cc-safety-net 2.5.1 → 2.5.2

package/dist/chunks/index-8cqwk53d.js

@@ -1,45 +0,0 @@
-var Js="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",zn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",vo="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Xs={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},So={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...Xs},processedCandidateBytes:{cap:4194304,...Xs},pathEnvironmentExpansion:{cap:64,...Xs},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...So},trackedHeredocFiles:{cap:64,...So},controlFlowStates:{cap:64,...So},wrapperPeelIterations:{cap:20,...So},derivedCommandShape:So});class s extends Error{kind;name="AnalysisLimit";constructor(M){super(a[M].reason);this.kind=M}}function hn(){let M=new Map;return{counters:M,resolvedPaths:new Map,charge(L,F=1){let q=(M.get(L)??0)+F;if(M.set(L,q),q>a[L].cap)throw new s(L)}}}var Cg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function K(M){return _e(M.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function _e(M){return Cg.reduce((L,F)=>L.replace(F,"<redacted>"),M.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function We(M){return Wc(M).reduceRight((L,F)=>`${L.slice(0,F.valueStart)}<redacted>${L.slice(F.valueEnd)}`,M)}function k(M){return _e(We(M))}function tt(M){return Wc(M).map((L)=>M.slice(L.valueStart,L.valueEnd))}function Be(M){return/[A-Za-z_][A-Za-z0-9_]*=/.test(M)}function Wc(M){return[...M.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((L)=>{let F=M[L.index-1];if(L.index>0&&F&&!/[\s"'([{]/.test(F))return[];let q=L.index+L[0].length;if(q>=M.length)return[];return[{valueStart:q,valueEnd:Sg(M,q)}]})}function Sg(M,L){if(M.startsWith("$(",L))return vg(M,L);let F=M[L];if(F==='"'||F==="'"){for(let ne=L+1;ne<M.length;ne++){if(F==='"'&&M[ne]==="\\"){ne++;continue}if(M[ne]===F)return ne+1}return M.length}let q=L;while(q<M.length&&!/\s/.test(M[q]??""))q++;return q}function vg(M,L){let F=0,q;for(let ne=L;ne<M.length;ne++){let re=M[ne];if(q){if(q==='"'&&re==="\\"){ne++;continue}if(re===q)q=void 0;continue}if(re==='"'||re==="'"){q=re;continue}if(re==="$"&&M[ne+1]==="("){F++,ne++;continue}if(re!==")")continue;if(F--,F===0)return ne+1}return M.length}var Eg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function xg(M){let L=M.maxLen??200,F=M.redact??((ne)=>ne),q=(ne)=>ne.length>L?`${ne.slice(0,L)}...`:ne;return[M.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${F(M.reason)}`,M.ruleId?`Rule: ${M.ruleId}`:void 0,M.toolName?`Tool: ${M.toolName}`:void 0,M.command?`Command: ${q(F(M.command))}`:void 0,M.segment&&M.segment!==M.command?`Segment: ${q(F(M.segment))}`:void 0,M.cwd?`Working directory: ${q(F(M.cwd))}`:void 0,M.configWarning?`Config warning: ${F(M.configWarning)}`:void 0,M.askUser?"Approve only if you expected this command.":Eg[M.intent??"manual_only"]].filter((ne)=>ne!==void 0).join(`
-
-`)}function Se(M,L){if(M.decision.kind!=="deny")return;let F=L.includeEvidence?M.decision.evidence:void 0;return{reason:M.decision.reason,ruleId:M.decision.ruleId,intent:M.decision.intent,command:F?.command,segment:F?.segment,toolName:L.toolName,...M.configFallback?{configWarning:M.configFallback.reason}:{},...M.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function I(M={}){return{reason:vo,intent:"stop_and_explain",command:M.command,segment:M.segment??M.command,toolName:M.toolName}}var Rg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function O(M,L={}){return{...Rg[M.directory][M.problem],command:L.command,toolName:L.toolName,cwd:M.cwd}}function J(M){return xg({...M,redact:K})}function nt(M){return K(M instanceof Error?M.message:String(M))}import{lstatSync as sh,realpathSync as ah,statSync as lh}from"node:fs";import{homedir as ch,tmpdir as uh}from"node:os";import{statSync as rh}from"node:fs";import{join as oh}from"node:path";import{basename as zc,dirname as _g,isAbsolute as wg,join as Pg,normalize as Ag,resolve as Gc}from"node:path";var Tg=256,yi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function yn(M,L=process.platform){if(L!=="win32")return M;return M.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function rr(M,L=process.platform){if(L!=="win32")return!1;return(M[0]==="/"||M[0]==="\\")&&(M[1]==="/"||M[1]==="\\")}function na(M,L){return Qs(M,0,L)}function Qs(M,L,F){let q="",ne=0;while(ne<M.length){if(M[ne]!=="$"){q+=M[ne],ne++;continue}if(M[ne+1]==="{"){let ue=ea(M,ne+2),ve=Ig(M,ne,L);if(ve===null){if(yi.has(ue))throw new s("pathEnvironmentExpansion");q+=M.slice(ne);break}let xe=M.slice(ne,ve+1);q+=kg(xe,L,F),ne=ve+1;continue}let re=ea(M,ne+1);if(!re){q+="$",ne++;continue}q+=ta(re,F)??`$${re}`,ne+=re.length+1}return q}function Ig(M,L,F){let q=1;for(let ne=L+2;ne<M.length;ne++){if(M[ne]==="\\"){ne++;continue}if(M[ne]==="$"&&M[ne+1]==="{"){if(q++,F+q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ne++;continue}if(M[ne]!=="}")continue;if(q--,q===0)return ne}return null}function kg(M,L,F){let q=M.slice(2,-1),ne=ea(q,0);if(!ne)return M;let re=q.slice(ne.length);if(!re)return ta(ne,F)??M;let ue=[":-",":+",":=",":?","-","+","=","?"].find((He)=>re.startsWith(He));if(!ue){if(yi.has(ne))throw new s("pathEnvironmentExpansion");return M}if(!yi.has(ne))return M;if(ue.endsWith("="))throw new s("pathEnvironmentExpansion");let ve=ta(ne,F),xe=ue.startsWith(":")?ve!==null&&ve!=="":ve!==null;if(ue.endsWith("?")&&!xe)throw new s("pathEnvironmentExpansion");if(ue.endsWith("-")||ue.endsWith("?"))return xe?ve??"":Qs(re.slice(ue.length),L+1,F);return xe?Qs(re.slice(ue.length),L+1,F):""}function ea(M,L){if(!/[A-Za-z_]/.test(M[L]??""))return"";let F=L+1;while(/[A-Za-z0-9_]/.test(M[F]??""))F++;return M.slice(L,F)}function ta(M,L){if(!yi.has(M))return null;if(M==="HOME")return L.env.get("HOME")??L.home;return L.env.get(M)??null}function Dt(M,L,F){if(!M)return M;let q=F.resolvedPaths.get(M);if(q!==void 0)return q;let ne=[],re=M;while(!0){Bc(F,re);let ue=L.realpath(re);if(ue!==null)return Fc(F,M,ue,ne);let ve=_g(re);if(ve===re||ne.length>=Tg)return Fc(F,M,re,ne);ne.push(zc(re)),re=ve}}function Fc(M,L,F,q){let ne=q.length===0?F:Pg(F,...q.reverse());return M.resolvedPaths.set(L,ne),ne}function Og(M,L,F){let q=F.resolvedPaths.get(M);if(q!==void 0)return q;Bc(F,M);let ne=L.realpath(M);if(ne!==null)F.resolvedPaths.set(M,ne);return ne}function Bc(M,L){M.charge("realpathAttempts"),M.charge("processedCandidateBytes",Buffer.byteLength(L))}function on(M,L,F,q){let ne=Uc(M,L,F);if(!ne)return"";return Dt(ne,F.paths,q).replace(/\\/g,"/")}function $c(M,L,F,q,ne){let re=Uc(M,L,F);if(!re)return null;if(ne(zc(re)))return Dt(re,F.paths,q).replace(/\\/g,"/");let ue=Og(re,F.paths,q);return ue===null?null:ue.replace(/\\/g,"/")}function Uc(M,L,F){let q=F.home,ne=na(M.trim(),F).replace(/\\/g,"/");if(!ne)return"";let re=ne==="~"?q:ne.startsWith("~/")?Gc(q,ne.slice(2)):ne,ue=yn(re);return Ag(wg(ue)?ue:Gc(L,ue))}import{spawnSync as Mg}from"node:child_process";import{existsSync as xo,lstatSync as Dg,readFileSync as Ro,realpathSync as Ur,statSync as Eo}from"node:fs";import{dirname as ra,isAbsolute as oa,join as Hr,resolve as bi}from"node:path";var Ng=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Lg=5000;function jc(M,L=Qg(),F=Lg){let q=Wg(M),ne=q===null?null:Gg(q);if(q===null||ne===null)return null;let re=Xg(q,ne,L,F);return re===null?null:{recursiveSubmodules:re}}function Wg(M){try{let L=Ur(bi(M));return Eo(L).isDirectory()?L:null}catch{return null}}function Gg(M){let L=Zg(M);if(!L)return null;try{let F=Dg(L);if(F.isSymbolicLink()||!F.isFile())return null;let q=ia(L);if(!q?.commonDir)return null;if(!Bg(q.gitDir,L))return null;return $g(q.gitDir,ra(L))?{gitDir:q.gitDir,commonDir:q.commonDir}:null}catch{return null}}function ia(M){try{let L=Fg(M);if(!L)return null;let F=Ur(oa(L)?L:bi(ra(M),L));if(!Eo(F).isDirectory())return null;return{gitDir:F,commonDir:zg(F)}}catch{return null}}function Fg(M){let L=Ro(M,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!L.startsWith("gitdir:"))return null;return L.slice(7).trim()||null}function zg(M){try{let L=Ro(Hr(M,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!L)return null;let F=Ur(oa(L)?L:bi(M,L));return Eo(F).isDirectory()?F:null}catch{return null}}function Bg(M,L){let F=Ug(M);return F===null?!1:Vc(M,F,L)}function $g(M,L){let F=Hg(M);return F===null?!0:Vc(M,F,L)}function Ug(M){let L=Hr(M,"gitdir");if(!xo(L))return null;let F=Ro(L,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return F===""?null:F}function Hg(M){let L=Hr(M,"config.worktree");return xo(L)?Vg(L):null}function Vc(M,L,F){try{return jg(oa(L)?L:bi(M,L),F)}catch{return!1}}function jg(M,L){try{let F=Eo(M),q=Eo(L);if(F.ino!==0&&q.ino!==0&&F.dev===q.dev&&F.ino===q.ino)return!0}catch{}return Hc(Ur.native(M))===Hc(Ur.native(L))}function Hc(M){let L=M.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),F=L.length>1&&L.endsWith("/")?L.slice(0,-1):L;return process.platform==="win32"?F.toLowerCase():F}function Vg(M){let L=Ro(M,"utf-8"),F=!1,q=null;for(let ne of L.split(/\r?\n/)){let re=ne.trim();if(re===""||re.startsWith("#")||re.startsWith(";"))continue;if(re.startsWith("[")){F=/^\[core\]$/i.test(re);continue}if(!F)continue;let ue=re.match(/^worktree\s*=\s*(.*)$/i);if(ue)q=Kg(ue[1]??"")}return q}function Kg(M){let L=M.trim();if(!L.startsWith('"')||!L.endsWith('"'))return L;return Yg(L.slice(1,-1))}var qg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Yg(M){return M.replace(/\\(.?)/gs,(L,F)=>F===""?L:qg[F]??L)}function Zg(M){try{return sa(Ur(M))}catch{return null}}function sa(M){let L=M;while(!0){let F=Hr(L,".git");if(xo(F))return F;let q=ra(L);if(q===L)return null;L=q}}function Xg(M,L,F,q){if(Jg(L))return!0;if(F===null)return!0;let ne=Mg(F,["config","--get","submodule.recurse"],{cwd:M,encoding:"utf8",env:eh(process.env),stdio:["ignore","pipe","ignore"],timeout:q});if(ne.error!==void 0||ne.status!==0&&ne.status!==1)return null;return ne.status===0&&Kc(ne.stdout.trim())}function Jg(M){return[Hr(M.commonDir,"config"),Hr(M.gitDir,"config.worktree")].filter((L)=>xo(L)).some((L)=>th(L))}function Qg(){return Ng.find((M)=>xo(M))??null}function _o(M){return M==="GIT_CONFIG_COUNT"||M==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(M)}function eh(M){return Object.fromEntries(Object.entries(M).filter(([L])=>!_o(L)))}function th(M){let L;try{L=Ro(M,"utf-8")}catch{return!0}let F="",q=!1;for(let ne of L.split(/\r?\n/)){let re=ne.trim();if(re===""||re.startsWith("#")||re.startsWith(";"))continue;let ue=re.match(/^\[([^\]]+)\]$/);if(ue){F=ue[1]?.trim().toLowerCase()??"";continue}let ve=re.indexOf("="),xe=(ve===-1?re:re.slice(0,ve)).trim().toLowerCase(),He=ve===-1?"true":re.slice(ve+1).trim();if(nh(F)&&xe==="path")return!0;if(F==="submodule"&&xe==="recurse")q=Kc(He)}return q}function nh(M){return M==="include"||M.startsWith("includeif ")}function Kc(M){let L=M.toLowerCase();return L!=="false"&&L!=="no"&&L!=="off"&&L!=="0"}function qc(M,L){if(M==="")return null;let F=hn(),q=sa(on(M,M,L,F)),ne=q?ih(q,M,L,F):null;if(!ne)return null;return Object.freeze({entries:Object.freeze([ne.entry]),markerFiles:Object.freeze(ne.markerFile?[ne.markerFile]:[]),directories:Object.freeze(ne.directories),hooksDirectories:Object.freeze(ne.hooksDirectories)})}function ih(M,L,F,q){try{let ne=on(M,L,F,q),re=rh(M),ue=re.isFile()?ne:null,ve=re.isFile()?ia(M):null,xe=(re.isDirectory()?[ne]:[ve?.gitDir,ve?.commonDir]).flatMap((ft)=>ft?[jr(on(ft,L,F,q))]:[]),He=[...new Set(re.isDirectory()?[jr(M.replace(/\\/g,"/")),...xe]:xe)];return{entry:jr(ne),markerFile:ue?jr(ue):null,directories:He,hooksDirectories:[...new Set(He.flatMap((ft)=>{let mt=jr(oh(ft,"hooks").replace(/\\/g,"/"));return[mt,jr(on(mt,L,F,q))]}))]}}catch{return null}}function jr(M){return process.platform==="win32"?M.toLowerCase():M}var dh={realpath:(M)=>{try{return ah(M)}catch{return null}},entryKind:(M)=>{let L=sh(M,{throwIfNoEntry:!1});if(!L)return"missing";return L.isSymbolicLink()?"symlink":"present"},isDirectory:(M)=>{try{return lh(M).isDirectory()}catch{return!1}}};function c(){return fh({env:new Map(Object.entries(process.env).flatMap(([M,L])=>L===void 0?[]:[[M,L]])),home:yn(process.env.HOME||ch()),tmpdir:uh(),paths:dh})}function fh(M,L={}){let F=new Map,q=new Map,ne={...M,gitMetadata:(re)=>Yc(F,re,()=>qc(re,ne)),worktreeFacts:(re)=>Yc(q,re,()=>jc(re)),...L};return ne}function Yc(M,L,F){let q=M.get(L);if(q!==void 0)return q;let ne=F();return M.set(L,ne),ne}import{accessSync as Nh,constants as du,statSync as Lh}from"node:fs";import{isAbsolute as fu,relative as Wh,resolve as Gh,sep as Fh}from"node:path";import{types as mh}from"node:util";var ph=new Set(["applypatch","patch"]),gh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),hh=new Set(["grep","grepsearch","rg"]),yh=new Set(["find","findbyname","glob"]),bh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ch=new Set(["command","diff","input","patch","patchtext"]),Zc=new TextEncoder,Sh=new TextDecoder,vh=/\s/,Eh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var wo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function tu(M){return M.replace(/[-_\s]/g,"").toLowerCase()}function Si(M){return bh.has(tu(M))}function _(M){let L=tu(M);if(ph.has(L))return"patch";if(hh.has(L))return"grep";if(yh.has(L))return"glob";if(gh.has(L))return"path";return"unknown"}function oe(M){if(!M||typeof M!=="object")return;lu(M);let L=Object.getOwnPropertyDescriptor(M,"command");if(!L){if("command"in M)Bn();return}if(L.get||L.set)Bn();let F=L.value;return typeof F==="string"&&F!==""?F:void 0}function nu(M,L){return ru(M,L,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function ru(M,L,F,q,ne){let re=au(M,q,ne);if(typeof M==="string")return F?[M]:[];if(!re)return[];let ue=re.entries.flatMap(([ve,xe])=>ru(xe,L,re.array?F:L.has(ou(ve)),q,ne+1));return q.ancestors.delete(re.object),ue}function ou(M){return M.replace(/-/g,"_").toLowerCase()}function iu(M){return su(M,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Rh)}function su(M,L,F,q){let ne=au(M,F,q);if(typeof M==="string")return L?[M]:[];if(!ne)return[];let re=ne.entries.flatMap(([ue,ve])=>su(ve,ne.array?L:Ch.has(ou(ue)),F,q+1));return F.ancestors.delete(ne.object),re}function xh(M,L,F){if(L.nodes++,M!==null&&typeof M==="object"&&F>wo.maxDepth||L.nodes>wo.maxNodes)Bn();if(typeof M!=="string")return;let q=Buffer.byteLength(M);if(L.stringBytes+=q,q>wo.maxStringBytes||L.stringBytes>wo.maxAggregateStringBytes)Bn()}function au(M,L,F){if(xh(M,L,F),!M||typeof M!=="object")return null;let q=lu(M);if(L.ancestors.has(M))Bn();let ne=Reflect.ownKeys(M);if(L.keys+=ne.length,L.keys>wo.maxKeys)Bn();let re=ne.flatMap((ue)=>{let ve=Object.getOwnPropertyDescriptor(M,ue);if(!ve||ve.get||ve.set)Bn();return typeof ue==="string"&&ve.enumerable?[[ue,ve.value]]:[]});return L.ancestors.add(M),{object:M,array:q,entries:re}}function lu(M){if(mh.isProxy(M))Bn();let L=Array.isArray(M),F=Object.getPrototypeOf(M);if(L&&F!==Array.prototype||!L&&F!==Object.prototype&&F!==null)Bn();return L}function Bn(){throw new f}function Rh(M){let L=[],F=M.split(/\r?\n/),q=!1,ne=!1,re=null,ue=null,ve=()=>{ne=!1,re=null,ue=null};for(let xe=0;xe<F.length;xe++){let He=F[xe]??"";if(He==="*** Begin Patch"){q=!0,ve();continue}if(He==="*** End Patch"){q=!1,ve();continue}if(He.startsWith("@@")){let ft=_h(He);if(ne=!0,re=ft?.oldLines??null,ue=ft?.newLines??null,re===0&&ue===0)ve();continue}if(ne&&re!==null&&ue!==null){let ft=He.startsWith(" ")||He.startsWith("-")?1:0,mt=He.startsWith(" ")||He.startsWith("+")?1:0;if(re=Math.max(0,re-ft),ue=Math.max(0,ue-mt),re===0&&ue===0)ve();continue}if(He.startsWith("*** ")){ve(),L.push(...aa(He));continue}if(ne)continue;if(He.startsWith("diff --git ")){L.push(...aa(He));continue}if(He.startsWith("--- ")){let ft=F[xe+1]??"";if(!ft.startsWith("+++ "))continue;L.push(...ca(Ci(He.slice(4),!0),Ci(ft.slice(4),!0))),xe++;continue}if(!q)L.push(...aa(He))}return L}function _h(M){let L=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(M);if(!L)return null;return{oldLines:Number(L[1]??1),newLines:Number(L[2]??1)}}function aa(M){let L=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(M);if(L?.[1])return eu(L[1]);let F=/^\*\*\* Move to: (.+)$/.exec(M);if(F?.[1])return eu(F[1]);if(M.startsWith("diff --git "))return wh(M.slice(11));let q=/^--- (.+)$/.exec(M);if(q?.[1])return Qc(q[1]);let ne=/^\+\+\+ (.+)$/.exec(M);if(ne?.[1])return Qc(ne[1]);let re=/^(?:rename|copy) (?:from|to) (.+)$/.exec(M);if(re?.[1])return Mh(re[1]);return[]}function wh(M){let L=Ph(M);if(L.length===2&&L[0]&&L[1])return ca(L[0],L[1]);let F=Ah(M);return F?ca(M.slice(F.oldStart,F.oldEnd),M.slice(F.newStart,F.newEnd)):[]}function Ph(M){let L=[],F=0;while(F<M.length&&L.length<2){while(Cr(M[F]))F++;if(F>=M.length)break;let q=M[F]==='"'||M[F]==="'"?M[F]:void 0;if(!q){let re=F;while(F<M.length&&!Cr(M[F]))F++;L.push(M.slice(re,F));continue}let ne=cu(M,F,q);if(!ne)return[];L.push(ne.value),F=ne.end}while(Cr(M[F]))F++;return F===M.length?L:[]}function Ah(M){let L=0;while(L<M.length&&Cr(M[L]))L++;let F=M.length;while(F>L&&Cr(M[F-1]))F--;let q=0,ne=L;while(ne<F){if(!Cr(M[ne])){ne++;continue}let re=ne;while(ne<F&&Cr(M[ne]))ne++;if(re===L||ne===F)continue;if(q++,q>Eh)Bn();if(Th(M,L,re,ne,F))return{oldStart:L,oldEnd:re,newStart:ne,newEnd:F}}return null}function Th(M,L,F,q,ne){if(la(M,L,F,q,ne))return!0;let re=Xc(M,"/",L,F),ue=Xc(M,"/",q,ne);if(re<=L||ue<=q)return!1;if(la(M,L,re,q,ue))return!1;return la(M,re+1,F,ue+1,ne)}function la(M,L,F,q,ne){if(F-L!==ne-q)return!1;for(let re=0;re<F-L;re++)if(M[L+re]!==M[q+re])return!1;return!0}function Xc(M,L,F,q){for(let ne=F;ne<q;ne++)if(M[ne]===L)return ne;return-1}function Cr(M){return M!==void 0&&vh.test(M)}function cu(M,L,F){let q=[],ne=L+1;while(ne<M.length){let re=String.fromCodePoint(M.codePointAt(ne)??0);if(re===F)return{value:Sh.decode(Uint8Array.from(q)),end:ne+1};if(re!=="\\"||F==="'"){q.push(...Zc.encode(re)),ne+=re.length;continue}let ue=M.slice(ne+1),ve=/^[0-7]{1,3}/.exec(ue)?.[0];if(ve){q.push(Number.parseInt(ve,8)),ne+=ve.length+1;continue}q.push(...Zc.encode(Ih(ue[0]??""))),ne+=2}return null}function Ih(M){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[M]??M}function kh(M){return Po(Dh(M))}function ca(M,L){if(M==="/dev/null")return Jc(L);if(L==="/dev/null")return Jc(M);if(M.startsWith("a/")&&L.startsWith("b/"))return[M.slice(2),L.slice(2)].flatMap(Po);let F=Oh(M,L)??(M===L?uu(M):null);return[M,L,...F?[F]:[]].flatMap(Po)}function Jc(M){let L=uu(M);return[M,...L?[L]:[]].flatMap(Po)}function uu(M){let L=M.indexOf("/");return L>0&&L<M.length-1?M.slice(L+1):null}function Oh(M,L){let F=M.indexOf("/"),q=L.indexOf("/");if(F<1||q<1)return null;if(M.slice(0,F)===L.slice(0,q))return null;let ne=M.slice(F+1);return ne===L.slice(q+1)?ne:null}function Qc(M){return kh(Ci(M,!0))}function Mh(M){return Po(Ci(M,!1))}function Ci(M,L){let F=M.trim(),q=F[0]==='"'||F[0]==="'"?F[0]:void 0;if(q){let ne=cu(F,0,q);if(ne&&(L||F.slice(ne.end).trim()===""))return ne.value}return L?F.split("\t",1)[0]?.trim()??"":F}function Dh(M){return M.startsWith("a/")||M.startsWith("b/")?M.slice(2):M}function Po(M){return M===""||M==="/dev/null"?[]:[M]}function eu(M){let L=M.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return L===""||L==="/dev/null"?[]:[L]}function de(M){try{if(!Lh(M).isDirectory())return!1;return Nh(M,du.R_OK|du.X_OK),!0}catch{return!1}}function ot(M,L,F){if(rr(M))return;let q=L.flatMap((re)=>ua(re,F));if(!q[0])return;let ne=ua(fu(M)?M:Gh(q[0],M),F)[0];if(!ne)return;return q.some((re)=>zh(ne,re))?ne:void 0}function Ve(M,L){return M.flatMap((F)=>ua(F,L))[0]}function ua(M,L){let F=L.realpath(M);if(F===null)return[];return L.isDirectory(F)?[F]:[]}function zh(M,L){let F=Wh(L,M);return F===""||F!==".."&&!F.startsWith(`..${Fh}`)&&!fu(F)}var Bh=8388608;async function qe(M){let L=[],F=0;for await(let q of M){let ne=typeof q==="string"?Buffer.from(q,"utf-8"):Buffer.from(q.buffer,q.byteOffset,q.byteLength);if(F+=ne.byteLength,F>Bh)throw $h(M),Error("hook input byte limit exceeded");L.push(ne)}return Buffer.concat(L,F).toString("utf-8")}function $h(M){let L=M.destroy??M.cancel;if(!L)return;try{Promise.resolve(L.call(M)).catch(()=>{})}catch{}}function l(M,L,F,q,ne){if(F.kind!=="command")return{toolName:M,input:L,route:F,context:q};return{toolName:M,input:L,route:F,context:q,command:ne}}var Vr=["fail_closed","paranoid_rm","paranoid_interpreters"],vi={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ei=["standard","strict","paranoid"];function Uh(M,L){if(!L)return M;return Ei.indexOf(L)>Ei.indexOf(M)?L:M}function Hh(M){let L=Ce(o.level,M);if(L===void 0||L==="")return;if(Ei.includes(L))return L;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(L.slice(0,40))}. Use ${Ei.join(", ")}.`);return}function ze(M){if(M===void 0||M==="all")return"all";if(M==="blocked")return"blocked";return"invalid"}function we(M){return ze(Ce(o.auditScope,M))==="all"}function da(M){if(M.failClosed&&M.paranoidRm&&M.paranoidInterpreters)return"paranoid";if(M.failClosed&&!M.paranoidRm&&!M.paranoidInterpreters)return"strict";if(!M.failClosed&&!M.paranoidRm&&!M.paranoidInterpreters)return"standard";return"custom"}function R(M={},L){let F=M.safety?.level??"standard",q=Hh(L),ne=Uh(F,q),re=vi[ne],ue={failClosed:re.fail_closed,paranoidRm:re.paranoid_rm,paranoidInterpreters:re.paranoid_interpreters},ve={failClosed:ne===F?"preset":"environment",paranoidRm:ne===F?"preset":"environment",paranoidInterpreters:ne===F?"preset":"environment"},xe={failClosed:[`policy safety.level=${F}`],paranoidRm:[`policy safety.level=${F}`],paranoidInterpreters:[`policy safety.level=${F}`]};if(ne!==F)xe.failClosed.push(`env ${o.level.name}=${q}`),xe.paranoidRm.push(`env ${o.level.name}=${q}`),xe.paranoidInterpreters.push(`env ${o.level.name}=${q}`);if(M.safety?.overrides?.failClosed!==void 0)ue.failClosed=M.safety.overrides.failClosed,ve.failClosed="capability_override",xe.failClosed.push("policy safety.overrides.fail_closed");if(M.safety?.overrides?.paranoidRm!==void 0)ue.paranoidRm=M.safety.overrides.paranoidRm,ve.paranoidRm="capability_override",xe.paranoidRm.push("policy safety.overrides.paranoid_rm");if(M.safety?.overrides?.paranoidInterpreters!==void 0)ue.paranoidInterpreters=M.safety.overrides.paranoidInterpreters,ve.paranoidInterpreters="capability_override",xe.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(T(o.strict,L))ue.failClosed=!0,ve.failClosed="environment",xe.failClosed.push(`env ${o.strict.name}`);if(T(o.paranoid,L))ue.paranoidRm=!0,ue.paranoidInterpreters=!0,ve.paranoidRm="environment",ve.paranoidInterpreters="environment",xe.paranoidRm.push(`env ${o.paranoid.name}`),xe.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(T(o.paranoidRm,L))ue.paranoidRm=!0,ve.paranoidRm="environment",xe.paranoidRm.push(`env ${o.paranoidRm.name}`);if(T(o.paranoidInterpreters,L))ue.paranoidInterpreters=!0,ve.paranoidInterpreters="environment",xe.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let He=!!M.worktreeMode||T(o.worktree,L);return{strict:ue.failClosed,paranoidRm:ue.paranoidRm,paranoidInterpreters:ue.paranoidInterpreters,worktreeMode:He,effectiveLevel:da(ue),capabilities:{fail_closed:{enabled:ue.failClosed,source:ve.failClosed,sources:xe.failClosed},paranoid_rm:{enabled:ue.paranoidRm,source:ve.paranoidRm,sources:xe.paranoidRm},paranoid_interpreters:{enabled:ue.paranoidInterpreters,source:ve.paranoidInterpreters,sources:xe.paranoidInterpreters}}}}function T(M,L){let F=typeof M==="string"?Ao(M,L):Ce(M,L);return F==="1"||F?.toLowerCase()==="true"}function Ao(M,L){return L.get(M)}function Ce(M,L){let F=Ao(M.name,L);if(F!==void 0)return F;if(M.legacyName)return Ao(M.legacyName,L);return}function rt(M,L){return Ao(M.name,L)!==void 0||!!M.legacyName&&Ao(M.legacyName,L)!==void 0}import{dirname as Rr}from"node:path";import{closeSync as jh,constants as To,fstatSync as fa,fsyncSync as Vh,lstatSync as Rn,mkdirSync as mu,openSync as pu,readdirSync as pa,readFileSync as Kh,realpathSync as Kr,renameSync as qh,rmdirSync as gu,statSync as ma,unlinkSync as ga,writeFileSync as Yh}from"node:fs";import{isAbsolute as hu,join as Sr,normalize as Zh,parse as xi,relative as ha,resolve as ya,sep as Ri}from"node:path";function Pe(){let M=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${M()}${M()}`}var Xh=Symbol("PolicyFilesystemScope"),Jh=Symbol("PolicyFilesystemTarget"),yu=To.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(M){super(`Unable to access ${M} filesystem safely.`)}}function v(M,L){return{[Xh]:!0,root:ya(M),label:L}}function Io(M,L){let F=Zh(L);if(L===""||hu(L)||F===".."||F.startsWith(`..${Ri}`))throw new r(M.label);return{[Jh]:!0,scope:M,relativePath:F,path:Sr(M.root,F)}}function i(M,L){return Io(M,ha(M.root,ya(L)))}function ie(M,L="rules policy"){let F=ya(M),q=xi(F).dir;return Io(v(q,L),ha(q,F))}function n(M){return Kn(M.scope.label,()=>{if(!Xt(M))return null;let L=pu(M.path,To.O_RDONLY|yu);return Cu(L,()=>{let F=fa(L);if(!F.isFile())throw new r(M.scope.label);let q=Kh(L,"utf-8"),ne=Rn(M.path);if(!ne.isFile()||ne.isSymbolicLink()||F.dev!==ne.dev||F.ino!==ne.ino)throw new r(M.scope.label);return Xt(M),q})})}function g(M,L,F=384,q){let ne=`${M.path}.${Pe()}.tmp`;Kn(M.scope.label,()=>{ey(M),Xt(M);let re=pu(ne,To.O_CREAT|To.O_EXCL|To.O_WRONLY|yu,F),ue=Cu(re,()=>{let ve=fa(re);if(!ve.isFile())throw new r(M.scope.label);Yh(re,L,"utf-8"),Vh(re);let xe=fa(re);if(!xe.isFile()||xe.dev!==ve.dev||xe.ino!==ve.ino)throw new r(M.scope.label);return xe});Xt(M),ny(M,ne,ue.dev,ue.ino),qh(ne,M.path),q?.(M.path),Xt(M)},()=>ry(ne))}function bu(M,L){if(M.path===L.path)return!0;return Kn(M.scope.label,()=>{if(!Xt(M)||!Xt(L))return!1;let F=(q)=>Sr(Kr(xi(q).dir),xi(q).base);return F(M.path)===F(L.path)})}function pe(M){let L=Kn(M.scope.label,()=>{if(!Xt(M,"directory"))return null;let F=pa(M.path);return Xt(M,"directory"),F});if(!L)return null;return Kn(M.scope.label,()=>{let F=L.map((q)=>{let ne=Io(M.scope,Sr(M.relativePath,q)),re=Rn(ne.path);if(re.isSymbolicLink()||!re.isFile()&&!re.isDirectory())throw new r(M.scope.label);return _i(ba(M.scope),Kr(ne.path),M.scope.label),{name:q,kind:re.isDirectory()?"directory":"file"}});return Xt(M,"directory"),F})}function j(M){Kn(M.scope.label,()=>{if(!Xt(M))return;ga(M.path),Xt(M)})}function it(M){Kn(M.scope.label,()=>{if(!Qh(M))return;vu(M),Xt(M,"directory")})}function st(M){Kn(M.scope.label,()=>{if(!Xt(M,"directory"))return;gu(M.path),Xt(M,"directory")})}function Qh(M){return Kn(M.scope.label,()=>{if(!Xt(M,"directory"))return!1;return Su(M),!0})}function Kn(M,L,F){try{return L()}catch(q){if(F?.(),q instanceof r)throw q;throw new r(M)}}function Cu(M,L){try{return L()}finally{jh(M)}}function Xt(M,L="file"){let F=Eu(M.scope);if(!F)return!1;let q=M.relativePath.split(Ri);for(let ne of q.keys()){let re=Sr(M.scope.root,...q.slice(0,ne+1)),ue=Rn(re,{throwIfNoEntry:!1});if(!ue)return!1;if(ue.isSymbolicLink())throw new r(M.scope.label);if(ne<q.length-1&&!ue.isDirectory())throw new r(M.scope.label);if(ne===q.length-1&&(L==="file"?!ue.isFile():!ue.isDirectory()))throw new r(M.scope.label);_i(F,Kr(re),M.scope.label)}return!0}function Su(M){for(let L of pa(M.path)){let F=Io(M.scope,Sr(M.relativePath,L)),q=Rn(F.path);if(q.isSymbolicLink()||!q.isDirectory()&&!q.isFile())throw new r(M.scope.label);if(q.isDirectory())Su(F)}Xt(M,"directory")}function vu(M){for(let L of pa(M.path)){let F=Io(M.scope,Sr(M.relativePath,L)),q=Rn(F.path);if(q.isSymbolicLink())throw new r(M.scope.label);if(q.isDirectory()){vu(F);continue}if(!q.isFile())throw new r(M.scope.label);ga(F.path)}gu(M.path)}function ey(M){ty(M.scope);let L=ba(M.scope),F=M.relativePath.split(Ri).slice(0,-1);for(let q of F.keys()){let ne=Sr(M.scope.root,...F.slice(0,q+1));if(!Rn(ne,{throwIfNoEntry:!1}))mu(ne,{mode:448});let re=Rn(ne);if(!re.isDirectory()||re.isSymbolicLink())throw new r(M.scope.label);_i(L,Kr(ne),M.scope.label)}}function ty(M){if(Rn(M.root,{throwIfNoEntry:!1})){if(!ma(M.root).isDirectory())throw new r(M.label);return}let L=[],F=M.root;while(!Rn(F,{throwIfNoEntry:!1})){L.unshift(F);let q=xi(F).dir;if(q===F)throw new r(M.label);F=q}if(!ma(F).isDirectory())throw new r(M.label);for(let q of L){mu(q,{mode:448});let ne=Rn(q);if(!ne.isDirectory()||ne.isSymbolicLink())throw new r(M.label)}}function Eu(M){if(!Rn(M.root,{throwIfNoEntry:!1}))return null;if(!ma(M.root).isDirectory())throw new r(M.label);return Kr(M.root)}function ba(M){let L=Eu(M);if(!L)throw new r(M.label);return L}function ny(M,L,F,q){let ne=Rn(L);if(!ne.isFile()||ne.isSymbolicLink()||ne.dev!==F||ne.ino!==q)throw new r(M.scope.label);_i(ba(M.scope),Kr(L),M.scope.label)}function _i(M,L,F){let q=ha(M,L);if(q===".."||q.startsWith(`..${Ri}`)||hu(q))throw new r(F)}function ry(M){try{ga(M)}catch{}}import{dirname as vr,isAbsolute as ly,join as xr,relative as cy,resolve as Er,sep as uy}from"node:path";var u=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,fe="rulebook.json",me=".cc-safety-net/rules";var xu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,oy=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Ru=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,iy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),sy="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),at=new RegExp(`^${iy}/(${u.source.slice(1,-1)})/${sy}$`);function ay(M){return`.cc-safety-net/rules/${M}/rulebook.json`}function _u(M){if(S(M))try{return D(M),null}catch(L){return L instanceof Error?L.message:String(L)}return u.test(M)?null:`Local rulebook sources must be bare names matching ${u}: ${M}`}function D(M){if(M.startsWith("github:"))throw Error(`Invalid rulebook source: ${M}`);let L=M.match(xu);if(!L?.[1]||!L[2]||!L[3])throw Error(`Invalid GitHub rulebook source: ${M}`);let F=L[3].lastIndexOf("/");if(F<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${M}`);let q=L[3].slice(0,F),ne=L[3].slice(F+1);if(!q||!Ru.test(q))throw Error(`GitHub rulebook refs must use valid path segments: ${M}`);if(!ne||!u.test(ne))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${M}`);return{owner:L[1],repo:L[2],ref:q,path:ay(ne),name:ne}}function Y(M){return oy.test(M)}function se(M){return Ru.test(M)}function S(M){return xu.test(M)}function ct(M){if(!u.test(M))throw Error(`Local rulebook sources must be bare names matching ${u}: ${M}`)}var wu="rule.json",wi="policy.json",Pu=".cc-safety-net",dy="rules",fy="CC_SAFETY_NET_HOME",Au="`cc-safety-net rule update`";function my(M){return Er(M,me)}function U(M){return xr(my(M),wu)}function b(M){return xr(Er(M),Pu,wi)}function Ee(M,L={}){return L.userConfigDir??(L.userConfigPath?vr(L.userConfigPath):xr(py(M),dy))}function py(M){let L=M.env.get(fy);return L?Er(yn(L)):xr(M.home,Pu)}function G(M,L={}){return xr(Ee(M,L),wu)}function d(M,L={}){return xr(vr(Ee(M,L)),wi)}function Z(M,L){let F=L.userConfigPath??G(M,L),q=L.projectConfigPath??U(L.cwd),ne=Ke(M,L),re=Je(q,L.cwd);return{userConfigPath:F,projectConfigPath:q,userScope:ne,projectScope:re,userConfigTarget:i(ne,F),projectConfigTarget:i(re,q)}}function Ke(M,L){let F=L.userConfigPath?vr(vr(Er(L.userConfigPath))):vr(Er(L.userConfigDir??Ee(M,L)));return v(F,"user policy")}function Je(M,L){let F=Er(L),q=Er(M),ne=cy(F,q);if(ne!==".."&&!ne.startsWith(`..${uy}`)&&!ly(ne))return v(F,"project policy");return v(vr(vr(q)),"project policy")}function N(M,L){return xr(M,L,fe)}var bn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,P=256,jt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Tu=new Set(["python","python3","python2","node","ruby","perl"]),Pi=/^python(?:[23](?:\.\d+)*)?$/,_n=new Set(["awk","gawk","nawk","mawk"]),Ai=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Iu="Rulebook exceeds CC Safety Net's safe validation limits.",ku="Additional rulebook validation errors were omitted.",Tn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ou(M){if(Ca(M.allowed_commands,Tn.maxAllowedCommands)||Ca(M.rules,Tn.maxRules)||Ca(M.tests,Tn.maxTests))return!1;let{maxAggregateStringCodeUnits:L,maxTotalBlockArgs:F}=Tn,q=(ne,re=!1)=>{if(typeof ne!=="string")return!0;if(ne.length>Tn.maxStringCodeUnits||re&&ne.length>Tn.maxFixtureCommandCodeUnits||ne.length>L)return!1;return L-=ne.length,!0};if(!q(M.name)||!q(M.version)||!q(M.description)||!q(M.author)||!q(M.migrated_from))return!1;if(Array.isArray(M.allowed_commands)){for(let ne of M.allowed_commands)if(!q(ne))return!1}if(Array.isArray(M.rules))for(let ne of M.rules){if(!ne||typeof ne!=="object")continue;let re=ne;if(!q(re.name)||!q(re.command)||!q(re.subcommand)||!q(re.reason)||!q(re.intent))return!1;let ue=re.match&&typeof re.match==="object"?re.match:{};for(let ve of[re.block_args,ue.command_path,ue.any_args,ue.exclude_args]){if(!Array.isArray(ve))continue;if(ve.length>Tn.maxBlockArgsPerRule||ve.length>F)return!1;F-=ve.length;for(let xe of ve)if(!q(xe))return!1}}if(Array.isArray(M.tests))for(let ne of M.tests){if(!ne||typeof ne!=="object")continue;let re=ne;if(!q(re.command,!0)||!q(re.expect)||!q(re.rule))return!1}return!0}function Ca(M,L){return Array.isArray(M)&&M.length>L}var Sa=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ge=64,he="Rule config exceeds CC Safety Net's safe source limit.";function kt(M){return At(M).toLowerCase()}function At(M){return M.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??M}function ln(M,L){let F=new Set,q=!1;for(let ne of M){if(ne==="--"){q=!0;continue}if(q)continue;if(ne.startsWith("-")&&!ne.startsWith("--")&&ne.length>1)for(let re=1;re<ne.length;re++){let ue=ne[re];if(!ue||!/[a-zA-Z]/.test(ue))break;let ve=`-${ue}`;if(F.add(ve),L?.shortOptsWithValue?.has(ve))break}}return F}var gy={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},va=new Set(["--init-file","--rcfile"]);function Ea(M,L,F,q){let ne=!1,re=0,ue=!1,ve=!1,xe=!1;for(let He=1;He<L.length;He++){let ft=L[He];if(ft===void 0)break;if(M==="ksh"&&ft==="o"&&He+1<L.length){if(q==="argv"){let mt=L.slice(He+1);if(L[0]==="-"&&(mt==="c"||mt[0]==="-"&&mt.endsWith("c")))ue=!0}break}if(M==="ksh"&&ft==="o"&&He+1===L.length&&(F?.startsWith("-")||F?.startsWith("+")))break;if(M==="zsh"&&ft==="o"&&He+1<L.length)break;if(q==="startup"&&ft==="i")ne=L[0]==="-";if(q==="argv"&&L[0]==="-"&&ft==="c")ue=!0;if(q==="argv"&&ft==="n")xe=L[0]==="-";if(q==="argv"&&ft==="s")ve=L[0]==="-";if(!gy[M]?.includes(ft))continue;if(He+1===L.length)re++;break}return{interactive:ne,followingValues:re,commandSelected:ue,stdinMode:ve,syntaxCheck:xe}}function Cn(M){let L=At(M[0]??"").toLowerCase(),F=!1,q=!1,ne=!1;for(let re=1;re<M.length;re++){let ue=M[re];if(ue===void 0)break;if(ue==="--"){let xe=F&&M[re+1]!==void 0?re+1:null;return{command:xe===null?null:M[xe]??null,commandIndex:xe,scriptIndex:!F&&!q&&M[re+1]!==void 0?re+1:null,readsStdinAsCommands:!F&&(q||M[re+1]===void 0),syntaxCheck:ne}}if(ue==="-"||ue[0]!=="-"&&ue[0]!=="+")return{command:F?ue:null,commandIndex:F?re:null,scriptIndex:!F&&!q&&ue!=="-"?re:null,readsStdinAsCommands:!F&&(q||ue==="-"),syntaxCheck:ne};if(ue.startsWith("--")){let xe=ue.split("=",1)[0]??ue;if(L==="bash"&&va.has(xe)&&!ue.includes("="))re++;continue}let ve=Ea(L,ue,M[re+1],"argv");if(ve.commandSelected)F=!0;if(ve.syntaxCheck)ne=!0;if(ve.stdinMode)q=!0;re+=ve.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!F,syntaxCheck:ne}}function ko(M,L){if(L.escaped)return L.escaped=!1,!0;if(M==="\\"&&!L.inSingle)return L.escaped=!0,!0;if(M==="'"&&!L.inDouble)return L.inSingle=!L.inSingle,!0;if(M==='"'&&!L.inSingle)return L.inDouble=!L.inDouble,!0;return!1}function Ti(M){let L={inSingle:!1,inDouble:!1,escaped:!1};for(let F of hy(M))ko(F,L);return L.inSingle||L.inDouble}function hy(M){let L="",F={inSingle:!1,inDouble:!1,escaped:!1},q=!1,ne=!0;for(let re=0;re<M.length;re++){let ue=M[re];if(!ue)break;if(q){if(ue===`
-`||ue==="\r")L+=ue,q=!1,F.escaped=!1;continue}if(ue==="#"&&!F.inSingle&&!F.inDouble&&ne){q=!0;continue}if(L+=ue,!F.inSingle&&!F.inDouble&&!F.escaped)ne=/[\s;&|()<>]/.test(ue);ko(ue,F)}return L}var xa=new Set(["rm","find","xargs","parallel"]),yy=new Set(["git","busybox",...xa,...jt,...Tu,..._n]),by=new Set(["python","node","ruby","perl"]);function Ae(M){let L=kt(M);return yy.has(L)||In(L)}function In(M){return by.has(Cy(M))}function Cy(M){let L=At(M).toLowerCase();return Pi.test(L)?"python":L}var lt={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(M){try{let L=n(Sy(M));if(L===null)return{config:null,errors:[]};if(!L.trim())return{config:null,errors:["Config file is empty"]};let F=JSON.parse(L),q=Ye(F);if(q.errors.length>0)return{config:null,errors:q.errors};return{config:{version:1,rules:F.rules??[],overrides:F.overrides??{},transparent_wrappers:F.transparent_wrappers??[]},errors:[]}}catch(L){if(L instanceof r)return{config:null,errors:[L.message]};let F=L instanceof Error?L.message:String(L);return{config:null,errors:[L instanceof SyntaxError?"Invalid JSON":F]}}}function Sy(M){return typeof M==="string"?ie(M):M}var e=(M,L)=>({path:M,message:L,kind:"typed"}),Jt=(M,L)=>({path:M,message:L,kind:"custom"});function Ie(M){let L=new Set;return M.flatMap((F,q)=>{let ne=qr(F)?F.name:void 0;if(typeof ne!=="string")return[];if(L.has(ne.toLowerCase()))return[Jt(["rules",q,"name"],`duplicate rule name "${ne}"`)];return L.add(ne.toLowerCase()),[]})}var ke=`must be one of ${Sa.join(", ")}`,vy=/^[^/]+\/[^/]+$/,Ey=["version","rules","overrides","transparent_wrappers"];function Ye(M){let L=xy(M);return{errors:ae(Ze(L,Ey,(F)=>F.kind==="custom"),": "," "),sources:ky(M,L)}}function xy(M){if(!qr(M))return[e([],"Config must be an object")];let L=Array.isArray(M.rules)&&M.rules.length>ge;return[...M.version===1?[]:[e(["version"],"must be 1")],...Ry(M.rules,L),...Py(M.overrides),...Ty(M.transparent_wrappers),...L?[]:wy(M.rules),...qr(M.overrides)?Object.keys(M.overrides).filter((F)=>!vy.test(F)).map((F)=>Jt(["overrides",F],"must use <rulebook-name>/<rule-name>")):[],...Iy(M.transparent_wrappers)]}function Ry(M,L){if(M===void 0)return[];if(!Array.isArray(M))return[e(["rules"],"must be an array of rulebook source strings"),...Mu(M,ge)?[e(["rules"],he)]:[]];if(L)return[{path:["rules"],message:he,kind:"limit"}];return M.flatMap((F,q)=>{if(typeof F!=="string")return[e(["rules",q],"must be a rulebook source string"),..._y(F,1)?[e(["rules",q],"must be a non-empty rulebook source string")]:[]];return F===""?[e(["rules",q],"must be a non-empty rulebook source string")]:[]})}function Mu(M,L){let F=Du(M);return F!==void 0&&!(F<=L)}function _y(M,L){let F=Du(M);return F!==void 0&&!(F>=L)}function Du(M){if(M===null||M===void 0)return;let L=M.length;return L===void 0?void 0:Number(L)}function wy(M){if(!Array.isArray(M))return[];let L=new Set;return M.flatMap((F,q)=>{if(typeof F!=="string"||F==="")return[];if(F.trim()==="")return[Jt(["rules",q],"must be a non-empty rulebook source string")];let ne=_u(F);if(ne)return[Jt(["rules",q],ne)];if(L.has(F))return[Jt(["rules",q],`duplicate rulebook source "${F}"`)];return L.add(F),[]})}function Py(M){if(M===void 0)return[];if(!qr(M))return[e(["overrides"],"must be an object if provided")];return Object.keys(M).flatMap((L)=>{let F=M[L];if(F==="off")return[];if(!qr(F))return[e(["overrides",L],'must be "off" or an object')];return[...Ay(F.reason,["overrides",L,"reason"]),...F.intent===void 0||Re(F.intent)?[]:[e(["overrides",L,"intent"],ke)]]})}function Ay(M,L){if(typeof M!=="string")return[e(L,"required non-empty string"),...Mu(M,P)?[e(L,`must be at most ${P} characters`)]:[]];if(M==="")return[e(L,"required non-empty string")];return M.length>P?[e(L,`must be at most ${P} characters`)]:[]}function Ty(M){if(M===void 0)return[];if(!Array.isArray(M))return[e(["transparent_wrappers"],"must be an array of command strings")];return M.flatMap((L,F)=>{if(typeof L!=="string")return[e(["transparent_wrappers",F],"must be a command string")];return w.test(L)?[]:[e(["transparent_wrappers",F],"must match command pattern")]})}function Iy(M){if(!Array.isArray(M))return[];let L=new Set;return M.flatMap((F,q)=>{if(typeof F!=="string"||!w.test(F))return[];if(L.has(F))return[Jt(["transparent_wrappers",q],`duplicate command "${F}"`)];if(Ae(F))return[Jt(["transparent_wrappers",q],`reserved command "${F}" cannot be a wrapper`)];return L.add(F),[]})}function ky(M,L){let F=qr(M)?M.rules:void 0;if(!Array.isArray(F))return new Set;if(L.some((ne)=>ne.path.length===1&&ne.path[0]==="rules"))return new Set;let q=new Set(L.filter((ne)=>ne.path[0]==="rules"&&typeof ne.path[1]==="number").map((ne)=>ne.path[1]));return new Set(F.filter((ne,re)=>typeof ne==="string"&&!q.has(re)))}function Ze(M,L,F){let q=M.map((ue)=>ue.path[1]),ne=[...new Set(q.filter((ue)=>typeof ue==="string"))],re=(ue,ve)=>[ue.path.length===0?-1:L.indexOf(String(ue.path[0])),typeof ve==="number"?ve:ne.indexOf(String(ve)),F(ue)?0:1];return M.map((ue,ve)=>({issue:ue,rank:re(ue,q[ve])})).sort((ue,ve)=>ue.rank[0]-ve.rank[0]||ue.rank[1]-ve.rank[1]||ue.rank[2]-ve.rank[2]).map((ue)=>ue.issue)}function ae(M,L,F){return[...new Set(M.map((q)=>{let ne=Ra(q.path);if(q.kind==="unknownKeys")return`${ne?`${ne}.`:""}unknown field "${q.message}"`;if(q.kind==="key"||q.kind==="limit"||q.path.length===0)return q.message;return`${ne}${q.path.length===1?F:L}${q.message}`}))]}function Ra(M){return M.map((L,F)=>{if(typeof L==="number")return`[${L}]`;return F===0?String(L):`.${String(L)}`}).join("")}function Re(M){return Sa.includes(M)}function qr(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function ce(M){let L=Dy(M);if(L.errors.length>0)throw Error(L.errors.join("; "));return M}var Oy=`required non-empty string up to ${P} characters`,Nu="must be a non-empty array of unique non-empty strings",My="required non-empty array of non-empty strings";function Dy(M){if(!or(M))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ou(M))return{errors:[Iu],ruleNames:new Set};let L=[...M.rulebook_version===1||M.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ae(Ny(M,M.rulebook_version===2),": ",": ")];return{errors:L.length>Tn.maxValidationErrors?[...L.slice(0,Tn.maxValidationErrors),ku]:L,ruleNames:new Set(Oe(M).map((F)=>F.toLowerCase()))}}function Oe(M){let L=or(M)?M.rules:void 0;return(Array.isArray(L)?L:[]).flatMap((F)=>{let q=or(F)?F.name:void 0;return typeof q==="string"?[q]:[]})}function Ny(M,L){return[...typeof M.name==="string"&&u.test(M.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof M.version==="string"&&M.version!==""?[]:[e(["version"],"required non-empty string")],...Ly(M.allowed_commands),...Wy(M.rules,L),...By(M.tests),...$y(M),...Uy(M)]}function Ly(M){if(!Array.isArray(M))return[e(["allowed_commands"],"required array")];let L=new Set;return[...M.flatMap((F,q)=>typeof F==="string"&&w.test(F)?[]:[e(["allowed_commands",q],"must match command pattern")]),...M.flatMap((F,q)=>{if(typeof F!=="string"||!w.test(F))return[];if(L.has(F))return[Jt(["allowed_commands",q],`duplicate command "${F}"`)];return L.add(F),[]})]}function Wy(M,L){if(!Array.isArray(M))return[e(["rules"],"required array")];return[...M.flatMap((F,q)=>{if(!or(F))return[e(["rules",q],"must be an object")];return L?Fy(F,["rules",q]):Gy(F,["rules",q])}),...Ie(M)]}function Gy(M,L){return[...Lu(M.name,L),...Wu(M.command,L),...M.subcommand===void 0||typeof M.subcommand==="string"&&w.test(M.subcommand)?[]:[e([...L,"subcommand"],"must match command pattern")],...Ii(M.block_args,[...L,"block_args"],"required non-empty array",!1),...Gu(M.reason,L),...Fu(M.intent,L)]}function Fy(M,L){return[...Lu(M.name,L),...Wu(M.command,L),...Gu(M.reason,L),...Fu(M.intent,L),...zy(M.match,[...L,"match"]),...M.subcommand===void 0?[]:[e([...L,"subcommand"],"not supported in rulebook_version 2")],...M.block_args===void 0?[]:[e([...L,"block_args"],"not supported in rulebook_version 2")]]}function Lu(M,L){if(typeof M!=="string")return[e([...L,"name"],"required string")];return u.test(M)?[]:[e([...L,"name"],"must match rule name pattern")]}function Wu(M,L){return typeof M==="string"&&w.test(M)?[]:[e([...L,"command"],"required string matching command pattern")]}function Gu(M,L){return typeof M==="string"&&M!==""&&M.length<=P?[]:[e([...L,"reason"],Oy)]}function Fu(M,L){return M===void 0||Re(M)?[]:[e([...L,"intent"],ke)]}function zy(M,L){if(!or(M))return[e(L,"required object")];return[...Ii(M.command_path,[...L,"command_path"],My,!1),...M.any_args===void 0?[]:Ii(M.any_args,[...L,"any_args"],Nu,!0),...M.exclude_args===void 0?[]:Ii(M.exclude_args,[...L,"exclude_args"],Nu,!0)]}function Ii(M,L,F,q){if(!Array.isArray(M))return[e(L,F)];let ne=M.flatMap((re,ue)=>{if(typeof re!=="string")return[e([...L,ue],"must be a non-empty string")];return re===""?[Jt([...L,ue],"must be a non-empty string")]:[]});if(M.some((re)=>typeof re!=="string"))return ne;return[...ne,...M.length===0?[Jt(L,F)]:[],...q&&new Set(M).size!==M.length?[Jt(L,"must not contain duplicate values")]:[]]}function By(M){if(M===void 0)return[];if(!Array.isArray(M))return[e(["tests"],"must be an array if provided")];return M.flatMap((L,F)=>{if(!or(L))return[e(["tests",F],"must be an object")];return[...typeof L.command==="string"&&L.command.trim()!==""?[]:[e(["tests",F,"command"],"required non-empty string")],...L.expect==="blocked"||L.expect==="allowed"?[]:[e(["tests",F,"expect"],'must be "blocked" or "allowed"')],...L.rule===void 0||typeof L.rule==="string"?[]:[e(["tests",F,"rule"],"must be a string if provided")],...L.expect==="blocked"&&typeof L.rule!=="string"?[Jt(["tests",F,"rule"],"required string for blocked fixtures")]:[]]})}function $y(M){if(!Array.isArray(M.tests))return[];let L=new Set(Oe(M));return[...new Set(M.tests.flatMap((F)=>or(F)&&F.expect==="blocked"&&typeof F.rule==="string"?[F.rule]:[]))].filter((F)=>!L.has(F)).map((F)=>Jt(["tests"],`blocked fixture references unknown rule "${F}"`))}function Uy(M){if(!Array.isArray(M.allowed_commands)||!Array.isArray(M.rules))return[];let L=new Set(M.allowed_commands.filter((F)=>typeof F==="string"));return M.rules.flatMap((F,q)=>{let ne=or(F)?F.command:void 0;if(typeof ne!=="string"||L.has(ne))return[];return[Jt(["rules",q,"command"],`"${ne}" must be listed in allowed_commands`)]})}function or(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function X(M,L){let F=Z(M,L),q;try{q=bu(F.userConfigTarget,F.projectConfigTarget)}catch(pt){if(pt instanceof r)return Jy(F,pt.message);throw pt}let ne=m(F.userConfigTarget),re=q?{config:null,errors:[]}:m(F.projectConfigTarget),ue=Bu(F.userConfigPath,ne.errors),ve=Bu(F.projectConfigPath,re.errors),xe=new Set,He=ne.config?_a(ne.config,Rr(F.userConfigPath),"user",F.userScope,xe):$u(),ft=re.config?_a(re.config,Rr(F.projectConfigPath),"project",F.projectScope,xe):$u(),mt=ne.config?.overrides??{},dt=re.config?.overrides??{};return{rules:[...zu(He.rules,mt),...zu(ft.rules,dt)],transparent_wrappers:Zy(ne.config,re.config),rulebooks:[...He.rulebooks,...ft.rulebooks],errors:[...ue,...ve,...He.errors,...ft.errors],warnings:[...He.warnings,...ft.warnings,...He.canValidateOverrides?wa(mt,He.knownRuleIds,F.userConfigPath):[],...He.canValidateOverrides?Xy(dt,He.knownRuleIds,F.projectConfigPath):[],...ft.canValidateOverrides?wa(dt,ft.knownRuleIds,F.projectConfigPath):[]],userConfig:ne.config??void 0,projectConfig:re.config??void 0,...F}}function H(M,L){let F=Hy(M,L);if(!F)return[];return[...F.scope.errors,...F.scope.warnings,...jy(F.config,F.scope,M)]}function Hy(M,L){let F=L??v(Rr(Rr(M)),"rules policy"),q=m(i(F,M)).config;if(!q)return null;return{config:q,scope:_a(q,Rr(M),"project",F)}}function jy(M,L,F){return L.canValidateOverrides?wa(M.overrides??{},L.knownRuleIds,F):[]}function _a(M,L,F,q=v(Rr(Rr(L)),F==="user"?"user policy":"project policy"),ne=new Set){let re=[],ue=[],ve=M.rules.flatMap((He)=>{let ft=Ky(He,L,q);if(ft.errors.length>0||!ft.rulebook)return re.push(...ft.errors),[];let mt=ft.rulebook;if(ne.has(mt.name))return ue.push(`duplicate active rulebook name "${mt.name}" for ${He}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ne.add(mt.name),[{rules:Vy(mt),rulebook:{source:F,spec:He,name:mt.name,version:mt.version,rules:mt.rules.map((dt)=>`${mt.name}/${dt.name}`)}}]}),xe=ve.flatMap((He)=>He.rules);return{rules:xe,rulebooks:ve.map((He)=>He.rulebook),knownRuleIds:new Set(xe.map((He)=>He.name)),errors:re,warnings:ue,canValidateOverrides:re.length===0}}function Vy(M){if(M.rulebook_version===2)return M.rules.map((L)=>({name:`${M.name}/${L.name}`,command:L.command,block_args:[],match:L.match,reason:L.reason,intent:L.intent}));return M.rules.map((L)=>({...L,name:`${M.name}/${L.name}`,match:void 0}))}function Ky(M,L,F){let q=De(M),ne=N(L,q),re=Yy(ne,F);if("error"in re)return{rulebook:null,errors:[re.error]};if(re.content===null)return{rulebook:null,errors:[`missing rulebook file ${ne} for ${M}; ${qy(M)}`]};let ue=ye(re.content);if("problem"in ue)return{rulebook:null,errors:[`invalid rulebook ${ne}: ${ue.problem}; fix that file`]};if(ue.rulebook.name!==q)return{rulebook:null,errors:[`rulebook name "${ue.rulebook.name}" in ${ne} must match source "${M}"; fix that file`]};return{rulebook:ue.rulebook,errors:[]}}function De(M){return S(M)?D(M).name:M}function qy(M){return S(M)?`run ${Au} to vendor ${M}`:"create that file or remove that source from the rules config"}function Yy(M,L){try{return{content:n(i(L,M))}}catch(F){if(F instanceof r)return{error:F.message};throw F}}function ye(M){let L;try{L=JSON.parse(M)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ce(L)}}catch(F){return{problem:F instanceof Error?F.message:"invalid rulebook"}}}function Zy(M,L){return[...new Set([...M?.transparent_wrappers??[],...L?.transparent_wrappers??[]])]}function zu(M,L){return M.flatMap((F)=>{let q=L[F.name];if(q==="off")return[];if(q&&typeof q==="object")return[{...F,intent:q.intent??F.intent,reason:q.reason}];return[F]})}function wa(M,L,F){return Object.keys(M).filter((q)=>!L.has(q)).map((q)=>`unknown override key "${q}" in ${F}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Xy(M,L,F){return Object.keys(M).filter((q)=>L.has(q)).map((q)=>`project override cannot target user-scoped rule "${q}" in ${F}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Bu(M,L){return L.map((F)=>F.startsWith("Unable to access ")?F:`${M}: ${F}`)}function Jy(M,L){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[L],warnings:[],userConfigPath:M.userConfigPath,projectConfigPath:M.projectConfigPath}}function $u(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as cb,readFileSync as ub}from"node:fs";var Uu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Pa=new Set(Uu.map((M)=>M.id)),W=Uu,Qy=new Map(W.map((M)=>[M.id,M.intent]));function Et(M,L){return{id:M,reason:L,intent:Qy.get(M)??"manual_only"}}var Aa=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],ki={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},eb=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],tb=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ta=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...tb.flatMap((M)=>eb.map((L)=>({id:["secret.home",M.idSlug,L.slice(1)].join("."),category:"Home path",label:[M.label,L].join(""),description:["Blocks home ",M.label,L," credential backup files."].join(""),suffixParts:[...M.directoryParts,[M.basename,L].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Oi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Hu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],nb=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ia=Hu.map((M)=>({id:`secret.variant.${M.slug}.separator`,category:"Variant",label:`${M.label}-* / ${M.label}_*`,description:`Blocks ${M.label} variants with dash or underscore suffixes.`,prefix:M.prefix})),ka=Hu.flatMap((M)=>nb.map((L)=>({id:`secret.variant.${M.slug}.${L.slice(1)}`,category:"Variant",label:`${M.label}${L}`,description:`Blocks ${M.label}${L} private credential variants.`,prefix:M.prefix,suffix:L}))),Oo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Oa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((M)=>({id:`secret.ext.${M}`,category:"Extension",label:`.${M}`,description:`Blocks files with the .${M} extension.`,extension:M})),Ma=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Xe=[...Aa,ki,...Ta,...Ia,...ka,Oo,...Oa,...Ma,...Oi].map((M)=>({id:M.id,category:M.category,label:M.label,...M.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in M?{paths:M.paths}:{description:M.description}})),Mi=new Set(Oi.flatMap((M)=>M.category==="Coding CLI config"?[M.id]:[])),Da=new Set(Xe.map((M)=>M.id));import{isAbsolute as Na,join as rb,normalize as ob,sep as Di}from"node:path";var Ni=process.platform==="win32",ju=/[*?]/;function La(M){let L=M.trim(),F=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Ni?L.replaceAll("\\","/"):L);if(!F)return null;let q=F[1]??"",ne=F[2]??"";if(ju.test(q)||ne==="."||ne==="..")return null;return{root:q||"/",name:ne}}function Mo(M,L){if(M==="~")return L;if(M.startsWith("~/"))return`${L}${M.slice(1)}`;return M}function Wa(M,L){if(typeof M!=="string"||M.trim()==="")return"must be a non-empty path string";let F=Mo(M.trim(),L);if(!Na(F))return"must be an absolute path or start with ~/";return Do(F,L)}function Ga(M,L){let F=Vu(M,L);if(F===null)return"must be a non-empty path string";if(!Na(F))return null;if(Do(F,L)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var ib="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",sb="cannot cover the guard's own configuration";function Vu(M,L){if(typeof M!=="string"||M.trim()==="")return null;let F=M.trim(),q=Ni?F.replaceAll("\\","/"):F;return Mo(q.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),L)}function Fa(M,L){let F=Vu(M,L);if(F===null)return"must be a non-empty path string";let q=La(F)?.root??F;if(ju.test(q))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Na(q))return null;if(Do(q,L)!==null)return ib;return ab(q,L)?sb:null}function ab(M,L){let F=Li(M),q=Li(rb(L,".cc-safety-net"));return F===q||F.startsWith(`${q}${Di}`)}function Do(M,L){let F=Li(M),q=Li(L);if(F===q)return"cannot be the home directory";let ne=F.endsWith(Di)?F:`${F}${Di}`;if(q.startsWith(ne))return"cannot contain the home directory";return null}function Li(M){let L=ob(M);if(Ni)L=L.replace(/\//g,"\\").toLowerCase();if(L.length>(Ni?3:1)&&L.endsWith(Di))L=L.slice(0,-1);return L}var Ku=30,Wi=1,Gi=365;function qu(M){if(typeof M!=="number"||!Number.isInteger(M))return 30;if(M<1)return 1;return M>365?365:M}var Yu=new Set(W.filter((M)=>M.catastrophic).map((M)=>M.id));function Pt(M,L){if(!M)return null;if(Yu.has(M.id))return M;if(L?.destructiveCommandProtectionEnabled===!1)return null;let F=L?.effectiveDestructiveCommandRules[M.id];return F&&!F.enabled?null:M}function Qt(M,L,F){if(Yu.has(L))return!0;if(M?.destructiveCommandProtectionEnabled===!1)return!1;return M?.effectiveDestructiveCommandRules[L]?.enabled??F}function B(M,L){return Object.freeze(Object.fromEntries(W.map((F)=>{let q=F.activationCapability?L[F.activationCapability]:void 0,ne=q?.enabled??!0,re=M.destructiveCommandRuleOverrides[F.id],ue=F.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...re?{override:re}:{}}:M.destructiveCommandProtectionEnabled?re?{enabled:re==="on",inheritedEnabled:ne,changesInherited:re==="on"!==ne,source:"rule_override",...F.activationCapability?{activationCapability:F.activationCapability}:{},override:re}:{enabled:ne,inheritedEnabled:ne,changesInherited:!1,source:q?.source??"built_in_default",...F.activationCapability?{activationCapability:F.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ne,changesInherited:!1,source:"master_disabled",...F.activationCapability?{activationCapability:F.activationCapability}:{},...re?{override:re}:{}};return[F.id,Object.freeze(ue)]})))}function Zu(M,L){return Object.freeze({...M,effectiveDestructiveCommandRules:B(M,L)})}var Xu={standard:0,strict:1,paranoid:2};function Q(M,L){return{policy:{version:1,safety:{level:L.safety?.level??M.safety.level,overrides:{...M.safety.overrides,...L.safety?.overrides}},workflow:{worktree_mode:L.workflow?.worktree_mode??M.workflow.worktree_mode},destructive_command_protection:{enabled:L.destructive_command_protection?.enabled??M.destructive_command_protection.enabled,overrides:{...M.destructive_command_protection.overrides,...L.destructive_command_protection?.overrides},allow_paths:za(M.destructive_command_protection.allow_paths,L.destructive_command_protection?.allow_paths)},secret_protection:{enabled:L.secret_protection?.enabled??M.secret_protection.enabled,overrides:{...M.secret_protection.overrides,...L.secret_protection?.overrides},deny_paths:za(M.secret_protection.deny_paths,L.secret_protection?.deny_paths),allow_paths:za(M.secret_protection.allow_paths,L.secret_protection?.allow_paths)},audit:M.audit},weakenings:lb(M,L)}}function za(M,L){return[...new Set([...M,...L??[]])]}function lb(M,L){let F=L.safety?.level,q=vi[M.safety.level];return[...F&&Xu[F]<Xu[M.safety.level]?[`project policy lowers level: ${M.safety.level} -> ${F}`]:[],...Vr.flatMap((ne)=>L.safety?.overrides?.[ne]===!1&&(M.safety.overrides[ne]??q[ne])?[`project policy disables ${ne}`]:[]),...L.workflow?.worktree_mode===!0&&!M.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...L.destructive_command_protection?.enabled===!1&&M.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...L.secret_protection?.enabled===!1&&M.secret_protection.enabled?["project policy disables secret protection"]:[],...Ju(L.destructive_command_protection?.overrides,(ne)=>M.destructive_command_protection.enabled&&M.destructive_command_protection.overrides[ne]!=="off"),...Ju(L.secret_protection?.overrides,(ne)=>M.secret_protection.enabled&&(M.secret_protection.overrides[ne]==="on"?!0:M.secret_protection.overrides[ne]!=="off"&&!Mi.has(ne))),...M.destructive_command_protection.enabled?Qu(M.destructive_command_protection.allow_paths,L.destructive_command_protection?.allow_paths).map((ne)=>`project policy adds destructive allow path: ${ne}`):[],...M.secret_protection.enabled?Qu(M.secret_protection.allow_paths,L.secret_protection?.allow_paths).map((ne)=>`project policy adds secret allow path: ${ne}`):[]]}function Ju(M,L){return Object.entries(M??{}).flatMap(([F,q])=>q==="off"&&L(F)?[`project policy disables rule ${F}`]:[])}function Qu(M,L){return(L??[]).filter((F)=>!M.includes(F))}var Ua=new Set(["standard","strict","paranoid"]),ee={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Ku}};function rd(M,L){let F=hb(d(M,L),M.home),q=Le(b(L.cwd),M.home),ne=le(q.parsed,M.home),re=Object.keys(ne.policy).length>0?Q(F.gui??ee,ne.policy):void 0,ue=[...F.errors,...q.errors,...ne.diagnostics],ve=(F.fallback==="defaults"&&re?"salvaged":F.fallback)??(F.gui?void 0:q.fallback)??(ue.length>0?"salvaged":void 0),xe=ne.policy.safety?.level?"project":F.levelPresent?"user":"default";return{...re?$a(re.policy):F.policy,errors:ue,...ve?{fallback:ve}:{},...q.exists?{policyScopes:{levelScope:xe,weakenings:re?.weakenings??[]}}:{}}}var db="project policy audit settings are ignored; audit is user scope only";function le(M,L){if(!Sn(M))return{policy:{},diagnostics:[]};let F=Sn(M.safety)?M.safety:{},q=Sn(M.workflow)?M.workflow:{},ne=Sn(M.destructive_command_protection)?M.destructive_command_protection:{},re=Sn(M.secret_protection)?M.secret_protection:{},ue={...Ua.has(F.level)?{level:F.level}:{},...Sn(F.overrides)?ed({overrides:od(F.overrides,Vr,["safety","overrides"],_r)}):{}},ve={...typeof ne.enabled==="boolean"?{enabled:ne.enabled}:{},...ne.overrides!==void 0?{overrides:Fi(ne.overrides,Pa,sd,_r)}:{},...ne.allow_paths!==void 0?{allow_paths:Zr(ne.allow_paths,Wa,L,["destructive_command_protection","allow_paths"],_r)}:{}},xe={...typeof re.enabled==="boolean"?{enabled:re.enabled}:{},...re.overrides!==void 0?{overrides:Fi(re.overrides,Da,ad,_r)}:{},...re.deny_paths!==void 0?{deny_paths:Zr(re.deny_paths,Ga,L,["secret_protection","deny_paths"],_r)}:{},...re.allow_paths!==void 0?{allow_paths:Zr(re.allow_paths,Fa,L,["secret_protection","allow_paths"],_r)}:{}};return{policy:ed({safety:ue,workflow:typeof q.worktree_mode==="boolean"?{worktree_mode:q.worktree_mode}:{},destructive_command_protection:ve,secret_protection:xe}),diagnostics:M.audit===void 0?[]:[db]}}function od(M,L,F,q){return Object.fromEntries(L.flatMap((ne)=>{let re=M[ne];if(typeof re==="boolean")return[[ne,re]];if(re!==void 0)q(e([...F,ne],Ha));return[]}))}function ed(M){return Object.fromEntries(Object.entries(M).flatMap((L)=>Object.keys(L[1]).length>0?[L]:[]))}var _r=()=>{return},Ha="must be a boolean",ja="must be an object if provided",id=`must be an integer between ${Wi} and ${Gi}`,sd={path:["destructive_command_protection","overrides"],label:"destructive command"},ad={path:["secret_protection","overrides"],label:"secret protection"},Qe=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function et(M,L){let F=[];return{policy:ld(M,L,(ne)=>{F.push(ne)}),issues:F}}function C(M,L){return ld(M,L,_r)}function ld(M,L,F){if(!Sn(M))return F(e([],"Config must be an object")),z();if(M.version!==1)F(e(["version"],"must be 1"));let q=Yr(M.safety,["safety"],["level","overrides"],F),ne=Yr(q.overrides,["safety","overrides"],Vr,F),re=Yr(M.workflow,["workflow"],["worktree_mode"],F),ue=Yr(M.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],F),ve=Yr(M.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],F),xe=Yr(M.audit,["audit"],["retention_days"],F);return cd(M,Qe,[],F),{version:1,safety:{level:fb(q.level,F),overrides:od(ne,Vr,["safety","overrides"],F)},workflow:{worktree_mode:Ba(re.worktree_mode,["workflow","worktree_mode"],!1,F)},destructive_command_protection:{enabled:Ba(ue.enabled,["destructive_command_protection","enabled"],!0,F),overrides:Fi(ue.overrides,Pa,sd,F),allow_paths:Zr(ue.allow_paths,Wa,L,["destructive_command_protection","allow_paths"],F)},secret_protection:{enabled:Ba(ve.enabled,["secret_protection","enabled"],!0,F),overrides:Fi(ve.overrides,Da,ad,F),deny_paths:Zr(ve.deny_paths,Ga,L,["secret_protection","deny_paths"],F),allow_paths:Zr(ve.allow_paths,Fa,L,["secret_protection","allow_paths"],F)},audit:{retention_days:mb(xe.retention_days,F)}}}function Yr(M,L,F,q){if(M===void 0)return{};if(!Sn(M))return q(e(L,ja)),{};return cd(M,F,L,q),M}function cd(M,L,F,q){for(let ne of Object.keys(M).filter((re)=>!L.includes(re)))q({path:F,message:ne,kind:"unknownKeys"})}function fb(M,L){if(M===void 0)return"standard";if(Ua.has(M))return M;return L(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ba(M,L,F,q){if(typeof M==="boolean")return M;if(M!==void 0)q(e(L,Ha));return F}function mb(M,L){if(!(M===void 0||typeof M==="number"&&Number.isInteger(M)&&M>=Wi&&M<=Gi))L(e(["audit","retention_days"],id));return qu(M)}function Fi(M,L,F,q){if(M===void 0)return{};if(!Sn(M))return q(e(F.path,ja)),{};return Object.fromEntries(Object.entries(M).flatMap(([ne,re])=>{if(!L.has(ne))return q({path:[...F.path,ne],message:`unknown ${F.label} rule id "${ne}"`,kind:"key"}),[];if(re==="on"||re==="off")return[[ne,re]];return q(e([...F.path,ne],'must be "on" or "off"')),[]}))}function Zr(M,L,F,q,ne){if(M===void 0)return[];if(!Array.isArray(M))return ne(e(q,"must be an array of paths")),[];return M.flatMap((re,ue)=>{let ve=L(re,F);if(ve===null)return[re];return ne(typeof re==="string"?Jt([...q,ue],ve):e([...q,ue],ve)),[]})}function Sn(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function z(){return structuredClone(ee)}function Ne(M,L){let F=R({safety:Me(M.safety)},L),q=B({destructiveCommandProtectionEnabled:M.destructive_command_protection.enabled,destructiveCommandRuleOverrides:M.destructive_command_protection.overrides},F.capabilities),ne=Object.values(q),re=ne.filter((ue)=>ue.source!=="catastrophic");return{selectedPreset:M.safety.level,effectiveLevel:F.effectiveLevel,capabilities:F.capabilities,rules:q,counts:{enabled:re.filter((ue)=>ue.enabled).length,disabled:re.filter((ue)=>!ue.enabled).length,effectiveCustomizations:ne.filter((ue)=>ue.changesInherited).length}}}function Le(M,L){if(!cb(M))return{exists:!1,policy:z(),errors:[]};try{let F=ub(M,"utf-8");if(!F.trim())return{exists:!0,policy:z(),errors:[`${M}: Config file is empty`],fallback:"defaults"};let q=JSON.parse(F),ne=et(q,L);if(ne.issues.length===0)return{exists:!0,parsed:q,policy:ne.policy,errors:[]};return{exists:!0,parsed:q,policy:ne.policy,errors:ne.issues.map((re)=>`${M}: ${gb(re)}`),fallback:Sn(q)?"salvaged":"defaults"}}catch(F){let q=F instanceof Error?F.message:String(F);return{exists:!0,policy:z(),errors:[`${M}: ${F instanceof SyntaxError?"Invalid JSON":q}`],fallback:"defaults"}}}var pb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[ja,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ha,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[id,`not an integer between ${Wi} and ${Gi}`]]);function gb(M){let L=Ra(M.path);if(M.kind==="unknownKeys")return`${L===""?"":`${L}.`}${M.message}: unknown field`;if(M.kind==="key")return`${L}: unknown rule id`;let F=pb.get(M.message)??M.message;return L===""?F:`${L}: ${F}`}function hb(M,L){let F=Le(M,L);if(!F.exists){let q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Sn(q))return{policy:nd(),errors:[]};let ne=C(q,L);return{policy:$a(ne),gui:ne,errors:[],levelPresent:td(q)}}if(F.parsed===void 0)return{policy:nd(),errors:F.errors,...F.fallback?{fallback:F.fallback}:{}};return{policy:$a(F.policy),gui:F.policy,errors:F.errors,...F.fallback?{fallback:F.fallback}:{},levelPresent:td(F.parsed)}}function td(M){let L=Sn(M)&&Sn(M.safety)?M.safety:{};return Ua.has(L.level)}function Fe(M){let L=Object.entries(M),F=new Set(L.flatMap(([q,ne])=>ne==="on"?[q]:[]));return[...new Set([...[...Mi].filter((q)=>!F.has(q)),...L.flatMap(([q,ne])=>ne==="off"?[q]:[])])]}function nd(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Fe({}),denyPaths:[],allowPaths:[]}}}function $a(M){return{safety:Me(M.safety),worktreeMode:M.workflow.worktree_mode,destructiveCommandProtectionEnabled:M.destructive_command_protection.enabled,destructiveCommandRuleOverrides:M.destructive_command_protection.overrides,destructiveCommandAllowPaths:M.destructive_command_protection.allow_paths,secretProtection:{enabled:M.secret_protection.enabled,disabledRules:Fe(M.secret_protection.overrides),denyPaths:M.secret_protection.deny_paths,allowPaths:M.secret_protection.allow_paths}}}function Me(M){let L={...M.overrides.fail_closed!==void 0?{failClosed:M.overrides.fail_closed}:{},...M.overrides.paranoid_rm!==void 0?{paranoidRm:M.overrides.paranoid_rm}:{},...M.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:M.overrides.paranoid_interpreters}:{}};return{level:M.level,...Object.keys(L).length>0?{overrides:L}:{}}}function E(M,L){let F=X(M,L),q=rd(M,L),ne={rules:F.rules,transparentWrappers:F.transparent_wrappers,safety:q.safety,worktreeMode:q.worktreeMode,destructiveCommandProtectionEnabled:q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:q.destructiveCommandAllowPaths,secretProtection:{enabled:q.secretProtection.enabled??!0,disabledRules:q.secretProtection.disabledRules??[],denyPaths:q.secretProtection.denyPaths,allowPaths:q.secretProtection.allowPaths??[]}},re={...F.userConfig?.overrides,...F.projectConfig?.overrides},ue=Object.freeze(Object.fromEntries(ne.rules.map((ve)=>{let xe=F.rulebooks.find((ft)=>ft.rules.includes(ve.name)),He=re[ve.name];return[ve.name,Object.freeze({id:ve.name,...xe?{rulebook:Object.freeze({name:xe.name,version:xe.version}),...Sb(xe.spec)?{source:xe.spec}:{}}:{},...He&&typeof He==="object"?{override:Object.freeze({type:"reason",reason:He.reason})}:{}})]})));return Te(ne,yb(F,q),ue,q.policyScopes)}function $e(M){if(M.state==="ready")return{state:M.state};return{state:M.state,reason:M.reason}}function yb(M,L){let F=Cb(L);if(M.errors.length===0&&M.warnings.length===0&&!F)return;return{diagnostics:[...M.errors,...M.warnings,...L.errors],reason:vb(M.errors.length>0?bb(M.errors):void 0,M.warnings.length>0?Ka(M.warnings.join("; ")):void 0,F)}}function bb(M){return`${Ka(M.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cb(M){if(M.errors.length===0)return;let L=M.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${M.errors.join("; ")}. Enforcing ${L}; the invalid values are not active. Fix the policy file manually`}function Sb(M){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(M)}function Te(M,L,F=Object.freeze({}),q){let ne=Va(structuredClone(M)),re=q?{policyScopes:Va(structuredClone(q))}:{};if(!L)return Object.freeze({state:"ready",policy:ne,diagnostics:Object.freeze([]),ruleMetadata:F,...re});return Object.freeze({state:"degraded",policy:ne,diagnostics:Object.freeze([...L.diagnostics]),reason:L.reason,ruleMetadata:F,...re})}function Va(M){if(typeof M!=="object"||M===null)return M;for(let L of Object.values(M))Va(L);return Object.freeze(M)}function vb(...M){return Ka(M.filter((L)=>!!L).join("; "))}function Ka(M){return/[.!?]$/.test(M)?M:`${M}.`}function je(M){let L=M.effectiveCapabilities,F=M.strict??L.fail_closed.enabled,q=M.paranoidRm??L.paranoid_rm.enabled,ne=M.paranoidInterpreters??L.paranoid_interpreters.enabled,re={fail_closed:qa(L.fail_closed,M.strict,"strict"),paranoid_rm:qa(L.paranoid_rm,M.paranoidRm,"paranoidRm"),paranoid_interpreters:qa(L.paranoid_interpreters,M.paranoidInterpreters,"paranoidInterpreters")};return{policy:Zu(M.policySnapshot.policy,re),effectiveCapabilities:re,effectiveLevel:da({failClosed:F,paranoidRm:q,paranoidInterpreters:ne}),strict:F,paranoidRm:q,paranoidInterpreters:ne,worktreeMode:M.worktreeMode??!1}}function qa(M,L,F){if(L===void 0||L===M.enabled)return M;return{enabled:L,source:"capability_override",sources:[...M.sources,`analysis options.${F}`]}}import{dirname as w_,isAbsolute as P_,join as A_,parse as T_,resolve as I_,sep as k_}from"node:path";function No(M,L){if(M!=="powershell")return L[0]?.provenance==="command-substitution";let F=L[0]?.text==="&"||L[0]?.text==="."?1:0,q=L[F]?.provenance;return q!==void 0&&q!=="literal"}var Eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function zi(M,L){return M?.provenance==="literal"&&!M.quoted&&M.raw===L&&M.text===L}function Lo(M){let L=zi(M.words[0],"time")?1:0,F=L===1&&zi(M.words[L],"-p")?L+1:L,q=L===1&&zi(M.words[F],"--")?F+1:F,ne=zi(M.words[q],"!")?q+1:q,re=M.words.slice(ne).find((ue)=>!Eb.test(ue.text));return re?.provenance==="literal"?re.text:void 0}var ir=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Bi(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xb(M){return Object.freeze({...M,span:Object.freeze(M.span),words:Object.freeze(M.words),redirections:Object.freeze(M.redirections.map((L)=>Object.freeze({...L,span:Object.freeze(L.span),...L.heredoc?{heredoc:Object.freeze({...L.heredoc,bodySpan:Object.freeze(L.heredoc.bodySpan),terminatorSpan:Object.freeze(L.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(M.nested.map((L)=>cn(L)))})}function $i(M,L,F){M.push(F),L.reset()}function Ui(M){let L=[];return{parts:L,push:(F,q,ne)=>{if(q<=F)return;L.push({raw:M.slice(F,q),span:{start:F,end:q},provenance:ne})}}}function Ya(M){let L=M.parts??[{raw:M.raw,span:M.span,provenance:M.provenance}];return Object.freeze({kind:"word",...M,span:Object.freeze(M.span),parts:Object.freeze(L.map((F)=>Object.freeze({...F,span:Object.freeze(F.span)})))})}function Xr(M,L,F,q,ne,re,ue){return Ya({text:q,raw:M.slice(L,F),span:{start:L,end:F},provenance:ne,quoted:re,...ue?{parts:ue}:{}})}function cn(M){return Object.freeze({...M,span:Object.freeze(M.span),issues:Object.freeze(M.issues.map((L)=>Object.freeze({...L}))),nodes:Object.freeze(M.nodes.map((L)=>{if(L.kind==="command")return xb(L);if(L.kind==="group"||L.kind==="function")return Object.freeze({...L,span:Object.freeze(L.span),body:cn(L.body)});return Object.freeze({...L,span:Object.freeze(L.span)})}))})}function Za(M,L,F){if(L>=F||dd(M[L]??""))return null;let q="",ne=!1,re=!1,ue=L;while(ue<F&&!dd(M[ue]??"")){let ve=M[ue]??"";if(ve==="'"){ne=!0;let xe=ud(M,ue+1,F,"'");q+=xe.text,re||=!xe.closed,ue=xe.next;continue}if(ve==='"'){ne=!0;let xe=ud(M,ue+1,F,'"');q+=xe.text,re||=!xe.closed,ue=xe.next;continue}if(ve==="\\"){ne=!0;let xe=M[ue+1];if(!xe||xe===`
-`||xe==="\r"){re=!0;break}q+=xe,ue+=2;continue}if(ve==="`"||M.startsWith("$(",ue)||M.startsWith("${",ue)||M.startsWith("<(",ue)||M.startsWith(">(",ue))re=!0;q+=ve,ue++}return{delimiter:q,quoted:ne,next:ue,ambiguous:re}}function Xa(M,L,F,q){let ne=[],re=L;for(let ue of q){let ve=re,xe=!1;while(re<F){let He=Rb(M,re,F);if((ue.stripTabs?He.text.replace(/^\t+/,""):He.text)===ue.delimiter){ue.attach({body:ue.stripTabs?_b(M.slice(ve,re)):M.slice(ve,re),delimiter:ue.delimiter,quotedDelimiter:ue.quotedDelimiter,bodySpan:{start:ve,end:re},terminatorSpan:{start:re,end:He.contentEnd}}),re=He.next,xe=!0;break}if(He.next<=re)break;re=He.next}if(xe)continue;return ne.push({code:"unterminated-heredoc",message:`heredoc delimiter ${ue.delimiter} was not found`}),{next:F,issues:ne,terminated:!1}}return{next:re,issues:ne,terminated:!0}}function ud(M,L,F,q){let ne="",re=L;while(re<F&&M[re]!==`
-`&&M[re]!=="\r"){let ue=M[re]??"";if(ue===q)return{text:ne,next:re+1,closed:!0};if(q==='"'&&ue==="\\"&&M[re+1]){let ve=M[re+1]??"";ne+=["$","`",'"',"\\"].includes(ve)?ve:`\\${ve}`,re+=2;continue}ne+=ue,re++}return{text:ne,next:re,closed:!1}}function dd(M){return M!=="\r"&&(/[\s;&|<>)]/u.test(M)||M==="`")}function Rb(M,L,F){let q=L;while(q<F&&M[q]!==`
-`)q++;let ne=q>=F?F:q+1;return{text:M.slice(L,q),contentEnd:q,next:ne}}function _b(M){return M.replace(/(^|\r\n?|\n)\t+/g,"$1")}var gd=new Set(["&&","||","|","|&"]),wb=new Set(["!","do","elif","else","if","then","until","while"]);function hd(M,L){let F={start:0,end:M.length};if(M.length>L.maxInputLength)return cn({kind:"program",dialect:"posix",source:M,span:F,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${L.maxInputLength} UTF-16 code units`}],nodes:[]});let q=Vi(M,0,M.length,L,{used:0,max:L.maxWords},0);return cn({kind:"program",dialect:"posix",source:M,span:F,status:Yi(q.issues,q.limited),issues:q.issues,nodes:q.nodes})}function Vi(M,L,F,q,ne,re,ue){let ve=[],xe=[],He=Bi(),ft=[],mt=()=>{if(He.words.length===0&&He.redirections.length===0)return;let pt={start:He.start,end:He.end},gt=He.words.map((ht)=>ht.text);$i(ve,He,{kind:"command",dialect:"posix",source:M.slice(pt.start,pt.end),span:pt,words:He.words,redirections:He.redirections,nested:He.nested,displayText:xe.length>0&&ve.length===0?M.slice(L,F):gt.join(" ")})},dt=L;while(dt<F){let pt=M[dt];if(!pt)break;if(ue&&pt===ue)return mt(),pd(ve,xe),{nodes:ve,issues:xe,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ft};if(qi(pt)){if(pt===`
-`||pt==="\r"){mt();let wt=pt==="\r"&&M[dt+1]===`
-`?dt+2:dt+1,xt=ve.at(-1);if(xt?.kind!=="connector"||!gd.has(xt.operator))ve.push(Object.freeze({kind:"connector",operator:M.slice(dt,wt),span:Object.freeze({start:dt,end:wt})}));if(ft.length>0){let Tt=Xa(M,wt,F,ft.splice(0));xe.push(...Tt.issues),dt=Tt.next;continue}dt=wt;continue}dt++;continue}if(pt==="#"){while(dt<F&&M[dt]!==`
-`&&M[dt]!=="\r")dt++;continue}let gt=He.start===-1?Kb(M,dt,F):void 0;if(gt){if(Qa(ve,xe),re>=q.maxDepth)return Jr(ve,xe,dt,"depth-limit",q.maxDepth);if(!Ja(ne))return Jr(ve,xe,dt,"word-limit",q.maxWords);let wt=Vi(M,gt.braceIndex+1,F,q,ne,re+1,"}"),xt=wt.next,Tt={start:gt.braceIndex+1,end:wt.closed?xt-1:xt},Nt=fd(M,Tt,wt);if(ve.push({kind:"function",name:gt.name,span:{start:dt,end:xt},body:Nt}),xe.push(...wt.issues),wt.pendingHeredocs.length>0||Go(wt.nodes))xe.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ft.push(...wt.pendingHeredocs),wt.limited)return ji(ve,xe,wt.next);if(!wt.closed)xe.push({code:"unclosed-function-body",message:"function body is not closed"});dt=xt;continue}let ht=Ki(M,dt);if(ht){if(mt(),!Rd(ve.at(-1)))xe.push({code:"unexpected-connector",message:`connector ${ht} has no preceding command`});ve.push(Object.freeze({kind:"connector",operator:ht,span:Object.freeze({start:dt,end:dt+ht.length})})),dt+=ht.length;continue}if(pt===")"){mt(),xe.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),ve.push({kind:"unknown",source:pt,span:{start:dt,end:dt+1}}),dt++;continue}if((pt==="("||pt==="{"&&Db(M,dt,F))&&He.start===-1){if(Qa(ve,xe),re>=q.maxDepth)return Jr(ve,xe,dt,"depth-limit",q.maxDepth);let wt=pt==="("?")":"}",xt=Vi(M,dt+1,F,q,ne,re+1,wt),Tt=xt.next,Nt={start:dt+1,end:xt.closed?Tt-1:Tt},Yt=fd(M,Nt,xt);if(ve.push({kind:"group",style:pt==="("?"subshell":"brace",span:{start:dt,end:Tt},body:Yt}),xe.push(...xt.issues),xt.pendingHeredocs.length>0||Go(xt.nodes))xe.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ft.push(...xt.pendingHeredocs),xt.limited)return ji(ve,xe,xt.next);if(!xt.closed)xe.push({code:pt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${pt} group is not closed`});dt=Tt;continue}let yt=(pt==="<"||pt===">")&&M[dt+1]!=="("?Ib(M,dt):null;if(yt){let wt=He.words.at(-1),xt=wt&&wt.span.end===dt&&/^[0-9]+$/.test(wt.raw)?Number(wt.raw):void 0;if(xt!==void 0)He.words.pop();let Tt=xt===void 0?dt:wt?.span.start??dt;He.start=He.start===-1?dt:He.start;let Nt=dt+yt.length;while(Nt<F&&/[ \t]/.test(M[Nt]??""))Nt++;let Yt=M[Nt],Vn=Nt>dt+yt.length&&Yt==="#",pn=!Yt||qi(Yt)||!!Ki(M,Nt)||Yt===ue||Yt===")"||Vn||(Yt==="<"||Yt===">")&&M[Nt+1]!=="(",yr=yt==="<<"||yt==="<<-",Gt=yr?Za(M,Nt,F):void 0,Mt=Gt?{word:Xr(M,Nt,Gt.next,Gt.delimiter,"literal",Gt.quoted),nested:[],issues:[],next:Gt.next,limited:!1}:!pn?el(M,Nt,F,q,ne,re):void 0;if(Mt){if(xe.push(...Mt.issues),Mt.limited)return ji(ve,xe,Mt.next);if(!Ja(ne))return Jr(ve,xe,Mt.next,"word-limit",q.maxWords)}let rn=Mt?.next??dt+yt.length,Kt={kind:"redirection",operator:yt,span:{start:Tt,end:rn},...xt===void 0?{}:{fd:xt},...Mt?{target:Mt.word}:{}};if(He.redirections.push(Kt),yr&&!Gt)xe.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Gt){if(Gt.ambiguous||Gt.delimiter.length===0)xe.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qt=He.nested;ft.push({delimiter:Gt.delimiter,quotedDelimiter:Gt.quoted,stripTabs:yt==="<<-",attach:(gn)=>{if(Kt.heredoc=gn,gn.quotedDelimiter)return;qt.push(...Ab(M,gn.bodySpan.start,gn.bodySpan.end,q,ne,re+1))}})}if(!yr&&!Mt)xe.push({code:"missing-redirection-target",message:`redirection ${yt} requires a target word`});if(Mt)He.nested.push(...Mt.nested);He.end=rn,dt=rn;continue}let bt=He.start===-1;if(bt)Qa(ve,xe);let St=el(M,dt,F,q,ne,re);if(xe.push(...St.issues),St.limited)return ji(ve,xe,St.next);let Ct=Wb(He.words)?$b(M,St.word,ne.max-ne.used,q.maxDepth,q.maxInputLength):void 0;if(Ct?.limitCode)return Jr(ve,xe,St.next,Ct.limitCode,Ct.limitCode==="word-limit"?q.maxWords:Ct.limitCode==="depth-limit"?q.maxDepth:q.maxInputLength);let Rt=Ct?.words??[St.word];for(let wt of Rt){if(!Ja(ne))return Jr(ve,xe,St.next,"word-limit",q.maxWords);He.words.push(wt)}if(He.start=He.start===-1?dt:He.start,He.end=St.next,He.nested.push(...St.nested),bt&&_d(St.word))mt();dt=St.next>dt?St.next:dt+1}return mt(),pd(ve,xe),xe.push(...qb(ft)),{nodes:ve,issues:xe,next:dt,closed:ue===void 0,limited:!1,pendingHeredocs:[]}}function fd(M,L,F){return{kind:"program",dialect:"posix",source:M.slice(L.start,L.end),span:L,status:Yi(F.issues,F.limited),issues:F.issues,nodes:F.nodes}}function el(M,L,F,q,ne,re){let ue="",ve=L,xe=!1,He="literal",ft=[],mt=[],dt=!1;while(ve<F){let pt=M[ve],gt=(pt==="<"||pt===">")&&M[ve+1]==="(";if(!pt||qi(pt)||(pt===";"||pt==="|"||pt==="&")&&Ki(M,ve)||(pt==="<"||pt===">")&&!gt)break;if(pt===")")break;if(pt==="'"){xe=!0;let yt=M.indexOf("'",ve+1);if(yt===-1||yt>=F){ue+=M.slice(ve+1,F),mt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),ve=F;break}ue+=M.slice(ve+1,yt),ve=yt+1;continue}if(pt==='"'){xe=!0;let yt=Pb(M,ve,F,q,ne,re);if(ue+=yt.text,ft.push(...yt.nested),mt.push(...yt.issues),dt||=yt.limited,He=Wo(He,yt.provenance),ve=yt.next,dt)break;continue}if(M.startsWith("$'",ve)){xe=!0;let yt=kb(M,ve+2,F);if(ue+=yt.text,mt.push(...yt.issues),!yt.closed)mt.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});ve=yt.next;continue}if(pt==="\\"){let yt=M[ve+1];if(!yt){mt.push({code:"trailing-escape",message:"escape has no following character"}),ve++;break}if(yt===`
-`){ve+=2;continue}ue+=yt,ve+=2;continue}let ht=pt==="$"||pt==="<"||pt===">"||pt==="`"?Zi(M,ve,F,q,ne,re):null;if(ht){let yt=yd(ht,ft,mt);if(dt||=yt.limited,He=Wo(He,yt.provenance),ve=yt.next,dt)break;continue}if(pt==="$"){let yt=Sd(M,ve,F,ue,He);ue=yt.text,He=yt.provenance,ve=yt.next;continue}if(pt==="*"||pt==="?"||pt==="[")He=Wo(He,"glob");ue+=pt,ve++}return{word:Xr(M,L,ve,ue,He,xe,He==="literal"?void 0:Mb(M,L,ve)),nested:ft,issues:mt,next:ve,limited:dt}}function Pb(M,L,F,q,ne,re){let ue="",ve="literal",xe=[],He=[],ft=!1,mt=L+1;while(mt<F){let dt=M[mt];if(dt==='"')return{text:ue,provenance:ve,nested:xe,issues:He,next:mt+1,limited:ft};if(dt==="\\"&&M[mt+1]){let gt=M[mt+1]??"";if(gt===`
-`){mt+=2;continue}if(gt==="\r"&&M[mt+2]===`
-`){mt+=3;continue}ue+=["$","`",'"',"\\"].includes(gt)?gt:`\\${gt}`,mt+=2;continue}if(M.startsWith("$((",mt)){let gt=tl(M,mt+3,F,"))"),ht=gt===-1?F:gt+2;if(ue+=M.slice(mt,ht),gt===-1)He.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});mt=ht;continue}let pt=Zi(M,mt,F,q,ne,re);if(pt){let gt=yd(pt,xe,He);if(mt=gt.next,ft||=gt.limited,ve=Wo(ve,gt.provenance),ft)return{text:ue,provenance:ve,nested:xe,issues:He,next:mt,limited:ft};continue}if(dt==="$"){let gt=Sd(M,mt,F,ue,ve);ue=gt.text,ve=gt.provenance,mt=gt.next;continue}ue+=dt??"",mt++}return He.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:ue,provenance:ve,nested:xe,issues:He,next:F,limited:ft}}function Zi(M,L,F,q,ne,re){let ue=M.startsWith("$((",L),ve=M.startsWith("$(",L)&&!ue,xe=M.startsWith("<(",L)||M.startsWith(">(",L),He=M[L]==="`";if(!ue&&!ve&&!xe&&!He)return null;let ft=ue?3:He?1:2,mt=ue?"))":He?"`":")",dt=tl(M,L+ft,F,mt),pt=dt===-1?F:dt,gt=dt===-1?F:dt+mt.length;if(re>=q.maxDepth)return{program:Vb(M,L+ft,pt,"depth-limit"),next:gt,provenance:ue?"arithmetic":"command-substitution"};if(ue){let St=[],Ct=[],Rt=!1,wt=L+ft;while(wt<pt){let xt=Zi(M,wt,pt,q,ne,re+1);if(!xt){wt++;continue}if(St.push(...xt.program.nodes),Ct.push(...xt.program.issues),Rt||=xt.program.status==="limited",wt=xt.next,Rt)break}if(dt===-1)Ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:cn({kind:"program",dialect:"posix",source:M.slice(L+ft,pt),span:{start:L+ft,end:pt},status:Yi(Ct,Rt),issues:Ct,nodes:St}),next:gt,provenance:"arithmetic"}}let ht=Vi(M,L+ft,pt,q,ne,re+1),yt=dt===-1?[{code:"unclosed-command-substitution",message:`${M.slice(L,L+ft)} substitution is not closed`}]:[],bt=(He||xe)&&Go(ht.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:cn({kind:"program",dialect:"posix",source:M.slice(L+ft,pt),span:{start:L+ft,end:pt},status:Yi([...ht.issues,...yt,...bt],ht.limited),issues:[...ht.issues,...yt,...bt],nodes:ht.nodes}),next:gt,provenance:"command-substitution"}}function Ab(M,L,F,q,ne,re){let ue=[],ve=L;while(ve<F){let xe=M[ve];if(xe==="\\"){ve+=2;continue}let He=xe==="$"||xe==="`"?Zi(M,ve,F,q,ne,re):null;if(!He){ve++;continue}if(ue.push(He.program),ve=He.next,He.program.status==="limited")break}return ue}function yd(M,L,F){return L.push(M.program),F.push(...M.program.issues),{provenance:M.provenance,next:M.next,limited:M.program.status==="limited"}}function tl(M,L,F,q){if(q==="`"){for(let ve=L;ve<F;ve++){if(M[ve]==="\\"){ve++;continue}if(M[ve]==="`")return ve}return-1}let ne=1,re={single:!1,double:!1},ue=[];for(let ve=L;ve<F;ve++){let xe=M[ve];if((xe===`
-`||xe==="\r")&&ue.length>0){let ft=xe==="\r"&&M[ve+1]===`
-`?ve+2:ve+1,mt=Xa(M,ft,F,ue.splice(0));if(!mt.terminated)return-1;ve=mt.next-1;continue}let He=bd(M,ve,L,F,re);if(He!==null){ve=He;continue}if(!re.double&&M.startsWith("$((",ve)){let ft=Tb(M,ve+3,F);if(ft===-1)return-1;ve=ft+1;continue}if(q===")"&&!re.double&&xe==="<"&&M[ve+1]==="<"&&M[ve+2]!=="<"){let ft=M[ve+2]==="-",mt=ve+(ft?3:2);while(mt<F&&/[ \t]/.test(M[mt]??""))mt++;let dt=Za(M,mt,F);if(dt){ue.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ft,attach:()=>{return}}),ve=dt.next-1;continue}}if(M.startsWith("$(",ve)&&!M.startsWith("$((",ve)){ne++,ve++;continue}if(xe==="("&&!re.double)ne++;if(xe===")"&&!re.double){if(ne--,ne===0)return q==="))"&&M[ve+1]!==")"?-1:ve}}return-1}function Tb(M,L,F){let q=1,ne={single:!1,double:!1};for(let re=L;re<F;re++){let ue=M[re],ve=bd(M,re,L,F,ne);if(ve!==null){re=ve;continue}if(M.startsWith("$(",re)&&!M.startsWith("$((",re)){q++,re++;continue}if(ue==="("&&!ne.double)q++;if(ue!==")"||ne.double)continue;if(q--,q===0)return M[re+1]===")"?re:-1}return-1}function bd(M,L,F,q,ne){let re=M[L];if(re==="\\"&&!ne.single)return L+1;if(!ne.double&&re==="'")ne.single=!ne.single;if(!ne.single&&re==='"')ne.double=!ne.double;if(ne.single)return L;if(ne.double||re!=="#"||!Yb(M,L,F))return null;let ue=L;while(ue+1<q&&M[ue+1]!==`
-`&&M[ue+1]!=="\r")ue++;return ue}function Ki(M,L){let F=M[L];if(F===";")return";";if(F==="&")return M[L+1]==="&"?"&&":"&";if(F==="|")return M[L+1]==="|"?"||":M[L+1]==="&"?"|&":"|";return null}function Ib(M,L){let F=M[L];if(F===">"){if(M[L+1]===">")return">>";if(M[L+1]==="&")return">&";return M[L+1]==="|"?">|":">"}if(F!=="<")return null;if(M.startsWith("<<<",L))return"<<<";if(M.startsWith("<<-",L))return"<<-";if(M[L+1]==="<")return"<<";if(M[L+1]==="&")return"<&";if(M[L+1]===">")return"<>";return"<"}function qi(M){let L=M.charCodeAt(0);if(L===32||L>=9&&L<=13)return!0;if(L<128)return!1;return/\s/u.test(M)}function Cd(M,L,F){if(M[L+1]==="{"){let ne=M.indexOf("}",L+2);return ne===-1||ne>=F?F:ne+1}let q=L+1;while(q<F&&/[A-Za-z0-9_?@#$!*-]/.test(M[q]??""))q++;return q===L+1?L+1:q}function kb(M,L,F){let q="",ne=[],re=L;while(re<F){let ue=M[re];if(ue==="'")return{text:q,next:re+1,closed:!0,issues:ne};if(ue!=="\\"){q+=ue??"",re++;continue}let ve=Ob(M,re+1,F);if(q+=ve.text,ve.invalidCodePoint!==void 0)ne.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${ve.invalidCodePoint}`});re=ve.next}return{text:q,next:F,closed:!1,issues:ne}}function Ob(M,L,F){let q=M[L];if(!q||L>=F)return{text:"\\",next:L};let ne=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ne.has(q))return{text:ne.get(q)??q,next:L+1};if(q==="x")return Hi(M,L+1,F,16,2,L+1);if(q==="u")return Hi(M,L+1,F,16,4,L+1);if(q==="U")return Hi(M,L+1,F,16,8,L+1);if(/[0-7]/.test(q))return Hi(M,L,F,8,3,L+1);return{text:q,next:L+1}}function Hi(M,L,F,q,ne,re){let ue=q===16?/[0-9a-fA-F]/:/[0-7]/,ve="",xe=L;while(xe<F&&ve.length<ne&&ue.test(M[xe]??""))ve+=M[xe],xe++;if(!ve)return{text:M[re-1]??"",next:re};let He=Number.parseInt(ve,q);return He>1114111||He>=55296&&He<=57343?{text:"�",next:xe,invalidCodePoint:He}:{text:String.fromCodePoint(He),next:xe}}function Yi(M,L=!1){if(L)return"limited";if(M.some((F)=>F.code==="invalid-ansi-c-code-point"||F.code==="missing-heredoc-delimiter"||F.code==="ambiguous-heredoc-delimiter"||F.code==="unterminated-heredoc"||F.code==="unsupported-heredoc-context"))return"invalid";return M.length>0?"partial":"complete"}function Sd(M,L,F,q,ne){let re=Cd(M,L,F);return{text:q+M.slice(L,re),provenance:Wo(ne,"variable"),next:re}}function Mb(M,L,F){let q=Ui(M),ne=L,re=!1,ue=!1,ve=L;while(ve<F){let xe=M[ve];if(xe==="\\"&&!re){ve+=2;continue}if(!ue&&xe==="'"){re=!re,ve++;continue}if(!re&&xe==='"'){ue=!ue,ve++;continue}if(re){ve++;continue}let He=M.startsWith("$((",ve),ft=M.startsWith("$(",ve)&&!He,mt=!ue&&(M.startsWith("<(",ve)||M.startsWith(">(",ve)),dt=xe==="`";if(He||ft||mt||dt){let pt=He?3:dt?1:2,gt=He?"))":dt?"`":")",ht=tl(M,ve+pt,F,gt),yt=ht===-1?F:ht+gt.length;q.push(ne,ve,"literal"),q.push(ve,yt,He?"arithmetic":"command-substitution"),ve=yt,ne=yt;continue}if(xe==="$"){let pt=Cd(M,ve,F);if(pt>ve+1){q.push(ne,ve,"literal"),q.push(ve,pt,"variable"),ve=pt,ne=pt;continue}}if(!ue&&(xe==="*"||xe==="?"||xe==="[")){q.push(ne,ve,"literal"),q.push(ve,ve+1,"glob"),ve++,ne=ve;continue}ve++}return q.push(ne,F,"literal"),q.parts}function Wo(M,L){if(L==="command-substitution"||M==="command-substitution")return"command-substitution";if(L==="arithmetic"||M==="arithmetic")return"arithmetic";if(L==="variable"||M==="variable")return"variable";if(L==="glob"||M==="glob")return"glob";return M}function Db(M,L,F){return L+1>=F||qi(M[L+1]??"")||Ki(M,L+1)!==null}var Nb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Lb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Wb(M){let L=0;while(L<=M.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(M[L]?.text??""))L++;if(L===M.length)return!0;let F=Gb(M,L);if(F===void 0||F===null)return!1;L=F}return!1}function Gb(M,L){let F=M[L]?.text.toLowerCase();if(F==="command")return Fb(M,L);if(F==="env")return zb(M,L);if(F==="sudo")return Bb(M,L);return}function Fb(M,L){if(M[L+1]?.text==="-v")return null;for(let F=L+1;F<M.length;F++){let q=M[F]?.text??"";if(q==="--")return F+1;if(q==="-p"||q==="-v"||q==="-V"||/^-[pvV]+$/.test(q))continue;return F}return M.length}function zb(M,L){for(let F=L+1;F<M.length;F++){let q=M[F]?.text??"";if(q==="--")return F+1;if(Nb.has(q)){if(M[F+1]===void 0)return null;F++;continue}if(q.startsWith("-u=")||q.startsWith("--unset=")||q.startsWith("-C")&&q.length>2||q.startsWith("--chdir=")||q.startsWith("-S")&&q.length>2||q.startsWith("--split-string=")||q.startsWith("-P"))continue;if(q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(q))continue;return F}return M.length}function Bb(M,L){for(let F=L+1;F<M.length;F++){let q=M[F]?.text??"";if(q==="--")return F+1;if(Lb.has(q)){if(M[F+1]===void 0)return null;F++;continue}if(q.startsWith("-"))continue;return F}return M.length}function vd(M,L,F,q){if(M.provenance!=="literal"||!M.raw.includes("{"))return;let ne=Ed(M.raw,L,F,q,!0);if(!ne)return;if("limited"in ne)return{limited:!0};let re=ne.values.map((ue)=>xd(ue,F));if(re.some((ue)=>ue===null))return{limited:!0};return{words:[...new Set(re.filter((ue)=>ue!==null&&ue!==""))]}}function $b(M,L,F,q,ne){if(L.provenance!=="literal"||!L.raw.includes("{"))return;let re=Ed(L.raw,F,q,ne,!1);if(!re)return;if("limited"in re){if(re.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:re.limited==="length"?"brace-expansion-limit":"word-limit"}}let ue=re.values.map((ve)=>xd(ve,q));if(ue.some((ve)=>ve===null))return;return{words:ue.filter((ve)=>ve!==null&&ve!=="").map((ve)=>Xr(M,L.span.start,L.span.end,ve,"literal",!1))}}function Ed(M,L,F,q,ne){let re=[M],ue=M.length,ve=0;while(!0){let xe=re.findIndex((pt)=>md(pt,ne));if(xe===-1)break;if(++ve>F)return{limited:"expansions"};let He=re[xe]??"",ft=md(He,ne);if(!ft||ft.kind==="range")return{limited:"expansions"};let mt=ft.start+He.length-ft.end,dt=ft.alternatives.reduce((pt,gt)=>pt+mt+gt.length,0);if(ue-He.length+dt>q)return{limited:"length"};if(re.length-1+ft.alternatives.length>L)return{limited:"words"};re.splice(xe,1,...Ub(He,ft)),ue+=dt-He.length}return ve===0?void 0:{values:re}}function md(M,L){let F=[],q,ne=null,re=!1;for(let ue=0;ue<M.length;ue++){let ve=M[ue];if(re){re=!1;continue}if(ve==="\\"&&ne!=="'"){re=!0;continue}if(ve===ne){ne=null;continue}if(ne===null&&(ve==="'"||ve==='"')){ne=ve;continue}if(ne!==null)continue;if(ve==="{"){F.push({start:ue,commas:[]});continue}if(ve===","&&F.length>0){F.at(-1)?.commas.push(ue);continue}if(ve!=="}"||F.length===0)continue;let xe=F.pop();if(!xe)continue;let He=xe.commas.length>0?{kind:"alternatives",start:xe.start,end:ue+1,commas:xe.commas}:L&&jb(M.slice(xe.start+1,ue))?{kind:"range",start:xe.start,end:ue+1}:void 0;if(He&&(!q||He.start<q.start))q=He}if(!q||q.kind==="range")return q;return{kind:q.kind,start:q.start,end:q.end,alternatives:Hb(M,q)}}function Ub(M,L){return L.alternatives.map((F)=>`${M.slice(0,L.start)}${F}${M.slice(L.end)}`)}function Hb(M,L){let F=[L.start,...L.commas,L.end-1];return F.slice(0,-1).map((q,ne)=>M.slice(q+1,F[ne+1]))}function jb(M){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(M)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(M)}function xd(M,L){let F=`x${M}`,q=el(F,0,F.length,{maxInputLength:F.length,maxWords:1,maxDepth:L},{used:0,max:1},0);if(q.limited||q.issues.length>0||q.next!==F.length||q.word.provenance!=="literal")return null;return q.word.text.slice(1)}function Vb(M,L,F,q){return cn({kind:"program",dialect:"posix",source:M.slice(L,F),span:{start:L,end:F},status:"limited",issues:[{code:q,message:"command structure exceeds parser limit"}],nodes:[]})}function Jr(M,L,F,q,ne){return{nodes:M,issues:[...L,{code:q,message:`command structure exceeds parser limit ${ne}`}],next:F,closed:!1,limited:!0,pendingHeredocs:[]}}function ji(M,L,F){return{nodes:M,issues:L,next:F,closed:!1,limited:!0,pendingHeredocs:[]}}function Ja(M){return M.used++,M.used<=M.max}function Kb(M,L,F){let q=M.slice(L,F),ne=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(q),re=ne?.[1];if(!ne||!re)return;return{name:re,braceIndex:L+ne[0].lastIndexOf("{")}}function Go(M){return M.some((L)=>{if(L.kind==="command")return L.redirections.some((F)=>F.heredoc)||L.nested.some((F)=>Go(F.nodes));return(L.kind==="group"||L.kind==="function")&&Go(L.body.nodes)})}function qb(M){return M.map((L)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${L.delimiter} was not found`}))}function Rd(M){return M?.kind==="command"||M?.kind==="group"||M?.kind==="function"}function pd(M,L){let F=M.at(-1);if(F?.kind!=="connector"||!gd.has(F.operator))return;L.push({code:"missing-command-after-connector",message:`connector ${F.operator} requires a following command`})}function _d(M){return M?.provenance==="literal"&&!M.quoted&&M.raw===M.text&&wb.has(M.text)}function Qa(M,L){let F=M.at(-1);if(!Rd(F))return;if(F?.kind==="command"&&_d(F.words[0]))return;L.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Yb(M,L,F){return L===F||/[\s;&|()]/u.test(M[L-1]??"")}var Pd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Zb=new Set(["gc","cat","type","cp","mv","rm"]),Ad=["-rec","-for","-path","-literalpath","-whatif"],Xb=/^\$env:\w/i,Jb=/^(?:\$\{?\w+\}?|~)\\./;function Td(M,L){let F=M.toLowerCase().replaceAll("`","");if(![...Pd].some((ne)=>F.includes(ne))&&!(F.includes("rm")&&Ad.some((ne)=>F.includes(ne)))&&!F.includes("<#")&&!Qb(F))return!1;let q=il(M,L);if(Id(q))return!1;return q.issues.some((ne)=>ne.code==="unclosed-block-comment"||ne.code==="comment-depth-limit")||ol(q).some(eC)}function Id(M){return M.nodes.some((L)=>{if(L.kind==="group")return Id(L.body);if(L.kind!=="command")return!1;return L.redirections.some((F)=>F.operator==="<<")})}function Qb(M){if(M.includes("$env:"))return!0;return M.includes("\\")&&(M.includes("$")||M.includes("~"))}function eC(M){let L=M[0]==="&"||M[0]==="."?1:0,F=M[L]?.toLowerCase();if(F&&Pd.has(F))return!0;let q=M.slice(L+1);if(F&&Zb.has(F)&&q.some(tC))return!0;if(F!=="rm")return!1;return q.some((ne)=>{let re=ne.toLowerCase().split(":",1)[0]??"";return Ad.some((ue)=>re.startsWith(ue))})}function tC(M){return Xb.test(M)||Jb.test(M)}function il(M,L){let F={start:0,end:M.length};if(M.length>L.maxInputLength)return cn({kind:"program",dialect:"powershell",source:M,span:F,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${L.maxInputLength} UTF-16 code units`}],nodes:[]});let q=sl(M,0,M.length,L,0);return cn({kind:"program",dialect:"powershell",source:M,span:F,status:sC(q.issues,q.limited),issues:q.issues,nodes:q.nodes})}function sl(M,L,F,q,ne,re=!1){let ue=[],ve=[],xe=Bi(),He=0,ft=!1,mt=()=>{if(xe.words.length===0&&xe.redirections.length===0)return;let pt={start:xe.start,end:xe.end};$i(ue,xe,{kind:"command",dialect:"powershell",source:M.slice(pt.start,pt.end),span:pt,words:xe.words,redirections:xe.redirections,nested:xe.nested,displayText:xe.words.map((gt)=>gt.text).join(" ")})},dt=L;while(dt<F){let pt=M[dt];if(!pt)break;if(re&&pt==="}")return mt(),{nodes:ue,issues:ve,next:dt+1,closed:!0,words:He,limited:ft};let gt=iC(M,dt,F,q.maxDepth);if(gt){if(gt.issue)ve.push(gt.issue);if(gt.limited)return mt(),{nodes:ue,issues:ve,next:gt.next,closed:!1,words:He,limited:!0};dt=gt.next;continue}if(/\s/.test(pt)){if(pt==="\r"||pt===`
-`){mt();let bt=pt==="\r"&&M[dt+1]===`
-`?dt+2:dt+1;ue.push(nl(M,dt,bt)),dt=bt;continue}dt++;continue}let ht=Md(M,dt);if(ht){mt(),ue.push(nl(M,dt,dt+ht.length)),dt+=ht.length;continue}if(pt==="{"){if(mt(),ne>=q.maxDepth)return ve.push(Od(q.maxDepth)),{nodes:ue,issues:ve,next:F,closed:!1,words:He,limited:!0};let bt=sl(M,dt+1,F,q,ne+1,!0),St=bt.closed?bt.next-1:bt.next,Ct=cn({kind:"program",dialect:"powershell",source:M.slice(dt+1,St),span:{start:dt+1,end:St},status:bt.limited?"limited":bt.issues.length>0?"partial":"complete",issues:bt.issues,nodes:bt.nodes});if(ue.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:bt.next}),body:Ct})),ve.push(...bt.issues),!bt.closed)ve.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});He+=bt.words,ft||=bt.limited,dt=bt.next;continue}if(pt==="}"){mt(),ue.push(nl(M,dt,dt+1)),dt++;continue}if(pt===">"||pt==="<"){xe.start=xe.start===-1?dt:xe.start;let bt=M[dt+1]===pt?dt+2:dt+1,St=bt;while(/[ \t]/.test(M[St]??""))St++;let Ct=St<F?wd(M,St,F,q,ne):void 0,Rt=Ct?.next??bt;if(xe.redirections.push(Object.freeze({kind:"redirection",operator:M.slice(dt,bt),span:Object.freeze({start:dt,end:Rt}),...Ct?{target:Ct.word}:{}})),Ct)ve.push(...Ct.issues),xe.nested.push(...Ct.nested),He+=Ct.words,ft||=Ct.limited;xe.end=Rt,dt=Rt;continue}if(pt===","){xe.start=xe.start===-1?dt:xe.start,xe.words.push(Ya({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),xe.end=++dt;continue}let yt=wd(M,dt,F,q,ne);if(xe.start=xe.start===-1?dt:xe.start,xe.end=yt.next,xe.words.push(yt.word),ve.push(...yt.issues),xe.nested.push(...yt.nested),He+=1+yt.words,ft||=yt.limited,He>q.maxWords)return ve.push({code:"word-limit",message:`command exceeds ${q.maxWords} words`}),mt(),{nodes:ue,issues:ve,next:yt.next,closed:!1,words:He,limited:!0};dt=yt.next>dt?yt.next:dt+1}return mt(),{nodes:ue,issues:ve,next:dt,closed:!re,words:He,limited:ft}}function wd(M,L,F,q,ne){let re="",ue="literal",ve=!1,xe=[],He=[],ft=0,mt=!1,dt=(gt)=>{let ht=nC(M,gt,F,q,ne);return re+=M.slice(gt,ht.next),He.push(ht.program),xe.push(...ht.program.issues),ft+=rl(ht.program),mt||=ht.program.status==="limited",ue="command-substitution",ht.next},pt=L;while(pt<F){let gt=M[pt];if(!gt||/\s/.test(gt)||Md(M,pt)||gt===">"||gt==="<"||gt==="#")break;if(gt===",")break;if(gt==="`"){let ht=M[pt+1];if(!ht){xe.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),pt++;break}re+=ht,pt+=2;continue}if(M.startsWith("$(",pt)){pt=dt(pt);continue}if(gt==="'"){ve=!0,pt++;let ht=!1;while(pt<M.length){if(M[pt]==="'"&&M[pt+1]==="'"){re+="'",pt+=2;continue}if(M[pt]==="'"){ht=!0,pt++;break}re+=M[pt]??"",pt++}if(!ht)xe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(gt==='"'){ve=!0,pt++;let ht=!1;while(pt<F){let yt=M[pt];if(yt==="`"&&M[pt+1]){re+=M[pt+1],pt+=2;continue}if(yt==='"'){ht=!0,pt++;break}if(M.startsWith("$(",pt)){pt=dt(pt);continue}if(yt==="$")ue=M[pt+1]==="("?"command-substitution":"variable";re+=yt??"",pt++}if(!ht)xe.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(gt==="$")ue=M[pt+1]==="("?"command-substitution":"variable";if(gt==="@"&&pt===L)ue="variable";re+=gt,pt++}return{word:Xr(M,L,pt,re,ue,ve,ue==="literal"?void 0:rC(M,L,pt)),next:pt,issues:xe,nested:He,words:ft,limited:mt}}function nC(M,L,F,q,ne){let re=kd(M,L+2,F),ue=re===-1?F:re,ve=re===-1?F:re+1;if(ne>=q.maxDepth)return{program:cn({kind:"program",dialect:"powershell",source:M.slice(L+2,ue),span:{start:L+2,end:ue},status:"limited",issues:[Od(q.maxDepth)],nodes:[]}),next:ve};let xe=sl(M,L+2,ue,q,ne+1),He=re===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:cn({kind:"program",dialect:"powershell",source:M.slice(L+2,ue),span:{start:L+2,end:ue},status:xe.limited?"limited":xe.issues.length+He.length>0?"partial":"complete",issues:[...xe.issues,...He],nodes:xe.nodes}),next:ve}}function kd(M,L,F){let q=1,ne=!1,re=!1;for(let ue=L;ue<F;ue++){let ve=M[ue];if(ve==="`"){ue++;continue}if(!re&&ve==="'"){if(ne&&M[ue+1]==="'"){ue++;continue}ne=!ne;continue}if(!ne&&ve==='"'){re=!re;continue}if(ne)continue;if(M.startsWith("$(",ue)){q++,ue++;continue}if(!re&&ve==="(")q++;if(ve!==")")continue;if(q--,q===0)return ue}return-1}function rl(M){let L=0;for(let F of M.nodes){if(F.kind==="group")L+=rl(F.body);if(F.kind==="command"){L+=F.words.length;for(let q of F.nested)L+=rl(q)}}return L}function rC(M,L,F){let q=Ui(M),ne=L,re=!1,ue=L;while(ue<F){let ve=M[ue];if(ve==="`"){ue+=2;continue}if(ve==="'"){if(re&&M[ue+1]==="'"){ue+=2;continue}re=!re,ue++;continue}if(re){ue++;continue}if(M.startsWith("$(",ue)){let xe=kd(M,ue+2,F),He=xe===-1?F:xe+1;q.push(ne,ue,"literal"),q.push(ue,He,"command-substitution"),ue=He,ne=He;continue}if(ve==="$"||ve==="@"&&ue===L){let xe=oC(M,ue+1,F);q.push(ne,ue,"literal"),q.push(ue,xe,"variable"),ue=xe,ne=xe;continue}ue++}return q.push(ne,F,"literal"),q.parts}function oC(M,L,F){if(M[L]==="{"){let ne=M.indexOf("}",L+1);return ne===-1||ne>=F?F:ne+1}let q=L;while(q<F&&/[A-Za-z0-9_:?]/.test(M[q]??""))q++;return q}function Od(M){return{code:"depth-limit",message:`command structure exceeds parser limit ${M}`}}function ol(M){return M.nodes.flatMap((L)=>{if(L.kind==="group")return ol(L.body);if(L.kind!=="command")return[];return[[...L.words,...L.redirections.flatMap((F)=>F.target?[F.target]:[])].sort((F,q)=>F.span.start-q.span.start).filter((F)=>F.text!==""&&F.raw!==",").map((F)=>F.text),...L.nested.flatMap(ol)]})}function Md(M,L){for(let F of["&&","||",";","|"])if(M.startsWith(F,L))return F;return null}function iC(M,L,F,q){if(M[L]==="#"&&M[L+1]!==">"){let ue=L+1;while(ue<F&&M[ue]!=="\r"&&M[ue]!==`
-`)ue++;return{next:ue,limited:!1}}if(!M.startsWith("<#",L))return null;let ne=1,re=L+2;while(re<F){if(M.startsWith("<#",re)){if(ne++,ne>q)return{next:F,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${q}`},limited:!0};re+=2;continue}if(M.startsWith("#>",re)){if(ne--,re+=2,ne===0)return{next:re,limited:!1};continue}re++}return{next:F,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function sC(M,L){if(L)return"limited";if(M.some((F)=>F.code==="unclosed-block-comment"))return"invalid";return M.length>0?"partial":"complete"}function nl(M,L,F){return Object.freeze({kind:"connector",operator:M.slice(L,F),span:Object.freeze({start:L,end:F})})}function h(M,L="auto",F=ir){if(L==="powershell"||L==="auto"&&Td(M.slice(0,F.maxInputLength),F))return il(M,F);return hd(M,F)}function t(M){return M.provenance==="command-substitution"?M.raw:M.text}function te(M,L){return M==="posix"?L:Ht(L.map((F)=>F.text))}function Xi(M,L){return M&&M.provenance!=="unknown"?M.provenance==="literal":!/[$`*?[\]]/.test(L)}function Ht(M){return M.map((L)=>({kind:"word",text:L,raw:L,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function al(M,L){return{value:M,work:L}}function vt(M,L){if(M.work)M.work.units=Math.min(Number.MAX_SAFE_INTEGER,M.work.units+1);return M.value[L]}function Vt(M){return M.value.length}function Fo(M,L,F=1){if(M)M.units=Math.min(Number.MAX_SAFE_INTEGER,M.units+L.length*F)}function vn(M,L){Fo(M,L)}function wr(M){if(!M)return!1;let L=M.charCodeAt(0);return L>=48&&L<=57||L>=65&&L<=90||L===95||L>=97&&L<=122}function Bt(M){if(!M)return!1;let L=M.charCodeAt(0);return L===9||L===10||L===11||L===12||L===13||L===32||L===160||L===65279||L===5760||L>=8192&&L<=8202||L===8232||L===8233||L===8239||L===8287||L===12288}function ll(M){return M===`
-`||M==="\r"||M==="\u2028"||M==="\u2029"}function $t(M,L,F){if(L+F.length>Vt(M))return!1;for(let q=0;q<F.length;q++)if(vt(M,L+q)!==F[q])return!1;return!0}function qn(M,L,F){return!wr(vt(M,L-1))&&$t(M,L,F)&&!wr(vt(M,L+F.length))}function Yn(M,L){return wr(vt(M,L-1))!==wr(vt(M,L))}function en(M){return M===`
-`||M===";"||M==="&"||M==="|"}function Qr(M){return M==="|"||M===";"}function Ji(M,L,F){let q=al(M,F);if(L==="rm")return aC(q);if(L==="dd")return cC(q);return Fd(q,!0)}function Qi(M,L,F){let q=al(M,F);if(L==="rm")return uC(q);if(L==="reset-hard")return Wd(q,"--ha","rd");if(L==="reset-merge")return Wd(q,"--me","rge");if(L==="clean")return pC(q);if(L==="checkout")return hC(q);if(L==="push-force")return yC(q);if(L==="push-refspec")return bC(q);if(L==="push-delete")return CC(q);if(L==="branch")return SC(q);if(L==="tag")return xC(q);if(L==="restore")return RC(q);return Fd(q,!1)}function aC(M){let L=!1,F=!1,q=!1,ne=-1;for(let re=0;re<=Vt(M);re++){let ue=vt(M,re);if(!L){let xe=vt(M,re+2);if(qn(M,re,"rm")&&Bt(xe)&&xe!==`
-`)L=!0,re++;continue}let ve=lC(M,re);if(ue===`
-`||ve!==-1){if(L=!1,F=!1,q=!1,ne=-1,ve!==-1)re=ve-1;continue}if(ue===";"||ue==="&"||ue==="|"||re===Vt(M)){if(ne>=0){let xe=Dd(M,ne,re);F||=xe.recursive,q||=xe.force}if(F&&q)return!0;L=!1,F=!1,q=!1,ne=-1;continue}if(Bt(ue)){if(ne<0)continue;if($t(M,ne,"--")&&re-ne===2){L=!1,F=!1,q=!1,ne=-1;continue}let xe=Dd(M,ne,re);if(F||=xe.recursive,q||=xe.force,F&&q)return!0;ne=-1;continue}if(ne<0)ne=re}return!1}function lC(M,L){if(vt(M,L)!=="\\"||vt(M,L-1)==="\\")return-1;if($t(M,L,String.raw`\n`))return L+2;if($t(M,L,String.raw`\x0a`)||$t(M,L,String.raw`\x0A`))return L+5;if($t(M,L,String.raw`\u000a`)||$t(M,L,String.raw`\u000A`))return L+7;return $t(M,L,String.raw`\012`)?L+4:-1}function Dd(M,L,F){if(Nd(M,L,F,"recursive"))return{recursive:!0,force:!1};if(Nd(M,L,F,"force"))return{recursive:!1,force:!0};if(vt(M,L)!=="-"||vt(M,L+1)==="-")return{recursive:!1,force:!1};let q=!1,ne=!1;for(let re=L+1;re<F;re++){let ue=vt(M,re);q||=ue==="r"||ue==="R",ne||=ue==="f"||ue==="F"}return{recursive:q,force:ne}}function Nd(M,L,F,q){let ne=F-L-2;if(ne<1||ne>q.length||!$t(M,L,"--"))return!1;for(let re=0;re<ne;re++)if(vt(M,L+re+2)!==q[re])return!1;return!0}function cC(M){let L=!1;for(let F=0;F<Vt(M);F++){if(en(vt(M,F))){L=!1;continue}if(qn(M,F,"dd")){L=!0,F++;continue}if(!L||!qn(M,F,"of")||!$t(M,F,"of=/dev/"))continue;let q=F+8;if(q<Vt(M)&&!Bt(vt(M,q))&&vt(M,q)!=="'"&&vt(M,q)!=='"')return!0}return!1}function uC(M){let L=!1,F=!1,q=!1;for(let ne=0;ne<=Vt(M);){let re=vt(M,ne);if(ne===Vt(M)||en(re)){L=!1,F=!1,q=!1,ne++;continue}let ue=fC(M,ne);if(ue>=0){if(dC(M,ue))return!0;let ve=ue,xe=!1;while(Bt(vt(M,ve)))xe||=vt(M,ve)===`
-`,ve++;if(xe)F=!1,q=!1;L=!0,ne=ve;continue}if(!L){ne++;continue}if($t(M,ne,"--")&&(ne===0||Bt(vt(M,ne-1)))&&(!vt(M,ne+2)||Bt(vt(M,ne+2))||en(vt(M,ne+2)))){L=!1,F=!1,q=!1,ne+=2;continue}if(F||=$t(M,ne,"--recursive")&&Yn(M,ne+11)||cl(M,ne,"recursive"),q||=$t(M,ne,"--force")&&Yn(M,ne+7)||cl(M,ne,"force"),F&&q)return!0;ne++}return!1}function cl(M,L,F){if(!$t(M,L,"--"))return!1;let q=0;while(q<=F.length){let ne=vt(M,L+q+2);if(!ne||Bt(ne)||en(ne))break;if(ne!==F[q])return!1;q++}return q>0&&Yn(M,L+q+2)}function dC(M,L){let F=L,q=!1,ne=!1;while(F<Vt(M)){while(Bt(vt(M,F)))F++;let re=F;while(F<Vt(M)&&!Bt(vt(M,F)))F++;if(vt(M,re)!=="-"||F-re===2&&$t(M,re,"--"))return!1;let ue=Ld(M,re,"recursive"),ve=Ld(M,re,"force");if(q&&ve||ne&&ue)return!0;if(q||=ue,ne||=ve,vt(M,re+1)==="-")continue;let xe=mC(M,re,F);if(xe.combined||q&&xe.forceAtBoundary||ne&&xe.recursiveAtBoundary)return!0;q||=xe.recursive,ne||=xe.force}return!1}function Ld(M,L,F){return $t(M,L,`--${F}`)&&Yn(M,L+F.length+2)||cl(M,L,F)}function fC(M,L){if(L>0&&wr(vt(M,L-1)))return-1;let F=L;if(vt(M,F)==="\\")F++;if(vt(M,F)!=="r")return-1;if(F++,vt(M,F)==="\\")F++;if(vt(M,F)!=="m"||!Bt(vt(M,F+1)))return-1;return F+1}function mC(M,L,F){let q=!1,ne=!1,re=!1,ue=!1,ve=!1;if(vt(M,L)!=="-")return{recursive:q,force:ne,recursiveAtBoundary:re,forceAtBoundary:ue,combined:ve};let xe="";for(let He=L+1;He<F;He++){let ft=vt(M,He)??"",mt=(ft==="r"||ft==="f")&&Yn(M,He+1);q||=ft==="r",ne||=ft==="f",re||=ft==="r"&&mt,ue||=ft==="f"&&mt,ve||=(xe==="r"&&ft==="f"||xe==="f"&&ft==="r")&&mt,xe=ft}return{recursive:q,force:ne,recursiveAtBoundary:re,forceAtBoundary:ue,combined:ve}}function Wd(M,L,F){return Bo(M,"reset",Qr,!0,(q)=>vt(M,q)==="-"&&eo(M,q,L,F)?!0:q)}function pC(M){return Bo(M,"clean",Qr,!0,(L)=>{if(vt(M,L)!=="-")return L;if(eo(M,L,"--fo","rce"))return!0;let F=zo(M,L,Qr);for(let q=L+1;q<F;q++)if(vt(M,q)==="f")return!0;return F-1})}function es(M,L,F){if(!qn(M,L,"git"))return null;let q=L+3;if(!Bt(vt(M,q)))return{commandEnd:-1,next:q};while(Bt(vt(M,q)))q++;while(q<Vt(M)){if(en(vt(M,q)))return{commandEnd:-1,next:q};let ne=zo(M,q,en);if(qn(M,q,F))return{commandEnd:q+F.length,next:ne};if(vt(M,q)!=="-")return{commandEnd:-1,next:ne};let re=ne-q===2&&$t(M,q,"--"),ue=gC(M,q,ne);q=ne;while(Bt(vt(M,q)))q++;if(re)return{commandEnd:qn(M,q,F)?q+F.length:-1,next:zo(M,q,en)};if(!ue)continue;if(q>=Vt(M)||en(vt(M,q)))return{commandEnd:-1,next:q};q=zo(M,q,en);while(Bt(vt(M,q)))q++}return{commandEnd:-1,next:q}}function gC(M,L,F){for(let q of bn)if(F-L===q.length&&$t(M,L,q))return!0;return!1}function hC(M){return Gd(M,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function yC(M){return Bo(M,"push",Qr,!0,(L)=>{if(vt(M,L)!=="-")return L;if(vt(M,L+1)==="f"&&!wr(vt(M,L+2))&&!$t(M,L+2,"-with-lease"))return!0;let F=zd(M,L,"--fo","rce");if(F>=0&&!$t(M,F,"-with-lease"))return!0;return L})}function bC(M){return Bo(M,"push",en,!1,(L)=>{if(Bt(vt(M,L))&&vt(M,L+1)==="+"&&L+2<Vt(M)&&!en(vt(M,L+2))&&!Bt(vt(M,L+2)))return!0;if(vt(M,L)===":"&&vt(M,L+1)==="+")return!0;return L})}function CC(M){return Bo(M,"push",en,!1,(L)=>{if(vt(M,L)==="-"&&eo(M,L,"--de","lete"))return!0;if(Bt(vt(M,L))&&vt(M,L+1)===":"&&L+2<Vt(M)&&!Bt(vt(M,L+2))&&!en(vt(M,L+2)))return!0;return L})}function SC(M){let L=!1,F=!1,q=!1;for(let ne=0;ne<=Vt(M);ne++){if(ne===Vt(M)||en(vt(M,ne))){if(F&&q)return!0;L=!1,F=!1,q=!1;continue}if(!L){let ve=es(M,ne,"branch");if(ve){L=ve.commandEnd>=0,ne=Math.max(ne,(L?ve.commandEnd:ve.next)-1);continue}}if(!L||vt(M,ne)!=="-")continue;let re=zo(M,ne,en),ue=vC(M,ne,re);if(F||=ue.deletion,q||=ue.force,F&&q)return!0;ne=re-1}return!1}function vC(M,L,F){let q=!1,ne=!1;for(let re=L;re<F;re++){if(vt(M,re)!=="-")continue;if(eo(M,re,"--de","lete"))q=!0;if(eo(M,re,"--fo","rce"))ne=!0;if(vt(M,re+1)==="-")continue;let ue=re+1,ve=!1,xe=!1,He=!1;while(ue<F&&EC(vt(M,ue))){let ft=vt(M,ue);ve||=ft==="d"||ft==="D",xe||=ft==="f",He||=ft==="D",ue++}if(!Yn(M,ue))continue;q||=ve,ne||=xe||He}return{deletion:q,force:ne}}function EC(M){if(!M)return!1;let L=M.charCodeAt(0);return L>=65&&L<=90||L>=97&&L<=122}function xC(M){return Gd(M,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Gd(M,L){let F=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let q=0;q<Vt(M);q++){let ne=vt(M,q),re=F[F.length-1];if(!re)return!1;let ue=re.escaped;if(re.escaped=!ue&&re.quote!=="'"&&ne==="\\",!ue&&ne==="'"&&re.quote!=='"')re.quote=re.quote==="'"?"":"'";if(!ue&&ne==='"'&&re.quote!=="'")re.quote=re.quote==='"'?"":'"';if(ne==="$"&&vt(M,q+1)==="("&&(F.length===1||!ue&&re.quote!=="'")){F.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),q++;continue}if(!ue&&!re.quote&&F.length>1&&ne==="("){re.depth++;continue}if(!ue&&!re.quote&&F.length>1&&ne===")"){if(re.depth--,re.depth===0)F.pop();continue}if(Bt(ne))re.shortActive=!1,re.hasShortFlag=!1;if(!re.outerActive){let ve=es(M,q,L.command);if(ve){re.outerActive=ve.commandEnd>=0&&Bt(vt(M,ve.commandEnd)),re.shortActive=!1,re.hasShortFlag=!1,q=Math.max(q,(re.outerActive?ve.commandEnd:ve.next)-1);continue}}if(re.outerActive&&ne==="-"){if(eo(M,q,L.longPrefix,L.longOptional))return!0;re.shortActive||=!L.excludedShortStarts.includes(vt(M,q+1)??"")}if(re.hasShortFlag||=re.shortActive&&ne===L.shortFlag,re.hasShortFlag&&Yn(M,q+1))return!0;if(Qr(ne))re.outerActive=!1}return!1}function Bo(M,L,F,q,ne){let re=!1;for(let ue=0;ue<Vt(M);ue++){let ve=vt(M,ue),xe=F(ve);if(!re&&!xe){let He=es(M,ue,L);if(He){re=He.commandEnd>=0&&(!q||Bt(vt(M,He.commandEnd))),ue=Math.max(ue,(re?He.commandEnd:He.next)-1);continue}}if(re){let He=ne(ue);if(He===!0)return!0;for(let ft=ue;ft<=He;ft++)if(F(vt(M,ft)))re=!1;ue=He}if(xe)re=!1}return!1}function RC(M){let L=!1;for(let F=0;F<Vt(M);F++){if(ll(vt(M,F))){if(L)return!0;L=!1;continue}if(!L){let q=es(M,F,"restore");if(q){L=q.commandEnd>=0,F=Math.max(F,(L?q.commandEnd:q.next)-1);continue}}if(L&&vt(M,F)==="-"&&vt(M,F+1)==="-"&&($t(M,F+2,"staged")||$t(M,F+2,"help")))L=!1}return L}function Fd(M,L){let F=!1;for(let q=0;q<Vt(M);q++){let ne=vt(M,q),re=L?ll(ne):en(ne);if(F&&Bt(ne)&&vt(M,q+1)==="-"&&qn(M,q+2,"delete"))return!0;if(re){F=!1;continue}if(qn(M,q,"find"))F=!0,q+=3}return!1}function zo(M,L,F){let q=L;while(q<Vt(M)&&!Bt(vt(M,q))&&!F(vt(M,q)))q++;return q}function zd(M,L,F,q){if(!$t(M,L,F))return-1;let ne=L+F.length;for(let re=0;re<q.length&&vt(M,ne)===q[re];re++)ne++;return Yn(M,ne)?ne:-1}function eo(M,L,F,q){return zd(M,L,F,q)>=0}function wn(M,L){Fo(L,M,2);let F=M.toLowerCase(),q=F.trimStart(),ne=q.startsWith("echo ")||q.startsWith("rg "),re=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let ue of re){if(ue.skipForEchoRg&&ne)continue;let ve=ue.caseSensitive?M:F;if(ue.regex)vn(L,ve);if((ue.regex?.test(ve)??!1)||ue.scan&&Qi(ve,ue.scan,L))return Et("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${ue.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var _C=/^[A-Za-z_][A-Za-z0-9_]*=/;function $d(M,L,F){let q=M.words[0];if(!L||!q||M.words.length!==1||M.dialect!=="posix")return!1;if(!q.quoted||q.provenance!=="literal")return!1;let ne=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(q.text)?.[1];if(!ne)return!1;Fo(F,L.source,2);let re={anchored:new RegExp(`^\\$\\{?${ne}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ne}(?![A-Za-z0-9_])`)};return Ud(L.nodes,q,re)}function Ud(M,L,F){return M.every((q)=>{if(q.kind==="connector")return!0;if(q.kind==="group"||q.kind==="function")return Ud(q.body.nodes,L,F);if(q.kind==="unknown")return!F.loose.test(q.source);return wC(q,L,F)})}function wC(M,L,F){if(M.nested.some((ne)=>F.loose.test(ne.source)))return!1;let q=M.words.findIndex((ne)=>!_C.test(ne.text));return M.words.every((ne,re)=>ne===L||Bd(ne.raw,F.anchored,re!==q))&&M.redirections.every((ne)=>(!ne.heredoc||ne.heredoc.quotedDelimiter||!F.loose.test(ne.heredoc.body))&&(!ne.target||Bd(ne.target.raw,F.anchored,!0)))}function Bd(M,L,F){let q=!1,ne=!1;for(let re=0;re<M.length;re++){let ue=M[re];if(ue==="\\"&&!q){re++;continue}if(!ne&&ue==="'"){q=!q;continue}if(!q&&ue==='"'){ne=!ne;continue}if(q||ue!=="$")continue;if(!L.test(M.slice(re)))continue;if(!ne||!F)return!1}return!0}import{isAbsolute as PC,resolve as Hd}from"node:path";function $o(M,L,F,q){let ne=PC(M)?Hd(M):L?Hd(L,M):void 0;if(!ne)return;try{return Dt(ne,F,q)}catch{return ne}}function jd(M){return!["/dev","/proc","/sys"].some((L)=>M===L||M.startsWith(`${L}/`))}var to="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Uo="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",dl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),AC=new Set(["-p","--print"]),TC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),IC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),kC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),OC=new Map([["python",new Set(["m"])]]),MC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),DC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),LC=/\\\r?\n/g,WC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Vd(M){return ns(M).code}function ts(M){return ns(M).sources}function Kd(M){return WC.get(ml(M))??[]}function ns(M){let L=ml(M[0]??"");if(!dl.has(L))return{code:null,sources:[],optionsOpen:!1};let F=[],q=[],ne=!0;for(let re=1;re<M.length;re++){let ue=M[re];if(ue===void 0)break;if(ue==="--")return kn(L,F,q,ne,M[re+1]===void 0?void 0:re+1,M[re+1]);if(ue===""||ue==="-"||!ue.startsWith("-"))return kn(L,F,q,ne,re,ue);if(L==="node"&&AC.has(ue)){let mt=M[re+1];if(mt===void 0)return kn(L,F,q,ne);if(mt.startsWith("-"))continue;F.push({tokenIndex:re+1,value:mt}),q.push({tokenIndex:re+1,kind:"inline-code",value:mt}),re++;continue}if(FC(L,ue)){let mt=M[re+1];if(mt===void 0)return kn(L,F,q,ne);if(F.push({tokenIndex:re+1,value:mt}),q.push({tokenIndex:re+1,kind:"inline-code",value:mt}),L==="python")return kn(L,F,q,ne);re++;continue}let ve=/^--eval=(.*)$/s.exec(ue);if(zC(L)&&ve){let mt=ve[1]??"";F.push({tokenIndex:re,value:mt}),q.push({tokenIndex:re,kind:"inline-code",value:mt});continue}if(L==="node"){let mt=GC(ue);if(mt){if(mt.attached){if(ne&&=mt.value!=="",mt.value!=="")q.push({tokenIndex:re,kind:"module-file",value:mt.value});continue}let dt=M[re+1];if(dt===void 0||dt.startsWith("-"))return ne=!1,kn(L,F,q,ne);q.push({tokenIndex:re+1,kind:"module-file",value:dt}),re++;continue}}if(L==="python"&&ue.startsWith("--check-hash-based-pycs=")||L==="node"&&(ue==="--conditions="||ue==="--diagnostic-dir="||ue==="--title=")||L==="ruby"&&(ue==="--disable="||ue==="--enable="))return kn(L,F,q,ne);if(MC.get(L)?.has(ue)){let mt=M[re+1];if(mt===void 0||mt.startsWith("-")&&!(L==="ruby"&&NC.has(ue))||L==="python"&&!DC.has(mt))return kn(L,F,q,ne);re++;continue}if(ue.startsWith("--"))continue;let xe,He=!1;for(let mt=1;mt<ue.length;mt++){let dt=ue[mt];if(dt===void 0)break;if(OC.get(L)?.has(dt)){let pt=ue.slice(mt+1),gt=pt||M[re+1];if(gt!==void 0)q.push({tokenIndex:pt?re:re+1,kind:"module-file",value:gt});return kn(L,F,q,ne)}if(TC.get(L)?.has(dt)){xe=ue.slice(mt+1)||M[re+1],He=mt+1===ue.length;break}if(L==="node"&&dt==="r"){if(ne&&=ue==="-r",ue==="-r"){let pt=M[re+1];if(ne&&=pt!==void 0&&!pt.startsWith("-"),ne&&pt!==void 0)q.push({tokenIndex:re+1,kind:"module-file",value:pt});re++}break}if(L==="ruby"&&dt==="r"){let pt=ue.slice(mt+1),gt=pt||M[re+1];if(ne&&=gt!==void 0,gt!==void 0)q.push({tokenIndex:pt?re:re+1,kind:"module-file",value:gt});if(!pt)re++;break}if(L==="perl"&&(dt==="M"||dt==="m")){let pt=ue.slice(mt+1);if(!pt){if(ne=!1,mt+1===ue.length)re++;break}q.push({tokenIndex:re,kind:"module-file",value:pt});break}if(IC.get(L)?.has(dt)){if(mt+1===ue.length)re++;break}if(kC.get(L)?.has(dt)&&mt+1<ue.length)break}if(xe===void 0)continue;let ft=He?re+1:re;if(F.push({tokenIndex:ft,value:xe}),q.push({tokenIndex:ft,kind:"inline-code",value:xe}),L==="python")return kn(L,F,q,ne);if(He)re++}return kn(L,F,q,ne,void 0,void 0,!0)}function kn(M,L,F,q,ne,re,ue=!1){let ve=M==="node"?L.slice(-1):L,xe=new Set(ve.map((ft)=>ft.tokenIndex)),He=F.filter((ft)=>ft.kind!=="inline-code"||xe.has(ft.tokenIndex));if(q&&L.length===0&&ne!==void 0&&re!==void 0)He.push({tokenIndex:ne,kind:"main-script",value:re});return{code:(M==="node"?ve[0]?.value:ve.map((ft)=>ft.value).join(`
-`))||null,sources:q?He:[],optionsOpen:q&&ue}}function GC(M){for(let L of["--import","--loader","--experimental-loader","--require"]){if(M===L)return{attached:!1,value:""};if(M.startsWith(`${L}=`))return{attached:!0,value:M.slice(L.length+1)}}return}function fl(M,L){return ml(M)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(L)}function ml(M){let L=At(M).toLowerCase();return Pi.test(L)?"python":L}function FC(M,L){return dl.get(M)?.has(L)??!1}function zC(M){return dl.get(M)?.has("--eval")??!1}function Ho(M,L,F=!1){let q=UC(M,L);if(!ul(q,L))return!1;vn(L,q);let ne=$C(q);if(ul(ne,L))return!0;if(vn(L,ne),!qd.test(ne))return!1;return!F||BC(q,L)}function BC(M,L){if(/`|%x|\bqx\b/.test(M))return!0;let q=M.split(""),ne=[];for(let xe=0;xe<M.length;xe++){let He=M[xe];if(He!=="'"&&He!=='"')continue;let ft=M.startsWith(He.repeat(3),xe)?He.repeat(3):He,mt=xe+ft.length,dt=mt;while(dt<M.length&&!M.startsWith(ft,dt))dt+=M[dt]==="\\"?2:1;if(dt>=M.length)return!0;ne.push({start:mt,text:M.slice(mt,dt)}),q.fill(" ",xe,dt+ft.length),xe=dt+ft.length-1}let re=q.join(""),ue=Array.from(re.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((xe)=>qd.test(xe[1]??"")).map((xe)=>{let He=xe.index+xe[0].length;return{start:He,end:pl(re,He)}});if(ue.some((xe)=>gl(re,xe.start)))return!0;return ne.some((xe)=>{let He=/\b(?:system|exec|spawn|popen)\s*$/.test(re.slice(0,xe.start)),ft=ue.some((mt)=>xe.start>=mt.start&&xe.start<mt.end);return(He||ft)&&ul(xe.text,L)})}function pl(M,L){let F=1;for(let q=L;q<M.length;q++){if(M[q]==="(")F++;if(M[q]===")")F--;if(F===0)return q}return M.length}function gl(M,L){let F=0;for(let q=L;q<M.length;q++){let ne=M[q]??"";if("([{".includes(ne))F++;if(")]}".includes(ne)&&F--===0)return!1;if(ne===","&&F===0)return!1;if(/[A-Za-z_$]/.test(ne))return!0}return!1}var qd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function $C(M){let L=[],F=0,q=0;while(q<M.length){let ne=M[q];if(ne!=="'"&&ne!=='"'){q++;continue}let re=M.startsWith(ne.repeat(3),q)?ne.repeat(3):ne,ue=q+re.length;while(ue<M.length&&!M.startsWith(re,ue))ue+=M[ue]==="\\"?2:1;if(ue>=M.length)break;L.push(M.slice(F,q)," "),q=ue+re.length,F=q}return L.push(M.slice(F)),L.join("")}function ul(M,L){if(Ji(M,"rm",L))return!0;for(let q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(vn(L,M),q.test(M))return!0;if(Ji(M,"dd",L))return!0;for(let q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(vn(L,M),q.test(M))return!0;if(Ji(M,"find",L))return!0;let F=M.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((q)=>(vn(L,M),F.some((ne)=>Qi(ne,q))))}function UC(M,L){return vn(L,M),M.replace(LC,"")}import{lstatSync as zS,readdirSync as BS}from"node:fs";import{basename as $S,isAbsolute as Sf,join as US,relative as vf}from"node:path";import{isAbsolute as tf,parse as QC}from"node:path";import{dirname as HC,isAbsolute as jC,parse as VC,sep as KC}from"node:path";function sr(M,L,F){if(rr(L))throw Error("Unsupported Windows namespace path");let q=jC(L)?VC(L).root:"",ne=q||M;for(let re of YC(q?L.slice(q.length):L)){if(re===""||re===".")continue;if(re===".."){ne=HC(ne);continue}let ue=qC(ne,re),ve=F.entryKind(ue),xe=ve==="symlink"?F.realpath(ue):ue;if(ve==="missing"||xe===null)throw Error(`Cannot resolve path component: ${ue}`);ne=xe}return ne}function qC(M,L){return M.endsWith("/")||M.endsWith("\\")?`${M}${L}`:`${M}${KC}${L}`}function YC(M){let L=process.platform==="win32"?/[\\/]+/:/\/+/;return M.split(L)}var hl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],ZC=new Set(hl),XC=1024,Yd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Zd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),JC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function rs(M){return ZC.has(M)}function yl(M){return rs(M)||Yd.has(M)||Zd.has(M)||_o(M)}function Zn(M,L,F){return F?.has(M)?F.get(M):L.get(M)}function Xd(M,L){let F=Zn("GIT_CONFIG_COUNT",M,L);if(F===void 0)return{state:"absent"};if(F==="")return{state:"valid",count:0};if(!/^\d+$/.test(F))return{state:"invalid"};let q=Number(F);return Number.isSafeInteger(q)&&q<=XC?{state:"valid",count:q}:{state:"invalid"}}function os(M,L,F){let ne=M.match(JC)?.[1];if(!ne||!yl(ne))return null;let re=M.indexOf("=");return{name:ne,value:`${Zn(ne,L,F)??""}${M.slice(re+1)}`}}function Jd(M){return ef(M,Zd)}function Qd(M){return ef(M,Yd)}function ef(M,L){if(!M)return!1;for(let F of M.keys())if(L.has(F))return!0;return!1}var rf=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pn(M){if(!rf.test(M))return null;let L=M.indexOf("=");return{name:M.slice(0,L),value:M.slice(L+1)}}function be(M){let L=new Map,F=0;while(F<M.length){let q=M[F];if(!q)break;let ne=Pn(t(q));if(!ne)break;L.set(ne.name,ne.value),F++}return{words:M.slice(F),envAssignments:L}}function of(M){let L=kt(M);return M.includes("=")||L==="sudo"||L==="env"||L==="command"||L==="builtin"}function Pr(M,L,F,q){if(!of(no(M)))return{words:M,envAssignments:new Map,cwd:F,rewritten:!1};let ne=new Set(M),re=M,ue=new Map,ve=new Map(q??[]),xe=[],He=F;for(let mt=0;mt<a.wrapperPeelIterations.cap;mt++){let dt=nf(re),pt=be(re);for(let[ht,yt]of pt.envAssignments)ue.set(ht,yt),ve.set(ht,yt);if(re=pt.words,re.length===0)break;while(re.length>0&&no(re).includes("=")&&!tS(re)){let ht=nS(no(re),ve,L.env)??os(no(re),L.env,ve);if(ht)ue.set(ht.name,ht.value),ve.set(ht.name,ht.value);re=re.slice(1)}if(re.length===0)break;let gt=kt(no(re));if(gt!=="sudo"&&gt!=="env"&&gt!=="command"&&gt!=="builtin")break;if(gt==="sudo"){let ht=oS(re,L.paths,He);if(re=ht.words,ht.cwd!==void 0)He=ht.cwd}if(gt==="env"){let ht=aS(re,He,ve,L);if(xe.push(...ht.envSplitValues??[]),re=ht.words,ht.cwd!==void 0)He=ht.cwd;for(let[yt,bt]of ht.envAssignments)ue.set(yt,bt),ve.set(yt,bt)}if(gt==="command")re=lS(re);if(gt==="builtin")re=re.slice(On(re,1)==="--"?2:1);if(nf(re)===dt)break}let ft=be(re);for(let[mt,dt]of ft.envAssignments)ue.set(mt,dt),ve.set(mt,dt);return{words:ft.words,envAssignments:ue,cwd:He,envSplitValues:xe.length>0?xe:void 0,rewritten:eS(ft.words,ne)}}function eS(M,L){return M.some((F)=>!L.has(F))}function nf(M){return M.map(t).join(" ")}function no(M){let L=M[0];return L?t(L):""}function On(M,L){let F=M[L];return F?t(F):void 0}function tS(M){return rf.test(no(M))}function nS(M,L,F){if(!M.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${L.get("TMPDIR")??F.get("TMPDIR")??""}${M.slice(8)}`}}var rS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function oS(M,L,F){let q=1,ne=F;while(q<M.length){let re=On(M,q);if(!re)break;if(re==="--")return{words:M.slice(q+1),cwd:ne};if(!re.startsWith("-"))break;if(re==="-D"||re==="--chdir"){let ue=On(M,q+1);ne=ue?jo(ne,ue,L):null,q+=2;continue}if(re.startsWith("--chdir=")){ne=jo(ne,re.slice(8),L),q++;continue}if(re.startsWith("-D")&&re.length>2){ne=jo(ne,re.slice(2),L),q++;continue}if(re==="-i"||re==="--login"){ne=null,q++;continue}if(rS.has(re)){q+=2;continue}q++}return{words:M.slice(q),cwd:ne}}var iS=new Set(["-i","-0","--null"]),sS=new Set(["-u","--unset","-C","--chdir","-P"]);function aS(M,L,F,q){let ne=new Map,re=[],ue=L,ve=1,xe=(He)=>({words:M.slice(He),envAssignments:ne,cwd:ue,envSplitValues:re.length>0?re:void 0});while(ve<M.length){let He=On(M,ve);if(!He)break;if(He==="--")return xe(ve+1);if(He==="-i"||He==="--ignore-environment"||He==="-"){ne.clear();for(let mt of F.keys())ne.set(mt,"");ne.set("TMPDIR",""),ve++;continue}if(iS.has(He)){ve++;continue}if(He==="-u"||He==="--unset"){let mt=On(M,ve+1);if(mt!==void 0)ne.set(mt,"");ve+=2;continue}if(He.startsWith("-u")&&He.length>2&&!He.startsWith("-u=")){ne.set(He.slice(2),""),ve++;continue}if(He.startsWith("--unset=")){ne.set(He.slice(8),""),ve++;continue}let ft=He==="-S"||He==="--split-string"?{value:On(M,ve+1),consumed:2}:He.startsWith("-S")&&He.length>2?{value:He.slice(2),consumed:1}:He.startsWith("--split-string=")?{value:He.slice(15),consumed:1}:null;if(ft){if(ft.value!==void 0)re.push(ft.value);return ue=null,xe(ve+ft.consumed)}if(sS.has(He)){if(He==="-C"||He==="--chdir"){let mt=On(M,ve+1);ue=mt?jo(ue,mt,q.paths):null}ve+=2;continue}if(He.startsWith("-u=")){ve++;continue}if(He.startsWith("-C")&&He.length>2||He.startsWith("--chdir=")){let mt=He.startsWith("--chdir=")?He.slice(8):He.startsWith("-C=")?He.slice(3):He.slice(2);ue=jo(ue,mt,q.paths),ve++;continue}if(He.startsWith("-P")){ve++;continue}if(He.startsWith("-")){ve++;continue}if(!Pn(He))break;while(ve<M.length){let mt=Pn(On(M,ve)??"");if(!mt)break;ne.set(mt.name,mt.value),ve++}if(On(M,ve)==="--")ve++;return xe(ve)}return xe(ve)}function jo(M,L,F){if(L==="")return null;if(!M&&!tf(L))return null;let q=tf(L)?QC(L).root:F.realpath(M??"/");if(q===null)return null;try{return sr(q,L,F)}catch{return null}}function lS(M){if(On(M,1)==="-v")return[...Ht(["type"]),...M.slice(2)];let L=1;while(L<M.length){let F=On(M,L);if(!F)break;if(F==="-p"||F==="-v"||F==="-V"){L++;continue}if(F==="--")return M.slice(L+1);if(F.startsWith("-")&&!F.startsWith("--")&&F.length>1){if(!/^[pvV]+$/.test(F.slice(1)))break;L++;continue}break}return M.slice(L)}var cS=/['"\\$`{}#]/;function is(M,L){if(M.some((q)=>cS.test(q)))return null;let F=[...M.flatMap((q)=>q.split(/\s+/).filter((ne)=>ne.length>0)),...L];return F.length<=64?F:null}function ar(M,L,F){return ss(M,L,F).tokens}function uS(M){let L=[],F="",q=0;while(q<M.length){let ne=M.charAt(q);if(ne==='"'||ne==="'"){let re=M.indexOf(ne,q+1);if(re===-1)return M.split(/\s+/).map((ue)=>ue.replace(/["']/g,"")).filter((ue)=>ue.length>0);F+=M.slice(q+1,re),q=re+1;continue}if(/\s/.test(ne)){if(F.length>0)L.push(F);F="",q++;continue}F+=ne,q++}if(F.length>0)L.push(F);return L}function lr(M,L,F,q=0){let ne=ss(M,L,F),re=(ne.envSplitValues??[]).flatMap(uS);if(re.length===0)return ne.tokens;let ue=[...re,...ne.tokens];if(q>=8)return ue;return lr(ue,L,F,q+1)}function ss(M,L,F,q){if(!of(M[0]??""))return{tokens:[...M],envAssignments:new Map,cwd:F};let ne=Pr(Ht(M),L,F,q);return{tokens:ne.words.map(t),envAssignments:ne.envAssignments,cwd:ne.cwd,envSplitValues:ne.envSplitValues}}var vl=Symbol("adopt-as-operand"),dS=new Set(["env","sudo","command","builtin"]),fS=new Set(["&&","||","|&","|","&",";"]),mS=new Set(["<<","<<<",">|"]),pS=new Set(["|","|&"]),gS=/[*@#?$!_-]/,hS=/^\w+(?::\w+)*/,yS=Object.freeze([]),Vo=Object.freeze({kind:"scope",edge:"enter"}),Ko=Object.freeze({kind:"scope",edge:"exit"}),bS=Object.freeze([]),CS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),qo=new Set(["bash","sh","zsh","dash","ksh"]),SS=256,uf=new WeakMap;function df(M,L){let F=L.status==="complete"?new Set(Sl(L)):new Set,q=xS(M,F);if(Ti(q))return as("unclosed-quote",q,L);let ne={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},re=Ar(L,{source:q,suppressed:F,flags:ne,depth:0,functions:new Map,powershell:L.dialect==="powershell"});if(ne.limited)return as("structural-limit",q,L);if(ne.invalid)return as("invalid",q,L);let ue=as("complete",q,L,ne.assignmentFallbacks);return uf.set(ue,Object.freeze(re)),ue}function cs(M,L,F,q,ne){let re=ne.word??((mt)=>mt),ue={cwd:L,variables:new Map,previous:null},ve=[],xe=new Set,He=null,ft=[];for(let mt of ff(M)){if(mt.kind==="scope"){if(mt.edge==="enter"){ft.push({state:ue,segment:[...ve],shellWords:new Set(xe),pipeProducer:He});continue}let dt=ne.segment(ve,ue,He,null,xe);if(dt)return dt;let pt=ft.pop();if(pt===void 0)throw Error("scope exit without a matching enter");ue=pt.state,ve=pt.segment,xe=pt.shellWords,He=pt.pipeProducer;continue}if(mt.kind==="operator"){if(!mt.boundary)continue;let dt=ne.segment(ve,ue,He,mt.operator,xe);if(dt)return dt;ue=vS(ve,ue,F,q),He=ve.length>0&&pS.has(mt.operator)?ve:null,ve=[],xe=new Set;continue}if(mt.kind==="redirection"){if(mt.fd!==void 0)xe.add(ve.length-1);if(mt.target===void 0)continue;let dt=ne.redirection({operator:mt.operator,role:mt.role,targetOrder:mt.targetOrder,target:mt.target,...mt.body===void 0?{}:{body:mt.body,consumer:mt.consumer}},ue);if(dt===vl){xe.add(ve.length),ve.push(re(mt.target));continue}if(dt)return dt;continue}ve.push(re(mt.text))}return ne.segment(ve,ue,He,null,xe)}function us(M){return ff(M).flatMap((L)=>{if(L.kind==="word")return[{kind:"word",text:L.text}];if(L.kind==="operator")return[{kind:"operator",boundary:L.boundary}];if(L.kind==="redirection")return[{kind:"redirection",target:L.target}];return[]})}function un(M,L){return M.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(F,q,ne,re)=>{let ue=L.get(q);if(ue===void 0)return F;let ve=ne.startsWith(":")?ue!=="":!0;if(ne.endsWith("-"))return ve?ue:un(re,L);return ve?un(re,L):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(F,q)=>L.get(q)??F).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(F,q)=>L.get(q)??F)}function Yo(M){return M.length>0&&M.every((L)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(L))}function vS(M,L,F,q){let ne=Yo(M)?new Map([...L.variables,...ES(M,L.variables)]):L.variables,re=ar([...M],F),ue=At(re[0]??"").toLowerCase()==="cd"?re[1]:void 0;if(!ue)return{...L,variables:ne};if(ue==="-"){if(L.previous===null)return{...L,variables:ne};return{cwd:L.previous,variables:ne,previous:L.cwd}}return{cwd:on(un(ue,ne),L.cwd,F,q),variables:ne,previous:L.cwd}}function ES(M,L){return M.flatMap((F)=>{let q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(F),ne=q?.[2]?.startsWith("=")?q[2].slice(1):void 0;return q?.[1]!==void 0&&ne!==void 0?[[q[1],un(ne,L)]]:[]})}function ff(M){return uf.get(M)??yS}function xS(M,L){return[...L].reduce((F,q)=>F.slice(0,q.start)+" ".repeat(q.end-q.start)+F.slice(q.end),M)}function as(M,L,F,q=bS){return Object.freeze({status:M,source:L,program:F,assignmentFallbacks:Object.freeze(q)})}function Ar(M,L){return M.nodes.flatMap((F,q)=>RS(F,M,q,L)).sort((F,q)=>F.start-q.start).flatMap((F)=>[...F.events])}function RS(M,L,F,q){if(M.kind==="connector")return[{start:M.span.start,events:[Mn(TS(M.operator))]}];if(M.kind==="unknown")return[{start:M.span.start,events:[Mn(M.source)]}];if(M.kind==="function")return q.functions.set(M.name,M.body),[];if(M.kind==="group"){let re=M.style!=="subshell",ue=q.source[M.span.end-1]===(re?"}":")"),ve=re?q:{...q,functions:new Map(q.functions)};return[{start:M.span.start,events:re?[ls("{"),...Ar(M.body,ve),...ue?[ls("}")]:[]]:[Vo,Mn("("),...Ar(M.body,ve),...ue?[Mn(")")]:[],Ko]}]}let ne=MS(M,q.functions);if(ne){if(q.depth>=ir.maxDepth||++q.flags.expansions>SS)return q.flags.limited=!0,[];return[{start:M.span.start,events:[...sf(M,q),ls(";"),...Ar(ne,{...q,depth:q.depth+1}),ls(";")]},...af(M,L,F,q)]}return[{start:M.span.start,events:sf(M,q)},...af(M,L,F,q)]}function sf(M,L){return[...M.words.map((F)=>({start:F.span.start,events:pf(F,M,L,!1)})),...M.redirections.map((F)=>({start:F.span.start,events:_S(F,M,L)}))].sort((F,q)=>F.start-q.start).flatMap((F)=>F.events)}function _S(M,L,F){let q=M.operator==="<<-"?"<<":M.operator,ne=M.target?pf(M.target,L,F,!0):[],re=ne[0],ue=re?.kind==="word"?re.text:void 0;return[...M.fd===void 0?[]:[El(String(M.fd))],Object.freeze({kind:"redirection",operator:q,...M.fd===void 0?{}:{fd:M.fd},role:IS(q),targetOrder:mS.has(q)?"legacy-segment":"immediate",...ue===void 0?{}:{target:ue},...M.heredoc&&F.suppressed.has(M.heredoc.bodySpan)?{body:M.heredoc.body,consumer:hf(L)}:{}}),...ue===void 0?ne:ne.slice(1)]}function af(M,L,F,q){let ne=M.redirections.filter((re)=>re.operator==="<<"||re.operator==="<<-");return[...ne.flatMap((re)=>{let ue=re.heredoc;if(!ue)return[];let ve=[El(ue.delimiter),.../[\r\n]/.test(q.source[ue.terminatorSpan.end]??"")?[Mn(";")]:[]];if(q.suppressed.has(ue.bodySpan))return[{start:ue.bodySpan.start,events:ve}];return[{start:ue.bodySpan.start,events:[...mf(q.source.slice(ue.bodySpan.start,ue.bodySpan.end),q),...ve]}]}),...ne.some((re)=>!re.heredoc&&re.target)?wS(L,F,q):[]]}function wS(M,L,F){let q=M.nodes.slice(L+1).find((ne)=>ne.kind==="connector");if(!q||q.span.end>=M.span.end)return[];return[{start:q.span.end,events:mf(F.source.slice(q.span.end,M.span.end),F)}]}function mf(M,L){if(L.depth>=ir.maxDepth)return L.flags.limited=!0,[];let F=h(M,"posix");if(F.status==="limited")return L.flags.limited=!0,[];let q={invalid:!1,limited:!1,expansions:L.flags.expansions,assignmentFallbacks:L.flags.assignmentFallbacks},ne=Ar(F,{source:M,suppressed:new Set,flags:q,depth:L.depth+1,functions:new Map,powershell:!1});return L.flags.limited||=q.limited,L.flags.expansions=q.expansions,ne}function pf(M,L,F,q){let ne=[],re={single:!1,double:!1},ue="",ve=!1,xe=()=>{let He=ve&&!q?Mn("glob"):ue!==""||M.quoted&&ne.length===0?El(ue):void 0;if(He)ne.push(He);ue="",ve=!1};for(let He of M.parts){if(He.provenance!=="command-substitution"&&He.provenance!=="arithmetic"){for(let pt of bl(He.raw,re,F.flags,F.powershell)){if(typeof pt==="string"){xe(),ne.push(Mn(pt));continue}ue+=pt.text,ve||=pt.glob}continue}let ft=L.nested.find((pt)=>pt.span.start>=He.span.start&&pt.span.end<=He.span.end);if(re.double){let pt=F.source.slice(He.span.start,He.span.end);ue+=bl(pt,{single:!1,double:!0},F.flags,F.powershell).map((ht)=>typeof ht==="string"?ht:ht.text).join("");let gt=ft?Ar(ft,F).filter((ht)=>ht.kind==="redirection"&&ht.body!==void 0):[];if(gt.length>0)ne.push(Vo,...gt,Ko);continue}let mt=ft?Ar(ft,F):[];if(He.raw.startsWith("`")){ue+="${}",xe(),ne.push(Vo,...mt,Ko);continue}if(He.raw.startsWith("<(")||He.raw.startsWith(">(")){xe(),ne.push(He.raw.startsWith("<(")?Mn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Vo,...mt,...He.raw.endsWith(")")?[Mn(")")]:[],Ko);continue}let dt=He.raw.startsWith("$((")?2:1;ue+="${}",xe(),ne.push(...Array.from({length:dt},()=>Mn("(")),...dt===1?[Vo]:[],...mt,...He.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>Mn(")")):[],...dt===1?[Ko]:[])}return xe(),ne}function bl(M,L,F,q){let ne=[],re="",ue=!1,ve=0;while(ve<M.length){let xe=M[ve]??"";if(!L.single&&!L.double&&(xe==="("||xe===")")){ne.push({text:re,glob:ue},xe),re="",ue=!1,ve++;continue}if(q&&xe==="`"&&!L.single){re+=M[ve+1]??"",ve+=2;continue}if(L.single&&xe==="'"){L.single=!1,ve++;continue}if(L.single){re+=xe,ve++;continue}if(L.double){if(xe==='"'){L.double=!1,ve++;continue}if(!q&&xe==="\\"){let He=M[ve+1]??"";re+=['"',"\\","$"].includes(He)?He:`\\${He}`,ve+=2;continue}if(xe==="$"){let He=lf(M,ve,L,F,q);re+=He.text,ve=He.next;continue}re+=xe,ve++;continue}if(xe==="'"||xe==='"'){L.single=xe==="'",L.double=xe==='"',ve++;continue}if(!q&&xe==="\\"){let He=M[ve+1]??"";ue||=He==="*"||He==="?",re+=He,ve+=2;continue}if(xe==="$"){let He=lf(M,ve,L,F,q);re+=He.text,ve=He.next;continue}ue||=xe==="*"||xe==="?",re+=xe,ve++}return[...ne,{text:re,glob:ue}]}function lf(M,L,F,q,ne){let re=M[L+1];if(re==="{"){let ve=AS(M,L+2);if(ve===-1)return q.invalid=!0,{text:"",next:M.length};let xe=M.slice(L,ve+1);return PS(xe,F,q,ne),{text:xe,next:ve+1}}if(re!==void 0&&gS.test(re))return{text:`\${${re}}`,next:L+2};let ue=(ne?hS:/^\w*/).exec(M.slice(L+1))?.[0]??"";return{text:`\${${ue}}`,next:L+1+ue.length}}function PS(M,L,F,q){let ne=M.slice(2,-1),re=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ne)?.[0];if(!re)return;let ue=ne.slice(re.length),ve=[":=","="].find((He)=>ue.startsWith(He));if(!ve)return;let xe=bl(ue.slice(ve.length),{...L},F,q);F.assignmentFallbacks.push(...xe.flatMap((He)=>typeof He==="string"||!He.text?[]:[He.text]))}function AS(M,L){let F=1,q=L;while(F>0&&q<M.length){if(M[q]==="{"&&M[q-1]==="$")F++;if(M[q]==="}")F--;q++}return F===0?q-1:-1}function TS(M){return/^[\r\n]+$/.test(M)?";":M}function Mn(M){return Object.freeze({kind:"operator",operator:M,boundary:fS.has(M)})}function ls(M){return Object.freeze({kind:"operator",operator:M,boundary:!0})}function El(M){return Object.freeze({kind:"word",text:M})}function IS(M){if(M==="<<"||M==="<<<")return"here-data";if(M==="<"||M==="<&")return"file-read";return"file-write"}function Zo(M){return CS.has(M)||/^python\d/.test(M)}var kS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function gf(M,L){let F=L[0];if(F===void 0||!F.startsWith("-"))return L;let q=kS.get(M)?.has(F)??!1;return gf(M,L.slice(q?2:1))}function Cl(M){let L=M[0];if(L===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(L))return Cl(M.slice(1));if(!dS.has(L))return[...M];return Cl(gf(L,M.slice(1)))}function hf(M){let L=Lo(M),F=M.words.findIndex((q)=>q.provenance==="literal"&&q.text===L);return Cl(F<0?[]:M.words.slice(F).map((q)=>q.text))}function OS(M){let L=hf(M)[0];if(L===void 0)return!1;let F=At(L).toLowerCase();return Zo(F)&&!qo.has(F)}function Sl(M){return M.nodes.flatMap((L,F)=>{if(L.kind==="group"||L.kind==="function")return Sl(L.body);if(L.kind!=="command")return[];let q=L.nested.flatMap((ve)=>Sl(ve)),ne=L.redirections.flatMap((ve)=>ve.heredoc?.quotedDelimiter?[ve.heredoc.bodySpan]:[]);if(OS(L))return[...q,...ne];let re=M.nodes[F+1];if(re?.kind==="connector"&&(re.operator==="|"||re.operator==="|&")||!NS(L))return q;return[...q,...ne]})}function MS(M,L){let F=Lo(M);return F===void 0?void 0:L.get(F)}function cr(M,L){return M!==void 0&&M.provenance==="literal"&&!M.quoted&&M.raw===M.text&&M.text===L}function DS(M){if(cr(M.words[0],"git"))return cr(M.words[1],"commit");if(!cr(M.words[0],"gh")||!cr(M.words[2],"create"))return!1;return cr(M.words[1],"pr")||cr(M.words[1],"issue")}function NS(M){return(cr(M.words[0],"cat")||cr(M.words[0],"tee")||DS(M))&&!M.words.some(cf)&&!M.redirections.some((F)=>cf(F.target))}function cf(M){return M?.parts.some((L)=>L.provenance==="command-substitution"&&L.raw.startsWith(">("))??!1}var yf=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),bf=new Set([...yf,"glob"]),LS=new Set([...bf,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Xo(M){let L=WS(),F=oe(M.input),q=[];if((M.route.kind==="command"||M.route.kind==="unknown")&&F)q.push({usage:"input-candidate",source:F});if(M.route.kind==="command"&&"command"in M&&M.command)q.push({usage:"declared-command",source:M.command});let ne=q.reduce((re,ue)=>{let ve=re.findIndex((ft)=>ft.source===ue.source);if(ve!==-1){let ft=re[ve];if(!ft)return re;return re[ve]={...ft,usages:[...ft.usages,ue.usage]},re}let xe=M.route.kind==="command"?M.route.shell:process.platform==="win32"?"powershell":"posix",He=L.getCommandProgram(ue.source,xe);return re.push({usages:[ue.usage],source:ue.source,program:He,shell:L.getShellSyntax(ue.source,He)}),re},[]);return{invocation:{toolName:M.toolName,route:M.route,context:M.context},commands:ne,paths:GS(M),store:L}}function dn(M,L){return M.commands.find((F)=>F.usages.includes(L))}function Xn(M,L){if(!M.includes("$"))return M;return na(M,L)}function WS(){let M=new Map,L=new Map,F=new WeakMap,q=(re,ue)=>{let ve=`${ue}\x00${re}`,xe=L.get(ve);if(xe)return xe;let He=h(re,ue);return L.set(ve,He),He};return{getShellSyntax:(re,ue)=>{if(ue&&ue.source!==re)throw TypeError("Shell syntax source does not match command program source.");let ve=ue??q(re,"posix");if(ve.status==="limited"){let ft=F.get(ve);if(ft)return ft;let mt={status:"structural-limit",source:re,program:ve,assignmentFallbacks:[]};return F.set(ve,mt),mt}let xe=M.get(re);if(xe)return xe;let He=df(re,ve);return M.set(re,He),He},getCommandProgram:q}}function GS(M){let L=M.route.kind==="grep"?bf:M.route.kind==="glob"?LS:yf;return[...nu(M.input,L),...M.route.kind==="patch"||typeof M.input==="string"?iu(M.input):[]]}var FS=new Set(["-S","--suffix"]);function ro(M,L,F,q,ne){if(M.status==="structural-limit")throw new y;if(M.status!=="complete")return ne.findMalformedTarget(M.source);return cs(M,L,F,q,{segment:(re,ue)=>ne.findSegmentTarget(re,ue),redirection:(re,ue)=>re.role==="file-write"&&ne.isRedirectionTarget(un(re.target,ue.variables),ue)?re.target:null})}function ds(M){let L=[],F=null,q=!1;for(let ne=0;ne<M.length;ne++){let re=M[ne];if(re===void 0)break;if(!q&&re==="--"){q=!0;continue}if(!q&&(re==="-t"||re==="--target-directory")){F=M[++ne]??null;continue}if(!q&&re.startsWith("--target-directory=")){F=re.slice(19);continue}if(!q&&re.startsWith("-t")&&re.length>2){F=re.slice(2);continue}if(!q&&FS.has(re)){ne++;continue}if(!q&&(re.startsWith("--suffix=")||re.startsWith("--backup=")))continue;if(!q&&re.startsWith("-"))continue;L.push(re)}return F?{sources:L,destination:F}:{sources:L.slice(0,-1),destination:L.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function Ef(M,L,F,q){let ne=M.invocation.context.executionCwd;if(!L)return null;if(M.invocation.route.kind==="patch"||M.invocation.route.kind==="path"||M.invocation.route.kind==="unknown"){if(Si(M.invocation.toolName))return null;let ve=M.paths.find((xe)=>Cf(xe,ne,L,F,q,L.entries));return ve?{target:ve}:null}if(M.invocation.route.kind!=="command")return null;let re=dn(M,"input-candidate");if(!re)return null;let ue=ro(re.shell,ne,F,q,{findSegmentTarget:(ve,xe)=>YS(ve,xe,L,F,q),isRedirectionTarget:(ve,xe)=>Cf(ve,xe.cwd,L,F,q,L.markerFiles),findMalformedTarget:()=>null});return ue?{target:ue}:null}function Tr(M,L,F,q,ne,re,ue=!1){if(!F)return!1;let ve=ms(on(M,L,ne,re)),xe=ve.replace(/(\/\.?\*+)+$/,"");if(xe!==ve&&xe!==""){if(xl(xe,F))return!0;let He=ue||ve.slice(xe.length).includes("/."),ft=(mt)=>He?fs(mt,xe):HS(mt,xe);if(F.markerFiles.some(ft))return!0;return q&&Rl(F).some(ft)}if(xl(ve,F))return!0;return q&&Rl(F).some((He)=>fs(He,ve))}function HS(M,L){let F=vf(L,M);if(F===""||F.startsWith("..")||Sf(F))return!1;return!F.split(/[\\/]/)[0]?.startsWith(".")}function jS(M,L,F,q,ne){return Tr(M,L,F,!0,q,ne)}function VS(M,L,F,q,ne){if(!F)return!1;return xl(ms(on(M,L,q,ne)),F)}function Cf(M,L,F,q,ne,re){let ue=ms(on(M,L,q,ne));return re.includes(ue)||Rf(ue,F)}function xf(M,L,F,q,ne){if(!F)return!1;return F.hooksDirectories.some((re)=>M.some((ue)=>fs(re,ms(on(ue,L,q,ne)))))}function xl(M,L){return L.entries.includes(M)||L.directories.includes(M)||Rf(M,L)}function Rf(M,L){return L.hooksDirectories.some((F)=>fs(M,F))}var KS=50000;function _f(M,L){let F=[...new Set(Rl(M))];if(F.some((ne)=>L($S(ne))))return!0;let q=0;while(F.length>0){let ne=F.pop()??"",re=qS(ne);if(!re)return!0;if(q+=re.length,q>KS)return!0;if(re.some((ue)=>L(ue.name)))return!0;F.push(...re.filter((ue)=>ue.isDirectory()).map((ue)=>US(ne,ue.name)))}return!1}function qS(M){try{let L=zS(M,{throwIfNoEntry:!1});if(!L)return[];if(!L.isDirectory())return L.isSymbolicLink()?null:[];return BS(M,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Rl(M){return[...M.entries,...M.directories,...M.hooksDirectories]}function fs(M,L){let F=vf(L,M);return F===""||!/^\.\.(?:[\\/]|$)/.test(F)&&!Sf(F)}function ms(M){return process.platform==="win32"?M.toLowerCase():M}function YS(M,L,F,q,ne){if(Yo(M))return null;let re=lr([...M],q);if(At(re[0]??"").toLowerCase()!=="mv")return null;let ue=ds(re.slice(1)),ve=ue.sources.find((xe)=>jS(un(xe,L.variables),L.cwd,F,q,ne));if(ve)return ve;return ue.destination&&VS(un(ue.destination,L.variables),L.cwd,F,q,ne)?ue.destination:null}import{isAbsolute as ys,normalize as rv,parse as ov,posix as Mf,resolve as kr,sep as Al}from"node:path";import{isAbsolute as ZS,join as wf,normalize as Tf,parse as XS,sep as Pf}from"node:path";var JS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],QS=` 	
-`;function Jo(M,L){if(ur(M,L))return!0;if(!M.has("TMPDIR"))return!1;return!_l(M.get("TMPDIR")??"",L)}function Ir(M,L){if(M.has("TMPDIR"))return _l(M.get("TMPDIR")??"",L);let F=wl(M,L);if(F===void 0)return!0;return _l(F,L)}function wl(M,L){return kf(M,L,"TMPDIR")}function _l(M,L){if(!M)return!1;if(tv(M))return!1;return oo(M,L)}function ur(M,L){let F=kf(M,L,"IFS");return F!==void 0&&F!==""&&F!==QS}function oo(M,L){let F=ps(M,L.paths);if(F===null)return!1;return If(L).some((q)=>io(F,q))}function hs(M,L){let F=ps(M,L.paths);if(F===null)return!1;return If(L).some((q)=>gs(q)===gs(F))}var Af=new WeakMap;function If(M){let L=Af.get(M);if(L)return L;let F=ev(M);return Af.set(M,F),F}function ev(M){let L=JS.map((q)=>ps(q,M.paths)??Tf(q)),F=ps(M.tmpdir,M.paths);if(!F)return L;if(process.platform==="win32")return[...L,F];if(process.platform==="darwin"&&nv(F))return[...L,F];return L}function tv(M){return/[\s$`*?[]/.test(M)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(M)||/[+@!]\([^)]*\)/.test(M)}function kf(M,L,F){return M.has(F)?M.get(F):L.env.get(F)}function nv(M){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(M)}function ps(M,L){try{let F=Tf(M);if(!ZS(F))return F;let q=XS(F).root,ne=F.slice(q.length).split(/[\\/]+/).filter(Boolean),re=q;for(let ue=0;ue<ne.length;ue++){let ve=wf(re,ne[ue]??"");if(L.entryKind(ve)==="missing")return wf(ve,...ne.slice(ue+1));let xe=L.realpath(ve);if(xe===null)return null;re=xe}return re}catch{return null}}function io(M,L){let F=gs(M),q=gs(L);if(F===q)return!0;let ne=q.endsWith(Pf)?q:`${q}${Pf}`;return F.startsWith(ne)}function gs(M){return process.platform==="win32"?M.toLowerCase():M}var iv=process.platform==="win32",Of=64,sv=16384;function Qo(M,L,F,q){if(M.kind==="temp_target")return null;let ne=q[M.kind];if(M.kind==="dynamic_target"&&!Qt(F,ne.id,L.strict))return null;if(M.kind==="within_anchored_cwd"&&!Qt(F,ne.id,L.paranoid))return null;return Et(ne.id,ne.reason)}function ei(M){let L=vd(M,Of,Of,sv);return{expandedTargets:L&&"words"in L?L.words:void 0,unsafeBraceExpansion:L!==void 0&&"limited"in L,targetIsLiteral:L===void 0&&M.provenance==="literal"&&(M.quoted||M.raw!==M.text),tmpdirWordSplittingProtected:av(M)}}function av(M){let L=M.parts.filter((F)=>F.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(F.raw));return L.length>0&&L.every((F)=>lv(M.raw,F.span.start-M.span.start))}function lv(M,L){let F=null,q=!1;for(let ne=0;ne<L;ne++){let re=M[ne];if(q){q=!1;continue}if(re==="\\"&&F!=="'"){q=!0;continue}if(F===re){F=null;continue}if(F===null&&(re==="'"||re==='"'))F=re}return F==='"'}function dr(M){let L=M.environment.home,F=M.environment.paths,q=M.budget??hn();return{anchoredCwd:M.originalCwd??M.cwd??null,resolvedCwd:M.cwd??null,strict:M.strict??!1,paranoid:M.paranoid??!1,trustTmpdirVar:M.allowTmpdirVar??!0,posixShell:M.posixShell??!1,tmpdirWordSplittingUnsafe:M.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:M.trustedTmpdirValue??M.allowTmpdirVar??!0,environment:M.environment,allowRoots:pv(M.allowPaths,L,F,q),protectedGitMetadata:M.protectedGitMetadata,budget:q}}function Dn(M,L,F={}){let q=F.targetIsLiteral??!1;if(!q&&L.tmpdirWordSplittingUnsafe&&!F.tmpdirWordSplittingProtected&&hv(M))return{kind:"outside_anchored_cwd"};let ne=!q&&Nf(M,L.posixShell);if(rr(M))return{kind:"outside_anchored_cwd"};if(Tl(M,q))return{kind:"root_or_home_target"};if(uv(M,L,q))return{kind:"root_or_home_target"};if(L.resolvedCwd&&Tr(M,L.resolvedCwd,L.protectedGitMetadata,!0,L.environment,L.budget,!L.posixShell))return{kind:"git_metadata_target"};if(dv(M,L.trustTmpdirVar,L.posixShell,ne,q,F.tmpdirWordSplittingProtected??!1,L.trustedTmpdirValue,L.environment))return{kind:"temp_target"};if(ne)return{kind:"dynamic_target"};if(gv(M,L,q))return{kind:"temp_target"};let re=L.anchoredCwd;if(re){if(!F.skipHomeCwd&&Sv(re,L.environment.home,L.environment.paths,L.budget))return{kind:"home_cwd_target"};if(!F.skipCwdSelf&&[L.resolvedCwd??re,re].some((ue)=>vv(M,L.resolvedCwd??re,L.environment.paths,L.budget,ue)))return{kind:"cwd_self_target"};if(Ev(M,re,L.resolvedCwd??re,ne,q,L.environment.paths,L.budget))return{kind:"within_anchored_cwd"}}if(cv(M,L,ne))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function cv(M,L,F){let q=M.trim();if(F||!L.resolvedCwd||!L.anchoredCwd||!q)return!1;if(ys(q)||q.startsWith("~"))return!1;if(Il(q))return!1;if(Lf(L.resolvedCwd,L.anchoredCwd,L.environment.paths,L.budget))return!1;return oo(kr(L.resolvedCwd,q),L.environment)}function Df(M,L,F={}){let{containmentTarget:q,...ne}=F;if(Dn(M,L,ne).kind!=="temp_target")return!1;let re=M.trim();if(mv(re))return!1;if(hs(re,L.environment))return!1;return![L.anchoredCwd,L.resolvedCwd].some((ue)=>Lf(q??re,ue,L.environment.paths,L.budget))}function Tl(M,L=!1){let F=M.trim(),q=Mf.normalize(F),ne=F.replace(/\\/g,"/"),re=q==="/"?q:q.replace(/\/+$/,"");if(re==="/"||re.startsWith("/")&&re.slice(1).split("/").every((ue)=>/^\*+$/.test(ue)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ne)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ne))return!0;if(!L&&(q==="~"||q==="~/"||q==="~/*"))return!0;if(!L&&(q==="$HOME"||q==="$HOME/"||q==="$HOME/*"))return!0;if(!L&&(q==="${HOME}"||q==="${HOME}/"||q==="${HOME}/*"))return!0;return!1}function uv(M,L,F){let q=M.trim(),ne=F?q:q==="*"?".":q.endsWith("/*")?q.slice(0,-2):q;if(!ne)return!1;try{let re=ys(ne)?ne:L.resolvedCwd?kr(L.resolvedCwd,ne):null;if(!re)return!1;let ue=fn(Dt(re,L.environment.paths,L.budget));if(ue===ov(ue).root)return!0;return ue===fn(Dt(L.environment.home,L.environment.paths,L.budget))}catch{return!1}}function fn(M){let L=rv(M);if(iv){if(L=L.replace(/\//g,"\\").toLowerCase(),L.length>3&&L.endsWith("\\"))L=L.slice(0,-1);return L}if(L.length>1&&L.endsWith("/"))L=L.slice(0,-1);return L}function dv(M,L,F,q,ne,re,ue,ve){let xe=M.trim();if(Il(xe))return!1;if(!q&&oo(xe,ve))return!0;return(L||re&&ue)&&F&&!ne&&fv(xe,F)}function fv(M,L){return["$TMPDIR","${TMPDIR}"].some((F)=>{if(M===F)return!0;if(!M.startsWith(`${F}/`))return!1;return!Nf(M.slice(F.length+1),L)})}function mv(M){let L=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(M);if(!L)return!1;return Mf.normalize(`/${L[1]??""}`)==="/"}function Il(M){return M.split(/[\\/]+/).includes("..")}function pv(M,L,F,q){if(!M?.length)return[];return M.flatMap((ne)=>{let re=Mo(ne.trim(),L);if(!ys(re))return[];try{let ue=Dt(re,F,q);if(Do(ue,Dt(L,F,q)))return[];return[fn(ue)]}catch{return[]}})}function gv(M,L,F){if(L.allowRoots.length===0)return!1;let q=M.trim();if(Il(q))return!1;let ne=F?q:Mo(q,L.environment.home),re=L.resolvedCwd??L.anchoredCwd,ue=ys(ne)?ne:re?kr(re,ne):null;if(!ue)return!1;try{let ve=fn(Dt(ue,L.environment.paths,L.budget));return L.allowRoots.some((xe)=>ve===xe||ve.startsWith(xe.endsWith(Al)?xe:`${xe}${Al}`))}catch{return!1}}function hv(M){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(M)}function Nf(M,L=!1){return M.includes("$")||M.includes("`")||yv(M)||L&&bv(M)}function yv(M){let L=!1;for(let F of M){if(L){L=!1;continue}if(F==="\\"){L=!0;continue}if(F==="*"||F==="?"||F==="[")return!0}return!1}function bv(M){let L=!1;for(let F=0;F<M.length;F++){let q=M[F];if(L){L=!1;continue}if(q==="\\"){L=!0;continue}if(q==="{"&&Cv(M,F)||(q==="+"||q==="@"||q==="!")&&M[F+1]==="(")return!0}return!1}function Cv(M,L){let F=M.indexOf("}",L+1);if(F===-1)return!1;let q=M.slice(L+1,F);return q.includes(",")||q.includes("..")}function Sv(M,L,F,q){try{return fn(Dt(M,F,q))===fn(Dt(L,F,q))}catch{try{return fn(M)===fn(L)}catch{return!1}}}function vv(M,L,F,q,ne=L){if(ne===L&&(M==="."||M==="./"||M===".\\"))return!0;try{return fn(Dt(kr(L,M),F,q))===fn(Dt(ne,F,q))}catch{try{return fn(kr(L,M))===fn(ne)}catch{return!1}}}function Ev(M,L,F,q,ne,re,ue){let ve=F??L;if(!ne&&(M.startsWith("~")||M.startsWith("$HOME")||M.startsWith("${HOME}")))return!1;if(q)return!1;if(M.startsWith("/")||/^[A-Za-z]:[\\/]/.test(M))try{return Pl(M,L,re,ue)}catch{return!1}if(M.startsWith("./")||M.startsWith(".\\")||!M.includes("/")&&!M.includes("\\"))try{return Pl(kr(ve,M),L,re,ue)}catch{return!1}if(M.startsWith("../"))return!1;try{return Pl(kr(ve,M),L,re,ue)}catch{return!1}}function Pl(M,L,F,q){try{return Wf(Dt(M,F,q),Dt(L,F,q))}catch{return!1}}function Lf(M,L,F,q){if(!L)return!1;try{return Wf(Dt(L,F,q),Dt(M,F,q))}catch{return!0}}function Wf(M,L){let F=fn(M),q=fn(L);return F.startsWith(`${q}${Al}`)||F===q}var xv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Gf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ff="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",zf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",_v="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",wv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",Pv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:zf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Ff},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:_v},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Gf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Rv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Gf}};function Bf(M,L,F,q=dr({...F,allowPaths:F.policy?.destructiveCommandAllowPaths})){return Av(M.words.map((ne)=>({kind:"word",text:ne.text,dynamic:ne.provenance!=="literal"})),L,q,F.policy)}function Av(M,L,F,q){let ne=M.filter((xe)=>xe.kind==="word"),re=Iv(ne),ue=ne[re];if(!ue||!xv.has(Fv(ue.text)))return null;let ve=Tv(ne.slice(re+1));if(ve.whatIfProtected)return null;if(Qt(q,"powershell.remove-item-pipeline-dynamic-target",F.strict)&&L&&(ve.targets.length===0||ve.recursive))return Et("powershell.remove-item-pipeline-dynamic-target",wv);for(let xe of ve.targets)if(!rr(xe.text)&&Tl(Ol(xe.text)))return Et(ve.recursive&&ve.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",zf);for(let xe of ve.targets)if(F.resolvedCwd&&Tr(Ol(xe.text),F.resolvedCwd,F.protectedGitMetadata,ve.recursive,F.environment,F.budget,!0))return Et("powershell.remove-item-git-metadata",x);if(!ve.recursive||!ve.force)return null;if(Qt(q,"powershell.remove-item-recursive-force-dynamic-target",F.strict)&&(ve.hasDynamicTarget||ve.targets.length===0))return Et("powershell.remove-item-recursive-force-dynamic-target",Ff);for(let xe of ve.targets){let He=Qo(Dn(Ol(xe.text),F),F,q,Pv);if(He)return He}return null}function Tv(M){let L=[],F=!1,q=!1,ne=!1,re=!1,ue=!1;for(let ve=0;ve<M.length;ve++){let xe=M[ve];if(!xe||xe.kind!=="word")continue;if(kv(xe))continue;if(ue){L.push(kl(xe)),re=re||xe.dynamic;continue}if(xe.text==="--"){ue=!0;continue}let He=Mv(xe.text);if(!He){L.push(kl(xe)),re=re||xe.dynamic;continue}if(Dv(He.name)){let ft=He.value?Ov(He.value,xe):M[++ve];if(ft?.kind==="word"){L.push(kl(ft)),re=re||ft.dynamic;continue}re=!0;continue}if(Nv(He.name)){F=!0;continue}if(Lv(He.name)){q=!0;continue}if(Wv(He.name))ne=Gv(He.value)}return{targets:L,recursive:F,force:q,whatIfProtected:ne,hasDynamicTarget:re}}function Iv(M){let L=M[0];if(L?.kind==="word"&&L.text==="&"||L?.text===".")return M.length>1?1:0;return 0}function kl(M){return{text:M.kind==="word"?M.text:"",dynamic:M.kind==="word"&&M.dynamic}}function kv(M){return M.kind==="word"&&M.text===","}function Ol(M){let L=M.replace(/\\/g,"/"),F=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(L);return F?`$HOME${L.slice(F[0].length)}`:L}function Ov(M,L){return{kind:"word",text:M,dynamic:L.kind==="word"&&(L.dynamic||M.includes("$"))}}function Mv(M){if(!M.startsWith("-")||M==="-")return null;let L=M.slice(1),F=L.indexOf(":");if(F===-1)return{name:L.toLowerCase()};return{name:L.slice(0,F).toLowerCase(),value:L.slice(F+1)}}function Dv(M){return"path".startsWith(M)||"literalpath".startsWith(M)}function Nv(M){return"recurse".startsWith(M)}function Lv(M){return M.length>=2&&"force".startsWith(M)}function Wv(M){return M==="wi"||"whatif".startsWith(M)}function Gv(M){if(M===void 0||M==="")return!0;let L=M.toLowerCase();return L==="$true"||L==="true"}function Fv(M){return M.toLowerCase()}var so="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",bs="Unsupported heredoc syntax",ti="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",$f="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var zv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Bv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),$v=new Set(["-o","--output","--query","--subscription"]),Uv=new Set;function Uf(M){if(M==="aws")return zv;if(M==="gcloud")return Bv;if(M==="az")return $v;return Uv}var Hv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),jv=new Set;function Hf(M){if(M==="git")return bn;if(M==="docker")return Hv;return jv}function A(M,L){if(M.length===0||L.length===0)return null;let F=kt(M[0]??""),q=ln(M);for(let ne of L){if(!qv(F,ne.command))continue;if(ne.match){if(Vv(F,M,ne.match))return jf(ne);continue}if(!Yv(F,M,ne.subcommand))continue;if(Xv(M,new Set(ne.block_args),q))return jf(ne)}return null}function jf(M){return{id:`custom.${M.name}`,reason:`[${M.name}] ${M.reason}`,intent:M.intent??"manual_only"}}function Vv(M,L,F){let q=L.slice(1);if(F.exclude_args?.some((ne)=>q.includes(ne)))return!1;if(F.any_args&&!F.any_args.some((ne)=>q.includes(ne)))return!1;return Kv(q,F.command_path,Uf(M))}function Kv(M,L,F){let q=0,ne=!1;for(let re of M){if(q>=L.length)return!0;if(ne){ne=!1;continue}if(re.startsWith("-")){ne=!re.includes("=")&&F.has(re);continue}if(re!==L[q])return!1;q++}return q>=L.length}function qv(M,L){return M===kt(L)}function Yv(M,L,F){if(!F)return!0;return Vf(L,1,F,Hf(M))}function Vf(M,L,F,q){let ne=!1;for(let re=L;re<M.length;re++){let ue=M[re];if(!ue)continue;if(ne){ne=!1;continue}if(ue==="--"){let ve=M[re+1];if(ve&&!ve.startsWith("-"))return ve===F;return!1}if(q.has(ue)){ne=!0;continue}if(ue.startsWith("-")){if(!ue.includes("=")&&Zv(M,re,F,q))return!0;continue}return ue===F}return!1}function Zv(M,L,F,q){let ne=M[L+1];if(!ne||ne.startsWith("-"))return!1;return Vf(M,L+2,F,q)}function Xv(M,L,F){return M.some((q)=>L.has(q))||[...F].some((q)=>L.has(q))}var Jv=new Set(["-e","--source"]),Qv=new Set(["-F","-v","--assign","--field-separator"]),Kf=new Set(["-f","--file"]),eE=new Set(["print","printf","return"]),qf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],tE="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Yf(M,L,F){let q=!1;for(let ne of nE(M)){let re=rE(ne,F);if(!re)continue;for(let ue of re.commands){let ve=L(ue);if(ve)return ve;if(ue.includes("{}")||/[$`]/.test(ue))q=!0}q||=re.dynamic}return q?Et("awk.system-dynamic",tE):null}function Dl(M){let L=[],F=!1,q=!1,ne=!0,re=!0;for(let ue=1;ue<M.length;ue++){let ve=M[ue];if(ve===void 0)break;if(ne&&ve==="--"){ne=!1;continue}if(ne&&Jv.has(ve)){F=!0;let xe=M[ue+1];if(re&&=xe!==void 0,xe!==void 0)L.push({tokenIndex:ue+1,kind:"inline-code",value:xe});ue++;continue}if(ne&&ve.startsWith("--source=")){F=!0,L.push({tokenIndex:ue,kind:"inline-code",value:ve.slice(9)});continue}if(ne&&ve.startsWith("-e")&&ve.length>2){F=!0,L.push({tokenIndex:ue,kind:"inline-code",value:ve.slice(2)});continue}if(ne&&(Qv.has(ve)||Kf.has(ve))){let xe=M[ue+1];if(re&&=xe!==void 0,Kf.has(ve)){if(q=!0,xe!==void 0)L.push({tokenIndex:ue+1,kind:"program-file",value:xe})}ue++;continue}if(ne&&(ve.startsWith("-F")||ve.startsWith("-v")&&ve.slice(2).includes("=")))continue;if(ne&&ve.startsWith("-f")&&ve.length>2){q=!0,L.push({tokenIndex:ue,kind:"program-file",value:ve.slice(2)});continue}if(ne&&(ve.startsWith("--assign=")||ve.startsWith("--field-separator=")))continue;if(ne&&ve.startsWith("--file=")){q=!0,L.push({tokenIndex:ue,kind:"program-file",value:ve.slice(7)});continue}if(ne&&ve.startsWith("-")&&ve!=="-")continue;if(!F&&!q)L.push({tokenIndex:ue,kind:"main-program",value:ve});return{sources:L,optionsOpen:!1}}return{sources:re?L:[],optionsOpen:ne&&re}}function ri(M){return Dl(M).sources}function nE(M){return ri(M).filter((L)=>L.kind!=="program-file").map((L)=>L.value)}function rE(M,L){vn(L,M);let F=M.includes("system")?Nl(M,L):null,q=oE(M,L);if(!F&&!q)return null;return{dynamic:!!F?.dynamic||!!q?.dynamic,commands:[...F?.commands??[],...q?.commands??[]]}}function Nl(M,L){vn(L,M);let F=[],q=!1,ne=!1,re=0;while(re<M.length){let ue=M[re];if(ue==='"'||ue==="'"){re=Ss(M,re,ue)?.endIndex??re+1;continue}if(ue==="#"){re=Zf(M,re+1);continue}if(ue==="/"&&Xf(M,re)){re=Jf(M,re+1)??re+1;continue}if(!M.startsWith("system",re)){re++;continue}let ve=re;if(re+=6,ni(M[ve-1])||ni(M[re]))continue;let xe=Cs(M,re);if(M[xe]!=="(")continue;xe=Cs(M,xe+1);let He=M[xe];if(He!=='"'&&He!=="'"){q=!0,ne=!0;continue}let ft=Ss(M,xe,He);if(!ft){q=!0,ne=!0;continue}if(xe=Cs(M,ft.endIndex),q=!0,M[xe]!==")"){ne=!0,re=ft.endIndex;continue}F.push(ft.value),re=xe+1}if(!q)return null;return{dynamic:ne,commands:F}}function oE(M,L){vn(L,M);let F=[],q=!1,ne=!1,re=0,ue=0,ve=null,xe=null,He=0;while(re<M.length){let ft=M[re];if(!ft)break;if(ft==='"'||ft==="'"){let pt=Ss(M,re,ft);if(pt&&He===ue)xe={...pt,startIndex:re};He=pt?.endIndex??re+1,re=pt?.endIndex??re+1;continue}if(ft==="#"){re=Zf(M,re+1),ue=re,ve=null,xe=null,He=re;continue}if(ft==="/"&&Xf(M,re)){let pt=Jf(M,re+1);He=pt??re+1,re=pt??re+1;continue}if(`;
-{}`.includes(ft)){re++,ue=re,ve=null,xe=null,He=re;continue}if(ve===null&&(Ml(M,re,"print")||Ml(M,re,"printf")))ve=re;if(ft!=="|"||M[re-1]==="|"||M[re+1]==="|"){if(!/\s/.test(ft))He=re+1;re++;continue}let mt=M[re+1]==="&"?re+2:re+1,dt=Cs(M,mt);if(Ml(M,dt,"getline")){ne=!0;let pt=aE(ue,xe,He);if(q||=pt===null,pt!==null)F.push(pt);He=mt,re=mt;continue}if(cE(ue,ve)){ne=!0;let pt=sE(M,dt);if(!pt){q=!0,He=mt,re=mt;continue}if(!iE(M,pt.endIndex)){q=!0,He=pt.endIndex,re=pt.endIndex;continue}F.push(pt.value),He=pt.endIndex,re=pt.endIndex;continue}He=mt,re++}if(!ne)return null;return{dynamic:q,commands:F}}function ni(M){return!!M&&/[A-Za-z0-9_]/.test(M)}function Cs(M,L){let F=L;while(/\s/.test(M[F]??""))F++;return F}function iE(M,L){let F=L;while(/[\t\f\v\r ]/.test(M[F]??""))F++;let q=M[F];return!q||`;
-}#`.includes(q)}function Ss(M,L,F){let q="",ne=!1;for(let re=L+1;re<M.length;re++){let ue=M[re];if(!ue)break;if(ne){let ve=lE(M,re);if(!ve)return null;q+=ve.value,re=ve.endIndex,ne=!1;continue}if(ue==="\\"){ne=!0;continue}if(ue===F)return{value:q,endIndex:re+1};q+=ue}return null}function sE(M,L){let F=M[L];if(F!=='"'&&F!=="'")return null;return Ss(M,L,F)}function aE(M,L,F){if(!L)return null;return L.startIndex>=M&&L.endIndex===F?L.value:null}function lE(M,L){let F=M[L];if(!F)return null;if(F==="x"){let ne=M.slice(L+1,L+3);if(!/^[0-9A-Fa-f]{2}$/.test(ne))return null;return{value:String.fromCharCode(Number.parseInt(ne,16)),endIndex:L+2}}if(/[0-7]/.test(F)){let ne=/^[0-7]{1,3}/.exec(M.slice(L));if(!ne)return null;return{value:String.fromCharCode(Number.parseInt(ne[0],8)),endIndex:L+ne[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[F]??F,endIndex:L}}function Ml(M,L,F){return M.startsWith(F,L)&&!ni(M[L-1])&&!ni(M[L+F.length])}function cE(M,L){return L!==null&&L>=M}function Zf(M,L){let F=M.indexOf(`
-`,L);return F===-1?M.length:F+1}function Xf(M,L){let F=uE(M,L);if(F===-1)return!0;if("{([,;!~=".includes(M[F]??""))return!0;let q=F;while(ni(M[q-1]))q--;return eE.has(M.slice(q,F+1))}function uE(M,L){for(let F=L-1;F>=0;F--)if(!/\s/.test(M[F]??""))return F;return-1}function Jf(M,L){let F=!1;for(let q=L;q<M.length;q++){let ne=M[q];if(!ne)break;if(F){F=!1;continue}if(ne==="\\"){F=!0;continue}if(ne==="/")return q+1}return null}var dE="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",fE="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",mE="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Qf(M){return M==="dd"||M==="shred"||M==="mkfs"||M.startsWith("mkfs.")}function em(M,L){let F=L.slice(1);if(M==="dd"&&F.some((q)=>/^of=\/dev\/.+/.test(q)))return Et("dd.device-write",dE);if((M==="mkfs"||M.startsWith("mkfs."))&&F.some((q)=>q.startsWith("/dev/")))return Et("mkfs.device",fE);if(M==="shred"&&F.length>0)return Et("shred.target",mE);return null}var pE=new Set(["sudo","env","command","builtin"]),gE=new Set(["exec","nice","nohup","setsid","stdbuf","time","timeout"]);function vs(M,L){let F=M[0];if(!F||!tm(At(F),L))return null;let q=At(F),ne=M[1]==="--"?2:1,re=hE(M,ne,q,L),ue=re[0];if(ue===void 0)return null;return{wrapper:q,tokens:M.slice(ue),childIndex:ue,alternativeChildIndices:re.slice(1)}}function hE(M,L,F,q){let ne=M[1]==="--",re=[];for(let ue=L;ue<M.length;ue++){let ve=M[ue];if(!ve)continue;let xe=At(ve)!==F&&yE(ve,q);if(xe)re.push(ue);if(!xe&&Ai.has(kt(ve)))break;if(ne)break}return re}function yE(M,L){let F=At(M),q=kt(M);return q==="git"||F==="busybox"||Or(M)||xa.has(F)||Qf(q)||tm(F,L)||jt.has(q)||M==="$SHELL"||In(q)||_n.has(q)||L.rules.some((ne)=>ne.command===F)}function tm(M,L){return gE.has(M)||L.transparentWrappers.includes(M)}function Or(M){return pE.has(M.toLowerCase())}function Mr(M,L){return{embedded:!1,cwd:M.cwd,originalCwd:L.originalCwd,effectiveCwd:M.cwd,envAssignments:M.envAssignments,allowTmpdirVar:L.allowTmpdirVar,worktreeMode:L.worktreeMode,wrappedByTransparent:!1}}function Nn(M,L){let F=L.policy??{rules:[],transparentWrappers:[]};return Es([...M],L.environment,L.cwd,L.cwd,new Map,new Map(L.envAssignments??[]),F,{iterations:0},!1)}function*Es(M,L,F,q,ne,re,ue,ve,xe){let He=ss(M,L,F,re);for(let[pt,gt]of He.envAssignments)re.set(pt,gt),ne.set(pt,gt);let{tokens:ft,cwd:mt}=He;if(He.envSplitValues){let pt=is(He.envSplitValues,ft);if(!pt)throw new s("derivedCommandShape");Ll(ve),yield*Es(pt,L,mt,q,ne,re,ue,ve,xe);return}if(Or(ft[0]??""))throw new s("wrapperPeelIterations");let dt=vs(ft,ue);if(dt){for(let pt of[dt.childIndex,...dt.alternativeChildIndices])Ll(ve),yield*Es(pt===dt.childIndex?dt.tokens:ft.slice(pt),L,mt,q,new Map(ne),new Map(re),ue,ve,!0);return}if(CE(ft)){Ll(ve),yield*Es(ft.slice(1),L,mt,q,ne,re,ue,ve,xe);return}yield bE(ft,mt,q,ne,re,xe)}function bE(M,L,F,q,ne,re){return{tokens:M,cwd:L===null?void 0:L??F,wrapperCwd:L,wrapperEnvAssignments:q,envAssignments:ne,head:At(M[0]??"").toLowerCase(),wrappedByTransparent:re}}function Ll(M){if(M.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");M.iterations++}function CE(M){return At(M[0]??"").toLowerCase()==="busybox"&&M.length>1}function Wl(M,L){let F=[],q=L;while(q<M.length){let ne=M[q];if(ne===void 0||ne===":::")break;F.push(ne),q++}return{markerIndex:q<M.length&&M[q]===":::"?q:-1,templateTokens:F}}function Ln(M){let L=!1,F=!1;for(let q of M){if(q==="--")break;if(q==="-r"||q==="-R"||Gl(q,"recursive")){L=!0;continue}if(q==="-f"||Gl(q,"force")){F=!0;continue}if(q.startsWith("-")&&!q.startsWith("--")){if(q.includes("r")||q.includes("R"))L=!0;if(q.includes("f"))F=!0}}return L&&F}function xs(M){let L=M.indexOf("--");return M.slice(1,L===-1?void 0:L).some((F)=>Gl(F,"recursive")||/^-[A-Za-z]+$/.test(F)&&/[rR]/.test(F.slice(1)))}function Gl(M,L){return M.length>2&&M.startsWith("--")&&L.startsWith(M.slice(2))}var SE=["--init-file","--rcfile"],vE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Wn(M){for(let L=1;L<M.length;L++){let F=M[L];if(!F)continue;if(F==="-c")return nm(M,L,!0);if(F.startsWith("-")&&F.includes("c")&&!F.startsWith("--")){let q=nm(M,L,!1);if(q!==null)return q}}return null}function Jn(M){let L=At(M[0]??"").toLowerCase();if(L==="zsh"||L==="ksh")return Cn(M).syntaxCheck;let F=!1;for(let q of M.slice(1)){if(q==="--")return F;if(q.startsWith("+")&&!q.startsWith("++")){if(q.slice(1).includes("n"))F=!1;continue}if(!q.startsWith("-")||q.startsWith("--"))return F;let ne=q.slice(1);if(ne.includes("n"))F=!0;if(ne.includes("c"))return F}return F}function nm(M,L,F){if(M[L+1]==="--")return M[L+2]||null;let q=M[L+1];if(!q||!F&&q.startsWith("-"))return null;return q}function rm(M){let L=At(M[0]??"").toLowerCase(),F=EE(M,L),q=vE.get(L)??null,ne=F.argvSource?.kind!=="absent";return{argvSource:L==="bash"?F.argvSource:null,argvSourceApplies:L==="bash"&&F.interactive&&F.argvSource?.kind==="literal",envName:q,envSourceApplies:ne&&(q==="BASH_ENV"?!F.interactive:q==="ENV"&&F.interactive)}}function EE(M,L){let F=Cn(M),q=F.commandIndex??F.scriptIndex??M.length,ne=[],re=!1,ue=!0;for(let ve=1;ve<q;ve++){let xe=M[ve];if(xe===void 0||xe==="--"||xe==="-"||xe[0]!=="-"&&xe[0]!=="+")break;if(xe.startsWith("--")){if(L==="bash"&&ue?SE.find((dt)=>xe===dt):void 0){let dt=M[ve+1];ne.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),ve++;continue}let mt=xe.split("=",1)[0]??xe;if(L==="bash"&&va.has(mt)&&!xe.includes("="))ve++;continue}if(L==="bash")ue=!1;let He=Ea(L,xe,M[ve+1],"startup");if(He.interactive)re=xe[0]==="-";ve+=He.followingValues}return{argvSource:ne.at(-1)??null,interactive:re}}var xE="find -delete permanently removes files. Use -print first to preview.",RE="find -exec rm -rf is dangerous. Use explicit file list instead.",_E=new Set(["-exec","-execdir","-ok","-okdir"]),wE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((M)=>[M,1]),["-fprintf",2]]);function om(M,L){let F=M.map(t),q=PE(M,F,L);if(q)return q;if(Rs(F,1)&&!ME(M,F,L)){let ue=Pt(Et("find.delete",xE),L.policy);if(ue)return ue}let ne=L.budget??hn(),re=0;while(re<F.length){let ue=F[re],ve=Qn(ue??"");if(ve>0){re+=ve+1;continue}if(!$n(ue)){re++;continue}ne.charge("derivedTokens",F.length-re-1);let xe=ao(F,re);re=xe.nextIndex;let He=NE(xe.tokens,L.environment);if(He){let pt=Pt(He,L.policy);if(pt)return pt}let ft=ue==="-execdir"||ue==="-okdir",mt=L.analyzeTokens?L.analyzeTokens(xe.tokens,ft?null:L.cwd):L.analyzeNested?L.analyzeNested(xe.tokens.join(" "),{effectiveCwd:ft?void 0:L.cwd,envAssignments:L.envAssignments}):null,dt=mt?.id.startsWith("custom.")?mt:Pt(mt,L.policy);if(dt)return dt}return null}function PE(M,L,F){if(!Rs(L,1)&&!Fl(L,F.environment))return null;let ne=oi(M)??Ht(["."]),re=dr({...F,allowPaths:F.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let ue of ne){let ve=ei(ue);for(let xe of ve.expandedTargets??[t(ue)]){let He=Dn(xe,re,{targetIsLiteral:ve.expandedTargets!==void 0||ve.targetIsLiteral,tmpdirWordSplittingProtected:ve.tmpdirWordSplittingProtected});if(He.kind==="root_or_home_target")return Et("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(He.kind==="git_metadata_target"&&!AE(M,re.protectedGitMetadata,F.environment))return Et("find.delete-git-metadata",x)}}if(OE(L)&&re.resolvedCwd&&xf(ne.map(t),re.resolvedCwd,re.protectedGitMetadata,re.environment,re.budget))return Et("find.delete-git-metadata",x);return null}function AE(M,L,F){if(!L)return!1;let q=M.map(t),ne=[],re=!1,ue=oi(M)?.at(-1),ve=ue?M.indexOf(ue)+1:1;while(ve<q.length){let xe=q[ve]??"";if($n(xe)){let He=ao(q,ve),ft=lr([...He.tokens],F),mt=xs(ft),dt=jt.has(At(ft[0]??"").toLowerCase()),pt=He.tokens.some((ht)=>ht!=="{}"&&ht.includes("{}")),gt=(xe==="-execdir"||xe==="-okdir")&&ft.slice(1).some((ht)=>ht!=="{}"&&!ht.startsWith("-"));if(mt||dt||pt||gt)return!1;re=!0,ve=He.nextIndex;continue}if(xe==="-delete"){re=!0,ve++;continue}if(xe==="-name"||xe==="-iname"){let He=M[ve+1];if(!(He?.provenance==="literal"&&!/[[\\]/.test(He.text)))return!1;if(!re)ne.push(IE(He.text,xe==="-iname"));ve+=2;continue}if(!TE.has(xe))return!1;ve+=1+Qn(xe)}return ne.length>0&&!_f(L,(xe)=>ne.every((He)=>He.test(xe)))}var TE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function IE(M,L){let F=M.replace(/[*?]|[.+^${}()|\]/]/g,(q)=>q==="*"?".*":q==="?"?".":`\\${q}`);return new RegExp(`^${F}$`,L?"isu":"su")}var kE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Fl(M,L){let F=0;while(F<M.length){if(!$n(M[F])){F++;continue}let q=ao(M,F),ne=lr([...q.tokens],L),re=At(ne[0]??"").toLowerCase(),ue=jt.has(re)&&kE.test((Wn(ne)??"").replace(/["'\\]/g,""));if((re==="rm"||re==="rmdir"||ue)&&ne.some((xe)=>xe.includes("{}")))return!0;F=q.nextIndex}return!1}function OE(M){return M.some((L,F)=>{if(!["-name","-iname"].includes(L))return!1;return M[F+1]?.toLowerCase()==="hooks"})}function ME(M,L,F){if(L.includes("-L")||L.includes("-f")||L.includes("-follow"))return!1;let q=oi(M);if(!q)return!1;let ne=F.envAssignments??new Map,re=wl(ne,F.environment),ue=F.trustedTmpdirValue??Ir(ne,F.environment),ve=F.allowTmpdirVar??!Jo(ne,F.environment),xe={environment:F.environment,protectedGitMetadata:F.protectedGitMetadata,cwd:F.cwd,originalCwd:F.originalCwd,strict:F.strict,allowTmpdirVar:ve&&ue&&Boolean(re),allowPaths:F.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:F.tmpdirWordSplittingUnsafe??ur(ne,F.environment),trustedTmpdirValue:ue,budget:F.budget},He=dr(xe),ft=dr({...xe,cwd:F.originalCwd??F.cwd}),mt=F.originalCwd&&F.environment.paths.realpath(F.originalCwd),dt=F.cwd&&F.environment.paths.realpath(F.cwd),pt=mt&&dt&&!io(dt,mt)?F.cwd:void 0;return q.every((gt)=>{let ht=ei(gt);if(ht.unsafeBraceExpansion)return!1;return(ht.expandedTargets??[t(gt)]).every((yt)=>{let bt=/^\.\/*$/.test(yt)?pt:void 0,St=bt??yt;return Df(St,bt?ft:He,{containmentTarget:DE(St,re),targetIsLiteral:ht.expandedTargets!==void 0||ht.targetIsLiteral,tmpdirWordSplittingProtected:ht.tmpdirWordSplittingProtected})})})}function DE(M,L){if(!L)return M;return M.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>L)}function oi(M){let L=(ne)=>{let re=M[ne];return re?t(re):void 0},F=1;while(L(F)==="-H"||L(F)==="-P")F++;if(L(F)==="--")F++;let q=[];while(F<M.length){let ne=L(F),re=M[F];if(!ne||!re||ne.startsWith("-")||["!","(",")"].includes(ne))break;q.push(re),F++}return q.length>0?q:null}function NE(M,L){let F=ar([...M],L);if(F.length===0)return null;let q=At(F[0]??"");if(q==="busybox"&&F.length>1)F=F.slice(1),q=At(F[0]??"");if(q==="rm"&&Ln(F))return Et("find.exec-rm-recursive-force",RE);return null}function ao(M,L){let F=L+1;while(F<M.length&&M[F]!==";"&&!(M[F]==="+"&&M[F-1]==="{}"))F++;return{tokens:M.slice(L+1,F),nextIndex:Math.min(F+1,M.length)}}function Rs(M,L){let F=L;while(F<M.length){let q=M[F];if(!q){F++;continue}if($n(q)){F=ao(M,F).nextIndex;continue}let ne=Qn(q);if(ne>0){F+=ne+1;continue}if(q==="-delete")return!0;F++}return!1}function Qn(M){return wE.get(M)??(/^-newer[A-Za-z]{2}$/.test(M)?1:0)}function $n(M){return M!==void 0&&_E.has(M)}import{resolve as uR}from"node:path";function*zl(M){for(let L of M.nodes)yield*WE(L)}function LE(M){return Object.freeze([...zl(M)])}function ut(M){return Object.freeze(LE(M).map((L)=>Object.freeze(L.words.map((F)=>F.text))))}function ii(M){let L=h(M,"posix");if(L.status!=="complete"||L.nodes.length!==1)return null;let F=L.nodes[0];if(F?.kind!=="command")return null;if(F.redirections.length>0||F.nested.length>0)return null;if(F.words.some((q)=>q.provenance==="command-substitution"))return null;return F.words.map((q)=>q.text)}function*WE(M){if(M.kind==="command"){yield M;for(let L of M.nested)yield*zl(L);return}if(M.kind==="group")yield*zl(M.body)}var GE=5,Bl="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function tn(M){let L=M.indexOf("--");if(L===-1)return{index:-1,before:M,after:[]};return{index:L,before:M.slice(0,L),after:M.slice(L+1)}}function sm(M,L,F){let q=_s(M,L,F),ne=FE(q.entries);if(ne.size===0)return{blockedReason:q.blockedReason,expanded:!1,tokens:M};let re=M,ue=!1;for(let ve=0;ve<GE;ve++){let{subcommand:xe,rest:He}=En(re),ft=xe?.toLowerCase();if(!ft||!ne.has(ft))return{blockedReason:q.blockedReason,expanded:ue,tokens:re};let mt=ne.get(ft),dt=HE(mt);if(dt===null||dt.length===0)return{blockedReason:Bl,expanded:!0,tokens:re};re=["git",...dt,...He],ue=!0}return{blockedReason:Bl,expanded:!0,tokens:re}}function am(M,L,F){return _s(M,L,F).entries.some((q)=>q.key.toLowerCase()==="core.sshcommand")}function En(M){if(M.length===0)return{subcommand:null,rest:[]};let L=M[0];if((L?At(L).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let q=1;while(q<M.length){let ne=M[q];if(!ne)break;if(ne==="--"){let re=M[q+1];if(re&&!re.startsWith("-"))return{subcommand:re,rest:M.slice(q+2)};return{subcommand:null,rest:M.slice(q+1)}}if(!ne.startsWith("-"))return{subcommand:ne,rest:M.slice(q+1)};q+=bn.has(ne)?2:1}return{subcommand:null,rest:[]}}function FE(M){let L=new Map;for(let F of M){let q=F.key.toLowerCase();if(!q.startsWith("alias."))continue;let ne=q.slice(6);if(ne!=="")L.set(ne,F.value)}return L}function _s(M,L,F){if(M.length===0)return{blockedReason:null,entries:[]};let q=M[0];if((q?At(q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let re=BE(L,F);return{blockedReason:re.blockedReason,entries:[...re.entries,...zE(M,L,F)]}}function zE(M,L,F){let q=[],ne=1;while(ne<M.length){let re=M[ne];if(!re||re==="--"||!re.startsWith("-"))return q;if(re==="-c"){let ue=$l(M[ne+1]);if(ue)q.push(ue);ne+=2;continue}if(re.startsWith("-c")&&re.length>2){let ue=$l(re.slice(2));if(ue)q.push(ue);ne++;continue}if(re==="--config-env"){let ue=im(M[ne+1],L,F);if(ue)q.push(ue);ne+=2;continue}if(re.startsWith("--config-env=")){let ue=im(re.slice(13),L,F);if(ue)q.push(ue);ne++;continue}if(bn.has(re)){ne+=2;continue}ne++}return q}function BE(M,L){let F=$E(M,L),q=UE(M,L);return{blockedReason:F===null||q===null?Bl:null,entries:[...F??[],...q??[]]}}function $E(M,L){let F=Zn("GIT_CONFIG_PARAMETERS",M,L);if(F===void 0)return[];let q=[],ne=ii(F);if(!ne)return null;for(let re of ne){let ue=$l(re);if(!ue)return null;q.push(ue)}return q}function UE(M,L){let F=Xd(M,L);if(F.state==="absent")return[];if(F.state==="invalid")return null;let q=[];for(let ne=0;ne<F.count;ne++){let re=Zn(`GIT_CONFIG_KEY_${ne}`,M,L)?.trim(),ue=Zn(`GIT_CONFIG_VALUE_${ne}`,M,L);if(!re||ue===void 0)return null;q.push({key:re,value:ue})}return q}function $l(M){if(!M)return null;let L=M.indexOf("=");return{key:(L===-1?M:M.slice(0,L)).trim(),value:L===-1?void 0:M.slice(L+1)}}function im(M,L,F){let q=M?.indexOf("=")??-1;if(!M||q===-1)return null;return{key:M.slice(0,q).trim(),value:Zn(M.slice(q+1),L,F)}}function HE(M){let L=M?.trimStart();if(!L||L.startsWith("!"))return null;return ii(L)}var jE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",VE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",KE="git checkout --force discards uncommitted changes. Use 'git stash' first.",qE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",YE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",ZE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",XE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",JE="git switch --force discards uncommitted changes. Use 'git stash' first.",QE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",ex="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",tx="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",nx="git reset --merge can lose uncommitted changes. Use 'git stash' first.",rx="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",ox="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",ix="git push --force destroys remote history. Use --force-with-lease for safer force push.",sx="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",ax="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",lx="git branch -D force-deletes without merge check. Use -d for safe delete.",cx="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",ux="git merge --abort discards merge conflict resolutions. Use 'git status' first.",dx="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",fx="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",mx="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",px="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",gx="git worktree remove --force can delete uncommitted changes. Remove --force flag.",hx=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),yx=new Set(["--recurse-submodules","--track","-t"]),Ul=new Set(["-b","-B","-U"]),Hl=new Set(["-c","-C"]),bx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ot(M,L){let F=M.split("=",1)[0]??M;return F.length>=4&&L.startsWith(F)&&F.startsWith("--")&&F.slice(2).length>=2}var lo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function cm(M,L){let{subcommand:F,rest:q}=En(M);if(!F)return null;switch(F.toLowerCase()){case"checkout":return fr(Cx(q,L));case"switch":return fr(vx(q));case"restore":return fr(xx(q));case"reset":return _x(q);case"clean":return fr(Px(q));case"rm":return fr(Ax(q));case"push":return Dr(Tx(q));case"branch":return Dr(Ox(q));case"stash":return Dr(Wx(q));case"worktree":return Dr(Gx(q));case"rebase":return fr(Mx(q));case"merge":return fr(Dx(q));case"tag":return Dr(Nx(q));case"reflog":return Dr(Lx(q));default:return null}}function fr(M){return M?{...M,localDiscard:!0}:null}function Dr(M){return M?{...M,localDiscard:!1}:null}function Cx(M,L){let{index:F,before:q}=tn(M),ne=ln(q,{shortOptsWithValue:Ul});if(q.some((ve)=>Ot(ve,"--force"))||ne.has("-f"))return Et("git.checkout-force",KE);for(let ve of M){if(ve==="-b"||ve==="-B"||ve==="--orphan")return null;if(Ot(ve,"--pathspec-from-file"))return Et("git.checkout-pathspec-from-file",YE)}if(F!==-1){if(q.some((xe)=>!xe.startsWith("-")))return Et("git.checkout-ref-path",qE);return Et("git.checkout-double-dash",jE)}let re=Ex(M);if(re.length>=2)return Et("git.checkout-ambiguous",ZE);let ue=re[0];if(ue===void 0||ne.has("-d")||ne.has("-t")||M.some((ve)=>Ot(ve,"--detach")||Ot(ve,"--track")))return null;if(Sx(ue)||L(ue))return Et("git.checkout-double-dash",VE);return null}function Sx(M){return M==="."||M===".."||/^\.\.?[/\\]/.test(M)||/^([/\\]|[A-Za-z]:[/\\])/.test(M)||M.endsWith("/")||M.startsWith(":")||/[*?[]/.test(M)}function vx(M){let{before:L}=tn(M);if(L.some((q)=>Ot(q,"--discard-changes")))return Et("git.switch-discard-changes",XE);let F=ln(L,{shortOptsWithValue:Hl});if(L.some((q)=>Ot(q,"--force"))||F.has("-f"))return Et("git.switch-force",JE);return null}function Ex(M){let L=[],F=0;while(F<M.length){let q=M[F];if(!q)break;if(q==="--")break;if(!q.startsWith("-")){L.push(q),F++;continue}if(hx.has(q)){F+=2;continue}if(yx.has(q)){let ne=M[F+1],re=q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];F+=ne&&!ne.startsWith("-")&&re.includes(ne)?2:1;continue}F++}return L}function xx(M){let L=Rx(M);if(L.isTerminal||!L.hasPathspec&&!L.hasPatch||!L.hasWorktree)return null;return L.hasExplicitLocation?Et("git.restore-worktree",ex):Et("git.restore-unstaged",QE)}function Rx(M){let L=!1,F=!1,q=!0,ne=!1,re=(ue)=>{if(!ne)q=!1,ne=!0;if(ue!==void 0)q=ue};for(let ue=0;ue<M.length;ue++){let ve=M[ue];if(ve===void 0)break;if(ve==="--"){L||=ue+1<M.length;break}if(ve==="--pathspec-from-file"){L=!0,ue++;continue}if(ve.startsWith("--pathspec-from-file=")){L=!0;continue}if(ve==="-h"||ve==="--help"||ve==="--version")return{hasPathspec:L,hasPatch:F,hasWorktree:q,hasExplicitLocation:ne,isTerminal:!0};if(ve==="--staged"){re();continue}if(ve==="--no-staged"){re();continue}if(ve==="--worktree"){re(!0);continue}if(ve==="--no-worktree"){re(!1);continue}if(ve==="--patch"){F=!0;continue}if(ve==="--no-patch"){F=!1;continue}if(bx.has(ve)){ue++;continue}if(ve.startsWith("--"))continue;if(ve==="-"){L=!0;continue}if(!ve.startsWith("-")){L=!0;continue}for(let xe=1;xe<ve.length;xe++){let He=ve.charAt(xe);if(He==="h")return{hasPathspec:L,hasPatch:F,hasWorktree:q,hasExplicitLocation:ne,isTerminal:!0};if(He==="S"){re();continue}if(He==="W"){re(!0);continue}if(He==="p"){F=!0;continue}if(He==="s"||He==="U"){if(xe===ve.length-1)ue++;break}}}return{hasPathspec:L,hasPatch:F,hasWorktree:q,hasExplicitLocation:ne,isTerminal:!1}}function _x(M){let L=null;for(let F of M){if(Ot(F,"--hard")){L=Et("git.reset-hard",tx);break}if(Ot(F,"--merge")){L=Et("git.reset-merge",nx);break}}if(!L)return null;return wx(M)?Dr(L):fr(L)}function wx(M){for(let L of M){if(L==="--")return!1;if(!L.startsWith("-"))return!0}return!1}function Px(M){for(let F of M)if(F==="-n"||Ot(F,"--dry-run"))return null;let L=ln(M.filter((F)=>F!=="--"));if(M.some((F)=>Ot(F,"--force"))||L.has("-f"))return Et("git.clean-force",rx);return null}function Ax(M){let L=!1,F=!1,q=!1;for(let ne of tn(M).before){if(Ot(ne,"--no-force")){L=!1;continue}if(Ot(ne,"--force")){L=!0;continue}if(Ot(ne,"--no-cached")){F=!1;continue}if(Ot(ne,"--cached")){F=!0;continue}if(Ot(ne,"--no-dry-run")){q=!1;continue}if(Ot(ne,"--dry-run")){q=!0;continue}let re=ln([ne]);L||=re.has("-f"),q||=re.has("-n")}return L&&!F&&!q?Et("git.rm-force",ox):null}function Tx(M){let{before:L,after:F}=tn(M),q=ln(L);if(L.some((ue)=>Ot(ue,"--mirror")))return Et("git.push-mirror",ax);if(L.some((ue)=>Ot(ue,"--force"))||q.has("-f")||lm(L,F).some(Ix))return Et("git.push-force",ix);if(L.some((ue)=>Ot(ue,"--delete"))||q.has("-d")||lm(L,F).some(kx))return Et("git.push-delete",sx);return null}function lm(M,L){return[...M.filter((F)=>F!==""&&!F.startsWith("-")),...L]}function Ix(M){return M.startsWith("+")||M.includes(":+")}function kx(M){return M.length>1&&M.startsWith(":")}function Ox(M){let{before:L}=tn(M),F=ln(L),q=F.has("-D")||F.has("-d")||L.some((re)=>Ot(re,"--delete")),ne=F.has("-D")||F.has("-f")||L.some((re)=>Ot(re,"--force"));if(q&&ne)return Et("git.branch-force-delete",lx);return null}function Mx(M){let{before:L}=tn(M);return L.some((F)=>Ot(F,"--abort"))?Et("git.rebase-abort",cx):null}function Dx(M){let{before:L}=tn(M);return L.some((F)=>Ot(F,"--abort"))?Et("git.merge-abort",ux):null}function Nx(M){let{before:L}=tn(M);return ln(L).has("-d")||L.some((q)=>Ot(q,"--delete"))?Et("git.tag-delete",dx):null}function Lx(M){return M[0]==="delete"?Et("git.reflog-delete",fx):null}function Wx(M){for(let L of M){if(L==="drop")return Et("git.stash-drop",mx);if(L==="clear")return Et("git.stash-clear",px)}return null}function Gx(M){let{before:L}=tn(M);if(!L.includes("remove"))return null;let q=ln(L);if(L.some((ne)=>Ot(ne,"--force"))||q.has("-f"))return Et("git.worktree-remove-force",gx);return null}import{dirname as iR,isAbsolute as sR,join as Rm,resolve as aR}from"node:path";var Vl="TMPDIR",Kl="IFS",dm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,fm=/^[A-Za-z_][A-Za-z0-9_]*$/,mm=new Set(["export","typeset","declare","readonly"]),Fx=new Set(["builtin","command","time"]),zx=new Set(["do","then","else"]),Bx=new Set(["do","then","case"]),um=new Set(["done","fi","esac"]),$x=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function pm(M,L){return M.map((F)=>F.provenance==="variable"&&vm(F.text)?gm(F.text,L.shellAssignments):t(F))}function gm(M,L){return M.replace($x,(F,q,ne)=>L.get(q??ne??"")??F)}function Un(M,L){let F=M.parts.every((ne)=>ne.provenance!=="literal"||!/[$`]/.test(ne.raw));if(M.provenance!=="variable"||!F)return null;let q=gm(M.text,L);return/^[~-]/.test(q)||/[\s$`*?[]/.test(q)?null:q}function hm(M,L){return{env:M,effectiveEnvAssignments:Vx(M,L),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function ym(M){return{env:M.env,effectiveEnvAssignments:M.effectiveEnvAssignments?new Map(M.effectiveEnvAssignments):void 0,shellAssignments:new Map(M.shellAssignments),bodyDepth:M.bodyDepth,bodyAssignments:new Set(M.bodyAssignments)}}function ql(M,L){let F=Cm(M,L),q=M[0]??"";if(Bx.has(q))L.bodyDepth+=1;if(q==="elif"||um.has(q))L.bodyDepth=Math.max(0,L.bodyDepth-1);if(um.has(q)&&L.bodyDepth===0)L.bodyAssignments.forEach((ve)=>{L.shellAssignments.delete(ve)}),L.bodyAssignments.clear();F.assignments.filter((ve)=>ve.persists).forEach((ve)=>{if(L.shellAssignments.set(ve.name,ve.value),L.bodyDepth>0)L.bodyAssignments.add(ve.name);Yl(L,ve)});let ne=F.commandIndex;if(ne!==-1&&mm.has(M[ne]??""))M.filter((ve)=>fm.test(ve)&&jl(ve)).forEach((ve)=>{Kx(L,ve)});let re=ne===-1?-1:Sm(M,ne);if(re===-1||M[re]!=="unset")return;let ue=Yx(M,re);if(ue===null)return;M.slice(ue).forEach((ve)=>{if(L.bodyDepth>0){L.shellAssignments.set(ve,"");return}qx(L,ve)})}function bm(M,L){let F=Cm(M,L).assignments;if(F.length===0)return L.effectiveEnvAssignments;let q=new Map(L.effectiveEnvAssignments??[]);return F.forEach((ne)=>{q.set(ne.name,ne.value)}),q}function Cm(M,L){let F=zx.has(M[0]??"")?1:0,q=M.findIndex((ve,xe)=>xe>=F&&!vm(ve)),ne=q!==-1&&mm.has(M[Sm(M,q)]??""),re=jx(L);return{assignments:M.flatMap((ve,xe)=>{let He=Ux(ve,re,L.env);if(!He)return[];if(q!==-1&&xe>q&&!ne&&!rs(He.name))return[];return re.set(He.name,He.value),[{...He,persists:q===-1||ne}]}),commandIndex:q}}function Sm(M,L){let F=L;while(Fx.has(M[F]??"")){F+=1;while(M[F]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(M[F]??""))return L;F+=1}}return F}function vm(M){return Pn(M)!==null||dm.test(M)}function Ux(M,L,F){return Pn(M)??Hx(M,L,F)}function Hx(M,L,F){let q=os(M,F,L);if(q)return q;let ne=M.match(dm)?.[1];if(!ne)return null;let re=M.indexOf("=");return{name:ne,value:`${L.has(ne)?L.get(ne):F.get(ne)??""}${M.slice(re+1)}`}}function jl(M){return M===Vl||M===Kl||yl(M)}function jx(M){return new Map([...M.effectiveEnvAssignments??[],...M.shellAssignments])}function Vx(M,L){let F=[Vl,Kl].map((q)=>{let ne=M.get(q);return ne===void 0?null:[q,ne]}).filter((q)=>q!==null);if(F.length===0)return L;return new Map([...F,...L??[]])}function Yl(M,L){let F=new Map(M.effectiveEnvAssignments??[]);F.set(L.name,L.value),M.effectiveEnvAssignments=F}function Kx(M,L){Yl(M,{name:L,value:M.shellAssignments.get(L)??M.effectiveEnvAssignments?.get(L)??M.env.get(L)??""})}function qx(M,L){if(!jl(L)&&!fm.test(L))return;if(M.shellAssignments.set(L,""),rs(L)&&M.env.has(L)){let q=new Map(M.env);q.delete(L),M.env=q}if(!jl(L)||L===Vl||L===Kl||_o(L)){Yl(M,{name:L,value:""});return}if(!M.effectiveEnvAssignments?.has(L))return;let F=new Map(M.effectiveEnvAssignments);F.delete(L),M.effectiveEnvAssignments=F.size===0?void 0:F}function Yx(M,L){let F=L+1;while(F<M.length){let q=M[F];if(!q)return null;if(q==="--")return F+1;if(q==="-v"){F++;continue}if(q.startsWith("-"))return null;return F}return F}import{resolve as Zx}from"node:path";function ws(M,L){return hl.some((F)=>L?.has(F)||M.has(F))}function co(M,L,F){if(!L)return{gitCwd:null,hasExplicitGitContext:!1};let q=F.realpath(Zx(L));if(q===null||!F.isDirectory(q))return{gitCwd:null,hasExplicitGitContext:!1};let ne=q,re=!1,ue=1;while(ue<M.length){let ve=M[ue];if(!ve)break;if(ve==="--")break;if(!ve.startsWith("-"))break;if(ve==="-C"){let xe=M[ue+1];if(!xe)return{gitCwd:null,hasExplicitGitContext:re};let He=Em(ne,xe,F);if(!He)return{gitCwd:null,hasExplicitGitContext:re};ne=He,ue+=2;continue}if(ve.startsWith("-C")&&ve.length>2){let xe=Em(ne,ve.slice(2),F);if(!xe)return{gitCwd:null,hasExplicitGitContext:re};ne=xe,ue++;continue}if(ve==="--git-dir"||ve==="--work-tree"){re=!0,ue+=2;continue}if(ve.startsWith("--git-dir=")||ve.startsWith("--work-tree=")){re=!0,ue++;continue}ue+=bn.has(ve)?2:1}return{gitCwd:ne,hasExplicitGitContext:re}}function Em(M,L,F){try{let q=sr(M,L,F);return F.isDirectory(q)?q:null}catch{return null}}function xm(M,L,F){if(!L.localDiscard||!F.worktreeMode||ws(F.environment.env,F.envAssignments))return null;let q=co(M,F.cwd,F.environment.paths);if(!q.gitCwd||q.hasExplicitGitContext)return null;let ne=F.environment.worktreeFacts(q.gitCwd);if(!ne)return null;if(Zl(M,F,ne))return null;return{kind:"worktree",originalReason:L.reason,gitCwd:q.gitCwd}}function Zl(M,L,F){let{subcommand:q,rest:ne}=En(M),re=q?.toLowerCase();if(L.dynamicArguments||Xx(ne)||nR(M,L.environment.env,L.envAssignments,F)||eR(ne)||Jx(re,ne))return!0;return re==="clean"&&tR(ne)>1}function Xx(M){return M.some((L)=>/[$*?[]/.test(L))}function Jx(M,L){if(M==="checkout"){let{before:F}=tn(L),q=ln(F,{shortOptsWithValue:Ul}),ne=F.some((ue)=>Ot(ue,"--force"))||q.has("-f"),re=q.has("-B")||F.some((ue)=>ue==="-B"||ue.startsWith("-B"));return ne&&re}if(M==="switch"){let{before:F}=tn(L),q=ln(F,{shortOptsWithValue:Hl}),ne=F.some((ue)=>Ot(ue,"--force"))||F.some((ue)=>Ot(ue,"--discard-changes"))||q.has("-f"),re=F.some((ue)=>ue==="-C"||ue.startsWith("-C")||Qx(ue))||q.has("-C");return ne&&re}return!1}function Qx(M){let L=M.split("=",1)[0]??M;return L==="--force-create"||L.length>=9&&"--force-create".startsWith(L)}function eR(M){return M.some((L)=>L.startsWith("--recurse-sub"))}function tR(M){let L=0;for(let F of M){if(F==="--force"){L++;continue}if(F.startsWith("-")&&!F.startsWith("--")){for(let q of F.slice(1))if(q==="f")L++}}return L}function nR(M,L,F,q){if(Zn("GIT_CONFIG_PARAMETERS",L,F)!==void 0)return!0;let ne=_s(M,L,F);if(ne.blockedReason!==null)return!0;let re=ne.entries.map((ve)=>({key:ve.key.toLowerCase(),value:ve.value}));if(re.some((ve)=>oR(ve.key)))return!0;let ue=re.filter((ve)=>ve.key==="submodule.recurse").at(-1);if(ue)return ue.value===void 0||rR(ue.value);if(Qd(F))return!0;return q.recursiveSubmodules}function rR(M){let L=M.toLowerCase();return L!=="false"&&L!=="no"&&L!=="off"&&L!=="0"}function oR(M){return M==="include.path"||M.startsWith("includeif.")&&M.endsWith(".path")}function _m(M,L,F){let q=M.map((xe)=>Un(xe,F.shellAssignments??new Map)??t(xe)),ne=F.environment.paths,re=co(q,F.cwd,ne),ue=F.originalCwd?ne.realpath(aR(F.originalCwd)):null;if(L.id.startsWith("git.push-")||ue===null||re.gitCwd===null||re.hasExplicitGitContext||ws(F.environment.env,F.envAssignments))return null;let ve=L.id==="git.worktree-remove-force"?cR(M,F.shellAssignments,ne):wm(re.gitCwd,ne);if(ve===null||L.id!=="git.worktree-remove-force"&&!lR(ve,q,L,F)||!oo(ve,F.environment)||hs(ve,F.environment)||io(ue,ve)||io(ve,ue))return null;return{kind:"temp-root",originalReason:L.reason,gitCwd:re.gitCwd}}function lR(M,L,F,q){let ne=q.environment.paths,re=Rm(M,".git");if(ne.entryKind(re)!=="present")return!1;if(ne.isDirectory(re))return!0;if(!F.localDiscard)return!1;let ve=q.environment.worktreeFacts(M);return ve!==null&&!Zl(L,q,ve)}function cR(M,L,F){let q=En(M.map(t)).rest,{before:ne,after:re}=tn(q.slice(q.indexOf("remove")+1)),ue=[...ne.filter((ft)=>!ft.startsWith("-")),...re],ve=ue.length===1?ue[0]??"":"",xe=M.find((ft)=>ft.text===ve),He=(xe&&Un(xe,L??new Map))??ve;if(!sR(He)||/[\s$`*?[]/.test(He)||F.entryKind(He)!=="present"||!F.isDirectory(He))return null;return F.realpath(He)}function wm(M,L){if(L.entryKind(Rm(M,".git"))!=="missing")return M;let F=iR(M);return F===M?null:wm(F,L)}var dR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",fR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ps(M,L){return Pm(M,L)}function Pm(M,L,F){let q=M.map(t),ne=sm(q,L.environment.env,L.envAssignments),re=ne.blockedReason?Pt(Et("git.alias-config",ne.blockedReason),L.policy):null;if(re)return re;let ue=ne.tokens;if((Jd(L.envAssignments)||am(q,L.environment.env,L.envAssignments))&&mR(ue))return Et("git.ssh-env",dR);let ve=cm(ue,(He)=>{let ft=co(q,L.cwd,L.environment.paths).gitCwd;return ft!==null&&L.environment.paths.entryKind(uR(ft,He))!=="missing"});if(!ve)return null;if(ne.expanded||ne.blockedReason)return ve;let xe=xm(q,ve,L)??_m(M,ve,L);if(!xe)return ve;return F?.(xe),null}function Am(M,L){let F=null;return{match:Pm(M,L,(ne)=>{F=ne}),relaxation:F}}function mR(M){let{subcommand:L,rest:F}=En(M),q=L?.toLowerCase();if(!q)return!1;if(fR.has(q))return!0;if(q==="archive")return tn(F).before.some((ne)=>Ot(ne,"--remote"));return q==="remote"&&pR(F)}function pR(M){return M.find((L)=>!gR(L))?.toLowerCase()==="update"}function gR(M){return M==="-v"||Ot(M,"--verbose")||Ot(M,"--no-verbose")}import{isAbsolute as HR}from"node:path";function Tm(M,L,F,q){let ne=M.slice(0,L),re=M.slice(L+F);return q.startsWith(ne)&&q.endsWith(re)?q.slice(ne.length,q.length-re.length):null}function As(M,L,F){let q=(re)=>`${re.tokenIndex}\x00${re.kind}\x00${re.value}`,ne=new Set(M.map(q));return Array.from(L).some((re)=>F(re).some((ue)=>!ne.has(q(ue))))}var Im="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",hR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Om="rm -rf targeting root or home directory is extremely dangerous and always blocked.",bR="rm -rf in home directory is dangerous. Change to a project directory first.",km={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Om},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:yR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:bR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Im},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:hR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Im}};function Ts(M,L){let F=dr({...L,allowPaths:L.policy?.destructiveCommandAllowPaths,posixShell:!0}),q=M.map(t),ne=Ln(q),re=xs(q),ue=SR(M);for(let ve of ue){let xe=ei(ve.word);if(ne&&xe.unsafeBraceExpansion){let He=Pt(Qo({kind:"outside_anchored_cwd"},F,L.policy,km),L.policy);if(He)return He;continue}for(let He of xe.expandedTargets??[ve.text]){let ft=yn(He),mt={targetIsLiteral:xe.expandedTargets!==void 0||xe.targetIsLiteral,tmpdirWordSplittingProtected:xe.tmpdirWordSplittingProtected};if(!re&&F.resolvedCwd&&Tr(ft,F.resolvedCwd,F.protectedGitMetadata,re,F.environment,F.budget))return Et("rm.git-metadata",x);if(re&&!ne){let dt=Dn(ft,F,mt);if(dt.kind==="root_or_home_target")return Et("rm.recursive-force-root-or-home",Om);if(dt.kind==="git_metadata_target")return Et("rm.git-metadata",x);continue}if(!ne)continue;for(let dt of CR(ft,F,mt)){let pt=Qo(dt,F,L.policy,km),gt=Pt(pt,L.policy);if(gt)return gt}}}return null}function CR(M,L,F){let q=Dn(M,L,F);if(q.kind==="cwd_self_target")return[q,Dn(M,L,{...F,skipCwdSelf:!0})];if(q.kind!=="home_cwd_target")return[q];let ne=Dn(M,L,{...F,skipHomeCwd:!0});if(ne.kind!=="cwd_self_target")return[q,ne];return[q,ne,Dn(M,L,{...F,skipHomeCwd:!0,skipCwdSelf:!0})]}function SR(M){let L=[],F=!1;for(let q of M.slice(1)){let ne=t(q);if(!ne)continue;if(ne==="--"){F=!0;continue}if(F){L.push({text:ne,word:q});continue}if(!ne.startsWith("-"))L.push({text:ne,word:q})}return L}var mr={kind:"none"},Nr={kind:"dynamic"},vR=new Set(["<","<<","<<-","<<<","<&","<>"]),Dm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,ER=/^(?:[0-9]+|[@*])$/,xR=ir.maxWords,Nm=ir.maxInputLength;function Lm(M){if(!M||At(kt(M.words[0]?.text??""))!=="printf")return;if(M.words.some((ne)=>ne.provenance!=="literal"))return;let L=M.words.slice(M.words[1]?.text==="--"?2:1),F=L[0]?.text;if(F===void 0)return"";let q=L.slice(1).map((ne)=>ne.text);if(F==="%s")return q.join("");if(F==="%s\\n"||F===`%s
-`)return`${q.join(`
-`)}
-`;if(F.includes("%")||/\\(?![\\nrt])/.test(F))return;return F.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Is(M){let L=uo(M[1])==="--"?2:1;if(M.length<=L)return mr;let F=M.slice(L);if(!F.every(ai))return Nr;return{kind:"literal",source:F.map(t).join(" ")}}function Wm(M){let L=uo(M[1])==="--"?2:1,F=M[L],q=uo(F);if(F===void 0||M.length<=L+1||q==="-"||q===""||q==="-l"||q==="-p")return mr;if(!ai(F))return Nr;return{kind:"literal",source:q}}function ks(M,L){let F=zm(M);if(F===-1)return mr;let q=_R(L);if(!q)return mr;let ne=[],re=q.command?.length??0;for(let ue of q.references){let ve=PR(ue,M,F,q.ifs);if(!ve)return Nr;if(re+=ve.reduce((xe,He)=>xe+He.length+3,0),ne.length+ve.length>xR||re>Nm)return Nr;ne.push(...ve)}if(q.command==="eval")return{kind:"literal",source:ne.join(" ")};if(ne.length===0||/\s/.test(ne[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[q.command,q.command&&q.optionTerminator?"--":null,...ne.map(Bm)].filter((ue)=>ue!==null).join(" ")}}function Gm(M,L){let F=zm(M),q=M.slice(F+1),ne=/\bIFS\b/.test(L);if(F===-1||!q.every(ai)||ne)return L;let re=q.map(uo),ue="",ve=null,xe=0;while(xe<L.length){let He=L[xe]??"",ft=ve==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(L.slice(xe));if(ft){let mt=ft[1]??ft[2],dt=mt==="@"||mt==="*"?re.slice(1):[re[Number(mt)]??""];if(ve!=='"'&&dt.some((gt)=>/[*?[]/.test(gt)))return L;if(ue+=ve==='"'?dt.map((gt)=>gt.replace(/["$`\\]/g,"\\$&")).join(mt==="@"?'" "':" "):dt.map((gt)=>gt.split(/[ \t\n]+/).map((ht)=>ht?Bm(ht):"").join(" ")).join(" "),ue.length>Nm)return L;xe+=ft[0].length;continue}if(He==="\\"&&ve!=="'"){ue+=L.slice(xe,xe+2),xe+=2;continue}if(He==="'"&&ve!=='"'||He==='"'&&ve!=="'")ve=ve?null:He;ue+=He,xe++}return ue}function Fm(M,L,F,q){if(!Cn(M.map(t)).readsStdinAsCommands)return mr;let ne=L.filter((re)=>(re.fd===void 0||re.fd===0)&&vR.has(re.operator)).at(-1);if(ne){if(ne.operator==="<<"||ne.operator==="<<-")return mr;if(ne.operator!=="<<<"||ne.target?.provenance!=="literal")return Nr;return{kind:"literal",source:ne.target.text}}if(!F)return mr;return q===void 0?Nr:{kind:"literal",source:q}}function er(M,L=new Map){let F=Cn(M.map(t)).scriptIndex;if(F===null)return mr;let q=M[F],ne=uo(q);if(Xi(q,ne))return{kind:"literal",source:ne};let re=q?Un(q,L):null;return re===null?Nr:{kind:"literal",source:re}}var RR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ec(M){if(M.words.length!==2||M.redirections.length!==0||M.nested.length!==1)return!1;let L=M.words[0],F=M.words[1];if(!L||L.provenance!=="literal"||L.quoted||L.raw!==L.text||!F)return!1;if(!(L.text==="eval"&&F.quoted&&F.parts.length===3&&F.parts[0]?.raw==='"'&&F.parts[1]?.provenance==="command-substitution"&&F.parts[1].raw.startsWith("$(")&&F.parts[2]?.raw==='"'||L.text==="eval"&&!F.quoted&&F.parts.length===1&&F.parts[0]?.provenance==="command-substitution"&&F.parts[0].raw.startsWith("$(")||(L.text==="source"||L.text===".")&&!F.quoted&&F.parts.length===1&&F.parts[0]?.provenance==="command-substitution"&&F.parts[0].raw.startsWith("<(")))return!1;let ne=M.nested[0];if(ne?.status!=="complete"||ne.nodes.length!==1)return!1;let re=ne.nodes[0];if(re?.kind!=="command"||re.redirections.length!==0||re.nested.length!==0||re.words.some((xe)=>xe.provenance!=="literal"||xe.parts.some((He)=>He.provenance!=="literal")))return!1;let ue=re.words[0]?.text;if(ue===void 0||Pn(ue)!==null)return!1;let ve=At(kt(ue));return!RR.has(ve)&&!jt.has(ve)&&!Or(ve)}function zm(M){return Cn(M.map(t)).commandIndex??-1}function _R(M){let L=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(M.trim()),F=L?.[4]??M.trim(),q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(F),ne=(q?.[3]??F).split(/\s+/).map(wR);if(ne.length===0||ne.some((re)=>re===null))return null;return{command:q?.[1]??null,optionTerminator:q?.[2]!==void 0,references:ne.filter((re)=>!!re),ifs:L?L[1]??L[2]??L[3]??"":` 	
-`}}function wR(M){let L=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(M),F=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(M),q=L??F;if(!q)return null;let ne=q[1]??q[2];return{parameter:ne==="@"||ne==="*"?ne:Number(ne),quoted:L!==null}}function PR(M,L,F,q){let ne=L.slice(F+2);if(M.parameter==="@")return M.quoted?Xl(ne):AR(ne,q);if(M.parameter==="*"){let ve=Xl(ne);if(!ve)return;let xe=ve.join(q[0]??"");return M.quoted?[xe]:Jl(xe,q)}let re=L[F+1+M.parameter];if(re&&!ai(re))return;let ue=uo(re);return M.quoted?[ue]:Jl(ue,q)}function Xl(M){return M.every(ai)?M.map(t):void 0}function AR(M,L){let F=Xl(M);if(!F)return;let q=F.map((ne)=>Jl(ne,L));return q.some((ne)=>ne===void 0)?void 0:q.flatMap((ne)=>ne??[])}function Jl(M,L){if(["*","?","[","]"].some((F)=>M.includes(F)))return;if(L==="")return M===""?[]:[M];if(L===` 	
-`)return M.trim().split(/\s+/).filter(Boolean);if(L.length!==1)return;return L===" "||L==="\t"||L===`
-`?M.trim().split(/\s+/).filter(Boolean):M.split(L).filter(Boolean)}function ai(M){if(!M)return!0;return M.provenance==="unknown"?!/[$`]/.test(t(M)):M.provenance==="literal"}function uo(M){return M?t(M):""}function Bm(M){return`'${M.replaceAll("'",`'"'"'`)}'`}function tc(M,L){return Ql(h(M,"posix"),L)}function li(M){return tc(M,new Set(Array.from(M.matchAll(Dm)).flatMap((L)=>{let F=L[1]??L[2];return F===void 0?[]:[F]})))}function Ql(M,L){if(M.status==="invalid"||M.status==="limited")return!1;let F=new Set(L);for(let q of M.nodes){if(q.kind==="group"){if(Ql(q.body,F))return!0;continue}if(q.kind!=="command")continue;if(q.nested.some((ne)=>Ql(ne,F))||$m(q.words,F))return!0;MR(q,F)}return!1}function $m(M,L){let F=M.findIndex((ue)=>Pn(ue.text)===null);if(F===-1)return!1;let q=M[F];if(!q)return!1;if(si(q,L))return!0;let ne=kt(q.text);if(ne==="source"||ne==="."){let ue=M[F+1]?.text==="--"?F+2:F+1;return Mm(M[ue],L)}if(jt.has(ne)){let ue=M.slice(F),ve=Cn(ue.map((He)=>He.text)),xe=ve.commandIndex??ve.scriptIndex;return!ve.syntaxCheck&&xe!==null&&Mm(ue[xe],L)}let re=TR(M,F,L);if(re===null)return!1;if(re===-1)return!0;return $m(M.slice(re),L)}function TR(M,L,F){let q=kt(M[L]?.text??"");if(q==="command")return IR(M,L+1);if(q==="exec")return kR(M,L+1);if(q==="env")return OR(M,L+1,F);return null}function IR(M,L){for(let F=L;F<M.length;F++){let q=M[F]?.text??"";if(q==="--")return M[F+1]?F+1:null;if(/^-[p]*[vV][pvV]*$/.test(q))return null;if(/^-p+$/.test(q))continue;return F}return null}function kR(M,L){for(let F=L;F<M.length;F++){let q=M[F]?.text??"";if(q==="--")return M[F+1]?F+1:null;if(q==="-a"){F++;continue}if(/^-a.+/.test(q)||/^-[cl]+$/.test(q))continue;return F}return null}function OR(M,L,F){for(let q=L;q<M.length;q++){let ne=M[q],re=ne?.text??"";if(re==="--")return M[q+1]?q+1:null;if(re==="-S"||re==="--split-string")return si(M[q+1],F)?-1:q+2;if(re.startsWith("-S")||re.startsWith("--split-string="))return si(ne,F)?-1:q+1;if(re==="-u"||re==="--unset"||re==="-C"||re==="--chdir"||re==="-P"){q++;continue}if(re==="-i"||re==="-0"||re==="--null"||re.startsWith("-u=")||re.startsWith("--unset=")||re.startsWith("-C")||re.startsWith("--chdir=")||re.startsWith("-P"))continue;if(re.startsWith("-"))continue;if(Pn(re))continue;return q}return null}function MR(M,L){if(!M.words.every((F)=>Pn(F.text)!==null))return;for(let F of M.words){let q=Pn(F.text);if(!q)continue;if(si(F,L))L.add(q.name)}}function si(M,L){if(!M)return!1;return M.parts.filter((F)=>F.provenance==="variable").some((F)=>Array.from(F.raw.matchAll(Dm)).some((q)=>{let ne=q[1]??q[2];return ne!==void 0&&(ER.test(ne)||L.has(ne))}))}function Mm(M,L){return!!M&&(M.parts.some((F)=>F.provenance!=="literal"&&F.provenance!=="variable")||si(M,L))}var nc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",rc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",DR="__CC_SAFETY_NET_XARGS_INPUT__",Os="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ms="rm",NR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,LR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,WR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,GR=/^(?:[0-9]+|[@*])$/;function jm(M,L){let F=M.map(t),{childStart:q,replacementToken:ne}=Lr(F),re=F.slice(q),ue=Et("xargs.shell-dynamic",rc);if(zR(re,ne,L)&&Pt(ue,L.policy))return Pt(ue,L.policy);for(let ve of Nn(re,L)){let xe=ve.tokens,He=ne!==null&&xe[0]!==re[0]&&(xe[0]?.includes(ne)??!1)?Pt(ue,L.policy):null;if(He)return He;let ft=Xm(xe,ne,ve.wrapperEnvAssignments),mt=ve.head==="rm"&&ne!==null&&Ym(xe,ne),dt=L.analyzeChild(xe,{...Mr(ve,L),dynamicInput:ft,dynamicSourceInput:mt||Km(xe,ve.head,ne,ve.wrapperEnvAssignments,ft,L.environment,L.strict?void 0:L.analyzeNested),dynamicRmInput:mt,shellDynamicMatch:ue,dynamicSourceMatch:ue,rmDynamicMatch:Et("xargs.rm-recursive-force-dynamic",nc)});if(dt)return dt;let pt=FR(xe,ne,L.policy?.rules??[],Pt(ue,L.policy));if(pt)return pt;if(ve.head==="git"){let ht=ne===null?[...xe,DR]:xe,yt=ne!==null&&(xe.some((St)=>St.includes(ne))||Array.from(ve.envAssignments.values()).some((St)=>St.includes(ne))),bt=L.analyzeChild(ht,{...Mr(ve,L),worktreeMode:ne===null||yt?!1:L.worktreeMode});if(bt)return bt}let gt=A(xe,L.policy?.rules??[]);if(gt)return gt}return null}function FR(M,L,F,q){if(F.length===0)return null;if(L===null){for(let re of F){let ue=A([...M,...re.subcommand?[re.subcommand]:[],...re.block_args],F);if(ue)return ue}return null}let ne=kt(M[0]??"");if(!F.some((re)=>kt(re.command)===ne))return null;return M.slice(1).some((re)=>re.includes(L))?q:null}function Vm(M,L,F){let q=M.indexOf(L);if(q===-1||M.indexOf(L,q+L.length)!==-1)return[];let ne=Tm(M,q,L.length,F);return ne===null?[]:[ne]}function Km(M,L,F,q,ne,re,ue){if(jt.has(L)){if(Jn(M))return!1;if(F!==null&&BR(M,F,ue))return!0;let ve=Wn(M);if(!ve){let xe=er(Ht(M));if(xe.kind==="literal")return F!==null&&xe.source.includes(F);return xe.kind==="none"&&ne}if(F!==null&&ve.includes(F)&&!qm(ve,F,ue))return!0;if(wn(ve))return!0;return $R(ve,F,q)}if(In(L))return Um(M,F,ns,Kd(L));if(_n.has(L))return Um(M,F,Dl,qf);if(L==="eval"){let ve=Is(Ht(M));if(ve.kind==="dynamic")return!0;if(F!==null)return ve.kind==="literal"&&ve.source.includes(F);return ne}if(L==="find")return UR(M,F,re);if(L==="git"){let ve=En(M);return F===null?ve.subcommand===null:(ve.subcommand?.includes(F)??!1)||ve.subcommand!==null&&lo.has(ve.subcommand.toLowerCase())&&Zm(ve.rest,F).some((xe)=>xe.includes(F))}return!1}function qm(M,L,F){if(F===void 0)return!1;let q=L.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${q}`).test(M)||/\bcase\b/.test(M))return!1;let re=M.replaceAll(L,"/");return wn(re)===null&&F(re)===null}function Um(M,L,F,q){let ne=F(M);if(L===null)return ne.optionsOpen||F([...M,Os]).sources.some((ve)=>ve.value===Os);if(ne.sources.some((ve)=>ve.value.includes(L)))return!0;let re=q.flatMap((ve)=>[ve.selector,...ve.valueForm==="attached-only"||ve.valueForm==="attached-or-separate"?[`${ve.selector}${Os}`]:[],...ve.valueForm==="equals-or-separate"?[`${ve.selector}=${Os}`]:[]]),ue=new Set(re.flatMap((ve)=>M.flatMap((xe)=>Vm(xe,L,ve))));return As(ne.sources,ue,(ve)=>F(M.map((xe)=>xe.replaceAll(L,ve))).sources)}function zR(M,L,F){if(M.length===0||(M[0]??"").toLowerCase()==="command")return!1;let q=new Set(Array.from(Nn(M,F),(re)=>re.head)),ne=L===null?[...M,Ms]:M.map((re,ue)=>ue===0?re:re.replaceAll(L,Ms));return Array.from(Nn(ne,F)).some((re)=>re.head===Ms&&!q.has(Ms))}function Ym(M,L){return Zm(M.slice(1),L).some((F)=>F.includes(L)&&(F.startsWith("-")||F.startsWith(L)))}function Zm(M,L){let F=M.findIndex((q)=>q==="--"&&!q.includes(L));return F===-1?M:M.slice(0,F)}function Xm(M,L,F){if(L===null)return!0;return M.some((q)=>q.includes(L))||Array.from(F.values()).some((q)=>q.includes(L))}function BR(M,L,F){let q=Cn(M),ne=q.commandIndex===null?"":M[q.commandIndex]??"";if(ne.includes(L)&&!qm(ne,L,F)||q.scriptIndex!==null&&(M[q.scriptIndex]??"").includes(L))return!0;return["-c","-nc","-cn",`--${L}`,L].some((ue)=>M.some((ve,xe)=>{if(xe===0||!ve.includes(L))return!1;return Vm(ve,L,ue).some((ft)=>{let mt=M.map((pt,gt)=>gt===xe?pt.replaceAll(L,ft):pt),dt=Cn(mt);if(dt.commandIndex===null&&dt.scriptIndex===null)return!1;if(q.commandIndex===null&&dt.commandIndex!==null)return!0;if(q.scriptIndex===null&&dt.scriptIndex!==null)return!0;if(dt.commandIndex!==null&&(mt[dt.commandIndex]??"").includes(ft))return!0;return dt.scriptIndex!==null&&(mt[dt.scriptIndex]??"").includes(ft)})}))}function $R(M,L,F){let q=new Set(L===null?[]:Array.from(F).filter(([,ne])=>ne.includes(L)).map(([ne])=>ne));for(let ne of M.matchAll(NR))if(Hm(ne,q))return!0;for(let ne of M.matchAll(LR))for(let re of(ne[1]??"").matchAll(WR))if(Hm(re,q))return!0;return tc(M,q)}function Hm(M,L){let F=M[1]??M[2];return F!==void 0&&(GR.test(F)||L.has(F))}function UR(M,L,F){if(L===null)return!0;let q=!1,ne=0;for(let re=1;re<M.length;re++){let ue=M[re]??"";if(!q&&!ue.startsWith("-")&&ue!=="!"&&ue!=="("){if(ue.indexOf(L)===0)return!0;continue}if(q=!0,ne>0){ne--;continue}if($n(ue)){let xe=ao(M,re);re=xe.nextIndex-1;for(let He of Nn(xe.tokens,{environment:F,cwd:void 0})){let ft=Xm(He.tokens,L,He.wrapperEnvAssignments);if(He.head==="rm"&&Ym(He.tokens,L)||Km(He.tokens,He.head,L,He.wrapperEnvAssignments,ft,F))return!0}continue}let ve=Qn(ue);if(ve>0){if(ne=ve,ue.includes(L))return!0;continue}if(ue.includes(L))return!0}return!1}function Lr(M){let L=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),F=null,q=1;while(q<M.length){let ne=M[q];if(!ne)break;if(ne==="--")return{childStart:q+1,replacementToken:F};if(!ne.startsWith("-"))return{childStart:q,replacementToken:F};if(ne==="-I"){F=M[q+1]??"{}",q+=2;continue}if(ne.startsWith("-I")&&ne.length>2){F=ne.slice(2),q++;continue}if(ne==="--replace"){F="{}",q++;continue}if(ne.startsWith("--replace=")){let re=ne.slice(10);F=re===""?"{}":re,q++;continue}if(ne==="-J"){F=M[q+1]??"{}",q+=2;continue}q+=L.has(ne)?2:1}return{childStart:M.length,replacementToken:F}}var ci="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",ui="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",jR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",VR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ns=/\{[^{}\s]*\}/g,Jm=/\{\}|\{-?\d+\}/g,KR=["e","f","source","file","-e","-f","--source","--file"],qR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],YR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),ZR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Qm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),XR=new Set(["--workdir","--wd"]),ep="__CC_SAFETY_NET_PARALLEL_SOURCE__";function An(M,L){for(let F of M){let q=L(F);if(q)return q}return null}function ip(M){return An([...M],(L)=>wn(L))}function sp(M,L){let F=M.map(t);if((L.envAssignments?.has("PARALLEL")?L.envAssignments.get("PARALLEL"):L.environment.env.get("PARALLEL"))?.trim()){let gt=fo(L);if(gt)return gt}if(F.length===2&&(F[1]==="--version"||F[1]==="--help"))return null;let ne=gp(F),{template:re,jobs:ue,runsRemotely:ve,readsCommandsFromInput:xe,unsupported:He,workdir:ft,dryRun:mt}=ne;if(He){let gt=fo(L);if(gt)return gt;let ht=ip(L.envAssignments?.values()??[]);if(ht)return ht}if(xe){let gt=r_(L);if(gt)return gt}if(ft!==void 0&&ve){let gt=fo(L);if(gt)return gt}let dt=o_(ft,L.cwd,L.environment.paths);if(dt===null){let gt=fo(L);if(gt)return gt}let pt=ve?{...L,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===L.cwd?L:{...L,cwd:dt};if(mt){if([...Nn(re,pt)].flatMap((ht)=>[...ht.envAssignments.values()]).some(sc)){let ht=fo(L);if(ht)return ht}return null}if(re.length===0){let gt=ue.map((yt)=>yt[0]??"");L.budget.charge("derivedTokens",gt.length);let ht=up(pt.envAssignments,pt.cwd,ve);return An(gt,(yt)=>L.analyzeNested(yt,ht))}return An(Nn(re,pt),(gt)=>JR(gt,ne,L,pt))}function JR(M,L,F,q){let{jobs:ne,templateHasPlaceholder:re,runsRemotely:ue,usesStdin:ve}=L,xe=M.tokens,He=[...M.envAssignments.values()];if(He.some(mp)){let yt=fo(F);if(yt)return yt}let ft=ip(He);if(ft)return ft;let mt=He.some(Ft),dt=re||mt,pt=ve&&dt,gt=up(M.envAssignments,M.wrapperCwd,ue||pt);if(jt.has(M.head)){let yt=()=>{if(!re||ne.length===0)return null;return An(ne,(Ct)=>F.analyzeChild(Ds(xe,Ct,F.budget),Mr(M,q)))};if(Jn(xe))return yt();let bt=Wn(xe);if(bt){if(pp(bt)){let xt=pr(F);if(xt)return xt;if(ne.length===0)return null;return An(ne,(Tt)=>F.analyzeNested(rp(bt,Tt,F.budget),gt))}if(Ft(bt)){if(ne.length>0)return An(ne,(Nt)=>F.analyzeNested(rp(bt,Nt,F.budget),gt));let xt=ii(bt);if(xt?.[0]&&kt(xt[0])==="rm"&&Ln(xt)){let Nt=np(F);if(Nt)return Nt}let Tt=xt?F.analyzeChild(xt,{...Mr(M,q),dynamicInput:ve,shellDynamicMatch:Et("parallel.shell-dynamic",ui),rmDynamicMatch:Et("parallel.rm-recursive-force-dynamic",ci)}):null;if(Tt)return Tt;return F.analyzeNested(bt,gt)}let Ct=!mt&&(!re||ne.length>0)?(ne.length>0?ne:[void 0]).map((xt)=>ks(Ht(xt===void 0?xe:re?xe.map((Tt)=>dp(Tt,xt)):[...xe,...xt]),bt)):[];if(Ct.some((xt)=>xt.kind==="dynamic")){let xt=pr(F);if(xt)return xt}let Rt=Ct.flatMap((xt)=>xt.kind==="literal"?[xt.source]:[]);if(Rt.length>0)return F.budget.charge("derivedTokens",Rt.length),An(Rt,(xt)=>F.analyzeNested(xt,gt));if(li(bt)){let xt=pr(F);if(xt)return xt}let wt=F.analyzeNested(bt,gt);if(wt)return wt;if(dt)return pr(F);return null}let St=er(Ht(xe));if(St.kind==="dynamic"||St.kind==="literal"&&Ft(St.source))return pr(F)??yt();if(St.kind==="literal")return yt();if(ne.length>0){let Ct=pr(F);if(Ct)return Ct;let Rt=yt();if(Rt)return Rt;if(re)return null;let wt=ne.flatMap((xt)=>xt[0]===void 0?[]:[xt[0]]);return F.budget.charge("derivedTokens",wt.length),An(wt,(xt)=>F.analyzeNested(xt,gt))}if(dt||ve)return pr(F)??yt();return null}if(M.head==="rm"&&Ln(xe)){if(re&&ne.length>0)return An(ne,(bt)=>oc(Ds(xe,bt,F.budget,Jm),M.cwd,q));if(ne.length>0)return An(ne,(bt)=>oc(op(xe,bt,F.budget),M.cwd,q));let yt=oc(xe.flatMap((bt,St)=>{if(St===0||!Ft(bt))return[bt];return bt.startsWith("-")?[bt.replace(Jm,"")]:[]}),M.cwd,q);if(yt)return yt;return np(F)}let ht=ne.length>0?ne:[void 0];return An(ht,(yt)=>{let bt=yt===void 0?xe:re?Ds(xe,yt,F.budget):op(xe,yt,F.budget),St=Et("parallel.shell-dynamic",ui),Ct=ve&&M.head==="find"?n_(bt,q):null,Rt=lp(bt,ve,F)??Ct?.customResult??null,wt=kt(M.head),xt=ve&&(wt==="rm"&&ic(bt)||wt==="xargs"&&cp(bt)||Ct?.rmOptions===!0),Tt=ve&&(xt||Ct?.executedSource===!0||Ct===null&&ap(bt,wt)),Nt=F.analyzeChild(bt,{...Mr(M,q),worktreeMode:ue||ve||dt?!1:F.worktreeMode,dynamicInput:ve||dt,dynamicRmInput:xt,dynamicSourceInput:Rt!==null||Tt,shellDynamicMatch:St,dynamicSourceMatch:St,rmDynamicMatch:Et("parallel.rm-recursive-force-dynamic",ci)});if(Tt){let Yt=Pt(St,F.policy);if(Yt)return Yt}return Nt??Rt??A(bt,F.policy?.rules??[])})}function ap(M,L){if(Ft(M[0]??""))return!0;if(L==="eval"||L==="source"||L===".")return!0;if(L==="parallel"||L==="xargs")return!0;if(jt.has(L))return t_(M);if(L==="git")return QR(M);if(L==="find")return!0;if(_n.has(L))return tp(M,KR,ri);if(In(L))return tp(M,qR,ts);return!1}function ic(M){let L=M.indexOf("--"),F=M.slice(1,L===-1?void 0:L);if(!M.some(Ft))return L===-1;return F.some((ne)=>Ft(ne)&&(ne.startsWith("-")||pp(ne)))}function QR(M){if(e_(M))return!0;let L=En(M);if(L.subcommand===null||Ft(L.subcommand))return!0;if(!lo.has(L.subcommand.toLowerCase()))return!1;let F=L.rest.indexOf("--"),q=L.rest.slice(0,F===-1?void 0:F);if(!M.some(Ft))return F===-1;return q.some(Ft)}function e_(M){for(let L=1;L<M.length;L++){let F=M[L];if(!F||F==="--"||!F.startsWith("-"))return!1;if(F==="-c"||F==="--config-env"){if(Ft(M[L+1]??""))return!0;L++;continue}if(F.startsWith("-c")&&F.length>2||F.startsWith("--config-env=")){if(Ft(F))return!0;continue}if(Ft(F))return!0}return!1}function t_(M){if(Jn(M))return!1;let L=Wn(M);if(L!==null)return Ft(L);let F=er(Ht(M));if(F.kind==="literal")return Ft(F.source);if(F.kind==="dynamic")return!0;return!M.some(Ft)}function tp(M,L,F){let q=F(M);if(q.some((ne)=>Ft(ne.value)))return!0;if(!M.some(Ft))return F([...M,ep]).some((ne)=>ne.value===ep);return As(q,L,(ne)=>F(M.map((re)=>dp(re,[ne]))))}function lp(M,L,F){let q=F.policy?.rules??[];if(!L||q.length===0)return null;let ne=q.filter((re)=>kt(re.command)===kt(M[0]??""));if(ne.length===0)return null;if(M.slice(1).some(Ft))return pr(F);return An(ne,(re)=>A([...M,...re.subcommand?[re.subcommand]:[],...re.block_args],[re]))}function n_(M,L){let F={customResult:null,executedSource:!M.some(Ft),rmOptions:!1},q=!1,ne=0,re=null,ue=()=>{if(!re?.some(Ft))return;for(let ve of Nn(re,L))F.executedSource||=ap(ve.tokens,ve.head),F.rmOptions||=ve.head==="rm"&&ic(ve.tokens)||ve.head==="xargs"&&cp(ve.tokens),F.customResult??=lp(ve.tokens,!0,L)};for(let ve of M.slice(1)){if(!q&&!ve.startsWith("-")&&ve!=="!"&&ve!=="("){F.executedSource||=Ft(ve);continue}if(q=!0,re){if(ve===";"||ve==="+"){ue(),re=null;continue}re.push(ve);continue}if(ne>0){ne--;continue}if($n(ve)){re=[],F.executedSource||=Ft(ve);continue}let xe=Qn(ve);if(xe>0){ne=xe,F.executedSource||=Ft(ve);continue}F.executedSource||=Ft(ve)}return ue(),F}function cp(M){let L=M.slice(Lr(M).childStart);return kt(L[0]??"")==="rm"&&ic(L)}function Ls(M,L){return(F)=>Pt(Et(M,L),F.policy)}var pr=Ls("parallel.shell-dynamic",ui),r_=Ls("parallel.command-stream-dynamic",jR),fo=Ls("parallel.command-stream-dynamic",VR),np=Ls("parallel.rm-recursive-force-dynamic",ci);function oc(M,L,F){return Pt(Ts(Ht(M),{environment:F.environment,cwd:L,budget:F.budget,originalCwd:F.originalCwd,strict:F.strict,paranoid:F.paranoidRm,allowTmpdirVar:F.allowTmpdirVar,tmpdirWordSplittingUnsafe:ur(F.envAssignments??new Map,F.environment),trustedTmpdirValue:Ir(F.envAssignments??new Map,F.environment),protectedGitMetadata:F.protectedGitMetadata,policy:F.policy}),F.policy)}function up(M,L,F){let q={};if(M)q.envAssignments=M;if(F)return q.effectiveCwd=null,q.worktreeMode=!1,q;if(L!==void 0)q.effectiveCwd=L;return Object.keys(q).length>0?q:void 0}function dp(M,L){return M.replace(Ns,(F)=>fp(F,L))}function Ds(M,L,F,q=Ns){return F.charge("derivedTokens",M.reduce((ne,re)=>ne+1+Math.floor(re.length/64),0)),M.map((ne)=>ne.replace(q,(re)=>{let ue=fp(re,L);return F.charge("derivedTokens",Math.max(1,Math.ceil(ue.length/64))),ue}))}function rp(M,L,F){return Ds([M],L,F)[0]??""}function op(M,L,F){return F.charge("derivedTokens",M.length+L.length),[...M,...L]}function fp(M,L){let F=/^\{(-?\d+)[^{}\s]*\}$/.exec(M)?.[1];if(F===void 0)return L[0]??"";let q=Number(F);return L[q>0?q-1:L.length+q]??""}function Ft(M){return M.search(Ns)!==-1}function mp(M){if(sc(M))return!0;for(let L of M.matchAll(Ns))if(!/^(?:\{\}|\{\d+\})$/.test(L[0]))return!0;return!1}function sc(M){let L=M.indexOf("{=");return L!==-1&&M.indexOf("=}",L+2)!==-1}function pp(M){return/^\{[^{}\s]*\}$/.test(M)}function o_(M,L,F){if(M===void 0)return;if(M==="..."||/^~|[{}$`*?[]/.test(M))return null;if(!L&&!HR(M))return null;try{return sr(L??M,M,F)}catch{return null}}function gp(M){let L=1,F=[],q=M.length,ne=-1,re=!1,ue=!1,ve,xe=!1,He=M.some((gt)=>gt==="::::"||gt==="::::+"||gt===":::+");while(L<M.length){let gt=M[L];if(gt===void 0)break;if(gt===":::"){ne=L;break}if(gt==="--"){let Ct=Wl(M,L+1);F.push(...Ct.templateTokens),q=L+1,ne=Ct.markerIndex;break}if(!gt.startsWith("-")){let Ct=Wl(M,L);F.push(...Ct.templateTokens),q=L,ne=Ct.markerIndex;break}let ht=M[L+1],yt=gt.indexOf("="),bt=yt===-1?gt:gt.slice(0,yt),St=yt===-1?void 0:gt.slice(yt+1);if(gt==="--dry-run"){xe=!0,L++;continue}if(gt==="-I"||gt.startsWith("-I")&&gt.length>2){He||=(gt==="-I"?ht:gt.slice(2))!=="{}",L+=gt==="-I"?2:1;continue}if(gt==="--replace"||gt==="-i"){He=!0,L+=2;continue}if(bt==="--replace"||gt.startsWith("-i")&&gt.length>2){let Ct=bt==="--replace"?St:gt.slice(2);He||=Ct!==""&&Ct!=="{}",L++;continue}if(gt==="-a"||ZR.has(bt)){He=!0,L+=St===void 0?2:1;continue}if(gt==="--pipe"||gt==="--pipepart"){ue=!0,L++;continue}if(bt==="--env"){He=!0,L+=St===void 0?2:1;continue}if(Qm.has(bt)||gt.startsWith("-S")&&gt.length>2){re=!0,L+=Qm.has(gt)?2:1;continue}if(XR.has(bt)){He=!0;let Ct=St??ht;if(Ct===void 0||Ct===":::"||Ct==="--"){L++;continue}ve=Ct,L+=St===void 0?2:1;continue}if(gt.startsWith("-j")&&gt.length>2&&/^\d+$/.test(gt.slice(2))){L++;continue}if(gt.startsWith("--")&&St!==void 0){L++;continue}if(YR.has(gt)){if(ht===void 0||ht===":::"||ht==="--"){He=!0,L++;continue}L+=2;continue}L+=gt==="-j"||gt==="--jobs"?2:1}He||=F.some(xe?sc:mp);let ft=[];if(ne!==-1){let gt=[];for(let ht=ne+1;ht<M.length;ht++){let yt=M[ht];if(yt===":::"){ft.push(gt),gt=[];continue}if(yt!==void 0)gt.push(yt)}ft.push(gt)}He||=ft.length>1;let mt=i_(ft),dt=F.some(Ft),pt=F.length===0&&ne===-1;return{template:F,jobs:mt,childStart:q,templateHasPlaceholder:dt,runsRemotely:re,usesStdin:ue||ne===-1,readsCommandsFromInput:pt,unsupported:He,workdir:ve,dryRun:xe}}function i_(M){if(M.length===0||M.some((F)=>F.length===0))return[];let L=[[]];for(let[F,q]of M.entries()){if(q.length===1){let re=q[0];if(re===void 0)return[];for(let ue of L)ue.push(re);if(L.length*(F+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ne=[];for(let re of L)for(let ue of q){if((ne.length+1)*(F+1)>a.derivedTokens.cap)throw new s("derivedTokens");ne.push([...re,ue])}L=ne}return L}function hp(M){return gp(M).childStart}var s_="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ws="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function lc(M){return M?.parts.some((L)=>L.provenance==="command-substitution")??!1}function ac(M){return M?.parts.some((L)=>L.provenance==="literal"&&L.raw.replace(/^["']/,"").startsWith("-"))??!1}function bp(M,L,F,q,ne=!1,re){let ve=(No(M,L)||q&&M!=="powershell"&&L[0]?.provenance==="variable")&&Qt(re,"shell.dynamic-executable",ne)?Et("shell.dynamic-executable",s_):null;return Pt(ve,re)??Cp(M,L,F,ne,re)}function Cp(M,L,F,q,ne){if(L.length<2)return null;let re=L.flatMap((ve,xe)=>lc(ve)?[xe]:[]);if(re.length===0)return null;let ue=kt(L[0]?.text??"");if(ue==="git"){let ve=te(M,L),xe=l_(ve);if(Qt(ne,"shell.dynamic-structure",q)&&re.some((mt)=>mt<=xe))return Pt(Et("shell.dynamic-structure",Ws),ne);if(Pt(Ps(ve,{environment:F}),ne))return null;let He=L[xe]?.text.toLowerCase(),ft=ve.findIndex((mt,dt)=>dt>xe&&t(mt)==="--");if(Qt(ne,"shell.dynamic-structure",q)&&He&&lo.has(He)&&re.some((mt)=>mt>xe&&(ft===-1||mt<ft)))return Pt(Et("shell.dynamic-structure",Ws),ne);return null}if(ue==="find")return Qt(ne,"shell.dynamic-structure",q)&&c_(L)?Pt(Et("shell.dynamic-structure",Ws),ne):null;if(ue==="rm"){let ve=L.findIndex((He,ft)=>ft>0&&t(He)==="--"),xe=Ln(L.map(t));return Qt(ne,"shell.dynamic-structure",q)&&re.some((He)=>(ve===-1||He<ve)&&(He<L.length-1||!xe))?Pt(Et("shell.dynamic-structure",Ws),ne):null}if(ue==="xargs")return yp(M,L.slice(Lr(L.map(t)).childStart),"xargs",F,q,ne);if(ue==="parallel")return yp(M,L.slice(hp(L.map(t))),"parallel",F,q,ne);return null}function yp(M,L,F,q,ne,re){if(L.length===0)return null;let ue=a_(L,q);if(No(M,ue)){let xe=Pt(Et(`${F}.shell-dynamic`,F==="xargs"?rc:ui),re);if(xe)return xe}let ve=Cp(M,ue,q,ne,re);if(ve)return ve;if(ue[0]?.text==="rm"&&ue.slice(1).some((xe)=>lc(xe)&&ac(xe)))return Pt(Et(`${F}.rm-recursive-force-dynamic`,F==="xargs"?nc:ci),re);return null}function a_(M,L){let F=Pr(M,L),q=F.rewritten?Ht(F.words.map(t)):F.words,ne=q[0];return ne&&t(ne)==="busybox"?q.slice(1):q}function l_(M){let L=1;while(L<M.length){let F=M[L],q=F?t(F):"";if(bn.has(q)){L+=2;continue}if(q.startsWith("-")){L++;continue}return L}return L}function c_(M){let L=!1,F=0,q=!1,ne=!1;for(let re=1;re<M.length;re++){let ue=M[re];if(!ue)continue;let ve=lc(ue);if(F>0){F--;continue}if(ne){if(ue.text===";"||ue.text==="+"){ne=!1,L=!0,q=!1;continue}if(ve&&(q||ac(ue)))return!0;q=!1;continue}if(!L&&!ue.text.startsWith("-")){if(ve&&(re>1||ac(ue)))return!0;continue}if(L=!0,ve)return!0;let xe=Qn(ue.text);if(xe>0){F=xe;continue}if($n(ue.text))ne=!0,q=!0}return!1}function cc(M,L){return M.some((F)=>{if(F.value==="-"&&(F.kind==="main-script"||F.kind==="program-file"))return!0;return!Xi(L[F.tokenIndex],F.value)})}var vp=[{heads:new Set(["rm","rmdir"]),analyze:(M)=>Ts(M.words,{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,paranoid:M.options.paranoidRm,allowTmpdirVar:M.allowTmpdirVar,tmpdirWordSplittingUnsafe:ur(M.envAssignments,M.options.environment),trustedTmpdirValue:Ir(M.envAssignments,M.options.environment),protectedGitMetadata:M.options.protectedGitMetadata,policy:M.options.policy,budget:M.options.budget})},{heads:new Set(["git"]),analyze:(M)=>Ps(M.words,uc(M))},{heads:new Set(["find"]),analyze:(M)=>om(M.words,{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,allowTmpdirVar:M.allowTmpdirVar,tmpdirWordSplittingUnsafe:ur(M.envAssignments,M.options.environment),trustedTmpdirValue:Ir(M.envAssignments,M.options.environment),protectedGitMetadata:M.options.protectedGitMetadata,budget:M.options.budget,envAssignments:M.envAssignments,policy:M.options.policy,analyzeTokens:M.analyzeChildTokens,analyzeNested:(L,F)=>Wr(M.options.analyzeNested(L,F))})},{heads:new Set(["xargs"]),analyze:(M)=>jm(M.words,{...Sp(M),analyzeChild:M.analyzeChild,analyzeNested:(L,F)=>Wr(M.options.analyzeNested(L,F))})},{heads:new Set(["parallel"]),analyze:(M)=>sp(M.words,{...Sp(M),analyzeChild:M.analyzeChild,analyzeNested:(L,F)=>Wr(M.options.analyzeNested(L,F))})}];function Sp(M){return{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,paranoidRm:M.options.paranoidRm,paranoidInterpreters:M.options.paranoidInterpreters,allowTmpdirVar:M.allowTmpdirVar,protectedGitMetadata:M.options.protectedGitMetadata,budget:M.options.budget,envAssignments:M.envAssignments,worktreeMode:M.options.worktreeMode,policy:M.options.policy}}function Wr(M){return M?{id:M.ruleId??"",reason:M.reason,intent:M.intent??"manual_only"}:null}function uc(M){return{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,dynamicArguments:M.dynamicArguments,envAssignments:M.envAssignments,shellAssignments:M.options.shellAssignments,policy:M.options.policy,worktreeMode:M.options.worktreeMode}}function Rp(M){return vp.find((L)=>L.heads.has(M))?.analyze}function po(M,L,F){let q=F.trace;if(M.length===0)return null;let ne=F.commandView?.dialect??"posix",re=(_t)=>_t.map((It)=>ne==="posix"?t(It):It.text),ue=F.child,ve=ue!==void 0&&!ue.embedded,xe=ue?.embedded===!0,He=F.effectiveCwd===null,ft=ue?ue.cwd:He?void 0:F.effectiveCwd??F.cwd,mt=ue?ue.originalCwd:He?void 0:F.cwd,dt=be(M);if(dt.envAssignments.size>0)q?.recordSegment({type:"env-strip",input:re(M),envVars:[...dt.envAssignments.keys()],output:re(dt.words)});let pt=Pr(dt.words,F.environment,ft,new Map([...F.envAssignments??[],...dt.envAssignments])),gt=pt.envSplitValues??[];if(gt.length>0){let _t=[...gt,...re(pt.words)].join(" "),It=wn(_t);if(It)return q?.recordSegment({type:"dangerous-text",token:_t,matched:!0,reason:It.reason}),an(It);if(F.strict)return mn(q);let Lt=is(gt,re(pt.words));if(Lt){F.budget.charge("derivedTokens",Lt.length);let Zt=F.analyzeNested(Lt.join(" "),{effectiveCwd:pt.cwd===void 0?F.effectiveCwd:pt.cwd,envAssignments:new Map([...F.envAssignments??[],...dt.envAssignments,...pt.envAssignments])});if(Zt)return Zt}}let ht=pt.rewritten?Ht(re(pt.words)):te(ne,pt.words),yt=re(ht),bt={...F,wrapperNormalizationBudget:F.wrapperNormalizationBudget??{iterations:0}};if(q&&dt.words.length>ht.length){let _t=re(dt.words);q.recordSegment({type:"leading-tokens-stripped",input:_t,removed:_t.slice(0,_t.length-ht.length),output:yt})}let St=new Map([...F.envAssignments??[],...dt.envAssignments,...pt.envAssignments]),Ct=yt[0];if(!Ct)return null;if(Or(Ct))throw new s("wrapperPeelIterations");let Rt=kt(Ct),wt=pt.cwd===null?void 0:pt.cwd??ft,xt=pt.cwd===null?void 0:mt,Tt=pt.cwd===void 0?F.effectiveCwd:pt.cwd,Nt=ue?ue.allowTmpdirVar:!Jo(St,F.environment),Yt=bp(ne,pt.words,F.environment,L===0,F.strict,F.policy);if(Yt)return q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Yt.reason}),an(Yt);let Vn=vs(yt,F.policy);if(Vn){for(let _t of[Vn.childIndex,...Vn.alternativeChildIndices]){Ep(bt.wrapperNormalizationBudget);let It=ht.slice(_t);q?.recordSegment({type:"transparent-wrapper",wrapper:Vn.wrapper,output:re(It)});let Lt=po(It,L,{...bt,effectiveCwd:Tt,envAssignments:St});if(Lt)return Lt}return null}let pn=xe?void 0:Rt==="eval"?Is(ht):Rt==="trap"&&!ve?Wm(ht):void 0;if(ve&&ue&&Rt==="eval"){if(pn?.kind==="dynamic")return mo(ue,F.policy);if(pn?.kind==="literal"){let _t=F.analyzeNested(pn.source,{effectiveCwd:Tt,envAssignments:St});if(_t)return _t}return go(ue,F.policy)}if(pn?.kind==="dynamic"&&(F.strict||!F.commandView||!ec(F.commandView)))return mn(q);if(pn?.kind==="literal"){q?.recordSegment({type:"recurse",reason:Rt==="eval"?"shell-eval":"shell-trap",innerCommand:pn.source,depth:L+1});let _t=F.analyzeNested(pn.source,{effectiveCwd:Tt,envAssignments:St,functionDefinitions:F.functionDefinitions});if(_t)return _t}if(ve?jt.has(Rt):wp(Ct,Rt)){if(Jn(yt))return null;if(ve&&ue){let _t=Wn(yt);if(_t){if(ue.dynamicSourceInput??ue.dynamicInput){let Lt=mo(ue,F.policy);if(Lt)return Lt}if(li(_t)){let Lt=mo(ue,F.policy);if(Lt)return Lt}return F.analyzeNested(_t,{effectiveCwd:Tt,envAssignments:St})}let It=er(ht);if(It.kind==="dynamic")return mo(ue,F.policy);if(It.kind==="literal")return ue.dynamicSourceInput?mo(ue,F.policy):null;return ue.dynamicSourceInput??ue.dynamicInput?mo(ue,F.policy):null}if(xe){let _t=Wn(yt),It=_t?F.analyzeNested(_t,{effectiveCwd:Tt,envAssignments:St}):er(ht).kind==="dynamic"?mn(q):null;if(It)return It}if(ue===void 0){let _t=m_(yt,St,Tt,F,q,L);if(_t)return _t;let It=Wn(yt);if(It){let $r=ks(ht,It);if($r.kind==="dynamic")return mn(q);let Zs=$r.kind==="literal"?$r.source:Gm(ht,It),Nc=p_(Zs);q?.recordSegment({type:"shell-wrapper",wrapper:Rt,innerCommand:Nc}),q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Nc,depth:L+1});let Lc=F.analyzeNested(Zs,{effectiveCwd:Tt,envAssignments:St});if(Lc)return Lc;return li(Zs)?mn(q):null}let Lt=er(ht,F.strict?void 0:F.shellAssignments);if(Lt.kind==="dynamic")return mn(q);if(Lt.kind==="literal")return Gs(Lt.source,Tt,St,F,q,L);let Zt=Fm(ht,F.commandView?.redirections??[],F.hasPipelineInput??!1,F.literalShellInput);if(Zt.kind==="dynamic")return mn(q);if(Zt.kind==="literal")return q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Zt.source,depth:L+1}),F.analyzeNested(Zt.source,{effectiveCwd:Tt,envAssignments:St})}}if(!ue&&(Rt==="source"||Rt===".")){let _t=yt[1]==="-p"?2:null;if(_t!==null){let $r=F.commandView?ht[_t]:void 0;if(!$r)return null;if($r.provenance!=="literal")return mn(q)}let It=_t===null?1:3,Lt=yt[It]==="--"?It+1:It,Zt=F.commandView?ht[Lt]:void 0;if(!Zt)return null;if(Zt.provenance==="literal")return Gs(Zt.text,Tt,St,F,q,L);if(F.strict||!F.commandView||!ec(F.commandView))return mn(q)}if(_n.has(Rt)&&!xe){if(!ue&&F.strict&&cc(ri(yt),ht))return mn(q);let _t=Yf(yt,(Lt)=>Wr(F.analyzeNested(Lt,{effectiveCwd:Tt,envAssignments:St}))),It=Pt(_t,F.policy);if(It)return q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:It.reason}),an(It)}if(In(Rt)&&!xe){if(!ue&&F.strict&&cc(ts(yt),ht))return mn(q);let _t=Vd(yt);if(ve&&ue)return d_(Rt,_t,Tt,St,F,ue);if(_t){let It=Qt(F.policy,"interpreter.one-liner-paranoid",!!F.paranoidInterpreters);if(q?.recordSegment({type:"interpreter",interpreter:Rt,codeArg:_t,paranoidBlocked:It}),It){let Zt=Pt(Et("interpreter.one-liner-paranoid",Uo),F.policy);if(Zt)return an(Zt)}if(fl(Rt,_t))return null;q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:_t,depth:L+1});let Lt=F.analyzeNested(_t,{effectiveCwd:Tt,envAssignments:St});if(Lt&&!_p(Lt,_t))return Lt;if(Ho(_t,void 0,!F.strict)){let Zt=Pt(Et("interpreter.dangerous-command",to),F.policy);if(Zt)return q?.recordSegment({type:"dangerous-text",token:_t,matched:!0,reason:to}),an(Zt)}q=void 0}}if(Rt==="busybox"&&yt.length>1)return Ep(bt.wrapperNormalizationBudget),q?.recordSegment({type:"busybox",subcommand:yt[1]??"unknown"}),q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:yt.slice(1).join(" "),depth:L+1}),po(ht.slice(1),L,{...bt,effectiveCwd:Tt,envAssignments:St});let Gt=ue?null:Pt(em(Rt,yt),F.policy);if(Gt)return q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Gt.reason}),an(Gt);let Mt=q===bt.trace?bt:{...bt,trace:q},rn={words:ht,head:Rt,cwd:wt,originalCwd:xt,envAssignments:St,allowTmpdirVar:Nt,dynamicArguments:pt.words.some((_t)=>_t.provenance==="command-substitution"),depth:L,effectiveCwd:Tt,options:Mt,analyzeChildTokens:(_t,It)=>ve&&ue?fc(_t,L,Mt,{...ue,cwd:It??void 0,effectiveCwd:It??void 0}):Wr(po(Ht(_t),L+1,{...Mt,child:void 0,commandView:void 0,effectiveCwd:It,envAssignments:St}))??A(_t,Mt.policy.rules),analyzeChild:(_t,It)=>fc(_t,L,Mt,It)},Kt=ue&&(Rt==="xargs"||Rt==="parallel")?void 0:Rp(Rt);if(Rt==="rm"||Rt==="xargs"||Rt==="parallel")q?.recordSegment({type:"tmpdir-check",tmpdirValue:St.has("TMPDIR")||F.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Nt});let qt=q&&Rt==="git"?Am(rn.words,uc(rn)):void 0,gn=xp(qt?qt.match:Kt?.(rn)??null,F.policy);if(q)g_(rn,gn,qt?.relaxation??null);if(gn)return an(gn);if(ve&&ue&&(Rt==="rm"||Rt==="rmdir")){if(!(Rt==="rm"&&(Ln(yt)||ue.dynamicRmInput)))return null;return(ue.dynamicRmInput?go(ue,F.policy):null)??f_(ue,F.policy)}let br=!ue&&Kt===void 0&&!Ai.has(Rt),Co=q&&br?[]:void 0;if(br)for(let _t=1;_t<yt.length;_t++){let It=yt[_t];if(!It)continue;Co?.push(It);let Lt=xp(u_(yt,_t,L,Mt,wt,xt,Tt,St),F.policy);if(Lt)return q?.recordSegment({type:"fallback-scan",tokensScanned:Co??[],embeddedCommandFound:kt(It)}),an(Lt)}if(q?.recordSegment({type:"fallback-scan",tokensScanned:Co??[]}),xe&&ue&&!ue.wrappedByTransparent)return null;let xn=A(yt,F.policy.rules);if(q?.recordSegment({type:"custom-rules-check",rulesChecked:F.policy.rules.length>0,matched:!!xn,reason:xn?.reason}),xn)return an(xn);return ve&&ue?go(ue,F.policy):null}function fc(M,L,F,q){return Wr(po(Ht(M),L+1,{...F,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:q.originalCwd,effectiveCwd:q.effectiveCwd,envAssignments:q.envAssignments,worktreeMode:q.dynamicInput?!1:q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:q}))}function u_(M,L,F,q,ne,re,ue,ve){for(let xe of Nn(M.slice(L),{environment:q.environment,cwd:ne,envAssignments:ve,policy:q.policy})){let He=xe.tokens[0];if(!He)continue;let ft=kt(He);if(wp(He,ft)||Rp(ft)!==void 0&&ft!=="xargs"&&ft!=="parallel"||xe.wrappedByTransparent&&q.policy.rules.length>0)q.budget.charge("derivedTokens",M.length-L);let dt=fc(xe.tokens,F,q,{embedded:!0,cwd:xe.cwd,originalCwd:xe.wrapperCwd===null?void 0:re,effectiveCwd:xe.wrapperCwd===void 0?ue:xe.wrapperCwd,envAssignments:xe.envAssignments,allowTmpdirVar:!Jo(xe.envAssignments,q.environment),worktreeMode:!1,wrappedByTransparent:xe.wrappedByTransparent});if(dt)return dt}return null}function d_(M,L,F,q,ne,re){if(!L)return go(re,ne.policy);if(Qt(ne.policy,"interpreter.one-liner-paranoid",!!ne.paranoidInterpreters)){let ve=Pt(Et("interpreter.one-liner-paranoid",Uo),ne.policy);if(ve)return an(ve)}if(fl(M,L))return go(re,ne.policy);let ue=ne.analyzeNested(L,{effectiveCwd:F,envAssignments:q});if(ue&&!_p(ue,L))return ue;if(Ho(L,void 0,!ne.strict)){let ve=Pt(Et("interpreter.dangerous-command",to),ne.policy);if(ve)return an(ve)}return go(re,ne.policy)}function _p(M,L){let F=M.ruleId==="raw-text.dangerous-command",q=(M.reason.startsWith(bs)||M.reason===so)&&!Ti(L);return F||q}function mo(M,L){let F=M.shellDynamicMatch?Pt(M.shellDynamicMatch,L):null;return F?an(F):null}function go(M,L){let F=M.dynamicSourceInput&&M.dynamicSourceMatch?Pt(M.dynamicSourceMatch,L):null;return F?an(F):null}function f_(M,L){let F=M.dynamicInput&&M.rmDynamicMatch?Pt(M.rmDynamicMatch,L):null;return F?an(F):null}function m_(M,L,F,q,ne,re){let ue=rm(M);if(ue.argvSource?.kind==="absent")return mn(ne);if(ue.argvSourceApplies&&ue.argvSource){let xe=Gs(ue.argvSource.value,F,L,q,ne,re,!0);if(xe)return xe}if(!ue.envSourceApplies||!ue.envName)return null;let ve=L.get(ue.envName);if(!ve)return null;return Gs(ve,F,L,q,ne,re,!0)}function Gs(M,L,F,q,ne,re,ue=!1){if(ue&&/[$`*?[\]]/.test(M))return mn(ne);let ve=$o(M,L,q.environment.paths,q.budget),xe=ve?q.literalHeredocFiles?.get(ve):void 0;if(xe===void 0)return ue?mn(ne):null;return q.budget.charge("derivedTokens",1),ne?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:xe,depth:re+1}),q.analyzeNested(xe,{effectiveCwd:L,envAssignments:F})}function p_(M){let L=M[0];return M.length>=2&&(L==='"'||L==="'")&&M.at(-1)===L?M.slice(1,-1):M}function g_(M,L,F){let q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[M.head];if(!q)return;if(M.options.trace?.recordSegment({type:"rule-check",rule:q,matched:!!L||!!F,reason:L?.reason??F?.originalReason}),F)M.options.trace?.recordSegment({type:F.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:F.originalReason,gitCwd:F.gitCwd})}function Ep(M){if(M.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");M.iterations++}function an(M){return{reason:M.reason,ruleId:M.id||void 0,intent:M.intent}}function mn(M){return M?.recordSegment({type:"error",message:ti}),an(h_())}function h_(){return{id:"",reason:ti,intent:"stop_and_explain"}}function wp(M,L){return jt.has(L)||M==="$SHELL"||M==="${SHELL}"||jt.has(At(L))}function xp(M,L){return M?.id.startsWith("custom.")||M?.id==="raw-text.dangerous-command"?M:Pt(M,L)}var y_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,b_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function C_(M,L){let F=Tp(M,L);if(F.length===0)return!1;let q=F[Ap(F)];if(q==="cd"||q==="pushd"||q==="popd")return!0;return y_.test(M.join(" "))}function Pp(M,L,F,q,ne){if(M.dialect==="powershell"){let Ct=S_(M.words,ne);if(Ct.kind==="none")return;if(!L||Ct.kind==="unknown")return null;return dc(R_(Ct.target),L,F.paths)}let re=M.words.map(t),ue=re.some((Ct)=>/^CDPATH\+?=/.test(Ct));if(!C_(re,F))return ue?null:void 0;if(!L)return null;let ve=Tp(re,F,L),xe=Ap(ve);if(xe===-1||ve[xe]!=="cd")return null;let He=ve.slice(xe+1),ft=He.findIndex((Ct)=>Ct.length<=1||!Ct.startsWith("-")||Ct==="--");if((ft===-1?He:He.slice(0,ft)).some((Ct)=>!/^-[LP]+$/.test(Ct)))return null;let dt=ft===-1?[]:He.slice(ft),pt=dt[0]==="--"?dt.slice(1):dt;if(pt.length>1)return null;let gt=pt[0],ht=q.get("HOME")||F.home;if(gt===void 0)return dc(ht,L,F.paths);let yt=M.words.find((Ct)=>Ct.provenance==="variable"&&Ct.text===gt),bt=M.words.find((Ct)=>Ct.text===gt&&/^~(?:\/|$)/.test(Ct.raw)),St=yt?Un(yt,new Map([...q,["HOME",ht]])):bt?`${ht}${gt.slice(1)}`:gt;if(St===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(St)&&(ue||F.env.has("CDPATH")))return null;return dc(St,L,F.paths)}function dc(M,L,F){if(!M||M==="-"||M.startsWith("~")||M.includes("$")||M.includes("`"))return null;try{let q=sr(L,M,F);return F.isDirectory(q)?q:null}catch{return null}}function S_(M,L){let F=v_(M[0])?1:0,q=M[F];if(!E_(q,F===1))return{kind:"none"};let ne=q.text.toLowerCase(),re=ne.split(/[\\/]/).pop()??ne;if(!b_.has(re))return{kind:"none"};if(ne!==re||re==="pop-location"||re==="popd")return{kind:"unknown"};return x_(M.slice(F+1),L)}function v_(M){return M?.provenance==="literal"&&!M.quoted&&M.raw===M.text&&(M.text==="&"||M.text===".")}function E_(M,L){return M?.provenance==="literal"&&(L||!M.quoted&&M.raw===M.text)}function x_(M,L){let F;for(let q of M){if(q.provenance!=="literal"||F!==void 0)return{kind:"unknown"};F=q.text}if(F!==void 0)return{kind:"target",target:F};return L===void 0?{kind:"unknown"}:{kind:"target",target:L}}function R_(M){return M.includes("::")?void 0:M.replaceAll("\\","/")}function Ap(M){let L=0;if(M[0]==="builtin"&&M.length>1)L=1;if(M[L]!=="time")return L;let F=L+1;while(M[F]?.startsWith("-"))F++;return F}function Tp(M,L,F){let q=__(M);return ar([...q],L,F)}function __(M){let L=0;while(L<M.length){let F=M[L];if(F!=="{"&&F!=="("&&F!=="$(")break;L++}return M.slice(L)}var O_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Gr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function bc(M,L,F,q){if(L>=a.recursionDepth.cap)return F.trace?.recordSegment({type:"error",message:zn}),{reason:zn,segment:M,intent:"stop_and_explain"};let ne=q??F.factStore?.getCommandProgram(M,F.shell??"auto")??h(M,F.shell);if(ne.status==="limited")return F.trace?.recordSegment({type:"error",message:zn}),{reason:zn,segment:M,intent:"stop_and_explain"};if(ne.status==="invalid"){let He=ne.issues.find((ft)=>ft.code.includes("heredoc"));if(He){if(!F.strict)return yc(M,F);let ft=`${bs}: ${He.message}`;return F.trace?.recordGlobal({type:"error",message:ft}),{reason:ft,segment:M,intent:"stop_and_explain"}}return Np(M,F),{reason:so,segment:M,intent:"stop_and_explain"}}if(F.strict&&ne.status==="partial")return Np(M,F),{reason:so,segment:M,intent:"stop_and_explain"};if(ne.issues.some((He)=>He.code.includes("quote")))return yc(M,F);let ue=F.cwd,ve=F.effectiveCwd!==void 0?F.effectiveCwd:F.cwd,xe=hm(F.environment.env,F.envAssignments);return Bs(ne,L,{...F,rootProgram:ne},ue,[{effectiveCwd:ve,shellGitContextState:xe,literalHeredocFiles:new Map(F.literalHeredocFiles),functionDefinitions:new Map(F.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Bs(M,L,F,q,ne){let re=[...ne],ue,ve,xe;for(let[He,ft]of M.nodes.entries()){if(ft.kind==="connector"){ve=ft.operator;continue}let mt=M.nodes[He+1],dt=mt?.kind==="connector"?mt.operator:void 0,pt=M_(M,He,ft,ve,dt),ht=ve==="&&"||ve==="||"?ue:void 0,yt=ve==="&&"?ht?.success??re:ve==="||"?ht?.failure??re:re,bt=ve==="||"?ht?.success??[]:[],St=ve==="&&"?ht?.failure??[]:[],Ct={connector:ve,skippedSuccessStates:bt,skippedFailureStates:St};if(gr(dt)&&!gr(ve))xe=Ct;let Rt=gr(dt)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:gr(ve)?xe??Ct:Ct,wt=Fr(Rt.connector)||Fr(dt);if(ft.kind==="function"){let Gt=yt.flatMap((rn)=>{let Kt=zr(rn);return Kt.functionDefinitions.set(ft.name,ft.body),mc(rn,[Kt],pt,dt==="&",Fr(dt))}),Mt=pc(Gt,[],Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,dt);re=Mt.states,ue=Mt.conditionalStates,ve=void 0;continue}if(ft.kind==="group"){let Gt=[],Mt=[];for(let Kt of yt){let qt=Bs(ft.body,L,F,q,[zr(Kt)]);if(qt.result)return qt;if(Gt.push(...mc(Kt,qt.states,pt,dt==="&",Fr(dt))),wt)Mt.push(Kt,...pt?qt.states.map((gn)=>Fs(Kt,gn)):qt.states)}let rn=pc(Gt,Mt,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,dt);re=rn.states,ue=rn.conditionalStates,ve=void 0;continue}if(ft.kind!=="command")continue;let xt=nw(M.nodes[He-1]),Tt=F.trace?.flattenNested?F.trace.currentSegmentIndex:F.trace?.allocateSegment(),Nt=M.nodes[He-2],Yt=gr(ve)&&Nt?.kind==="command"?Lm(Nt)??N_(Nt):void 0,Vn=[],pn=[];for(let Gt of yt){let Mt=L_(ft,L,F,q,[zr(Gt)]);if(Mt.result)return{result:Mt.result,states:re};let rn=M.dialect==="powershell"?Mt.states:Mt.states.map((Kt)=>Fs(Gt,Kt));for(let Kt of rn){let qt=zr(Kt),gn=F_(ft,L,F.trace?{...F,trace:Lp(F.trace,Tt)}:F,q,qt,gr(ve),Yt);if(gn)return{result:gn,states:re};let bo=cw(ft,qt.functionDefinitions);if(bo)F.budget.charge("derivedTokens",$s(bo));let br=bo?L+1>=a.recursionDepth.cap?gc(ft.displayText,F,[qt]):Bs(bo,L+1,F,q,[qt]):{result:null,states:aw(ft,qt).flatMap((xn)=>rw(ft,Kt,xn,xt))};if(br.result)return br;Vn.push(...mc(Gt,br.states,pt,dt==="&",Fr(dt)));let Co=typeof qt.effectiveCwd==="string"&&qt.effectiveCwd!==Kt.effectiveCwd&&ft.redirections.every((xn)=>["<",">",">>",">|"].includes(xn.operator)&&xn.target?.text==="/dev/null");if(wt&&(xt||!Co))pn.push(Gt),pn.push(...br.states.map((xn)=>pt?Fs(Gt,xn):xn))}}let yr=pc(Vn,pn,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,dt);re=yr.states,ue=yr.conditionalStates,ve=void 0}return{result:null,states:re}}function M_(M,L,F,q,ne){if(F.kind==="group"&&F.style==="subshell")return!0;if(M.dialect==="posix"&&(gr(q)||gr(ne)))return!0;if(ne==="&")return!0;return M.dialect==="powershell"&&F.kind==="group"&&F.style==="brace"&&D_(M,L)}function mc(M,L,F,q,ne){let re=F?L.map((ve)=>Fs(M,ve)):[...L],ue=ne?re.flatMap((ve)=>ho(M.literalHeredocFiles,ve.literalHeredocFiles)?[ve]:[{...ve,literalHeredocFiles:new Map(M.literalHeredocFiles)},ve]):re;return q?[M,...ue]:ue}function Fs(M,L){return{...M,literalHeredocFiles:new Map(L.literalHeredocFiles),createdDirectories:new Set(L.createdDirectories)}}function D_(M,L){let F=M.nodes.slice(0,L).reverse().find((ne)=>ne.kind==="command"||ne.kind==="connector");if(!F||F.kind!=="command")return!0;let q=F.words[0]?.text.toLowerCase();if(q==="&"||q===".")return!1;if(q==="write-output"||q==="function"||q==="start-job")return!0;if(W_(F))return!0;return F.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function gr(M){return M==="|"||M==="|&"}function N_(M){if(M?.dialect!=="powershell")return;if(M.words.length===1&&M.words[0]?.quoted&&M.words[0].provenance==="literal")return M.words[0].text;if(M.words[0]?.text.toLowerCase()==="write-output"&&M.words.length===2&&M.words[1]?.provenance==="literal")return M.words[1].text;return}function Fr(M){return M==="&&"||M==="||"}function pc(M,L,F,q,ne,re){let ue={success:zs([...F,...M]),failure:zs([...q,...L])},ve=Fr(re)?ue:void 0;return{states:Fr(ne)||ve?zs([...ue.success,...ue.failure]):ue.success,conditionalStates:ve}}function Lp(M,L,F=M.flattenNested){return{currentSegmentIndex:L,flattenNested:F,allocateSegment:M.allocateSegment,getNextSegmentIndex:M.getNextSegmentIndex,recordGlobal:M.recordGlobal,recordSegment:(q,ne=L)=>M.recordSegment(q,ne)}}function L_(M,L,F,q,ne){let re=M.nested.map((ue)=>({program:ue,depth:L}));if(M.dialect==="powershell"){let ue=G_(M);if(ue){if(L+1>=a.recursionDepth.cap)return gc(ue,F,ne);let ve=h(ue,"powershell");if(ve.status==="limited")return gc(ue,F,ne);if(ve.status!=="complete")return Ip(re,F,q,ne);F.budget.charge("derivedTokens",$s(ve)),re.push({program:ve,depth:L+1})}}return Ip(re,F,q,ne)}function W_(M){let L=M.words[0];return L?.provenance==="variable"&&M.words.at(-1)?.text==="="?L.text.toLowerCase():void 0}function Ip(M,L,F,q){let ne=[...q];for(let re of M){let ue=[];for(let ve of ne){let xe=Bs(re.program,re.depth,L,F,[zr(ve)]);if(xe.result)return xe;ue.push(...xe.states)}ne=zs(ue)}return{result:null,states:ne}}function G_(M){let L=M.words[0]?.provenance==="literal"&&!M.words[0].quoted&&M.words[0].raw===M.words[0].text&&(M.words[0].text==="&"||M.words[0].text==="."),F=L?1:0,q=M.words[F];if(q?.provenance!=="literal"||!L&&(q.quoted||q.raw!==q.text)||!["iex","invoke-expression"].includes(q.text.toLowerCase()))return;let ne=M.words.slice(F+1),re=ne[0]&&!ne[0].quoted&&ne[0].raw===ne[0].text&&["-c","-command"].includes(ne[0].text.toLowerCase())?1:0,ue=ne[re];return ne.length===re+1&&ue?.quoted&&ue.provenance==="literal"?ue.text:void 0}function $s(M){return M.nodes.reduce((L,F)=>L+(F.kind==="command"?F.words.length+F.nested.reduce((q,ne)=>q+$s(ne),0):F.kind==="group"||F.kind==="function"?$s(F.body):0),0)}function gc(M,L,F){return L.trace?.recordSegment({type:"error",message:zn}),{result:{reason:zn,segment:M,intent:"stop_and_explain"},states:[...F]}}function F_(M,L,F,q,ne,re,ue){let ve={...F,environment:{...F.environment,env:ne.shellGitContextState.env,paths:H_(F.environment.paths,ne.createdDirectories,F.budget)}},xe=Z_(M,!ve.strict);if(xe&&ve.strict)return ve.trace?.recordSegment({type:"error",message:xe}),{reason:xe,segment:M.source,intent:"stop_and_explain"};Wp(M,ne,"before-consumer",ve.environment.paths,ve.budget);let He=te(M.dialect,M.words),ft=He.map(t),mt=M.displayText,dt=pm(He,ne.shellGitContextState),pt=bm(dt,ne.shellGitContextState);if(M.dialect==="powershell"){let yt=Pt(Bf(M,re,dw(ve,ne.effectiveCwd)),ve.policy);if(ve.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!yt,reason:yt?.reason}),yt)return uw(mt,yt)}if(ft.length===1&&ft[0]?.includes(" ")&&!No(M.dialect,M.words)){let yt=Pt(wn(ft[0]),ve.policy),bt=yt!==null&&!ve.strict&&$d(M,ve.rootProgram);if(yt&&!bt)return ve.trace?.recordSegment({type:"dangerous-text",token:ft[0],matched:!0,reason:yt.reason}),{reason:yt.reason,segment:mt,ruleId:yt.id,intent:yt.intent};ve.trace?.recordSegment({type:"dangerous-text",token:ft[0],matched:!1});let St=kp(M,xe,ne,pt,ue,ve);if(St)return St;return ql(dt,ne.shellGitContextState),null}let gt=po(M.words,L,{...ve,commandView:M,cwd:q,effectiveCwd:ne.effectiveCwd,envAssignments:pt,shellAssignments:ne.shellGitContextState.shellAssignments,literalHeredocFiles:ne.literalHeredocFiles,functionDefinitions:ne.functionDefinitions,hasPipelineInput:re,literalShellInput:ue,analyzeNested:(yt,bt)=>{let St=bt&&Object.hasOwn(bt,"effectiveCwd")?bt.effectiveCwd:ne.effectiveCwd,Ct=bc(yt,L+1,{...ve,effectiveCwd:St,envAssignments:bt?.envAssignments??pt,literalHeredocFiles:ne.literalHeredocFiles,functionDefinitions:bt?.functionDefinitions,worktreeMode:bt?.worktreeMode??ve.worktreeMode,trace:ve.trace?Lp(ve.trace,ve.trace.currentSegmentIndex,!0):void 0});return Ct?{reason:Ct.reason,ruleId:Ct.ruleId,intent:Ct.intent}:null}});if(gt)return{...gt,segment:mt};let ht=kp(M,xe,ne,pt,ue,ve);if(ht)return ht;return ql(dt,ne.shellGitContextState),null}function kp(M,L,F,q,ne,re){let ue=X_(M,L,F,q??new Map,re);if(ue)return ue;return Wp(M,F,"after-consumer",re.environment.paths,re.budget),F.literalHeredocFiles.clear(),$_(M,L,F,re.environment.paths,re.budget),j_(M,F,re.environment.paths,re.budget),ew(M,F,ne,re.environment,re.trace),null}var z_=new Set([">>","<>"]);function Wp(M,L,F,q,ne){for(let ue of M.redirections){if(!(F==="before-consumer"?B_(ue):z_.has(ue.operator)))continue;Op(ue.target,L,q,ne)}if(F!=="before-consumer"||!nn(M.words[0],"tee"))return;let re=Fp(M.words.slice(1));if(!re)return;for(let ue of re.operands)Op(ue,L,q,ne)}function B_(M){if(M.operator===">"||M.operator===">|")return!0;return M.operator===">&"&&M.fd===void 0&&M.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(M.target.text)}function Op(M,L,F,q){let ne=M?.provenance==="literal"?$o(M.text,L.effectiveCwd,F,q):void 0;if(!ne)return;L.literalHeredocFiles.delete(ne)}function $_(M,L,F,q,ne){if(L)return;let re=M.redirections.find((ue)=>ue.operator==="<<"||ue.operator==="<<-")?.heredoc;if(!re)return;for(let ue of U_(M,F.shellGitContextState.shellAssignments)){let ve=$o(ue,F.effectiveCwd,q,ne);if(!ve||!jd(ve))continue;if(!F.literalHeredocFiles.has(ve)&&F.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");F.literalHeredocFiles.set(ve,re.body)}}function U_(M,L){let F=hc(q_(M.redirections)?.target,L),q=F===void 0?[]:[F];if(nn(M.words[0],"cat"))return K_(M.words)?q:[];if(!nn(M.words[0],"tee"))return[];let ne=Fp(M.words.slice(1),L);if(!ne||ne.append||ne.hasUnsupportedOptions)return[];let re=ne.operands.map((ue)=>hc(ue,L));if(!re.every((ue)=>ue!==void 0))return[];return[...re,...q]}function hc(M,L){if(Y_(M))return M.text;return(M&&Un(M,L))??void 0}function H_(M,L,F){if(L.size===0)return M;let q=(ne)=>{let re=Dt(ne,M,F);return[...L].some((ue)=>ue===re||ue.startsWith(`${re}${k_}`))};return{realpath:(ne)=>M.realpath(ne)??(q(ne)?Dt(ne,M,F):null),entryKind:(ne)=>{let re=M.entryKind(ne);return re==="missing"&&q(ne)?"present":re},isDirectory:(ne)=>M.isDirectory(ne)||q(ne)}}function j_(M,L,F,q){if(L.shellGitContextState.bodyDepth>0||!nn(M.words[0],"mkdir"))return;let ne=M.words.slice(1).map((He)=>hc(He,L.shellGitContextState.shellAssignments));if(!ne.every((He)=>He!==void 0))return;let re=ne.findIndex((He)=>He==="--"||He==="-"||!He.startsWith("-")),ue=ne.slice(0,re);if(re===-1||!ue.every((He)=>/^(?:-[pv]+|--parents|--verbose)$/.test(He)))return;let ve=ue.some((He)=>He==="--parents"||/^-v*p/.test(He)),xe=L.effectiveCwd;for(let He of ne.slice(ne[re]==="--"?re+1:re)){if(He.split(/[\\/]/).includes("..")||!P_(He)&&!xe)continue;let ft=Dt(I_(xe??"",He),F,q);if(ve?V_(ft,F):F.isDirectory(w_(ft))&&Gp(ft,F))L.createdDirectories.add(ft)}}function V_(M,L){let F=T_(M).root,q=M.slice(F.length).split(/[\\/]+/).filter(Boolean),ne=(ue)=>A_(F,...q.slice(0,ue+1)),re=q.findIndex((ue,ve)=>!L.isDirectory(ne(ve)));return re===-1||Gp(ne(re),L)}function Gp(M,L){try{return L.entryKind(M)==="missing"}catch{return!1}}function K_(M){let L=!1;for(let F of M.slice(1)){if(L||F.provenance!=="literal")return!1;if(F.text==="--"){L=!0;continue}if(!/^-u+$/.test(F.text))return!1}return!0}function q_(M){let L=M.findLast((F)=>(F.fd??([">",">|",">>",">&"].includes(F.operator)?1:0))===1);return L?.operator===">"||L?.operator===">|"?L:void 0}function Fp(M,L=new Map){let F=[],q=!0,ne=!1,re=!1;for(let ue of M){if(ue.provenance!=="literal"&&Un(ue,L)===null)return;if(q&&nn(ue,"--")){q=!1;continue}if(q&&!ue.quoted&&ue.raw===ue.text&&/^-[^-]/.test(ue.text)){ne||=ue.text.slice(1).includes("a"),re||=Array.from(ue.text.slice(1)).some((ve)=>ve!=="a"&&ve!=="i");continue}if(q&&!ue.quoted&&ue.raw===ue.text&&ue.text.startsWith("--")){ne||=ue.text==="--append",re||=ue.text!=="--append"&&ue.text!=="--ignore-interrupts";continue}F.push(ue)}return{operands:F,append:ne,hasUnsupportedOptions:re}}function Y_(M){if(!M||M.provenance!=="literal"||M.text.length===0)return!1;if(M.quoted||M.raw!==M.text)return!0;return!M.raw.startsWith("~")&&!/[{}]/.test(M.raw)}function nn(M,L){return M?.text===L&&M.raw===L&&M.provenance==="literal"&&!M.quoted}function Cc(M){return M.quotedDelimiter||!/[$`\\]/.test(M.body)}function Z_(M,L){let F=M.redirections.filter((xe)=>xe.operator==="<<"||xe.operator==="<<-");if(F.length===0)return;if(F.length!==1)return Gr;let q=F[0];if(!q?.heredoc)return Gr;let ne=/\$\(|`/.test(q.heredoc.body);if(!Cc(q.heredoc)&&(!L||ne))return O_;if(q.fd!==void 0&&q.fd!==0)return Gr;if(M.redirections.some((xe)=>xe!==q&&["<","<<","<<-","<<<","<&","<>"].includes(xe.operator)))return Gr;let re=M.redirections.some((xe)=>xe!==q&&Mp(xe.target));if(nn(M.words[0],"cat"))return re?Gr:void 0;if(nn(M.words[0],"tee"))return re||M.words.slice(1).some(Mp)?Gr:void 0;let ue=M.words[0],ve=M.words[1];if(nn(ue,"git")&&(nn(ve,"apply")||nn(ve,"commit")))return;if(nn(ue,"gh")&&(nn(ve,"pr")||nn(ve,"issue"))&&nn(M.words[2],"create"))return;return Gr}function Mp(M){return M?.parts.some((L)=>L.provenance==="command-substitution"&&L.raw.startsWith(">("))??!1}function X_(M,L,F,q,ne){if(!L)return null;let re=M.redirections.filter((He)=>He.operator==="<<"||He.operator==="<<-"),ue=re.flatMap((He)=>He.heredoc?[He.heredoc.body]:[]);if(Q_(M,re,F,q,ne))return null;let ve=J_(M,re,ne);if(ve!==void 0)return ve?{reason:ve.reason,segment:M.displayText,ruleId:ve.id,intent:ve.intent}:null;let xe=yc(ue.length===re.length?ue.join(`
-`):M.source,ne);return xe?{...xe,segment:M.displayText}:null}function J_(M,L,F){let q=L.length===1?L[0]:void 0;if(!q?.heredoc||!Cc(q.heredoc)||q.fd!==void 0&&q.fd!==0)return;let ne=nn(M.words[0],"uv")&&nn(M.words[1],"run")?M.words.slice(2):M.words,re=ne[0];if(re?.provenance!=="literal"||!In(re.text))return;let ue=ne.findIndex((mt)=>nn(mt,"-"));if(!ne.slice(1,ue===-1?void 0:ue).every((mt)=>mt.provenance==="literal"&&mt.text.startsWith("-")))return;let xe=q.heredoc.body,He=Qt(F.policy,"interpreter.one-liner-paranoid",!!F.paranoidInterpreters);if(F.trace?.recordSegment({type:"interpreter",interpreter:re.text,codeArg:xe,paranoidBlocked:He}),He){let mt=Pt(Et("interpreter.one-liner-paranoid",Uo),F.policy);if(mt)return mt}if(!Ho(xe,void 0,!F.strict))return null;let ft=Pt(Et("interpreter.dangerous-command",to),F.policy);if(!ft)return null;return F.trace?.recordSegment({type:"dangerous-text",token:xe,matched:!0,reason:ft.reason}),ft}function Q_(M,L,F,q,ne){let re=L.length===1?L[0]:void 0;if(!re?.heredoc||!Cc(re.heredoc)||re.fd!==void 0&&re.fd!==0)return!1;let ue=Pr(M.words,ne.environment,F.effectiveCwd,q),ve=ue.words.map(t),xe=kt(ve[0]??"");if((ue.envSplitValues?.length??0)>0||!jt.has(xe)&&!jt.has(At(xe)))return!1;return Jn(ve)}function ew(M,L,F,q,ne){let re=Pp(M,L.effectiveCwd,q,L.shellGitContextState.shellAssignments,F);if(re===null)ne?.recordSegment({type:"cwd-change",segment:M.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(re!==void 0)L.effectiveCwd=re}var tw=new Set(["fi","done","esac"]);function nw(M){return M?.kind==="command"&&M.words.length===1&&M.words[0]?.raw==="!"}function rw(M,L,F,q){let ne=M.words[0]?.text??"",re=L.shellGitContextState.bodyDepth,ue=F.shellGitContextState.bodyDepth,ve=F.compoundBodies;if(ue>re)return F.compoundBodies=[...ve.slice(0,re),{entryCwd:L.effectiveCwd,branchCwds:ve[re]?.branchCwds??[],hasElse:!1}],[F];let xe=re>0?ve[re-1]:void 0;if(xe&&(ne==="else"||ne==="elif"))return F.compoundBodies=[...ve.slice(0,re-1),{entryCwd:xe.entryCwd,branchCwds:[...xe.branchCwds,F.effectiveCwd],hasElse:ne==="else"}],F.effectiveCwd=xe.entryCwd,[F];let He=xe!==void 0&&tw.has(ne);if(He)F.compoundBodies=ve.slice(0,ue);return[...new Set([F.effectiveCwd,...He?xe.branchCwds:[],...He&&!xe.hasElse?[xe.entryCwd]:[],...q?[L.effectiveCwd]:[]])].map((mt)=>{if(mt===F.effectiveCwd)return F;let dt=zr(F);return dt.effectiveCwd=mt,dt})}function ow(M,L){return M.length===L.length&&M.every((F,q)=>{let ne=L[q];return ne!==void 0&&F.entryCwd===ne.entryCwd&&F.hasElse===ne.hasElse&&F.branchCwds.length===ne.branchCwds.length&&F.branchCwds.every((re,ue)=>re===ne.branchCwds[ue])})}var iw=/^[A-Za-z_][A-Za-z0-9_]*$/,sw=8;function aw(M,L){let F=M.words[1]?.text;if(M.dialect!=="posix"||M.words[0]?.text!=="for"||F===void 0||!iw.test(F))return[L];let q=M.words.slice(3);if(!(M.words[2]?.text==="in"&&q.length>=1&&q.length<=sw&&q.every((re)=>re.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(re.text))))return L.shellGitContextState.shellAssignments.delete(F),[L];return q.map((re)=>{let ue=zr(L);return ue.shellGitContextState.shellAssignments.set(F,re.text),ue})}function zr(M){return{effectiveCwd:M.effectiveCwd,shellGitContextState:ym(M.shellGitContextState),literalHeredocFiles:new Map(M.literalHeredocFiles),functionDefinitions:new Map(M.functionDefinitions),createdDirectories:new Set(M.createdDirectories),compoundBodies:M.compoundBodies}}function zs(M){let L=[];for(let F of M){if(!L.some((q)=>lw(q,F)))L.push(F);if(L.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return L}function lw(M,L){return M.effectiveCwd===L.effectiveCwd&&ow(M.compoundBodies,L.compoundBodies)&&ho(M.shellGitContextState.env,L.shellGitContextState.env)&&ho(M.literalHeredocFiles,L.literalHeredocFiles)&&ho(M.functionDefinitions,L.functionDefinitions)&&ho(M.shellGitContextState.effectiveEnvAssignments,L.shellGitContextState.effectiveEnvAssignments)&&ho(M.shellGitContextState.shellAssignments,L.shellGitContextState.shellAssignments)&&M.shellGitContextState.bodyDepth===L.shellGitContextState.bodyDepth&&Dp(M.shellGitContextState.bodyAssignments,L.shellGitContextState.bodyAssignments)&&Dp(M.createdDirectories,L.createdDirectories)}function Dp(M,L){return M.size===L.size&&[...M].every((F)=>L.has(F))}function ho(M,L){if(M===L)return!0;if(!M||!L||M.size!==L.size)return!1;return[...M].every(([F,q])=>L.get(F)===q&&L.has(F))}function cw(M,L){let F=Lo(M);return F===void 0?void 0:L.get(F)}function uw(M,L){if(!L)return null;return{reason:L.reason,segment:M,ruleId:L.id,intent:L.intent}}function dw(M,L=M.effectiveCwd){let F=L===null;return{environment:M.environment,cwd:F?void 0:L??M.cwd,originalCwd:F?void 0:M.cwd,strict:M.strict,paranoid:M.paranoidRm,allowTmpdirVar:M.allowTmpdirVar,protectedGitMetadata:M.protectedGitMetadata,policy:M.policy,budget:M.budget}}function yc(M,L){let F=Pt(wn(M),L.policy),q=L.trace?.currentSegmentIndex??L.trace?.allocateSegment(),ne={type:"dangerous-text",token:M,matched:!!F,reason:F?.reason};if(L.trace?.recordSegment(ne,q),!F&&/^(?:cd|pushd)\s/.test(M))L.trace?.recordSegment({type:"cwd-change",segment:M,effectiveCwdNowUnknown:!0},q);return F?{reason:F.reason,segment:M,ruleId:F.id,intent:F.intent}:null}function Np(M,L){let F={type:"strict-unparseable",rawCommand:M,reason:so},q=L.trace?.currentSegmentIndex;if(q===void 0)L.trace?.recordGlobal(F);if(q!==void 0)L.trace?.recordSegment(F)}var fw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function zp(M,L,F,q){let ne=bc(M,0,{...L,...je(L),budget:L.budget??hn(),factStore:q},F);if(!ne)return null;return{kind:"deny",reason:ne.reason,intent:ne.intent??"manual_only",...ne.ruleId?{ruleId:ne.ruleId}:{},evidence:{command:M,segment:ne.segment}}}function Bp(M,L,F){try{return{decision:M()}}catch(q){let ne=mw(q,L,F);if(!ne)throw q;return ne}}function mw(M,L,F){if(!(M instanceof s)||!fw.has(M.kind))return null;let q=a[M.kind];if(F?.currentSegmentIndex!==void 0)F.recordSegment({type:"error",message:q.reason});if(F?.currentSegmentIndex===void 0)F?.recordGlobal({type:"error",message:q.reason});return{decision:{kind:"deny",reason:q.reason,intent:"stop_and_explain",evidence:{command:L,segment:L}},errorCode:q.errorCode}}var pw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),vc=new Set(["cc-safety-net","ccsn"]),gw=new Set(["bunx","npx","pnpx"]),hw=new Set(["pnpm","yarn"]),yw=new Set(["npm","pnpm","yarn"]),bw=new Set(["bun","node"]);function Hs(M,L,F={}){if(vc.has(M))return 0;if(gw.has(M)){if(F.broad)return Sc(L);let ne=L[0]==="-y"||L[0]==="--yes"?1:0;return Us(L[ne])?ne+1:null}let q=F.broad?L.findIndex((ne)=>!ne.startsWith("-")):0;if(q!==-1&&yw.has(M)&&F.broad&&L[q]==="exec"){let ne=Sc(L.slice(q+1));return ne===null?null:q+1+ne}if(hw.has(M)){if(M==="yarn"&&!F.broad)return null;if(!F.broad)return L[0]==="dlx"&&Us(L[1])?2:null;if(q===-1||L[q]!=="dlx")return null;let ne=Sc(L.slice(q+1));return ne===null?null:q+1+ne}if(bw.has(M)){let ne=F.broad&&q!==-1?q:0;if($p(L[ne]))return ne+1;if(M==="bun"&&L[ne]==="run"&&$p(L[ne+1]))return ne+2}return null}function Sc(M){let L=M.findIndex((q)=>Us(q));if(L===-1)return null;let F=L;while(F<M.length){let q=M[F]??"";if(!q.startsWith("-")&&!Us(q))break;F++}return F}function Us(M){if(!M)return!1;let L=M.indexOf("@");if(L===-1)return vc.has(M);if(L===0)return!1;let F=M.slice(L+1);if(F===""||F.includes("/")||F.includes(":"))return!1;return vc.has(M.slice(0,L))}function $p(M){let L=M?.replaceAll("\\","/");return[...pw].some((F)=>L===F||L?.endsWith(`/${F}`))}var Ue="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Up(M,L,F){let q=dn(M,"input-candidate");if(!q)return null;let ne=ro(q.shell,M.invocation.context.executionCwd,L,F,{findSegmentTarget:(re)=>Cw(re,L),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ne?{target:ne}:null}function Cw(M,L){let F=ar([...M],L),q=F.slice(1),ne=Hs(At(F[0]??"").toLowerCase(),q,{broad:!0});if(ne===null)return null;let re=q.slice(ne).filter((ue)=>ue!=="-g"&&ue!=="--global");return re[0]==="policy"&&re[1]==="apply"?F.join(" "):null}import{dirname as js}from"node:path";var Ge="This path contains the protected policy config and you must not modify or delete it.",Sw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Kp(M,L,F){let q=ww(M.invocation.context,L,F);if(M.invocation.route.kind==="patch")return Hp(M.paths,!1,M.invocation.context.executionCwd,q,L,F);let ne=dn(M,"input-candidate");if(M.invocation.route.kind==="command")return ne?jp(ne.shell,M.invocation.context.executionCwd,q,L,F):null;if(M.invocation.route.kind==="unknown"&&ne){let re=jp(ne.shell,M.invocation.context.executionCwd,q,L,F);if(re)return re}return Hp(M.paths,M.invocation.route.kind==="grep"||M.invocation.route.kind==="glob"||Si(M.invocation.toolName),M.invocation.context.executionCwd,q,L,F)}function Hp(M,L,F,q,ne,re){if(L)return null;let ue=M.find((ve)=>di(ve,F,q,ne,re));return ue?{target:ue}:null}function jp(M,L,F,q,ne){let re=ro(M,L,q,ne,{findSegmentTarget:(ue,ve)=>vw(ue,ve,F,q,ne)?.target??null,isRedirectionTarget:(ue,ve)=>di(ue,ve.cwd,F,q,ne),findMalformedTarget:(ue)=>_w(ue,L,F,q,ne)?.target??null});return re?{target:re}:null}function vw(M,L,F,q,ne){if(Yo(M))return null;let re=lr([...M],q),ue=At(re[0]??"").toLowerCase(),ve=re.slice(1);if(ue==="rm"&&Ew(ve)){let xe=xw(ve).find((He)=>Vp(un(He,L.variables),L.cwd,F,q,ne));if(xe)return{target:xe}}if(ue==="find"){if(Rs(re,1)||Fl(re,q)){let He=(oi(Ht(re))??Ht(["."])).find((ft)=>{let mt=un(ft.text,L.variables);return di(mt,L.cwd,F,q,ne)||Vp(mt,L.cwd,F,q,ne)})?.text;if(He)return{target:He}}}if(ue==="mv"){let xe=ds(ve).sources.find((He)=>Pw(un(He,L.variables),L.cwd,F,q,ne));if(xe)return{target:xe}}if(Rw(re,ue))return null;for(let xe of[...M,...re])for(let He of qp(xe))if(di(un(He,L.variables),L.cwd,F,q,ne))return{target:He};return null}function Ew(M){return M.some((L)=>L==="--recursive"||L.startsWith("-")&&!L.startsWith("--")&&/[rR]/.test(L.slice(1)))}function xw(M){let L=M.indexOf("--");if(L!==-1)return[...M.slice(0,L).filter((F)=>!F.startsWith("-")),...M.slice(L+1)];return M.filter((F)=>!F.startsWith("-"))}function Rw(M,L){if(!Sw.has(L))return!1;if(L!=="sed")return!0;return!M.slice(1).some((F)=>F.startsWith("-i")||F==="--in-place"||F.startsWith("--in-place="))}function _w(M,L,F,q,ne){for(let re of M.split(/\s+/))for(let ue of qp(re))if(di(ue,L,F,q,ne))return{target:ue};return null}function qp(M){let L=M.trim().replace(/^['"]|['"]$/g,""),F=L.indexOf("=");return F===-1||F===L.length-1?[L]:[L,L.slice(F+1)]}function ww(M,L,F){let q=(ve)=>fi(on(ve,M.executionCwd,L,F)),ne=q(d(L)),re=[q(b(M.executionCwd)),q(b(M.configCwd))],ue=new Set(re.map((ve)=>js(ve)));for(let ve=js(ne);;ve=js(ve))if(ue.add(ve),js(ve)===ve)break;return{files:new Set([ne,...re]),directoriesAndAncestors:ue}}function di(M,L,F,q,ne){let re=$c(M,L,q,ne,(ue)=>fi(ue)===wi);return re!==null&&F.files.has(fi(re))}function Vp(M,L,F,q,ne){return F.directoriesAndAncestors.has(fi(on(M,L,q,ne)))}function Pw(M,L,F,q,ne){let re=fi(on(M,L,q,ne));return F.files.has(re)||F.directoriesAndAncestors.has(re)}function fi(M){return process.platform==="win32"?M.toLowerCase():M}import{isAbsolute as Vs,posix as sg,resolve as qs,win32 as Aw}from"node:path";import{fileURLToPath as Tw}from"node:url";var ag="Access to a sensitive path is not allowed.",lg=new Set(["echo","printf"]),Iw=new Set(["find"]),kw=new Set(["!","do","elif","else","if","then","until","while"]),Ow=new Set(["-exec","-execdir"]),Mw=new Set([";","+"]),Dw=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Nw=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),cg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Lw=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Ww=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),ug=new Set(["-c","-e","-r","-E","--eval","--exec"]),Gw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Fw=new Set(["grep","rg"]),zw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),Bw=new Set(["commit","merge","notes","stash","tag"]),$w=new Set(["-m","--message"]),Uw=new Set(["--grep"]),Yp=new Set(["jq","gojq","jaq"]),Zp="f",Xp="file",Hw="files",jw=new Set(["e","f"]),Vw=new Set(["regexp","file"]),Kw=new Set(["e","f","A","B","C","m"]),qw=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ec="__CC_SAFETY_NET_PIPE_INPUT__",Rc=/[\w./~@+-]*[./~][\w./~@+-]*/g,Yw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Zw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Xw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Jp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Qp=/\b(?:system|exec|spawn|popen)\s*$/,Jw=/\b(?:eval|exec)\s*\(/g,Qw=/\b(?:eval|exec)\s*$/,eP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function eg(M,L,F,q,ne,re){for(let ue of M){let ve=ue.target;if(XP(ve,ue.cwd,L?.denyPaths??[],F,q,ne))return{target:ve,ruleId:"secret.deny-path"};if(re&&!re.has(ve))continue;let xe=YP(ve,ue.cwd,L,q,ne);if(xe){let He=re!==void 0&&!xe.startsWith("secret.home.")&&!xe.startsWith("secret.cli.");if(He&&q.paths.isDirectory(yg(ve,ue.cwd,q,ne)))continue;if(He&&ue.isRedirectionWriteTarget===!0&&!ve.includes("$")&&!wc(ve,ue.cwd,q,ne))continue;if(He&&/\s/.test(ve)&&!ve.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(ve)&&!wc(ve,ue.cwd,q,ne))continue;if(!xe.startsWith("secret.cli.")&&JP(ve,ue.cwd,L?.allowPaths??[],F,q,ne))continue;return{target:ve,ruleId:xe}}}return null}function dg(M,L,F,q,ne={}){let re=tg(M,F,q),ue=eg(re,L,M.invocation.context.configCwd,F,q);if(ue===null||ue.ruleId==="secret.deny-path"||ne.strict!==!1)return ue;let ve=eg(re,L,M.invocation.context.configCwd,F,q,new Set(tg(M,F,q,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((xe)=>xe.target)));return ve?.ruleId!=="secret.deny-path"&&tP(M,F)?null:ve}function tP(M,L){let F=dn(M,"input-candidate")??dn(M,"declared-command");if(!F)return!1;if(F.program.nodes.some((ue)=>ue.kind==="command"&&ue.nested.length>0))return!1;let q=[];for(let ue of us(F.shell)){if(ue.kind==="operator"&&ue.boundary)return!1;if(ue.kind==="redirection")return!1;if(ue.kind==="operator")continue;q.push(Xn(ue.text,L))}let ne=nr(q);if(ne.length===0)return!1;let re=Fn(ne[0]??"").toLowerCase();if(M.invocation.route.kind==="unknown")return F.program.dialect==="powershell"&&(re==="ls"||re==="stat");return Pc(re,ne.slice(1))}function Pc(M,L){if(M==="ls"||M==="stat")return!0;if(M==="test")return L.length===2&&(L[0]==="-e"||L[0]==="-f");if(M==="[")return L.length===3&&(L[0]==="-e"||L[0]==="-f")&&L[2]==="]";if(M==="git")return L[0]==="check-ignore";if(M!=="find")return!1;return!L.some((F)=>Dw.has(F))}function tg(M,L,F,q={}){let ne=M.invocation.context.executionCwd,re=M.invocation.route.kind;if(re!=="command"&&re!=="unknown")return M.paths.map((ve)=>({target:ve,cwd:ne}));let ue=dn(M,"input-candidate");return[...ue?yo(ue.shell,M.store,q,L,ne,F,nP(ue)):[],...re==="unknown"?M.paths.map((ve)=>({target:ve,cwd:ne})):[]]}function nP(M){return M.program.dialect==="powershell"}function yo(M,L,F,q,ne,re,ue=!1){if(M.status==="structural-limit")throw new y;if(M.status==="unclosed-quote")return[];if(M.status==="invalid")throw Error("Unable to parse command for secret protection");let ve=[...M.assignmentFallbacks.map((He)=>({target:He,cwd:ne})),...OP(Xn(M.source,q),L,F,q,ne,re)],xe=(He)=>Xn(mP(He,ue),q);return cs(M,ne,q,re,{word:xe,segment:(He,ft,mt,dt,pt)=>{if(He.length===0)return null;if(ve.push(...Ys(He,L,F,q,ft.cwd,re,pt)),mt!==null)ve.push(...oP(mt,He,L,F,q,ft.cwd,re));return null},redirection:(He,ft)=>{if(He.body!==void 0&&He.consumer!==void 0)ve.push(...fg(He.consumer,[He.body],L,F,q,ft.cwd,re,(mt)=>iP(He.consumer??[],mt,L,F,q,ft.cwd,re)));if(He.targetOrder==="legacy-segment")return vl;return ve.push({target:xe(He.target),cwd:ft.cwd,...He.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),ve}function Ac(M,L,F,q,ne,re){let ue=L.getShellSyntax(M);if(ue.status==="structural-limit")throw new y;return ue.status==="complete"?yo(ue,L,F,q,ne,re):null}function Ys(M,L,F,q,ne,re,ue){let ve=(ht)=>({target:ht,cwd:ne});if(ue?.size){let ht=M.filter((yt,bt)=>!ue.has(bt));if(Yp.has(Fn(nr(ht)[0]??"").toLowerCase()))return[...M.filter((yt,bt)=>ue.has(bt)).map(ve),...Ys(ht,L,F,q,ne,re)]}let xe=fP(M).map(ve),He=nr(M);if(He.length===0)return xe;let ft=He[0]??"",mt=Fn(ft).toLowerCase(),dt=He.slice(1),pt=He.findIndex((ht)=>!kw.has(ht));if(F.skipMetadataOnlySegments===!0&&pt!==-1&&Pc(Fn(He[pt]??"").toLowerCase(),He.slice(pt+1)))return xe;let gt=rP(ft,mt,dt);if(gt)return[...xe,...gt.map(ve)];if(lg.has(mt))return F.displayOperandsAreCapturedOutput===!0?[...xe,...mg(M).map(ve)]:xe;if(mt==="eval")return[...xe,...Ac(dt.join(" "),L,F,q,ne,re)??dt.map(ve)];if(mt==="export")return[...xe,...dt.flatMap((ht)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ht)?[ht.slice(ht.indexOf("=")+1)]:jn(mt,ht)).map(ve)];if(mt==="git")return[...xe,...gP(dt).map(ve)];if(mt==="gh")return[...xe,..._c(mt,dt,zw).map(ve)];if(Yp.has(mt))return[...xe,...pP(dt).map(ve)];if(Fw.has(mt))return[...xe,...zP(dt).map(ve)];if(Iw.has(mt))return[...xe,...CP(dt,L,F,q,ne,re).map(ve)];if(_n.has(mt))return[...xe,...dt.flatMap((ht)=>jn("awk",ht)).map(ve),...dt.flatMap((ht)=>vP(ht,L,F,q,ne,re)),...dt.flatMap(EP).map(ve)];if(mt==="curl")return[...xe,...dt.flatMap((ht)=>jn(mt,ht)).map(ve),...hP(dt).map(ve)];if(Zo(mt)){let ht=qo.has(mt)?Cn([mt,...dt]):null;if(ht!==null&&ht.command!==null&&ht.commandIndex!==null){let yt=L.getShellSyntax(ht.command);if(yt.status==="structural-limit")throw new y;if(yt.status==="complete")return[...xe,...yo(yt,L,F,q,ne,re),...dt.slice(ht.commandIndex).filter((bt)=>!bt.startsWith("-")).map(ve)]}return[...xe,...SP(mt,dt,L,F,q,ne,re)]}return[...xe,...dt.flatMap((ht)=>jn(mt,ht)).map(ve)]}function rP(M,L,F){let q=Hs(L,F);if(q===null||F[q]!=="explain")return null;let ne=[M,...F.slice(0,q)],re=F.slice(q+1);for(let ue=0;ue<re.length;ue++){let ve=re[ue];if(ve==="--json"||ve==="--help"||ve==="-h")continue;if(ve==="--cwd"){let xe=re[ue+1];if(xe&&!xe.startsWith("--"))ne.push(xe);ue++;continue}return ne}return ne}function oP(M,L,F,q,ne,re,ue){if(cP(L,F,q,ne,re,ue)){let ve=nr(M),xe=Pc(Fn(ve[0]??"").toLowerCase(),ve.slice(1))?ve.slice(1).filter((He)=>!He.startsWith("-")):[];return[...mg(M),...xe].map((He)=>({target:He,cwd:re}))}return fg(L,sP(M),F,q,ne,re,ue,()=>[])}function iP(M,L,F,q,ne,re,ue){let ve=nr(M);if(!Zo(Fn(ve[0]??"").toLowerCase()))return[];return Ac(L,F,q,ne,re,ue)??[{target:L,cwd:re}]}function fg(M,L,F,q,ne,re,ue,ve){let xe=uP(M);if(xe===null)return L.flatMap(ve);return L.flatMap((He)=>qo.has(xe)?yo(F.getShellSyntax(He),F,q,ne,re,ue):Ks(xe,He,F,q,ne,re,ue))}function mg(M){let L=nr(M);if(L.length===0)return[];let F=Fn(L[0]??"").toLowerCase();if(!lg.has(F))return[];let q=L[L[1]==="--"?2:1];if(F==="printf"&&q!==void 0&&!q.startsWith("-")&&!q.replaceAll("%%","").includes("%"))return[Tc(q.replaceAll("%%","%"))];return L.slice(1)}function sP(M){let L=nr(M);if(L.length===0)return[];let F=Fn(L[0]??"").toLowerCase(),q=L.slice(1);if(F==="echo"){let ne=q.findIndex((re)=>!/^-[neE]+$/.test(re));return[(ne===-1?[]:q.slice(ne)).join(" ")]}if(F==="printf")return aP(q);return[]}function aP(M){let L=M[0];if(L===void 0)return[];let F=(L.match(/%%|%[bqs]/g)??[]).filter((ne)=>ne!=="%%").length;if(F===0||M.length===1)return[Tc(L)];let q=M.slice(1);return Array.from({length:Math.ceil(q.length/F)},(ne,re)=>lP(L,q.slice(re*F,(re+1)*F)))}function lP(M,L){let F=0;return Tc(M.replace(/%%|%[bqs]/g,(q)=>{if(q==="%%")return"%";let ne=L[F]??"";return F++,ne}))}function Tc(M){return M.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function cP(M,L,F,q,ne,re){let ue=nr(M);if(ue.length===0||Fn(ue[0]??"").toLowerCase()!=="xargs")return!1;let ve=Lr(ue),xe=ue.slice(ve.childStart);if(xe.length===0)return!1;if(ve.replacementToken==="")return!1;let He=ve.replacementToken,ft=He===null?[...xe,Ec]:xe.map((mt)=>mt.split(He).join(Ec));return Ys(ft,L,F,q,ne,re).some((mt)=>mt.target.includes(Ec))}function uP(M){let L=nr(M);if(L.length===0)return null;let F=Fn(L[0]??"").toLowerCase();if(!Zo(F))return null;return dP(F,L.slice(1))?F:null}function dP(M,L){let F=Ic(M);for(let q=0;q<L.length;q++){let ne=L[q];if(ne===void 0)break;if(ug.has(ne)||pg(M,ne)||/^--(?:eval|exec)=/.test(ne))return!1;if(ne==="-")return!0;if(ne.startsWith("-")){if(F==="python"&&ne==="-m")return!1;if(eP.get(F)?.has(ne))q++;continue}return!1}return!0}function Ic(M){return/^python\d/.test(M)?"python":M}function fP(M){let L=[];for(let F of M){if(hg(F))continue;let q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(F);if(q===null)break;if(q[1]!==void 0&&q[1]!=="")L.push(q[1])}return L}var ng=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function mP(M,L){if(!L||!ng.test(M))return M;return`~${M.replace(ng,"").replace(/\\/g,"/")}`}function jn(M,L){if(L==="--")return[];let F=[],q=L.indexOf("=");if(q>0&&q<L.length-1)F.push(L.slice(q+1));if(L.startsWith("-"))return F;if(M==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(L))return F;if(M==="zip"&&/\.zip$/i.test(L))return F;return F.push(L),F}function pP(M){let L=-1,F=!1;for(let q=0;q<M.length;q++){let ne=M[q]??"";if(!F&&ne==="--"){F=!0;continue}if(F||!/^-(?:[A-Za-z]|-)/.test(ne)){if(L===-1)L=q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ne)){q+=2;continue}if(ne==="--indent"||ne==="-L"){q++;continue}if(ne.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ne)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ne))continue;return M.flatMap((re)=>jn("jq",re))}return M.flatMap((q,ne)=>ne===L?[]:jn("jq",q))}function gP(M){let L=[];for(let F=0;F<M.length;F++){let q=M[F]??"";if(q==="--"||!q.startsWith("-"))return[...L,...Bw.has(q)?_c("git",M.slice(F).map((re)=>/^-[aeinopqsv]+m$/.test(re)?"-m":re),$w):_c("git",M.slice(F),Uw)];if(L.push(...jn("git",q)),!bn.has(q))continue;let ne=M[F+1];if(ne===void 0)break;L.push(...q==="-c"&&ne.includes("=")?[ne.slice(ne.indexOf("=")+1)]:jn("git",ne)),F++}return L}function _c(M,L,F){let q=[];for(let ne=0;ne<L.length;ne++){let re=L[ne]??"";if(re==="--")return[...q,...L.slice(ne).flatMap((ue)=>jn(M,ue))];if(F.has(re)){ne++;continue}if(re.includes("=")&&F.has(re.slice(0,re.indexOf("="))))continue;q.push(...jn(M,re))}return q}function hP(M){return M.flatMap((L,F)=>{let q=bP(L);if(q!==null)return rg(q.flag,q.value);let ne=yP(M[F-1]);return ne===null?[]:rg(ne,L)})}function rg(M,L){if(M==="-F"||M==="--form"){let F=L.indexOf("="),q=F===-1?L:L.slice(F+1);if(!q.startsWith("@")&&!q.startsWith("<"))return[];return xc(q.slice(1).split(";")[0]??"")}if(M==="--data-urlencode"){let F=L.indexOf("@"),q=L.indexOf("=");if(F===-1||q!==-1&&q<F)return[];return xc(L.slice(F+1))}return L.startsWith("@")?xc(L.slice(1)):[]}function yP(M){if(M===void 0)return null;if(cg.has(M))return M;return/^-[A-Za-z]+[dF]$/.test(M)?`-${M.slice(-1)}`:null}function bP(M){let L=M.slice(0,2);if(M.length>2&&(L==="-d"||L==="-F"))return{flag:L,value:M.slice(2)};let F=M.indexOf("=");if(F===-1)return null;let q=M.slice(0,F);return cg.has(q)?{flag:q,value:M.slice(F+1)}:null}function xc(M){return M===""||M==="-"?[]:[M]}function CP(M,L,F,q,ne,re){let ue=M.findIndex((xe)=>xe.startsWith("-")||xe==="("||xe==="!"||xe===";"),ve=[...M.slice(0,ue===-1?M.length:ue),...M.flatMap((xe,He)=>xe==="-files0-from"&&M[He+1]!==void 0?[M[He+1]??""]:[])];for(let xe=0;xe<M.length;xe++){if(!Ow.has(M[xe]??""))continue;let He=M.slice(xe+1),ft=He.findIndex((pt)=>Mw.has(pt)),mt=ft===-1?He:He.slice(0,ft),dt=Ys(mt,L,F,q,ne,re).map((pt)=>pt.target);if(ve.push(...dt.filter((pt)=>pt!=="{}")),!dt.includes("{}"))continue;ve.push(...M.slice(0,xe).flatMap((pt,gt,ht)=>{if(!Nw.has(pt))return[];let yt=ht[gt+1];return yt===void 0?[]:[yt,yt.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return ve}function SP(M,L,F,q,ne,re,ue){let ve=[];for(let xe=0;xe<L.length;xe++){let He=L[xe];if(He===void 0)break;if(ug.has(He)||pg(M,He)){let mt=L[xe+1];if(mt!==void 0)ve.push(...Ks(M,mt,F,q,ne,re,ue)),xe++;continue}let ft=/^--(?:eval|exec)=(.*)$/.exec(He);if(ft!==null&&ft[1]!==void 0){ve.push(...Ks(M,ft[1],F,q,ne,re,ue));continue}if(!He.startsWith("-"))ve.push({target:He,cwd:re})}return ve}function pg(M,L){if(!L.startsWith("-")||L.startsWith("--")||L.length<=2)return!1;return Gw.get(L[L.length-1]??"")?.has(Ic(M))??!1}function vP(M,L,F,q,ne,re){if(!M.includes("system"))return[];return Nl(M)?.commands.flatMap((ue)=>yo(L.getShellSyntax(ue),L,F,q,ne,re))??[]}function EP(M){return Array.from(M.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((L)=>L[1]).filter((L)=>L!==void 0&&L!=="")}function xP(M){let L=Array.from(M.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((F)=>F[2]).filter((F)=>F!==void 0&&F!=="");return[...L,...L.flatMap(kc),...M.match(Rc)??[]]}function Ks(M,L,F,q,ne,re,ue){let ve=(ht)=>({target:ht,cwd:re}),xe=_P(L,RP(M));if(xe.kind==="unmaskable")return xP(L).map(ve);let He=xe.masked.match(Jp)!==null||xe.literals.some((ht)=>Qp.test(xe.masked.slice(0,ht.start))),ft=xe.masked.match(Jw)!==null||xe.literals.some((ht)=>Qw.test(xe.masked.slice(0,ht.start))),mt=q.inlineLiteralsPresumedData===!0&&!qo.has(M),dt=mt&&!(TP(xe.masked)||He||ft)?[]:xe.literals,pt=mt?Array.from(xe.masked.matchAll(Jp),(ht)=>{let yt=ht.index+ht[0].length;return{start:yt,end:pl(xe.masked,yt)}}):[],gt=!mt||pt.some((ht)=>gl(xe.masked,ht.start))?xe.literals:xe.literals.filter((ht)=>Qp.test(xe.masked.slice(0,ht.start))||pt.some((yt)=>ht.start>=yt.start&&ht.start<yt.end));return[...dt.map((ht)=>ht.text).filter((ht)=>ht!=="").map(ve),...dt.flatMap((ht)=>kc(ht.text)).map(ve),...mt?[]:xe.literals.flatMap((ht)=>ht.text.match(Rc)??[]).map(ve),...He?gt.flatMap((ht)=>Ac(ht.text,F,q,ne,re,ue)??[ve(ht.text)]):[],...ft?xe.literals.flatMap((ht)=>Ks(M,ht.text.replace(/\\(.)/g,(yt,bt)=>bt==="n"?`
-`:bt),F,q,ne,re,ue)):[],...(xe.masked.match(Rc)??[]).map(ve)]}function RP(M){let L=Ic(M);if(L==="python")return"python";if(L==="osascript")return"opaque";return L==="node"||L==="bun"||L==="deno"?"javascript":"simple"}function _P(M,L){if(L==="opaque")return{kind:"unmaskable"};let F=M.split(""),q=[];for(let ne=0;ne<M.length;ne++){let re=M[ne]??"";if(L==="simple"&&(re==="`"||re==="%"||re==="<")){if(Zw.test(M.slice(ne)))return{kind:"unmaskable"}}let ue=re==="'"||re==='"'||L==="javascript"&&re==="`"?re:null;if(ue===null)continue;if(ue==="`"&&AP(M,ne))return{kind:"unmaskable"};let ve=L==="python"?wP(M,ne):"",xe=L==="python"&&M.startsWith(ue.repeat(3),ne)?ue.repeat(3):ue,He=ne+xe.length,ft=PP(M,He,xe);if(ft===null)return{kind:"unmaskable"};let mt=M.slice(He,ft);if(/[fF]/.test(ve)&&mt.includes("{"))return{kind:"unmaskable"};if(L==="simple"&&ue==='"'&&Xw.test(mt))return{kind:"unmaskable"};q.push({start:He,text:mt});for(let dt=ne;dt<ft+xe.length;dt++)F[dt]=" ";ne=ft+xe.length-1}return{kind:"masked",masked:F.join(""),literals:q}}function wP(M,L){return Yw.exec(M.slice(Math.max(0,L-3),L))?.[1]??""}function PP(M,L,F){let q=F==="`",ne=q||F.length===3;for(let re=L;re<M.length;re++){let ue=M[re];if(ue==="\\"){re++;continue}if(q&&ue==="$"&&M[re+1]==="{")return null;if(!ne&&(ue===`
-`||ue==="\r"))return null;if(M.startsWith(F,re))return re}return null}function AP(M,L){for(let F=L-1;F>=0;F--){let q=M[F];if(!q||/\s/.test(q))continue;return/[\w$\])]/.test(q)}return!1}function TP(M){for(let L of M.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let F=L[0],q=L.index;if(Lw.has(F.toLowerCase()))return!0;let ne=F.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((re)=>re.toLowerCase());if(!ne.some((re)=>Ww.has(re)))continue;if(ne.length>1)return!0;if(IP(M,q)===".")return!0;if(kP(M,q+F.length)==="(")return!0}return!1}function IP(M,L){for(let F=L-1;F>=0;F--)if(!/\s/.test(M[F]??""))return M[F];return}function kP(M,L){for(let F=L;F<M.length;F++)if(!/\s/.test(M[F]??""))return M[F];return}function OP(M,L,F,q,ne,re){return WP(M).flatMap((ue)=>{let ve=L.getShellSyntax(ue);if(ve.status==="invalid")return[];return[...yo(ve,L,{...F,displayOperandsAreCapturedOutput:!0},q,ne,re),...MP(ve,q)?DP(ve,q).map((xe)=>({target:xe,cwd:ne})):[]]})}function MP(M,L){let F=us(M);for(let q=0;q<F.length;q++){let ne=F[q];if(ne?.kind!=="word"||Fn(Xn(ne.text,L)).toLowerCase()!=="base64")continue;for(let re=q+1;re<F.length;re++){let ue=F[re];if(ue?.kind==="operator")break;if(ue?.kind!=="word")continue;let ve=Xn(ue.text,L);if(ve==="--decode"||!ve.startsWith("--")&&ve.startsWith("-")&&/[dD]/.test(ve))return!0}}return!1}function DP(M,L){return us(M).flatMap((F)=>F.kind==="word"?[Xn(F.text,L)]:F.kind==="redirection"&&F.target?[Xn(F.target,L)]:[]).flatMap(kc)}function kc(M){let L=LP(M);if(L===null)return[];let F=Buffer.from(L,"base64").toString("utf8");if(F===""||NP(F))return[];return Buffer.from(F,"utf8").toString("base64").replace(/=+$/g,"")===L.replace(/=+$/g,"")?[F]:[]}function NP(M){return Array.from(M).some((L)=>{let F=L.charCodeAt(0);return F<32||F===127})}function LP(M){if(M.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(M))return null;if(/=/.test(M.replace(/=+$/g,"")))return null;let L=M.replace(/=+$/g,"");if(L.length%4===1)return null;return`${L.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-L.length%4)%4)}`}function WP(M){let L=[],F={inSingle:!1,inDouble:!1,escaped:!1};for(let q=0;q<M.length;q++){let ne=M[q];if(!ne)break;if(ko(ne,F))continue;if(gg(M,q,F)){let re=GP(M,q+1);if(re!==null)L.push(re.body),q=re.endIndex;continue}if(!F.inSingle&&ne==="`"){let re=FP(M,q);if(re!==null)L.push(re.body),q=re.endIndex}}return L}function GP(M,L){let F={inSingle:!1,inDouble:!1,escaped:!1},q=1;for(let ne=L+1;ne<M.length;ne++){let re=M[ne];if(!re)break;if(ko(re,F))continue;if(gg(M,ne,F)){q++,ne++;continue}if(!F.inSingle&&!F.inDouble&&re===")"){if(q--,q===0)return{body:M.slice(L+1,ne),endIndex:ne}}}return null}function FP(M,L){let F=!1;for(let q=L+1;q<M.length;q++){let ne=M[q];if(!ne)break;if(F){F=!1;continue}if(ne==="\\"){F=!0;continue}if(ne==="`")return{body:M.slice(L+1,q),endIndex:q}}return null}function gg(M,L,F){return!F.inSingle&&M[L]==="$"&&M[L+1]==="("&&M[L+2]!=="("}function zP(M){let L=[],F=[],q=!1,ne=!1,re=!1;for(let xe=0;xe<M.length;xe++){let He=M[xe];if(He===void 0)break;if(!re&&He==="--"){re=!0;continue}if(re){F.push(He);continue}let ft=/^--([^=]+)(?:=(.*))?$/.exec(He);if(ft!==null){let mt=ft[1]??"",dt=ft[2];if(mt===Hw)ne=!0;if(Vw.has(mt))q=!0;if(dt!==void 0){if(mt===Xp)L.push(dt);continue}if(qw.has(mt)){let pt=M[xe+1];if(mt===Xp&&pt!==void 0)L.push(pt);xe++}continue}if(He.startsWith("-")&&He.length>1){let mt=He.slice(1),dt="",pt="";for(let ht=0;ht<mt.length;ht++){let yt=mt[ht]??"";if(jw.has(yt))q=!0;if(Kw.has(yt)){dt=yt,pt=mt.slice(ht+1);break}}if(dt==="")continue;if(pt.length>0){if(dt===Zp)L.push(pt);continue}let gt=M[xe+1];if(dt===Zp&&gt!==void 0)L.push(gt);xe++;continue}F.push(He)}let ve=!q&&!ne?F.slice(1):F;return[...L,...ve]}function nr(M){let L=M.findIndex((F)=>!hg(F)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(F));return L===-1?[]:M.slice(L)}function hg(M){return M==="env"||M==="command"||M==="builtin"||M==="sudo"}var BP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),$P=".env.",UP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),HP=[".env.example.",".env.sample."];function jP(M){let L;try{L=new URL(M.trim())}catch{return!1}return L.protocol!=="file:"&&L.host!==""}function VP(M){return M.length>0&&!/\s/.test(M)}function wc(M,L,F,q){let ne=yg(M,L,F,q);return ne!==""&&F.paths.entryKind(ne)!=="missing"}function yg(M,L,F,q){try{return gi(M,L,F,q)}catch(ne){if(ne instanceof s)throw ne;return""}}var KP=new Set(["node_modules","__pycache__"]),qP=[["vendor","bundle"],["vendor","cache"]];function YP(M,L,F,q,ne){if(jP(M))return null;let re=Hn(M,L,q,ne);if(!re)return null;let ue=zt(re.split("/").pop()??""),ve=zt(re),xe=()=>VP(ue)||wc(M,L,q,ne);if(UP.has(ue)||HP.some((dt)=>ue.startsWith(dt)))return null;let He=zt(tA(M,L,q,ne));for(let dt of Ta){let pt=`~/${dt.suffixParts.join("/")}`;if((ig(ve,pt)||ig(He,pt))&&tr(dt.id,F))return dt.id}let ft=ZP(re,L,F,q,ne);if(ft)return ft;if(BP.has(ue))return null;for(let dt of Aa)if(ue===dt.basename&&tr(dt.id,F))return dt.id;if(ue.startsWith($P)&&tr(ki.id,F)&&xe())return ki.id;for(let dt of Ia)if(ue.length>dt.prefix.length&&ue.startsWith(dt.prefix)){let pt=ue.slice(dt.prefix.length)[0];if((pt==="-"||pt==="_")&&tr(dt.id,F)&&xe())return dt.id}for(let dt of ka)if(ue.length>dt.prefix.length&&ue.startsWith(dt.prefix)){if(ue.slice(dt.prefix.length)===dt.suffix&&tr(dt.id,F))return dt.id}if(QP(ve))return null;if(!ue.includes(".")&&Oo.pattern.test(ue)&&tr(Oo.id,F))return Oo.id;let mt=eA(ue,F);if(mt)return mt;return null}function ZP(M,L,F,q,ne){return Oi.find((re)=>{if(!tr(re.id,F))return!1;switch(re.id){case"secret.cli.claude-code":return Wt(M,Ut(q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",L,q,ne),[".credentials.json"]);case"secret.cli.claude-code.config":{let ue=zt(M).split("/");return Wt(M,Ut(q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",L,q,ne),["settings.json","settings.local.json"])||pi(M,"~/.claude.json",L,q,ne)||ue.at(-1)==="settings.local.json"&&ue.at(-2)===".claude"||ue.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Wt(M,Hn("~/.gemini/config",L,q,ne),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let ue=Ut(q.env.get("CODEX_HOME"),"~/.codex",L,q,ne);return Wt(M,ue,["auth.json",".credentials.json"])||mi(M,ue,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let ue=Ut(q.env.get("CODEX_HOME"),"~/.codex",L,q,ne),ve=zt(M).split("/").at(-1)??"";return Wt(M,ue,["config.toml"])||ve.endsWith(".config.toml")&&Wt(M,ue,[ve])}case"secret.cli.gemini":return Wt(M,sn(Ut(q.env.get("GEMINI_CLI_HOME"),"~",L,q,ne),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let ue=zt(M).split("/"),ve=q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),xe=q.env.get("ProgramData")?[sn(Ut(q.env.get("ProgramData"),"",L,q,ne),"gemini-cli")]:[];return Wt(M,sn(Ut(q.env.get("GEMINI_CLI_HOME"),"~",L,q,ne),".gemini"),["settings.json","google_accounts.json"])||ue.at(-1)==="settings.json"&&ue.at(-2)===".gemini"||(ve?.trim()?pi(M,ve,L,q,ne):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...xe].some((He)=>Wt(M,Hn(He,L,q,ne),["settings.json"]))}case"secret.cli.copilot-cli":{let ue=Ut(q.env.get("COPILOT_HOME"),"~/.copilot",L,q,ne);return Wt(M,ue,["config.json"])||mi(M,ue,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Wt(M,Ut(q.env.get("COPILOT_HOME"),"~/.copilot",L,q,ne),["mcp-config.json"]);case"secret.cli.kimi-code":{let ue=Ut(q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",L,q,ne),ve=Ut(q.env.get("KIMI_SHARE_DIR"),"~/.kimi",L,q,ne);return Wt(M,ue,["server.token"])||mi(M,ue,["credentials"])||mi(M,ve,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let ue=["config.toml","mcp.json"],ve=zt(M).split("/");return ve.at(-1)==="mcp.json"&&ve.at(-2)===".kimi-code"||Wt(M,Ut(q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",L,q,ne),ue)||Wt(M,Ut(q.env.get("KIMI_SHARE_DIR"),"~/.kimi",L,q,ne),[...ue,"config.json","config.json.bak"])}case"secret.cli.opencode":{let ue=sn(Ut(q.env.get("XDG_DATA_HOME"),"~/.local/share",L,q,ne),"opencode"),ve=zt(M).split("/").at(-1)??"",xe=q.env.get("OPENCODE_DB")?.trim(),He=xe&&xe!==":memory:"?[xe,`${xe}-wal`,`${xe}-shm`]:[];return Wt(M,ue,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(ve)&&Wt(M,ue,[ve])||He.some((ft)=>pi(M,ft,L,q,ne))}case"secret.cli.opencode.config":{let ue=sn(Ut(q.env.get("XDG_CONFIG_HOME"),"~/.config",L,q,ne),"opencode"),ve=q.env.get("ProgramData")?[sn(Ut(q.env.get("ProgramData"),"",L,q,ne),"opencode")]:[],xe=["opencode.json","opencode.jsonc"],He=q.env.get("OPENCODE_CONFIG");return xe.includes(zt(M).split("/").at(-1)??"")||Wt(M,ue,["config.json"])||(He?.trim()?pi(M,He,L,q,ne):!1)||["/Library/Application Support/opencode","/etc/opencode",...ve].some((ft)=>Wt(M,Hn(ft,L,q,ne),xe))}case"secret.cli.pi":return Wt(M,Ut(q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",L,q,ne),["auth.json"]);case"secret.cli.pi.config":return Wt(M,Ut(q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",L,q,ne),["models.json"]);case"secret.cli.amp":{let ue=Hn("~",L,q,ne);return[sn(Ut(q.env.get("XDG_DATA_HOME"),"~/.local/share",L,q,ne),"amp"),sn(ue,".local","share","amp")].some((xe)=>Wt(M,xe,["secrets.json"]))||mi(M,sn(ue,".amp"),["oauth"])}case"secret.cli.amp.config":{let ue=["settings.json","settings.jsonc"],ve=[sn(Ut(q.env.get("XDG_CONFIG_HOME"),"~/.config",L,q,ne),"amp"),sn(Hn("~",L,q,ne),".config","amp")],xe=zt(M).split("/"),He=q.env.get("AMP_SETTINGS_FILE");return ve.some((ft)=>Wt(M,ft,ue))||xe.at(-2)===".amp"&&ue.includes(xe.at(-1)??"")||(He?.trim()?pi(M,He,L,q,ne):!1)}case"secret.cli.cursor":{let ue=sn(Ut(q.env.get("XDG_CONFIG_HOME"),"~/.config",L,q,ne),"cursor"),ve=sn(Ut(q.env.get("CURSOR_DATA_DIR"),"~/.cursor",L,q,ne),"projects");return Wt(M,Hn("~/.cursor",L,q,ne),["auth.json"])||Wt(M,ue,["auth.json"])||zt(M).split("/").at(-1)==="mcp-auth.json"&&Br(zt(M),zt(ve))}case"secret.cli.cursor.config":{let ue=zt(M).split("/");return ue.at(-1)==="mcp.json"&&ue.at(-2)===".cursor"}case"secret.cli.grok-build":return Wt(M,Ut(q.env.get("GROK_HOME"),"~/.grok",L,q,ne),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let ue=zt(M).split("/");return ue.at(-1)==="config.toml"&&ue.at(-2)===".grok"||Wt(M,Ut(q.env.get("GROK_HOME"),"~/.grok",L,q,ne),["config.toml","managed_config.toml","requirements.toml"])||Wt(M,Hn("/etc/grok",L,q,ne),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var og=new WeakMap;function Ut(M,L,F,q,ne){let re=og.get(ne)??new Map;og.set(ne,re);let ue=`${F}\x00${M??""}\x00${L}`,ve=re.get(ue);if(ve!==void 0)return ve;let xe=Hn(M?.trim()?M:L,F,q,ne);return re.set(ue,xe),xe}function Wt(M,L,F){return F.some((q)=>bg(M,sn(L,q)))}function mi(M,L,F){return F.some((q)=>Br(zt(M),zt(sn(L,q))))}function pi(M,L,F,q,ne){return bg(M,Hn(L,F,q,ne))}function bg(M,L){return zt(M)===zt(L)}function sn(M,...L){return Gn([M,...L].filter(Boolean).join("/"))}function XP(M,L,F,q,ne,re){if(F.length===0)return!1;let ue=zt(gi(M,L,ne,re));return F.some((ve)=>Br(ue,zt(gi(ve,q,ne,re))))}function JP(M,L,F,q,ne,re){if(F.length===0)return!1;let ue=zt(gi(M,L,ne,re));if(!ue)return!1;let ve=ne.env.get("HOME")??ne.home,xe=ve?Gn(Dt(yn(ve),ne.paths,re)):"",He=zt(xe),ft=ne.env.get("CC_SAFETY_NET_HOME"),mt=zt(ft?Gn(Dt(qs(yn(ft)),ne.paths,re)):xe&&Gn(Dt(`${xe}/.cc-safety-net`,ne.paths,re)));if(mt&&Br(ue,mt))return!1;return F.some((dt)=>{let pt=La(dt);if(pt&&sg.basename(ue)!==zt(pt.name))return!1;let gt=zt(gi(pt?.root??dt,q,ne,re));if(!gt)return!1;if(He&&(He===gt||He.startsWith(gt.endsWith("/")?gt:`${gt}/`)))return!1;return Br(ue,gt)&&!(pt&&ue===gt)})}function QP(M){let L=M.split("/");return L.some((F)=>KP.has(F))||qP.some(([F,q])=>L.some((ne,re)=>ne===F&&L[re+1]===q))}function eA(M,L){let F=M.lastIndexOf("."),q=F>0&&F<M.length-1?M.slice(F+1):"";if(q==="")return null;for(let ne of Oa)if(q===ne.extension&&tr(ne.id,L))return ne.id;for(let ne of Ma)if(ne.pattern.test(q)&&tr(ne.id,L))return ne.id;return null}function zt(M){return M.toLowerCase()}function tr(M,L){return!L?.disabledRules?.includes(M)}function Hn(M,L,F,q){let{home:ne,normalized:re}=Oc(M,F,q);if(!re)return"";if(!ne)return re;let ue=Mc(re,ne),ve=Vs(ue)?ue:Gn(qs(L,ue)),xe=Gn(Dt(ve,F.paths,q));if(!Br(xe,ne)){if(Vs(ue))return xe;return xe===ve?re:xe}let He=xe.slice(ne.length);return He?`~${He}`:"~"}function ig(M,L){return M===L||M.startsWith(`${L}/`)}function tA(M,L,F,q){let{home:ne,normalized:re}=Oc(M,F,q);if(!re||!ne)return"";let ue=Mc(re,ne),ve=sg.normalize(Vs(ue)?ue:Gn(qs(L,ue))),xe=Gn(yn(F.env.get("HOME")??F.home)),He=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ft=[ne,xe].find((dt)=>dt!==""&&Br(He(ve),He(dt)));if(ft===void 0)return"";let mt=ve.slice(ft.length);return mt?`~${mt}`:"~"}function gi(M,L,F,q){let{home:ne,normalized:re}=Oc(M,F,q);if(!re)return"";let ue=ne?Mc(re,ne):re;return Gn(Dt(Vs(ue)?ue:qs(L,ue),F.paths,q))}function Oc(M,L,F){let q=L.env.get("HOME")??L.home,ne=q?Gn(Dt(yn(q),L.paths,F)):"",re=Gn(yn(nA(Xn(M,L))));return{home:ne,normalized:re}}function nA(M){if(!M.trim().toLowerCase().startsWith("file:"))return M;try{return Tw(M)}catch{return M}}function Mc(M,L){if(M==="~")return L;if(M.startsWith("~/"))return sn(L,M.slice(2));return M}function rA(M){if(process.platform==="win32")return!0;return Aw.parse(M).root.length>1}function Gn(M){let L=M.trim(),F=(L.includes("\\")&&rA(L)?L.replace(/\\/g,"/"):L).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(F==="/")return F;return F.replace(/\/+$/g,"")}function Br(M,L){return M===L||M.startsWith(L.endsWith("/")?L:`${L}/`)}function Fn(M){return M.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??M}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(M,L,F){super(`CC Safety Net ${M} dependency failed`,{cause:F});this.stage=M;this.evaluation=L}}var oA={findPolicyMutation:Kp,findGitMetadataMutation:Ef,resolveGitMetadata:sA,loadPolicySnapshot:E,findSensitiveTarget:dg,analyzeCommand:zp,getModes:R},iA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function V(M,L){let F={...oA,...L.dependencies},q=cA(M),ne=hi(M)?M.command:q,re=hr("policy-protection",ne,()=>Xo(M)),ue=dn(re,"input-candidate"),ve=dn(re,"declared-command");if(hi(M)&&M.command?.trim()&&ve?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:zn,intent:"stop_and_explain",evidence:{command:M.command,segment:M.command}}};if(ue?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:$f,intent:"stop_and_explain"}};let xe=hn(),He=hr("policy-protection",ne,()=>F.resolveGitMetadata([M.context.executionCwd,M.context.configCwd],L.environment)),ft=hr("policy-protection",ne,()=>F.findPolicyMutation(re,L.environment,xe));if(ft){let Ct=ne??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ge,intent:"hard_stop",evidence:{command:Ct,segment:ft.target}}}}let mt=hr("policy-protection",ne,()=>Up(re,L.environment,xe));if(mt){let Ct=ne??mt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ue,intent:"hard_stop",evidence:{command:Ct,segment:mt.target}}}}let dt=hr("policy-protection",ne,()=>F.findGitMetadataMutation(re,He,L.environment,xe));if(dt){let Ct=ne??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Ct,segment:dt.target}}}}let pt=hr("config-load",ne,()=>F.loadPolicySnapshot(L.environment,{...L.policyOptions,cwd:M.context.configCwd})),gt=pt.policy,ht=F.getModes(gt,L.environment.env),yt={level:ht.effectiveLevel,...aA(pt)},bt=gt.secretProtection.enabled===!1?null:hr("secret-protection",ne,()=>F.findSensitiveTarget(re,gt.secretProtection,L.environment,xe,{strict:hi(M)||ue?.program.dialect==="powershell"?ht.strict:void 0}));if(bt){let Ct=ne??bt.target;return{stage:"secret-protection",...yt,decision:{kind:"deny",reason:ag,intent:"hard_stop",ruleId:bt.ruleId,evidence:{command:Ct,segment:bt.target}}}}if(!hi(M))return{stage:"non-command",...yt,decision:{kind:"allow"}};if(!M.command||M.command.trim()==="")return{...Dc("command-validation",ne),...yt};let St=hr("command-analysis",ne,()=>Bp(()=>F.analyzeCommand(M.command,{cwd:M.context.executionCwd,shell:M.route.shell,policySnapshot:pt,environment:L.environment,protectedGitMetadata:He,effectiveCapabilities:ht.capabilities,strict:ht.strict,paranoidRm:ht.paranoidRm,paranoidInterpreters:ht.paranoidInterpreters,worktreeMode:ht.worktreeMode,budget:xe,...L.trace?{trace:L.trace}:{}},lA(re),re.store),M.command,L.trace));if(St.decision){let Ct=!ht.strict&&(St.decision.ruleId==="raw-text.dangerous-command"||St.decision.reason===ti&&!iA.test(St.decision.evidence?.segment??"")&&wn(M.command)===null);return{stage:"command-analysis",...yt,..."errorCode"in St?{errorCode:St.errorCode}:{},decision:Ct?{...St.decision,unverifiedByStandardMode:!0}:St.decision}}return{stage:"command-analysis",...yt,decision:{kind:"allow"}}}function sA(M,L){let F=[...new Set(M.filter((q)=>typeof q==="string"&&q!==""))].flatMap((q)=>L.gitMetadata(q)??[]);if(F.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(F.flatMap((q)=>q.entries))]),markerFiles:Object.freeze([...new Set(F.flatMap((q)=>q.markerFiles))]),directories:Object.freeze([...new Set(F.flatMap((q)=>q.directories))]),hooksDirectories:Object.freeze([...new Set(F.flatMap((q)=>q.hooksDirectories))])})}function aA(M){if(M.state==="ready")return{};return{configFallback:{reason:M.reason}}}function lA(M){return dn(M,"declared-command")?.program}function cA(M){try{return oe(M.input)}catch(L){let F=hi(M)?M.command:void 0;throw new p("policy-protection",Dc("policy-protection",L instanceof f?void 0:F,L),L)}}function hr(M,L,F){try{return F()}catch(q){throw new p(M,Dc(M,q instanceof f?void 0:L,q),q)}}function Dc(M,L,F){let q=F instanceof s||F instanceof y;return{stage:M,decision:{kind:"deny",reason:q?Js:vo,intent:"stop_and_explain",...L?{evidence:{command:L,segment:L}}:{}}}}function hi(M){return M.route.kind==="command"}
-export{a,s,K,_e,We,k,tt,Be,Se,I,O,J,nt,c,o,ze,we,R,T,Ce,rt,f,_,oe,de,ot,Ve,qe,l,Pe,r,v,i,ie,n,g,pe,j,it,st,u,fe,me,at,D,Y,se,S,ct,U,b,Ee,G,d,Z,Ke,Je,N,w,P,ge,he,Ae,lt,m,e,Ie,ke,Ye,Ze,ae,Re,ce,Oe,X,H,De,ye,W,Xe,B,Q,ee,le,Qe,et,C,z,Ne,Le,Fe,Me,E,$e,Te,je,h,t,te,be,y,x,A,ut,Ue,Ge,p,V};