=/[*?]/;function ka(O){let D=O.trim(),B=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Pi?D.replaceAll("\\","/"):D);if(!B)return null;let Q=B[1]??"",ee=B[2]??"";if(zu.test(Q)||ee==="."||ee==="..")return null;return{root:Q||"/",name:ee}}function xo(O,D){if(O==="~")return D;if(O.startsWith("~/"))return`${D}${O.slice(1)}`;return O}function Oa(O,D){if(typeof O!=="string"||O.trim()==="")return"must be a non-empty path string";let B=xo(O.trim(),D);if(!Ia(B))return"must be an absolute path or start with ~/";return Ro(B,D)}function Ma(O,D){let B=Bu(O,D);if(B===null)return"must be a non-empty path string";if(!Ia(B))return null;if(Ro(B,D)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Zy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Xy="cannot cover the guard's own configuration";function Bu(O,D){if(typeof O!=="string"||O.trim()==="")return null;let B=O.trim(),Q=Pi?B.replaceAll("\\","/"):B;return xo(Q.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),D)}function Da(O,D){let B=Bu(O,D);if(B===null)return"must be a non-empty path string";let Q=ka(B)?.root??B;if(zu.test(Q))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Ia(Q))return null;if(Ro(Q,D)!==null)return Zy;return Jy(Q,D)?Xy:null}function Jy(O,D){let B=Ai(O),Q=Ai(qy(D,".cc-safety-net"));return B===Q||B.startsWith(`${Q}${wi}`)}function Ro(O,D){let B=Ai(O),Q=Ai(D);if(B===Q)return"cannot be the home directory";let ee=B.endsWith(wi)?B:`${B}${wi}`;if(Q.startsWith(ee))return"cannot contain the home directory";return null}function Ai(O){let D=Yy(O);if(Pi)D=D.replace(/\//g,"\\").toLowerCase();if(D.length>(Pi?3:1)&&D.endsWith(wi))D=D.slice(0,-1);return D}var $u=30,Ti=1,Ii=365;function Uu(O){if(typeof O!=="number"||!Number.isInteger(O))return 30;if(O<1)return 1;return O>365?365:O}var Hu=new Set(U.filter((O)=>O.catastrophic).map((O)=>O.id));function wt(O,D){if(!O)return null;if(Hu.has(O.id))return O;if(D?.destructiveCommandProtectionEnabled===!1)return null;let B=D?.effectiveDestructiveCommandRules[O.id];return B&&!B.enabled?null:O}function Jt(O,D,B){if(Hu.has(D))return!0;if(O?.destructiveCommandProtectionEnabled===!1)return!1;return O?.effectiveDestructiveCommandRules[D]?.enabled??B}function G(O,D){return Object.freeze(Object.fromEntries(U.map((B)=>{let Q=B.activationCapability?D[B.activationCapability]:void 0,ee=Q?.enabled??!0,he=O.destructiveCommandRuleOverrides[B.id],je=B.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:O.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:ee,changesInherited:he==="on"!==ee,source:"rule_override",...B.activationCapability?{activationCapability:B.activationCapability}:{},override:he}:{enabled:ee,inheritedEnabled:ee,changesInherited:!1,source:Q?.source??"built_in_default",...B.activationCapability?{activationCapability:B.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ee,changesInherited:!1,source:"master_disabled",...B.activationCapability?{activationCapability:B.activationCapability}:{},...he?{override:he}:{}};return[B.id,Object.freeze(je)]})))}function ju(O,D){return Object.freeze({...O,effectiveDestructiveCommandRules:G(O,D)})}var Vu={standard:0,strict:1,paranoid:2};function Y(O,D){return{policy:{version:1,safety:{level:D.safety?.level??O.safety.level,overrides:{...O.safety.overrides,...D.safety?.overrides}},workflow:{worktree_mode:D.workflow?.worktree_mode??O.workflow.worktree_mode},destructive_command_protection:{enabled:D.destructive_command_protection?.enabled??O.destructive_command_protection.enabled,overrides:{...O.destructive_command_protection.overrides,...D.destructive_command_protection?.overrides},allow_paths:Na(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths)},secret_protection:{enabled:D.secret_protection?.enabled??O.secret_protection.enabled,overrides:{...O.secret_protection.overrides,...D.secret_protection?.overrides},deny_paths:Na(O.secret_protection.deny_paths,D.secret_protection?.deny_paths),allow_paths:Na(O.secret_protection.allow_paths,D.secret_protection?.allow_paths)},audit:O.audit},weakenings:Qy(O,D)}}function Na(O,D){return[...new Set([...O,...D??[]])]}function Qy(O,D){let B=D.safety?.level,Q=mi[O.safety.level];return[...B&&Vu[B]<Vu[O.safety.level]?[`project policy lowers level: ${O.safety.level} -> ${B}`]:[],...Gr.flatMap((ee)=>D.safety?.overrides?.[ee]===!1&&(O.safety.overrides[ee]??Q[ee])?[`project policy disables ${ee}`]:[]),...D.workflow?.worktree_mode===!0&&!O.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...D.destructive_command_protection?.enabled===!1&&O.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...D.secret_protection?.enabled===!1&&O.secret_protection.enabled?["project policy disables secret protection"]:[],...Ku(D.destructive_command_protection?.overrides,(ee)=>O.destructive_command_protection.enabled&&O.destructive_command_protection.overrides[ee]!=="off"),...Ku(D.secret_protection?.overrides,(ee)=>O.secret_protection.enabled&&(O.secret_protection.overrides[ee]==="on"?!0:O.secret_protection.overrides[ee]!=="off"&&!_i.has(ee))),...O.destructive_command_protection.enabled?qu(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths).map((ee)=>`project policy adds destructive allow path: ${ee}`):[],...O.secret_protection.enabled?qu(O.secret_protection.allow_paths,D.secret_protection?.allow_paths).map((ee)=>`project policy adds secret allow path: ${ee}`):[]]}function Ku(O,D){return Object.entries(O??{}).flatMap(([B,Q])=>Q==="off"&&D(B)?[`project policy disables rule ${B}`]:[])}function qu(O,D){return(D??[]).filter((B)=>!O.includes(B))}var Ga=new Set(["standard","strict","paranoid"]),Z={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:$u}};function Ju(O,D){let B=ab(u(O,D),O.home),Q=Ie(b(D.cwd),O.home),ee=ae(Q.parsed,O.home),he=Object.keys(ee.policy).length>0?Y(B.gui??Z,ee.policy):void 0,je=[...B.errors,...Q.errors,...ee.diagnostics],at=(B.fallback==="defaults"&&he?"salvaged":B.fallback)??(B.gui?void 0:Q.fallback)??(je.length>0?"salvaged":void 0),lt=ee.policy.safety?.level?"project":B.levelPresent?"user":"default";return{...he?Wa(he.policy):B.policy,errors:je,...at?{fallback:at}:{},...Q.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var nb="project policy audit settings are ignored; audit is user scope only";function ae(O,D){if(!yn(O))return{policy:{},diagnostics:[]};let B=yn(O.safety)?O.safety:{},Q=yn(O.workflow)?O.workflow:{},ee=yn(O.destructive_command_protection)?O.destructive_command_protection:{},he=yn(O.secret_protection)?O.secret_protection:{},je={...Ga.has(B.level)?{level:B.level}:{},...yn(B.overrides)?Yu({overrides:Qu(B.overrides,Gr,["safety","overrides"],br)}):{}},at={...typeof ee.enabled==="boolean"?{enabled:ee.enabled}:{},...ee.overrides!==void 0?{overrides:ki(ee.overrides,Ea,td,br)}:{},...ee.allow_paths!==void 0?{allow_paths:$r(ee.allow_paths,Oa,D,["destructive_command_protection","allow_paths"],br)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:ki(he.overrides,Ta,nd,br)}:{},...he.deny_paths!==void 0?{deny_paths:$r(he.deny_paths,Ma,D,["secret_protection","deny_paths"],br)}:{},...he.allow_paths!==void 0?{allow_paths:$r(he.allow_paths,Da,D,["secret_protection","allow_paths"],br)}:{}};return{policy:Yu({safety:je,workflow:typeof Q.worktree_mode==="boolean"?{worktree_mode:Q.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:O.audit===void 0?[]:[nb]}}function Qu(O,D,B,Q){return Object.fromEntries(D.flatMap((ee)=>{let he=O[ee];if(typeof he==="boolean")return[[ee,he]];if(he!==void 0)Q(e([...B,ee],Fa));return[]}))}function Yu(O){return Object.fromEntries(Object.entries(O).flatMap((D)=>Object.keys(D[1]).length>0?[D]:[]))}var br=()=>{return},Fa="must be a boolean",za="must be an object if provided",ed=`must be an integer between ${Ti} and ${Ii}`,td={path:["destructive_command_protection","overrides"],label:"destructive command"},nd={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(O,D){let B=[];return{policy:rd(O,D,(ee)=>{B.push(ee)}),issues:B}}function C(O,D){return rd(O,D,br)}function rd(O,D,B){if(!yn(O))return B(e([],"Config must be an object")),H();if(O.version!==1)B(e(["version"],"must be 1"));let Q=Br(O.safety,["safety"],["level","overrides"],B),ee=Br(Q.overrides,["safety","overrides"],Gr,B),he=Br(O.workflow,["workflow"],["worktree_mode"],B),je=Br(O.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],B),at=Br(O.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],B),lt=Br(O.audit,["audit"],["retention_days"],B);return od(O,Je,[],B),{version:1,safety:{level:rb(Q.level,B),overrides:Qu(ee,Gr,["safety","overrides"],B)},workflow:{worktree_mode:La(he.worktree_mode,["workflow","worktree_mode"],!1,B)},destructive_command_protection:{enabled:La(je.enabled,["destructive_command_protection","enabled"],!0,B),overrides:ki(je.overrides,Ea,td,B),allow_paths:$r(je.allow_paths,Oa,D,["destructive_command_protection","allow_paths"],B)},secret_protection:{enabled:La(at.enabled,["secret_protection","enabled"],!0,B),overrides:ki(at.overrides,Ta,nd,B),deny_paths:$r(at.deny_paths,Ma,D,["secret_protection","deny_paths"],B),allow_paths:$r(at.allow_paths,Da,D,["secret_protection","allow_paths"],B)},audit:{retention_days:ob(lt.retention_days,B)}}}function Br(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(D,za)),{};return od(O,B,D,Q),O}function od(O,D,B,Q){for(let ee of Object.keys(O).filter((he)=>!D.includes(he)))Q({path:B,message:ee,kind:"unknownKeys"})}function rb(O,D){if(O===void 0)return"standard";if(Ga.has(O))return O;return D(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function La(O,D,B,Q){if(typeof O==="boolean")return O;if(O!==void 0)Q(e(D,Fa));return B}function ob(O,D){if(!(O===void 0||typeof O==="number"&&Number.isInteger(O)&&O>=Ti&&O<=Ii))D(e(["audit","retention_days"],ed));return Uu(O)}function ki(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(B.path,za)),{};return Object.fromEntries(Object.entries(O).flatMap(([ee,he])=>{if(!D.has(ee))return Q({path:[...B.path,ee],message:`unknown ${B.label} rule id "${ee}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[ee,he]];return Q(e([...B.path,ee],'must be "on" or "off"')),[]}))}function $r(O,D,B,Q,ee){if(O===void 0)return[];if(!Array.isArray(O))return ee(e(Q,"must be an array of paths")),[];return O.flatMap((he,je)=>{let at=D(he,B);if(at===null)return[he];return ee(typeof he==="string"?Xt([...Q,je],at):e([...Q,je],at)),[]})}function yn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function H(){return structuredClone(Z)}function Ae(O,D){let B=R({safety:De(O.safety)},D),Q=G({destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides},B.capabilities),ee=Object.values(Q),he=ee.filter((je)=>je.source!=="catastrophic");return{selectedPreset:O.safety.level,effectiveLevel:B.effectiveLevel,capabilities:B.capabilities,rules:Q,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:ee.filter((je)=>je.changesInherited).length}}}function Ie(O,D){if(!eb(O))return{exists:!1,policy:H(),errors:[]};try{let B=tb(O,"utf-8");if(!B.trim())return{exists:!0,policy:H(),errors:[`${O}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(B),ee=Ye(Q,D);if(ee.issues.length===0)return{exists:!0,parsed:Q,policy:ee.policy,errors:[]};return{exists:!0,parsed:Q,policy:ee.policy,errors:ee.issues.map((he)=>`${O}: ${sb(he)}`),fallback:yn(Q)?"salvaged":"defaults"}}catch(B){let Q=B instanceof Error?B.message:String(B);return{exists:!0,policy:H(),errors:[`${O}: ${B instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}var ib=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[za,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Fa,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[ed,`not an integer between ${Ti} and ${Ii}`]]);function sb(O){let D=Sa(O.path);if(O.kind==="unknownKeys")return`${D===""?"":`${D}.`}${O.message}: unknown field`;if(O.kind==="key")return`${D}: unknown rule id`;let B=ib.get(O.message)??O.message;return D===""?B:`${D}: ${B}`}function ab(O,D){let B=Ie(O,D);if(!B.exists){let Q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!yn(Q))return{policy:Xu(),errors:[]};let ee=C(Q,D);return{policy:Wa(ee),gui:ee,errors:[],levelPresent:Zu(Q)}}if(B.parsed===void 0)return{policy:Xu(),errors:B.errors,...B.fallback?{fallback:B.fallback}:{}};return{policy:Wa(B.policy),gui:B.policy,errors:B.errors,...B.fallback?{fallback:B.fallback}:{},levelPresent:Zu(B.parsed)}}function Zu(O){let D=yn(O)&&yn(O.safety)?O.safety:{};return Ga.has(D.level)}function Oe(O){let D=Object.entries(O),B=new Set(D.flatMap(([Q,ee])=>ee==="on"?[Q]:[]));return[...new Set([...[..._i].filter((Q)=>!B.has(Q)),...D.flatMap(([Q,ee])=>ee==="off"?[Q]:[])])]}function Xu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function Wa(O){return{safety:De(O.safety),worktreeMode:O.workflow.worktree_mode,destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides,destructiveCommandAllowPaths:O.destructive_command_protection.allow_paths,secretProtection:{enabled:O.secret_protection.enabled,disabledRules:Oe(O.secret_protection.overrides),denyPaths:O.secret_protection.deny_paths,allowPaths:O.secret_protection.allow_paths}}}function De(O){let D={...O.overrides.fail_closed!==void 0?{failClosed:O.overrides.fail_closed}:{},...O.overrides.paranoid_rm!==void 0?{paranoidRm:O.overrides.paranoid_rm}:{},...O.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:O.overrides.paranoid_interpreters}:{}};return{level:O.level,...Object.keys(D).length>0?{overrides:D}:{}}}function E(O,D){let B=J(O,D),Q=Ju(O,D),ee={rules:B.rules,transparentWrappers:B.transparent_wrappers,safety:Q.safety,worktreeMode:Q.worktreeMode,destructiveCommandProtectionEnabled:Q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:Q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:Q.destructiveCommandAllowPaths,secretProtection:{enabled:Q.secretProtection.enabled??!0,disabledRules:Q.secretProtection.disabledRules??[],denyPaths:Q.secretProtection.denyPaths,allowPaths:Q.secretProtection.allowPaths??[]}},he={...B.userConfig?.overrides,...B.projectConfig?.overrides},je=Object.freeze(Object.fromEntries(ee.rules.map((at)=>{let lt=B.rulebooks.find((ut)=>ut.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...db(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(ee,lb(B,Q),je,Q.policyScopes)}function Ne(O){if(O.state==="ready")return{state:O.state};return{state:O.state,reason:O.reason}}function lb(O,D){let B=ub(D);if(O.errors.length===0&&O.warnings.length===0&&!B)return;return{diagnostics:[...O.errors,...O.warnings,...D.errors],reason:fb(O.errors.length>0?cb(O.errors):void 0,O.warnings.length>0?$a(O.warnings.join("; ")):void 0,B)}}function cb(O){return`${$a(O.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ub(O){if(O.errors.length===0)return;let D=O.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${O.errors.join("; ")}. Enforcing ${D}; the invalid values are not active. Fix the policy file manually`}function db(O){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(O)}function Ee(O,D,B=Object.freeze({}),Q){let ee=Ba(structuredClone(O)),he=Q?{policyScopes:Ba(structuredClone(Q))}:{};if(!D)return Object.freeze({state:"ready",policy:ee,diagnostics:Object.freeze([]),ruleMetadata:B,...he});return Object.freeze({state:"degraded",policy:ee,diagnostics:Object.freeze([...D.diagnostics]),reason:D.reason,ruleMetadata:B,...he})}function Ba(O){if(typeof O!=="object"||O===null)return O;for(let D of Object.values(O))Ba(D);return Object.freeze(O)}function fb(...O){return $a(O.filter((D)=>!!D).join("; "))}function $a(O){return/[.!?]$/.test(O)?O:`${O}.`}function Fe(O){let D=O.effectiveCapabilities,B=O.strict??D.fail_closed.enabled,Q=O.paranoidRm??D.paranoid_rm.enabled,ee=O.paranoidInterpreters??D.paranoid_interpreters.enabled,he={fail_closed:Ua(D.fail_closed,O.strict,"strict"),paranoid_rm:Ua(D.paranoid_rm,O.paranoidRm,"paranoidRm"),paranoid_interpreters:Ua(D.paranoid_interpreters,O.paranoidInterpreters,"paranoidInterpreters")};return{policy:ju(O.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:sa({failClosed:B,paranoidRm:Q,paranoidInterpreters:ee}),strict:B,paranoidRm:Q,paranoidInterpreters:ee,worktreeMode:O.worktreeMode??!1}}function Ua(O,D,B){if(D===void 0||D===O.enabled)return O;return{enabled:D,source:"capability_override",sources:[...O.sources,`analysis options.${B}`]}}function _o(O,D){if(O!=="powershell")return D[0]?.provenance==="command-substitution";let B=D[0]?.text==="&"||D[0]?.text==="."?1:0,Q=D[B]?.provenance;return Q!==void 0&&Q!=="literal"}var mb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Oi(O,D){return O?.provenance==="literal"&&!O.quoted&&O.raw===D&&O.text===D}function wo(O){let D=Oi(O.words[0],"time")?1:0,B=D===1&&Oi(O.words[D],"-p")?D+1:D,Q=D===1&&Oi(O.words[B],"--")?B+1:B,ee=Oi(O.words[Q],"!")?Q+1:Q,he=O.words.slice(ee).find((je)=>!mb.test(je.text));return he?.provenance==="literal"?he.text:void 0}var nr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Mi(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function pb(O){return Object.freeze({...O,span:Object.freeze(O.span),words:Object.freeze(O.words),redirections:Object.freeze(O.redirections.map((D)=>Object.freeze({...D,span:Object.freeze(D.span),...D.heredoc?{heredoc:Object.freeze({...D.heredoc,bodySpan:Object.freeze(D.heredoc.bodySpan),terminatorSpan:Object.freeze(D.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(O.nested.map((D)=>ln(D)))})}function Di(O,D,B){O.push(B),D.reset()}function Ni(O){let D=[];return{parts:D,push:(B,Q,ee)=>{if(Q<=B)return;D.push({raw:O.slice(B,Q),span:{start:B,end:Q},provenance:ee})}}}function Ha(O){let D=O.parts??[{raw:O.raw,span:O.span,provenance:O.provenance}];return Object.freeze({kind:"word",...O,span:Object.freeze(O.span),parts:Object.freeze(D.map((B)=>Object.freeze({...B,span:Object.freeze(B.span)})))})}function Ur(O,D,B,Q,ee,he,je){return Ha({text:Q,raw:O.slice(D,B),span:{start:D,end:B},provenance:ee,quoted:he,...je?{parts:je}:{}})}function ln(O){return Object.freeze({...O,span:Object.freeze(O.span),issues:Object.freeze(O.issues.map((D)=>Object.freeze({...D}))),nodes:Object.freeze(O.nodes.map((D)=>{if(D.kind==="command")return pb(D);if(D.kind==="group"||D.kind==="function")return Object.freeze({...D,span:Object.freeze(D.span),body:ln(D.body)});return Object.freeze({...D,span:Object.freeze(D.span)})}))})}function ja(O,D,B){if(D>=B||sd(O[D]??""))return null;let Q="",ee=!1,he=!1,je=D;while(je<B&&!sd(O[je]??"")){let at=O[je]??"";if(at==="'"){ee=!0;let lt=id(O,je+1,B,"'");Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){ee=!0;let lt=id(O,je+1,B,'"');Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){ee=!0;let lt=O[je+1];if(!lt||lt===`
+`||lt==="\r"){he=!0;break}Q+=lt,je+=2;continue}if(at==="`"||O.startsWith("$(",je)||O.startsWith("${",je)||O.startsWith("<(",je)||O.startsWith(">(",je))he=!0;Q+=at,je++}return{delimiter:Q,quoted:ee,next:je,ambiguous:he}}function Va(O,D,B,Q){let ee=[],he=D;for(let je of Q){let at=he,lt=!1;while(he<B){let ct=gb(O,he,B);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?hb(O.slice(at,he)):O.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return ee.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:B,issues:ee,terminated:!1}}return{next:he,issues:ee,terminated:!0}}function id(O,D,B,Q){let ee="",he=D;while(he<B&&O[he]!==`
+`&&O[he]!=="\r"){let je=O[he]??"";if(je===Q)return{text:ee,next:he+1,closed:!0};if(Q==='"'&&je==="\\"&&O[he+1]){let at=O[he+1]??"";ee+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}ee+=je,he++}return{text:ee,next:he,closed:!1}}function sd(O){return O!=="\r"&&(/[\s;&|<>)]/u.test(O)||O==="`")}function gb(O,D,B){let Q=D;while(Q<B&&O[Q]!==`
+`)Q++;let ee=Q>=B?B:Q+1;return{text:O.slice(D,Q),contentEnd:Q,next:ee}}function hb(O){return O.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ud=new Set(["&&","||","|","|&"]);function dd(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"posix",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Gi(O,0,O.length,D,{used:0,max:D.maxWords},0);return ln({kind:"program",dialect:"posix",source:O,span:B,status:Bi(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Gi(O,D,B,Q,ee,he,je){let at=[],lt=[],ct=Mi(),ut=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((gt)=>gt.text);Di(at,ct,{kind:"command",dialect:"posix",source:O.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?O.slice(D,B):pt.join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(je&&mt===je)return ft(),cd(at,lt),{nodes:at,issues:lt,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ut};if(zi(mt)){if(mt===`
+`||mt==="\r"){ft();let vt=mt==="\r"&&O[dt+1]===`
+`?dt+2:dt+1,Pt=at.at(-1);if(Pt?.kind!=="connector"||!ud.has(Pt.operator))at.push(Object.freeze({kind:"connector",operator:O.slice(dt,vt),span:Object.freeze({start:dt,end:vt})}));if(ut.length>0){let xt=Va(O,vt,B,ut.splice(0));lt.push(...xt.issues),dt=xt.next;continue}dt=vt;continue}dt++;continue}if(mt==="#"){while(dt<B&&O[dt]!==`
+`&&O[dt]!=="\r")dt++;continue}let pt=ct.start===-1?Wb(O,dt,B):void 0;if(pt){if(qa(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);if(!Ka(ee))return Hr(at,lt,dt,"word-limit",Q.maxWords);let vt=Gi(O,pt.braceIndex+1,B,Q,ee,he+1,"}"),Pt=vt.next,xt={start:pt.braceIndex+1,end:vt.closed?Pt-1:Pt},_t=ad(O,xt,vt);if(at.push({kind:"function",name:pt.name,span:{start:dt,end:Pt},body:_t}),lt.push(...vt.issues),vt.pendingHeredocs.length>0||Ao(vt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ut.push(...vt.pendingHeredocs),vt.limited)return Wi(at,lt,vt.next);if(!vt.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});dt=Pt;continue}let gt=Fi(O,dt);if(gt){if(ft(),!Sd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${gt} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:gt,span:Object.freeze({start:dt,end:dt+gt.length})})),dt+=gt.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:dt,end:dt+1}}),dt++;continue}if((mt==="("||mt==="{"&&Rb(O,dt,B))&&ct.start===-1){if(qa(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);let vt=mt==="("?")":"}",Pt=Gi(O,dt+1,B,Q,ee,he+1,vt),xt=Pt.next,_t={start:dt+1,end:Pt.closed?xt-1:xt},Ut=ad(O,_t,Pt);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:dt,end:xt},body:Ut}),lt.push(...Pt.issues),Pt.pendingHeredocs.length>0||Ao(Pt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ut.push(...Pt.pendingHeredocs),Pt.limited)return Wi(at,lt,Pt.next);if(!Pt.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});dt=xt;continue}let ht=(mt==="<"||mt===">")&&O[dt+1]!=="("?Cb(O,dt):null;if(ht){let vt=ct.words.at(-1),Pt=vt&&vt.span.end===dt&&/^[0-9]+$/.test(vt.raw)?Number(vt.raw):void 0;if(Pt!==void 0)ct.words.pop();let xt=Pt===void 0?dt:vt?.span.start??dt;ct.start=ct.start===-1?dt:ct.start;let _t=dt+ht.length;while(_t<B&&/[ \t]/.test(O[_t]??""))_t++;let Ut=O[_t],Vt=_t>dt+ht.length&&Ut==="#",qt=!Ut||zi(Ut)||!!Fi(O,_t)||Ut===je||Ut===")"||Vt||(Ut==="<"||Ut===">")&&O[_t+1]!=="(",Kt=ht==="<<"||ht==="<<-",Ft=Kt?ja(O,_t,B):void 0,Ot=Ft?{word:Ur(O,_t,Ft.next,Ft.delimiter,"literal",Ft.quoted),nested:[],issues:[],next:Ft.next,limited:!1}:!qt?Ya(O,_t,B,Q,ee,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Wi(at,lt,Ot.next);if(!Ka(ee))return Hr(at,lt,Ot.next,"word-limit",Q.maxWords)}let on=Ot?.next??dt+ht.length,Cn={kind:"redirection",operator:ht,span:{start:xt,end:on},...Pt===void 0?{}:{fd:Pt},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Cn),Kt&&!Ft)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Ft){if(Ft.ambiguous||Ft.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Un=ct.nested;ut.push({delimiter:Ft.delimiter,quotedDelimiter:Ft.quoted,stripTabs:ht==="<<-",attach:(wn)=>{if(Cn.heredoc=wn,wn.quotedDelimiter)return;Un.push(...bb(O,wn.bodySpan.start,wn.bodySpan.end,Q,ee,he+1))}})}if(!Kt&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${ht} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=on,dt=on;continue}if(ct.start===-1)qa(at,lt);let yt=Ya(O,dt,B,Q,ee,he);if(lt.push(...yt.issues),yt.limited)return Wi(at,lt,yt.next);let Ct=Pb(ct.words)?Ob(O,yt.word,ee.max-ee.used,Q.maxDepth,Q.maxInputLength):void 0;if(Ct?.limitCode)return Hr(at,lt,yt.next,Ct.limitCode,Ct.limitCode==="word-limit"?Q.maxWords:Ct.limitCode==="depth-limit"?Q.maxDepth:Q.maxInputLength);let Et=Ct?.words??[yt.word];for(let vt of Et){if(!Ka(ee))return Hr(at,lt,yt.next,"word-limit",Q.maxWords);ct.words.push(vt)}ct.start=ct.start===-1?dt:ct.start,ct.end=yt.next,ct.nested.push(...yt.nested),dt=yt.next>dt?yt.next:dt+1}return ft(),cd(at,lt),lt.push(...Gb(ut)),{nodes:at,issues:lt,next:dt,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function ad(O,D,B){return{kind:"program",dialect:"posix",source:O.slice(D.start,D.end),span:D,status:Bi(B.issues,B.limited),issues:B.issues,nodes:B.nodes}}function Ya(O,D,B,Q,ee,he){let je="",at=D,lt=!1,ct="literal",ut=[],ft=[],dt=!1;while(at<B){let mt=O[at],pt=(mt==="<"||mt===">")&&O[at+1]==="(";if(!mt||zi(mt)||(mt===";"||mt==="|"||mt==="&")&&Fi(O,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let ht=O.indexOf("'",at+1);if(ht===-1||ht>=B){je+=O.slice(at+1,B),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=B;break}je+=O.slice(at+1,ht),at=ht+1;continue}if(mt==='"'){lt=!0;let ht=yb(O,at,B,Q,ee,he);if(je+=ht.text,ut.push(...ht.nested),ft.push(...ht.issues),dt||=ht.limited,ct=Po(ct,ht.provenance),at=ht.next,dt)break;continue}if(O.startsWith("$'",at)){lt=!0;let ht=vb(O,at+2,B);if(je+=ht.text,ft.push(...ht.issues),!ht.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=ht.next;continue}if(mt==="\\"){let ht=O[at+1];if(!ht){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(ht===`
+`){at+=2;continue}je+=ht,at+=2;continue}let gt=mt==="$"||mt==="<"||mt===">"||mt==="`"?$i(O,at,B,Q,ee,he):null;if(gt){let ht=fd(gt,ut,ft);if(dt||=ht.limited,ct=Po(ct,ht.provenance),at=ht.next,dt)break;continue}if(mt==="$"){let ht=gd(O,at,B,je,ct);je=ht.text,ct=ht.provenance,at=ht.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=Po(ct,"glob");je+=mt,at++}return{word:Ur(O,D,at,je,ct,lt,ct==="literal"?void 0:xb(O,D,at)),nested:ut,issues:ft,next:at,limited:dt}}function yb(O,D,B,Q,ee,he){let je="",at="literal",lt=[],ct=[],ut=!1,ft=D+1;while(ft<B){let dt=O[ft];if(dt==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:ut};if(dt==="\\"&&O[ft+1]){let pt=O[ft+1]??"";if(pt===`
+`){ft+=2;continue}if(pt==="\r"&&O[ft+2]===`
+`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(O.startsWith("$((",ft)){let pt=Za(O,ft+3,B,"))"),gt=pt===-1?B:pt+2;if(je+=O.slice(ft,gt),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=gt;continue}let mt=$i(O,ft,B,Q,ee,he);if(mt){let pt=fd(mt,lt,ct);if(ft=pt.next,ut||=pt.limited,at=Po(at,pt.provenance),ut)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:ut};continue}if(dt==="$"){let pt=gd(O,ft,B,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=dt??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:B,limited:ut}}function $i(O,D,B,Q,ee,he){let je=O.startsWith("$((",D),at=O.startsWith("$(",D)&&!je,lt=O.startsWith("<(",D)||O.startsWith(">(",D),ct=O[D]==="`";if(!je&&!at&&!lt&&!ct)return null;let ut=je?3:ct?1:2,ft=je?"))":ct?"`":")",dt=Za(O,D+ut,B,ft),mt=dt===-1?B:dt,pt=dt===-1?B:dt+ft.length;if(he>=Q.maxDepth)return{program:Lb(O,D+ut,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let Ct=[],Et=[],vt=!1,Pt=D+ut;while(Pt<mt){let xt=$i(O,Pt,mt,Q,ee,he+1);if(!xt){Pt++;continue}if(Ct.push(...xt.program.nodes),Et.push(...xt.program.issues),vt||=xt.program.status==="limited",Pt=xt.next,vt)break}if(dt===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Bi(Et,vt),issues:Et,nodes:Ct}),next:pt,provenance:"arithmetic"}}let gt=Gi(O,D+ut,mt,Q,ee,he+1),ht=dt===-1?[{code:"unclosed-command-substitution",message:`${O.slice(D,D+ut)} substitution is not closed`}]:[],yt=(ct||lt)&&Ao(gt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Bi([...gt.issues,...ht,...yt],gt.limited),issues:[...gt.issues,...ht,...yt],nodes:gt.nodes}),next:pt,provenance:"command-substitution"}}function bb(O,D,B,Q,ee,he){let je=[],at=D;while(at<B){let lt=O[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?$i(O,at,B,Q,ee,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function fd(O,D,B){return D.push(O.program),B.push(...O.program.issues),{provenance:O.provenance,next:O.next,limited:O.program.status==="limited"}}function Za(O,D,B,Q){if(Q==="`"){for(let at=D;at<B;at++){if(O[at]==="\\"){at++;continue}if(O[at]==="`")return at}return-1}let ee=1,he={single:!1,double:!1},je=[];for(let at=D;at<B;at++){let lt=O[at];if((lt===`
+`||lt==="\r")&&je.length>0){let ut=lt==="\r"&&O[at+1]===`
+`?at+2:at+1,ft=Va(O,ut,B,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=md(O,at,D,B,he);if(ct!==null){at=ct;continue}if(!he.double&&O.startsWith("$((",at)){let ut=Sb(O,at+3,B);if(ut===-1)return-1;at=ut+1;continue}if(Q===")"&&!he.double&&lt==="<"&&O[at+1]==="<"&&O[at+2]!=="<"){let ut=O[at+2]==="-",ft=at+(ut?3:2);while(ft<B&&/[ \t]/.test(O[ft]??""))ft++;let dt=ja(O,ft,B);if(dt){je.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ut,attach:()=>{return}}),at=dt.next-1;continue}}if(O.startsWith("$(",at)&&!O.startsWith("$((",at)){ee++,at++;continue}if(lt==="("&&!he.double)ee++;if(lt===")"&&!he.double){if(ee--,ee===0)return Q==="))"&&O[at+1]!==")"?-1:at}}return-1}function Sb(O,D,B){let Q=1,ee={single:!1,double:!1};for(let he=D;he<B;he++){let je=O[he],at=md(O,he,D,B,ee);if(at!==null){he=at;continue}if(O.startsWith("$(",he)&&!O.startsWith("$((",he)){Q++,he++;continue}if(je==="("&&!ee.double)Q++;if(je!==")"||ee.double)continue;if(Q--,Q===0)return O[he+1]===")"?he:-1}return-1}function md(O,D,B,Q,ee){let he=O[D];if(he==="\\"&&!ee.single)return D+1;if(!ee.double&&he==="'")ee.single=!ee.single;if(!ee.single&&he==='"')ee.double=!ee.double;if(ee.single)return D;if(ee.double||he!=="#"||!Fb(O,D,B))return null;let je=D;while(je+1<Q&&O[je+1]!==`
+`&&O[je+1]!=="\r")je++;return je}function Fi(O,D){let B=O[D];if(B===";")return";";if(B==="&")return O[D+1]==="&"?"&&":"&";if(B==="|")return O[D+1]==="|"?"||":O[D+1]==="&"?"|&":"|";return null}function Cb(O,D){let B=O[D];if(B===">"){if(O[D+1]===">")return">>";if(O[D+1]==="&")return">&";return O[D+1]==="|"?">|":">"}if(B!=="<")return null;if(O.startsWith("<<<",D))return"<<<";if(O.startsWith("<<-",D))return"<<-";if(O[D+1]==="<")return"<<";if(O[D+1]==="&")return"<&";if(O[D+1]===">")return"<>";return"<"}function zi(O){let D=O.charCodeAt(0);if(D===32||D>=9&&D<=13)return!0;if(D<128)return!1;return/\s/u.test(O)}function pd(O,D,B){if(O[D+1]==="{"){let ee=O.indexOf("}",D+2);return ee===-1||ee>=B?B:ee+1}let Q=D+1;while(Q<B&&/[A-Za-z0-9_?@#$!*-]/.test(O[Q]??""))Q++;return Q===D+1?D+1:Q}function vb(O,D,B){let Q="",ee=[],he=D;while(he<B){let je=O[he];if(je==="'")return{text:Q,next:he+1,closed:!0,issues:ee};if(je!=="\\"){Q+=je??"",he++;continue}let at=Eb(O,he+1,B);if(Q+=at.text,at.invalidCodePoint!==void 0)ee.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:Q,next:B,closed:!1,issues:ee}}function Eb(O,D,B){let Q=O[D];if(!Q||D>=B)return{text:"\\",next:D};let ee=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ee.has(Q))return{text:ee.get(Q)??Q,next:D+1};if(Q==="x")return Li(O,D+1,B,16,2,D+1);if(Q==="u")return Li(O,D+1,B,16,4,D+1);if(Q==="U")return Li(O,D+1,B,16,8,D+1);if(/[0-7]/.test(Q))return Li(O,D,B,8,3,D+1);return{text:Q,next:D+1}}function Li(O,D,B,Q,ee,he){let je=Q===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=D;while(lt<B&&at.length<ee&&je.test(O[lt]??""))at+=O[lt],lt++;if(!at)return{text:O[he-1]??"",next:he};let ct=Number.parseInt(at,Q);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function Bi(O,D=!1){if(D)return"limited";if(O.some((B)=>B.code==="invalid-ansi-c-code-point"||B.code==="missing-heredoc-delimiter"||B.code==="ambiguous-heredoc-delimiter"||B.code==="unterminated-heredoc"||B.code==="unsupported-heredoc-context"))return"invalid";return O.length>0?"partial":"complete"}function gd(O,D,B,Q,ee){let he=pd(O,D,B);return{text:Q+O.slice(D,he),provenance:Po(ee,"variable"),next:he}}function xb(O,D,B){let Q=Ni(O),ee=D,he=!1,je=!1,at=D;while(at<B){let lt=O[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=O.startsWith("$((",at),ut=O.startsWith("$(",at)&&!ct,ft=!je&&(O.startsWith("<(",at)||O.startsWith(">(",at)),dt=lt==="`";if(ct||ut||ft||dt){let mt=ct?3:dt?1:2,pt=ct?"))":dt?"`":")",gt=Za(O,at+mt,B,pt),ht=gt===-1?B:gt+pt.length;Q.push(ee,at,"literal"),Q.push(at,ht,ct?"arithmetic":"command-substitution"),at=ht,ee=ht;continue}if(lt==="$"){let mt=pd(O,at,B);if(mt>at+1){Q.push(ee,at,"literal"),Q.push(at,mt,"variable"),at=mt,ee=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){Q.push(ee,at,"literal"),Q.push(at,at+1,"glob"),at++,ee=at;continue}at++}return Q.push(ee,B,"literal"),Q.parts}function Po(O,D){if(D==="command-substitution"||O==="command-substitution")return"command-substitution";if(D==="arithmetic"||O==="arithmetic")return"arithmetic";if(D==="variable"||O==="variable")return"variable";if(D==="glob"||O==="glob")return"glob";return O}function Rb(O,D,B){return D+1>=B||zi(O[D+1]??"")||Fi(O,D+1)!==null}var _b=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),wb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Pb(O){let D=0;while(D<=O.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(O[D]?.text??""))D++;if(D===O.length)return!0;let B=Ab(O,D);if(B===void 0||B===null)return!1;D=B}return!1}function Ab(O,D){let B=O[D]?.text.toLowerCase();if(B==="command")return Tb(O,D);if(B==="env")return Ib(O,D);if(B==="sudo")return kb(O,D);return}function Tb(O,D){if(O[D+1]?.text==="-v")return null;for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return B}return O.length}function Ib(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(_b.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return B}return O.length}function kb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(wb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-"))continue;return B}return O.length}function hd(O,D,B,Q){if(O.provenance!=="literal"||!O.raw.includes("{"))return;let ee=yd(O.raw,D,B,Q,!0);if(!ee)return;if("limited"in ee)return{limited:!0};let he=ee.values.map((je)=>bd(je,B));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function Ob(O,D,B,Q,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let he=yd(D.raw,B,Q,ee,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>bd(at,Q));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Ur(O,D.span.start,D.span.end,at,"literal",!1))}}function yd(O,D,B,Q,ee){let he=[O],je=O.length,at=0;while(!0){let lt=he.findIndex((mt)=>ld(mt,ee));if(lt===-1)break;if(++at>B)return{limited:"expansions"};let ct=he[lt]??"",ut=ld(ct,ee);if(!ut||ut.kind==="range")return{limited:"expansions"};let ft=ut.start+ct.length-ut.end,dt=ut.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+dt>Q)return{limited:"length"};if(he.length-1+ut.alternatives.length>D)return{limited:"words"};he.splice(lt,1,...Mb(ct,ut)),je+=dt-ct.length}return at===0?void 0:{values:he}}function ld(O,D){let B=[],Q,ee=null,he=!1;for(let je=0;je<O.length;je++){let at=O[je];if(he){he=!1;continue}if(at==="\\"&&ee!=="'"){he=!0;continue}if(at===ee){ee=null;continue}if(ee===null&&(at==="'"||at==='"')){ee=at;continue}if(ee!==null)continue;if(at==="{"){B.push({start:je,commas:[]});continue}if(at===","&&B.length>0){B.at(-1)?.commas.push(je);continue}if(at!=="}"||B.length===0)continue;let lt=B.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:D&&Nb(O.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!Q||ct.start<Q.start))Q=ct}if(!Q||Q.kind==="range")return Q;return{kind:Q.kind,start:Q.start,end:Q.end,alternatives:Db(O,Q)}}function Mb(O,D){return D.alternatives.map((B)=>`${O.slice(0,D.start)}${B}${O.slice(D.end)}`)}function Db(O,D){let B=[D.start,...D.commas,D.end-1];return B.slice(0,-1).map((Q,ee)=>O.slice(Q+1,B[ee+1]))}function Nb(O){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(O)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(O)}function bd(O,D){let B=`x${O}`,Q=Ya(B,0,B.length,{maxInputLength:B.length,maxWords:1,maxDepth:D},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==B.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function Lb(O,D,B,Q){return ln({kind:"program",dialect:"posix",source:O.slice(D,B),span:{start:D,end:B},status:"limited",issues:[{code:Q,message:"command structure exceeds parser limit"}],nodes:[]})}function Hr(O,D,B,Q,ee){return{nodes:O,issues:[...D,{code:Q,message:`command structure exceeds parser limit ${ee}`}],next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Wi(O,D,B){return{nodes:O,issues:D,next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Ka(O){return O.used++,O.used<=O.max}function Wb(O,D,B){let Q=O.slice(D,B),ee=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(Q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(Q),he=ee?.[1];if(!ee||!he)return;return{name:he,braceIndex:D+ee[0].lastIndexOf("{")}}function Ao(O){return O.some((D)=>{if(D.kind==="command")return D.redirections.some((B)=>B.heredoc)||D.nested.some((B)=>Ao(B.nodes));return(D.kind==="group"||D.kind==="function")&&Ao(D.body.nodes)})}function Gb(O){return O.map((D)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${D.delimiter} was not found`}))}function Sd(O){return O?.kind==="command"||O?.kind==="group"||O?.kind==="function"}function cd(O,D){let B=O.at(-1);if(B?.kind!=="connector"||!ud.has(B.operator))return;D.push({code:"missing-command-after-connector",message:`connector ${B.operator} requires a following command`})}function qa(O,D){if(!Sd(O.at(-1)))return;D.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Fb(O,D,B){return D===B||/[\s;&|()]/u.test(O[D-1]??"")}var vd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),zb=new Set(["gc","cat","type","cp","mv","rm"]),Ed=["-rec","-for","-path","-literalpath","-whatif"],Bb=/^\$env:\w/i,$b=/^(?:\$\{?\w+\}?|~)\\./;function xd(O,D){let B=O.toLowerCase().replaceAll("`","");if(![...vd].some((ee)=>B.includes(ee))&&!(B.includes("rm")&&Ed.some((ee)=>B.includes(ee)))&&!B.includes("<#")&&!Ub(B))return!1;let Q=el(O,D);if(Rd(Q))return!1;return Q.issues.some((ee)=>ee.code==="unclosed-block-comment"||ee.code==="comment-depth-limit")||Qa(Q).some(Hb)}function Rd(O){return O.nodes.some((D)=>{if(D.kind==="group")return Rd(D.body);if(D.kind!=="command")return!1;return D.redirections.some((B)=>B.operator==="<<")})}function Ub(O){if(O.includes("$env:"))return!0;return O.includes("\\")&&(O.includes("$")||O.includes("~"))}function Hb(O){let D=O[0]==="&"||O[0]==="."?1:0,B=O[D]?.toLowerCase();if(B&&vd.has(B))return!0;let Q=O.slice(D+1);if(B&&zb.has(B)&&Q.some(jb))return!0;if(B!=="rm")return!1;return Q.some((ee)=>{let he=ee.toLowerCase().split(":",1)[0]??"";return Ed.some((je)=>he.startsWith(je))})}function jb(O){return Bb.test(O)||$b.test(O)}function el(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"powershell",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=tl(O,0,O.length,D,0);return ln({kind:"program",dialect:"powershell",source:O,span:B,status:Zb(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function tl(O,D,B,Q,ee,he=!1){let je=[],at=[],lt=Mi(),ct=0,ut=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};Di(je,lt,{kind:"command",dialect:"powershell",source:O.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:dt+1,closed:!0,words:ct,limited:ut};let pt=Yb(O,dt,B,Q.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};dt=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
+`){ft();let yt=mt==="\r"&&O[dt+1]===`
+`?dt+2:dt+1;je.push(Xa(O,dt,yt)),dt=yt;continue}dt++;continue}let gt=Pd(O,dt);if(gt){ft(),je.push(Xa(O,dt,dt+gt.length)),dt+=gt.length;continue}if(mt==="{"){if(ft(),ee>=Q.maxDepth)return at.push(wd(Q.maxDepth)),{nodes:je,issues:at,next:B,closed:!1,words:ct,limited:!0};let yt=tl(O,dt+1,B,Q,ee+1,!0),Ct=yt.closed?yt.next-1:yt.next,Et=ln({kind:"program",dialect:"powershell",source:O.slice(dt+1,Ct),span:{start:dt+1,end:Ct},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:yt.next}),body:Et})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,ut||=yt.limited,dt=yt.next;continue}if(mt==="}"){ft(),je.push(Xa(O,dt,dt+1)),dt++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?dt:lt.start;let yt=O[dt+1]===mt?dt+2:dt+1,Ct=yt;while(/[ \t]/.test(O[Ct]??""))Ct++;let Et=Ct<B?Cd(O,Ct,B,Q,ee):void 0,vt=Et?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:O.slice(dt,yt),span:Object.freeze({start:dt,end:vt}),...Et?{target:Et.word}:{}})),Et)at.push(...Et.issues),lt.nested.push(...Et.nested),ct+=Et.words,ut||=Et.limited;lt.end=vt,dt=vt;continue}if(mt===","){lt.start=lt.start===-1?dt:lt.start,lt.words.push(Ha({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),lt.end=++dt;continue}let ht=Cd(O,dt,B,Q,ee);if(lt.start=lt.start===-1?dt:lt.start,lt.end=ht.next,lt.words.push(ht.word),at.push(...ht.issues),lt.nested.push(...ht.nested),ct+=1+ht.words,ut||=ht.limited,ct>Q.maxWords)return at.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`}),ft(),{nodes:je,issues:at,next:ht.next,closed:!1,words:ct,limited:!0};dt=ht.next>dt?ht.next:dt+1}return ft(),{nodes:je,issues:at,next:dt,closed:!he,words:ct,limited:ut}}function Cd(O,D,B,Q,ee){let he="",je="literal",at=!1,lt=[],ct=[],ut=0,ft=!1,dt=(pt)=>{let gt=Vb(O,pt,B,Q,ee);return he+=O.slice(pt,gt.next),ct.push(gt.program),lt.push(...gt.program.issues),ut+=Ja(gt.program),ft||=gt.program.status==="limited",je="command-substitution",gt.next},mt=D;while(mt<B){let pt=O[mt];if(!pt||/\s/.test(pt)||Pd(O,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let gt=O[mt+1];if(!gt){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=gt,mt+=2;continue}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(pt==="'"){at=!0,mt++;let gt=!1;while(mt<O.length){if(O[mt]==="'"&&O[mt+1]==="'"){he+="'",mt+=2;continue}if(O[mt]==="'"){gt=!0,mt++;break}he+=O[mt]??"",mt++}if(!gt)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let gt=!1;while(mt<B){let ht=O[mt];if(ht==="`"&&O[mt+1]){he+=O[mt+1],mt+=2;continue}if(ht==='"'){gt=!0,mt++;break}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(ht==="$")je=O[mt+1]==="("?"command-substitution":"variable";he+=ht??"",mt++}if(!gt)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=O[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===D)je="variable";he+=pt,mt++}return{word:Ur(O,D,mt,he,je,at,je==="literal"?void 0:Kb(O,D,mt)),next:mt,issues:lt,nested:ct,words:ut,limited:ft}}function Vb(O,D,B,Q,ee){let he=_d(O,D+2,B),je=he===-1?B:he,at=he===-1?B:he+1;if(ee>=Q.maxDepth)return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:"limited",issues:[wd(Q.maxDepth)],nodes:[]}),next:at};let lt=tl(O,D+2,je,Q,ee+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function _d(O,D,B){let Q=1,ee=!1,he=!1;for(let je=D;je<B;je++){let at=O[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(ee&&O[je+1]==="'"){je++;continue}ee=!ee;continue}if(!ee&&at==='"'){he=!he;continue}if(ee)continue;if(O.startsWith("$(",je)){Q++,je++;continue}if(!he&&at==="(")Q++;if(at!==")")continue;if(Q--,Q===0)return je}return-1}function Ja(O){let D=0;for(let B of O.nodes){if(B.kind==="group")D+=Ja(B.body);if(B.kind==="command"){D+=B.words.length;for(let Q of B.nested)D+=Ja(Q)}}return D}function Kb(O,D,B){let Q=Ni(O),ee=D,he=!1,je=D;while(je<B){let at=O[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&O[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(O.startsWith("$(",je)){let lt=_d(O,je+2,B),ct=lt===-1?B:lt+1;Q.push(ee,je,"literal"),Q.push(je,ct,"command-substitution"),je=ct,ee=ct;continue}if(at==="$"||at==="@"&&je===D){let lt=qb(O,je+1,B);Q.push(ee,je,"literal"),Q.push(je,lt,"variable"),je=lt,ee=lt;continue}je++}return Q.push(ee,B,"literal"),Q.parts}function qb(O,D,B){if(O[D]==="{"){let ee=O.indexOf("}",D+1);return ee===-1||ee>=B?B:ee+1}let Q=D;while(Q<B&&/[A-Za-z0-9_:?]/.test(O[Q]??""))Q++;return Q}function wd(O){return{code:"depth-limit",message:`command structure exceeds parser limit ${O}`}}function Qa(O){return O.nodes.flatMap((D)=>{if(D.kind==="group")return Qa(D.body);if(D.kind!=="command")return[];return[[...D.words,...D.redirections.flatMap((B)=>B.target?[B.target]:[])].sort((B,Q)=>B.span.start-Q.span.start).filter((B)=>B.text!==""&&B.raw!==",").map((B)=>B.text),...D.nested.flatMap(Qa)]})}function Pd(O,D){for(let B of["&&","||",";","|"])if(O.startsWith(B,D))return B;return null}function Yb(O,D,B,Q){if(O[D]==="#"&&O[D+1]!==">"){let je=D+1;while(je<B&&O[je]!=="\r"&&O[je]!==`
+`)je++;return{next:je,limited:!1}}if(!O.startsWith("<#",D))return null;let ee=1,he=D+2;while(he<B){if(O.startsWith("<#",he)){if(ee++,ee>Q)return{next:B,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`},limited:!0};he+=2;continue}if(O.startsWith("#>",he)){if(ee--,he+=2,ee===0)return{next:he,limited:!1};continue}he++}return{next:B,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Zb(O,D){if(D)return"limited";if(O.some((B)=>B.code==="unclosed-block-comment"))return"invalid";return O.length>0?"partial":"complete"}function Xa(O,D,B){return Object.freeze({kind:"connector",operator:O.slice(D,B),span:Object.freeze({start:D,end:B})})}function h(O,D="auto",B=nr){if(D==="powershell"||D==="auto"&&xd(O.slice(0,B.maxInputLength),B))return el(O,B);return dd(O,B)}function t(O){return O.provenance==="command-substitution"?O.raw:O.text}function X(O,D){return O==="posix"?D:$t(D.map((B)=>B.text))}function Ui(O,D){return O&&O.provenance!=="unknown"?O.provenance==="literal":!/[$`*?[\]]/.test(D)}function $t(O){return O.map((D)=>({kind:"word",text:D,raw:D,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function nl(O,D){return{value:O,work:D}}function bt(O,D){if(O.work)O.work.units=Math.min(Number.MAX_SAFE_INTEGER,O.work.units+1);return O.value[D]}function jt(O){return O.value.length}function To(O,D,B=1){if(O)O.units=Math.min(Number.MAX_SAFE_INTEGER,O.units+D.length*B)}function bn(O,D){To(O,D)}function Sr(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=48&&D<=57||D>=65&&D<=90||D===95||D>=97&&D<=122}function zt(O){if(!O)return!1;let D=O.charCodeAt(0);return D===9||D===10||D===11||D===12||D===13||D===32||D===160||D===65279||D===5760||D>=8192&&D<=8202||D===8232||D===8233||D===8239||D===8287||D===12288}function rl(O){return O===`
+`||O==="\r"||O==="\u2028"||O==="\u2029"}function Bt(O,D,B){if(D+B.length>jt(O))return!1;for(let Q=0;Q<B.length;Q++)if(bt(O,D+Q)!==B[Q])return!1;return!0}function jn(O,D,B){return!Sr(bt(O,D-1))&&Bt(O,D,B)&&!Sr(bt(O,D+B.length))}function Vn(O,D){return Sr(bt(O,D-1))!==Sr(bt(O,D))}function Qt(O){return O===`
+`||O===";"||O==="&"||O==="|"}function jr(O){return O==="|"||O===";"}function Hi(O,D,B){let Q=nl(O,B);if(D==="rm")return Xb(Q);if(D==="dd")return Qb(Q);return Md(Q,!0)}function ji(O,D,B){let Q=nl(O,B);if(D==="rm")return eS(Q);if(D==="reset-hard")return kd(Q,"--ha","rd");if(D==="reset-merge")return kd(Q,"--me","rge");if(D==="clean")return oS(Q);if(D==="checkout")return sS(Q);if(D==="push-force")return aS(Q);if(D==="push-refspec")return lS(Q);if(D==="push-delete")return cS(Q);if(D==="branch")return uS(Q);if(D==="tag")return mS(Q);if(D==="restore")return pS(Q);return Md(Q,!1)}function Xb(O){let D=!1,B=!1,Q=!1,ee=-1;for(let he=0;he<=jt(O);he++){let je=bt(O,he);if(!D){let lt=bt(O,he+2);if(jn(O,he,"rm")&&zt(lt)&&lt!==`
+`)D=!0,he++;continue}let at=Jb(O,he);if(je===`
+`||at!==-1){if(D=!1,B=!1,Q=!1,ee=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===jt(O)){if(ee>=0){let lt=Ad(O,ee,he);B||=lt.recursive,Q||=lt.force}if(B&&Q)return!0;D=!1,B=!1,Q=!1,ee=-1;continue}if(zt(je)){if(ee<0)continue;if(Bt(O,ee,"--")&&he-ee===2){D=!1,B=!1,Q=!1,ee=-1;continue}let lt=Ad(O,ee,he);if(B||=lt.recursive,Q||=lt.force,B&&Q)return!0;ee=-1;continue}if(ee<0)ee=he}return!1}function Jb(O,D){if(bt(O,D)!=="\\"||bt(O,D-1)==="\\")return-1;if(Bt(O,D,String.raw`\n`))return D+2;if(Bt(O,D,String.raw`\x0a`)||Bt(O,D,String.raw`\x0A`))return D+5;if(Bt(O,D,String.raw`\u000a`)||Bt(O,D,String.raw`\u000A`))return D+7;return Bt(O,D,String.raw`\012`)?D+4:-1}function Ad(O,D,B){if(Td(O,D,B,"recursive"))return{recursive:!0,force:!1};if(Td(O,D,B,"force"))return{recursive:!1,force:!0};if(bt(O,D)!=="-"||bt(O,D+1)==="-")return{recursive:!1,force:!1};let Q=!1,ee=!1;for(let he=D+1;he<B;he++){let je=bt(O,he);Q||=je==="r"||je==="R",ee||=je==="f"||je==="F"}return{recursive:Q,force:ee}}function Td(O,D,B,Q){let ee=B-D-2;if(ee<1||ee>Q.length||!Bt(O,D,"--"))return!1;for(let he=0;he<ee;he++)if(bt(O,D+he+2)!==Q[he])return!1;return!0}function Qb(O){let D=!1;for(let B=0;B<jt(O);B++){if(Qt(bt(O,B))){D=!1;continue}if(jn(O,B,"dd")){D=!0,B++;continue}if(!D||!jn(O,B,"of")||!Bt(O,B,"of=/dev/"))continue;let Q=B+8;if(Q<jt(O)&&!zt(bt(O,Q))&&bt(O,Q)!=="'"&&bt(O,Q)!=='"')return!0}return!1}function eS(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=jt(O);){let he=bt(O,ee);if(ee===jt(O)||Qt(he)){D=!1,B=!1,Q=!1,ee++;continue}let je=nS(O,ee);if(je>=0){if(tS(O,je))return!0;let at=je,lt=!1;while(zt(bt(O,at)))lt||=bt(O,at)===`
+`,at++;if(lt)B=!1,Q=!1;D=!0,ee=at;continue}if(!D){ee++;continue}if(Bt(O,ee,"--")&&(ee===0||zt(bt(O,ee-1)))&&(!bt(O,ee+2)||zt(bt(O,ee+2))||Qt(bt(O,ee+2)))){D=!1,B=!1,Q=!1,ee+=2;continue}if(B||=Bt(O,ee,"--recursive")&&Vn(O,ee+11)||ol(O,ee,"recursive"),Q||=Bt(O,ee,"--force")&&Vn(O,ee+7)||ol(O,ee,"force"),B&&Q)return!0;ee++}return!1}function ol(O,D,B){if(!Bt(O,D,"--"))return!1;let Q=0;while(Q<=B.length){let ee=bt(O,D+Q+2);if(!ee||zt(ee)||Qt(ee))break;if(ee!==B[Q])return!1;Q++}return Q>0&&Vn(O,D+Q+2)}function tS(O,D){let B=D,Q=!1,ee=!1;while(B<jt(O)){while(zt(bt(O,B)))B++;let he=B;while(B<jt(O)&&!zt(bt(O,B)))B++;if(bt(O,he)!=="-"||B-he===2&&Bt(O,he,"--"))return!1;let je=Id(O,he,"recursive"),at=Id(O,he,"force");if(Q&&at||ee&&je)return!0;if(Q||=je,ee||=at,bt(O,he+1)==="-")continue;let lt=rS(O,he,B);if(lt.combined||Q&&lt.forceAtBoundary||ee&&lt.recursiveAtBoundary)return!0;Q||=lt.recursive,ee||=lt.force}return!1}function Id(O,D,B){return Bt(O,D,`--${B}`)&&Vn(O,D+B.length+2)||ol(O,D,B)}function nS(O,D){if(D>0&&Sr(bt(O,D-1)))return-1;let B=D;if(bt(O,B)==="\\")B++;if(bt(O,B)!=="r")return-1;if(B++,bt(O,B)==="\\")B++;if(bt(O,B)!=="m"||!zt(bt(O,B+1)))return-1;return B+1}function rS(O,D,B){let Q=!1,ee=!1,he=!1,je=!1,at=!1;if(bt(O,D)!=="-")return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=D+1;ct<B;ct++){let ut=bt(O,ct)??"",ft=(ut==="r"||ut==="f")&&Vn(O,ct+1);Q||=ut==="r",ee||=ut==="f",he||=ut==="r"&&ft,je||=ut==="f"&&ft,at||=(lt==="r"&&ut==="f"||lt==="f"&&ut==="r")&&ft,lt=ut}return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function kd(O,D,B){return ko(O,"reset",jr,!0,(Q)=>bt(O,Q)==="-"&&Vr(O,Q,D,B)?!0:Q)}function oS(O){return ko(O,"clean",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(Vr(O,D,"--fo","rce"))return!0;let B=Io(O,D,jr);for(let Q=D+1;Q<B;Q++)if(bt(O,Q)==="f")return!0;return B-1})}function Vi(O,D,B){if(!jn(O,D,"git"))return null;let Q=D+3;if(!zt(bt(O,Q)))return{commandEnd:-1,next:Q};while(zt(bt(O,Q)))Q++;while(Q<jt(O)){if(Qt(bt(O,Q)))return{commandEnd:-1,next:Q};let ee=Io(O,Q,Qt);if(jn(O,Q,B))return{commandEnd:Q+B.length,next:ee};if(bt(O,Q)!=="-")return{commandEnd:-1,next:ee};let he=ee-Q===2&&Bt(O,Q,"--"),je=iS(O,Q,ee);Q=ee;while(zt(bt(O,Q)))Q++;if(he)return{commandEnd:jn(O,Q,B)?Q+B.length:-1,next:Io(O,Q,Qt)};if(!je)continue;if(Q>=jt(O)||Qt(bt(O,Q)))return{commandEnd:-1,next:Q};Q=Io(O,Q,Qt);while(zt(bt(O,Q)))Q++}return{commandEnd:-1,next:Q}}function iS(O,D,B){for(let Q of gn)if(B-D===Q.length&&Bt(O,D,Q))return!0;return!1}function sS(O){return Od(O,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function aS(O){return ko(O,"push",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(bt(O,D+1)==="f"&&!Sr(bt(O,D+2))&&!Bt(O,D+2,"-with-lease"))return!0;let B=Dd(O,D,"--fo","rce");if(B>=0&&!Bt(O,B,"-with-lease"))return!0;return D})}function lS(O){return ko(O,"push",Qt,!1,(D)=>{if(zt(bt(O,D))&&bt(O,D+1)==="+"&&D+2<jt(O)&&!Qt(bt(O,D+2))&&!zt(bt(O,D+2)))return!0;if(bt(O,D)===":"&&bt(O,D+1)==="+")return!0;return D})}function cS(O){return ko(O,"push",Qt,!1,(D)=>{if(bt(O,D)==="-"&&Vr(O,D,"--de","lete"))return!0;if(zt(bt(O,D))&&bt(O,D+1)===":"&&D+2<jt(O)&&!zt(bt(O,D+2))&&!Qt(bt(O,D+2)))return!0;return D})}function uS(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=jt(O);ee++){if(ee===jt(O)||Qt(bt(O,ee))){if(B&&Q)return!0;D=!1,B=!1,Q=!1;continue}if(!D){let at=Vi(O,ee,"branch");if(at){D=at.commandEnd>=0,ee=Math.max(ee,(D?at.commandEnd:at.next)-1);continue}}if(!D||bt(O,ee)!=="-")continue;let he=Io(O,ee,Qt),je=dS(O,ee,he);if(B||=je.deletion,Q||=je.force,B&&Q)return!0;ee=he-1}return!1}function dS(O,D,B){let Q=!1,ee=!1;for(let he=D;he<B;he++){if(bt(O,he)!=="-")continue;if(Vr(O,he,"--de","lete"))Q=!0;if(Vr(O,he,"--fo","rce"))ee=!0;if(bt(O,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<B&&fS(bt(O,je))){let ut=bt(O,je);at||=ut==="d"||ut==="D",lt||=ut==="f",ct||=ut==="D",je++}if(!Vn(O,je))continue;Q||=at,ee||=lt||ct}return{deletion:Q,force:ee}}function fS(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=65&&D<=90||D>=97&&D<=122}function mS(O){return Od(O,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Od(O,D){let B=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<jt(O);Q++){let ee=bt(O,Q),he=B[B.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&ee==="\\",!je&&ee==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&ee==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(ee==="$"&&bt(O,Q+1)==="("&&(B.length===1||!je&&he.quote!=="'")){B.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!je&&!he.quote&&B.length>1&&ee==="("){he.depth++;continue}if(!je&&!he.quote&&B.length>1&&ee===")"){if(he.depth--,he.depth===0)B.pop();continue}if(zt(ee))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=Vi(O,Q,D.command);if(at){he.outerActive=at.commandEnd>=0&&zt(bt(O,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,Q=Math.max(Q,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&ee==="-"){if(Vr(O,Q,D.longPrefix,D.longOptional))return!0;he.shortActive||=!D.excludedShortStarts.includes(bt(O,Q+1)??"")}if(he.hasShortFlag||=he.shortActive&&ee===D.shortFlag,he.hasShortFlag&&Vn(O,Q+1))return!0;if(jr(ee))he.outerActive=!1}return!1}function ko(O,D,B,Q,ee){let he=!1;for(let je=0;je<jt(O);je++){let at=bt(O,je),lt=B(at);if(!he&&!lt){let ct=Vi(O,je,D);if(ct){he=ct.commandEnd>=0&&(!Q||zt(bt(O,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=ee(je);if(ct===!0)return!0;for(let ut=je;ut<=ct;ut++)if(B(bt(O,ut)))he=!1;je=ct}if(lt)he=!1}return!1}function pS(O){let D=!1;for(let B=0;B<jt(O);B++){if(rl(bt(O,B))){if(D)return!0;D=!1;continue}if(!D){let Q=Vi(O,B,"restore");if(Q){D=Q.commandEnd>=0,B=Math.max(B,(D?Q.commandEnd:Q.next)-1);continue}}if(D&&bt(O,B)==="-"&&bt(O,B+1)==="-"&&(Bt(O,B+2,"staged")||Bt(O,B+2,"help")))D=!1}return D}function Md(O,D){let B=!1;for(let Q=0;Q<jt(O);Q++){let ee=bt(O,Q),he=D?rl(ee):Qt(ee);if(B&&zt(ee)&&bt(O,Q+1)==="-"&&jn(O,Q+2,"delete"))return!0;if(he){B=!1;continue}if(jn(O,Q,"find"))B=!0,Q+=3}return!1}function Io(O,D,B){let Q=D;while(Q<jt(O)&&!zt(bt(O,Q))&&!B(bt(O,Q)))Q++;return Q}function Dd(O,D,B,Q){if(!Bt(O,D,B))return-1;let ee=D+B.length;for(let he=0;he<Q.length&&bt(O,ee)===Q[he];he++)ee++;return Vn(O,ee)?ee:-1}function Vr(O,D,B,Q){return Dd(O,D,B,Q)>=0}function xn(O,D){To(D,O,2);let B=O.toLowerCase(),Q=B.trimStart(),ee=Q.startsWith("echo ")||Q.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&ee)continue;let at=je.caseSensitive?O:B;if(je.regex)bn(D,at);if((je.regex?.test(at)??!1)||je.scan&&ji(at,je.scan,D))return St("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var gS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ld(O,D,B){let Q=O.words[0];if(!D||!Q||O.words.length!==1||O.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let ee=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!ee)return!1;To(B,D.source,2);let he={anchored:new RegExp(`^\\$\\{?${ee}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ee}(?![A-Za-z0-9_])`)};return Wd(D.nodes,Q,he)}function Wd(O,D,B){return O.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return Wd(Q.body.nodes,D,B);if(Q.kind==="unknown")return!B.loose.test(Q.source);return hS(Q,D,B)})}function hS(O,D,B){if(O.nested.some((ee)=>B.loose.test(ee.source)))return!1;let Q=O.words.findIndex((ee)=>!gS.test(ee.text));return O.words.every((ee,he)=>ee===D||Nd(ee.raw,B.anchored,he!==Q))&&O.redirections.every((ee)=>(!ee.heredoc||ee.heredoc.quotedDelimiter||!B.loose.test(ee.heredoc.body))&&(!ee.target||Nd(ee.target.raw,B.anchored,!0)))}function Nd(O,D,B){let Q=!1,ee=!1;for(let he=0;he<O.length;he++){let je=O[he];if(je==="\\"&&!Q){he++;continue}if(!ee&&je==="'"){Q=!Q;continue}if(!Q&&je==='"'){ee=!ee;continue}if(Q||je!=="$")continue;if(!D.test(O.slice(he)))continue;if(!ee||!B)return!1}return!0}import{isAbsolute as yS,resolve as Gd}from"node:path";function Oo(O,D,B,Q){let ee=yS(O)?Gd(O):D?Gd(D,O):void 0;if(!ee)return;try{return Wt(ee,B,Q)}catch{return ee}}function Fd(O){return!["/dev","/proc","/sys"].some((D)=>O===D||O.startsWith(`${D}/`))}var Kr="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Mo="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",sl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),bS=new Set(["-p","--print"]),SS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),CS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),vS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ES=new Map([["python",new Set(["m"])]]),xS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),RS=new Set(["always","default","never"]),_S=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),wS=/\\\r?\n/g,PS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function zd(O){return qi(O).code}function Ki(O){return qi(O).sources}function Bd(O){return PS.get(ll(O))??[]}function qi(O){let D=ll(O[0]??"");if(!sl.has(D))return{code:null,sources:[],optionsOpen:!1};let B=[],Q=[],ee=!0;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--")return Tn(D,B,Q,ee,O[he+1]===void 0?void 0:he+1,O[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return Tn(D,B,Q,ee,he,je);if(D==="node"&&bS.has(je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(ft.startsWith("-"))continue;B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(TS(D,je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),D==="python")return Tn(D,B,Q,ee);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(IS(D)&&at){let ft=at[1]??"";B.push({tokenIndex:he,value:ft}),Q.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(D==="node"){let ft=AS(je);if(ft){if(ft.attached){if(ee&&=ft.value!=="",ft.value!=="")Q.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let dt=O[he+1];if(dt===void 0||dt.startsWith("-"))return ee=!1,Tn(D,B,Q,ee);Q.push({tokenIndex:he+1,kind:"module-file",value:dt}),he++;continue}}if(D==="python"&&je.startsWith("--check-hash-based-pycs=")||D==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||D==="ruby"&&(je==="--disable="||je==="--enable="))return Tn(D,B,Q,ee);if(xS.get(D)?.has(je)){let ft=O[he+1];if(ft===void 0||ft.startsWith("-")&&!(D==="ruby"&&_S.has(je))||D==="python"&&!RS.has(ft))return Tn(D,B,Q,ee);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let dt=je[ft];if(dt===void 0)break;if(ES.get(D)?.has(dt)){let mt=je.slice(ft+1),pt=mt||O[he+1];if(pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return Tn(D,B,Q,ee)}if(SS.get(D)?.has(dt)){lt=je.slice(ft+1)||O[he+1],ct=ft+1===je.length;break}if(D==="node"&&dt==="r"){if(ee&&=je==="-r",je==="-r"){let mt=O[he+1];if(ee&&=mt!==void 0&&!mt.startsWith("-"),ee&&mt!==void 0)Q.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(D==="ruby"&&dt==="r"){let mt=je.slice(ft+1),pt=mt||O[he+1];if(ee&&=pt!==void 0,pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(D==="perl"&&(dt==="M"||dt==="m")){let mt=je.slice(ft+1);if(!mt){if(ee=!1,ft+1===je.length)he++;break}Q.push({tokenIndex:he,kind:"module-file",value:mt});break}if(CS.get(D)?.has(dt)){if(ft+1===je.length)he++;break}if(vS.get(D)?.has(dt)&&ft+1<je.length)break}if(lt===void 0)continue;let ut=ct?he+1:he;if(B.push({tokenIndex:ut,value:lt}),Q.push({tokenIndex:ut,kind:"inline-code",value:lt}),D==="python")return Tn(D,B,Q,ee);if(ct)he++}return Tn(D,B,Q,ee,void 0,void 0,!0)}function Tn(O,D,B,Q,ee,he,je=!1){let at=O==="node"?D.slice(-1):D,lt=new Set(at.map((ut)=>ut.tokenIndex)),ct=B.filter((ut)=>ut.kind!=="inline-code"||lt.has(ut.tokenIndex));if(Q&&D.length===0&&ee!==void 0&&he!==void 0)ct.push({tokenIndex:ee,kind:"main-script",value:he});return{code:(O==="node"?at[0]?.value:at.map((ut)=>ut.value).join(`
+`))||null,sources:Q?ct:[],optionsOpen:Q&&je}}function AS(O){for(let D of["--import","--loader","--experimental-loader","--require"]){if(O===D)return{attached:!1,value:""};if(O.startsWith(`${D}=`))return{attached:!0,value:O.slice(D.length+1)}}return}function al(O,D){return ll(O)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(D)}function ll(O){let D=At(O).toLowerCase();return Si.test(D)?"python":D}function TS(O,D){return sl.get(O)?.has(D)??!1}function IS(O){return sl.get(O)?.has("--eval")??!1}function Do(O,D,B=!1){let Q=MS(O,D);if(!il(Q,D))return!1;bn(D,Q);let ee=OS(Q);if(il(ee,D))return!0;if(bn(D,ee),!$d.test(ee))return!1;return!B||kS(Q,D)}function kS(O,D){if(/`|%x|\bqx\b/.test(O))return!0;let B=O.split(""),Q=[];for(let je=0;je<O.length;je++){let at=O[je];if(at!=="'"&&at!=='"')continue;let lt=O.startsWith(at.repeat(3),je)?at.repeat(3):at,ct=je+lt.length,ut=ct;while(ut<O.length&&!O.startsWith(lt,ut))ut+=O[ut]==="\\"?2:1;if(ut>=O.length)return!0;Q.push({start:ct,text:O.slice(ct,ut)}),B.fill(" ",je,ut+lt.length),je=ut+lt.length-1}let ee=B.join(""),he=Array.from(ee.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((je)=>$d.test(je[1]??"")).map((je)=>{let at=je.index+je[0].length;return{start:at,end:cl(ee,at)}});if(he.some((je)=>ul(ee,je.start)))return!0;return Q.some((je)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(ee.slice(0,je.start))||he.some((at)=>je.start>=at.start&&je.start<at.end))&&il(je.text,D))}function cl(O,D){let B=1;for(let Q=D;Q<O.length;Q++){if(O[Q]==="(")B++;if(O[Q]===")")B--;if(B===0)return Q}return O.length}function ul(O,D){let B=0;for(let Q=D;Q<O.length;Q++){let ee=O[Q]??"";if("([{".includes(ee))B++;if(")]}".includes(ee)&&B--===0)return!1;if(ee===","&&B===0)return!1;if(/[A-Za-z_$]/.test(ee))return!0}return!1}var $d=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function OS(O){let D=[],B=0,Q=0;while(Q<O.length){let ee=O[Q];if(ee!=="'"&&ee!=='"'){Q++;continue}let he=O.startsWith(ee.repeat(3),Q)?ee.repeat(3):ee,je=Q+he.length;while(je<O.length&&!O.startsWith(he,je))je+=O[je]==="\\"?2:1;if(je>=O.length)break;D.push(O.slice(B,Q)," "),Q=je+he.length,B=Q}return D.push(O.slice(B)),D.join("")}function il(O,D){if(Hi(O,"rm",D))return!0;for(let Q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(bn(D,O),Q.test(O))return!0;if(Hi(O,"dd",D))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(bn(D,O),Q.test(O))return!0;if(Hi(O,"find",D))return!0;let B=O.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>(bn(D,O),B.some((ee)=>ji(ee,Q))))}function MS(O,D){return bn(D,O),O.replace(wS,"")}import{lstatSync as IC,readdirSync as kC}from"node:fs";import{basename as OC,isAbsolute as pf,join as MC,relative as gf}from"node:path";import{isAbsolute as Yd,parse as US}from"node:path";import{dirname as DS,isAbsolute as NS,parse as LS,sep as WS}from"node:path";function rr(O,D,B){if(er(D))throw Error("Unsupported Windows namespace path");let Q=NS(D)?LS(D).root:"",ee=Q||O;for(let he of FS(Q?D.slice(Q.length):D)){if(he===""||he===".")continue;if(he===".."){ee=DS(ee);continue}let je=GS(ee,he),at=B.entryKind(je),lt=at==="symlink"?B.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);ee=lt}return ee}function GS(O,D){return O.endsWith("/")||O.endsWith("\\")?`${O}${D}`:`${O}${WS}${D}`}function FS(O){let D=process.platform==="win32"?/[\\/]+/:/\/+/;return O.split(D)}var dl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],zS=new Set(dl),BS=1024,Ud=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Hd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),$S=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Yi(O){return zS.has(O)}function fl(O){return Yi(O)||Ud.has(O)||Hd.has(O)||go(O)}function Kn(O,D,B){return B?.has(O)?B.get(O):D.get(O)}function jd(O,D){let B=Kn("GIT_CONFIG_COUNT",O,D);if(B===void 0)return{state:"absent"};if(B==="")return{state:"valid",count:0};if(!/^\d+$/.test(B))return{state:"invalid"};let Q=Number(B);return Number.isSafeInteger(Q)&&Q<=BS?{state:"valid",count:Q}:{state:"invalid"}}function Zi(O,D,B){let ee=O.match($S)?.[1];if(!ee||!fl(ee))return null;let he=O.indexOf("=");return{name:ee,value:`${Kn(ee,D,B)??""}${O.slice(he+1)}`}}function Vd(O){return qd(O,Hd)}function Kd(O){return qd(O,Ud)}function qd(O,D){if(!O)return!1;for(let B of O.keys())if(D.has(B))return!0;return!1}var Xd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rn(O){if(!Xd.test(O))return null;let D=O.indexOf("=");return{name:O.slice(0,D),value:O.slice(D+1)}}function ge(O){let D=new Map,B=0;while(B<O.length){let Q=O[B];if(!Q)break;let ee=Rn(t(Q));if(!ee)break;D.set(ee.name,ee.value),B++}return{words:O.slice(B),envAssignments:D}}function Jd(O){let D=It(O);return O.includes("=")||D==="sudo"||D==="env"||D==="command"||D==="builtin"}function Cr(O,D,B,Q){if(!Jd(qr(O)))return{words:O,envAssignments:new Map,cwd:B,rewritten:!1};let ee=new Set(O),he=O,je=new Map,at=new Map(Q??[]),lt=[],ct=B;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let dt=Zd(he),mt=ge(he);for(let[gt,ht]of mt.envAssignments)je.set(gt,ht),at.set(gt,ht);if(he=mt.words,he.length===0)break;while(he.length>0&&qr(he).includes("=")&&!jS(he)){let gt=VS(qr(he),at,D.env)??Zi(qr(he),D.env,at);if(gt)je.set(gt.name,gt.value),at.set(gt.name,gt.value);he=he.slice(1)}if(he.length===0)break;let pt=It(qr(he));if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let gt=qS(he,D.paths,ct);if(he=gt.words,gt.cwd!==void 0)ct=gt.cwd}if(pt==="env"){let gt=XS(he,ct,at,D);if(lt.push(...gt.envSplitValues??[]),he=gt.words,gt.cwd!==void 0)ct=gt.cwd;for(let[ht,yt]of gt.envAssignments)je.set(ht,yt),at.set(ht,yt)}if(pt==="command")he=JS(he);if(pt==="builtin")he=he.slice(In(he,1)==="--"?2:1);if(Zd(he)===dt)break}let ut=ge(he);for(let[ft,dt]of ut.envAssignments)je.set(ft,dt),at.set(ft,dt);return{words:ut.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:HS(ut.words,ee)}}function HS(O,D){return O.some((B)=>!D.has(B))}function Zd(O){return O.map(t).join(" ")}function qr(O){let D=O[0];return D?t(D):""}function In(O,D){let B=O[D];return B?t(B):void 0}function jS(O){return Xd.test(qr(O))}function VS(O,D,B){if(!O.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${D.get("TMPDIR")??B.get("TMPDIR")??""}${O.slice(8)}`}}var KS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function qS(O,D,B){let Q=1,ee=B;while(Q<O.length){let he=In(O,Q);if(!he)break;if(he==="--")return{words:O.slice(Q+1),cwd:ee};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=In(O,Q+1);ee=je?No(ee,je,D):null,Q+=2;continue}if(he.startsWith("--chdir=")){ee=No(ee,he.slice(8),D),Q++;continue}if(he.startsWith("-D")&&he.length>2){ee=No(ee,he.slice(2),D),Q++;continue}if(he==="-i"||he==="--login"){ee=null,Q++;continue}if(KS.has(he)){Q+=2;continue}Q++}return{words:O.slice(Q),cwd:ee}}var YS=new Set(["-i","-0","--null"]),ZS=new Set(["-u","--unset","-C","--chdir","-P"]);function XS(O,D,B,Q){let ee=new Map,he=[],je=D,at=1,lt=(ct)=>({words:O.slice(ct),envAssignments:ee,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<O.length){let ct=In(O,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){ee.clear();for(let ft of B.keys())ee.set(ft,"");ee.set("TMPDIR",""),at++;continue}if(YS.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=In(O,at+1);if(ft!==void 0)ee.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){ee.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){ee.set(ct.slice(8),""),at++;continue}let ut=ct==="-S"||ct==="--split-string"?{value:In(O,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(ut){if(ut.value!==void 0)he.push(ut.value);return je=null,lt(at+ut.consumed)}if(ZS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=In(O,at+1);je=ft?No(je,ft,Q.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=No(je,ft,Q.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!Rn(ct))break;while(at<O.length){let ft=Rn(In(O,at)??"");if(!ft)break;ee.set(ft.name,ft.value),at++}if(In(O,at)==="--")at++;return lt(at)}return lt(at)}function No(O,D,B){if(D==="")return null;if(!O&&!Yd(D))return null;let Q=Yd(D)?US(D).root:B.realpath(O??"/");if(Q===null)return null;try{return rr(Q,D,B)}catch{return null}}function JS(O){if(In(O,1)==="-v")return[...$t(["type"]),...O.slice(2)];let D=1;while(D<O.length){let B=In(O,D);if(!B)break;if(B==="-p"||B==="-v"||B==="-V"){D++;continue}if(B==="--")return O.slice(D+1);if(B.startsWith("-")&&!B.startsWith("--")&&B.length>1){if(!/^[pvV]+$/.test(B.slice(1)))break;D++;continue}break}return O.slice(D)}var QS=/['"\\$`{}#]/;function Xi(O,D){if(O.some((Q)=>QS.test(Q)))return null;let B=[...O.flatMap((Q)=>Q.split(/\s+/).filter((ee)=>ee.length>0)),...D];return B.length<=64?B:null}function or(O,D,B){return Ji(O,D,B).tokens}function eC(O){let D=[],B="",Q=0;while(Q<O.length){let ee=O.charAt(Q);if(ee==='"'||ee==="'"){let he=O.indexOf(ee,Q+1);if(he===-1)return O.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);B+=O.slice(Q+1,he),Q=he+1;continue}if(/\s/.test(ee)){if(B.length>0)D.push(B);B="",Q++;continue}B+=ee,Q++}if(B.length>0)D.push(B);return D}function ir(O,D,B,Q=0){let ee=Ji(O,D,B),he=(ee.envSplitValues??[]).flatMap(eC);if(he.length===0)return ee.tokens;let je=[...he,...ee.tokens];if(Q>=8)return je;return ir(je,D,B,Q+1)}function Ji(O,D,B,Q){if(!Jd(O[0]??""))return{tokens:[...O],envAssignments:new Map,cwd:B};let ee=Cr($t(O),D,B,Q);return{tokens:ee.words.map(t),envAssignments:ee.envAssignments,cwd:ee.cwd,envSplitValues:ee.envSplitValues}}var hl=Symbol("adopt-as-operand"),tC=new Set(["env","sudo","command","builtin"]),nC=new Set(["&&","||","|&","|","&",";"]),rC=new Set(["<<","<<<",">|"]),oC=new Set(["|","|&"]),iC=/[*@#?$!_-]/,sC=/^\w+(?::\w+)*/,aC=Object.freeze([]),Lo=Object.freeze({kind:"scope",edge:"enter"}),Wo=Object.freeze({kind:"scope",edge:"exit"}),lC=Object.freeze([]),cC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Go=new Set(["bash","sh","zsh","dash","ksh"]),uC=256,rf=new WeakMap;function of(O,D){let B=D.status==="complete"?new Set(gl(D)):new Set,Q=mC(O,B);if(vi(Q))return Qi("unclosed-quote",Q,D);let ee={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=vr(D,{source:Q,suppressed:B,flags:ee,depth:0,functions:new Map,powershell:D.dialect==="powershell"});if(ee.limited)return Qi("structural-limit",Q,D);if(ee.invalid)return Qi("invalid",Q,D);let je=Qi("complete",Q,D,ee.assignmentFallbacks);return rf.set(je,Object.freeze(he)),je}function ts(O,D,B,Q,ee){let he=ee.word??((ft)=>ft),je={cwd:D,variables:new Map,previous:null},at=[],lt=new Set,ct=null,ut=[];for(let ft of sf(O)){if(ft.kind==="scope"){if(ft.edge==="enter"){ut.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let dt=ee.segment(at,je,ct,null,lt);if(dt)return dt;let mt=ut.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let dt=ee.segment(at,je,ct,ft.operator,lt);if(dt)return dt;je=dC(at,je,B,Q),ct=at.length>0&&oC.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let dt=ee.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(dt===hl){lt.add(at.length),at.push(he(ft.target));continue}if(dt)return dt;continue}at.push(he(ft.text))}return ee.segment(at,je,ct,null,lt)}function ns(O){return sf(O).flatMap((D)=>{if(D.kind==="word")return[{kind:"word",text:D.text}];if(D.kind==="operator")return[{kind:"operator",boundary:D.boundary}];if(D.kind==="redirection")return[{kind:"redirection",target:D.target}];return[]})}function cn(O,D){return O.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(B,Q,ee,he)=>{let je=D.get(Q);if(je===void 0)return B;let at=ee.startsWith(":")?je!=="":!0;if(ee.endsWith("-"))return at?je:cn(he,D);return at?cn(he,D):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(B,Q)=>D.get(Q)??B).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(B,Q)=>D.get(Q)??B)}function Fo(O){return O.length>0&&O.every((D)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(D))}function dC(O,D,B,Q){let ee=Fo(O)?new Map([...D.variables,...fC(O,D.variables)]):D.variables,he=or([...O],B),je=At(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...D,variables:ee};if(je==="-"){if(D.previous===null)return{...D,variables:ee};return{cwd:D.previous,variables:ee,previous:D.cwd}}return{cwd:tn(cn(je,ee),D.cwd,B,Q),variables:ee,previous:D.cwd}}function fC(O,D){return O.flatMap((B)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(B),ee=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&ee!==void 0?[[Q[1],cn(ee,D)]]:[]})}function sf(O){return rf.get(O)??aC}function mC(O,D){return[...D].reduce((B,Q)=>B.slice(0,Q.start)+" ".repeat(Q.end-Q.start)+B.slice(Q.end),O)}function Qi(O,D,B,Q=lC){return Object.freeze({status:O,source:D,program:B,assignmentFallbacks:Object.freeze(Q)})}function vr(O,D){return O.nodes.flatMap((B,Q)=>pC(B,O,Q,D)).sort((B,Q)=>B.start-Q.start).flatMap((B)=>[...B.events])}function pC(O,D,B,Q){if(O.kind==="connector")return[{start:O.span.start,events:[kn(SC(O.operator))]}];if(O.kind==="unknown")return[{start:O.span.start,events:[kn(O.source)]}];if(O.kind==="function")return Q.functions.set(O.name,O.body),[];if(O.kind==="group"){let he=O.style!=="subshell",je=Q.source[O.span.end-1]===(he?"}":")"),at=he?Q:{...Q,functions:new Map(Q.functions)};return[{start:O.span.start,events:he?[es("{"),...vr(O.body,at),...je?[es("}")]:[]]:[Lo,kn("("),...vr(O.body,at),...je?[kn(")")]:[],Wo]}]}let ee=xC(O,Q.functions);if(ee){if(Q.depth>=nr.maxDepth||++Q.flags.expansions>uC)return Q.flags.limited=!0,[];return[{start:O.span.start,events:[...Qd(O,Q),es(";"),...vr(ee,{...Q,depth:Q.depth+1}),es(";")]},...ef(O,D,B,Q)]}return[{start:O.span.start,events:Qd(O,Q)},...ef(O,D,B,Q)]}function Qd(O,D){return[...O.words.map((B)=>({start:B.span.start,events:lf(B,O,D,!1)})),...O.redirections.map((B)=>({start:B.span.start,events:gC(B,O,D)}))].sort((B,Q)=>B.start-Q.start).flatMap((B)=>B.events)}function gC(O,D,B){let Q=O.operator==="<<-"?"<<":O.operator,ee=O.target?lf(O.target,D,B,!0):[],he=ee[0],je=he?.kind==="word"?he.text:void 0;return[...O.fd===void 0?[]:[yl(String(O.fd))],Object.freeze({kind:"redirection",operator:Q,...O.fd===void 0?{}:{fd:O.fd},role:CC(Q),targetOrder:rC.has(Q)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...O.heredoc&&B.suppressed.has(O.heredoc.bodySpan)?{body:O.heredoc.body,consumer:uf(D)}:{}}),...je===void 0?ee:ee.slice(1)]}function ef(O,D,B,Q){let ee=O.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...ee.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[yl(je.delimiter),.../[\r\n]/.test(Q.source[je.terminatorSpan.end]??"")?[kn(";")]:[]];if(Q.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...af(Q.source.slice(je.bodySpan.start,je.bodySpan.end),Q),...at]}]}),...ee.some((he)=>!he.heredoc&&he.target)?hC(D,B,Q):[]]}function hC(O,D,B){let Q=O.nodes.slice(D+1).find((ee)=>ee.kind==="connector");if(!Q||Q.span.end>=O.span.end)return[];return[{start:Q.span.end,events:af(B.source.slice(Q.span.end,O.span.end),B)}]}function af(O,D){if(D.depth>=nr.maxDepth)return D.flags.limited=!0,[];let B=h(O,"posix");if(B.status==="limited")return D.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:D.flags.expansions,assignmentFallbacks:D.flags.assignmentFallbacks},ee=vr(B,{source:O,suppressed:new Set,flags:Q,depth:D.depth+1,functions:new Map,powershell:!1});return D.flags.limited||=Q.limited,D.flags.expansions=Q.expansions,ee}function lf(O,D,B,Q){let ee=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!Q?kn("glob"):je!==""||O.quoted&&ee.length===0?yl(je):void 0;if(ct)ee.push(ct);je="",at=!1};for(let ct of O.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of ml(ct.raw,he,B.flags,B.powershell)){if(typeof mt==="string"){lt(),ee.push(kn(mt));continue}je+=mt.text,at||=mt.glob}continue}let ut=D.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=B.source.slice(ct.span.start,ct.span.end);je+=ml(mt,{single:!1,double:!0},B.flags,B.powershell).map((gt)=>typeof gt==="string"?gt:gt.text).join("");let pt=ut?vr(ut,B).filter((gt)=>gt.kind==="redirection"&&gt.body!==void 0):[];if(pt.length>0)ee.push(Lo,...pt,Wo);continue}let ft=ut?vr(ut,B):[];if(ct.raw.startsWith("`")){je+="${}",lt(),ee.push(Lo,...ft,Wo);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),ee.push(ct.raw.startsWith("<(")?kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Lo,...ft,...ct.raw.endsWith(")")?[kn(")")]:[],Wo);continue}let dt=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),ee.push(...Array.from({length:dt},()=>kn("(")),...dt===1?[Lo]:[],...ft,...ct.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>kn(")")):[],...dt===1?[Wo]:[])}return lt(),ee}function ml(O,D,B,Q){let ee=[],he="",je=!1,at=0;while(at<O.length){let lt=O[at]??"";if(!D.single&&!D.double&&(lt==="("||lt===")")){ee.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(Q&&lt==="`"&&!D.single){he+=O[at+1]??"",at+=2;continue}if(D.single&&lt==="'"){D.single=!1,at++;continue}if(D.single){he+=lt,at++;continue}if(D.double){if(lt==='"'){D.double=!1,at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=tf(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){D.single=lt==="'",D.double=lt==='"',at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=tf(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...ee,{text:he,glob:je}]}function tf(O,D,B,Q,ee){let he=O[D+1];if(he==="{"){let at=bC(O,D+2);if(at===-1)return Q.invalid=!0,{text:"",next:O.length};let lt=O.slice(D,at+1);return yC(lt,B,Q,ee),{text:lt,next:at+1}}if(he!==void 0&&iC.test(he))return{text:`\${${he}}`,next:D+2};let je=(ee?sC:/^\w*/).exec(O.slice(D+1))?.[0]??"";return{text:`\${${je}}`,next:D+1+je.length}}function yC(O,D,B,Q){let ee=O.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ee)?.[0];if(!he)return;let je=ee.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=ml(je.slice(at.length),{...D},B,Q);B.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function bC(O,D){let B=1,Q=D;while(B>0&&Q<O.length){if(O[Q]==="{"&&O[Q-1]==="$")B++;if(O[Q]==="}")B--;Q++}return B===0?Q-1:-1}function SC(O){return/^[\r\n]+$/.test(O)?";":O}function kn(O){return Object.freeze({kind:"operator",operator:O,boundary:nC.has(O)})}function es(O){return Object.freeze({kind:"operator",operator:O,boundary:!0})}function yl(O){return Object.freeze({kind:"word",text:O})}function CC(O){if(O==="<<"||O==="<<<")return"here-data";if(O==="<"||O==="<&")return"file-read";return"file-write"}function zo(O){return cC.has(O)||/^python\d/.test(O)}var vC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function cf(O,D){let B=D[0];if(B===void 0||!B.startsWith("-"))return D;let Q=vC.get(O)?.has(B)??!1;return cf(O,D.slice(Q?2:1))}function pl(O){let D=O[0];if(D===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D))return pl(O.slice(1));if(!tC.has(D))return[...O];return pl(cf(D,O.slice(1)))}function uf(O){let D=wo(O),B=O.words.findIndex((Q)=>Q.provenance==="literal"&&Q.text===D);return pl(B<0?[]:O.words.slice(B).map((Q)=>Q.text))}function EC(O){let D=uf(O)[0];if(D===void 0)return!1;let B=At(D).toLowerCase();return zo(B)&&!Go.has(B)}function gl(O){return O.nodes.flatMap((D,B)=>{if(D.kind==="group"||D.kind==="function")return gl(D.body);if(D.kind!=="command")return[];let Q=D.nested.flatMap((at)=>gl(at)),ee=D.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(EC(D))return[...Q,...ee];let he=O.nodes[B+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!_C(D))return Q;return[...Q,...ee]})}function xC(O,D){let B=wo(O);return B===void 0?void 0:D.get(B)}function sr(O,D){return O!==void 0&&O.provenance==="literal"&&!O.quoted&&O.raw===O.text&&O.text===D}function RC(O){if(sr(O.words[0],"git"))return sr(O.words[1],"commit");if(!sr(O.words[0],"gh")||!sr(O.words[2],"create"))return!1;return sr(O.words[1],"pr")||sr(O.words[1],"issue")}function _C(O){return(sr(O.words[0],"cat")||sr(O.words[0],"tee")||RC(O))&&!O.words.some(nf)&&!O.redirections.some((B)=>nf(B.target))}function nf(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}var df=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),ff=new Set([...df,"glob"]),wC=new Set([...ff,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Bo(O){let D=PC(),B=ne(O.input),Q=[];if((O.route.kind==="command"||O.route.kind==="unknown")&&B)Q.push({usage:"input-candidate",source:B});if(O.route.kind==="command"&&"command"in O&&O.command)Q.push({usage:"declared-command",source:O.command});let ee=Q.reduce((he,je)=>{let at=he.findIndex((ut)=>ut.source===je.source);if(at!==-1){let ut=he[at];if(!ut)return he;return he[at]={...ut,usages:[...ut.usages,je.usage]},he}let lt=O.route.kind==="command"?O.route.shell:process.platform==="win32"?"powershell":"posix",ct=D.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:D.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:O.toolName,route:O.route,context:O.context},commands:ee,paths:AC(O),store:D}}function un(O,D){return O.commands.find((B)=>B.usages.includes(D))}function qn(O,D){if(!O.includes("$"))return O;return Js(O,D)}function PC(){let O=new Map,D=new Map,B=new WeakMap,Q=(he,je)=>{let at=`${je}\x00${he}`,lt=D.get(at);if(lt)return lt;let ct=h(he,je);return D.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??Q(he,"posix");if(at.status==="limited"){let ut=B.get(at);if(ut)return ut;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return B.set(at,ft),ft}let lt=O.get(he);if(lt)return lt;let ct=of(he,at);return O.set(he,ct),ct},getCommandProgram:Q}}function AC(O){let D=O.route.kind==="grep"?ff:O.route.kind==="glob"?wC:df;return[...Zc(O.input,D),...O.route.kind==="patch"?Qc(O.input):[]]}var TC=new Set(["-S","--suffix"]);function Yr(O,D,B,Q,ee){if(O.status==="structural-limit")throw new y;if(O.status!=="complete")return ee.findMalformedTarget(O.source);return ts(O,D,B,Q,{segment:(he,je)=>ee.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&ee.isRedirectionTarget(cn(he.target,je.variables),je)?he.target:null})}function rs(O){let D=[],B=null,Q=!1;for(let ee=0;ee<O.length;ee++){let he=O[ee];if(he===void 0)break;if(!Q&&he==="--"){Q=!0;continue}if(!Q&&(he==="-t"||he==="--target-directory")){B=O[++ee]??null;continue}if(!Q&&he.startsWith("--target-directory=")){B=he.slice(19);continue}if(!Q&&he.startsWith("-t")&&he.length>2){B=he.slice(2);continue}if(!Q&&TC.has(he)){ee++;continue}if(!Q&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!Q&&he.startsWith("-"))continue;D.push(he)}return B?{sources:D,destination:B}:{sources:D.slice(0,-1),destination:D.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function hf(O,D,B,Q){let ee=O.invocation.context.executionCwd;if(!D)return null;if(O.invocation.route.kind==="patch"||O.invocation.route.kind==="path"||O.invocation.route.kind==="unknown"){if(fi(O.invocation.toolName))return null;let at=O.paths.find((lt)=>mf(lt,ee,D,B,Q,D.entries));return at?{target:at}:null}if(O.invocation.route.kind!=="command")return null;let he=un(O,"input-candidate");if(!he)return null;let je=Yr(he.shell,ee,B,Q,{findSegmentTarget:(at,lt)=>FC(at,lt,D,B,Q),isRedirectionTarget:(at,lt)=>mf(at,lt.cwd,D,B,Q,D.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Er(O,D,B,Q,ee,he,je=!1){if(!B)return!1;let at=is(tn(O,D,ee,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(bl(lt,B))return!0;let ct=je||at.slice(lt.length).includes("/."),ut=(ft)=>ct?os(ft,lt):DC(ft,lt);if(B.markerFiles.some(ut))return!0;return Q&&Sl(B).some(ut)}if(bl(at,B))return!0;return Q&&Sl(B).some((ct)=>os(ct,at))}function DC(O,D){let B=gf(D,O);if(B===""||B.startsWith("..")||pf(B))return!1;return!B.split(/[\\/]/)[0]?.startsWith(".")}function NC(O,D,B,Q,ee){return Er(O,D,B,!0,Q,ee)}function LC(O,D,B,Q,ee){if(!B)return!1;return bl(is(tn(O,D,Q,ee)),B)}function mf(O,D,B,Q,ee,he){let je=is(tn(O,D,Q,ee));return he.includes(je)||bf(je,B)}function yf(O,D,B,Q,ee){if(!B)return!1;return B.hooksDirectories.some((he)=>O.some((je)=>os(he,is(tn(je,D,Q,ee)))))}function bl(O,D){return D.entries.includes(O)||D.directories.includes(O)||bf(O,D)}function bf(O,D){return D.hooksDirectories.some((B)=>os(O,B))}var WC=50000;function Sf(O,D){let B=[...new Set(Sl(O))];if(B.some((ee)=>D(OC(ee))))return!0;let Q=0;while(B.length>0){let ee=B.pop()??"",he=GC(ee);if(!he)return!0;if(Q+=he.length,Q>WC)return!0;if(he.some((je)=>D(je.name)))return!0;B.push(...he.filter((je)=>je.isDirectory()).map((je)=>MC(ee,je.name)))}return!1}function GC(O){try{let D=IC(O,{throwIfNoEntry:!1});if(!D)return[];if(!D.isDirectory())return D.isSymbolicLink()?null:[];return kC(O,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Sl(O){return[...O.entries,...O.directories,...O.hooksDirectories]}function os(O,D){let B=gf(D,O);return B===""||!/^\.\.(?:[\\/]|$)/.test(B)&&!pf(B)}function is(O){return process.platform==="win32"?O.toLowerCase():O}function FC(O,D,B,Q,ee){if(Fo(O))return null;let he=ir([...O],Q);if(At(he[0]??"").toLowerCase()!=="mv")return null;let je=rs(he.slice(1)),at=je.sources.find((lt)=>NC(cn(lt,D.variables),D.cwd,B,Q,ee));if(at)return at;return je.destination&&LC(cn(je.destination,D.variables),D.cwd,B,Q,ee)?je.destination:null}import{isAbsolute as us,normalize as KC,parse as qC,posix as Pf,resolve as Rr,sep as xl}from"node:path";import{isAbsolute as zC,join as Cf,normalize as xf,parse as BC,sep as vf}from"node:path";var $C=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],UC=` 	
+`;function $o(O,D){if(ar(O,D))return!0;if(!O.has("TMPDIR"))return!1;return!Cl(O.get("TMPDIR")??"",D)}function xr(O,D){if(O.has("TMPDIR"))return Cl(O.get("TMPDIR")??"",D);let B=vl(O,D);if(B===void 0)return!0;return Cl(B,D)}function vl(O,D){return _f(O,D,"TMPDIR")}function Cl(O,D){if(!O)return!1;if(jC(O))return!1;return Zr(O,D)}function ar(O,D){let B=_f(O,D,"IFS");return B!==void 0&&B!==""&&B!==UC}function Zr(O,D){let B=ss(O,D.paths);if(B===null)return!1;return Rf(D).some((Q)=>cs(B,Q))}function ls(O,D){let B=ss(O,D.paths);if(B===null)return!1;return Rf(D).some((Q)=>as(Q)===as(B))}var Ef=new WeakMap;function Rf(O){let D=Ef.get(O);if(D)return D;let B=HC(O);return Ef.set(O,B),B}function HC(O){let D=$C.map((Q)=>ss(Q,O.paths)??xf(Q)),B=ss(O.tmpdir,O.paths);if(!B)return D;if(process.platform==="win32")return[...D,B];if(process.platform==="darwin"&&VC(B))return[...D,B];return D}function jC(O){return/[\s$`*?[]/.test(O)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(O)||/[+@!]\([^)]*\)/.test(O)}function _f(O,D,B){return O.has(B)?O.get(B):D.env.get(B)}function VC(O){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(O)}function ss(O,D){try{let B=xf(O);if(!zC(B))return B;let Q=BC(B).root,ee=B.slice(Q.length).split(/[\\/]+/).filter(Boolean),he=Q;for(let je=0;je<ee.length;je++){let at=Cf(he,ee[je]??"");if(D.entryKind(at)==="missing")return Cf(at,...ee.slice(je+1));let lt=D.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function cs(O,D){let B=as(O),Q=as(D);if(B===Q)return!0;let ee=Q.endsWith(vf)?Q:`${Q}${vf}`;return B.startsWith(ee)}function as(O){return process.platform==="win32"?O.toLowerCase():O}var YC=process.platform==="win32",wf=64,ZC=16384;function Uo(O,D,B,Q){if(O.kind==="temp_target")return null;let ee=Q[O.kind];if(O.kind==="dynamic_target"&&!Jt(B,ee.id,D.strict))return null;if(O.kind==="within_anchored_cwd"&&!Jt(B,ee.id,D.paranoid))return null;return St(ee.id,ee.reason)}function Ho(O){let D=hd(O,wf,wf,ZC);return{expandedTargets:D&&"words"in D?D.words:void 0,unsafeBraceExpansion:D!==void 0&&"limited"in D,targetIsLiteral:D===void 0&&O.provenance==="literal"&&(O.quoted||O.raw!==O.text),tmpdirWordSplittingProtected:XC(O)}}function XC(O){let D=O.parts.filter((B)=>B.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(B.raw));return D.length>0&&D.every((B)=>JC(O.raw,B.span.start-O.span.start))}function JC(O,D){let B=null,Q=!1;for(let ee=0;ee<D;ee++){let he=O[ee];if(Q){Q=!1;continue}if(he==="\\"&&B!=="'"){Q=!0;continue}if(B===he){B=null;continue}if(B===null&&(he==="'"||he==='"'))B=he}return B==='"'}function _r(O){let D=O.environment.home,B=O.environment.paths,Q=O.budget??mn();return{anchoredCwd:O.originalCwd??O.cwd??null,resolvedCwd:O.cwd??null,strict:O.strict??!1,paranoid:O.paranoid??!1,trustTmpdirVar:O.allowTmpdirVar??!0,posixShell:O.posixShell??!1,tmpdirWordSplittingUnsafe:O.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:O.trustedTmpdirValue??O.allowTmpdirVar??!0,environment:O.environment,allowRoots:ov(O.allowPaths,D,B,Q),protectedGitMetadata:O.protectedGitMetadata,budget:Q}}function On(O,D,B={}){let Q=B.targetIsLiteral??!1;if(!Q&&D.tmpdirWordSplittingUnsafe&&!B.tmpdirWordSplittingProtected&&sv(O))return{kind:"outside_anchored_cwd"};let ee=!Q&&Tf(O,D.posixShell);if(er(O))return{kind:"outside_anchored_cwd"};if(Rl(O,Q))return{kind:"root_or_home_target"};if(ev(O,D,Q))return{kind:"root_or_home_target"};if(D.resolvedCwd&&Er(O,D.resolvedCwd,D.protectedGitMetadata,!0,D.environment,D.budget,!D.posixShell))return{kind:"git_metadata_target"};if(tv(O,D.trustTmpdirVar,D.posixShell,ee,Q,B.tmpdirWordSplittingProtected??!1,D.trustedTmpdirValue,D.environment))return{kind:"temp_target"};if(ee)return{kind:"dynamic_target"};if(iv(O,D,Q))return{kind:"temp_target"};let he=D.anchoredCwd;if(he){if(!B.skipHomeCwd&&uv(he,D.environment.home,D.environment.paths,D.budget))return{kind:"home_cwd_target"};if(!B.skipCwdSelf&&[D.resolvedCwd??he,he].some((je)=>dv(O,D.resolvedCwd??he,D.environment.paths,D.budget,je)))return{kind:"cwd_self_target"};if(fv(O,he,D.resolvedCwd??he,ee,Q,D.environment.paths,D.budget))return{kind:"within_anchored_cwd"}}if(QC(O,D,ee))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function QC(O,D,B){let Q=O.trim();if(B||!D.resolvedCwd||!D.anchoredCwd||!Q)return!1;if(us(Q)||Q.startsWith("~"))return!1;if(_l(Q))return!1;if(If(D.resolvedCwd,D.anchoredCwd,D.environment.paths,D.budget))return!1;return Zr(Rr(D.resolvedCwd,Q),D.environment)}function Af(O,D,B={}){let{containmentTarget:Q,...ee}=B;if(On(O,D,ee).kind!=="temp_target")return!1;let he=O.trim();if(rv(he))return!1;if(ls(he,D.environment))return!1;return![D.anchoredCwd,D.resolvedCwd].some((je)=>If(Q??he,je,D.environment.paths,D.budget))}function Rl(O,D=!1){let B=O.trim(),Q=Pf.normalize(B),ee=B.replace(/\\/g,"/"),he=Q==="/"?Q:Q.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ee)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ee))return!0;if(!D&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!D&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!D&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function ev(O,D,B){let Q=O.trim(),ee=B?Q:Q==="*"?".":Q.endsWith("/*")?Q.slice(0,-2):Q;if(!ee)return!1;try{let he=us(ee)?ee:D.resolvedCwd?Rr(D.resolvedCwd,ee):null;if(!he)return!1;let je=dn(Wt(he,D.environment.paths,D.budget));if(je===qC(je).root)return!0;return je===dn(Wt(D.environment.home,D.environment.paths,D.budget))}catch{return!1}}function dn(O){let D=KC(O);if(YC){if(D=D.replace(/\//g,"\\").toLowerCase(),D.length>3&&D.endsWith("\\"))D=D.slice(0,-1);return D}if(D.length>1&&D.endsWith("/"))D=D.slice(0,-1);return D}function tv(O,D,B,Q,ee,he,je,at){let lt=O.trim();if(_l(lt))return!1;if(!Q&&Zr(lt,at))return!0;return(D||he&&je)&&B&&!ee&&nv(lt,B)}function nv(O,D){return["$TMPDIR","${TMPDIR}"].some((B)=>{if(O===B)return!0;if(!O.startsWith(`${B}/`))return!1;return!Tf(O.slice(B.length+1),D)})}function rv(O){let D=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(O);if(!D)return!1;return Pf.normalize(`/${D[1]??""}`)==="/"}function _l(O){return O.split(/[\\/]+/).includes("..")}function ov(O,D,B,Q){if(!O?.length)return[];return O.flatMap((ee)=>{let he=xo(ee.trim(),D);if(!us(he))return[];try{let je=Wt(he,B,Q);if(Ro(je,Wt(D,B,Q)))return[];return[dn(je)]}catch{return[]}})}function iv(O,D,B){if(D.allowRoots.length===0)return!1;let Q=O.trim();if(_l(Q))return!1;let ee=B?Q:xo(Q,D.environment.home),he=D.resolvedCwd??D.anchoredCwd,je=us(ee)?ee:he?Rr(he,ee):null;if(!je)return!1;try{let at=dn(Wt(je,D.environment.paths,D.budget));return D.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(xl)?lt:`${lt}${xl}`))}catch{return!1}}function sv(O){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(O)}function Tf(O,D=!1){return O.includes("$")||O.includes("`")||av(O)||D&&lv(O)}function av(O){let D=!1;for(let B of O){if(D){D=!1;continue}if(B==="\\"){D=!0;continue}if(B==="*"||B==="?"||B==="[")return!0}return!1}function lv(O){let D=!1;for(let B=0;B<O.length;B++){let Q=O[B];if(D){D=!1;continue}if(Q==="\\"){D=!0;continue}if(Q==="{"&&cv(O,B)||(Q==="+"||Q==="@"||Q==="!")&&O[B+1]==="(")return!0}return!1}function cv(O,D){let B=O.indexOf("}",D+1);if(B===-1)return!1;let Q=O.slice(D+1,B);return Q.includes(",")||Q.includes("..")}function uv(O,D,B,Q){try{return dn(Wt(O,B,Q))===dn(Wt(D,B,Q))}catch{try{return dn(O)===dn(D)}catch{return!1}}}function dv(O,D,B,Q,ee=D){if(ee===D&&(O==="."||O==="./"||O===".\\"))return!0;try{return dn(Wt(Rr(D,O),B,Q))===dn(Wt(ee,B,Q))}catch{try{return dn(Rr(D,O))===dn(ee)}catch{return!1}}}function fv(O,D,B,Q,ee,he,je){let at=B??D;if(!ee&&(O.startsWith("~")||O.startsWith("$HOME")||O.startsWith("${HOME}")))return!1;if(Q)return!1;if(O.startsWith("/")||/^[A-Za-z]:[\\/]/.test(O))try{return El(O,D,he,je)}catch{return!1}if(O.startsWith("./")||O.startsWith(".\\")||!O.includes("/")&&!O.includes("\\"))try{return El(Rr(at,O),D,he,je)}catch{return!1}if(O.startsWith("../"))return!1;try{return El(Rr(at,O),D,he,je)}catch{return!1}}function El(O,D,B,Q){try{return kf(Wt(O,B,Q),Wt(D,B,Q))}catch{return!1}}function If(O,D,B,Q){if(!D)return!1;try{return kf(Wt(D,B,Q),Wt(O,B,Q))}catch{return!0}}function kf(O,D){let B=dn(O),Q=dn(D);return B.startsWith(`${Q}${xl}`)||B===Q}var mv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Of="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",pv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Mf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Df="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",gv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",hv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",yv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Df},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Mf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:gv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Of},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:pv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Of}};function Nf(O,D,B,Q=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths})){return bv(O.words.map((ee)=>({kind:"word",text:ee.text,dynamic:ee.provenance!=="literal"})),D,Q,B.policy)}function bv(O,D,B,Q){let ee=O.filter((lt)=>lt.kind==="word"),he=Cv(ee),je=ee[he];if(!je||!mv.has(Tv(je.text)))return null;let at=Sv(ee.slice(he+1));if(at.whatIfProtected)return null;if(Jt(Q,"powershell.remove-item-pipeline-dynamic-target",B.strict)&&D&&(at.targets.length===0||at.recursive))return St("powershell.remove-item-pipeline-dynamic-target",hv);for(let lt of at.targets)if(!er(lt.text)&&Rl(Pl(lt.text)))return St(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Df);for(let lt of at.targets)if(B.resolvedCwd&&Er(Pl(lt.text),B.resolvedCwd,B.protectedGitMetadata,at.recursive,B.environment,B.budget,!0))return St("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(Q,"powershell.remove-item-recursive-force-dynamic-target",B.strict)&&(at.hasDynamicTarget||at.targets.length===0))return St("powershell.remove-item-recursive-force-dynamic-target",Mf);for(let lt of at.targets){let ct=Uo(On(Pl(lt.text),B),B,Q,yv);if(ct)return ct}return null}function Sv(O){let D=[],B=!1,Q=!1,ee=!1,he=!1,je=!1;for(let at=0;at<O.length;at++){let lt=O[at];if(!lt||lt.kind!=="word")continue;if(vv(lt))continue;if(je){D.push(wl(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=xv(lt.text);if(!ct){D.push(wl(lt)),he=he||lt.dynamic;continue}if(Rv(ct.name)){let ut=ct.value?Ev(ct.value,lt):O[++at];if(ut?.kind==="word"){D.push(wl(ut)),he=he||ut.dynamic;continue}he=!0;continue}if(_v(ct.name)){B=!0;continue}if(wv(ct.name)){Q=!0;continue}if(Pv(ct.name))ee=Av(ct.value)}return{targets:D,recursive:B,force:Q,whatIfProtected:ee,hasDynamicTarget:he}}function Cv(O){let D=O[0];if(D?.kind==="word"&&D.text==="&"||D?.text===".")return O.length>1?1:0;return 0}function wl(O){return{text:O.kind==="word"?O.text:"",dynamic:O.kind==="word"&&O.dynamic}}function vv(O){return O.kind==="word"&&O.text===","}function Pl(O){let D=O.replace(/\\/g,"/"),B=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(D);return B?`$HOME${D.slice(B[0].length)}`:D}function Ev(O,D){return{kind:"word",text:O,dynamic:D.kind==="word"&&(D.dynamic||O.includes("$"))}}function xv(O){if(!O.startsWith("-")||O==="-")return null;let D=O.slice(1),B=D.indexOf(":");if(B===-1)return{name:D.toLowerCase()};return{name:D.slice(0,B).toLowerCase(),value:D.slice(B+1)}}function Rv(O){return"path".startsWith(O)||"literalpath".startsWith(O)}function _v(O){return"recurse".startsWith(O)}function wv(O){return O.length>=2&&"force".startsWith(O)}function Pv(O){return O==="wi"||"whatif".startsWith(O)}function Av(O){if(O===void 0||O==="")return!0;let D=O.toLowerCase();return D==="$true"||D==="true"}function Tv(O){return O.toLowerCase()}var Xr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ds="Unsupported heredoc syntax",jo="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Lf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Iv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),kv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Ov=new Set(["-o","--output","--query","--subscription"]),Mv=new Set;function Wf(O){if(O==="aws")return Iv;if(O==="gcloud")return kv;if(O==="az")return Ov;return Mv}var Dv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Nv=new Set;function Gf(O){if(O==="git")return gn;if(O==="docker")return Dv;return Nv}function _(O,D){if(O.length===0||D.length===0)return null;let B=It(O[0]??""),Q=an(O);for(let ee of D){if(!Gv(B,ee.command))continue;if(ee.match){if(Lv(B,O,ee.match))return Ff(ee);continue}if(!Fv(B,O,ee.subcommand))continue;if(Bv(O,new Set(ee.block_args),Q))return Ff(ee)}return null}function Ff(O){return{id:`custom.${O.name}`,reason:`[${O.name}] ${O.reason}`,intent:O.intent??"manual_only"}}function Lv(O,D,B){let Q=D.slice(1);if(B.exclude_args?.some((ee)=>Q.includes(ee)))return!1;if(B.any_args&&!B.any_args.some((ee)=>Q.includes(ee)))return!1;return Wv(Q,B.command_path,Wf(O))}function Wv(O,D,B){let Q=0,ee=!1;for(let he of O){if(Q>=D.length)return!0;if(ee){ee=!1;continue}if(he.startsWith("-")){ee=!he.includes("=")&&B.has(he);continue}if(he!==D[Q])return!1;Q++}return Q>=D.length}function Gv(O,D){return O===It(D)}function Fv(O,D,B){if(!B)return!0;return zf(D,1,B,Gf(O))}function zf(O,D,B,Q){let ee=!1;for(let he=D;he<O.length;he++){let je=O[he];if(!je)continue;if(ee){ee=!1;continue}if(je==="--"){let at=O[he+1];if(at&&!at.startsWith("-"))return at===B;return!1}if(Q.has(je)){ee=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&zv(O,he,B,Q))return!0;continue}return je===B}return!1}function zv(O,D,B,Q){let ee=O[D+1];if(!ee||ee.startsWith("-"))return!1;return zf(O,D+2,B,Q)}function Bv(O,D,B){return O.some((Q)=>D.has(Q))||[...B].some((Q)=>D.has(Q))}var $v=new Set(["-e","--source"]),Uv=new Set(["-F","-v","--assign","--field-separator"]),Bf=new Set(["-f","--file"]),Hv=new Set(["print","printf","return"]),$f=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],jv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Uf(O,D,B){let Q=!1;for(let ee of Vv(O)){let he=Kv(ee,B);if(!he)continue;for(let je of he.commands){let at=D(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))Q=!0}Q||=he.dynamic}return Q?St("awk.system-dynamic",jv):null}function Tl(O){let D=[],B=!1,Q=!1,ee=!0,he=!0;for(let je=1;je<O.length;je++){let at=O[je];if(at===void 0)break;if(ee&&at==="--"){ee=!1;continue}if(ee&&$v.has(at)){B=!0;let lt=O[je+1];if(he&&=lt!==void 0,lt!==void 0)D.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(ee&&at.startsWith("--source=")){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(ee&&at.startsWith("-e")&&at.length>2){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(ee&&(Uv.has(at)||Bf.has(at))){let lt=O[je+1];if(he&&=lt!==void 0,Bf.has(at)){if(Q=!0,lt!==void 0)D.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(ee&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(ee&&at.startsWith("-f")&&at.length>2){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(ee&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(ee&&at.startsWith("--file=")){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(ee&&at.startsWith("-")&&at!=="-")continue;if(!B&&!Q)D.push({tokenIndex:je,kind:"main-program",value:at});return{sources:D,optionsOpen:!1}}return{sources:he?D:[],optionsOpen:ee&&he}}function Ko(O){return Tl(O).sources}function Vv(O){return Ko(O).filter((D)=>D.kind!=="program-file").map((D)=>D.value)}function Kv(O,D){bn(D,O);let B=O.includes("system")?Il(O,D):null,Q=qv(O,D);if(!B&&!Q)return null;return{dynamic:!!B?.dynamic||!!Q?.dynamic,commands:[...B?.commands??[],...Q?.commands??[]]}}function Il(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0;while(he<O.length){let je=O[he];if(je==='"'||je==="'"){he=ms(O,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Hf(O,he+1);continue}if(je==="/"&&jf(O,he)){he=Vf(O,he+1)??he+1;continue}if(!O.startsWith("system",he)){he++;continue}let at=he;if(he+=6,Vo(O[at-1])||Vo(O[he]))continue;let lt=fs(O,he);if(O[lt]!=="(")continue;lt=fs(O,lt+1);let ct=O[lt];if(ct!=='"'&&ct!=="'"){Q=!0,ee=!0;continue}let ut=ms(O,lt,ct);if(!ut){Q=!0,ee=!0;continue}if(lt=fs(O,ut.endIndex),Q=!0,O[lt]!==")"){ee=!0,he=ut.endIndex;continue}B.push(ut.value),he=lt+1}if(!Q)return null;return{dynamic:ee,commands:B}}function qv(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<O.length){let ut=O[he];if(!ut)break;if(ut==='"'||ut==="'"){let mt=ms(O,he,ut);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(ut==="#"){he=Hf(O,he+1),je=he,at=null,lt=null,ct=he;continue}if(ut==="/"&&jf(O,he)){let mt=Vf(O,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
+{}`.includes(ut)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(Al(O,he,"print")||Al(O,he,"printf")))at=he;if(ut!=="|"||O[he-1]==="|"||O[he+1]==="|"){if(!/\s/.test(ut))ct=he+1;he++;continue}let ft=O[he+1]==="&"?he+2:he+1,dt=fs(O,ft);if(Al(O,dt,"getline")){ee=!0;let mt=Xv(je,lt,ct);if(Q||=mt===null,mt!==null)B.push(mt);ct=ft,he=ft;continue}if(Qv(je,at)){ee=!0;let mt=Zv(O,dt);if(!mt){Q=!0,ct=ft,he=ft;continue}if(!Yv(O,mt.endIndex)){Q=!0,ct=mt.endIndex,he=mt.endIndex;continue}B.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!ee)return null;return{dynamic:Q,commands:B}}function Vo(O){return!!O&&/[A-Za-z0-9_]/.test(O)}function fs(O,D){let B=D;while(/\s/.test(O[B]??""))B++;return B}function Yv(O,D){let B=D;while(/[\t\f\v\r ]/.test(O[B]??""))B++;let Q=O[B];return!Q||`;
+}#`.includes(Q)}function ms(O,D,B){let Q="",ee=!1;for(let he=D+1;he<O.length;he++){let je=O[he];if(!je)break;if(ee){let at=Jv(O,he);if(!at)return null;Q+=at.value,he=at.endIndex,ee=!1;continue}if(je==="\\"){ee=!0;continue}if(je===B)return{value:Q,endIndex:he+1};Q+=je}return null}function Zv(O,D){let B=O[D];if(B!=='"'&&B!=="'")return null;return ms(O,D,B)}function Xv(O,D,B){if(!D)return null;return D.startIndex>=O&&D.endIndex===B?D.value:null}function Jv(O,D){let B=O[D];if(!B)return null;if(B==="x"){let ee=O.slice(D+1,D+3);if(!/^[0-9A-Fa-f]{2}$/.test(ee))return null;return{value:String.fromCharCode(Number.parseInt(ee,16)),endIndex:D+2}}if(/[0-7]/.test(B)){let ee=/^[0-7]{1,3}/.exec(O.slice(D));if(!ee)return null;return{value:String.fromCharCode(Number.parseInt(ee[0],8)),endIndex:D+ee[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[B]??B,endIndex:D}}function Al(O,D,B){return O.startsWith(B,D)&&!Vo(O[D-1])&&!Vo(O[D+B.length])}function Qv(O,D){return D!==null&&D>=O}function Hf(O,D){let B=O.indexOf(`
+`,D);return B===-1?O.length:B+1}function jf(O,D){let B=eE(O,D);if(B===-1)return!0;if("{([,;!~=".includes(O[B]??""))return!0;let Q=B;while(Vo(O[Q-1]))Q--;return Hv.has(O.slice(Q,B+1))}function eE(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return B;return-1}function Vf(O,D){let B=!1;for(let Q=D;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="/")return Q+1}return null}var tE=new Set(["sudo","env","command","builtin"]);function ps(O,D){let B=O[0];if(!B||!D.transparentWrappers.includes(At(B)))return null;let Q=At(B),ee=O[1]==="--"?2:1,he=nE(O,ee,Q,D),je=he[0];if(je===void 0)return null;return{wrapper:Q,tokens:O.slice(je),childIndex:je,alternativeChildIndices:he.slice(1)}}function nE(O,D,B,Q){let ee=O[1]==="--",he=[];for(let je=D;je<O.length;je++){let at=O[je];if(!at)continue;let lt=At(at)!==B&&rE(at,Q);if(lt)he.push(je);if(!lt&&Ci.has(It(at)))break;if(ee)break}return he}function rE(O,D){let B=At(O),Q=It(O);return Q==="git"||B==="busybox"||wr(O)||ba.has(B)||D.transparentWrappers.includes(B)||Ht.has(Q)||O==="$SHELL"||An(Q)||En.has(Q)||D.rules.some((ee)=>ee.command===B)}function wr(O){return tE.has(O.toLowerCase())}function Pr(O,D){return{embedded:!1,cwd:O.cwd,originalCwd:D.originalCwd,effectiveCwd:O.cwd,envAssignments:O.envAssignments,allowTmpdirVar:D.allowTmpdirVar,worktreeMode:D.worktreeMode,wrappedByTransparent:!1}}function Mn(O,D){let B=D.policy??{rules:[],transparentWrappers:[]};return gs([...O],D.environment,D.cwd,D.cwd,new Map,new Map(D.envAssignments??[]),B,{iterations:0},!1)}function*gs(O,D,B,Q,ee,he,je,at,lt){let ct=Ji(O,D,B,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),ee.set(mt,pt);let{tokens:ut,cwd:ft}=ct;if(ct.envSplitValues){let mt=Xi(ct.envSplitValues,ut);if(!mt)throw new s("derivedCommandShape");kl(at),yield*gs(mt,D,ft,Q,ee,he,je,at,lt);return}if(wr(ut[0]??""))throw new s("wrapperPeelIterations");let dt=ps(ut,je);if(dt){for(let mt of[dt.childIndex,...dt.alternativeChildIndices])kl(at),yield*gs(mt===dt.childIndex?dt.tokens:ut.slice(mt),D,ft,Q,new Map(ee),new Map(he),je,at,!0);return}if(iE(ut)){kl(at),yield*gs(ut.slice(1),D,ft,Q,ee,he,je,at,lt);return}yield oE(ut,ft,Q,ee,he,lt)}function oE(O,D,B,Q,ee,he){return{tokens:O,cwd:D===null?void 0:D??B,wrapperCwd:D,wrapperEnvAssignments:Q,envAssignments:ee,head:At(O[0]??"").toLowerCase(),wrappedByTransparent:he}}function kl(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function iE(O){return At(O[0]??"").toLowerCase()==="busybox"&&O.length>1}function Ol(O,D){let B=[],Q=D;while(Q<O.length){let ee=O[Q];if(ee===void 0||ee===":::")break;B.push(ee),Q++}return{markerIndex:Q<O.length&&O[Q]===":::"?Q:-1,templateTokens:B}}function Dn(O){let D=!1,B=!1;for(let Q of O){if(Q==="--")break;if(Q==="-r"||Q==="-R"||Ml(Q,"recursive")){D=!0;continue}if(Q==="-f"||Ml(Q,"force")){B=!0;continue}if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))D=!0;if(Q.includes("f"))B=!0}}return D&&B}function hs(O){let D=O.indexOf("--");return O.slice(1,D===-1?void 0:D).some((B)=>Ml(B,"recursive")||/^-[A-Za-z]+$/.test(B)&&/[rR]/.test(B.slice(1)))}function Ml(O,D){return O.length>2&&O.startsWith("--")&&D.startsWith(O.slice(2))}var sE=["--init-file","--rcfile"],aE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Nn(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B)continue;if(B==="-c")return Kf(O,D,!0);if(B.startsWith("-")&&B.includes("c")&&!B.startsWith("--")){let Q=Kf(O,D,!1);if(Q!==null)return Q}}return null}function Yn(O){let D=At(O[0]??"").toLowerCase();if(D==="zsh"||D==="ksh")return hn(O).syntaxCheck;let B=!1;for(let Q of O.slice(1)){if(Q==="--")return B;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))B=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return B;let ee=Q.slice(1);if(ee.includes("n"))B=!0;if(ee.includes("c"))return B}return B}function Kf(O,D,B){if(O[D+1]==="--")return O[D+2]||null;let Q=O[D+1];if(!Q||!B&&Q.startsWith("-"))return null;return Q}function qf(O){let D=At(O[0]??"").toLowerCase(),B=lE(O,D),Q=aE.get(D)??null,ee=B.argvSource?.kind!=="absent";return{argvSource:D==="bash"?B.argvSource:null,argvSourceApplies:D==="bash"&&B.interactive&&B.argvSource?.kind==="literal",envName:Q,envSourceApplies:ee&&(Q==="BASH_ENV"?!B.interactive:Q==="ENV"&&B.interactive)}}function lE(O,D){let B=hn(O),Q=B.commandIndex??B.scriptIndex??O.length,ee=[],he=!1,je=!0;for(let at=1;at<Q;at++){let lt=O[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(D==="bash"&&je?sE.find((dt)=>lt===dt):void 0){let dt=O[at+1];ee.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(D==="bash"&&ha.has(ft)&&!lt.includes("="))at++;continue}if(D==="bash")je=!1;let ct=ya(D,lt,O[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:ee.at(-1)??null,interactive:he}}var cE="find -delete permanently removes files. Use -print first to preview.",uE="find -exec rm -rf is dangerous. Use explicit file list instead.",dE=new Set(["-exec","-execdir","-ok","-okdir"]),fE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((O)=>[O,1]),["-fprintf",2]]);function Yf(O,D){let B=O.map(t),Q=mE(O,B,D);if(Q)return Q;if(ys(B,1)&&!SE(O,B,D)){let je=wt(St("find.delete",cE),D.policy);if(je)return je}let ee=D.budget??mn(),he=0;while(he<B.length){let je=B[he],at=Zn(je??"");if(at>0){he+=at+1;continue}if(!zn(je)){he++;continue}ee.charge("derivedTokens",B.length-he-1);let lt=Jr(B,he);he=lt.nextIndex;let ct=vE(lt.tokens,D.environment);if(ct){let mt=wt(ct,D.policy);if(mt)return mt}let ut=je==="-execdir"||je==="-okdir",ft=D.analyzeTokens?D.analyzeTokens(lt.tokens,ut?null:D.cwd):D.analyzeNested?D.analyzeNested(lt.tokens.join(" "),{effectiveCwd:ut?void 0:D.cwd,envAssignments:D.envAssignments}):null,dt=ft?.id.startsWith("custom.")?ft:wt(ft,D.policy);if(dt)return dt}return null}function mE(O,D,B){if(!ys(D,1)&&!Dl(D,B.environment))return null;let ee=qo(O)??$t(["."]),he=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of ee){let at=Ho(je);for(let lt of at.expandedTargets??[t(je)]){let ct=On(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target"&&!pE(O,he.protectedGitMetadata,B.environment))return St("find.delete-git-metadata",x)}}if(bE(D)&&he.resolvedCwd&&yf(ee.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return St("find.delete-git-metadata",x);return null}function pE(O,D,B){if(!D)return!1;let Q=O.map(t),ee=[],he=!1,je=qo(O)?.at(-1),at=je?O.indexOf(je)+1:1;while(at<Q.length){let lt=Q[at]??"";if(zn(lt)){let ct=Jr(Q,at),ut=ir([...ct.tokens],B);if(hs(ut))return!1;if(Ht.has(At(ut[0]??"").toLowerCase()))return!1;if(ct.tokens.some((dt)=>dt!=="{}"&&dt.includes("{}")))return!1;if((lt==="-execdir"||lt==="-okdir")&&ut.slice(1).some((dt)=>dt!=="{}"&&!dt.startsWith("-")))return!1;he=!0,at=ct.nextIndex;continue}if(lt==="-delete"){he=!0,at++;continue}if(lt==="-name"||lt==="-iname"){let ct=O[at+1];if(ct?.provenance!=="literal"||/[[\\]/.test(ct.text))return!1;if(!he)ee.push(hE(ct.text,lt==="-iname"));at+=2;continue}if(!gE.has(lt))return!1;at+=1+Zn(lt)}return ee.length>0&&!Sf(D,(lt)=>ee.every((ct)=>ct.test(lt)))}var gE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function hE(O,D){let B=O.replace(/[*?]|[.+^${}()|\]/]/g,(Q)=>Q==="*"?".*":Q==="?"?".":`\\${Q}`);return new RegExp(`^${B}$`,D?"isu":"su")}var yE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Dl(O,D){let B=0;while(B<O.length){if(!zn(O[B])){B++;continue}let Q=Jr(O,B),ee=ir([...Q.tokens],D),he=At(ee[0]??"").toLowerCase();if((he==="rm"||he==="rmdir"||Ht.has(he)&&yE.test((Nn(ee)??"").replace(/["'\\]/g,"")))&&ee.some((at)=>at.includes("{}")))return!0;B=Q.nextIndex}return!1}function bE(O){return O.some((D,B)=>{if(!["-name","-iname"].includes(D))return!1;return O[B+1]?.toLowerCase()==="hooks"})}function SE(O,D,B){if(D.includes("-L")||D.includes("-f")||D.includes("-follow"))return!1;let Q=qo(O);if(!Q)return!1;let ee=B.envAssignments??new Map,he=vl(ee,B.environment),je=B.trustedTmpdirValue??xr(ee,B.environment),at=B.allowTmpdirVar??!$o(ee,B.environment),lt=_r({environment:B.environment,protectedGitMetadata:B.protectedGitMetadata,cwd:B.cwd,originalCwd:B.originalCwd,strict:B.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:B.tmpdirWordSplittingUnsafe??ar(ee,B.environment),trustedTmpdirValue:je,budget:B.budget});return Q.every((ct)=>{let ut=Ho(ct);if(ut.unsafeBraceExpansion)return!1;return(ut.expandedTargets??[t(ct)]).every((ft)=>Af(ft,lt,{containmentTarget:CE(ft,he),targetIsLiteral:ut.expandedTargets!==void 0||ut.targetIsLiteral,tmpdirWordSplittingProtected:ut.tmpdirWordSplittingProtected}))})}function CE(O,D){if(!D)return O;return O.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>D)}function qo(O){let D=(ee)=>{let he=O[ee];return he?t(he):void 0},B=1;while(D(B)==="-H"||D(B)==="-P")B++;if(D(B)==="--")B++;let Q=[];while(B<O.length){let ee=D(B),he=O[B];if(!ee||!he||ee.startsWith("-")||["!","(",")"].includes(ee))break;Q.push(he),B++}return Q.length>0?Q:null}function vE(O,D){let B=or([...O],D);if(B.length===0)return null;let Q=At(B[0]??"");if(Q==="busybox"&&B.length>1)B=B.slice(1),Q=At(B[0]??"");if(Q==="rm"&&Dn(B))return St("find.exec-rm-recursive-force",uE);return null}function Jr(O,D){let B=D+1;while(B<O.length&&O[B]!==";"&&!(O[B]==="+"&&O[B-1]==="{}"))B++;return{tokens:O.slice(D+1,B),nextIndex:Math.min(B+1,O.length)}}function ys(O,D){let B=D;while(B<O.length){let Q=O[B];if(!Q){B++;continue}if(zn(Q)){B=Jr(O,B).nextIndex;continue}let ee=Zn(Q);if(ee>0){B+=ee+1;continue}if(Q==="-delete")return!0;B++}return!1}function Zn(O){return fE.get(O)??(/^-newer[A-Za-z]{2}$/.test(O)?1:0)}function zn(O){return O!==void 0&&dE.has(O)}import{resolve as Yx}from"node:path";function*Nl(O){for(let D of O.nodes)yield*xE(D)}function EE(O){return Object.freeze([...Nl(O)])}function st(O){return Object.freeze(EE(O).map((D)=>Object.freeze(D.words.map((B)=>B.text))))}function Yo(O){let D=h(O,"posix");if(D.status!=="complete"||D.nodes.length!==1)return null;let B=D.nodes[0];if(B?.kind!=="command")return null;if(B.redirections.length>0||B.nested.length>0)return null;if(B.words.some((Q)=>Q.provenance==="command-substitution"))return null;return B.words.map((Q)=>Q.text)}function*xE(O){if(O.kind==="command"){yield O;for(let D of O.nested)yield*Nl(D);return}if(O.kind==="group")yield*Nl(O.body)}var RE=5,Ll="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(O){let D=O.indexOf("--");if(D===-1)return{index:-1,before:O,after:[]};return{index:D,before:O.slice(0,D),after:O.slice(D+1)}}function Xf(O,D,B){let Q=bs(O,D,B),ee=_E(Q.entries);if(ee.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:O};let he=O,je=!1;for(let at=0;at<RE;at++){let{subcommand:lt,rest:ct}=Sn(he),ut=lt?.toLowerCase();if(!ut||!ee.has(ut))return{blockedReason:Q.blockedReason,expanded:je,tokens:he};let ft=ee.get(ut),dt=IE(ft);if(dt===null||dt.length===0)return{blockedReason:Ll,expanded:!0,tokens:he};he=["git",...dt,...ct],je=!0}return{blockedReason:Ll,expanded:!0,tokens:he}}function Jf(O,D,B){return bs(O,D,B).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function Sn(O){if(O.length===0)return{subcommand:null,rest:[]};let D=O[0];if((D?At(D).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--"){let he=O[Q+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:O.slice(Q+2)};return{subcommand:null,rest:O.slice(Q+1)}}if(!ee.startsWith("-"))return{subcommand:ee,rest:O.slice(Q+1)};Q+=gn.has(ee)?2:1}return{subcommand:null,rest:[]}}function _E(O){let D=new Map;for(let B of O){let Q=B.key.toLowerCase();if(!Q.startsWith("alias."))continue;let ee=Q.slice(6);if(ee!=="")D.set(ee,B.value)}return D}function bs(O,D,B){if(O.length===0)return{blockedReason:null,entries:[]};let Q=O[0];if((Q?At(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=PE(D,B);return{blockedReason:he.blockedReason,entries:[...he.entries,...wE(O,D,B)]}}function wE(O,D,B){let Q=[],ee=1;while(ee<O.length){let he=O[ee];if(!he||he==="--"||!he.startsWith("-"))return Q;if(he==="-c"){let je=Wl(O[ee+1]);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=Wl(he.slice(2));if(je)Q.push(je);ee++;continue}if(he==="--config-env"){let je=Zf(O[ee+1],D,B);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("--config-env=")){let je=Zf(he.slice(13),D,B);if(je)Q.push(je);ee++;continue}if(gn.has(he)){ee+=2;continue}ee++}return Q}function PE(O,D){let B=AE(O,D),Q=TE(O,D);return{blockedReason:B===null||Q===null?Ll:null,entries:[...B??[],...Q??[]]}}function AE(O,D){let B=Kn("GIT_CONFIG_PARAMETERS",O,D);if(B===void 0)return[];let Q=[],ee=Yo(B);if(!ee)return null;for(let he of ee){let je=Wl(he);if(!je)return null;Q.push(je)}return Q}function TE(O,D){let B=jd(O,D);if(B.state==="absent")return[];if(B.state==="invalid")return null;let Q=[];for(let ee=0;ee<B.count;ee++){let he=Kn(`GIT_CONFIG_KEY_${ee}`,O,D)?.trim(),je=Kn(`GIT_CONFIG_VALUE_${ee}`,O,D);if(!he||je===void 0)return null;Q.push({key:he,value:je})}return Q}function Wl(O){if(!O)return null;let D=O.indexOf("=");return{key:(D===-1?O:O.slice(0,D)).trim(),value:D===-1?void 0:O.slice(D+1)}}function Zf(O,D,B){let Q=O?.indexOf("=")??-1;if(!O||Q===-1)return null;return{key:O.slice(0,Q).trim(),value:Kn(O.slice(Q+1),D,B)}}function IE(O){let D=O?.trimStart();if(!D||D.startsWith("!"))return null;return Yo(D)}var kE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",OE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",ME="git checkout --force discards uncommitted changes. Use 'git stash' first.",DE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",NE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",LE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",WE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",GE="git switch --force discards uncommitted changes. Use 'git stash' first.",FE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",zE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",BE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",$E="git reset --merge can lose uncommitted changes. Use 'git stash' first.",UE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",HE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",jE="git push --force destroys remote history. Use --force-with-lease for safer force push.",VE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",KE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",qE="git branch -D force-deletes without merge check. Use -d for safe delete.",YE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",ZE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",XE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",JE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",QE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",ex="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",tx="git worktree remove --force can delete uncommitted changes. Remove --force flag.",nx=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),rx=new Set(["--recurse-submodules","--track","-t"]),Gl=new Set(["-b","-B","-U"]),Fl=new Set(["-c","-C"]),ox=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function kt(O,D){let B=O.split("=",1)[0]??O;return B.length>=4&&D.startsWith(B)&&B.startsWith("--")&&B.slice(2).length>=2}var Qr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function em(O,D){let{subcommand:B,rest:Q}=Sn(O);if(!B)return null;switch(B.toLowerCase()){case"checkout":return lr(ix(Q,D));case"switch":return lr(ax(Q));case"restore":return lr(cx(Q));case"reset":return dx(Q);case"clean":return lr(mx(Q));case"rm":return lr(px(Q));case"push":return Ar(gx(Q));case"branch":return Ar(bx(Q));case"stash":return Ar(xx(Q));case"worktree":return Ar(Rx(Q));case"rebase":return lr(Sx(Q));case"merge":return lr(Cx(Q));case"tag":return Ar(vx(Q));case"reflog":return Ar(Ex(Q));default:return null}}function lr(O){return O?{...O,localDiscard:!0}:null}function Ar(O){return O?{...O,localDiscard:!1}:null}function ix(O,D){let{index:B,before:Q}=en(O),ee=an(Q,{shortOptsWithValue:Gl});if(Q.some((at)=>kt(at,"--force"))||ee.has("-f"))return St("git.checkout-force",ME);for(let at of O){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(kt(at,"--pathspec-from-file"))return St("git.checkout-pathspec-from-file",NE)}if(B!==-1){if(Q.some((lt)=>!lt.startsWith("-")))return St("git.checkout-ref-path",DE);return St("git.checkout-double-dash",kE)}let he=lx(O);if(he.length>=2)return St("git.checkout-ambiguous",LE);let je=he[0];if(je===void 0||ee.has("-d")||ee.has("-t")||O.some((at)=>kt(at,"--detach")||kt(at,"--track")))return null;if(sx(je)||D(je))return St("git.checkout-double-dash",OE);return null}function sx(O){return O==="."||O===".."||/^\.\.?[/\\]/.test(O)||/^([/\\]|[A-Za-z]:[/\\])/.test(O)||O.endsWith("/")||O.startsWith(":")||/[*?[]/.test(O)}function ax(O){let{before:D}=en(O);if(D.some((Q)=>kt(Q,"--discard-changes")))return St("git.switch-discard-changes",WE);let B=an(D,{shortOptsWithValue:Fl});if(D.some((Q)=>kt(Q,"--force"))||B.has("-f"))return St("git.switch-force",GE);return null}function lx(O){let D=[],B=0;while(B<O.length){let Q=O[B];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-")){D.push(Q),B++;continue}if(nx.has(Q)){B+=2;continue}if(rx.has(Q)){let ee=O[B+1],he=Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];B+=ee&&!ee.startsWith("-")&&he.includes(ee)?2:1;continue}B++}return D}function cx(O){let D=ux(O);if(D.isTerminal||!D.hasPathspec&&!D.hasPatch||!D.hasWorktree)return null;return D.hasExplicitLocation?St("git.restore-worktree",zE):St("git.restore-unstaged",FE)}function ux(O){let D=!1,B=!1,Q=!0,ee=!1,he=(je)=>{if(!ee)Q=!1,ee=!0;if(je!==void 0)Q=je};for(let je=0;je<O.length;je++){let at=O[je];if(at===void 0)break;if(at==="--"){D||=je+1<O.length;break}if(at==="--pathspec-from-file"){D=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){D=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){B=!0;continue}if(at==="--no-patch"){B=!1;continue}if(ox.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){D=!0;continue}if(!at.startsWith("-")){D=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){B=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!1}}function dx(O){let D=null;for(let B of O){if(kt(B,"--hard")){D=St("git.reset-hard",BE);break}if(kt(B,"--merge")){D=St("git.reset-merge",$E);break}}if(!D)return null;return fx(O)?Ar(D):lr(D)}function fx(O){for(let D of O){if(D==="--")return!1;if(!D.startsWith("-"))return!0}return!1}function mx(O){for(let B of O)if(B==="-n"||kt(B,"--dry-run"))return null;let D=an(O.filter((B)=>B!=="--"));if(O.some((B)=>kt(B,"--force"))||D.has("-f"))return St("git.clean-force",UE);return null}function px(O){let D=!1,B=!1,Q=!1;for(let ee of en(O).before){if(kt(ee,"--no-force")){D=!1;continue}if(kt(ee,"--force")){D=!0;continue}if(kt(ee,"--no-cached")){B=!1;continue}if(kt(ee,"--cached")){B=!0;continue}if(kt(ee,"--no-dry-run")){Q=!1;continue}if(kt(ee,"--dry-run")){Q=!0;continue}let he=an([ee]);D||=he.has("-f"),Q||=he.has("-n")}return D&&!B&&!Q?St("git.rm-force",HE):null}function gx(O){let{before:D,after:B}=en(O),Q=an(D);if(D.some((je)=>kt(je,"--mirror")))return St("git.push-mirror",KE);if(D.some((je)=>kt(je,"--force"))||Q.has("-f")||Qf(D,B).some(hx))return St("git.push-force",jE);if(D.some((je)=>kt(je,"--delete"))||Q.has("-d")||Qf(D,B).some(yx))return St("git.push-delete",VE);return null}function Qf(O,D){return[...O.filter((B)=>B!==""&&!B.startsWith("-")),...D]}function hx(O){return O.startsWith("+")||O.includes(":+")}function yx(O){return O.length>1&&O.startsWith(":")}function bx(O){let{before:D}=en(O),B=an(D),Q=B.has("-D")||B.has("-d")||D.some((he)=>kt(he,"--delete")),ee=B.has("-D")||B.has("-f")||D.some((he)=>kt(he,"--force"));if(Q&&ee)return St("git.branch-force-delete",qE);return null}function Sx(O){let{before:D}=en(O);return D.some((B)=>kt(B,"--abort"))?St("git.rebase-abort",YE):null}function Cx(O){let{before:D}=en(O);return D.some((B)=>kt(B,"--abort"))?St("git.merge-abort",ZE):null}function vx(O){let{before:D}=en(O);return an(D).has("-d")||D.some((Q)=>kt(Q,"--delete"))?St("git.tag-delete",XE):null}function Ex(O){return O[0]==="delete"?St("git.reflog-delete",JE):null}function xx(O){for(let D of O){if(D==="drop")return St("git.stash-drop",QE);if(D==="clear")return St("git.stash-clear",ex)}return null}function Rx(O){let{before:D}=en(O);if(!D.includes("remove"))return null;let Q=an(D);if(D.some((ee)=>kt(ee,"--force"))||Q.has("-f"))return St("git.worktree-remove-force",tx);return null}import{dirname as Hx,isAbsolute as jx,join as gm,resolve as Vx}from"node:path";var Bl="TMPDIR",$l="IFS",nm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rm=/^[A-Za-z_][A-Za-z0-9_]*$/,om=new Set(["export","typeset","declare","readonly"]),_x=new Set(["builtin","command","time"]),im=new Set(["do","then","else"]),wx=new Set(["do","then","case"]),tm=new Set(["done","fi","esac"]),Px=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function sm(O,D){return O.map((B)=>B.provenance==="variable"&&fm(B.text)?Zo(B.text,D.shellAssignments):t(B))}function Zo(O,D){return O.replace(Px,(B,Q,ee)=>D.get(Q??ee??"")??B)}function am(O,D){return{env:O,effectiveEnvAssignments:kx(O,D),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function lm(O){return{env:O.env,effectiveEnvAssignments:O.effectiveEnvAssignments?new Map(O.effectiveEnvAssignments):void 0,shellAssignments:new Map(O.shellAssignments),bodyDepth:O.bodyDepth,bodyAssignments:new Set(O.bodyAssignments)}}function Ul(O,D){let B=um(O,D),Q=O[0]??"";if(wx.has(Q))D.bodyDepth+=1;if(Q==="elif"||tm.has(Q))D.bodyDepth=Math.max(0,D.bodyDepth-1);if(tm.has(Q)&&D.bodyDepth===0)D.bodyAssignments.forEach((at)=>{D.shellAssignments.delete(at)}),D.bodyAssignments.clear();B.assignments.filter((at)=>at.persists).forEach((at)=>{if(D.shellAssignments.set(at.name,at.value),D.bodyDepth>0)D.bodyAssignments.add(at.name);Hl(D,at)});let ee=B.commandIndex;if(ee!==-1&&om.has(O[ee]??""))O.filter((at)=>rm.test(at)&&zl(at)).forEach((at)=>{Ox(D,at)});let he=ee===-1?-1:dm(O,ee);if(he===-1||O[he]!=="unset")return;let je=Dx(O,he);if(je===null)return;O.slice(je).forEach((at)=>{if(im.has(Q)){D.shellAssignments.set(at,"");return}Mx(D,at)})}function cm(O,D){let B=um(O,D).assignments;if(B.length===0)return D.effectiveEnvAssignments;let Q=new Map(D.effectiveEnvAssignments??[]);return B.forEach((ee)=>{Q.set(ee.name,ee.value)}),Q}function um(O,D){let B=im.has(O[0]??"")?1:0,Q=O.findIndex((at,lt)=>lt>=B&&!fm(at)),ee=Q!==-1&&om.has(O[dm(O,Q)]??""),he=Ix(D);return{assignments:O.flatMap((at,lt)=>{let ct=Ax(at,he,D.env);if(!ct)return[];if(Q!==-1&&lt>Q&&!ee&&!Yi(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:Q===-1||ee}]}),commandIndex:Q}}function dm(O,D){let B=D;while(_x.has(O[B]??"")){B+=1;while(O[B]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(O[B]??""))return D;B+=1}}return B}function fm(O){return Rn(O)!==null||nm.test(O)}function Ax(O,D,B){return Rn(O)??Tx(O,D,B)}function Tx(O,D,B){let Q=Zi(O,B,D);if(Q)return Q;let ee=O.match(nm)?.[1];if(!ee)return null;let he=O.indexOf("=");return{name:ee,value:`${D.has(ee)?D.get(ee):B.get(ee)??""}${O.slice(he+1)}`}}function zl(O){return O===Bl||O===$l||fl(O)}function Ix(O){return new Map([...O.effectiveEnvAssignments??[],...O.shellAssignments])}function kx(O,D){let B=[Bl,$l].map((Q)=>{let ee=O.get(Q);return ee===void 0?null:[Q,ee]}).filter((Q)=>Q!==null);if(B.length===0)return D;return new Map([...B,...D??[]])}function Hl(O,D){let B=new Map(O.effectiveEnvAssignments??[]);B.set(D.name,D.value),O.effectiveEnvAssignments=B}function Ox(O,D){Hl(O,{name:D,value:O.shellAssignments.get(D)??O.effectiveEnvAssignments?.get(D)??O.env.get(D)??""})}function Mx(O,D){if(!zl(D)&&!rm.test(D))return;if(O.shellAssignments.set(D,""),Yi(D)&&O.env.has(D)){let Q=new Map(O.env);Q.delete(D),O.env=Q}if(!zl(D)||D===Bl||D===$l||go(D)){Hl(O,{name:D,value:""});return}if(!O.effectiveEnvAssignments?.has(D))return;let B=new Map(O.effectiveEnvAssignments);B.delete(D),O.effectiveEnvAssignments=B.size===0?void 0:B}function Dx(O,D){let B=D+1;while(B<O.length){let Q=O[B];if(!Q)return null;if(Q==="--")return B+1;if(Q==="-v"){B++;continue}if(Q.startsWith("-"))return null;return B}return B}import{resolve as Nx}from"node:path";function Ss(O,D){return dl.some((B)=>D?.has(B)||O.has(B))}function eo(O,D,B){if(!D)return{gitCwd:null,hasExplicitGitContext:!1};let Q=B.realpath(Nx(D));if(Q===null||!B.isDirectory(Q))return{gitCwd:null,hasExplicitGitContext:!1};let ee=Q,he=!1,je=1;while(je<O.length){let at=O[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=O[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=mm(ee,lt,B);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};ee=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=mm(ee,at.slice(2),B);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};ee=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=gn.has(at)?2:1}return{gitCwd:ee,hasExplicitGitContext:he}}function mm(O,D,B){try{let Q=rr(O,D,B);return B.isDirectory(Q)?Q:null}catch{return null}}function pm(O,D,B){if(!D.localDiscard||!B.worktreeMode||Ss(B.environment.env,B.envAssignments))return null;let Q=eo(O,B.cwd,B.environment.paths);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;let ee=B.environment.worktreeFacts(Q.gitCwd);if(!ee)return null;if(jl(O,B,ee))return null;return{kind:"worktree",originalReason:D.reason,gitCwd:Q.gitCwd}}function jl(O,D,B){let{subcommand:Q,rest:ee}=Sn(O),he=Q?.toLowerCase();if(D.dynamicArguments||Lx(ee)||Bx(O,D.environment.env,D.envAssignments,B)||Fx(ee)||Wx(he,ee))return!0;return he==="clean"&&zx(ee)>1}function Lx(O){return O.some((D)=>/[$*?[]/.test(D))}function Wx(O,D){if(O==="checkout"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Gl}),ee=B.some((je)=>kt(je,"--force"))||Q.has("-f"),he=Q.has("-B")||B.some((je)=>je==="-B"||je.startsWith("-B"));return ee&&he}if(O==="switch"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Fl}),ee=B.some((je)=>kt(je,"--force"))||B.some((je)=>kt(je,"--discard-changes"))||Q.has("-f"),he=B.some((je)=>je==="-C"||je.startsWith("-C")||Gx(je))||Q.has("-C");return ee&&he}return!1}function Gx(O){let D=O.split("=",1)[0]??O;return D==="--force-create"||D.length>=9&&"--force-create".startsWith(D)}function Fx(O){return O.some((D)=>D.startsWith("--recurse-sub"))}function zx(O){let D=0;for(let B of O){if(B==="--force"){D++;continue}if(B.startsWith("-")&&!B.startsWith("--")){for(let Q of B.slice(1))if(Q==="f")D++}}return D}function Bx(O,D,B,Q){if(Kn("GIT_CONFIG_PARAMETERS",D,B)!==void 0)return!0;let ee=bs(O,D,B);if(ee.blockedReason!==null)return!0;let he=ee.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>Ux(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||$x(je.value);if(Kd(B))return!0;return Q.recursiveSubmodules}function $x(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Ux(O){return O==="include.path"||O.startsWith("includeif.")&&O.endsWith(".path")}function hm(O,D,B){let Q=O.map(t),ee=B.environment.paths,he=eo(Q,B.cwd,ee),je=B.originalCwd?ee.realpath(Vx(B.originalCwd)):null;if(D.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||Ss(B.environment.env,B.envAssignments))return null;let at=D.id==="git.worktree-remove-force"?qx(O,B.shellAssignments,ee):ym(he.gitCwd,ee);if(at===null||D.id!=="git.worktree-remove-force"&&!Kx(at,Q,D,B)||!Zr(at,B.environment)||ls(at,B.environment)||cs(je,at)||cs(at,je))return null;return{kind:"temp-root",originalReason:D.reason,gitCwd:he.gitCwd}}function Kx(O,D,B,Q){let ee=Q.environment.paths,he=gm(O,".git");if(ee.entryKind(he)!=="present")return!1;if(ee.isDirectory(he))return!0;let je=B.localDiscard?Q.environment.worktreeFacts(O):null;return je!==null&&!jl(D,Q,je)}function qx(O,D,B){let Q=Sn(O.map(t)).rest,{before:ee,after:he}=en(Q.slice(Q.indexOf("remove")+1)),je=[...ee.filter((ut)=>!ut.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=O.find((ut)=>ut.text===at),ct=lt?.provenance==="variable"&&lt.parts.every((ut)=>ut.provenance!=="literal"||!/[$`]/.test(ut.raw))?Zo(at,D??new Map):at;if(!jx(ct)||/[\s$`*?[]/.test(ct)||B.entryKind(ct)!=="present"||!B.isDirectory(ct))return null;return B.realpath(ct)}function ym(O,D){if(D.entryKind(gm(O,".git"))!=="missing")return O;let B=Hx(O);return B===O?null:ym(B,D)}var Zx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Xx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Cs(O,D){return bm(O,D)}function bm(O,D,B){let Q=O.map(t),ee=Xf(Q,D.environment.env,D.envAssignments),he=ee.blockedReason?wt(St("git.alias-config",ee.blockedReason),D.policy):null;if(he)return he;let je=ee.tokens;if((Vd(D.envAssignments)||Jf(Q,D.environment.env,D.envAssignments))&&Jx(je))return St("git.ssh-env",Zx);let at=em(je,(ct)=>{let ut=eo(Q,D.cwd,D.environment.paths).gitCwd;return ut!==null&&D.environment.paths.entryKind(Yx(ut,ct))!=="missing"});if(!at)return null;if(ee.expanded||ee.blockedReason)return at;let lt=pm(Q,at,D)??hm(O,at,D);if(!lt)return at;return B?.(lt),null}function Sm(O,D){let B=null;return{match:bm(O,D,(ee)=>{B=ee}),relaxation:B}}function Jx(O){let{subcommand:D,rest:B}=Sn(O),Q=D?.toLowerCase();if(!Q)return!1;if(Xx.has(Q))return!0;if(Q==="archive")return en(B).before.some((ee)=>kt(ee,"--remote"));return Q==="remote"&&Qx(B)}function Qx(O){return O.find((D)=>!eR(D))?.toLowerCase()==="update"}function eR(O){return O==="-v"||kt(O,"--verbose")||kt(O,"--no-verbose")}import{isAbsolute as TR}from"node:path";function Cm(O,D,B,Q){let ee=O.slice(0,D),he=O.slice(D+B);return Q.startsWith(ee)&&Q.endsWith(he)?Q.slice(ee.length,Q.length-he.length):null}function vs(O,D,B){let Q=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,ee=new Set(O.map(Q));return Array.from(D).some((he)=>B(he).some((je)=>!ee.has(Q(je))))}var vm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",tR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",xm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",rR="rm -rf in home directory is dangerous. Change to a project directory first.",Em={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:xm},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:nR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:rR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:vm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:tR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:vm}};function Es(O,D){let B=_r({...D,allowPaths:D.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=O.map(t),ee=Dn(Q),he=hs(Q),je=iR(O);for(let at of je){let lt=Ho(at.word);if(ee&&lt.unsafeBraceExpansion){let ct=wt(Uo({kind:"outside_anchored_cwd"},B,D.policy,Em),D.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let ut=pn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&B.resolvedCwd&&Er(ut,B.resolvedCwd,B.protectedGitMetadata,he,B.environment,B.budget))return St("rm.git-metadata",x);if(he&&!ee){let dt=On(ut,B,ft);if(dt.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home",xm);if(dt.kind==="git_metadata_target")return St("rm.git-metadata",x);continue}if(!ee)continue;for(let dt of oR(ut,B,ft)){let mt=Uo(dt,B,D.policy,Em),pt=wt(mt,D.policy);if(pt)return pt}}}return null}function oR(O,D,B){let Q=On(O,D,B);if(Q.kind==="cwd_self_target")return[Q,On(O,D,{...B,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let ee=On(O,D,{...B,skipHomeCwd:!0});if(ee.kind!=="cwd_self_target")return[Q,ee];return[Q,ee,On(O,D,{...B,skipHomeCwd:!0,skipCwdSelf:!0})]}function iR(O){let D=[],B=!1;for(let Q of O.slice(1)){let ee=t(Q);if(!ee)continue;if(ee==="--"){B=!0;continue}if(B){D.push({text:ee,word:Q});continue}if(!ee.startsWith("-"))D.push({text:ee,word:Q})}return D}var cr={kind:"none"},Tr={kind:"dynamic"},sR=new Set(["<","<<","<<-","<<<","<&","<>"]),_m=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,aR=/^(?:[0-9]+|[@*])$/,lR=nr.maxWords,wm=nr.maxInputLength;function Pm(O){if(!O||At(It(O.words[0]?.text??""))!=="printf")return;if(O.words.some((ee)=>ee.provenance!=="literal"))return;let D=O.words.slice(O.words[1]?.text==="--"?2:1),B=D[0]?.text;if(B===void 0)return"";let Q=D.slice(1).map((ee)=>ee.text);if(B==="%s")return Q.join("");if(B==="%s\\n"||B===`%s
+`)return`${Q.join(`
+`)}
+`;if(B.includes("%")||/\\(?![\\nrt])/.test(B))return;return B.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function xs(O){let D=to(O[1])==="--"?2:1;if(O.length<=D)return cr;let B=O.slice(D);if(!B.every(Jo))return Tr;return{kind:"literal",source:B.map(t).join(" ")}}function Am(O){let D=to(O[1])==="--"?2:1,B=O[D],Q=to(B);if(B===void 0||O.length<=D+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return cr;if(!Jo(B))return Tr;return{kind:"literal",source:Q}}function Rs(O,D){let B=km(O);if(B===-1)return cr;let Q=uR(D);if(!Q)return cr;let ee=[],he=Q.command?.length??0;for(let je of Q.references){let at=fR(je,O,B,Q.ifs);if(!at)return Tr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),ee.length+at.length>lR||he>wm)return Tr;ee.push(...at)}if(Q.command==="eval")return{kind:"literal",source:ee.join(" ")};if(ee.length===0||/\s/.test(ee[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...ee.map(Om)].filter((je)=>je!==null).join(" ")}}function Tm(O,D){let B=km(O),Q=O.slice(B+1);if(B===-1||!Q.every(Jo)||/\bIFS\b/.test(D))return D;let ee=Q.map(to),he="",je=null,at=0;while(at<D.length){let lt=D[at]??"",ct=je==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(D.slice(at));if(ct){let ut=ct[1]??ct[2],ft=ut==="@"||ut==="*"?ee.slice(1):[ee[Number(ut)]??""];if(je!=='"'&&ft.some((dt)=>/[*?[]/.test(dt)))return D;if(he+=je==='"'?ft.map((dt)=>dt.replace(/["$`\\]/g,"\\$&")).join(ut==="@"?'" "':" "):ft.map((dt)=>dt.split(/[ \t\n]+/).map((mt)=>mt?Om(mt):"").join(" ")).join(" "),he.length>wm)return D;at+=ct[0].length;continue}if(lt==="\\"&&je!=="'"){he+=D.slice(at,at+2),at+=2;continue}if(lt==="'"&&je!=='"'||lt==='"'&&je!=="'")je=je?null:lt;he+=lt,at++}return he}function Im(O,D,B,Q){if(!hn(O.map(t)).readsStdinAsCommands)return cr;let ee=D.filter((he)=>(he.fd===void 0||he.fd===0)&&sR.has(he.operator)).at(-1);if(ee){if(ee.operator==="<<"||ee.operator==="<<-")return cr;if(ee.operator!=="<<<"||ee.target?.provenance!=="literal")return Tr;return{kind:"literal",source:ee.target.text}}if(!B)return cr;return Q===void 0?Tr:{kind:"literal",source:Q}}function Xn(O){let D=hn(O.map(t)).scriptIndex;if(D===null)return cr;let B=O[D],Q=to(B);return Ui(B,Q)?{kind:"literal",source:Q}:Tr}var cR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Yl(O){if(O.words.length!==2||O.redirections.length!==0||O.nested.length!==1)return!1;let D=O.words[0],B=O.words[1];if(!D||D.provenance!=="literal"||D.quoted||D.raw!==D.text||!B)return!1;if(!(D.text==="eval"&&B.quoted&&B.parts.length===3&&B.parts[0]?.raw==='"'&&B.parts[1]?.provenance==="command-substitution"&&B.parts[1].raw.startsWith("$(")&&B.parts[2]?.raw==='"'||D.text==="eval"&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("$(")||(D.text==="source"||D.text===".")&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("<(")))return!1;let ee=O.nested[0];if(ee?.status!=="complete"||ee.nodes.length!==1)return!1;let he=ee.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||Rn(je)!==null)return!1;let at=At(It(je));return!cR.has(at)&&!Ht.has(at)&&!wr(at)}function km(O){return hn(O.map(t)).commandIndex??-1}function uR(O){let D=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(O.trim()),B=D?.[4]??O.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(B),ee=(Q?.[3]??B).split(/\s+/).map(dR);if(ee.length===0||ee.some((he)=>he===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:ee.filter((he)=>!!he),ifs:D?D[1]??D[2]??D[3]??"":` 	
+`}}function dR(O){let D=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(O),B=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(O),Q=D??B;if(!Q)return null;let ee=Q[1]??Q[2];return{parameter:ee==="@"||ee==="*"?ee:Number(ee),quoted:D!==null}}function fR(O,D,B,Q){let ee=D.slice(B+2);if(O.parameter==="@")return O.quoted?Vl(ee):mR(ee,Q);if(O.parameter==="*"){let at=Vl(ee);if(!at)return;let lt=at.join(Q[0]??"");return O.quoted?[lt]:Kl(lt,Q)}let he=D[B+1+O.parameter];if(he&&!Jo(he))return;let je=to(he);return O.quoted?[je]:Kl(je,Q)}function Vl(O){return O.every(Jo)?O.map(t):void 0}function mR(O,D){let B=Vl(O);if(!B)return;let Q=B.map((ee)=>Kl(ee,D));return Q.some((ee)=>ee===void 0)?void 0:Q.flatMap((ee)=>ee??[])}function Kl(O,D){if(["*","?","[","]"].some((B)=>O.includes(B)))return;if(D==="")return O===""?[]:[O];if(D===` 	
+`)return O.trim().split(/\s+/).filter(Boolean);if(D.length!==1)return;return D===" "||D==="\t"||D===`
+`?O.trim().split(/\s+/).filter(Boolean):O.split(D).filter(Boolean)}function Jo(O){if(!O)return!0;return O.provenance==="unknown"?!/[$`]/.test(t(O)):O.provenance==="literal"}function to(O){return O?t(O):""}function Om(O){return`'${O.replaceAll("'",`'"'"'`)}'`}function Zl(O,D){return ql(h(O,"posix"),D)}function Qo(O){return Zl(O,new Set(Array.from(O.matchAll(_m)).flatMap((D)=>{let B=D[1]??D[2];return B===void 0?[]:[B]})))}function ql(O,D){if(O.status==="invalid"||O.status==="limited")return!1;let B=new Set(D);for(let Q of O.nodes){if(Q.kind==="group"){if(ql(Q.body,B))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((ee)=>ql(ee,B))||Mm(Q.words,B))return!0;bR(Q,B)}return!1}function Mm(O,D){let B=O.findIndex((je)=>Rn(je.text)===null);if(B===-1)return!1;let Q=O[B];if(!Q)return!1;if(Xo(Q,D))return!0;let ee=It(Q.text);if(ee==="source"||ee==="."){let je=O[B+1]?.text==="--"?B+2:B+1;return Rm(O[je],D)}if(Ht.has(ee)){let je=O.slice(B),at=hn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&Rm(je[lt],D)}let he=pR(O,B,D);if(he===null)return!1;if(he===-1)return!0;return Mm(O.slice(he),D)}function pR(O,D,B){let Q=It(O[D]?.text??"");if(Q==="command")return gR(O,D+1);if(Q==="exec")return hR(O,D+1);if(Q==="env")return yR(O,D+1,B);return null}function gR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return B}return null}function hR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(Q==="-a"){B++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return B}return null}function yR(O,D,B){for(let Q=D;Q<O.length;Q++){let ee=O[Q],he=ee?.text??"";if(he==="--")return O[Q+1]?Q+1:null;if(he==="-S"||he==="--split-string")return Xo(O[Q+1],B)?-1:Q+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return Xo(ee,B)?-1:Q+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){Q++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(Rn(he))continue;return Q}return null}function bR(O,D){if(!O.words.every((B)=>Rn(B.text)!==null))return;for(let B of O.words){let Q=Rn(B.text);if(!Q)continue;if(Xo(B,D))D.add(Q.name)}}function Xo(O,D){if(!O)return!1;return O.parts.filter((B)=>B.provenance==="variable").some((B)=>Array.from(B.raw.matchAll(_m)).some((Q)=>{let ee=Q[1]??Q[2];return ee!==void 0&&(aR.test(ee)||D.has(ee))}))}function Rm(O,D){return!!O&&(O.parts.some((B)=>B.provenance!=="literal"&&B.provenance!=="variable")||Xo(O,D))}var Xl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Jl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",SR="__CC_SAFETY_NET_XARGS_INPUT__",_s="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ws="rm",CR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,vR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,ER=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xR=/^(?:[0-9]+|[@*])$/;function Lm(O,D){let B=O.map(t),{childStart:Q,replacementToken:ee}=Ir(B),he=B.slice(Q),je=St("xargs.shell-dynamic",Jl);if(_R(he,ee,D)&&wt(je,D.policy))return wt(je,D.policy);for(let at of Mn(he,D)){let lt=at.tokens,ct=ee!==null&&lt[0]!==he[0]&&(lt[0]?.includes(ee)??!1)?wt(je,D.policy):null;if(ct)return ct;let ut=$m(lt,ee,at.wrapperEnvAssignments),ft=at.head==="rm"&&ee!==null&&zm(lt,ee),dt=D.analyzeChild(lt,{...Pr(at,D),dynamicInput:ut,dynamicSourceInput:ft||Gm(lt,at.head,ee,at.wrapperEnvAssignments,ut,D.environment,D.strict?void 0:D.analyzeNested),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:St("xargs.rm-recursive-force-dynamic",Xl)});if(dt)return dt;let mt=RR(lt,ee,D.policy?.rules??[],wt(je,D.policy));if(mt)return mt;if(at.head==="git"){let gt=ee===null?[...lt,SR]:lt,ht=ee!==null&&(lt.some((Ct)=>Ct.includes(ee))||Array.from(at.envAssignments.values()).some((Ct)=>Ct.includes(ee))),yt=D.analyzeChild(gt,{...Pr(at,D),worktreeMode:ee===null||ht?!1:D.worktreeMode});if(yt)return yt}let pt=_(lt,D.policy?.rules??[]);if(pt)return pt}return null}function RR(O,D,B,Q){if(B.length===0)return null;if(D===null){for(let he of B){let je=_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],B);if(je)return je}return null}let ee=It(O[0]??"");if(!B.some((he)=>It(he.command)===ee))return null;return O.slice(1).some((he)=>he.includes(D))?Q:null}function Wm(O,D,B){let Q=O.indexOf(D);if(Q===-1||O.indexOf(D,Q+D.length)!==-1)return[];let ee=Cm(O,Q,D.length,B);return ee===null?[]:[ee]}function Gm(O,D,B,Q,ee,he,je){if(Ht.has(D)){if(Yn(O))return!1;if(B!==null&&wR(O,B,je))return!0;let at=Nn(O);if(!at){let lt=Xn($t(O));if(lt.kind==="literal")return B!==null&&lt.source.includes(B);return lt.kind==="none"&&ee}if(B!==null&&at.includes(B)&&!Fm(at,B,je))return!0;if(xn(at))return!0;return PR(at,B,Q)}if(An(D))return Dm(O,B,qi,Bd(D));if(En.has(D))return Dm(O,B,Tl,$f);if(D==="eval"){let at=xs($t(O));if(at.kind==="dynamic")return!0;if(B!==null)return at.kind==="literal"&&at.source.includes(B);return ee}if(D==="find")return AR(O,B,he);if(D==="git"){let at=Sn(O);return B===null?at.subcommand===null:(at.subcommand?.includes(B)??!1)||at.subcommand!==null&&Qr.has(at.subcommand.toLowerCase())&&Bm(at.rest,B).some((lt)=>lt.includes(B))}return!1}function Fm(O,D,B){if(B===void 0)return!1;let Q=D.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${Q}`).test(O)||/\bcase\b/.test(O))return!1;let he=O.replaceAll(D,"/");return xn(he)===null&&B(he)===null}function Dm(O,D,B,Q){let ee=B(O);if(D===null)return ee.optionsOpen||B([...O,_s]).sources.some((at)=>at.value===_s);if(ee.sources.some((at)=>at.value.includes(D)))return!0;let he=Q.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${_s}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${_s}`]:[]]),je=new Set(he.flatMap((at)=>O.flatMap((lt)=>Wm(lt,D,at))));return vs(ee.sources,je,(at)=>B(O.map((lt)=>lt.replaceAll(D,at))).sources)}function _R(O,D,B){if(O.length===0||(O[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(Mn(O,B),(he)=>he.head)),ee=D===null?[...O,ws]:O.map((he,je)=>je===0?he:he.replaceAll(D,ws));return Array.from(Mn(ee,B)).some((he)=>he.head===ws&&!Q.has(ws))}function zm(O,D){return Bm(O.slice(1),D).some((B)=>B.includes(D)&&(B.startsWith("-")||B.startsWith(D)))}function Bm(O,D){let B=O.findIndex((Q)=>Q==="--"&&!Q.includes(D));return B===-1?O:O.slice(0,B)}function $m(O,D,B){if(D===null)return!0;return O.some((Q)=>Q.includes(D))||Array.from(B.values()).some((Q)=>Q.includes(D))}function wR(O,D,B){let Q=hn(O),ee=Q.commandIndex===null?"":O[Q.commandIndex]??"";if(ee.includes(D)&&!Fm(ee,D,B)||Q.scriptIndex!==null&&(O[Q.scriptIndex]??"").includes(D))return!0;return["-c","-nc","-cn",`--${D}`,D].some((je)=>O.some((at,lt)=>{if(lt===0||!at.includes(D))return!1;return Wm(at,D,je).some((ut)=>{let ft=O.map((mt,pt)=>pt===lt?mt.replaceAll(D,ut):mt),dt=hn(ft);if(dt.commandIndex===null&&dt.scriptIndex===null)return!1;if(Q.commandIndex===null&&dt.commandIndex!==null)return!0;if(Q.scriptIndex===null&&dt.scriptIndex!==null)return!0;if(dt.commandIndex!==null&&(ft[dt.commandIndex]??"").includes(ut))return!0;return dt.scriptIndex!==null&&(ft[dt.scriptIndex]??"").includes(ut)})}))}function PR(O,D,B){let Q=new Set(D===null?[]:Array.from(B).filter(([,ee])=>ee.includes(D)).map(([ee])=>ee));for(let ee of O.matchAll(CR))if(Nm(ee,Q))return!0;for(let ee of O.matchAll(vR))for(let he of(ee[1]??"").matchAll(ER))if(Nm(he,Q))return!0;return Zl(O,Q)}function Nm(O,D){let B=O[1]??O[2];return B!==void 0&&(xR.test(B)||D.has(B))}function AR(O,D,B){if(D===null)return!0;let Q=!1,ee=0;for(let he=1;he<O.length;he++){let je=O[he]??"";if(!Q&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(D)===0)return!0;continue}if(Q=!0,ee>0){ee--;continue}if(zn(je)){let lt=Jr(O,he);he=lt.nextIndex-1;for(let ct of Mn(lt.tokens,{environment:B,cwd:void 0})){let ut=$m(ct.tokens,D,ct.wrapperEnvAssignments);if(ct.head==="rm"&&zm(ct.tokens,D)||Gm(ct.tokens,ct.head,D,ct.wrapperEnvAssignments,ut,B))return!0}continue}let at=Zn(je);if(at>0){if(ee=at,je.includes(D))return!0;continue}if(je.includes(D))return!0}return!1}function Ir(O){let D=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),B=null,Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--")return{childStart:Q+1,replacementToken:B};if(!ee.startsWith("-"))return{childStart:Q,replacementToken:B};if(ee==="-I"){B=O[Q+1]??"{}",Q+=2;continue}if(ee.startsWith("-I")&&ee.length>2){B=ee.slice(2),Q++;continue}if(ee==="--replace"){B="{}",Q++;continue}if(ee.startsWith("--replace=")){let he=ee.slice(10);B=he===""?"{}":he,Q++;continue}if(ee==="-J"){B=O[Q+1]??"{}",Q+=2;continue}Q+=D.has(ee)?2:1}return{childStart:O.length,replacementToken:B}}var ei="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",ti="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",IR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",kR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",As=/\{[^{}\s]*\}/g,Um=/\{\}|\{-?\d+\}/g,OR=["e","f","source","file","-e","-f","--source","--file"],MR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],DR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),NR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Hm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),LR=new Set(["--workdir","--wd"]),jm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function _n(O,D){for(let B of O){let Q=D(B);if(Q)return Q}return null}function Zm(O){return _n([...O],(D)=>xn(D))}function Xm(O,D){let B=O.map(t);if((D.envAssignments?.has("PARALLEL")?D.envAssignments.get("PARALLEL"):D.environment.env.get("PARALLEL"))?.trim()){let pt=no(D);if(pt)return pt}if(B.length===2&&(B[1]==="--version"||B[1]==="--help"))return null;let ee=sp(B),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:ut,dryRun:ft}=ee;if(ct){let pt=no(D);if(pt)return pt;let gt=Zm(D.envAssignments?.values()??[]);if(gt)return gt}if(lt){let pt=$R(D);if(pt)return pt}if(ut!==void 0&&at){let pt=no(D);if(pt)return pt}let dt=UR(ut,D.cwd,D.environment.paths);if(dt===null){let pt=no(D);if(pt)return pt}let mt=at?{...D,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===D.cwd?D:{...D,cwd:dt};if(ft){if([...Mn(he,mt)].flatMap((gt)=>[...gt.envAssignments.values()]).some(tc)){let gt=no(D);if(gt)return gt}return null}if(he.length===0){let pt=je.map((ht)=>ht[0]??"");D.budget.charge("derivedTokens",pt.length);let gt=tp(mt.envAssignments,mt.cwd,at);return _n(pt,(ht)=>D.analyzeNested(ht,gt))}return _n(Mn(he,mt),(pt)=>WR(pt,ee,D,mt))}function WR(O,D,B,Q){let{jobs:ee,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=D,lt=O.tokens,ct=[...O.envAssignments.values()];if(ct.some(op)){let ht=no(B);if(ht)return ht}let ut=Zm(ct);if(ut)return ut;let ft=ct.some(Nt),dt=he||ft,mt=at&&dt,pt=tp(O.envAssignments,O.wrapperCwd,je||mt);if(Ht.has(O.head)){let ht=()=>{if(!he||ee.length===0)return null;return _n(ee,(Et)=>B.analyzeChild(Ps(lt,Et,B.budget),Pr(O,Q)))};if(Yn(lt))return ht();let yt=Nn(lt);if(yt){if(ip(yt)){let xt=ur(B);if(xt)return xt;if(ee.length===0)return null;return _n(ee,(_t)=>B.analyzeNested(qm(yt,_t,B.budget),pt))}if(Nt(yt)){if(ee.length>0)return _n(ee,(Ut)=>B.analyzeNested(qm(yt,Ut,B.budget),pt));let xt=Yo(yt);if(xt?.[0]&&It(xt[0])==="rm"&&Dn(xt)){let Ut=Km(B);if(Ut)return Ut}let _t=xt?B.analyzeChild(xt,{...Pr(O,Q),dynamicInput:at,shellDynamicMatch:St("parallel.shell-dynamic",ti),rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",ei)}):null;if(_t)return _t;return B.analyzeNested(yt,pt)}let Et=!ft&&(!he||ee.length>0)?(ee.length>0?ee:[void 0]).map((xt)=>Rs($t(xt===void 0?lt:he?lt.map((_t)=>np(_t,xt)):[...lt,...xt]),yt)):[];if(Et.some((xt)=>xt.kind==="dynamic")){let xt=ur(B);if(xt)return xt}let vt=Et.flatMap((xt)=>xt.kind==="literal"?[xt.source]:[]);if(vt.length>0)return B.budget.charge("derivedTokens",vt.length),_n(vt,(xt)=>B.analyzeNested(xt,pt));if(Qo(yt)){let xt=ur(B);if(xt)return xt}let Pt=B.analyzeNested(yt,pt);if(Pt)return Pt;if(dt)return ur(B);return null}let Ct=Xn($t(lt));if(Ct.kind==="dynamic"||Ct.kind==="literal"&&Nt(Ct.source))return ur(B)??ht();if(Ct.kind==="literal")return ht();if(ee.length>0){let Et=ur(B);if(Et)return Et;let vt=ht();if(vt)return vt;if(he)return null;let Pt=ee.flatMap((xt)=>xt[0]===void 0?[]:[xt[0]]);return B.budget.charge("derivedTokens",Pt.length),_n(Pt,(xt)=>B.analyzeNested(xt,pt))}if(dt||at)return ur(B)??ht();return null}if(O.head==="rm"&&Dn(lt)){if(he&&ee.length>0)return _n(ee,(yt)=>Ql(Ps(lt,yt,B.budget,Um),O.cwd,Q));if(ee.length>0)return _n(ee,(yt)=>Ql(Ym(lt,yt,B.budget),O.cwd,Q));let ht=Ql(lt.flatMap((yt,Ct)=>{if(Ct===0||!Nt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Um,"")]:[]}),O.cwd,Q);if(ht)return ht;return Km(B)}let gt=ee.length>0?ee:[void 0];return _n(gt,(ht)=>{let yt=ht===void 0?lt:he?Ps(lt,ht,B.budget):Ym(lt,ht,B.budget),Ct=St("parallel.shell-dynamic",ti),Et=at&&O.head==="find"?BR(yt,Q):null,vt=Qm(yt,at,B)??Et?.customResult??null,Pt=It(O.head),xt=at&&(Pt==="rm"&&ec(yt)||Pt==="xargs"&&ep(yt)||Et?.rmOptions===!0),_t=at&&(xt||Et?.executedSource===!0||Et===null&&Jm(yt,Pt)),Ut=B.analyzeChild(yt,{...Pr(O,Q),worktreeMode:je||at||dt?!1:B.worktreeMode,dynamicInput:at||dt,dynamicRmInput:xt,dynamicSourceInput:vt!==null||_t,shellDynamicMatch:Ct,dynamicSourceMatch:Ct,rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",ei)});if(_t){let Vt=wt(Ct,B.policy);if(Vt)return Vt}return Ut??vt??_(yt,B.policy?.rules??[])})}function Jm(O,D){if(Nt(O[0]??""))return!0;if(D==="eval"||D==="source"||D===".")return!0;if(D==="parallel"||D==="xargs")return!0;if(Ht.has(D))return zR(O);if(D==="git")return GR(O);if(D==="find")return!0;if(En.has(D))return Vm(O,OR,Ko);if(An(D))return Vm(O,MR,Ki);return!1}function ec(O){let D=O.indexOf("--"),B=O.slice(1,D===-1?void 0:D);if(!O.some(Nt))return D===-1;return B.some((ee)=>Nt(ee)&&(ee.startsWith("-")||ip(ee)))}function GR(O){if(FR(O))return!0;let D=Sn(O);if(D.subcommand===null||Nt(D.subcommand))return!0;if(!Qr.has(D.subcommand.toLowerCase()))return!1;let B=D.rest.indexOf("--"),Q=D.rest.slice(0,B===-1?void 0:B);if(!O.some(Nt))return B===-1;return Q.some(Nt)}function FR(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B||B==="--"||!B.startsWith("-"))return!1;if(B==="-c"||B==="--config-env"){if(Nt(O[D+1]??""))return!0;D++;continue}if(B.startsWith("-c")&&B.length>2||B.startsWith("--config-env=")){if(Nt(B))return!0;continue}if(Nt(B))return!0}return!1}function zR(O){if(Yn(O))return!1;let D=Nn(O);if(D!==null)return Nt(D);let B=Xn($t(O));if(B.kind==="literal")return Nt(B.source);if(B.kind==="dynamic")return!0;return!O.some(Nt)}function Vm(O,D,B){let Q=B(O);if(Q.some((ee)=>Nt(ee.value)))return!0;if(!O.some(Nt))return B([...O,jm]).some((ee)=>ee.value===jm);return vs(Q,D,(ee)=>B(O.map((he)=>np(he,[ee]))))}function Qm(O,D,B){let Q=B.policy?.rules??[];if(!D||Q.length===0)return null;let ee=Q.filter((he)=>It(he.command)===It(O[0]??""));if(ee.length===0)return null;if(O.slice(1).some(Nt))return ur(B);return _n(ee,(he)=>_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function BR(O,D){let B={customResult:null,executedSource:!O.some(Nt),rmOptions:!1},Q=!1,ee=0,he=null,je=()=>{if(!he?.some(Nt))return;for(let at of Mn(he,D))B.executedSource||=Jm(at.tokens,at.head),B.rmOptions||=at.head==="rm"&&ec(at.tokens)||at.head==="xargs"&&ep(at.tokens),B.customResult??=Qm(at.tokens,!0,D)};for(let at of O.slice(1)){if(!Q&&!at.startsWith("-")&&at!=="!"&&at!=="("){B.executedSource||=Nt(at);continue}if(Q=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(ee>0){ee--;continue}if(zn(at)){he=[],B.executedSource||=Nt(at);continue}let lt=Zn(at);if(lt>0){ee=lt,B.executedSource||=Nt(at);continue}B.executedSource||=Nt(at)}return je(),B}function ep(O){let D=O.slice(Ir(O).childStart);return It(D[0]??"")==="rm"&&ec(D)}function Ts(O,D){return(B)=>wt(St(O,D),B.policy)}var ur=Ts("parallel.shell-dynamic",ti),$R=Ts("parallel.command-stream-dynamic",IR),no=Ts("parallel.command-stream-dynamic",kR),Km=Ts("parallel.rm-recursive-force-dynamic",ei);function Ql(O,D,B){return wt(Es($t(O),{environment:B.environment,cwd:D,budget:B.budget,originalCwd:B.originalCwd,strict:B.strict,paranoid:B.paranoidRm,allowTmpdirVar:B.allowTmpdirVar,tmpdirWordSplittingUnsafe:ar(B.envAssignments??new Map,B.environment),trustedTmpdirValue:xr(B.envAssignments??new Map,B.environment),protectedGitMetadata:B.protectedGitMetadata,policy:B.policy}),B.policy)}function tp(O,D,B){let Q={};if(O)Q.envAssignments=O;if(B)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(D!==void 0)Q.effectiveCwd=D;return Object.keys(Q).length>0?Q:void 0}function np(O,D){return O.replace(As,(B)=>rp(B,D))}function Ps(O,D,B,Q=As){return B.charge("derivedTokens",O.reduce((ee,he)=>ee+1+Math.floor(he.length/64),0)),O.map((ee)=>ee.replace(Q,(he)=>{let je=rp(he,D);return B.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function qm(O,D,B){return Ps([O],D,B)[0]??""}function Ym(O,D,B){return B.charge("derivedTokens",O.length+D.length),[...O,...D]}function rp(O,D){let B=/^\{(-?\d+)[^{}\s]*\}$/.exec(O)?.[1];if(B===void 0)return D[0]??"";let Q=Number(B);return D[Q>0?Q-1:D.length+Q]??""}function Nt(O){return O.search(As)!==-1}function op(O){if(tc(O))return!0;for(let D of O.matchAll(As))if(!/^(?:\{\}|\{\d+\})$/.test(D[0]))return!0;return!1}function tc(O){let D=O.indexOf("{=");return D!==-1&&O.indexOf("=}",D+2)!==-1}function ip(O){return/^\{[^{}\s]*\}$/.test(O)}function UR(O,D,B){if(O===void 0)return;if(O==="..."||/^~|[{}$`*?[]/.test(O))return null;if(!D&&!TR(O))return null;try{return rr(D??O,O,B)}catch{return null}}function sp(O){let D=1,B=[],Q=O.length,ee=-1,he=!1,je=!1,at,lt=!1,ct=O.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(D<O.length){let pt=O[D];if(pt===void 0)break;if(pt===":::"){ee=D;break}if(pt==="--"){let Et=Ol(O,D+1);B.push(...Et.templateTokens),Q=D+1,ee=Et.markerIndex;break}if(!pt.startsWith("-")){let Et=Ol(O,D);B.push(...Et.templateTokens),Q=D,ee=Et.markerIndex;break}let gt=O[D+1],ht=pt.indexOf("="),yt=ht===-1?pt:pt.slice(0,ht),Ct=ht===-1?void 0:pt.slice(ht+1);if(pt==="--dry-run"){lt=!0,D++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?gt:pt.slice(2))!=="{}",D+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,D+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let Et=yt==="--replace"?Ct:pt.slice(2);ct||=Et!==""&&Et!=="{}",D++;continue}if(pt==="-a"||NR.has(yt)){ct=!0,D+=Ct===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,D++;continue}if(yt==="--env"){ct=!0,D+=Ct===void 0?2:1;continue}if(Hm.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,D+=Hm.has(pt)?2:1;continue}if(LR.has(yt)){ct=!0;let Et=Ct??gt;if(Et===void 0||Et===":::"||Et==="--"){D++;continue}at=Et,D+=Ct===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){D++;continue}if(pt.startsWith("--")&&Ct!==void 0){D++;continue}if(DR.has(pt)){if(gt===void 0||gt===":::"||gt==="--"){ct=!0,D++;continue}D+=2;continue}D+=pt==="-j"||pt==="--jobs"?2:1}ct||=B.some(lt?tc:op);let ut=[];if(ee!==-1){let pt=[];for(let gt=ee+1;gt<O.length;gt++){let ht=O[gt];if(ht===":::"){ut.push(pt),pt=[];continue}if(ht!==void 0)pt.push(ht)}ut.push(pt)}ct||=ut.length>1;let ft=HR(ut),dt=B.some(Nt),mt=B.length===0&&ee===-1;return{template:B,jobs:ft,childStart:Q,templateHasPlaceholder:dt,runsRemotely:he,usesStdin:je||ee===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function HR(O){if(O.length===0||O.some((B)=>B.length===0))return[];let D=[[]];for(let[B,Q]of O.entries()){if(Q.length===1){let he=Q[0];if(he===void 0)return[];for(let je of D)je.push(he);if(D.length*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ee=[];for(let he of D)for(let je of Q){if((ee.length+1)*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");ee.push([...he,je])}D=ee}return D}function ap(O){return sp(O).childStart}var jR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Is="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function rc(O){return O?.parts.some((D)=>D.provenance==="command-substitution")??!1}function nc(O){return O?.parts.some((D)=>D.provenance==="literal"&&D.raw.replace(/^["']/,"").startsWith("-"))??!1}function cp(O,D,B,Q,ee=!1,he){let at=(_o(O,D)||Q&&O!=="powershell"&&D[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",ee)?St("shell.dynamic-executable",jR):null;return wt(at,he)??up(O,D,B,ee,he)}function up(O,D,B,Q,ee){if(D.length<2)return null;let he=D.flatMap((at,lt)=>rc(at)?[lt]:[]);if(he.length===0)return null;let je=It(D[0]?.text??"");if(je==="git"){let at=X(O,D),lt=KR(at);if(Jt(ee,"shell.dynamic-structure",Q)&&he.some((ft)=>ft<=lt))return wt(St("shell.dynamic-structure",Is),ee);if(wt(Cs(at,{environment:B}),ee))return null;let ct=D[lt]?.text.toLowerCase(),ut=at.findIndex((ft,dt)=>dt>lt&&t(ft)==="--");if(Jt(ee,"shell.dynamic-structure",Q)&&ct&&Qr.has(ct)&&he.some((ft)=>ft>lt&&(ut===-1||ft<ut)))return wt(St("shell.dynamic-structure",Is),ee);return null}if(je==="find")return Jt(ee,"shell.dynamic-structure",Q)&&qR(D)?wt(St("shell.dynamic-structure",Is),ee):null;if(je==="rm"){let at=D.findIndex((ct,ut)=>ut>0&&t(ct)==="--"),lt=Dn(D.map(t));return Jt(ee,"shell.dynamic-structure",Q)&&he.some((ct)=>(at===-1||ct<at)&&(ct<D.length-1||!lt))?wt(St("shell.dynamic-structure",Is),ee):null}if(je==="xargs")return lp(O,D.slice(Ir(D.map(t)).childStart),"xargs",B,Q,ee);if(je==="parallel")return lp(O,D.slice(ap(D.map(t))),"parallel",B,Q,ee);return null}function lp(O,D,B,Q,ee,he){if(D.length===0)return null;let je=VR(D,Q);if(_o(O,je)){let lt=wt(St(`${B}.shell-dynamic`,B==="xargs"?Jl:ti),he);if(lt)return lt}let at=up(O,je,Q,ee,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>rc(lt)&&nc(lt)))return wt(St(`${B}.rm-recursive-force-dynamic`,B==="xargs"?Xl:ei),he);return null}function VR(O,D){let B=Cr(O,D),Q=B.rewritten?$t(B.words.map(t)):B.words,ee=Q[0];return ee&&t(ee)==="busybox"?Q.slice(1):Q}function KR(O){let D=1;while(D<O.length){let B=O[D],Q=B?t(B):"";if(gn.has(Q)){D+=2;continue}if(Q.startsWith("-")){D++;continue}return D}return D}function qR(O){let D=!1,B=0,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(!je)continue;let at=rc(je);if(B>0){B--;continue}if(ee){if(je.text===";"||je.text==="+"){ee=!1,D=!0,Q=!1;continue}if(at&&(Q||nc(je)))return!0;Q=!1;continue}if(!D&&!je.text.startsWith("-")){if(at&&(he>1||nc(je)))return!0;continue}if(D=!0,at)return!0;let lt=Zn(je.text);if(lt>0){B=lt;continue}if(zn(je.text))ee=!0,Q=!0}return!1}function oc(O,D){return O.some((B)=>{if(B.value==="-"&&(B.kind==="main-script"||B.kind==="program-file"))return!0;return!Ui(D[B.tokenIndex],B.value)})}var YR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",ZR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",XR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function dp(O,D){let B=D.slice(1);if(O==="dd"&&B.some((Q)=>/^of=\/dev\/.+/.test(Q)))return St("dd.device-write",YR);if((O==="mkfs"||O.startsWith("mkfs."))&&B.some((Q)=>Q.startsWith("/dev/")))return St("mkfs.device",ZR);if(O==="shred"&&B.length>0)return St("shred.target",XR);return null}var mp=[{heads:new Set(["rm","rmdir"]),analyze:(O)=>Es(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoid:O.options.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ar(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,policy:O.options.policy,budget:O.options.budget})},{heads:new Set(["git"]),analyze:(O)=>Cs(O.words,ic(O))},{heads:new Set(["find"]),analyze:(O)=>Yf(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ar(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,policy:O.options.policy,analyzeTokens:O.analyzeChildTokens,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["xargs"]),analyze:(O)=>Lm(O.words,{...fp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["parallel"]),analyze:(O)=>Xm(O.words,{...fp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})}];function fp(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoidRm:O.options.paranoidRm,paranoidInterpreters:O.options.paranoidInterpreters,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,worktreeMode:O.options.worktreeMode,policy:O.options.policy}}function kr(O){return O?{id:O.ruleId??"",reason:O.reason,intent:O.intent??"manual_only"}:null}function ic(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,dynamicArguments:O.dynamicArguments,envAssignments:O.envAssignments,shellAssignments:O.options.shellAssignments,policy:O.options.policy,worktreeMode:O.options.worktreeMode}}function yp(O){return mp.find((D)=>D.heads.has(O))?.analyze}function oo(O,D,B){let Q=B.trace;if(O.length===0)return null;let ee=B.commandView?.dialect??"posix",he=(Rt)=>Rt.map((Tt)=>ee==="posix"?t(Tt):Tt.text),je=B.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=B.effectiveCwd===null,ut=je?je.cwd:ct?void 0:B.effectiveCwd??B.cwd,ft=je?je.originalCwd:ct?void 0:B.cwd,dt=ge(O);if(dt.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:he(O),envVars:[...dt.envAssignments.keys()],output:he(dt.words)});let mt=Cr(dt.words,B.environment,ut,new Map([...B.envAssignments??[],...dt.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let Rt=[...pt,...he(mt.words)].join(" "),Tt=xn(Rt);if(Tt)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Tt.reason}),sn(Tt);if(B.strict)return fn(Q);let Mt=Xi(pt,he(mt.words));if(Mt){B.budget.charge("derivedTokens",Mt.length);let Yt=B.analyzeNested(Mt.join(" "),{effectiveCwd:mt.cwd===void 0?B.effectiveCwd:mt.cwd,envAssignments:new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let gt=mt.rewritten?$t(he(mt.words)):X(ee,mt.words),ht=he(gt),yt={...B,wrapperNormalizationBudget:B.wrapperNormalizationBudget??{iterations:0}};if(Q&&dt.words.length>gt.length){let Rt=he(dt.words);Q.recordSegment({type:"leading-tokens-stripped",input:Rt,removed:Rt.slice(0,Rt.length-gt.length),output:ht})}let Ct=new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments]),Et=ht[0];if(!Et)return null;if(wr(Et))throw new s("wrapperPeelIterations");let vt=It(Et),Pt=mt.cwd===null?void 0:mt.cwd??ut,xt=mt.cwd===null?void 0:ft,_t=mt.cwd===void 0?B.effectiveCwd:mt.cwd,Ut=je?je.allowTmpdirVar:!$o(Ct,B.environment),Vt=cp(ee,mt.words,B.environment,D===0,B.strict,B.policy);if(Vt)return Q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Vt.reason}),sn(Vt);let qt=ps(ht,B.policy);if(qt){for(let Rt of[qt.childIndex,...qt.alternativeChildIndices]){pp(yt.wrapperNormalizationBudget);let Tt=gt.slice(Rt);Q?.recordSegment({type:"transparent-wrapper",wrapper:qt.wrapper,output:he(Tt)});let Mt=oo(Tt,D,{...yt,effectiveCwd:_t,envAssignments:Ct});if(Mt)return Mt}return null}let Kt=lt?void 0:vt==="eval"?xs(gt):vt==="trap"&&!at?Am(gt):void 0;if(at&&je&&vt==="eval"){if(Kt?.kind==="dynamic")return ro(je,B.policy);if(Kt?.kind==="literal"){let Rt=B.analyzeNested(Kt.source,{effectiveCwd:_t,envAssignments:Ct});if(Rt)return Rt}return io(je,B.policy)}if(Kt?.kind==="dynamic"&&(B.strict||!B.commandView||!Yl(B.commandView)))return fn(Q);if(Kt?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:vt==="eval"?"shell-eval":"shell-trap",innerCommand:Kt.source,depth:D+1});let Rt=B.analyzeNested(Kt.source,{effectiveCwd:_t,envAssignments:Ct,functionDefinitions:B.functionDefinitions});if(Rt)return Rt}if(at?Ht.has(vt):Sp(Et,vt)){if(Yn(ht))return null;if(at&&je){let Rt=Nn(ht);if(Rt){if(je.dynamicSourceInput??je.dynamicInput){let Mt=ro(je,B.policy);if(Mt)return Mt}if(Qo(Rt)){let Mt=ro(je,B.policy);if(Mt)return Mt}return B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct})}let Tt=Xn(gt);if(Tt.kind==="dynamic")return ro(je,B.policy);if(Tt.kind==="literal")return je.dynamicSourceInput?ro(je,B.policy):null;return je.dynamicSourceInput??je.dynamicInput?ro(je,B.policy):null}if(lt){let Rt=Nn(ht),Tt=Rt?B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct}):Xn(gt).kind==="dynamic"?fn(Q):null;if(Tt)return Tt}if(je===void 0){let Rt=t_(ht,Ct,_t,B,Q,D);if(Rt)return Rt;let Tt=Nn(ht);if(Tt){let Dr=Rs(gt,Tt);if(Dr.kind==="dynamic")return fn(Q);let Vs=Dr.kind==="literal"?Dr.source:Tm(gt,Tt),Tc=n_(Vs);Q?.recordSegment({type:"shell-wrapper",wrapper:vt,innerCommand:Tc}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Tc,depth:D+1});let Ic=B.analyzeNested(Vs,{effectiveCwd:_t,envAssignments:Ct});if(Ic)return Ic;return Qo(Vs)?fn(Q):null}let Mt=Xn(gt);if(Mt.kind==="dynamic")return fn(Q);if(Mt.kind==="literal")return ks(Mt.source,_t,Ct,B,Q,D);let Yt=Im(gt,B.commandView?.redirections??[],B.hasPipelineInput??!1,B.literalShellInput);if(Yt.kind==="dynamic")return fn(Q);if(Yt.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:D+1}),B.analyzeNested(Yt.source,{effectiveCwd:_t,envAssignments:Ct})}}if(!je&&(vt==="source"||vt===".")){let Rt=ht[1]==="-p"?2:null;if(Rt!==null){let Dr=B.commandView?gt[Rt]:void 0;if(!Dr)return null;if(Dr.provenance!=="literal")return fn(Q)}let Tt=Rt===null?1:3,Mt=ht[Tt]==="--"?Tt+1:Tt,Yt=B.commandView?gt[Mt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return ks(Yt.text,_t,Ct,B,Q,D);if(B.strict||!B.commandView||!Yl(B.commandView))return fn(Q)}if(En.has(vt)&&!lt){if(!je&&B.strict&&oc(Ko(ht),gt))return fn(Q);let Rt=Uf(ht,(Mt)=>kr(B.analyzeNested(Mt,{effectiveCwd:_t,envAssignments:Ct}))),Tt=wt(Rt,B.policy);if(Tt)return Q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Tt.reason}),sn(Tt)}if(An(vt)&&!lt){if(!je&&B.strict&&oc(Ki(ht),gt))return fn(Q);let Rt=zd(ht);if(at&&je)return QR(vt,Rt,_t,Ct,B,je);if(Rt){let Tt=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:vt,codeArg:Rt,paranoidBlocked:Tt}),Tt){let Yt=wt(St("interpreter.one-liner-paranoid",Mo),B.policy);if(Yt)return sn(Yt)}if(al(vt,Rt))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rt,depth:D+1});let Mt=B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct});if(Mt&&!bp(Mt,Rt))return Mt;if(Do(Rt,void 0,!B.strict)){let Yt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(Yt)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Kr}),sn(Yt)}Q=void 0}}if(vt==="busybox"&&ht.length>1)return pp(yt.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:ht[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:ht.slice(1).join(" "),depth:D+1}),oo(gt.slice(1),D,{...yt,effectiveCwd:_t,envAssignments:Ct});let Ot=je?null:wt(dp(vt,ht),B.policy);if(Ot)return Q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ot.reason}),sn(Ot);let on=Q===yt.trace?yt:{...yt,trace:Q},Cn={words:gt,head:vt,cwd:Pt,originalCwd:xt,envAssignments:Ct,allowTmpdirVar:Ut,dynamicArguments:mt.words.some((Rt)=>Rt.provenance==="command-substitution"),depth:D,effectiveCwd:_t,options:on,analyzeChildTokens:(Rt,Tt)=>at&&je?sc(Rt,D,on,{...je,cwd:Tt??void 0,effectiveCwd:Tt??void 0}):kr(oo($t(Rt),D+1,{...on,child:void 0,commandView:void 0,effectiveCwd:Tt,envAssignments:Ct}))??_(Rt,on.policy.rules),analyzeChild:(Rt,Tt)=>sc(Rt,D,on,Tt)},Un=je&&(vt==="xargs"||vt==="parallel")?void 0:yp(vt);if(vt==="rm"||vt==="xargs"||vt==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:Ct.has("TMPDIR")||B.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ut});let wn=Q&&vt==="git"?Sm(Cn.words,ic(Cn)):void 0,Hs=gp(wn?wn.match:Un?.(Cn)??null,B.policy);if(Q)r_(Cn,Hs,wn?.relaxation??null);if(Hs)return sn(Hs);if(at&&je&&(vt==="rm"||vt==="rmdir")){if(!(vt==="rm"&&(Dn(ht)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?io(je,B.policy):null)??e_(je,B.policy)}let Ac=!je&&Un===void 0&&!Ci.has(vt),js=Q&&Ac?[]:void 0;if(Ac)for(let Rt=1;Rt<ht.length;Rt++){let Tt=ht[Rt];if(!Tt)continue;js?.push(Tt);let Mt=gp(JR(ht,Rt,D,on,Pt,xt,_t,Ct),B.policy);if(Mt)return Q?.recordSegment({type:"fallback-scan",tokensScanned:js??[],embeddedCommandFound:It(Tt)}),sn(Mt)}if(Q?.recordSegment({type:"fallback-scan",tokensScanned:js??[]}),lt&&je&&!je.wrappedByTransparent)return null;let li=_(ht,B.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:B.policy.rules.length>0,matched:!!li,reason:li?.reason}),li)return sn(li);return at&&je?io(je,B.policy):null}function sc(O,D,B,Q){return kr(oo($t(O),D+1,{...B,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:Q.originalCwd,effectiveCwd:Q.effectiveCwd,envAssignments:Q.envAssignments,worktreeMode:Q.dynamicInput?!1:Q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:Q}))}function JR(O,D,B,Q,ee,he,je,at){for(let lt of Mn(O.slice(D),{environment:Q.environment,cwd:ee,envAssignments:at,policy:Q.policy})){let ct=lt.tokens[0];if(!ct)continue;let ut=It(ct);if(Sp(ct,ut)||yp(ut)!==void 0&&ut!=="xargs"&&ut!=="parallel"||lt.wrappedByTransparent&&Q.policy.rules.length>0)Q.budget.charge("derivedTokens",O.length-D);let dt=sc(lt.tokens,B,Q,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!$o(lt.envAssignments,Q.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(dt)return dt}return null}function QR(O,D,B,Q,ee,he){if(!D)return io(he,ee.policy);if(Jt(ee.policy,"interpreter.one-liner-paranoid",!!ee.paranoidInterpreters)){let at=wt(St("interpreter.one-liner-paranoid",Mo),ee.policy);if(at)return sn(at)}if(al(O,D))return io(he,ee.policy);let je=ee.analyzeNested(D,{effectiveCwd:B,envAssignments:Q});if(je&&!bp(je,D))return je;if(Do(D,void 0,!ee.strict)){let at=wt(St("interpreter.dangerous-command",Kr),ee.policy);if(at)return sn(at)}return io(he,ee.policy)}function bp(O,D){if(O.ruleId==="raw-text.dangerous-command")return!0;return(O.reason.startsWith(ds)||O.reason===Xr)&&!vi(D)}function ro(O,D){let B=O.shellDynamicMatch?wt(O.shellDynamicMatch,D):null;return B?sn(B):null}function io(O,D){let B=O.dynamicSourceInput&&O.dynamicSourceMatch?wt(O.dynamicSourceMatch,D):null;return B?sn(B):null}function e_(O,D){let B=O.dynamicInput&&O.rmDynamicMatch?wt(O.rmDynamicMatch,D):null;return B?sn(B):null}function t_(O,D,B,Q,ee,he){let je=qf(O);if(je.argvSource?.kind==="absent")return fn(ee);if(je.argvSourceApplies&&je.argvSource){let lt=ks(je.argvSource.value,B,D,Q,ee,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=D.get(je.envName);if(!at)return null;return ks(at,B,D,Q,ee,he,!0)}function ks(O,D,B,Q,ee,he,je=!1){if(je&&/[$`*?[\]]/.test(O))return fn(ee);let at=Oo(O,D,Q.environment.paths,Q.budget),lt=at?Q.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?fn(ee):null;return Q.budget.charge("derivedTokens",1),ee?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),Q.analyzeNested(lt,{effectiveCwd:D,envAssignments:B})}function n_(O){let D=O[0];return O.length>=2&&(D==='"'||D==="'")&&O.at(-1)===D?O.slice(1,-1):O}function r_(O,D,B){let Q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[O.head];if(!Q)return;if(O.options.trace?.recordSegment({type:"rule-check",rule:Q,matched:!!D||!!B,reason:D?.reason??B?.originalReason}),B)O.options.trace?.recordSegment({type:B.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:B.originalReason,gitCwd:B.gitCwd})}function pp(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function sn(O){return{reason:O.reason,ruleId:O.id||void 0,intent:O.intent}}function fn(O){return O?.recordSegment({type:"error",message:jo}),sn(o_())}function o_(){return{id:"",reason:jo,intent:"stop_and_explain"}}function Sp(O,D){return Ht.has(D)||O==="$SHELL"||O==="${SHELL}"||Ht.has(At(D))}function gp(O,D){return O?.id.startsWith("custom.")||O?.id==="raw-text.dangerous-command"?O:wt(O,D)}var i_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,s_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function a_(O,D){let B=Ep(O,D);if(B.length===0)return!1;let Q=B[vp(B)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return i_.test(O.join(" "))}function Cp(O,D,B,Q,ee){if(O.dialect==="powershell"){let ht=c_(O.words,ee);if(ht.kind==="none")return;if(!D||ht.kind==="unknown")return null;return hp(m_(ht.target),D,B.paths)}let he=O.words.map(t),je=he.some((ht)=>/^CDPATH\+?=/.test(ht));if(!a_(he,B))return je?null:void 0;if(!D)return null;let at=Ep(he,B,D),lt=vp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),ut=ct.findIndex((ht)=>ht.length<=1||!ht.startsWith("-")||ht==="--");if((ut===-1?ct:ct.slice(0,ut)).some((ht)=>!/^-[LP]+$/.test(ht)))return null;let dt=ut===-1?[]:ct.slice(ut),mt=dt[0]==="--"?dt.slice(1):dt;if(mt.length!==1)return null;let pt=mt[0]??"",gt=O.words.some((ht)=>ht.provenance==="variable"&&ht.text===pt)?l_(pt,Q):pt;if(gt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(gt)&&(je||B.env.has("CDPATH")))return null;return hp(gt,D,B.paths)}function l_(O,D){let B=Zo(O,D);return B.startsWith("~")||/[\s$`*?[]/.test(B)?null:B}function hp(O,D,B){if(!O||O==="-"||O.includes("$")||O.includes("`"))return null;try{return rr(D,O,B)}catch{return null}}function c_(O,D){let B=u_(O[0])?1:0,Q=O[B];if(!d_(Q,B===1))return{kind:"none"};let ee=Q.text.toLowerCase(),he=ee.split(/[\\/]/).pop()??ee;if(!s_.has(he))return{kind:"none"};if(ee!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return f_(O.slice(B+1),D)}function u_(O){return O?.provenance==="literal"&&!O.quoted&&O.raw===O.text&&(O.text==="&"||O.text===".")}function d_(O,D){return O?.provenance==="literal"&&(D||!O.quoted&&O.raw===O.text)}function f_(O,D){let B;for(let Q of O){if(Q.provenance!=="literal"||B!==void 0)return{kind:"unknown"};B=Q.text}if(B!==void 0)return{kind:"target",target:B};return D===void 0?{kind:"unknown"}:{kind:"target",target:D}}function m_(O){return O.includes("::")?void 0:O.replaceAll("\\","/")}function vp(O){let D=0;if(O[0]==="builtin"&&O.length>1)D=1;if(O[D]!=="time")return D;let B=D+1;while(O[B]?.startsWith("-"))B++;return B}function Ep(O,D,B){let Q=p_(O);return or([...Q],D,B)}function p_(O){let D=0;while(D<O.length){let B=O[D];if(B!=="{"&&B!=="("&&B!=="$(")break;D++}return O.slice(D)}var g_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Or="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function dc(O,D,B,Q){if(D>=a.recursionDepth.cap)return B.trace?.recordSegment({type:"error",message:Gn}),{reason:Gn,segment:O,intent:"stop_and_explain"};let ee=Q??B.factStore?.getCommandProgram(O,B.shell??"auto")??h(O,B.shell);if(ee.status==="limited")return B.trace?.recordSegment({type:"error",message:Gn}),{reason:Gn,segment:O,intent:"stop_and_explain"};if(ee.status==="invalid"){let ct=ee.issues.find((ut)=>ut.code.includes("heredoc"));if(ct){if(!B.strict)return uc(O,B);let ut=`${ds}: ${ct.message}`;return B.trace?.recordGlobal({type:"error",message:ut}),{reason:ut,segment:O,intent:"stop_and_explain"}}return Ap(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"}}if(B.strict&&ee.status==="partial")return Ap(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"};if(ee.issues.some((ct)=>ct.code.includes("quote")))return uc(O,B);let je=B.cwd,at=B.effectiveCwd!==void 0?B.effectiveCwd:B.cwd,lt=am(B.environment.env,B.envAssignments);return Ds(ee,D,{...B,rootProgram:ee},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(B.literalHeredocFiles),functionDefinitions:new Map(B.functionDefinitions)}]).result}function Ds(O,D,B,Q,ee){let he=[...ee],je,at;for(let[lt,ct]of O.nodes.entries()){if(ct.kind==="connector"){at=ct.operator;continue}let ut=O.nodes[lt+1],ft=ut?.kind==="connector"?ut.operator:void 0,dt=h_(O,lt,ct,at,ft),mt=at==="&&"||at==="||",pt=mt?je:void 0,gt=at==="&&"?pt?.success??he:at==="||"?pt?.failure??he:he,ht=at==="||"?pt?.success??[]:[],yt=at==="&&"?pt?.failure??[]:[],Ct=mt||ao(ft);if(ct.kind==="function"){let Vt=gt.flatMap((Kt)=>{let Ft=lo(Kt);return Ft.functionDefinitions.set(ct.name,ct.body),ac(Kt,[Ft],dt,ft==="&",ao(ft))}),qt=lc(Vt,[],ht,yt,at,ft);he=qt.states,je=qt.conditionalStates,at=void 0;continue}if(ct.kind==="group"){let Vt=[],qt=[];for(let Ft of gt){let Ot=Ds(ct.body,D,B,Q,[lo(Ft)]);if(Ot.result)return Ot;if(Vt.push(...ac(Ft,Ot.states,dt,ft==="&",ao(ft))),Ct)qt.push(Ft,...dt?Ot.states.map((on)=>Os(Ft,on)):Ot.states)}let Kt=lc(Vt,qt,ht,yt,at,ft);he=Kt.states,je=Kt.conditionalStates,at=void 0;continue}if(ct.kind!=="command")continue;let Et=B.trace?.flattenNested?B.trace.currentSegmentIndex:B.trace?.allocateSegment(),vt=O.nodes[lt-2],Pt=Ns(at)&&vt?.kind==="command"?Pm(vt)??b_(vt):void 0,xt=[],_t=[];for(let Vt of gt){let qt=S_(ct,D,B,Q,[lo(Vt)]);if(qt.result)return{result:qt.result,states:he};let Kt=O.dialect==="powershell"?qt.states:qt.states.map((Ft)=>Os(Vt,Ft));for(let Ft of Kt){let Ot=lo(Ft),on=E_(ct,D,B.trace?{...B,trace:Tp(B.trace,Et)}:B,Q,Ot,Ns(at),Pt);if(on)return{result:on,states:he};let Cn=G_(ct,Ot.functionDefinitions);if(Cn)B.budget.charge("derivedTokens",Ls(Cn));let Un=Cn?D+1>=a.recursionDepth.cap?cc(ct.displayText,B,[Ot]):Ds(Cn,D+1,B,Q,[Ot]):{result:null,states:L_(ct,Ot)};if(Un.result)return Un;if(xt.push(...ac(Vt,Un.states,dt,ft==="&",ao(ft))),Ct)_t.push(Vt),_t.push(...Un.states.map((wn)=>dt?Os(Vt,wn):wn))}}let Ut=lc(xt,_t,ht,yt,at,ft);he=Ut.states,je=Ut.conditionalStates,at=void 0}return{result:null,states:he}}function h_(O,D,B,Q,ee){if(B.kind==="group"&&B.style==="subshell")return!0;if(O.dialect==="posix"&&(Ns(Q)||Ns(ee)))return!0;if(ee==="&")return!0;return O.dialect==="powershell"&&B.kind==="group"&&B.style==="brace"&&y_(O,D)}function ac(O,D,B,Q,ee){let he=B?D.map((at)=>Os(O,at)):[...D],je=ee?he.flatMap((at)=>so(O.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(O.literalHeredocFiles)},at]):he;return Q?[O,...je]:je}function Os(O,D){return{...O,literalHeredocFiles:new Map(D.literalHeredocFiles)}}function y_(O,D){let B=O.nodes.slice(0,D).reverse().find((ee)=>ee.kind==="command"||ee.kind==="connector");if(!B||B.kind!=="command")return!0;let Q=B.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(C_(B))return!0;return B.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Ns(O){return O==="|"||O==="|&"}function b_(O){if(O?.dialect!=="powershell")return;if(O.words.length===1&&O.words[0]?.quoted&&O.words[0].provenance==="literal")return O.words[0].text;if(O.words[0]?.text.toLowerCase()==="write-output"&&O.words.length===2&&O.words[1]?.provenance==="literal")return O.words[1].text;return}function ao(O){return O==="&&"||O==="||"}function lc(O,D,B,Q,ee,he){let je={success:Ms([...B,...O]),failure:Ms([...Q,...D])},at=ao(he)?je:void 0;return{states:ao(ee)||at?Ms([...je.success,...je.failure]):je.success,conditionalStates:at}}function Tp(O,D,B=O.flattenNested){return{currentSegmentIndex:D,flattenNested:B,allocateSegment:O.allocateSegment,getNextSegmentIndex:O.getNextSegmentIndex,recordGlobal:O.recordGlobal,recordSegment:(Q,ee=D)=>O.recordSegment(Q,ee)}}function S_(O,D,B,Q,ee){let he=O.nested.map((je)=>({program:je,depth:D}));if(O.dialect==="powershell"){let je=v_(O);if(je){if(D+1>=a.recursionDepth.cap)return cc(je,B,ee);let at=h(je,"powershell");if(at.status==="limited")return cc(je,B,ee);if(at.status!=="complete")return xp(he,B,Q,ee);B.budget.charge("derivedTokens",Ls(at)),he.push({program:at,depth:D+1})}}return xp(he,B,Q,ee)}function C_(O){let D=O.words[0];return D?.provenance==="variable"&&O.words.at(-1)?.text==="="?D.text.toLowerCase():void 0}function xp(O,D,B,Q){let ee=[...Q];for(let he of O){let je=[];for(let at of ee){let lt=Ds(he.program,he.depth,D,B,[lo(at)]);if(lt.result)return lt;je.push(...lt.states)}ee=Ms(je)}return{result:null,states:ee}}function v_(O){let D=O.words[0]?.provenance==="literal"&&!O.words[0].quoted&&O.words[0].raw===O.words[0].text&&(O.words[0].text==="&"||O.words[0].text==="."),B=D?1:0,Q=O.words[B];if(Q?.provenance!=="literal"||!D&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let ee=O.words.slice(B+1),he=ee[0]&&!ee[0].quoted&&ee[0].raw===ee[0].text&&["-c","-command"].includes(ee[0].text.toLowerCase())?1:0,je=ee[he];return ee.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Ls(O){return O.nodes.reduce((D,B)=>D+(B.kind==="command"?B.words.length+B.nested.reduce((Q,ee)=>Q+Ls(ee),0):B.kind==="group"||B.kind==="function"?Ls(B.body):0),0)}function cc(O,D,B){return D.trace?.recordSegment({type:"error",message:Gn}),{result:{reason:Gn,segment:O,intent:"stop_and_explain"},states:[...B]}}function E_(O,D,B,Q,ee,he,je){let at={...B,environment:{...B.environment,env:ee.shellGitContextState.env}},lt=T_(O,!at.strict);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:O.source,intent:"stop_and_explain"};Ip(O,ee,"before-consumer",at.environment.paths,at.budget);let ct=X(O.dialect,O.words),ut=ct.map(t),ft=O.displayText,dt=sm(ct,ee.shellGitContextState),mt=cm(dt,ee.shellGitContextState);if(O.dialect==="powershell"){let ht=wt(Nf(O,he,z_(at,ee.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ht,reason:ht?.reason}),ht)return F_(ft,ht)}if(ut.length===1&&ut[0]?.includes(" ")&&!_o(O.dialect,O.words)){let ht=wt(xn(ut[0]),at.policy),yt=ht!==null&&!at.strict&&Ld(O,at.rootProgram);if(ht&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!0,reason:ht.reason}),{reason:ht.reason,segment:ft,ruleId:ht.id,intent:ht.intent};at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!1});let Ct=Rp(O,lt,ee,mt,je,at);if(Ct)return Ct;return Ul(dt,ee.shellGitContextState),null}let pt=oo(O.words,D,{...at,commandView:O,cwd:Q,effectiveCwd:ee.effectiveCwd,envAssignments:mt,shellAssignments:ee.shellGitContextState.shellAssignments,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:ee.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(ht,yt)=>{let Ct=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:ee.effectiveCwd,Et=dc(ht,D+1,{...at,effectiveCwd:Ct,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?Tp(at.trace,at.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent}:null}});if(pt)return{...pt,segment:ft};let gt=Rp(O,lt,ee,mt,je,at);if(gt)return gt;return Ul(dt,ee.shellGitContextState),null}function Rp(O,D,B,Q,ee,he){let je=I_(O,D,B,Q??new Map,he);if(je)return je;return Ip(O,B,"after-consumer",he.environment.paths,he.budget),B.literalHeredocFiles.clear(),__(O,D,B,he.environment.paths,he.budget),M_(O,B,ee,he.environment,he.trace),null}var x_=new Set([">>","<>"]);function Ip(O,D,B,Q,ee){for(let je of O.redirections){if(!(B==="before-consumer"?R_(je):x_.has(je.operator)))continue;_p(je.target,D,Q,ee)}if(B!=="before-consumer"||!nn(O.words[0],"tee"))return;let he=kp(O.words.slice(1));if(!he)return;for(let je of he.operands)_p(je,D,Q,ee)}function R_(O){if(O.operator===">"||O.operator===">|")return!0;return O.operator===">&"&&O.fd===void 0&&O.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(O.target.text)}function _p(O,D,B,Q){let ee=O?.provenance==="literal"?Oo(O.text,D.effectiveCwd,B,Q):void 0;if(!ee)return;D.literalHeredocFiles.delete(ee)}function __(O,D,B,Q,ee){if(D)return;let he=O.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he)return;for(let je of w_(O)){let at=Oo(je.text,B.effectiveCwd,Q,ee);if(!at||!Fd(at))continue;if(!B.literalHeredocFiles.has(at)&&B.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");B.literalHeredocFiles.set(at,he.body)}}function w_(O){let D=A_(O.redirections)?.target,B=wp(D)?[D]:[];if(nn(O.words[0],"cat"))return P_(O.words)?B:[];if(!nn(O.words[0],"tee"))return[];let Q=kp(O.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(wp))return[];return[...Q.operands,...B]}function P_(O){let D=!1;for(let B of O.slice(1)){if(D||B.provenance!=="literal")return!1;if(B.text==="--"){D=!0;continue}if(!/^-u+$/.test(B.text))return!1}return!0}function A_(O){let D=O.findLast((B)=>(B.fd??([">",">|",">>",">&"].includes(B.operator)?1:0))===1);return D?.operator===">"||D?.operator===">|"?D:void 0}function kp(O){let D=[],B=!0,Q=!1,ee=!1;for(let he of O){if(he.provenance!=="literal")return;if(B&&nn(he,"--")){B=!1;continue}if(B&&!he.quoted&&he.raw===he.text&&/^-[^-]/.test(he.text)){Q||=he.text.slice(1).includes("a"),ee||=Array.from(he.text.slice(1)).some((je)=>je!=="a"&&je!=="i");continue}if(B&&!he.quoted&&he.raw===he.text&&he.text.startsWith("--")){Q||=he.text==="--append",ee||=he.text!=="--append"&&he.text!=="--ignore-interrupts";continue}D.push(he)}return{operands:D,append:Q,hasUnsupportedOptions:ee}}function wp(O){if(!O||O.provenance!=="literal"||O.text.length===0)return!1;if(O.quoted||O.raw!==O.text)return!0;return!O.raw.startsWith("~")&&!/[{}]/.test(O.raw)}function nn(O,D){return O?.text===D&&O.raw===D&&O.provenance==="literal"&&!O.quoted}function fc(O){return O.quotedDelimiter||!/[$`\\]/.test(O.body)}function T_(O,D){let B=O.redirections.filter((at)=>at.operator==="<<"||at.operator==="<<-");if(B.length===0)return;if(B.length!==1)return Or;let Q=B[0];if(!Q?.heredoc)return Or;if(!fc(Q.heredoc)&&!(D&&!/\$\(|`/.test(Q.heredoc.body)))return g_;if(Q.fd!==void 0&&Q.fd!==0)return Or;if(O.redirections.some((at)=>at!==Q&&["<","<<","<<-","<<<","<&","<>"].includes(at.operator)))return Or;let ee=O.redirections.some((at)=>at!==Q&&Pp(at.target));if(nn(O.words[0],"cat"))return ee?Or:void 0;if(nn(O.words[0],"tee"))return ee||O.words.slice(1).some(Pp)?Or:void 0;let he=O.words[0],je=O.words[1];if(nn(he,"git")&&(nn(je,"apply")||nn(je,"commit")))return;if(nn(he,"gh")&&(nn(je,"pr")||nn(je,"issue"))&&nn(O.words[2],"create"))return;return Or}function Pp(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}function I_(O,D,B,Q,ee){if(!D)return null;let he=O.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(O_(O,he,B,Q,ee))return null;let at=k_(O,he,ee);if(at!==void 0)return at?{reason:at.reason,segment:O.displayText,ruleId:at.id,intent:at.intent}:null;let lt=uc(je.length===he.length?je.join(`
+`):O.source,ee);return lt?{...lt,segment:O.displayText}:null}function k_(O,D,B){let Q=D.length===1?D[0]:void 0;if(!Q?.heredoc||!fc(Q.heredoc)||Q.fd!==void 0&&Q.fd!==0)return;let ee=nn(O.words[0],"uv")&&nn(O.words[1],"run")?O.words.slice(2):O.words,he=ee[0];if(he?.provenance!=="literal"||!An(he.text))return;let je=ee.findIndex((ft)=>nn(ft,"-"));if(!ee.slice(1,je===-1?void 0:je).every((ft)=>ft.provenance==="literal"&&ft.text.startsWith("-")))return;let lt=Q.heredoc.body,ct=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(B.trace?.recordSegment({type:"interpreter",interpreter:he.text,codeArg:lt,paranoidBlocked:ct}),ct){let ft=wt(St("interpreter.one-liner-paranoid",Mo),B.policy);if(ft)return ft}if(!Do(lt,void 0,!B.strict))return null;let ut=wt(St("interpreter.dangerous-command",Kr),B.policy);if(!ut)return null;return B.trace?.recordSegment({type:"dangerous-text",token:lt,matched:!0,reason:ut.reason}),ut}function O_(O,D,B,Q,ee){let he=D.length===1?D[0]:void 0;if(!he?.heredoc||!fc(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=Cr(O.words,ee.environment,B.effectiveCwd,Q),at=je.words.map(t),lt=It(at[0]??"");if((je.envSplitValues?.length??0)>0||!Ht.has(lt)&&!Ht.has(At(lt)))return!1;return Yn(at)}function M_(O,D,B,Q,ee){let he=Cp(O,D.effectiveCwd,Q,D.shellGitContextState.shellAssignments,B);if(he===null)ee?.recordSegment({type:"cwd-change",segment:O.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)D.effectiveCwd=he}var D_=/^[A-Za-z_][A-Za-z0-9_]*$/,N_=8;function L_(O,D){let B=O.words[1]?.text;if(O.dialect!=="posix"||O.words[0]?.text!=="for"||B===void 0||!D_.test(B))return[D];let Q=O.words.slice(3);if(!(O.words[2]?.text==="in"&&Q.length>=1&&Q.length<=N_&&Q.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return D.shellGitContextState.shellAssignments.delete(B),[D];return Q.map((he)=>{let je=lo(D);return je.shellGitContextState.shellAssignments.set(B,he.text),je})}function lo(O){return{effectiveCwd:O.effectiveCwd,shellGitContextState:lm(O.shellGitContextState),literalHeredocFiles:new Map(O.literalHeredocFiles),functionDefinitions:new Map(O.functionDefinitions)}}function Ms(O){let D=[];for(let B of O){if(!D.some((Q)=>W_(Q,B)))D.push(B);if(D.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return D}function W_(O,D){return O.effectiveCwd===D.effectiveCwd&&so(O.shellGitContextState.env,D.shellGitContextState.env)&&so(O.literalHeredocFiles,D.literalHeredocFiles)&&so(O.functionDefinitions,D.functionDefinitions)&&so(O.shellGitContextState.effectiveEnvAssignments,D.shellGitContextState.effectiveEnvAssignments)&&so(O.shellGitContextState.shellAssignments,D.shellGitContextState.shellAssignments)&&O.shellGitContextState.bodyDepth===D.shellGitContextState.bodyDepth&&O.shellGitContextState.bodyAssignments.size===D.shellGitContextState.bodyAssignments.size&&[...O.shellGitContextState.bodyAssignments].every((B)=>D.shellGitContextState.bodyAssignments.has(B))}function so(O,D){if(O===D)return!0;if(!O||!D||O.size!==D.size)return!1;return[...O].every(([B,Q])=>D.get(B)===Q&&D.has(B))}function G_(O,D){let B=wo(O);return B===void 0?void 0:D.get(B)}function F_(O,D){if(!D)return null;return{reason:D.reason,segment:O,ruleId:D.id,intent:D.intent}}function z_(O,D=O.effectiveCwd){let B=D===null;return{environment:O.environment,cwd:B?void 0:D??O.cwd,originalCwd:B?void 0:O.cwd,strict:O.strict,paranoid:O.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.protectedGitMetadata,policy:O.policy,budget:O.budget}}function uc(O,D){let B=wt(xn(O),D.policy),Q=D.trace?.currentSegmentIndex??D.trace?.allocateSegment(),ee={type:"dangerous-text",token:O,matched:!!B,reason:B?.reason};if(D.trace?.recordSegment(ee,Q),!B&&/^(?:cd|pushd)\s/.test(O))D.trace?.recordSegment({type:"cwd-change",segment:O,effectiveCwdNowUnknown:!0},Q);return B?{reason:B.reason,segment:O,ruleId:B.id,intent:B.intent}:null}function Ap(O,D){let B={type:"strict-unparseable",rawCommand:O,reason:Xr},Q=D.trace?.currentSegmentIndex;if(Q===void 0)D.trace?.recordGlobal(B);if(Q!==void 0)D.trace?.recordSegment(B)}var B_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Op(O,D,B,Q){let ee=dc(O,0,{...D,...Fe(D),budget:D.budget??mn(),factStore:Q},B);if(!ee)return null;return{kind:"deny",reason:ee.reason,intent:ee.intent??"manual_only",...ee.ruleId?{ruleId:ee.ruleId}:{},evidence:{command:O,segment:ee.segment}}}function Mp(O,D,B){try{return{decision:O()}}catch(Q){let ee=$_(Q,D,B);if(!ee)throw Q;return ee}}function $_(O,D,B){if(!(O instanceof s)||!B_.has(O.kind))return null;let Q=a[O.kind];if(B?.currentSegmentIndex!==void 0)B.recordSegment({type:"error",message:Q.reason});if(B?.currentSegmentIndex===void 0)B?.recordGlobal({type:"error",message:Q.reason});return{decision:{kind:"deny",reason:Q.reason,intent:"stop_and_explain",evidence:{command:D,segment:D}},errorCode:Q.errorCode}}var U_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),pc=new Set(["cc-safety-net","ccsn"]),H_=new Set(["bunx","npx","pnpx"]),j_=new Set(["pnpm","yarn"]),V_=new Set(["npm","pnpm","yarn"]),K_=new Set(["bun","node"]);function Gs(O,D,B={}){if(pc.has(O))return 0;if(H_.has(O)){if(B.broad)return mc(D);let ee=D[0]==="-y"||D[0]==="--yes"?1:0;return Ws(D[ee])?ee+1:null}let Q=B.broad?D.findIndex((ee)=>!ee.startsWith("-")):0;if(Q!==-1&&V_.has(O)&&B.broad&&D[Q]==="exec"){let ee=mc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(j_.has(O)){if(O==="yarn"&&!B.broad)return null;if(!B.broad)return D[0]==="dlx"&&Ws(D[1])?2:null;if(Q===-1||D[Q]!=="dlx")return null;let ee=mc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(K_.has(O)){let ee=B.broad&&Q!==-1?Q:0;if(Dp(D[ee]))return ee+1;if(O==="bun"&&D[ee]==="run"&&Dp(D[ee+1]))return ee+2}return null}function mc(O){let D=O.findIndex((Q)=>Ws(Q));if(D===-1)return null;let B=D;while(B<O.length){let Q=O[B]??"";if(!Q.startsWith("-")&&!Ws(Q))break;B++}return B}function Ws(O){if(!O)return!1;let D=O.indexOf("@");if(D===-1)return pc.has(O);if(D===0)return!1;let B=O.slice(D+1);if(B===""||B.includes("/")||B.includes(":"))return!1;return pc.has(O.slice(0,D))}function Dp(O){let D=O?.replaceAll("\\","/");return[...U_].some((B)=>D===B||D?.endsWith(`/${B}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Np(O,D,B){let Q=un(O,"input-candidate");if(!Q)return null;let ee=Yr(Q.shell,O.invocation.context.executionCwd,D,B,{findSegmentTarget:(he)=>q_(he,D),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ee?{target:ee}:null}function q_(O,D){let B=or([...O],D),Q=B.slice(1),ee=Gs(At(B[0]??"").toLowerCase(),Q,{broad:!0});if(ee===null)return null;let he=Q.slice(ee).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?B.join(" "):null}import{dirname as Fs}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",Y_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Fp(O,D,B){let Q=tw(O.invocation.context,D,B);if(O.invocation.route.kind==="patch")return Lp(O.paths,!1,O.invocation.context.executionCwd,Q,D,B);let ee=un(O,"input-candidate");if(O.invocation.route.kind==="command")return ee?Wp(ee.shell,O.invocation.context.executionCwd,Q,D,B):null;if(O.invocation.route.kind==="unknown"&&ee){let he=Wp(ee.shell,O.invocation.context.executionCwd,Q,D,B);if(he)return he}return Lp(O.paths,O.invocation.route.kind==="grep"||O.invocation.route.kind==="glob"||fi(O.invocation.toolName),O.invocation.context.executionCwd,Q,D,B)}function Lp(O,D,B,Q,ee,he){if(D)return null;let je=O.find((at)=>ni(at,B,Q,ee,he));return je?{target:je}:null}function Wp(O,D,B,Q,ee){let he=Yr(O,D,Q,ee,{findSegmentTarget:(je,at)=>Z_(je,at,B,Q,ee)?.target??null,isRedirectionTarget:(je,at)=>ni(je,at.cwd,B,Q,ee),findMalformedTarget:(je)=>ew(je,D,B,Q,ee)?.target??null});return he?{target:he}:null}function Z_(O,D,B,Q,ee){if(Fo(O))return null;let he=ir([...O],Q),je=At(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&X_(at)){let lt=J_(at).find((ct)=>Gp(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(je==="find"){if(ys(he,1)||Dl(he,Q)){let ct=(qo($t(he))??$t(["."])).find((ut)=>{let ft=cn(ut.text,D.variables);return ni(ft,D.cwd,B,Q,ee)||Gp(ft,D.cwd,B,Q,ee)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=rs(at).sources.find((ct)=>nw(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(Q_(he,je))return null;for(let lt of[...O,...he])for(let ct of zp(lt))if(ni(cn(ct,D.variables),D.cwd,B,Q,ee))return{target:ct};return null}function X_(O){return O.some((D)=>D==="--recursive"||D.startsWith("-")&&!D.startsWith("--")&&/[rR]/.test(D.slice(1)))}function J_(O){let D=O.indexOf("--");if(D!==-1)return[...O.slice(0,D).filter((B)=>!B.startsWith("-")),...O.slice(D+1)];return O.filter((B)=>!B.startsWith("-"))}function Q_(O,D){if(!Y_.has(D))return!1;if(D!=="sed")return!0;return!O.slice(1).some((B)=>B.startsWith("-i")||B==="--in-place"||B.startsWith("--in-place="))}function ew(O,D,B,Q,ee){for(let he of O.split(/\s+/))for(let je of zp(he))if(ni(je,D,B,Q,ee))return{target:je};return null}function zp(O){let D=O.trim().replace(/^['"]|['"]$/g,""),B=D.indexOf("=");return B===-1||B===D.length-1?[D]:[D,D.slice(B+1)]}function tw(O,D,B){let Q=(at)=>ri(tn(at,O.executionCwd,D,B)),ee=Q(u(D)),he=[Q(b(O.executionCwd)),Q(b(O.configCwd))],je=new Set(he.map((at)=>Fs(at)));for(let at=Fs(ee);;at=Fs(at))if(je.add(at),Fs(at)===at)break;return{files:new Set([ee,...he]),directoriesAndAncestors:je}}function ni(O,D,B,Q,ee){let he=Nc(O,D,Q,ee,(je)=>ri(je)===bi);return he!==null&&B.files.has(ri(he))}function Gp(O,D,B,Q,ee){return B.directoriesAndAncestors.has(ri(tn(O,D,Q,ee)))}function nw(O,D,B,Q,ee){let he=ri(tn(O,D,Q,ee));return B.files.has(he)||B.directoriesAndAncestors.has(he)}function ri(O){return process.platform==="win32"?O.toLowerCase():O}import{isAbsolute as zs,posix as Jp,resolve as $s,win32 as rw}from"node:path";import{fileURLToPath as ow}from"node:url";var Qp="Access to a sensitive path is not allowed.",eg=new Set(["echo","printf"]),iw=new Set(["find"]),sw=new Set(["!","do","elif","else","if","then","until","while"]),aw=new Set(["-exec","-execdir"]),lw=new Set([";","+"]),cw=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),uw=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),tg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),dw=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),fw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),ng=new Set(["-c","-e","-r","-E","--eval","--exec"]),mw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),pw=new Set(["grep","rg"]),gw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),hw=new Set(["commit","merge","notes","stash","tag"]),yw=new Set(["-m","--message"]),bw=new Set(["--grep"]),Bp=new Set(["jq","gojq","jaq"]),$p="f",Up="file",Sw="files",Cw=new Set(["e","f"]),vw=new Set(["regexp","file"]),Ew=new Set(["e","f","A","B","C","m"]),xw=new Set(["regexp","file","after-context","before-context","context","max-count"]),gc="__CC_SAFETY_NET_PIPE_INPUT__",yc=/[\w./~@+-]*[./~][\w./~@+-]*/g,Rw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,_w=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,ww=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Hp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,jp=/\b(?:system|exec|spawn|popen)\s*$/,Pw=/\b(?:eval|exec)\s*\(/g,Aw=/\b(?:eval|exec)\s*$/,Tw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Vp(O,D,B,Q,ee,he){for(let je of O){let at=je.target;if(wP(at,je.cwd,D?.denyPaths??[],B,Q,ee))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=RP(at,je.cwd,D,Q,ee);if(lt){let ct=!lt.startsWith("secret.home.")&&!lt.startsWith("secret.cli.");if(he&&(ct&&Q.paths.isDirectory(cg(at,je.cwd,Q,ee))||ct&&je.written===!0&&!at.includes("$")&&!Sc(at,je.cwd,Q,ee)||ct&&/\s/.test(at)&&!at.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(at)&&!Sc(at,je.cwd,Q,ee)))continue;if(!lt.startsWith("secret.cli.")&&PP(at,je.cwd,D?.allowPaths??[],B,Q,ee))continue;return{target:at,ruleId:lt}}}return null}function rg(O,D,B,Q,ee={}){let he=Kp(O,B,Q),je=Vp(he,D,O.invocation.context.configCwd,B,Q);if(je===null||je.ruleId==="secret.deny-path"||ee.strict!==!1)return je;let at=Vp(he,D,O.invocation.context.configCwd,B,Q,new Set(Kp(O,B,Q,{standard:!0}).map((lt)=>lt.target)));return at?.ruleId!=="secret.deny-path"&&Iw(O,B)?null:at}function Iw(O,D){let B=un(O,"input-candidate")??un(O,"declared-command");if(!B)return!1;if(B.program.nodes.some((je)=>je.kind==="command"&&je.nested.length>0))return!1;let Q=[];for(let je of ns(B.shell)){if(je.kind==="operator"&&je.boundary)return!1;if(je.kind==="redirection")return!1;if(je.kind==="operator")continue;Q.push(qn(je.text,D))}let ee=Qn(Q);if(ee.length===0)return!1;let he=Wn(ee[0]??"").toLowerCase();if(O.invocation.route.kind==="unknown")return B.program.dialect==="powershell"&&(he==="ls"||he==="stat");return Cc(he,ee.slice(1))}function Cc(O,D){if(O==="ls"||O==="stat")return!0;if(O==="test")return D.length===2&&(D[0]==="-e"||D[0]==="-f");if(O==="[")return D.length===3&&(D[0]==="-e"||D[0]==="-f")&&D[2]==="]";if(O==="git")return D[0]==="check-ignore";if(O!=="find")return!1;return!D.some((B)=>cw.has(B))}function Kp(O,D,B,Q={}){let ee=O.invocation.context.executionCwd,he=O.invocation.route.kind;if(he!=="command"&&he!=="unknown")return O.paths.map((at)=>({target:at,cwd:ee}));let je=un(O,"input-candidate");return[...je?co(je.shell,O.store,Q,D,ee,B,kw(je)):[],...he==="unknown"?O.paths.map((at)=>({target:at,cwd:ee})):[]]}function kw(O){return O.program.dialect==="powershell"}function co(O,D,B,Q,ee,he,je=!1){if(O.status==="structural-limit")throw new y;if(O.status==="unclosed-quote")return[];if(O.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...O.assignmentFallbacks.map((ct)=>({target:ct,cwd:ee})),...aP(qn(O.source,Q),D,B,Q,ee,he)],lt=(ct)=>qn($w(ct,je),Q);return ts(O,ee,Q,he,{word:lt,segment:(ct,ut,ft,dt,mt)=>{if(ct.length===0)return null;if(at.push(...Us(ct,D,B,Q,ut.cwd,he,mt)),ft!==null)at.push(...Mw(ft,ct,D,B,Q,ut.cwd,he));return null},redirection:(ct,ut)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...og(ct.consumer,[ct.body],D,B,Q,ut.cwd,he,(ft)=>Dw(ct.consumer??[],ft,D,B,Q,ut.cwd,he)));if(ct.targetOrder==="legacy-segment")return hl;return at.push({target:lt(ct.target),cwd:ut.cwd,...ct.role==="file-write"?{written:!0}:{}}),null}}),at}function vc(O,D,B,Q,ee,he){let je=D.getShellSyntax(O);if(je.status==="structural-limit")throw new y;return je.status==="complete"?co(je,D,B,Q,ee,he):null}function Us(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:ee});if(je?.size){let gt=O.filter((ht,yt)=>!je.has(yt));if(Bp.has(Wn(Qn(gt)[0]??"").toLowerCase()))return[...O.filter((ht,yt)=>je.has(yt)).map(at),...Us(gt,D,B,Q,ee,he)]}let lt=Bw(O).map(at),ct=Qn(O);if(ct.length===0)return lt;let ut=ct[0]??"",ft=Wn(ut).toLowerCase(),dt=ct.slice(1),mt=ct.findIndex((gt)=>!sw.has(gt));if(B.standard===!0&&mt!==-1&&Cc(Wn(ct[mt]??"").toLowerCase(),ct.slice(mt+1)))return lt;let pt=Ow(ut,ft,dt);if(pt)return[...lt,...pt.map(at)];if(eg.has(ft))return B.capturedOutput===!0?[...lt,...ig(O).map(at)]:lt;if(ft==="eval")return[...lt,...vc(dt.join(" "),D,B,Q,ee,he)??dt.map(at)];if(ft==="export")return[...lt,...dt.flatMap((gt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(gt)?[gt.slice(gt.indexOf("=")+1)]:$n(ft,gt)).map(at)];if(ft==="git")return[...lt,...Hw(dt).map(at)];if(ft==="gh")return[...lt,...bc(ft,dt,gw).map(at)];if(Bp.has(ft))return[...lt,...Uw(dt).map(at)];if(pw.has(ft))return[...lt,...gP(dt).map(at)];if(iw.has(ft))return[...lt,...qw(dt,D,B,Q,ee,he).map(at)];if(En.has(ft))return[...lt,...dt.flatMap((gt)=>$n("awk",gt)).map(at),...dt.flatMap((gt)=>Zw(gt,D,B,Q,ee,he)),...dt.flatMap(Xw).map(at)];if(ft==="curl")return[...lt,...dt.flatMap((gt)=>$n(ft,gt)).map(at),...jw(dt).map(at)];if(zo(ft)){let gt=Go.has(ft)?hn([ft,...dt]):null;if(gt!==null&&gt.command!==null&&gt.commandIndex!==null){let ht=D.getShellSyntax(gt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...co(ht,D,B,Q,ee,he),...dt.slice(gt.commandIndex).filter((yt)=>!yt.startsWith("-")).map(at)]}return[...lt,...Yw(ft,dt,D,B,Q,ee,he)]}return[...lt,...dt.flatMap((gt)=>$n(ft,gt)).map(at)]}function Ow(O,D,B){let Q=Gs(D,B);if(Q===null||B[Q]!=="explain")return null;let ee=[O,...B.slice(0,Q)],he=B.slice(Q+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))ee.push(lt);je++;continue}return ee}return ee}function Mw(O,D,B,Q,ee,he,je){if(Gw(D,B,Q,ee,he,je)){let at=Qn(O),lt=Cc(Wn(at[0]??"").toLowerCase(),at.slice(1))?at.slice(1).filter((ct)=>!ct.startsWith("-")):[];return[...ig(O),...lt].map((ct)=>({target:ct,cwd:he}))}return og(D,Nw(O),B,Q,ee,he,je,()=>[])}function Dw(O,D,B,Q,ee,he,je){let at=Qn(O);if(!zo(Wn(at[0]??"").toLowerCase()))return[];return vc(D,B,Q,ee,he,je)??[{target:D,cwd:he}]}function og(O,D,B,Q,ee,he,je,at){let lt=Fw(O);if(lt===null)return D.flatMap(at);return D.flatMap((ct)=>Go.has(lt)?co(B.getShellSyntax(ct),B,Q,ee,he,je):Bs(lt,ct,B,Q,ee,he,je))}function ig(O){let D=Qn(O);if(D.length===0)return[];let B=Wn(D[0]??"").toLowerCase();if(!eg.has(B))return[];let Q=D[D[1]==="--"?2:1];if(B==="printf"&&Q!==void 0&&!Q.startsWith("-")&&!Q.replaceAll("%%","").includes("%"))return[Ec(Q.replaceAll("%%","%"))];return D.slice(1)}function Nw(O){let D=Qn(O);if(D.length===0)return[];let B=Wn(D[0]??"").toLowerCase(),Q=D.slice(1);if(B==="echo"){let ee=Q.findIndex((he)=>!/^-[neE]+$/.test(he));return[(ee===-1?[]:Q.slice(ee)).join(" ")]}if(B==="printf")return Lw(Q);return[]}function Lw(O){let D=O[0];if(D===void 0)return[];let B=(D.match(/%%|%[bqs]/g)??[]).filter((ee)=>ee!=="%%").length;if(B===0||O.length===1)return[Ec(D)];let Q=O.slice(1);return Array.from({length:Math.ceil(Q.length/B)},(ee,he)=>Ww(D,Q.slice(he*B,(he+1)*B)))}function Ww(O,D){let B=0;return Ec(O.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let ee=D[B]??"";return B++,ee}))}function Ec(O){return O.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Gw(O,D,B,Q,ee,he){let je=Qn(O);if(je.length===0||Wn(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Ir(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,ut=ct===null?[...lt,gc]:lt.map((ft)=>ft.split(ct).join(gc));return Us(ut,D,B,Q,ee,he).some((ft)=>ft.target.includes(gc))}function Fw(O){let D=Qn(O);if(D.length===0)return null;let B=Wn(D[0]??"").toLowerCase();if(!zo(B))return null;return zw(B,D.slice(1))?B:null}function zw(O,D){let B=xc(O);for(let Q=0;Q<D.length;Q++){let ee=D[Q];if(ee===void 0)break;if(ng.has(ee)||sg(O,ee)||/^--(?:eval|exec)=/.test(ee))return!1;if(ee==="-")return!0;if(ee.startsWith("-")){if(B==="python"&&ee==="-m")return!1;if(Tw.get(B)?.has(ee))Q++;continue}return!1}return!0}function xc(O){return/^python\d/.test(O)?"python":O}function Bw(O){let D=[];for(let B of O){if(lg(B))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(B);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")D.push(Q[1])}return D}var qp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function $w(O,D){if(!D||!qp.test(O))return O;return`~${O.replace(qp,"").replace(/\\/g,"/")}`}function $n(O,D){if(D==="--")return[];let B=[],Q=D.indexOf("=");if(Q>0&&Q<D.length-1)B.push(D.slice(Q+1));if(D.startsWith("-"))return B;if(O==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(D))return B;if(O==="zip"&&/\.zip$/i.test(D))return B;return B.push(D),B}function Uw(O){let D=-1,B=!1;for(let Q=0;Q<O.length;Q++){let ee=O[Q]??"";if(!B&&ee==="--"){B=!0;continue}if(B||!/^-(?:[A-Za-z]|-)/.test(ee)){if(D===-1)D=Q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ee)){Q+=2;continue}if(ee==="--indent"||ee==="-L"){Q++;continue}if(ee.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ee)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ee))continue;return O.flatMap((he)=>$n("jq",he))}return O.flatMap((Q,ee)=>ee===D?[]:$n("jq",Q))}function Hw(O){let D=[];for(let B=0;B<O.length;B++){let Q=O[B]??"";if(Q==="--"||!Q.startsWith("-"))return[...D,...hw.has(Q)?bc("git",O.slice(B).map((he)=>/^-[aeinopqsv]+m$/.test(he)?"-m":he),yw):bc("git",O.slice(B),bw)];if(D.push(...$n("git",Q)),!gn.has(Q))continue;let ee=O[B+1];if(ee===void 0)break;D.push(...Q==="-c"&&ee.includes("=")?[ee.slice(ee.indexOf("=")+1)]:$n("git",ee)),B++}return D}function bc(O,D,B){let Q=[];for(let ee=0;ee<D.length;ee++){let he=D[ee]??"";if(he==="--")return[...Q,...D.slice(ee).flatMap((je)=>$n(O,je))];if(B.has(he)){ee++;continue}if(he.includes("=")&&B.has(he.slice(0,he.indexOf("="))))continue;Q.push(...$n(O,he))}return Q}function jw(O){return O.flatMap((D,B)=>{let Q=Kw(D);if(Q!==null)return Yp(Q.flag,Q.value);let ee=Vw(O[B-1]);return ee===null?[]:Yp(ee,D)})}function Yp(O,D){if(O==="-F"||O==="--form"){let B=D.indexOf("="),Q=B===-1?D:D.slice(B+1);if(!Q.startsWith("@")&&!Q.startsWith("<"))return[];return hc(Q.slice(1).split(";")[0]??"")}if(O==="--data-urlencode"){let B=D.indexOf("@"),Q=D.indexOf("=");if(B===-1||Q!==-1&&Q<B)return[];return hc(D.slice(B+1))}return D.startsWith("@")?hc(D.slice(1)):[]}function Vw(O){if(O===void 0)return null;if(tg.has(O))return O;return/^-[A-Za-z]+[dF]$/.test(O)?`-${O.slice(-1)}`:null}function Kw(O){let D=O.slice(0,2);if(O.length>2&&(D==="-d"||D==="-F"))return{flag:D,value:O.slice(2)};let B=O.indexOf("=");if(B===-1)return null;let Q=O.slice(0,B);return tg.has(Q)?{flag:Q,value:O.slice(B+1)}:null}function hc(O){return O===""||O==="-"?[]:[O]}function qw(O,D,B,Q,ee,he){let je=O.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...O.slice(0,je===-1?O.length:je),...O.flatMap((lt,ct)=>lt==="-files0-from"&&O[ct+1]!==void 0?[O[ct+1]??""]:[])];for(let lt=0;lt<O.length;lt++){if(!aw.has(O[lt]??""))continue;let ct=O.slice(lt+1),ut=ct.findIndex((mt)=>lw.has(mt)),ft=ut===-1?ct:ct.slice(0,ut),dt=Us(ft,D,B,Q,ee,he).map((mt)=>mt.target);if(at.push(...dt.filter((mt)=>mt!=="{}")),!dt.includes("{}"))continue;at.push(...O.slice(0,lt).flatMap((mt,pt,gt)=>{if(!uw.has(mt))return[];let ht=gt[pt+1];return ht===void 0?[]:[ht,ht.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function Yw(O,D,B,Q,ee,he,je){let at=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(ng.has(ct)||sg(O,ct)){let ft=D[lt+1];if(ft!==void 0)at.push(...Bs(O,ft,B,Q,ee,he,je)),lt++;continue}let ut=/^--(?:eval|exec)=(.*)$/.exec(ct);if(ut!==null&&ut[1]!==void 0){at.push(...Bs(O,ut[1],B,Q,ee,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function sg(O,D){if(!D.startsWith("-")||D.startsWith("--")||D.length<=2)return!1;return mw.get(D[D.length-1]??"")?.has(xc(O))??!1}function Zw(O,D,B,Q,ee,he){if(!O.includes("system"))return[];return Il(O)?.commands.flatMap((je)=>co(D.getShellSyntax(je),D,B,Q,ee,he))??[]}function Xw(O){return Array.from(O.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((D)=>D[1]).filter((D)=>D!==void 0&&D!=="")}function Jw(O){let D=Array.from(O.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((B)=>B[2]).filter((B)=>B!==void 0&&B!=="");return[...D,...D.flatMap(Rc),...O.match(yc)??[]]}function Bs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:he}),lt=eP(D,Qw(O));if(lt===null)return Jw(D).map(at);let ct=lt.masked.match(Hp)!==null||lt.literals.some((gt)=>jp.test(lt.masked.slice(0,gt.start))),ut=lt.masked.match(Pw)!==null||lt.literals.some((gt)=>Aw.test(lt.masked.slice(0,gt.start))),ft=Q.standard===!0&&!Go.has(O),dt=ft&&!(oP(lt.masked)||ct||ut)?[]:lt.literals,mt=ft?Array.from(lt.masked.matchAll(Hp),(gt)=>{let ht=gt.index+gt[0].length;return{start:ht,end:cl(lt.masked,ht)}}):[],pt=!ft||mt.some((gt)=>ul(lt.masked,gt.start))?lt.literals:lt.literals.filter((gt)=>jp.test(lt.masked.slice(0,gt.start))||mt.some((ht)=>gt.start>=ht.start&&gt.start<ht.end));return[...dt.map((gt)=>gt.text).filter((gt)=>gt!=="").map(at),...dt.flatMap((gt)=>Rc(gt.text)).map(at),...ft?[]:lt.literals.flatMap((gt)=>gt.text.match(yc)??[]).map(at),...ct?pt.flatMap((gt)=>vc(gt.text,B,Q,ee,he,je)??[at(gt.text)]):[],...ut?lt.literals.flatMap((gt)=>Bs(O,gt.text.replace(/\\(.)/g,(ht,yt)=>yt==="n"?`
+`:yt),B,Q,ee,he,je)):[],...(lt.masked.match(yc)??[]).map(at)]}function Qw(O){let D=xc(O);if(D==="python")return"python";if(D==="osascript")return"opaque";return D==="node"||D==="bun"||D==="deno"?"javascript":"simple"}function eP(O,D){if(D==="opaque")return null;let B=O.split(""),Q=[];for(let ee=0;ee<O.length;ee++){let he=O[ee]??"";if(D==="simple"&&(he==="`"||he==="%"||he==="<")){if(_w.test(O.slice(ee)))return null}let je=he==="'"||he==='"'||D==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&rP(O,ee))return null;let at=D==="python"?tP(O,ee):"",lt=D==="python"&&O.startsWith(je.repeat(3),ee)?je.repeat(3):je,ct=ee+lt.length,ut=nP(O,ct,lt);if(ut===null)return null;let ft=O.slice(ct,ut);if(/[fF]/.test(at)&&ft.includes("{"))return null;if(D==="simple"&&je==='"'&&ww.test(ft))return null;Q.push({start:ct,text:ft});for(let dt=ee;dt<ut+lt.length;dt++)B[dt]=" ";ee=ut+lt.length-1}return{masked:B.join(""),literals:Q}}function tP(O,D){return Rw.exec(O.slice(Math.max(0,D-3),D))?.[1]??""}function nP(O,D,B){let Q=B==="`",ee=Q||B.length===3;for(let he=D;he<O.length;he++){let je=O[he];if(je==="\\"){he++;continue}if(Q&&je==="$"&&O[he+1]==="{")return null;if(!ee&&(je===`
+`||je==="\r"))return null;if(O.startsWith(B,he))return he}return null}function rP(O,D){for(let B=D-1;B>=0;B--){let Q=O[B];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function oP(O){for(let D of O.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let B=D[0],Q=D.index;if(dw.has(B.toLowerCase()))return!0;let ee=B.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!ee.some((he)=>fw.has(he)))continue;if(ee.length>1)return!0;if(iP(O,Q)===".")return!0;if(sP(O,Q+B.length)==="(")return!0}return!1}function iP(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return O[B];return}function sP(O,D){for(let B=D;B<O.length;B++)if(!/\s/.test(O[B]??""))return O[B];return}function aP(O,D,B,Q,ee,he){return fP(O).flatMap((je)=>{let at=D.getShellSyntax(je);if(at.status==="invalid")return[];return[...co(at,D,{...B,capturedOutput:!0},Q,ee,he),...lP(at,Q)?cP(at,Q).map((lt)=>({target:lt,cwd:ee})):[]]})}function lP(O,D){let B=ns(O);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee?.kind!=="word"||Wn(qn(ee.text,D)).toLowerCase()!=="base64")continue;for(let he=Q+1;he<B.length;he++){let je=B[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=qn(je.text,D);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function cP(O,D){return ns(O).flatMap((B)=>B.kind==="word"?[qn(B.text,D)]:B.kind==="redirection"&&B.target?[qn(B.target,D)]:[]).flatMap(Rc)}function Rc(O){let D=dP(O);if(D===null)return[];let B=Buffer.from(D,"base64").toString("utf8");if(B===""||uP(B))return[];return Buffer.from(B,"utf8").toString("base64").replace(/=+$/g,"")===D.replace(/=+$/g,"")?[B]:[]}function uP(O){return Array.from(O).some((D)=>{let B=D.charCodeAt(0);return B<32||B===127})}function dP(O){if(O.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(O))return null;if(/=/.test(O.replace(/=+$/g,"")))return null;let D=O.replace(/=+$/g,"");if(D.length%4===1)return null;return`${D.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-D.length%4)%4)}`}function fP(O){let D=[],B={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(vo(ee,B))continue;if(ag(O,Q,B)){let he=mP(O,Q+1);if(he!==null)D.push(he.body),Q=he.endIndex;continue}if(!B.inSingle&&ee==="`"){let he=pP(O,Q);if(he!==null)D.push(he.body),Q=he.endIndex}}return D}function mP(O,D){let B={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let ee=D+1;ee<O.length;ee++){let he=O[ee];if(!he)break;if(vo(he,B))continue;if(ag(O,ee,B)){Q++,ee++;continue}if(!B.inSingle&&!B.inDouble&&he===")"){if(Q--,Q===0)return{body:O.slice(D+1,ee),endIndex:ee}}}return null}function pP(O,D){let B=!1;for(let Q=D+1;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="`")return{body:O.slice(D+1,Q),endIndex:Q}}return null}function ag(O,D,B){return!B.inSingle&&O[D]==="$"&&O[D+1]==="("&&O[D+2]!=="("}function gP(O){let D=[],B=[],Q=!1,ee=!1,he=!1;for(let lt=0;lt<O.length;lt++){let ct=O[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){B.push(ct);continue}let ut=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(ut!==null){let ft=ut[1]??"",dt=ut[2];if(ft===Sw)ee=!0;if(vw.has(ft))Q=!0;if(dt!==void 0){if(ft===Up)D.push(dt);continue}if(xw.has(ft)){let mt=O[lt+1];if(ft===Up&&mt!==void 0)D.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),dt="",mt="";for(let gt=0;gt<ft.length;gt++){let ht=ft[gt]??"";if(Cw.has(ht))Q=!0;if(Ew.has(ht)){dt=ht,mt=ft.slice(gt+1);break}}if(dt==="")continue;if(mt.length>0){if(dt===$p)D.push(mt);continue}let pt=O[lt+1];if(dt===$p&&pt!==void 0)D.push(pt);lt++;continue}B.push(ct)}let at=!Q&&!ee?B.slice(1):B;return[...D,...at]}function Qn(O){let D=O.findIndex((B)=>!lg(B)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(B));return D===-1?[]:O.slice(D)}function lg(O){return O==="env"||O==="command"||O==="builtin"||O==="sudo"}var hP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),yP=".env.",bP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),SP=[".env.example.",".env.sample."];function CP(O){let D;try{D=new URL(O.trim())}catch{return!1}return D.protocol!=="file:"&&D.host!==""}function vP(O){return O.length>0&&!/\s/.test(O)}function Sc(O,D,B,Q){let ee=cg(O,D,B,Q);return ee!==""&&B.paths.entryKind(ee)!=="missing"}function cg(O,D,B,Q){try{return si(O,D,B,Q)}catch(ee){if(ee instanceof s)throw ee;return""}}var EP=new Set(["node_modules","__pycache__"]),xP=[["vendor","bundle"],["vendor","cache"]];function RP(O,D,B,Q,ee){if(CP(O))return null;let he=Bn(O,D,Q,ee);if(!he)return null;let je=Lt(he.split("/").pop()??""),at=Lt(he),lt=()=>vP(je)||Sc(O,D,Q,ee);if(bP.has(je)||SP.some((dt)=>je.startsWith(dt)))return null;let ct=Lt(IP(O,D,Q,ee));for(let dt of Ra){let mt=`~/${dt.suffixParts.join("/")}`;if((Xp(at,mt)||Xp(ct,mt))&&Jn(dt.id,B))return dt.id}let ut=_P(he,D,B,Q,ee);if(ut)return ut;if(hP.has(je))return null;for(let dt of xa)if(je===dt.basename&&Jn(dt.id,B))return dt.id;if(je.startsWith(yP)&&Jn(xi.id,B)&&lt())return xi.id;for(let dt of _a)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){let mt=je.slice(dt.prefix.length)[0];if((mt==="-"||mt==="_")&&Jn(dt.id,B)&&lt())return dt.id}for(let dt of wa)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){if(je.slice(dt.prefix.length)===dt.suffix&&Jn(dt.id,B))return dt.id}if(AP(at))return null;if(!je.includes(".")&&Eo.pattern.test(je)&&Jn(Eo.id,B))return Eo.id;let ft=TP(je,B);if(ft)return ft;return null}function _P(O,D,B,Q,ee){return Ri.find((he)=>{if(!Jn(he.id,B))return!1;switch(he.id){case"secret.cli.claude-code":return Dt(O,Gt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Lt(O).split("/");return Dt(O,Gt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),["settings.json","settings.local.json"])||ii(O,"~/.claude.json",D,Q,ee)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Dt(O,Bn("~/.gemini/config",D,Q,ee),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=Gt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee);return Dt(O,je,["auth.json",".credentials.json"])||oi(O,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=Gt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee),at=Lt(O).split("/").at(-1)??"";return Dt(O,je,["config.toml"])||at.endsWith(".config.toml")&&Dt(O,je,[at])}case"secret.cli.gemini":return Dt(O,rn(Gt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Lt(O).split("/"),at=Q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=Q.env.get("ProgramData")?[rn(Gt(Q.env.get("ProgramData"),"",D,Q,ee),"gemini-cli")]:[];return Dt(O,rn(Gt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?ii(O,at,D,Q,ee):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Dt(O,Bn(ct,D,Q,ee),["settings.json"]))}case"secret.cli.copilot-cli":{let je=Gt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee);return Dt(O,je,["config.json"])||oi(O,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Dt(O,Gt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=Gt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),at=Gt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee);return Dt(O,je,["server.token"])||oi(O,je,["credentials"])||oi(O,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Lt(O).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Dt(O,Gt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),je)||Dt(O,Gt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=rn(Gt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"opencode"),at=Lt(O).split("/").at(-1)??"",lt=Q.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Dt(O,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Dt(O,je,[at])||ct.some((ut)=>ii(O,ut,D,Q,ee))}case"secret.cli.opencode.config":{let je=Q.env.get("OPENCODE_CONFIG_DIR")?Gt(Q.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",D,Q,ee):rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"opencode"),at=Q.env.get("ProgramData")?[rn(Gt(Q.env.get("ProgramData"),"",D,Q,ee),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=Q.env.get("OPENCODE_CONFIG");return lt.includes(Lt(O).split("/").at(-1)??"")||Dt(O,je,lt)||(ct?.trim()?ii(O,ct,D,Q,ee):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((ut)=>Dt(O,Bn(ut,D,Q,ee),lt))}case"secret.cli.pi":return Dt(O,Gt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["auth.json"]);case"secret.cli.pi.config":return Dt(O,Gt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["models.json"]);case"secret.cli.amp":{let je=Bn("~",D,Q,ee);return[rn(Gt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"amp"),rn(je,".local","share","amp")].some((lt)=>Dt(O,lt,["secrets.json"]))||oi(O,rn(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"amp"),rn(Bn("~",D,Q,ee),".config","amp")],lt=Lt(O).split("/"),ct=Q.env.get("AMP_SETTINGS_FILE");return at.some((ut)=>Dt(O,ut,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?ii(O,ct,D,Q,ee):!1)}case"secret.cli.cursor":{let je=rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"cursor"),at=rn(Gt(Q.env.get("CURSOR_DATA_DIR"),"~/.cursor",D,Q,ee),"projects");return Dt(O,Bn("~/.cursor",D,Q,ee),["auth.json"])||Dt(O,je,["auth.json"])||Lt(O).split("/").at(-1)==="mcp-auth.json"&&Mr(Lt(O),Lt(at))}case"secret.cli.cursor.config":{let je=Lt(O).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Dt(O,Gt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Lt(O).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Dt(O,Gt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["config.toml","managed_config.toml","requirements.toml"])||Dt(O,Bn("/etc/grok",D,Q,ee),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Zp=new WeakMap;function Gt(O,D,B,Q,ee){let he=Zp.get(ee)??new Map;Zp.set(ee,he);let je=`${B}\x00${O??""}\x00${D}`,at=he.get(je);if(at!==void 0)return at;let lt=Bn(O?.trim()?O:D,B,Q,ee);return he.set(je,lt),lt}function Dt(O,D,B){return B.some((Q)=>ug(O,rn(D,Q)))}function oi(O,D,B){return B.some((Q)=>Mr(Lt(O),Lt(rn(D,Q))))}function ii(O,D,B,Q,ee){return ug(O,Bn(D,B,Q,ee))}function ug(O,D){return Lt(O)===Lt(D)}function rn(O,...D){return Ln([O,...D].filter(Boolean).join("/"))}function wP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Lt(si(O,D,ee,he));return B.some((at)=>Mr(je,Lt(si(at,Q,ee,he))))}function PP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Lt(si(O,D,ee,he));if(!je)return!1;let at=ee.env.get("HOME")??ee.home,lt=at?Ln(Wt(pn(at),ee.paths,he)):"",ct=Lt(lt),ut=ee.env.get("CC_SAFETY_NET_HOME"),ft=Lt(ut?Ln(Wt($s(pn(ut)),ee.paths,he)):lt&&Ln(Wt(`${lt}/.cc-safety-net`,ee.paths,he)));if(ft&&Mr(je,ft))return!1;return B.some((dt)=>{let mt=ka(dt);if(mt&&Jp.basename(je)!==Lt(mt.name))return!1;let pt=Lt(si(mt?.root??dt,Q,ee,he));if(!pt)return!1;if(ct&&(ct===pt||ct.startsWith(pt.endsWith("/")?pt:`${pt}/`)))return!1;return Mr(je,pt)&&!(mt&&je===pt)})}function AP(O){let D=O.split("/");return D.some((B)=>EP.has(B))||xP.some(([B,Q])=>D.some((ee,he)=>ee===B&&D[he+1]===Q))}function TP(O,D){let B=O.lastIndexOf("."),Q=B>0&&B<O.length-1?O.slice(B+1):"";if(Q==="")return null;for(let ee of Pa)if(Q===ee.extension&&Jn(ee.id,D))return ee.id;for(let ee of Aa)if(ee.pattern.test(Q)&&Jn(ee.id,D))return ee.id;return null}function Lt(O){return O.toLowerCase()}function Jn(O,D){return!D?.disabledRules?.includes(O)}function Bn(O,D,B,Q){let{home:ee,normalized:he}=_c(O,B,Q);if(!he)return"";if(!ee)return he;let je=wc(he,ee),at=zs(je)?je:Ln($s(D,je)),lt=Ln(Wt(at,B.paths,Q));if(!Mr(lt,ee)){if(zs(je))return lt;return lt===at?he:lt}let ct=lt.slice(ee.length);return ct?`~${ct}`:"~"}function Xp(O,D){return O===D||O.startsWith(`${D}/`)}function IP(O,D,B,Q){let{home:ee,normalized:he}=_c(O,B,Q);if(!he||!ee)return"";let je=wc(he,ee),at=Jp.normalize(zs(je)?je:Ln($s(D,je))),lt=Ln(pn(B.env.get("HOME")??B.home)),ct=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ut=[ee,lt].find((dt)=>dt!==""&&Mr(ct(at),ct(dt)));if(ut===void 0)return"";let ft=at.slice(ut.length);return ft?`~${ft}`:"~"}function si(O,D,B,Q){let{home:ee,normalized:he}=_c(O,B,Q);if(!he)return"";let je=ee?wc(he,ee):he;return Ln(Wt(zs(je)?je:$s(D,je),B.paths,Q))}function _c(O,D,B){let Q=D.env.get("HOME")??D.home,ee=Q?Ln(Wt(pn(Q),D.paths,B)):"",he=Ln(pn(kP(qn(O,D))));return{home:ee,normalized:he}}function kP(O){if(!O.trim().toLowerCase().startsWith("file:"))return O;try{return ow(O)}catch{return O}}function wc(O,D){if(O==="~")return D;if(O.startsWith("~/"))return rn(D,O.slice(2));return O}function OP(O){if(process.platform==="win32")return!0;return rw.parse(O).root.length>1}function Ln(O){let D=O.trim(),B=(D.includes("\\")&&OP(D)?D.replace(/\\/g,"/"):D).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(B==="/")return B;return B.replace(/\/+$/g,"")}function Mr(O,D){return O===D||O.startsWith(D.endsWith("/")?D:`${D}/`)}function Wn(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(O,D,B){super(`CC Safety Net ${O} dependency failed`,{cause:B});this.stage=O;this.evaluation=D}}var MP={findPolicyMutation:Fp,findGitMetadataMutation:hf,resolveGitMetadata:DP,loadPolicySnapshot:E,findSensitiveTarget:rg,analyzeCommand:Op,getModes:R};function W(O,D){let B={...MP,...D.dependencies},Q=WP(O),ee=ai(O)?O.command:Q,he=dr("policy-protection",ee,()=>Bo(O)),je=un(he,"input-candidate"),at=un(he,"declared-command");if(ai(O)&&O.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Gn,intent:"stop_and_explain",evidence:{command:O.command,segment:O.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Lf,intent:"stop_and_explain"}};let lt=mn(),ct=dr("policy-protection",ee,()=>B.resolveGitMetadata([O.context.executionCwd,O.context.configCwd],D.environment)),ut=dr("policy-protection",ee,()=>B.findPolicyMutation(he,D.environment,lt));if(ut){let Et=ee??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:Et,segment:ut.target}}}}let ft=dr("policy-protection",ee,()=>Np(he,D.environment,lt));if(ft){let Et=ee??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:Et,segment:ft.target}}}}let dt=dr("policy-protection",ee,()=>B.findGitMetadataMutation(he,ct,D.environment,lt));if(dt){let Et=ee??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Et,segment:dt.target}}}}let mt=dr("config-load",ee,()=>B.loadPolicySnapshot(D.environment,{...D.policyOptions,cwd:O.context.configCwd})),pt=mt.policy,gt=B.getModes(pt,D.environment.env),ht={level:gt.effectiveLevel,...NP(mt)},yt=pt.secretProtection.enabled===!1?null:dr("secret-protection",ee,()=>B.findSensitiveTarget(he,pt.secretProtection,D.environment,lt,{strict:ai(O)||je?.program.dialect==="powershell"?gt.strict:void 0}));if(yt){let Et=ee??yt.target;return{stage:"secret-protection",...ht,decision:{kind:"deny",reason:Qp,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:Et,segment:yt.target}}}}if(!ai(O))return{stage:"non-command",...ht,decision:{kind:"allow"}};if(!O.command||O.command.trim()==="")return{...Pc("command-validation",ee),...ht};let Ct=dr("command-analysis",ee,()=>Mp(()=>B.analyzeCommand(O.command,{cwd:O.context.executionCwd,shell:O.route.shell,policySnapshot:mt,environment:D.environment,protectedGitMetadata:ct,effectiveCapabilities:gt.capabilities,strict:gt.strict,paranoidRm:gt.paranoidRm,paranoidInterpreters:gt.paranoidInterpreters,worktreeMode:gt.worktreeMode,budget:lt,...D.trace?{trace:D.trace}:{}},LP(he),he.store),O.command,D.trace));if(Ct.decision){let Et=!gt.strict&&Ct.decision.kind==="deny"&&(Ct.decision.ruleId==="raw-text.dangerous-command"||Ct.decision.reason===jo&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(Ct.decision.evidence?.segment??"")&&xn(O.command)===null);return{stage:"command-analysis",...ht,..."errorCode"in Ct?{errorCode:Ct.errorCode}:{},decision:Et?{...Ct.decision,ask:!0}:Ct.decision}}return{stage:"command-analysis",...ht,decision:{kind:"allow"}}}function DP(O,D){let B=[...new Set(O.filter((Q)=>typeof Q==="string"&&Q!==""))].flatMap((Q)=>D.gitMetadata(Q)??[]);if(B.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(B.flatMap((Q)=>Q.entries))]),markerFiles:Object.freeze([...new Set(B.flatMap((Q)=>Q.markerFiles))]),directories:Object.freeze([...new Set(B.flatMap((Q)=>Q.directories))]),hooksDirectories:Object.freeze([...new Set(B.flatMap((Q)=>Q.hooksDirectories))])})}function NP(O){if(O.state==="ready")return{};return{configFallback:{reason:O.reason}}}function LP(O){return un(O,"declared-command")?.program}function WP(O){try{return ne(O.input)}catch(D){let B=ai(O)?O.command:void 0;throw new p("policy-protection",Pc("policy-protection",D instanceof f?void 0:B,D),D)}}function dr(O,D,B){try{return B()}catch(Q){throw new p(O,Pc(O,Q instanceof f?void 0:D,Q),Q)}}function Pc(O,D,B){let Q=B instanceof s||B instanceof y;return{stage:O,decision:{kind:"deny",reason:Q?qs:te,intent:"stop_and_explain",...D?{evidence:{command:D,segment:D}}:{}}}}function ai(O){return O.route.kind==="command"}
+export{te,a,s,z,ke,Ue,k,Ze,Ge,ye,P,be,Xe,c,o,He,xe,R,L,ve,Qe,f,V,ne,ce,et,We,d,Re,r,v,i,re,n,g,le,N,tt,nt,l,ue,de,rt,A,q,oe,S,ot,F,b,Se,M,u,K,Be,ze,I,w,T,pe,fe,Le,it,m,e,Te,we,Ve,qe,ie,Ce,se,_e,J,j,Pe,me,U,Ke,G,Y,Z,ae,Je,Ye,C,H,Ae,Ie,Oe,De,E,Ne,Ee,Fe,h,t,X,ge,y,x,_,st,Me,$e,p,W};