cc-safety-net 2.5.1 → 2.6.0

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,51 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.5.1
+// version: 2.6.0
 // @bun
-var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Ln="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Nn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Nn},trackedHeredocFiles:{cap:64,...Nn},controlFlowStates:{cap:64,...Nn},wrapperPeelIterations:{cap:20,...Nn},derivedCommandShape:Nn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new N(t)}}}var Bp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function dt(e){return $p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function $p(e){return Bp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Up={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Up[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var wi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Fn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var _i={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Gn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,..._i},processedCandidateBytes:{cap:4194304,..._i},pathEnvironmentExpansion:{cap:64,..._i},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Gn},trackedHeredocFiles:{cap:64,...Gn},controlFlowStates:{cap:64,...Gn},wrapperPeelIterations:{cap:20,...Gn},derivedCommandShape:Gn});class W extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Pe(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new W(t)}}}var rg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ft(e){return og(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function og(e){return rg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var ig={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function sg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":ig[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function Rl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Wn(e={}){return{reason:Ln,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var jp={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...jp[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function wl(e){return Hp({...e,redact:dt})}function _l(e){return dt(e instanceof Error?e.message:String(e))}import{types as Vp}from"util";var Kp=new Set(["applypatch","patch"]),qp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Yp=new Set(["grep","grepsearch","rg"]),Zp=new Set(["find","findbyname","glob"]),Xp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Jp=new Set(["command","diff","input","patch","patchtext"]),Al=new TextEncoder,Qp=new TextDecoder,eg=/\s/,tg=64;class Qe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Gn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ol(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Nr(e){return Xp.has(Ol(e))}function Ai(e){let t=Ol(e);if(Kp.has(t))return"patch";if(Yp.has(t))return"grep";if(Zp.has(t))return"glob";if(qp.has(t))return"path";return"unknown"}function zn(e){if(!e||typeof e!=="object")return;Fl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ml(e,t){return Dl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Dl(e,t,n,r,o){let i=Gl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Dl(l,t,i.array?n:t.has(Nl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Nl(e){return e.replace(/-/g,"_").toLowerCase()}function Ll(e){return Wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(rg)}function Wl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Wl(a,o.array?t:Jp.has(Nl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ng(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Gn.maxDepth||t.nodes>Gn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Gn.maxStringBytes||t.stringBytes>Gn.maxAggregateStringBytes)Ke()}function Gl(e,t,n){if(ng(e,t,n),!e||typeof e!=="object")return null;let r=Fl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Gn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Fl(e){if(Vp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Qe}function rg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=og(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(..._i(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function og(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return ig(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return mg(i[1]);return[]}function ig(e){let t=sg(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=ag(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function sg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Tt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Tt(e[n]))n++;t.push(e.slice(i,n));continue}let o=zl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Tt(e[n]))n++;return n===e.length?t:[]}function ag(e){let t=0;while(t<e.length&&Tt(e[t]))t++;let n=e.length;while(n>t&&Tt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Tt(e[o])){o++;continue}let i=o;while(o<n&&Tt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>tg)Ke();if(lg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function lg(e,t,n,r,o){if(wi(e,t,n,r,o))return!0;let i=Pl(e,"/",t,n),s=Pl(e,"/",r,o);if(i<=t||s<=r)return!1;if(wi(e,t,i,r,s))return!1;return wi(e,i+1,n,s+1,o)}function wi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Pl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Tt(e){return e!==void 0&&eg.test(e)}function zl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Qp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Al.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Al.encode(cg(s[0]??""))),o+=2}return null}function cg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function ug(e){return Fn(fg(e))}function _i(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Fn);let n=dg(e,t)??(e===t?Bl(e):null);return[e,t,...n?[n]:[]].flatMap(Fn)}function Tl(e){let t=Bl(e);return[e,...t?[t]:[]].flatMap(Fn)}function Bl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function dg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return ug(Dr(e,!0))}function mg(e){return Fn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=zl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function fg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Fn(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Eg,resolve as ql,sep as xg}from"path";import{basename as Hl,dirname as pg,isAbsolute as gg,join as hg,normalize as yg,resolve as $l}from"path";var Cg=256,Lr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function et(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=bg(e,o,t);if(a===null){if(Lr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Sg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function bg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Sg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Lr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Lr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Lr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function L(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){jl(n,i);let s=t.realpath(i);if(s!==null)return Ul(n,e,s,o);let a=pg(i);if(a===i||o.length>=Cg)return Ul(n,e,i,o);o.push(Hl(i)),i=a}}function Ul(e,t,n,r){let o=r.length===0?n:hg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function vg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;jl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function jl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Kl(e,t,n);if(!o)return"";return L(o,n.paths,r).replace(/\\/g,"/")}function Vl(e,t,n,r,o){let i=Kl(e,t,n);if(!i)return null;if(o(Hl(i)))return L(i,n.paths,r).replace(/\\/g,"/");let s=vg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Kl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?$l(r,o.slice(2)):o,s=ve(i);return yg(gg(s)?s:$l(t,s))}function Yl(e,t,n){if(et(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:ql(r[0],e),n)[0];if(!o)return;return r.some((i)=>Rg(o,i))?o:void 0}function Zl(e,t,n){if(et(e))return;return Oi(Mi(e)?e:ql(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Rg(e,t){let n=Eg(t,e);return n===""||n!==".."&&!n.startsWith(`..${xg}`)&&!Mi(n)}function nn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Jg,realpathSync as Qg,statSync as eh}from"fs";import{homedir as th,tmpdir as nh}from"os";import{statSync as Yg}from"fs";import{join as Zg}from"path";import{spawnSync as wg}from"child_process";import{existsSync as $n,lstatSync as _g,readFileSync as Un,realpathSync as rn,statSync as Bn}from"fs";import{dirname as Di,isAbsolute as Ni,join as on,resolve as Wr}from"path";var Ag=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Pg=5000;function Jl(e,t=jg(),n=Pg){let r=Tg(e),o=r===null?null:Ig(r);if(r===null||o===null)return null;let i=Ug(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Tg(e){try{let t=rn(Wr(e));return Bn(t).isDirectory()?t:null}catch{return null}}function Ig(e){let t=$g(e);if(!t)return null;try{let n=_g(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!Mg(r.gitDir,t))return null;return Dg(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=kg(e);if(!t)return null;let n=rn(Ni(t)?t:Wr(Di(e),t));if(!Bn(n).isDirectory())return null;return{gitDir:n,commonDir:Og(n)}}catch{return null}}function kg(e){let t=Un(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Og(e){try{let t=Un(on(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=rn(Ni(t)?t:Wr(e,t));return Bn(n).isDirectory()?n:null}catch{return null}}function Mg(e,t){let n=Ng(e);return n===null?!1:Ql(e,n,t)}function Dg(e,t){let n=Lg(e);return n===null?!0:Ql(e,n,t)}function Ng(e){let t=on(e,"gitdir");if(!$n(t))return null;let n=Un(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Lg(e){let t=on(e,"config.worktree");return $n(t)?Gg(t):null}function Ql(e,t,n){try{return Wg(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Wg(e,t){try{let n=Bn(e),r=Bn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Xl(rn.native(e))===Xl(rn.native(t))}function Xl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Gg(e){let t=Un(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Fg(s[1]??"")}return r}function Fg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Bg(t.slice(1,-1))}var zg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Bg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:zg[n]??t)}function $g(e){try{return Wi(rn(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=on(t,".git");if($n(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Ug(e,t,n,r){if(Hg(t))return!0;if(n===null)return!0;let o=wg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Vg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ec(o.stdout.trim())}function Hg(e){return[on(e.commonDir,"config"),on(e.gitDir,"config.worktree")].filter((t)=>$n(t)).some((t)=>Kg(t))}function jg(){return Ag.find((e)=>$n(e))??null}function Hn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Vg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Hn(t)))}function Kg(e){let t;try{t=Un(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(qg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ec(c)}return r}function qg(e){return e==="include"||e.startsWith("includeif ")}function ec(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function tc(e,t){if(e==="")return null;let n=Se(),r=Wi(le(e,e,t,n)),o=r?Xg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Xg(e,t,n,r){try{let o=le(e,t,n,r),i=Yg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[sn(le(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[sn(e.replace(/\\/g,"/")),...l]:l)];return{entry:sn(o),markerFile:s?sn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=sn(Zg(d,"hooks").replace(/\\/g,"/"));return[m,sn(le(m,t,n,r))]}))]}}catch{return null}}function sn(e){return process.platform==="win32"?e.toLowerCase():e}var rh={realpath:(e)=>{try{return Qg(e)}catch{return null}},entryKind:(e)=>{let t=Jg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return eh(e).isDirectory()}catch{return!1}}};function rc(){return oh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ve(process.env.HOME||th()),tmpdir:nh(),paths:rh})}function oh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>nc(n,i,()=>tc(i,o)),worktreeFacts:(i)=>nc(r,i,()=>Jl(i)),...t};return o}function nc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var an=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function ih(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function sh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function ah(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function oc(e){return ah(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=sh(t),o=ih(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(It(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(It(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(It(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(It(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||It(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function It(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"path";import{closeSync as lh,constants as ic,fstatSync as ch,fsyncSync as eT,lstatSync as Hi,mkdirSync as tT,openSync as uh,readdirSync as nT,readFileSync as dh,realpathSync as ji,renameSync as rT,rmdirSync as oT,statSync as mh,unlinkSync as iT,writeFileSync as sT}from"fs";import{isAbsolute as sc,join as Vi,normalize as fh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var ph=Symbol("PolicyFilesystemScope"),gh=Symbol("PolicyFilesystemTarget"),hh=ic.O_NOFOLLOW??0;class ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function kt(e,t){return{[ph]:!0,root:qi(e),label:t}}function ac(e,t){let n=fh(t);if(t===""||sc(t)||n===".."||n.startsWith(`..${Yi}`))throw new ce(e.label);return{[gh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function jn(e,t){return ac(e,Ki(e.root,qi(t)))}function lc(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return ac(kt(r,t),Ki(r,n))}function Br(e){return uc(e.scope.label,()=>{if(!zr(e))return null;let t=uh(e.path,ic.O_RDONLY|hh);return yh(t,()=>{let n=ch(t);if(!n.isFile())throw new ce(e.scope.label);let r=dh(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ce(e.scope.label);return zr(e),r})})}function cc(e,t){if(e.path===t.path)return!0;return uc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function uc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ce)throw r;throw new ce(e)}}function yh(e,t){try{return t()}finally{lh(e)}}function zr(e,t="file"){let n=Ch(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ce(e.scope.label);bh(n,ji(i),e.scope.label)}return!0}function Ch(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!mh(e.root).isDirectory())throw new ce(e.label);return ji(e.root)}function bh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||sc(r))throw new ce(n)}import{dirname as Mt,isAbsolute as Rh,join as Nt,relative as wh,resolve as Dt,sep as _h}from"path";var Ot=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,dc="rulebook.json",mc=".cc-safety-net/rules";var fc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Sh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,vh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Eh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uT=new RegExp(`^${vh}/(${Ot.source.slice(1,-1)})/${Eh}$`);function xh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function pc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Ot.test(e)?null:`Local rulebook sources must be bare names matching ${Ot}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(fc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Sh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Ot.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:xh(o),name:o}}function $r(e){return fc.test(e)}var gc="rule.json",Ur="policy.json",hc=".cc-safety-net",Ah="rules",Ph="CC_SAFETY_NET_HOME",yc="`cc-safety-net rule update`";function Th(e){return Dt(e,mc)}function Ih(e){return Nt(Th(e),gc)}function Vn(e){return Nt(Dt(e),hc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Mt(t.userConfigPath):Nt(kh(e),Ah))}function kh(e){let t=e.env.get(Ph);return t?Dt(ve(t)):Nt(e.home,hc)}function Oh(e,t={}){return Nt(Xi(e,t),gc)}function ln(e,t={}){return Nt(Mt(Xi(e,t)),Ur)}function Cc(e,t){let n=t.userConfigPath??Oh(e,t),r=t.projectConfigPath??Ih(t.cwd),o=Mh(e,t),i=Dh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:jn(o,n),projectConfigTarget:jn(i,r)}}function Mh(e,t){let n=t.userConfigPath?Mt(Mt(Dt(t.userConfigPath))):Mt(Dt(t.userConfigDir??Xi(e,t)));return kt(n,"user policy")}function Dh(e,t){let n=Dt(t),r=Dt(e),o=wh(n,r);if(o!==".."&&!o.startsWith(`..${_h}`)&&!Rh(o))return kt(n,"project policy");return kt(Mt(Mt(r)),"project policy")}function bc(e,t){return Nt(e,t,dc)}var Ee=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),mt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ft=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Sc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,Pe=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var vc="Rulebook exceeds CC Safety Net's safe validation limits.",Ec="Additional rulebook validation errors were omitted.",Me=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function xc(e){if(Ji(e.allowed_commands,Me.maxAllowedCommands)||Ji(e.rules,Me.maxRules)||Ji(e.tests,Me.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Me,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Me.maxStringCodeUnits||i&&o.length>Me.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Me.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return T(e).toLowerCase()}function T(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Nh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Nh[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function xe(e){let t=T(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Kn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Lh(e))Kn(n,t);return t.inSingle||t.inDouble}function Lh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Kn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Wh=new Set(["git","busybox",...os,...Y,...Sc,...Pe]),Gh=new Set(["python","node","ruby","perl"]);function Rc(e){let t=O(e);return Wh.has(t)||De(t)}function De(e){return Gh.has(Fh(e))}function Fh(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(zh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Uh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function zh(e){return typeof e==="string"?lc(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function wc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Bh=/^[^/]+\/[^/]+$/,$h=["version","rules","overrides","transparent_wrappers"];function Uh(e){let t=Hh(e);return{errors:as(Qh(t,$h,(n)=>n.kind==="custom"),": "," "),sources:Jh(e,t)}}function Hh(e){if(!cn(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[w(["version"],"must be 1")],...jh(e.rules,t),...qh(e.overrides),...Zh(e.transparent_wrappers),...t?[]:Kh(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Bh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Xh(e.transparent_wrappers)]}function jh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),..._c(e,es)?[w(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...Vh(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function _c(e,t){let n=Ac(e);return n!==void 0&&!(n<=t)}function Vh(e,t){let n=Ac(e);return n!==void 0&&!(n>=t)}function Ac(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Kh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=pc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function qh(e){if(e===void 0)return[];if(!cn(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[w(["overrides",t],'must be "off" or an object')];return[...Yh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[w(["overrides",t,"intent"],ss)]]})}function Yh(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),..._c(e,ft)?[w(t,`must be at most ${ft} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>ft?[w(t,`must be at most ${ft} characters`)]:[]}function Zh(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return mt.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function Xh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!mt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Rc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Jh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Qh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e){let t=ny(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ey=`required non-empty string up to ${ft} characters`,Pc="must be a non-empty array of unique non-empty strings",ty="required non-empty array of non-empty strings";function ny(e){if(!pt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!xc(e))return{errors:[vc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ry(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Me.maxValidationErrors?[...t.slice(0,Me.maxValidationErrors),Ec]:t,ruleNames:new Set(Ic(e).map((n)=>n.toLowerCase()))}}function Ic(e){let t=pt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=pt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ry(e,t){return[...typeof e.name==="string"&&Ot.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...oy(e.allowed_commands),...iy(e.rules,t),...cy(e.tests),...uy(e),...dy(e)]}function oy(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&mt.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!mt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function iy(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!pt(n))return[w(["rules",r],"must be an object")];return t?ay(n,["rules",r]):sy(n,["rules",r])}),...wc(e)]}function sy(e,t){return[...kc(e.name,t),...Oc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&mt.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Mc(e.reason,t),...Dc(e.intent,t)]}function ay(e,t){return[...kc(e.name,t),...Oc(e.command,t),...Mc(e.reason,t),...Dc(e.intent,t),...ly(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function kc(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return Ot.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function Oc(e,t){return typeof e==="string"&&mt.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function Mc(e,t){return typeof e==="string"&&e!==""&&e.length<=ft?[]:[w([...t,"reason"],ey)]}function Dc(e,t){return e===void 0||cs(e)?[]:[w([...t,"intent"],ss)]}function ly(e,t){if(!pt(e))return[w(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],ty,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],Pc,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],Pc,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function cy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!pt(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function uy(e){if(!Array.isArray(e.tests))return[];let t=new Set(Ic(e));return[...new Set(e.tests.flatMap((n)=>pt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function dy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=pt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function pt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function zc(e,t){let n=Cc(e,t),r;try{r=cc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ce)return Sy(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Gc(n.userConfigPath,o.errors),a=Gc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Nc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Fc(),d=i.config?Nc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Fc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Lc(c.rules,m),...Lc(d.rules,u)],transparent_wrappers:Cy(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Wc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?by(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Wc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Nc(e,t,n,r=kt(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=fy(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:my(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function my(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function fy(e,t,n){let r=py(e),o=bc(t,r),i=hy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${gy(e)}`]};let s=yy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function py(e){return $r(e)?Zi(e).name:e}function gy(e){return $r(e)?`run ${yc} to vendor ${e}`:"create that file or remove that source from the rules config"}function hy(e,t){try{return{content:Br(jn(t,e))}}catch(n){if(n instanceof ce)return{error:n.message};throw n}}function yy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Tc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Cy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Lc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function by(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Gc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Sy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Fc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Oy,readFileSync as My}from"fs";var Bc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(Bc.map((e)=>e.id)),Yr=Bc,vy=new Map(Yr.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:vy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Ey=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],xy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...xy.flatMap((e)=>Ey.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],$c=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ry=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=$c.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=$c.flatMap((e)=>Ry.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),qn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],wy=[...ds,Zr,...ms,...fs,...ps,qn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(wy.map((e)=>e.id));import{isAbsolute as Cs,join as _y,normalize as Ay,sep as Qr}from"path";var eo=process.platform==="win32",Uc=/[*?]/;function bs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Uc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Yn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Yn(e.trim(),t);if(!Cs(n))return"must be an absolute path or start with ~/";return Zn(n,t)}function vs(e,t){let n=Hc(e,t);if(n===null)return"must be a non-empty path string";if(!Cs(n))return null;if(Zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Py="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ty="cannot cover the guard's own configuration";function Hc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Yn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Hc(e,t);if(n===null)return"must be a non-empty path string";let r=bs(n)?.root??n;if(Uc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Cs(r))return null;if(Zn(r,t)!==null)return Py;return Iy(r,t)?Ty:null}function Iy(e,t){let n=to(e),r=to(_y(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function Zn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=Ay(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var jc=30,no=1,ro=365;function Vc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Kc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Kc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Kc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function qc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Yc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:qc(e,t)})}var Zc={standard:0,strict:1,paranoid:2};function Qc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ky(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function ky(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&Zc[n]<Zc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...an.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Xc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Xc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Jc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Jc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Xc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Jc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var _s=new Set(["standard","strict","paranoid"]),ru={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:jc}};function ou(e,t){let n=Uy(ln(e,t),e.home),r=so(Vn(t.cwd),e.home),o=Ny(r.parsed,e.home),i=Object.keys(o.policy).length>0?Qc(n.gui??ru,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ws(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Dy="project policy audit settings are ignored; audit is user scope only";function Ny(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={..._s.has(n.level)?{level:n.level}:{},...Re(n.overrides)?eu({overrides:iu(n.overrides,an,["safety","overrides"],Lt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,au,Lt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Lt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,lu,Lt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Lt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Lt)}:{}};return{policy:eu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Dy]}}function iu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],As));return[]}))}function eu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Lt=()=>{return},As="must be a boolean",Ps="must be an object if provided",su=`must be an integer between ${no} and ${ro}`,au={path:["destructive_command_protection","overrides"],label:"destructive command"},lu={path:["secret_protection","overrides"],label:"secret protection"},Ly=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Wy(e,t){let n=[];return{policy:cu(e,t,(o)=>{n.push(o)}),issues:n}}function Gy(e,t){return cu(e,t,Lt)}function cu(e,t,n){if(!Re(e))return n(w([],"Config must be an object")),oo();if(e.version!==1)n(w(["version"],"must be 1"));let r=un(e.safety,["safety"],["level","overrides"],n),o=un(r.overrides,["safety","overrides"],an,n),i=un(e.workflow,["workflow"],["worktree_mode"],n),s=un(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,["audit"],["retention_days"],n);return uu(e,Ly,[],n),{version:1,safety:{level:Fy(r.level,n),overrides:iu(o,an,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,au,n),allow_paths:dn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,lu,n),deny_paths:dn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:dn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:zy(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(w(t,Ps)),{};return uu(e,n,t,r),e}function uu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Fy(e,t){if(e===void 0)return"standard";if(_s.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,As));return n}function zy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(w(["audit","retention_days"],su));return Vc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(w(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):w([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(ru)}function so(e,t){if(!Oy(e))return{exists:!1,policy:oo(),errors:[]};try{let n=My(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Wy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${$y(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var By=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[su,`not an integer between ${no} and ${ro}`]]);function $y(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=By.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Uy(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:nu(),errors:[]};let o=Gy(r,t);return{policy:ws(o),gui:o,errors:[],levelPresent:tu(r)}}if(n.parsed===void 0)return{policy:nu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ws(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:tu(n.parsed)}}function tu(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return _s.has(t.level)}function du(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function nu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:du({}),denyPaths:[],allowPaths:[]}}}function ws(e){return{safety:Hy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:du(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Hy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function mu(e,t){let n=zc(e,t),r=ou(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...qy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Yy(o,jy(n,r),s,r.policyScopes)}function jy(e,t){let n=Ky(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Zy(e.errors.length>0?Vy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Vy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Ky(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function qy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Yy(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function Zy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function fu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Yc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as QR,isAbsolute as ew,join as tw,parse as nw,resolve as rw,sep as ow}from"path";function Xn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Xy=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Jn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Xy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var gt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Jy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function mn(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Jy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||gu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!gu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=pu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=pu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Qy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?eC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function pu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function gu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Qy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function eC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var bu=new Set(["&&","||","|","|&"]),tC=new Set(["!","do","elif","else","if","then","until","while"]);function Su(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),Cu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(ho(f)){if(f===`
-`||f==="\r"){m();let A=f==="\r"&&e[u+1]===`
-`?u+2:u+1,E=a.at(-1);if(E?.kind!=="connector"||!bu.has(E.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,A),span:Object.freeze({start:u,end:A})}));if(d.length>0){let I=Ds(e,A,n,d.splice(0));l.push(...I.issues),u=I.next;continue}u=A;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?EC(e,u,n):void 0;if(p){if(Ls(a,l),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return fn(a,l,u,"word-limit",r.maxWords);let A=po(e,p.braceIndex+1,n,r,o,i+1,"}"),E=A.next,I={start:p.braceIndex+1,end:A.closed?E-1:E},W=hu(e,I,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:E},body:W}),l.push(...A.issues),A.pendingHeredocs.length>0||er(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return fo(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=E;continue}let g=go(e,u);if(g){if(m(),!Pu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:u,end:u+g.length})})),u+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&cC(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);let A=f==="("?")":"}",E=po(e,u+1,n,r,o,i+1,A),I=E.next,W={start:u+1,end:E.closed?I-1:I},Q=hu(e,W,E);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:I},body:Q}),l.push(...E.issues),E.pendingHeredocs.length>0||er(E.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...E.pendingHeredocs),E.limited)return fo(a,l,E.next);if(!E.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=I;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?iC(e,u):null;if(h){let A=c.words.at(-1),E=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(E!==void 0)c.words.pop();let I=E===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let W=u+h.length;while(W<n&&/[ \t]/.test(e[W]??""))W++;let Q=e[W],Je=W>u+h.length&&Q==="#",Ce=!Q||ho(Q)||!!go(e,W)||Q===s||Q===")"||Je||(Q==="<"||Q===">")&&e[W+1]!=="(",At=h==="<<"||h==="<<-",z=At?Ms(e,W,n):void 0,D=z?{word:mn(e,W,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!Ce?Ws(e,W,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return fo(a,l,D.next);if(!Ns(o))return fn(a,l,D.next,"word-limit",r.maxWords)}let ae=D?.next??u+h.length,X={kind:"redirection",operator:h,span:{start:I,end:ae},...E===void 0?{}:{fd:E},...D?{target:D.word}:{}};if(c.redirections.push(X),At&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let J=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:h==="<<-",attach:(be)=>{if(X.heredoc=be,be.quotedDelimiter)return;J.push(...rC(e,be.bodySpan.start,be.bodySpan.end,r,o,i+1))}})}if(!At&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ae,u=ae;continue}let y=c.start===-1;if(y)Ls(a,l);let b=Ws(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return fo(a,l,b.next);let C=mC(c.words)?yC(e,b.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(C?.limitCode)return fn(a,l,b.next,C.limitCode,C.limitCode==="word-limit"?r.maxWords:C.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let x=C?.words??[b.word];for(let A of x){if(!Ns(o))return fn(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&Tu(b.word))m();u=b.next>u?b.next:u+1}return m(),Cu(a,l),l.push(...xC(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function hu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=nC(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=Qn(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=sC(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?Co(e,a,n,r,o,i):null;if(g){let h=vu(g,d,m);if(u||=h.limited,c=Qn(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=Ru(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Qn(c,"glob");s+=f,a++}return{word:mn(e,t,a,s,c,l,c==="literal"?void 0:lC(e,t,a)),nested:d,issues:m,next:a,limited:u}}function nC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`)}function Il(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function zn(e={}){return{reason:Fn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var ag={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Ai(e,t={}){return{...ag[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Tl(e){return sg({...e,redact:ft})}function kl(e){return ft(e instanceof Error?e.message:String(e))}import{types as lg}from"util";var cg=new Set(["applypatch","patch"]),ug=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),dg=new Set(["grep","grepsearch","rg"]),mg=new Set(["find","findbyname","glob"]),fg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),pg=new Set(["command","diff","input","patch","patchtext"]),Ol=new TextEncoder,gg=new TextDecoder,hg=/\s/,yg=64;class Je extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Bn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Wl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Gr(e){return fg.has(Wl(e))}function ki(e){let t=Wl(e);if(cg.has(t))return"patch";if(dg.has(t))return"grep";if(mg.has(t))return"glob";if(ug.has(t))return"path";return"unknown"}function Un(e){if(!e||typeof e!=="object")return;Hl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Gl(e,t){return Fl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Fl(e,t,n,r,o){let i=Ul(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Fl(l,t,i.array?n:t.has(zl(a)),r,o+1));return r.ancestors.delete(i.object),s}function zl(e){return e.replace(/-/g,"_").toLowerCase()}function Bl(e){return $l(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Cg)}function $l(e,t,n,r){let o=Ul(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>$l(a,o.array?t:pg.has(zl(s)),n,r+1));return n.ancestors.delete(o.object),i}function bg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Bn.maxDepth||t.nodes>Bn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Bn.maxStringBytes||t.stringBytes>Bn.maxAggregateStringBytes)Ke()}function Ul(e,t,n){if(bg(e,t,n),!e||typeof e!=="object")return null;let r=Hl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Bn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Hl(e){if(lg.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Je}function Cg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Sg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Pi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Pi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ti(Wr(c.slice(4),!0),Wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Pi(c))}return t}function Sg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Pi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ll(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ll(n[1]);if(e.startsWith("diff --git "))return vg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Nl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Nl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Pg(i[1]);return[]}function vg(e){let t=Eg(e);if(t.length===2&&t[0]&&t[1])return Ti(t[0],t[1]);let n=xg(e);return n?Ti(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Eg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(kt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!kt(e[n]))n++;t.push(e.slice(i,n));continue}let o=jl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(kt(e[n]))n++;return n===e.length?t:[]}function xg(e){let t=0;while(t<e.length&&kt(e[t]))t++;let n=e.length;while(n>t&&kt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!kt(e[o])){o++;continue}let i=o;while(o<n&&kt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>yg)Ke();if(Rg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Rg(e,t,n,r,o){if(Ii(e,t,n,r,o))return!0;let i=Ml(e,"/",t,n),s=Ml(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ii(e,t,i,r,s))return!1;return Ii(e,i+1,n,s+1,o)}function Ii(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Ml(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function kt(e){return e!==void 0&&hg.test(e)}function jl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:gg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Ol.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Ol.encode(_g(s[0]??""))),o+=2}return null}function _g(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function wg(e){return $n(Ig(e))}function Ti(e,t){if(e==="/dev/null")return Dl(t);if(t==="/dev/null")return Dl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap($n);let n=Ag(e,t)??(e===t?Vl(e):null);return[e,t,...n?[n]:[]].flatMap($n)}function Dl(e){let t=Vl(e);return[e,...t?[t]:[]].flatMap($n)}function Vl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Ag(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Nl(e){return wg(Wr(e,!0))}function Pg(e){return $n(Wr(e,!1))}function Wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=jl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Ig(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function $n(e){return e===""||e==="/dev/null"?[]:[e]}function Ll(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Wi,relative as Gg,resolve as Ql,sep as Fg}from"path";import{basename as Yl,dirname as Tg,isAbsolute as kg,join as Og,normalize as Mg,resolve as Kl}from"path";var Dg=256,Fr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ni(e,t){return Oi(e,0,t)}function Oi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Mi(e,o+2),a=Ng(e,o,t);if(a===null){if(Fr.has(s))throw new W("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Lg(l,t,n),o=a+1;continue}let i=Mi(e,o+1);if(!i){r+="$",o++;continue}r+=Di(i,n)??`$${i}`,o+=i.length+1}return r}function Ng(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new W("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Lg(e,t,n){let r=e.slice(2,-1),o=Mi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Di(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Fr.has(o))throw new W("pathEnvironmentExpansion");return e}if(!Fr.has(o))return e;if(s.endsWith("="))throw new W("pathEnvironmentExpansion");let a=Di(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new W("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Oi(i.slice(s.length),t+1,n);return l?Oi(i.slice(s.length),t+1,n):""}function Mi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Di(e,t){if(!Fr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function D(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Zl(n,i);let s=t.realpath(i);if(s!==null)return ql(n,e,s,o);let a=Tg(i);if(a===i||o.length>=Dg)return ql(n,e,i,o);o.push(Yl(i)),i=a}}function ql(e,t,n,r){let o=r.length===0?n:Og(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Wg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Zl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Zl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Jl(e,t,n);if(!o)return"";return D(o,n.paths,r).replace(/\\/g,"/")}function Xl(e,t,n,r,o){let i=Jl(e,t,n);if(!i)return null;if(o(Yl(i)))return D(i,n.paths,r).replace(/\\/g,"/");let s=Wg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Jl(e,t,n){let r=n.home,o=Ni(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Kl(r,o.slice(2)):o,s=ve(i);return Mg(kg(s)?s:Kl(t,s))}function ec(e,t,n){if(Qe(e))return;let r=t.flatMap((i)=>Li(i,n));if(!r[0])return;let o=Li(Wi(e)?e:Ql(r[0],e),n)[0];if(!o)return;return r.some((i)=>zg(o,i))?o:void 0}function tc(e,t,n){if(Qe(e))return;return Li(Wi(e)?e:Ql(t,e),n)[0]}function Li(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function zg(e,t){let n=Gg(t,e);return n===""||n!==".."&&!n.startsWith(`..${Fg}`)&&!Wi(n)}function Gi(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as ph,realpathSync as gh,statSync as hh}from"fs";import{homedir as yh,tmpdir as bh}from"os";import{statSync as dh}from"fs";import{join as mh}from"path";import{spawnSync as Bg}from"child_process";import{existsSync as jn,lstatSync as $g,readFileSync as Vn,realpathSync as on,statSync as Hn}from"fs";import{dirname as Fi,isAbsolute as zi,join as sn,resolve as zr}from"path";var Ug=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Hg=5000;function rc(e,t=ah(),n=Hg){let r=jg(e),o=r===null?null:Vg(r);if(r===null||o===null)return null;let i=ih(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function jg(e){try{let t=on(zr(e));return Hn(t).isDirectory()?t:null}catch{return null}}function Vg(e){let t=oh(e);if(!t)return null;try{let n=$g(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Bi(t);if(!r?.commonDir)return null;if(!Yg(r.gitDir,t))return null;return Zg(r.gitDir,Fi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Bi(e){try{let t=Kg(e);if(!t)return null;let n=on(zi(t)?t:zr(Fi(e),t));if(!Hn(n).isDirectory())return null;return{gitDir:n,commonDir:qg(n)}}catch{return null}}function Kg(e){let t=Vn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function qg(e){try{let t=Vn(sn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=on(zi(t)?t:zr(e,t));return Hn(n).isDirectory()?n:null}catch{return null}}function Yg(e,t){let n=Xg(e);return n===null?!1:oc(e,n,t)}function Zg(e,t){let n=Jg(e);return n===null?!0:oc(e,n,t)}function Xg(e){let t=sn(e,"gitdir");if(!jn(t))return null;let n=Vn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Jg(e){let t=sn(e,"config.worktree");return jn(t)?eh(t):null}function oc(e,t,n){try{return Qg(zi(t)?t:zr(e,t),n)}catch{return!1}}function Qg(e,t){try{let n=Hn(e),r=Hn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return nc(on.native(e))===nc(on.native(t))}function nc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function eh(e){let t=Vn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=th(s[1]??"")}return r}function th(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return rh(t.slice(1,-1))}var nh={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function rh(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:nh[n]??t)}function oh(e){try{return $i(on(e))}catch{return null}}function $i(e){let t=e;while(!0){let n=sn(t,".git");if(jn(n))return n;let r=Fi(t);if(r===t)return null;t=r}}function ih(e,t,n,r){if(sh(t))return!0;if(n===null)return!0;let o=Bg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:lh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ic(o.stdout.trim())}function sh(e){return[sn(e.commonDir,"config"),sn(e.gitDir,"config.worktree")].filter((t)=>jn(t)).some((t)=>ch(t))}function ah(){return Ug.find((e)=>jn(e))??null}function Kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function lh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Kn(t)))}function ch(e){let t;try{t=Vn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(uh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ic(c)}return r}function uh(e){return e==="include"||e.startsWith("includeif ")}function ic(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function sc(e,t){if(e==="")return null;let n=Pe(),r=$i(le(e,e,t,n)),o=r?fh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function fh(e,t,n,r){try{let o=le(e,t,n,r),i=dh(e),s=i.isFile()?o:null,a=i.isFile()?Bi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[an(le(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[an(e.replace(/\\/g,"/")),...l]:l)];return{entry:an(o),markerFile:s?an(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=an(mh(u,"hooks").replace(/\\/g,"/"));return[m,an(le(m,t,n,r))]}))]}}catch{return null}}function an(e){return process.platform==="win32"?e.toLowerCase():e}var Ch={realpath:(e)=>{try{return gh(e)}catch{return null}},entryKind:(e)=>{let t=ph(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return hh(e).isDirectory()}catch{return!1}}};function lc(){return Sh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ve(process.env.HOME||yh()),tmpdir:bh(),paths:Ch})}function Sh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>ac(n,i,()=>sc(i,o)),worktreeFacts:(i)=>ac(r,i,()=>rc(i)),...t};return o}function ac(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var ln=["fail_closed","paranoid_rm","paranoid_interpreters"],Br={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Z={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},$r=["standard","strict","paranoid"];function cc(e,t){if(!t)return e;return $r.indexOf(t)>$r.indexOf(e)?t:e}function uc(e){let t=Ur(Z.level,e);return $r.find((n)=>n===t)}function dc(e,t){return cc(e,uc(t))}function vh(e){let t=Ur(Z.level,e);if(!t)return;let n=uc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${Z.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${$r.join(", ")}.`);return}function Eh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function mc(e){return Eh(Ur(Z.auditScope,e))==="all"}function Hi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ji(e={},t){let n=e.safety?.level??"standard",r=vh(t),o=cc(n,r),i=Br[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Z.level.name}=${r}`),l.paranoidRm.push(`env ${Z.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Z.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(et(Z.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Z.strict.name}`);if(et(Z.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Z.paranoid.name}`),l.paranoidInterpreters.push(`env ${Z.paranoid.name}`);if(et(Z.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Z.paranoidRm.name}`);if(et(Z.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Z.paranoidInterpreters.name}`);let c=!!e.worktreeMode||et(Z.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Hi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function et(e,t){let n=typeof e==="string"?Ui(e,t):Ur(e,t);return n==="1"||n?.toLowerCase()==="true"}function Ui(e,t){return t.get(e)}function Ur(e,t){let n=Ui(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Ui(e.legacyName,t);return}import{dirname as Jr}from"path";import{closeSync as xh,constants as fc,fstatSync as Rh,fsyncSync as EI,lstatSync as qi,mkdirSync as xI,openSync as _h,readdirSync as RI,readFileSync as wh,realpathSync as Yi,renameSync as _I,rmdirSync as wI,statSync as Ah,unlinkSync as AI,writeFileSync as PI}from"fs";import{isAbsolute as pc,join as Zi,normalize as Ph,parse as Ki,relative as Xi,resolve as Ji,sep as Qi}from"path";function Vi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Ih=Symbol("PolicyFilesystemScope"),Th=Symbol("PolicyFilesystemTarget"),kh=fc.O_NOFOLLOW??0;class ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Ot(e,t){return{[Ih]:!0,root:Ji(e),label:t}}function gc(e,t){let n=Ph(t);if(t===""||pc(t)||n===".."||n.startsWith(`..${Qi}`))throw new ce(e.label);return{[Th]:!0,scope:e,relativePath:n,path:Zi(e.root,n)}}function qn(e,t){return gc(e,Xi(e.root,Ji(t)))}function hc(e,t="rules policy"){let n=Ji(e),r=Ki(n).dir;return gc(Ot(r,t),Xi(r,n))}function jr(e){return bc(e.scope.label,()=>{if(!Hr(e))return null;let t=_h(e.path,fc.O_RDONLY|kh);return Oh(t,()=>{let n=Rh(t);if(!n.isFile())throw new ce(e.scope.label);let r=wh(t,"utf-8"),o=qi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ce(e.scope.label);return Hr(e),r})})}function yc(e,t){if(e.path===t.path)return!0;return bc(e.scope.label,()=>{if(!Hr(e)||!Hr(t))return!1;let n=(r)=>Zi(Yi(Ki(r).dir),Ki(r).base);return n(e.path)===n(t.path)})}function bc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ce)throw r;throw new ce(e)}}function Oh(e,t){try{return t()}finally{xh(e)}}function Hr(e,t="file"){let n=Mh(e.scope);if(!n)return!1;let r=e.relativePath.split(Qi);for(let o of r.keys()){let i=Zi(e.scope.root,...r.slice(0,o+1)),s=qi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ce(e.scope.label);Dh(n,Yi(i),e.scope.label)}return!0}function Mh(e){if(!qi(e.root,{throwIfNoEntry:!1}))return null;if(!Ah(e.root).isDirectory())throw new ce(e.label);return Yi(e.root)}function Dh(e,t,n){let r=Xi(e,t);if(r===".."||r.startsWith(`..${Qi}`)||pc(r))throw new ce(n)}import{dirname as Dt,isAbsolute as Fh,join as Nt,relative as zh,resolve as pt,sep as Bh}from"path";var Mt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Cc="rulebook.json",Sc=".cc-safety-net/rules";var vc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Nh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Lh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Wh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),OI=new RegExp(`^${Lh}/(${Mt.source.slice(1,-1)})/${Wh}$`);function Gh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Ec(e){if(Vr(e))try{return es(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Mt.test(e)?null:`Local rulebook sources must be bare names matching ${Mt}: ${e}`}function es(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(vc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Nh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Mt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Gh(o),name:o}}function Vr(e){return vc.test(e)}var xc="rule.json",Kr="policy.json",Rc=".cc-safety-net",$h="rules",Uh="CC_SAFETY_NET_HOME",_c="`cc-safety-net rule update`";function Hh(e){return pt(e,Sc)}function jh(e){return Nt(Hh(e),xc)}function cn(e){return Nt(pt(e),Rc,Kr)}function ts(e,t={}){return t.userConfigDir??(t.userConfigPath?Dt(t.userConfigPath):Nt(Vh(e),$h))}function Vh(e){let t=e.env.get(Uh);return t?pt(ve(t)):Nt(e.home,Rc)}function Kh(e,t={}){return Nt(ts(e,t),xc)}function Lt(e,t={}){return Nt(Dt(ts(e,t)),Kr)}function wc(e,t){let n=Pe();return D(cn(t.cwd),e.paths,n)===D(pt(Lt(e,t)),e.paths,n)}function Ac(e,t){let n=t.userConfigPath??Kh(e,t),r=t.projectConfigPath??jh(t.cwd),o=qh(e,t),i=Yh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:qn(o,n),projectConfigTarget:qn(i,r)}}function qh(e,t){let n=t.userConfigPath?Dt(Dt(pt(t.userConfigPath))):Dt(pt(t.userConfigDir??ts(e,t)));return Ot(n,"user policy")}function Yh(e,t){let n=pt(t),r=pt(e),o=zh(n,r);if(o!==".."&&!o.startsWith(`..${Bh}`)&&!Fh(o))return Ot(n,"project policy");return Ot(Dt(Dt(r)),"project policy")}function Pc(e,t){return Nt(e,t,Cc)}var Ee=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),gt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ht=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Ic=new Set(["python","python3","python2","node","ruby","perl"]),qr=/^python(?:[23](?:\.\d+)*)?$/,Ie=new Set(["awk","gawk","nawk","mawk"]),Yr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Tc="Rulebook exceeds CC Safety Net's safe validation limits.",kc="Additional rulebook validation errors were omitted.",Me=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Oc(e){if(ns(e.allowed_commands,Me.maxAllowedCommands)||ns(e.rules,Me.maxRules)||ns(e.tests,Me.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Me,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Me.maxStringCodeUnits||i&&o.length>Me.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Me.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ns(e,t){return Array.isArray(e)&&e.length>t}var rs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var os=64,is="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return A(e).toLowerCase()}function A(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Zh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ss=new Set(["--init-file","--rcfile"]);function as(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Zh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function xe(e){let t=A(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ss.has(l)&&!s.includes("="))i++;continue}let a=as(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Yn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Zr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Xh(e))Yn(n,t);return t.inSingle||t.inDouble}function Xh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Yn(s,n)}return t}var ls=new Set(["rm","find","xargs","parallel"]),Jh=new Set(["git","busybox",...ls,...Y,...Ic,...Ie]),Qh=new Set(["python","node","ruby","perl"]);function Mc(e){let t=O(e);return Jh.has(t)||De(t)}function De(e){return Qh.has(ey(e))}function ey(e){let t=A(e).toLowerCase();return qr.test(t)?"python":t}function cs(e){try{let t=jr(ty(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=oy(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function ty(e){return typeof e==="string"?hc(e):e}var R=(e,t)=>({path:e,message:t,kind:"typed"}),re=(e,t)=>({path:e,message:t,kind:"custom"});function Dc(e){let t=new Set;return e.flatMap((n,r)=>{let o=un(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[re(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var us=`must be one of ${rs.join(", ")}`,ny=/^[^/]+\/[^/]+$/,ry=["version","rules","overrides","transparent_wrappers"];function oy(e){let t=iy(e);return{errors:ds(py(t,ry,(n)=>n.kind==="custom"),": "," "),sources:fy(e,t)}}function iy(e){if(!un(e))return[R([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>os;return[...e.version===1?[]:[R(["version"],"must be 1")],...sy(e.rules,t),...cy(e.overrides),...dy(e.transparent_wrappers),...t?[]:ly(e.rules),...un(e.overrides)?Object.keys(e.overrides).filter((n)=>!ny.test(n)).map((n)=>re(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...my(e.transparent_wrappers)]}function sy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[R(["rules"],"must be an array of rulebook source strings"),...Nc(e,os)?[R(["rules"],is)]:[]];if(t)return[{path:["rules"],message:is,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[R(["rules",r],"must be a rulebook source string"),...ay(n,1)?[R(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[R(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Nc(e,t){let n=Lc(e);return n!==void 0&&!(n<=t)}function ay(e,t){let n=Lc(e);return n!==void 0&&!(n>=t)}function Lc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ly(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[re(["rules",r],"must be a non-empty rulebook source string")];let o=Ec(n);if(o)return[re(["rules",r],o)];if(t.has(n))return[re(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function cy(e){if(e===void 0)return[];if(!un(e))return[R(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!un(n))return[R(["overrides",t],'must be "off" or an object')];return[...uy(n.reason,["overrides",t,"reason"]),...n.intent===void 0||fs(n.intent)?[]:[R(["overrides",t,"intent"],us)]]})}function uy(e,t){if(typeof e!=="string")return[R(t,"required non-empty string"),...Nc(e,ht)?[R(t,`must be at most ${ht} characters`)]:[]];if(e==="")return[R(t,"required non-empty string")];return e.length>ht?[R(t,`must be at most ${ht} characters`)]:[]}function dy(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[R(["transparent_wrappers",n],"must be a command string")];return gt.test(t)?[]:[R(["transparent_wrappers",n],"must match command pattern")]})}function my(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!gt.test(n))return[];if(t.has(n))return[re(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Mc(n))return[re(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function fy(e,t){let n=un(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function py(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ds(e,t,n){return[...new Set(e.map((r)=>{let o=ms(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ms(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function fs(e){return rs.includes(e)}function un(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Gc(e){let t=yy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var gy=`required non-empty string up to ${ht} characters`,Wc="must be a non-empty array of unique non-empty strings",hy="required non-empty array of non-empty strings";function yy(e){if(!yt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Oc(e))return{errors:[Tc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ds(by(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Me.maxValidationErrors?[...t.slice(0,Me.maxValidationErrors),kc]:t,ruleNames:new Set(Fc(e).map((n)=>n.toLowerCase()))}}function Fc(e){let t=yt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=yt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function by(e,t){return[...typeof e.name==="string"&&Mt.test(e.name)?[]:[R(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[R(["version"],"required non-empty string")],...Cy(e.allowed_commands),...Sy(e.rules,t),...Ry(e.tests),..._y(e),...wy(e)]}function Cy(e){if(!Array.isArray(e))return[R(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&gt.test(n)?[]:[R(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!gt.test(n))return[];if(t.has(n))return[re(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Sy(e,t){if(!Array.isArray(e))return[R(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!yt(n))return[R(["rules",r],"must be an object")];return t?Ey(n,["rules",r]):vy(n,["rules",r])}),...Dc(e)]}function vy(e,t){return[...zc(e.name,t),...Bc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&gt.test(e.subcommand)?[]:[R([...t,"subcommand"],"must match command pattern")],...Xr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...$c(e.reason,t),...Uc(e.intent,t)]}function Ey(e,t){return[...zc(e.name,t),...Bc(e.command,t),...$c(e.reason,t),...Uc(e.intent,t),...xy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[R([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[R([...t,"block_args"],"not supported in rulebook_version 2")]]}function zc(e,t){if(typeof e!=="string")return[R([...t,"name"],"required string")];return Mt.test(e)?[]:[R([...t,"name"],"must match rule name pattern")]}function Bc(e,t){return typeof e==="string"&&gt.test(e)?[]:[R([...t,"command"],"required string matching command pattern")]}function $c(e,t){return typeof e==="string"&&e!==""&&e.length<=ht?[]:[R([...t,"reason"],gy)]}function Uc(e,t){return e===void 0||fs(e)?[]:[R([...t,"intent"],us)]}function xy(e,t){if(!yt(e))return[R(t,"required object")];return[...Xr(e.command_path,[...t,"command_path"],hy,!1),...e.any_args===void 0?[]:Xr(e.any_args,[...t,"any_args"],Wc,!0),...e.exclude_args===void 0?[]:Xr(e.exclude_args,[...t,"exclude_args"],Wc,!0)]}function Xr(e,t,n,r){if(!Array.isArray(e))return[R(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[R([...t,s],"must be a non-empty string")];return i===""?[re([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[re(t,n)]:[],...r&&new Set(e).size!==e.length?[re(t,"must not contain duplicate values")]:[]]}function Ry(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!yt(t))return[R(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[R(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[R(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[R(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[re(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function _y(e){if(!Array.isArray(e.tests))return[];let t=new Set(Fc(e));return[...new Set(e.tests.flatMap((n)=>yt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>re(["tests"],`blocked fixture references unknown rule "${n}"`))}function wy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=yt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[re(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function yt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Yc(e,t){let n=Ac(e,t),r;try{r=yc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ce)return Ny(n,f.message);throw f}let o=cs(n.userConfigTarget),i=r?{config:null,errors:[]}:cs(n.projectConfigTarget),s=Kc(n.userConfigPath,o.errors),a=Kc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Hc(o.config,Jr(n.userConfigPath),"user",n.userScope,l):qc(),u=i.config?Hc(i.config,Jr(n.projectConfigPath),"project",n.projectScope,l):qc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...jc(c.rules,m),...jc(u.rules,d)],transparent_wrappers:My(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Vc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Dy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Vc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Hc(e,t,n,r=Ot(Jr(Jr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Py(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Ay(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Ay(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Py(e,t,n){let r=Iy(e),o=Pc(t,r),i=ky(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Ty(e)}`]};let s=Oy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Iy(e){return Vr(e)?es(e).name:e}function Ty(e){return Vr(e)?`run ${_c} to vendor ${e}`:"create that file or remove that source from the rules config"}function ky(e,t){try{return{content:jr(qn(t,e))}}catch(n){if(n instanceof ce)return{error:n.message};throw n}}function Oy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Gc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function My(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function jc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Vc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Dy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Kc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Ny(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function qc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Ky,readFileSync as qy}from"fs";var Zc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ps=new Set(Zc.map((e)=>e.id)),Qr=Zc,Ly=new Map(Qr.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:Ly.get(e)??"manual_only"}}var gs=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],eo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Wy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Gy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],hs=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Gy.flatMap((e)=>Wy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var to=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Xc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ys=Xc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),bs=Xc.flatMap((e)=>Fy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Cs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ss=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],zy=[...gs,eo,...hs,...ys,...bs,Zn,...Cs,...Ss,...to].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),no=new Set(to.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),vs=new Set(zy.map((e)=>e.id));import{isAbsolute as Es,join as By,normalize as $y,sep as ro}from"path";var oo=process.platform==="win32",Jc=/[*?]/;function xs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(oo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Jc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Xn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Rs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Xn(e.trim(),t);if(!Es(n))return"must be an absolute path or start with ~/";return Jn(n,t)}function _s(e,t){let n=Qc(e,t);if(n===null)return"must be a non-empty path string";if(!Es(n))return null;if(Jn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hy="cannot cover the guard's own configuration";function Qc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=oo?n.replaceAll("\\","/"):n;return Xn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ws(e,t){let n=Qc(e,t);if(n===null)return"must be a non-empty path string";let r=xs(n)?.root??n;if(Jc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Es(r))return null;if(Jn(r,t)!==null)return Uy;return jy(r,t)?Hy:null}function jy(e,t){let n=io(e),r=io(By(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${ro}`)}function Jn(e,t){let n=io(e),r=io(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(ro)?n:`${n}${ro}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function io(e){let t=$y(e);if(oo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(oo?3:1)&&t.endsWith(ro))t=t.slice(0,-1);return t}var eu=30,so=1,ao=365;function tu(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var nu=new Set(Qr.filter((e)=>e.catastrophic).map((e)=>e.id));function w(e,t){if(!e)return null;if(nu.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ee(e,t,n){if(nu.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function ru(e,t){return Object.freeze(Object.fromEntries(Qr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function ou(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:ru(e,t)})}var iu={standard:0,strict:1,paranoid:2};function lu(e,t,n=!1,r=e.safety.level){let o=Vy(e,t,r),i=new Set(n?o.map((u)=>u.field):[]),s=(u,m)=>i.has(u)?void 0:m,a=(u,m)=>Object.fromEntries(Object.entries(m??{}).filter(([d])=>!i.has(`${u}.${d}`))),l=(u,m)=>m?.filter((d)=>!i.has(`${u}.${d}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:As(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:As(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:As(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((u)=>u.message)}}function As(e,t){return[...new Set([...e,...t??[]])]}function Vy(e,t,n){let r=t.safety?.level,o=Br[n];return[...r&&iu[r]<iu[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...ln.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...su("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...su("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!no.has(i))),...e.destructive_command_protection.enabled?au(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?au(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function su(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function au(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Ts=new Set(["standard","strict","paranoid"]),mu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:eu}};function fu(e,t){let n=ob(Lt(e,t),e.home),r=wc(e,t)?{exists:!1,policy:Qn(),errors:[]}:co(cn(t.cwd),e.home),o=Zy(r.parsed,e.home),i=et(Z.projectTightenOnly,e.env),s=n.gui??mu,a=Object.keys(o.policy).length>0?lu(s,o.policy,i,dc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),u=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?Is(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:u,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var Yy="project policy audit settings are ignored; audit is user scope only";function Zy(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={...Ts.has(n.level)?{level:n.level}:{},...Re(n.overrides)?cu({overrides:pu(n.overrides,ln,["safety","overrides"],Wt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:lo(o.overrides,ps,hu,Wt)}:{},...o.allow_paths!==void 0?{allow_paths:mn(o.allow_paths,Rs,t,["destructive_command_protection","allow_paths"],Wt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:lo(i.overrides,vs,yu,Wt)}:{},...i.deny_paths!==void 0?{deny_paths:mn(i.deny_paths,_s,t,["secret_protection","deny_paths"],Wt)}:{},...i.allow_paths!==void 0?{allow_paths:mn(i.allow_paths,ws,t,["secret_protection","allow_paths"],Wt)}:{}};return{policy:cu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Yy]}}function pu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(R([...n,o],ks));return[]}))}function cu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Wt=()=>{return},ks="must be a boolean",Os="must be an object if provided",gu=`must be an integer between ${so} and ${ao}`,hu={path:["destructive_command_protection","overrides"],label:"destructive command"},yu={path:["secret_protection","overrides"],label:"secret protection"},Xy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Jy(e,t){let n=[];return{policy:bu(e,t,(o)=>{n.push(o)}),issues:n}}function Qy(e,t){return bu(e,t,Wt)}function bu(e,t,n){if(!Re(e))return n(R([],"Config must be an object")),Qn();if(e.version!==1)n(R(["version"],"must be 1"));let r=dn(e.safety,["safety"],["level","overrides"],n),o=dn(r.overrides,["safety","overrides"],ln,n),i=dn(e.workflow,["workflow"],["worktree_mode"],n),s=dn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=dn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=dn(e.audit,["audit"],["retention_days"],n);return Cu(e,Xy,[],n),{version:1,safety:{level:eb(r.level,n),overrides:pu(o,ln,["safety","overrides"],n)},workflow:{worktree_mode:Ps(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ps(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:lo(s.overrides,ps,hu,n),allow_paths:mn(s.allow_paths,Rs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ps(a.enabled,["secret_protection","enabled"],!0,n),overrides:lo(a.overrides,vs,yu,n),deny_paths:mn(a.deny_paths,_s,t,["secret_protection","deny_paths"],n),allow_paths:mn(a.allow_paths,ws,t,["secret_protection","allow_paths"],n)},audit:{retention_days:tb(l.retention_days,n)}}}function dn(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(R(t,Os)),{};return Cu(e,n,t,r),e}function Cu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function eb(e,t){if(e===void 0)return"standard";if(Ts.has(e))return e;return t(R(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ps(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(R(t,ks));return n}function tb(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=so&&e<=ao))t(R(["audit","retention_days"],gu));return tu(e)}function lo(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(R(n.path,Os)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(R([...n.path,o],'must be "on" or "off"')),[]}))}function mn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(R(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?re([...r,s],a):R([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qn(){return structuredClone(mu)}function co(e,t){if(!Ky(e))return{exists:!1,policy:Qn(),errors:[]};try{let n=qy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qn(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Jy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${rb(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qn(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var nb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Os,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ks,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[gu,`not an integer between ${so} and ${ao}`]]);function rb(e){let t=ms(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=nb.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function ob(e,t){let n=co(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:du(),errors:[]};let o=Qy(r,t);return{policy:Is(o),gui:o,errors:[],levelPresent:uu(r)}}if(n.parsed===void 0)return{policy:du(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Is(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:uu(n.parsed)}}function uu(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return Ts.has(t.level)}function Su(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...no].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function du(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Su({}),denyPaths:[],allowPaths:[]}}}function Is(e){return{safety:ib(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Su(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function ib(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function vu(e,t){let n=Yc(e,t),r=fu(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...cb(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return ub(o,sb(n,r),s,r.policyScopes)}function sb(e,t){let n=lb(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:db(e.errors.length>0?ab(e.errors):void 0,e.warnings.length>0?Ds(e.warnings.join("; ")):void 0,n)}}function ab(e){return`${Ds(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function lb(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function cb(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function ub(e,t,n=Object.freeze({}),r){let o=Ms(structuredClone(e)),i=r?{policyScopes:Ms(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ms(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ms(t);return Object.freeze(e)}function db(...e){return Ds(e.filter((t)=>!!t).join("; "))}function Ds(e){return/[.!?]$/.test(e)?e:`${e}.`}function Eu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ns(t.fail_closed,e.strict,"strict"),paranoid_rm:Ns(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ns(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:ou(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Hi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ns(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as E_,isAbsolute as x_,join as R_,parse as __,resolve as w_,sep as A_}from"path";function er(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var mb=/^[A-Za-z_][A-Za-z0-9_]*=/;function uo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function tr(e){let t=uo(e.words[0],"time")?1:0,n=t===1&&uo(e.words[t],"-p")?t+1:t,r=t===1&&uo(e.words[n],"--")?n+1:n,o=uo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!mb.test(s.text));return i?.provenance==="literal"?i.text:void 0}var bt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function mo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function fb(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function fo(e,t,n){e.push(n),t.reset()}function po(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ls(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function fn(e,t,n,r,o,i,s){return Ls({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return fb(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ws(e,t,n){if(t>=n||Ru(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Ru(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=xu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=xu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Gs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=pb(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?gb(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function xu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Ru(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function pb(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function gb(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Iu=new Set(["&&","||","|","|&"]),hb=new Set(["!","do","elif","else","if","then","until","while"]);function Tu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=yo(e,0,e.length,t,r,0),i=_b(e,r.quotedExpansionEnd,o.nodes)?[...o.issues,Mu]:o.issues;return fe({kind:"program",dialect:"posix",source:e,span:n,status:Co(i,o.limited),issues:i,nodes:o.nodes})}function yo(e,t,n,r,o,i,s){let a=[],l=[],c=mo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);fo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),Pu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(rr(f)){if(f===`
+`||f==="\r"){m();let I=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!Iu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,I),span:Object.freeze({start:d,end:I})}));if(u.length>0){let k=Gs(e,I,n,u.splice(0));l.push(...k.issues),d=k.next;continue}d=I;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let g=c.start===-1?Ub(e,d,n):void 0;if(g){if(zs(a,l),i>=r.maxDepth)return pn(a,l,d,"depth-limit",r.maxDepth);if(!Fs(o))return pn(a,l,d,"word-limit",r.maxWords);let I=yo(e,g.braceIndex+1,n,r,o,i+1,"}"),T=I.next,k={start:g.braceIndex+1,end:I.closed?T-1:T},F=_u(e,k,I);if(a.push({kind:"function",name:g.name,span:{start:d,end:T},body:F}),l.push(...I.issues),I.pendingHeredocs.length>0||or(I.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...I.pendingHeredocs),I.limited)return ho(a,l,I.next);if(!I.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let p=bo(e,d);if(p){if(m(),!zu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Tb(e,d,n))&&c.start===-1){if(zs(a,l),i>=r.maxDepth)return pn(a,l,d,"depth-limit",r.maxDepth);let I=f==="("?")":"}",T=yo(e,d+1,n,r,o,i+1,I),k=T.next,F={start:d+1,end:T.closed?k-1:k},ue=_u(e,F,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:k},body:ue}),l.push(...T.issues),T.pendingHeredocs.length>0||or(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return ho(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=k;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Sb(e,d):null;if(h){let I=c.words.at(-1),T=I&&I.span.end===d&&/^[0-9]+$/.test(I.raw)?Number(I.raw):void 0;if(T!==void 0)c.words.pop();let k=T===void 0?d:I?.span.start??d;c.start=c.start===-1?d:c.start;let F=d+h.length;while(F<n&&/[ \t]/.test(e[F]??""))F++;let ue=e[F],Xe=F>d+h.length&&ue==="#",Ce=!ue||rr(ue)||!!bo(e,F)||ue===s||ue===")"||Xe||(ue==="<"||ue===">")&&e[F+1]!=="(",It=h==="<<"||h==="<<-",U=It?Ws(e,F,n):void 0,L=U?{word:fn(e,F,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!Ce?Bs(e,F,n,r,o,i):void 0;if(L){if(l.push(...L.issues),L.limited)return ho(a,l,L.next);if(!Fs(o))return pn(a,l,L.next,"word-limit",r.maxWords)}let ae=L?.next??d+h.length,J={kind:"redirection",operator:h,span:{start:k,end:ae},...T===void 0?{}:{fd:T},...L?{target:L.word}:{}};if(c.redirections.push(J),It&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(Se)=>{if(J.heredoc=Se,Se.quotedDelimiter)return;let mt=bb(e,Se.bodySpan.start,Se.bodySpan.end,r,o,i+1);Q.push(...mt.programs),l.push(...mt.issues)}})}if(!It&&!L)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(L)c.nested.push(...L.nested);c.end=ae,d=ae;continue}let y=c.start===-1;if(y)zs(a,l);let C=Bs(e,d,n,r,o,i);if(l.push(...C.issues),C.limited)return ho(a,l,C.next);let b=Mb(c.words)?Gb(e,C.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(b?.limitCode)return pn(a,l,C.next,b.limitCode,b.limitCode==="word-limit"?r.maxWords:b.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=b?.words??[C.word];for(let I of E){if(!Fs(o))return pn(a,l,C.next,"word-limit",r.maxWords);c.words.push(I)}if(c.start=c.start===-1?d:c.start,c.end=C.next,c.nested.push(...C.nested),y&&Bu(C.word))m();d=C.next>d?C.next:d+1}return m(),Pu(a,l),l.push(...Hb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function _u(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Co(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Bs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||rr(f)||(f===";"||f==="|"||f==="&")&&bo(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(f==='"'){l=!0;let y=yb(e,a,n,r,o,i);if(s+=y.text,u.push(...y.nested),m.push(...y.issues),d||=y.limited,c=nr(c,y.provenance),a=y.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let y=Ab(e,a+2,n);if(s+=y.text,m.push(...y.issues),!y.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(f==="\\"){let y=e[a+1];if(!y){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
+`){a+=2;continue}s+=y,a+=2;continue}if(Ft(e,a))m.push(Gt);let p=f==="$"||f==="<"||f===">"||f==="`"?ir(e,a,n,r,o,i):null,h=p?Us(p,u,m):Du(e,a,n,r,o,i,u,m);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(d||=h.limited,c=nr(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let y=Lu(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(f==="*"||f==="?"||f==="[")c=nr(c,"glob");s+=f,a++}return{word:fn(e,t,a,s,c,l,c==="literal"?void 0:Ib(e,t,a)),nested:u,issues:m,next:a,limited:d}}function yb(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
 `){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Gs(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=Co(e,m,n,r,o,i);if(f){let p=vu(f,l,c);if(m=p.next,d||=p.limited,a=Qn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=Ru(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function Co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Gs(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:vC(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let b=[],C=[],x=!1,A=t+d;while(A<f){let E=Co(e,A,f,r,o,i+1);if(!E){A++;continue}if(b.push(...E.program.nodes),C.push(...E.program.issues),x||=E.program.status==="limited",A=E.next,x)break}if(u===-1)C.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo(C,x),issues:C,nodes:b}),next:p,provenance:"arithmetic"}}let g=po(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&er(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function rC(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?Co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function vu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=Eu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=oC(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function oC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Eu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Eu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!RC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function iC(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function xu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function sC(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=aC(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function aC(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Ru(e,t,n,r,o){let i=xu(e,t,n);return{text:r+e.slice(t,i),provenance:Qn(o,"variable"),next:i}}function lC(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",g=Gs(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=xu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Qn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function cC(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var uC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),dC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function mC(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=fC(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function fC(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return pC(e,t);if(n==="env")return gC(e,t);if(n==="sudo")return hC(e,t);return}function pC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function gC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(uC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function hC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(dC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function wu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=_u(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Au(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function yC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=_u(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Au(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>mn(e,t.span.start,t.span.end,a,"literal",!1))}}function _u(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>yu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=yu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...CC(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function yu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&SC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:bC(e,r)}}function CC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function bC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function SC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Au(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function vC(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function fn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function EC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function er(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>er(n.nodes));return(t.kind==="group"||t.kind==="function")&&er(t.body.nodes)})}function xC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Pu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Cu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!bu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Tu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&tC.has(e.text)}function Ls(e,t){let n=e.at(-1);if(!Pu(n))return;if(n?.kind==="command"&&Tu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function RC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var ku=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),wC=new Set(["gc","cat","type","cp","mv","rm"]),Ou=["-rec","-for","-path","-literalpath","-whatif"],_C=/^\$env:\w/i,AC=/^(?:\$\{?\w+\}?|~)\\./;function Mu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...ku].some((o)=>n.includes(o))&&!(n.includes("rm")&&Ou.some((o)=>n.includes(o)))&&!n.includes("<#")&&!PC(n))return!1;let r=$s(e,t);if(Du(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(TC)}function Du(e){return e.nodes.some((t)=>{if(t.kind==="group")return Du(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function PC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function TC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&ku.has(n))return!0;let r=e.slice(t+1);if(n&&wC.has(n)&&r.some(IC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Ou.some((s)=>i.startsWith(s))})}function IC(e){return _C.test(e)||AC.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:NC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=DC(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(Fs(e,u,y)),u=y;continue}u++;continue}let g=Wu(e,u);if(g){m(),s.push(Fs(e,u,u+g.length)),u+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Lu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,C=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:C})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Fs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let C=b<n?Iu(e,b,n,r,o):void 0,x=C?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:x}),...C?{target:C.word}:{}})),C)a.push(...C.issues),l.nested.push(...C.nested),c+=C.words,d||=C.limited;l.end=x,u=x;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=Iu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function Iu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let g=kC(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=zs(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Wu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:mn(e,t,f,i,s,a,s==="literal"?void 0:OC(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function kC(e,t,n,r,o){let i=Nu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Lu(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Nu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function OC(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Nu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=MC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function MC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Lu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Wu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function DC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function NC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=gt){if(t==="powershell"||t==="auto"&&Mu(e.slice(0,n.maxInputLength),n))return $s(e,n);return Su(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function bo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function tr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function we(e,t){tr(e,t)}function Wt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Wt(S(e,t-1))&&j(e,t,n)&&!Wt(S(e,t+n.length))}function nt(e,t){return Wt(S(e,t-1))!==Wt(S(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return LC(r);if(t==="dd")return GC(r);return Uu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return FC(r);if(t==="reset-hard")return Bu(r,"--ha","rd");if(t==="reset-merge")return Bu(r,"--me","rge");if(t==="clean")return UC(r);if(t==="checkout")return jC(r);if(t==="push-force")return VC(r);if(t==="push-refspec")return KC(r);if(t==="push-delete")return qC(r);if(t==="branch")return YC(r);if(t==="tag")return JC(r);if(t==="restore")return QC(r);return Uu(r,!1)}function LC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(tt(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=WC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Gu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Gu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function WC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Gu(e,t,n){if(Fu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Fu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Fu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function GC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function FC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=S(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=BC(e,o);if(s>=0){if(zC(e,s))return!0;let a=s,l=!1;while(H(S(e,a)))l||=S(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(S(e,o-1)))&&(!S(e,o+2)||H(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=j(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function zC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(S(e,n)))n++;let i=n;while(n<Z(e)&&!H(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=zu(e,i,"recursive"),a=zu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=$C(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function zu(e,t,n){return j(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function BC(e,t){if(t>0&&Wt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!H(S(e,n+1)))return-1;return n+1}function $C(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=S(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Bu(e,t,n){return rr(e,"reset",gn,!0,(r)=>S(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function UC(e){return rr(e,"clean",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=nr(e,t,gn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!H(S(e,r)))return{commandEnd:-1,next:r};while(H(S(e,r)))r++;while(r<Z(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=nr(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=HC(e,r,o);r=o;while(H(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:nr(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=nr(e,r,oe);while(H(S(e,r)))r++}return{commandEnd:-1,next:r}}function HC(e,t,n){for(let r of Ee)if(n-t===r.length&&j(e,t,r))return!0;return!1}function jC(e){return $u(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function VC(e){return rr(e,"push",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Wt(S(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Hu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function KC(e){return rr(e,"push",oe,!1,(t)=>{if(H(S(e,t))&&S(e,t+1)==="+"&&t+2<Z(e)&&!oe(S(e,t+2))&&!H(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function qC(e){return rr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(H(S(e,t))&&S(e,t+1)===":"&&t+2<Z(e)&&!H(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function YC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=nr(e,o,oe),s=ZC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ZC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&XC(S(e,s))){let d=S(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function XC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function JC(e){return $u(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function $u(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function rr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(S(e,d)))i=!1;s=c}if(l)i=!1}return!1}function QC(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Uu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=S(e,r),i=t?js(o):oe(o);if(n&&H(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function nr(e,t,n){let r=t;while(r<Z(e)&&!H(S(e,r))&&!n(S(e,r)))r++;return r}function Hu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function hn(e,t,n,r){return Hu(e,t,n,r)>=0}function Te(e,t){tr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)we(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;tr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Ku(t.nodes,r,i)}function Ku(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Ku(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return tb(r,t,n)})}function tb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!eb.test(o.text));return e.words.every((o,i)=>o===t||ju(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||ju(o.target.raw,n.anchored,!0)))}function ju(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as nb,resolve as qu}from"path";function or(e,t,n,r){let o=nb(e)?qu(e):t?qu(t,e):void 0;if(!o)return;try{return L(o,n,r)}catch{return o}}function Yu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ir="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),rb=new Set(["-p","--print"]),ob=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),ib=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),sb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ab=new Map([["python",new Set(["m"])]]),lb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),cb=new Set(["always","default","never"]),ub=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),db=/\\\r?\n/g,mb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Zu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Xu(e){return mb.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&rb.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(pb(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(gb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=fb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(lb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&ub.has(s))||t==="python"&&!cb.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(ab.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Le(t,n,r,o)}if(ob.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(ib.get(t)?.has(u)){if(m+1===s.length)i++;break}if(sb.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function fb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function pb(e,t){return qs.get(e)?.has(t)??!1}function gb(e){return qs.get(e)?.has("--eval")??!1}function sr(e,t,n=!1){let r=Cb(e,t);if(!Ks(r,t))return!1;we(t,r);let o=yb(r);if(Ks(o,t))return!0;if(we(t,o),!Ju.test(o))return!1;return!n||hb(r,t)}function hb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Ju.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Ju=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function yb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(we(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(we(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(we(t,e),n.some((o)=>vo(o,r))))}function Cb(e,t){return we(t,e),e.replace(db,"")}import{lstatSync as gS,readdirSync as hS}from"fs";import{basename as yS,isAbsolute as xd,join as CS,relative as Rd}from"path";import{isAbsolute as id,parse as Pb}from"path";import{dirname as bb,isAbsolute as Sb,parse as vb,sep as Eb}from"path";function ht(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=Sb(t)?vb(t).root:"",o=r||e;for(let i of Rb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=bb(o);continue}let s=xb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function xb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Eb}${t}`}function Rb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wb=new Set(Qs),_b=1024,Qu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ed=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Ab=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function wo(e){return wb.has(e)}function ea(e){return wo(e)||Qu.has(e)||ed.has(e)||Hn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function td(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=_b?{state:"valid",count:r}:{state:"invalid"}}function _o(e,t,n){let o=e.match(Ab)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function nd(e){return od(e,ed)}function rd(e){return od(e,Qu)}function od(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ad=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ie(e){if(!ad.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ie(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ld(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Gt(e,t,n,r){if(!ld(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<K.wrapperPeelIterations.cap;m++){let u=sd(i),f=Ao(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!Ib(i)){let g=kb(Cn(i),a,t.env)??_o(Cn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(Cn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Mb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Lb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=Wb(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(sd(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Tb(d.words,o)}}function Tb(e,t){return e.some((n)=>!t.has(n))}function sd(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function Ib(e){return ad.test(Cn(e))}function kb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?ar(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ar(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ar(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Ob.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Db=new Set(["-i","-0","--null"]),Nb=new Set(["-u","--unset","-C","--chdir","-P"]);function Lb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Db.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(Nb.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?ar(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ar(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ie(c))break;while(a<e.length){let m=Ie(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function ar(e,t,n){if(t==="")return null;if(!e&&!id(t))return null;let r=id(t)?Pb(t).root:n.realpath(e??"/");if(r===null)return null;try{return ht(r,t,n)}catch{return null}}function Wb(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Gb=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>Gb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function yt(e,t,n){return To(e,t,n).tokens}function Fb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(Fb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!ld(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Gt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),zb=new Set(["env","sudo","command","builtin"]),Bb=new Set(["&&","||","|&","|","&",";"]),$b=new Set(["<<","<<<",">|"]),Ub=new Set(["|","|&"]),Hb=/[*@#?$!_-]/,jb=/^\w+(?::\w+)*/,Vb=Object.freeze([]),lr=Object.freeze({kind:"scope",edge:"enter"}),cr=Object.freeze({kind:"scope",edge:"exit"}),Kb=Object.freeze([]),qb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ur=new Set(["bash","sh","zsh","dash","ksh"]),Yb=256,fd=new WeakMap;function pd(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=Jb(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return fd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of gd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=Zb(a,s,n,r),c=a.length>0&&Ub.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return gd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function dr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Zb(e,t,n,r){let o=dr(e)?new Map([...t.variables,...Xb(e,t.variables)]):t.variables,i=yt([...e],n),s=T(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Xb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function gd(e){return fd.get(e)??Vb}function Jb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=Kb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>Qb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Qb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(oS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Ft(e.body,a),...s?[ko("}")]:[]]:[lr,Ge("("),...Ft(e.body,a),...s?[Ge(")")]:[],cr]}]}let o=lS(e,r.functions);if(o){if(r.depth>=gt.maxDepth||++r.flags.expansions>Yb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...cd(e,r),ko(";"),...Ft(o,{...r,depth:r.depth+1}),ko(";")]},...ud(e,t,n,r)]}return[{start:e.span.start,events:cd(e,r)},...ud(e,t,n,r)]}function cd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:yd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:eS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function eS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?yd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:iS(r),targetOrder:$b.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:bd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ud(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...hd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?tS(t,n,r):[]]}function tS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:hd(n.source.slice(r.span.end,e.span.end),n)}]}function hd(e,t){if(t.depth>=gt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function yd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ge(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Ft(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(lr,...p,cr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(lr,...m,cr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),lr,...m,...c.raw.endsWith(")")?[Ge(")")]:[],cr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ge("(")),...u===1?[lr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ge(")")):[],...u===1?[cr]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function dd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=rS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return nS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Hb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?jb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function nS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function rS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function oS(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Bb.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function iS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function mr(e){return qb.has(e)||/^python\d/.test(e)}var sS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=sS.get(e)?.has(n)??!1;return Cd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!zb.has(t))return[...e];return na(Cd(t,e.slice(1)))}function bd(e){let t=Jn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function aS(e){let t=bd(e)[0];if(t===void 0)return!1;let n=T(t).toLowerCase();return mr(n)&&!ur.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(aS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!uS(t))return r;return[...r,...o]})}function lS(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function bt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function cS(e){if(bt(e.words[0],"git"))return bt(e.words[1],"commit");if(!bt(e.words[0],"gh")||!bt(e.words[2],"create"))return!1;return bt(e.words[1],"pr")||bt(e.words[1],"issue")}function uS(e){return(bt(e.words[0],"cat")||bt(e.words[0],"tee")||cS(e))&&!e.words.some(md)&&!e.redirections.some((n)=>md(n.target))}function md(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Sd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),vd=new Set([...Sd,"glob"]),dS=new Set([...vd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function fr(e){let t=mS(),n=zn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:fS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function mS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=pd(i,a);return e.set(i,c),c},getCommandProgram:r}}function fS(e){let t=e.route.kind==="grep"?vd:e.route.kind==="glob"?dS:Sd;return[...Ml(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Ll(e.input):[]]}var pS=new Set(["-S","--suffix"]);function bn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&pS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ke="Git metadata and hooks are protected. Ask the user before modifying them.";function wd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Ed(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=bn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>RS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Ed(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function zt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):bS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function bS(e,t){let n=Rd(t,e);if(n===""||n.startsWith("..")||xd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function SS(e,t,n,r,o){return zt(e,t,n,!0,r,o)}function vS(e,t,n,r,o){if(!n)return!1;return sa(Lo(le(e,t,r,o)),n)}function Ed(e,t,n,r,o,i){let s=Lo(le(e,t,r,o));return i.includes(s)||Ad(s,n)}function _d(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(le(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Ad(e,t)}function Ad(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var ES=50000;function Pd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(yS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=xS(o);if(!i)return!0;if(r+=i.length,r>ES)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>CS(o,s.name)))}return!1}function xS(e){try{let t=gS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return hS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Rd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!xd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function RS(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r);if(T(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>SS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&vS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as OS,parse as MS,posix as Ld,resolve as $t,sep as da}from"path";import{isAbsolute as wS,join as Td,normalize as Od,parse as _S,sep as Id}from"path";var AS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],PS=` 	
-`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function Bt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Dd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(IS(e))return!1;return Sn(e,t)}function St(e,t){let n=Dd(e,t,"IFS");return n!==void 0&&n!==""&&n!==PS}function Sn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>vn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>Go(r)===Go(n))}var kd=new WeakMap;function Md(e){let t=kd.get(e);if(t)return t;let n=TS(e);return kd.set(e,n),n}function TS(e){let t=AS.map((r)=>Wo(r,e.paths)??Od(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&kS(n))return[...t,n];return t}function IS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Dd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function kS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Od(e);if(!wS(n))return n;let r=_S(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Td(i,o[s]??"");if(t.entryKind(a)==="missing")return Td(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function vn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Id)?r:`${r}${Id}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var DS=process.platform==="win32",Nd=64,NS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=wu(e,Nd,Nd,NS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:LS(e)}}function LS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>WS(e.raw,n.span.start-e.span.start))}function WS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:US(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&jS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Gd(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(FS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&zt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(zS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(HS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&YS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>ZS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(XS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(GS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function GS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Fd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Sn($t(t.resolvedCwd,r),t.environment)}function Wd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if($S(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Fd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Ld.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function FS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?$t(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===MS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=OS(e);if(DS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function zS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&Sn(l,a))return!0;return(t||i&&s)&&n&&!o&&BS(l,n)}function BS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Gd(e.slice(n.length+1),t)})}function $S(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ld.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function US(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function HS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?$t(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function jS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Gd(e,t=!1){return e.includes("$")||e.includes("`")||VS(e)||t&&KS(e)}function VS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function KS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&qS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function qS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function YS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function ZS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L($t(t,e),n,r))===he(L(o,n,r))}catch{try{return he($t(t,e))===he(o)}catch{return!1}}}function XS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua($t(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua($t(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return zd(L(e,n,r),L(t,n,r))}catch{return!1}}function Fd(e,t,n,r){if(!t)return!1;try{return zd(L(t,n,r),L(e,n,r))}catch{return!0}}function zd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var JS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Bd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$d="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ud="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ev="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",tv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",nv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ud},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:$d},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ev},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Bd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:QS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Bd}};function Hd(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return rv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=iv(o),s=o[i];if(!s||!JS.has(pv(s.text)))return null;let a=ov(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",tv);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ud);for(let l of a.targets)if(n.resolvedCwd&&zt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",$d);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,nv);if(c)return c}return null}function ov(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(sv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=lv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(cv(c.name)){let d=c.value?av(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(uv(c.name)){n=!0;continue}if(dv(c.name)){r=!0;continue}if(mv(c.name))o=fv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function iv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function sv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function av(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function lv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function cv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function uv(e){return"recurse".startsWith(e)}function dv(e){return e.length>=2&&"force".startsWith(e)}function mv(e){return e==="wi"||"whatif".startsWith(e)}function fv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function pv(e){return e.toLowerCase()}var En="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",jd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var gv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),hv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),yv=new Set(["-o","--output","--query","--subscription"]),Cv=new Set;function Vd(e){if(e==="aws")return gv;if(e==="gcloud")return hv;if(e==="az")return yv;return Cv}var bv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Sv=new Set;function Kd(e){if(e==="git")return Ee;if(e==="docker")return bv;return Sv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!xv(n,o.command))continue;if(o.match){if(vv(n,e,o.match))return qd(o);continue}if(!Rv(n,e,o.subcommand))continue;if(_v(e,new Set(o.block_args),r))return qd(o)}return null}function qd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function vv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Ev(r,n.command_path,Vd(e))}function Ev(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function xv(e,t){return e===O(t)}function Rv(e,t,n){if(!n)return!0;return Yd(t,1,n,Kd(e))}function Yd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&wv(e,i,n,r))return!0;continue}return s===n}return!1}function wv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Yd(e,t+2,n,r)}function _v(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Av=new Set(["-e","--source"]),Pv=new Set(["-F","-v","--assign","--field-separator"]),Zd=new Set(["-f","--file"]),Tv=new Set(["print","printf","return"]),Xd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Iv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Jd(e,t,n){let r=!1;for(let o of kv(e)){let i=Ov(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Iv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Av.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Pv.has(a)||Zd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Zd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function kv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ov(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=Mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Qd(e,i+1);continue}if(s==="/"&&em(e,i)){i=tm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Mv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Qd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&em(e,i)){let f=tm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Lv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Gv(s,a)){o=!0;let f=Nv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Dv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Cr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Dv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Wv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Nv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Lv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Wv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!Cr(e[t-1])&&!Cr(e[t+n.length])}function Gv(e,t){return t!==null&&t>=e}function Qd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function em(e,t){let n=Fv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Cr(e[r-1]))r--;return Tv.has(e.slice(r,n+1))}function Fv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function tm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var zv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Bv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",$v="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function nm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function rm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",zv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",Bv);if(e==="shred"&&n.length>0)return v("shred.target",$v);return null}var Uv=new Set(["sudo","env","command","builtin"]),Hv=new Set(["exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Ho(e,t){let n=e[0];if(!n||!om(T(n),t))return null;let r=T(n),o=e[1]==="--"?2:1,i=jv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function jv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=T(a)!==n&&Vv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Vv(e,t){let n=T(e),r=O(e);return r==="git"||n==="busybox"||Ut(e)||os.has(n)||nm(r)||om(n,t)||Y.has(r)||e==="$SHELL"||De(r)||Pe.has(r)||t.rules.some((o)=>o.command===n)}function om(e,t){return Hv.has(e)||t.transparentWrappers.includes(e)}function Ut(e){return Uv.has(e.toLowerCase())}function Ht(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,d);if(!f)throw new N("derivedCommandShape");ba(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if(Ut(d[0]??""))throw new N("wrapperPeelIterations");let u=Ho(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])ba(a),yield*jo(f===u.childIndex?u.tokens:d.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(qv(d)){ba(a),yield*jo(d.slice(1),t,m,r,o,i,s,a,l);return}yield Kv(d,m,r,o,i,l)}function Kv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:T(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ba(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function qv(e){return T(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Yv=["--init-file","--rcfile"],Zv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ue(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return im(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=im(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=T(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return xe(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function im(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function sm(e){let t=T(e[0]??"").toLowerCase(),n=Xv(e,t),r=Zv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Xv(e,t){let n=xe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Yv.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Jv="find -delete permanently removes files. Use -print first to preview.",Qv="find -exec rm -rf is dangerous. Use explicit file list instead.",eE=new Set(["-exec","-execdir","-ok","-okdir"]),tE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function am(e,t){let n=e.map(_),r=nE(e,n,t);if(r)return r;if(Ko(n,1)&&!lE(e,n,t)){let s=P(v("find.delete",Jv),t.policy);if(s)return s}let o=t.budget??Se(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=xn(n,i);i=l.nextIndex;let c=uE(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:P(m,t.policy);if(u)return u}return null}function nE(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=Sr(e)??q(["."]),i=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=hr(s);for(let l of a.expandedTargets??[_(s)]){let c=ze(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!rE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",ke)}}if(aE(t)&&i.resolvedCwd&&_d(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",ke);return null}function rE(e,t,n){if(!t)return!1;let r=e.map(_),o=[],i=!1,s=Sr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=xn(r,a),d=Ct([...c.tokens],n),m=Vo(d),u=Y.has(T(d[0]??"").toLowerCase()),f=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(m||u||f||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(iE(c.text,l==="-iname"));a+=2;continue}if(!oE.has(l))return!1;a+=1+at(l)}return o.length>0&&!Pd(t,(l)=>o.every((c)=>c.test(l)))}var oE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function iE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var sE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=xn(e,n),o=Ct([...r.tokens],t),i=T(o[0]??"").toLowerCase(),s=Y.has(i)&&sE.test((Ue(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function aE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function lE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Sr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??Bt(o,n.environment),a=n.allowTmpdirVar??!pr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??St(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=vt(l),d=vt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&u&&!vn(u,m)?n.cwd:void 0;return r.every((p)=>{let g=hr(p);if(g.unsafeBraceExpansion)return!1;return(g.expandedTargets??[_(p)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,b=y??h;return Wd(b,y?d:c,{containmentTarget:cE(b,i),targetIsLiteral:g.expandedTargets!==void 0||g.targetIsLiteral,tmpdirWordSplittingProtected:g.tmpdirWordSplittingProtected})})})}function cE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Sr(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function uE(e,t){let n=yt([...e],t);if(n.length===0)return null;let r=T(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=T(n[0]??"");if(r==="rm"&&$e(n))return v("find.exec-rm-recursive-force",Qv);return null}function xn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=xn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return tE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&eE.has(e)}import{resolve as Wx}from"path";function vr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var dE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function cm(e,t,n){let r=qo(e,t,n),o=mE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<dE;a++){let{subcommand:l,rest:c}=_e(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=yE(m);if(u===null||u.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function um(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?T(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ee.has(o)?2:1}return{subcommand:null,rest:[]}}function mE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?T(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=pE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...fE(e,t,n)]}}function fE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=lm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=lm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ee.has(i)){o+=2;continue}o++}return r}function pE(e,t){let n=gE(e,t),r=hE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function gE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=vr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function hE(e,t){let n=td(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function lm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function yE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return vr(t)}var CE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",bE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",SE="git checkout --force discards uncommitted changes. Use 'git stash' first.",vE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",EE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",xE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",RE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",wE="git switch --force discards uncommitted changes. Use 'git stash' first.",_E="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",AE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",PE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",TE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",IE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",kE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",OE="git push --force destroys remote history. Use --force-with-lease for safer force push.",ME="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",DE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",NE="git branch -D force-deletes without merge check. Use -d for safe delete.",LE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",WE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",GE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",FE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",zE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",BE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",$E="git worktree remove --force can delete uncommitted changes. Remove --force flag.",UE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),HE=new Set(["--recurse-submodules","--track","-t"]),wa=new Set(["-b","-B","-U"]),_a=new Set(["-c","-C"]),jE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Rn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function mm(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Et(VE(r,t));case"switch":return Et(qE(r));case"restore":return Et(ZE(r));case"reset":return JE(r);case"clean":return Et(ex(r));case"rm":return Et(tx(r));case"push":return jt(nx(r));case"branch":return jt(ix(r));case"stash":return jt(ux(r));case"worktree":return jt(dx(r));case"rebase":return Et(sx(r));case"merge":return Et(ax(r));case"tag":return jt(lx(r));case"reflog":return jt(cx(r));default:return null}}function Et(e){return e?{...e,localDiscard:!0}:null}function jt(e){return e?{...e,localDiscard:!1}:null}function VE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:wa});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return v("git.checkout-force",SE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",EE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",vE);return v("git.checkout-double-dash",CE)}let i=YE(e);if(i.length>=2)return v("git.checkout-ambiguous",xE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(KE(s)||t(s))return v("git.checkout-double-dash",bE);return null}function KE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function qE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return v("git.switch-discard-changes",RE);let n=me(t,{shortOptsWithValue:_a});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return v("git.switch-force",wE);return null}function YE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(UE.has(r)){n+=2;continue}if(HE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function ZE(e){let t=XE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",AE):v("git.restore-unstaged",_E)}function XE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(jE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function JE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=v("git.reset-hard",PE);break}if(M(n,"--merge")){t=v("git.reset-merge",TE);break}}if(!t)return null;return QE(e)?jt(t):Et(t)}function QE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function ex(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return v("git.clean-force",IE);return null}function tx(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",kE):null}function nx(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return v("git.push-mirror",DE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||dm(t,n).some(rx))return v("git.push-force",OE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||dm(t,n).some(ox))return v("git.push-delete",ME);return null}function dm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function rx(e){return e.startsWith("+")||e.includes(":+")}function ox(e){return e.length>1&&e.startsWith(":")}function ix(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return v("git.branch-force-delete",NE);return null}function sx(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.rebase-abort",LE):null}function ax(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.merge-abort",WE):null}function lx(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?v("git.tag-delete",GE):null}function cx(e){return e[0]==="delete"?v("git.reflog-delete",FE):null}function ux(e){for(let t of e){if(t==="drop")return v("git.stash-drop",zE);if(t==="clear")return v("git.stash-clear",BE)}return null}function dx(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",$E);return null}import{dirname as Ox,isAbsolute as Mx,join as Am,resolve as Dx}from"path";var Pa="TMPDIR",Ta="IFS",pm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,gm=/^[A-Za-z_][A-Za-z0-9_]*$/,hm=new Set(["export","typeset","declare","readonly"]),mx=new Set(["builtin","command","time"]),fx=new Set(["do","then","else"]),px=new Set(["do","then","case"]),fm=new Set(["done","fi","esac"]),gx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function ym(e,t){return e.map((n)=>n.provenance==="variable"&&Rm(n.text)?Cm(n.text,t.shellAssignments):_(n))}function Cm(e,t){return e.replace(gx,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=Cm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function bm(e,t){return{env:e,effectiveEnvAssignments:bx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Sm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=Em(e,t),r=e[0]??"";if(px.has(r))t.bodyDepth+=1;if(r==="elif"||fm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(fm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&hm.has(e[o]??""))e.filter((a)=>gm.test(a)&&Aa(a)).forEach((a)=>{Sx(t,a)});let i=o===-1?-1:xm(e,o);if(i===-1||e[i]!=="unset")return;let s=Ex(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}vx(t,a)})}function vm(e,t){let n=Em(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Em(e,t){let n=fx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Rm(a)),o=r!==-1&&hm.has(e[xm(e,r)]??""),i=Cx(t);return{assignments:e.flatMap((a,l)=>{let c=hx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!wo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function xm(e,t){let n=t;while(mx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Rm(e){return Ie(e)!==null||pm.test(e)}function hx(e,t,n){return Ie(e)??yx(e,t,n)}function yx(e,t,n){let r=_o(e,n,t);if(r)return r;let o=e.match(pm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function Cx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function bx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Sx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function vx(e,t){if(!Aa(t)&&!gm.test(t))return;if(e.shellAssignments.set(t,""),wo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||Hn(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Ex(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as xx}from"path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function wn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(xx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=wm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=wm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ee.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function wm(e,t,n){try{let r=ht(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function _m(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=wn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||Rx(o)||Tx(e,t.environment.env,t.envAssignments,n)||Ax(o)||wx(i,o))return!0;return i==="clean"&&Px(o)>1}function Rx(e){return e.some((t)=>/[$*?[]/.test(t))}function wx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||_x(s))||r.has("-C");return o&&i}return!1}function _x(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Ax(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Px(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Tx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>kx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Ix(s.value);if(rd(n))return!0;return r.recursiveSubmodules}function Ix(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function kx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Pm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??_(l)),o=n.environment.paths,i=wn(r,n.cwd,o),s=n.originalCwd?o.realpath(Dx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Lx(e,n.shellAssignments,o):Tm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Nx(a,r,t,n)||!Sn(a,n.environment)||Fo(a,n.environment)||vn(s,a)||vn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Nx(e,t,n,r){let o=r.environment.paths,i=Am(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function Lx(e,t,n){let r=_e(e.map(_)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!Mx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Tm(e,t){if(t.entryKind(Am(e,".git"))!=="missing")return e;let n=Ox(e);return n===e?null:Tm(n,t)}var Gx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Fx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return Im(e,t)}function Im(e,t,n){let r=e.map(_),o=cm(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((nd(t.envAssignments)||um(r,t.environment.env,t.envAssignments))&&zx(s))return v("git.ssh-env",Gx);let a=mm(s,(c)=>{let d=wn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(Wx(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=_m(r,a,t)??Pm(e,a,t);if(!l)return a;return n?.(l),null}function km(e,t){let n=null;return{match:Im(e,t,(o)=>{n=o}),relaxation:n}}function zx(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(Fx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Bx(n)}function Bx(e){return e.find((t)=>!$x(t))?.toLowerCase()==="update"}function $x(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as yR}from"path";function Om(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Mm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ux="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Hx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Nm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",jx="rm -rf in home directory is dangerous. Change to a project directory first.",Dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Nm},git_metadata_target:{id:"rm.git-metadata",reason:ke},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Hx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:jx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Mm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Ux},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Mm}};function Jo(e,t){let n=vt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=Vo(r),s=Kx(e);for(let a of s){let l=hr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(gr({kind:"outside_anchored_cwd"},n,t.policy,Dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=ve(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&zt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return v("rm.git-metadata",ke);if(i&&!o){let u=ze(d,n,m);if(u.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home",Nm);if(u.kind==="git_metadata_target")return v("rm.git-metadata",ke);continue}if(!o)continue;for(let u of Vx(d,n,m)){let f=gr(u,n,t.policy,Dm),p=P(f,t.policy);if(p)return p}}}return null}function Vx(e,t,n){let r=ze(e,t,n);if(r.kind==="cwd_self_target")return[r,ze(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=ze(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,ze(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Kx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var xt={kind:"none"},Vt={kind:"dynamic"},qx=new Set(["<","<<","<<-","<<<","<&","<>"]),Wm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Yx=/^(?:[0-9]+|[@*])$/,Zx=gt.maxWords,Gm=gt.maxInputLength;function Fm(e){if(!e||T(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(Ft(e,m))c.push(Gt);let f=ir(e,m,n,r,o,i),g=f?Us(f,l,c):Du(e,m,n,r,o,i,l,c);if(g){if(g.provenance!=="command-substitution")s+=e.slice(m,g.next);if(m=g.next,u||=g.limited,a=nr(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=Lu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ir(e,t,n,r,o,i){let s=Ou(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",u=l==="`",m=e[t]==="<"||e[t]===">",d=Hs(e,t+a,n,l),f=d===-1?n:d,g=d===-1?n:d+l.length;if(i>=r.maxDepth)return{program:$b(e,t+a,f,"depth-limit"),next:g,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],I=[],T=!1,k=t+a;while(k<f){let F=ir(e,k,f,r,o,i+1);if(!F){if(Ft(e,k))I.push(Gt);k++;continue}if(E.push(...F.program.nodes),I.push(...F.program.issues),T||=F.program.status==="limited",k=F.next,T)break}if(d===-1)I.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Co(I,T),issues:I,nodes:E}),next:g,provenance:"arithmetic"}}let p=yo(e,t+a,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(u||m)&&or(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],C=u&&/\\[\\$`\n]/.test(e.slice(t+a,f))?[wb]:[],b=[...p.issues,...h,...y,...C];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Co(b,p.limited),issues:b,nodes:p.nodes}),next:g,provenance:"command-substitution"}}function bb(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let u=c==="$"||c==="`"?ir(e,l,n,r,o,i):null;if(!u){if(Ft(e,l))a.push(Gt);l++;continue}if(s.push(u.program),vb(e,l,u.next)&&Eb(u.program))a.push(Gt);l=u.next}return{programs:s,issues:a}}function Us(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Hs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let m=l==="\r"&&e[a+1]===`
+`?a+2:a+1,d=Gs(e,m,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=ku(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let m=Cb(e,a+3,n);if(m===-1)return-1;a=m+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let m=e[a+2]==="-",d=a+(m?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let f=Ws(e,d,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:m,attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let u=i.pop();if(u){o=u;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function Cb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ku(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ku(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!jb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function bo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Sb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function rr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var Gt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Ft(e,t){if(e[t]!=="$")return!1;let n=wu(e,t+1);if(e[n]!=="{")return!1;let r=e[wu(e,n+1)]??"";return r==="|"||rr(r)}function vb(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Ft(e,r))return!0;return!1}function Eb(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===Gt.code)}function wu(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
+`,n))n+=e[n+1]==="\r"?3:2;return n}function Ou(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var xb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Mu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),Rb=/\$\(|`|[<>]\(/g;function _b(e,t,n){let r=$s(n);return[...e.slice(t).matchAll(Rb)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function $s(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>$s(n.nodes))];return t.kind==="group"||t.kind==="function"?$s(t.body.nodes):[]})}var wb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Du(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=So(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(xb);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(Mu);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let u=l.substitutions.some((m)=>{if(Ft(e,m))return a.push(Gt),!1;let d=ir(e,m,c,r,o,i);return d!==null&&Us(d,s,a).limited});return{provenance:"variable",next:c,limited:u}}function So(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Ft(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
+`,a+=l==="\\"?2:1;continue}let c=Ou(e,a);if(c){r.push(a);let u=Hs(e,a+c.length,n,c.closing);if(u===-1)break;a=u+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function Nu(e,t,n){if(e[t+1]==="{"){let o=So(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Ab(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Pb(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Pb(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return go(e,t+1,n,16,2,t+1);if(r==="u")return go(e,t+1,n,16,4,t+1);if(r==="U")return go(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return go(e,t,n,8,3,t+1);return{text:r,next:t+1}}function go(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Co(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"))return"invalid";return e.length>0?"partial":"complete"}function Lu(e,t,n,r,o){let i=Nu(e,t,n);return{text:r+e.slice(t,i),provenance:nr(o,"variable"),next:i}}function Ib(e,t,n){let r=po(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=Hs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Nu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function nr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Tb(e,t,n){return t+1>=n||rr(e[t+1]??"")||bo(e,t+1)!==null}var kb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Db(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Db(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Nb(e,t);if(n==="env")return Lb(e,t);if(n==="sudo")return Wb(e,t);return}function Nb(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Lb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(kb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Wb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ob.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Wu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Gu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Fu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Gb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Gu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Fu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>fn(e,t.span.start,t.span.end,a,"literal",!1))}}function Gu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Au(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Au(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Fb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Au(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Bb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:zb(e,r)}}function Fb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function zb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Bb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Fu(e,t){let n=`x${e}`,r=Bs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function $b(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function pn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ho(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Fs(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function Ub(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function or(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>or(n.nodes));return(t.kind==="group"||t.kind==="function")&&or(t.body.nodes)})}function Hb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function zu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Pu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Iu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Bu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&hb.has(e.text)}function zs(e,t){let n=e.at(-1);if(!zu(n))return;if(n?.kind==="command"&&Bu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function jb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Uu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Vb=new Set(["gc","cat","type","cp","mv","rm"]),Hu=["-rec","-for","-path","-literalpath","-whatif"],Kb=/^\$env:\w/i,qb=/^(?:\$\{?\w+\}?|~)\\./;function ju(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Uu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Hu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Yb(n))return!1;let r=qs(e,t);if(Vu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ks(r).some(Zb)}function Vu(e){return e.nodes.some((t)=>{if(t.kind==="group")return Vu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Yb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Zb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Uu.has(n))return!0;let r=e.slice(t+1);if(n&&Vb.has(n)&&r.some(Xb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Hu.some((s)=>i.startsWith(s))})}function Xb(e){return Kb.test(e)||qb.test(e)}function qs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ys(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:nC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ys(e,t,n,r,o,i=!1){let s=[],a=[],l=mo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};fo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=tC(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(js(e,d,y)),d=y;continue}d++;continue}let p=Yu(e,d);if(p){m(),s.push(js(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(qu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ys(e,d+1,n,r,o+1,!0),C=y.closed?y.next-1:y.next,b=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,C),span:{start:d+1,end:C},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:b})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(js(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,C=y;while(/[ \t]/.test(e[C]??""))C++;let b=C<n?$u(e,C,n,r,o):void 0,E=b?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:E}),...b?{target:b.word}:{}})),b)a.push(...b.issues),l.nested.push(...b.nested),c+=b.words,u||=b.limited;l.end=E,d=E;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ls({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=$u(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function $u(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=Jb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=Vs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Yu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:fn(e,t,f,i,s,a,s==="literal"?void 0:Qb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function Jb(e,t,n,r,o){let i=Ku(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[qu(r.maxDepth)],nodes:[]}),next:a};let l=Ys(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Ku(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Vs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Vs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Vs(r)}}return t}function Qb(e,t,n){let r=po(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Ku(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=eC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function eC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function qu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ks(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ks(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ks)]})}function Yu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function tC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function nC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function js(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=bt){if(t==="powershell"||t==="auto"&&ju(e.slice(0,n.maxInputLength),n))return qs(e,n);return Tu(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function gn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function vo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Zs(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function sr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function _e(e,t){sr(e,t)}function zt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Xs(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>X(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!zt(S(e,t-1))&&V(e,t,n)&&!zt(S(e,t+n.length))}function nt(e,t){return zt(S(e,t-1))!==zt(S(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function hn(e){return e==="|"||e===";"}function Eo(e,t,n){let r=Zs(e,n);if(t==="rm")return rC(r);if(t==="dd")return iC(r);return td(r,!0)}function xo(e,t,n){let r=Zs(e,n);if(t==="rm")return sC(r);if(t==="reset-hard")return Qu(r,"--ha","rd");if(t==="reset-merge")return Qu(r,"--me","rge");if(t==="clean")return uC(r);if(t==="checkout")return mC(r);if(t==="push-force")return fC(r);if(t==="push-refspec")return pC(r);if(t==="push-delete")return gC(r);if(t==="branch")return hC(r);if(t==="tag")return CC(r);if(t==="restore")return SC(r);return td(r,!1)}function rC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(tt(e,i,"rm")&&j(l)&&l!==`
+`)t=!0,i++;continue}let a=oC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=Zu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Zu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function oC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function Zu(e,t,n){if(Xu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Xu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Xu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function iC(e){let t=!1;for(let n=0;n<X(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!j(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function sC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=S(e,o);if(o===X(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=lC(e,o);if(s>=0){if(aC(e,s))return!0;let a=s,l=!1;while(j(S(e,a)))l||=S(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(S(e,o-1)))&&(!S(e,o+2)||j(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&nt(e,o+11)||Js(e,o,"recursive"),r||=V(e,o,"--force")&&nt(e,o+7)||Js(e,o,"force"),n&&r)return!0;o++}return!1}function Js(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||j(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function aC(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(j(S(e,n)))n++;let i=n;while(n<X(e)&&!j(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Ju(e,i,"recursive"),a=Ju(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=cC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Ju(e,t,n){return V(e,t,`--${n}`)&&nt(e,t+n.length+2)||Js(e,t,n)}function lC(e,t){if(t>0&&zt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!j(S(e,n+1)))return-1;return n+1}function cC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&nt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Qu(e,t,n){return lr(e,"reset",hn,!0,(r)=>S(e,r)==="-"&&yn(e,r,t,n)?!0:r)}function uC(e){return lr(e,"clean",hn,!0,(t)=>{if(S(e,t)!=="-")return t;if(yn(e,t,"--fo","rce"))return!0;let n=ar(e,t,hn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Ro(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!j(S(e,r)))return{commandEnd:-1,next:r};while(j(S(e,r)))r++;while(r<X(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=ar(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=dC(e,r,o);r=o;while(j(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:ar(e,r,oe)};if(!s)continue;if(r>=X(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=ar(e,r,oe);while(j(S(e,r)))r++}return{commandEnd:-1,next:r}}function dC(e,t,n){for(let r of Ee)if(n-t===r.length&&V(e,t,r))return!0;return!1}function mC(e){return ed(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function fC(e){return lr(e,"push",hn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!zt(S(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=nd(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function pC(e){return lr(e,"push",oe,!1,(t)=>{if(j(S(e,t))&&S(e,t+1)==="+"&&t+2<X(e)&&!oe(S(e,t+2))&&!j(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function gC(e){return lr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&yn(e,t,"--de","lete"))return!0;if(j(S(e,t))&&S(e,t+1)===":"&&t+2<X(e)&&!j(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function hC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Ro(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=ar(e,o,oe),s=yC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function yC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(yn(e,i,"--de","lete"))r=!0;if(yn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&bC(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function bC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function CC(e){return ed(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function ed(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Ro(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(yn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(hn(o))i.outerActive=!1}return!1}function lr(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Ro(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function SC(e){let t=!1;for(let n=0;n<X(e);n++){if(Xs(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Ro(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function td(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=S(e,r),i=t?Xs(o):oe(o);if(n&&j(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function ar(e,t,n){let r=t;while(r<X(e)&&!j(S(e,r))&&!n(S(e,r)))r++;return r}function nd(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function yn(e,t,n,r){return nd(e,t,n,r)>=0}function Te(e,t){sr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)_e(t,a);if((s.regex?.test(a)??!1)||s.scan&&xo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var vC=/^[A-Za-z_][A-Za-z0-9_]*=/;function od(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;sr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return id(t.nodes,r,i)}function id(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return id(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return EC(r,t,n)})}function EC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!vC.test(o.text));return e.words.every((o,i)=>o===t||rd(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||rd(o.target.raw,n.anchored,!0)))}function rd(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as xC,resolve as sd}from"path";function cr(e,t,n,r){let o=xC(e)?sd(e):t?sd(t,e):void 0;if(!o)return;try{return D(o,n,r)}catch{return o}}function ad(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var bn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ur="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ea=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),RC=new Set(["-p","--print"]),_C=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),wC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),AC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),PC=new Map([["python",new Set(["m"])]]),IC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),TC=new Set(["always","default","never"]),kC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),OC=/\\\r?\n/g,MC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function ld(e){return wo(e).code}function _o(e){return wo(e).sources}function cd(e){return MC.get(na(e))??[]}function wo(e){let t=na(e[0]??"");if(!ea.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&RC.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(NC(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(LC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=DC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(IC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&kC.has(s))||t==="python"&&!TC.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(PC.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Le(t,n,r,o)}if(_C.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(wC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(AC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function DC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ta(e,t){return na(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function na(e){let t=A(e).toLowerCase();return qr.test(t)?"python":t}function NC(e,t){return ea.get(e)?.has(t)??!1}function LC(e){return ea.get(e)?.has("--eval")??!1}function dr(e,t,n=!1){let r=FC(e,t);if(!Qs(r,t))return!1;_e(t,r);let o=GC(r);if(Qs(o,t))return!0;if(_e(t,o),!ud.test(o))return!1;return!n||WC(r,t)}function WC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>ud.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:ra(i,c)}});if(s.some((l)=>oa(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&Qs(l.text,t)})}function ra(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function oa(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var ud=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function GC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Qs(e,t){if(Eo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(_e(t,e),r.test(e))return!0;if(Eo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(_e(t,e),r.test(e))return!0;if(Eo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(_e(t,e),n.some((o)=>xo(o,r))))}function FC(e,t){return _e(t,e),e.replace(OC,"")}import{lstatSync as LS,readdirSync as WS}from"fs";import{basename as GS,isAbsolute as Ld,join as FS,relative as Wd}from"path";import{isAbsolute as yd,parse as YC}from"path";import{dirname as zC,isAbsolute as BC,parse as $C,sep as UC}from"path";function Ct(e,t,n){if(Qe(t))throw Error("Unsupported Windows namespace path");let r=BC(t)?$C(t).root:"",o=r||e;for(let i of jC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=zC(o);continue}let s=HC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function HC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${UC}${t}`}function jC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var ia=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],VC=new Set(ia),KC=1024,dd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),md=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),qC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ao(e){return VC.has(e)}function sa(e){return Ao(e)||dd.has(e)||md.has(e)||Kn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function fd(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=KC?{state:"valid",count:r}:{state:"invalid"}}function Po(e,t,n){let o=e.match(qC)?.[1];if(!o||!sa(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function pd(e){return hd(e,md)}function gd(e){return hd(e,dd)}function hd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Cd=/^[A-Za-z_][A-Za-z0-9_]*=/;function ke(e){if(!Cd.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Io(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=ke(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Sd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Bt(e,t,n,r){if(!Sd(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<K.wrapperPeelIterations.cap;m++){let d=bd(i),f=Io(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!XC(i)){let p=JC(Cn(i),a,t.env)??Po(Cn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(Cn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=eS(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=rS(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=oS(i);if(g==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(bd(i)===d)break}let u=Io(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:ZC(u.words,o)}}function ZC(e,t){return e.some((n)=>!t.has(n))}function bd(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function XC(e){return Cd.test(Cn(e))}function JC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var QC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function eS(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?mr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=mr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=mr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(QC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var tS=new Set(["-i","-0","--null"]),nS=new Set(["-u","--unset","-C","--chdir","-P"]);function rS(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(tS.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(nS.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?mr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=mr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!ke(c))break;while(a<e.length){let m=ke(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function mr(e,t,n){if(t==="")return null;if(!e&&!yd(t))return null;let r=yd(t)?YC(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ct(r,t,n)}catch{return null}}function oS(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var iS=/['"\\$`{}#]/;function To(e,t){if(e.some((r)=>iS.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function St(e,t,n){return ko(e,t,n).tokens}function sS(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function vt(e,t,n,r=0){let o=ko(e,t,n),i=(o.envSplitValues??[]).flatMap(sS);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return vt(s,t,n,r+1)}function ko(e,t,n,r){if(!Sd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Bt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ua=Symbol("adopt-as-operand"),aS=new Set(["env","sudo","command","builtin"]),lS=new Set(["&&","||","|&","|","&",";"]),cS=new Set(["<<","<<<",">|"]),uS=new Set(["|","|&"]),dS=/[*@#?$!_-]/,mS=/^\w+(?::\w+)*/,fS=Object.freeze([]),fr=Object.freeze({kind:"scope",edge:"enter"}),pr=Object.freeze({kind:"scope",edge:"exit"}),pS=Object.freeze([]),gS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),gr=new Set(["bash","sh","zsh","dash","ksh"]),hS=256,_d=new WeakMap;function wd(e,t){let n=t.status==="complete"?new Set(ca(t)):new Set,r=CS(e,n);if(Zr(r))return Oo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=$t(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Oo("structural-limit",r,t);if(o.invalid)return Oo("invalid",r,t);let s=Oo("complete",r,t,o.assignmentFallbacks);return _d.set(s,Object.freeze(i)),s}function Do(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Ad(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=yS(a,s,n,r),c=a.length>0&&uS.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ua){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function No(e){return Ad(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function hr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function yS(e,t,n,r){let o=hr(e)?new Map([...t.variables,...bS(e,t.variables)]):t.variables,i=St([...e],n),s=A(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function bS(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function Ad(e){return _d.get(e)??fS}function CS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Oo(e,t,n,r=pS){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function $t(e,t){return e.nodes.flatMap((n,r)=>SS(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function SS(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(_S(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Mo("{"),...$t(e.body,a),...s?[Mo("}")]:[]]:[fr,Ge("("),...$t(e.body,a),...s?[Ge(")")]:[],pr]}]}let o=IS(e,r.functions);if(o){if(r.depth>=bt.maxDepth||++r.flags.expansions>hS)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...vd(e,r),Mo(";"),...$t(o,{...r,depth:r.depth+1}),Mo(";")]},...Ed(e,t,n,r)]}return[{start:e.span.start,events:vd(e,r)},...Ed(e,t,n,r)]}function vd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Id(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:vS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function vS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Id(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[da(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:wS(r),targetOrder:cS.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:kd(t)}:{}}),...s===void 0?o:o.slice(1)]}function Ed(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[da(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Pd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?ES(t,n,r):[]]}function ES(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Pd(n.source.slice(r.span.end,e.span.end),n)}]}function Pd(e,t){if(t.depth>=bt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=$t(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Id(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?da(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of aa(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ge(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=aa(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?$t(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(fr,...g,pr);continue}let m=u?$t(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(fr,...m,pr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),fr,...m,...c.raw.endsWith(")")?[Ge(")")]:[],pr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Ge("(")),...d===1?[fr]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Ge(")")):[],...d===1?[pr]:[])}return l(),o}function aa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=xd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=xd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function xd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?RS(e,t+2):So(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return xS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&dS.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?mS:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function xS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=aa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function RS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function _S(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:lS.has(e)})}function Mo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function da(e){return Object.freeze({kind:"word",text:e})}function wS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function yr(e){return gS.has(e)||/^python\d/.test(e)}var AS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Td(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=AS.get(e)?.has(n)??!1;return Td(e,t.slice(r?2:1))}function la(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return la(e.slice(1));if(!aS.has(t))return[...e];return la(Td(t,e.slice(1)))}function kd(e){let t=tr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return la(n<0?[]:e.words.slice(n).map((r)=>r.text))}function PS(e){let t=kd(e)[0];if(t===void 0)return!1;let n=A(t).toLowerCase();return yr(n)&&!gr.has(n)}function ca(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ca(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ca(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(PS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!kS(t))return r;return[...r,...o]})}function IS(e,t){let n=tr(e);return n===void 0?void 0:t.get(n)}function Et(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function TS(e){if(Et(e.words[0],"git"))return Et(e.words[1],"commit");if(!Et(e.words[0],"gh")||!Et(e.words[2],"create"))return!1;return Et(e.words[1],"pr")||Et(e.words[1],"issue")}function kS(e){return(Et(e.words[0],"cat")||Et(e.words[0],"tee")||TS(e))&&!e.words.some(Rd)&&!e.redirections.some((n)=>Rd(n.target))}function Rd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Od=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Md=new Set([...Od,"glob"]),OS=new Set([...Md,"folder","pattern","patterns"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Dd(e){let t=MS(),n=Un(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:DS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return Ni(e,t)}function MS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=wd(i,a);return e.set(i,c),c},getCommandProgram:r}}function DS(e){let t=e.route.kind==="grep"?Md:e.route.kind==="glob"?OS:Od;return[...Gl(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Bl(e.input):[]]}var NS=new Set(["-S","--suffix"]);function Sn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Do(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Lo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&NS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ze="Git metadata and hooks are protected. Ask the user before modifying them.";function Gd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Gr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Nd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=Sn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>jS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Nd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ut(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Go(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ma(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Wo(m,l):zS(m,l);if(n.markerFiles.some(u))return!0;return r&&fa(n).some(u)}if(ma(a,n))return!0;return r&&fa(n).some((c)=>Wo(c,a))}function zS(e,t){let n=Wd(t,e);if(n===""||n.startsWith("..")||Ld(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function BS(e,t,n,r,o){return Ut(e,t,n,!0,r,o)}function $S(e,t,n,r,o){if(!n)return!1;return ma(Go(le(e,t,r,o)),n)}function Nd(e,t,n,r,o,i){let s=Go(le(e,t,r,o));return i.includes(s)||zd(s,n)}function Fd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Wo(i,Go(le(s,t,r,o)))))}function ma(e,t){return t.entries.includes(e)||t.directories.includes(e)||zd(e,t)}function zd(e,t){return t.hooksDirectories.some((n)=>Wo(e,n))}var US=50000;function Bd(e,t){let n=[...new Set(fa(e))];if(n.some((o)=>t(GS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=HS(o);if(!i)return!0;if(r+=i.length,r>US)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>FS(o,s.name)))}return!1}function HS(e){try{let t=LS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return WS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function fa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Wo(e,t){let n=Wd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Ld(n)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}function jS(e,t,n,r,o){if(hr(e))return null;let i=vt([...e],r);if(A(i[0]??"").toLowerCase()!=="mv")return null;let s=Lo(i.slice(1)),a=s.sources.find((l)=>BS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&$S(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as $o,normalize as QS,parse as ev,posix as Yd,resolve as jt,sep as ya}from"path";import{isAbsolute as VS,join as $d,normalize as jd,parse as KS,sep as Ud}from"path";var qS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],YS=` 	
+`;function br(e,t){if(Ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!pa(e.get("TMPDIR")??"",t)}function vn(e,t){if(e.has("TMPDIR"))return pa(e.get("TMPDIR")??"",t);let n=ga(e,t);if(n===void 0)return!0;return pa(n,t)}function ga(e,t){return Kd(e,t,"TMPDIR")}function pa(e,t){if(!e)return!1;if(XS(e))return!1;return En(e,t)}function Ht(e,t){let n=Kd(e,t,"IFS");return n!==void 0&&n!==""&&n!==YS}function En(e,t){let n=Fo(e,t.paths);if(n===null)return!1;return Vd(t).some((r)=>xn(n,r))}function Bo(e,t){let n=Fo(e,t.paths);if(n===null)return!1;return Vd(t).some((r)=>zo(r)===zo(n))}var Hd=new WeakMap;function Vd(e){let t=Hd.get(e);if(t)return t;let n=ZS(e);return Hd.set(e,n),n}function ZS(e){let t=qS.map((r)=>Fo(r,e.paths)??jd(r)),n=Fo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&JS(n))return[...t,n];return t}function XS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Kd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function JS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Fo(e,t){try{let n=jd(e);if(!VS(n))return n;let r=KS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=$d(i,o[s]??"");if(t.entryKind(a)==="missing")return $d(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function xn(e,t){let n=zo(e),r=zo(t);if(n===r)return!0;let o=r.endsWith(Ud)?r:`${r}${Ud}`;return n.startsWith(o)}function zo(e){return process.platform==="win32"?e.toLowerCase():e}var tv=process.platform==="win32",qd=64,nv=16384;function Cr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ee(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ee(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Sr(e){let t=Wu(e,qd,qd,nv);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:rv(e)}}function rv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>ov(e.raw,n.span.start-e.span.start))}function ov(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function xt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Pe();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:uv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Be(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&mv(e))return{kind:"outside_anchored_cwd"};let o=!r&&Xd(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(ba(e,r))return{kind:"root_or_home_target"};if(sv(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ut(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(av(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(dv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&hv(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>yv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(bv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(iv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function iv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if($o(r)||r.startsWith("~"))return!1;if(Ca(r))return!1;if(Jd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return En(jt(t.resolvedCwd,r),t.environment)}function Zd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Be(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(cv(i))return!1;if(Bo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Jd(r??i,s,t.environment.paths,t.budget))}function ba(e,t=!1){let n=e.trim(),r=Yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function sv(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=$o(o)?o:t.resolvedCwd?jt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(D(i,t.environment.paths,t.budget));if(s===ev(s).root)return!0;return s===he(D(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=QS(e);if(tv){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function av(e,t,n,r,o,i,s,a){let l=e.trim();if(Ca(l))return!1;if(!r&&En(l,a))return!0;return(t||i&&s)&&n&&!o&&lv(l,n)}function lv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Xd(e.slice(n.length+1),t)})}function cv(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Yd.normalize(`/${t[1]??""}`)==="/"}function Ca(e){return e.split(/[\\/]+/).includes("..")}function uv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Xn(o.trim(),t);if(!$o(i))return[];try{let s=D(i,n,r);if(Jn(s,D(t,n,r)))return[];return[he(s)]}catch{return[]}})}function dv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Ca(r))return!1;let o=n?r:Xn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=$o(o)?o:i?jt(i,o):null;if(!s)return!1;try{let a=he(D(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ya)?l:`${l}${ya}`))}catch{return!1}}function mv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Xd(e,t=!1){return e.includes("$")||e.includes("`")||fv(e)||t&&pv(e)}function fv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function pv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&gv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function gv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function hv(e,t,n,r){try{return he(D(e,n,r))===he(D(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function yv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(D(jt(t,e),n,r))===he(D(o,n,r))}catch{try{return he(jt(t,e))===he(o)}catch{return!1}}}function bv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ha(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ha(jt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ha(jt(a,e),t,i,s)}catch{return!1}}function ha(e,t,n,r){try{return Qd(D(e,n,r),D(t,n,r))}catch{return!1}}function Jd(e,t,n,r){if(!t)return!1;try{return Qd(D(t,n,r),D(e,n,r))}catch{return!0}}function Qd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${ya}`)||n===r}var Cv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),em="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Sv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",tm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",nm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",vv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Ev="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",xv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:nm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ze},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:tm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:vv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:em},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Sv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:em}};function rm(e,t,n){return Rv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,xt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function Rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=wv(o),s=o[i];if(!s||!Cv.has(Nv(s.text)))return null;let a=_v(o.slice(i+1));if(a.whatIfProtected)return null;if(ee(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",Ev);for(let l of a.targets)if(!Qe(l.text)&&ba(va(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",nm);for(let l of a.targets)if(n.resolvedCwd&&Ut(va(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ze);if(!a.recursive||!a.force)return null;if(ee(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",tm);for(let l of a.targets){let c=Cr(Be(va(l.text),n),n,r,xv);if(c)return c}return null}function _v(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Av(l))continue;if(s){t.push(Sa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Iv(l.text);if(!c){t.push(Sa(l)),i=i||l.dynamic;continue}if(Tv(c.name)){let u=c.value?Pv(c.value,l):e[++a];if(u?.kind==="word"){t.push(Sa(u)),i=i||u.dynamic;continue}i=!0;continue}if(kv(c.name)){n=!0;continue}if(Ov(c.name)){r=!0;continue}if(Mv(c.name))o=Dv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function wv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Sa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Av(e){return e.kind==="word"&&e.text===","}function va(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function Pv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Iv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Tv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function kv(e){return"recurse".startsWith(e)}function Ov(e){return e.length>=2&&"force".startsWith(e)}function Mv(e){return e==="wi"||"whatif".startsWith(e)}function Dv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Nv(e){return e.toLowerCase()}var Rn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Uo="Unsupported heredoc syntax",vr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",om="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Lv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Wv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Gv=new Set(["-o","--output","--query","--subscription"]),Fv=new Set;function im(e){if(e==="aws")return Lv;if(e==="gcloud")return Wv;if(e==="az")return Gv;return Fv}var zv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Bv=new Set;function sm(e){if(e==="git")return Ee;if(e==="docker")return zv;return Bv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Hv(n,o.command))continue;if(o.match){if($v(n,e,o.match))return am(o);continue}if(!jv(n,e,o.subcommand))continue;if(Kv(e,new Set(o.block_args),r))return am(o)}return null}function am(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function $v(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Uv(r,n.command_path,im(e))}function Uv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Hv(e,t){return e===O(t)}function jv(e,t,n){if(!n)return!0;return lm(t,1,n,sm(e))}function lm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Vv(e,i,n,r))return!0;continue}return s===n}return!1}function Vv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return lm(e,t+2,n,r)}function Kv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var qv=new Set(["-e","--source"]),Yv=new Set(["-F","-v","--assign","--field-separator"]),cm=new Set(["-f","--file"]),Zv=new Set(["print","printf","return"]),um=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Xv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function dm(e,t,n){let r=!1;for(let o of Jv(e)){let i=Qv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Xv):null}function xa(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&qv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Yv.has(a)||cm.has(a))){let l=e[s+1];if(i&&=l!==void 0,cm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function xr(e){return xa(e).sources}function Jv(e){return xr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Qv(e,t){_e(t,e);let n=e.includes("system")?Ra(e,t):null,r=eE(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ra(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=jo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=mm(e,i+1);continue}if(s==="/"&&fm(e,i)){i=pm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Er(e[a-1])||Er(e[i]))continue;let l=Ho(e,i);if(e[l]!=="(")continue;l=Ho(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=jo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Ho(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function eE(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=jo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=mm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&fm(e,i)){let f=pm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Ea(e,i,"print")||Ea(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Ho(e,m);if(Ea(e,d,"getline")){o=!0;let f=rE(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(iE(s,a)){o=!0;let f=nE(e,d);if(!f){r=!0,c=m,i=m;continue}if(!tE(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Er(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Ho(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function tE(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function jo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=oE(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function nE(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return jo(e,t,n)}function rE(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function oE(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Ea(e,t,n){return e.startsWith(n,t)&&!Er(e[t-1])&&!Er(e[t+n.length])}function iE(e,t){return t!==null&&t>=e}function mm(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function fm(e,t){let n=sE(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Er(e[r-1]))r--;return Zv.has(e.slice(r,n+1))}function sE(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function pm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var aE="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lE="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cE="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function gm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function hm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",aE);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",lE);if(e==="shred"&&n.length>0)return v("shred.target",cE);return null}var uE=new Set(["sudo","env","command","builtin"]),dE=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Vo(e,t){let n=e[0];if(!n||!ym(A(n),t))return null;let r=A(n),o=e[1]==="--"?2:1,i=mE(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function mE(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=A(a)!==n&&fE(a,r);if(l)i.push(s);if(!l&&Yr.has(O(a)))break;if(o)break}return i}function fE(e,t){let n=A(e),r=O(e);return r==="git"||n==="busybox"||Vt(e)||ls.has(n)||gm(r)||ym(n,t)||Y.has(r)||e==="$SHELL"||De(r)||Ie.has(r)||t.rules.some((o)=>o.command===n)}function ym(e,t){return dE.has(e)||t.transparentWrappers.includes(e)}function Vt(e){return uE.has(e.toLowerCase())}function Kt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function $e(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Ko([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Ko(e,t,n,r,o,i,s,a,l){let c=ko(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=To(c.envSplitValues,u);if(!f)throw new W("derivedCommandShape");_a(a),yield*Ko(f,t,m,r,o,i,s,a,l);return}if(Vt(u[0]??""))throw new W("wrapperPeelIterations");let d=Vo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])_a(a),yield*Ko(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(gE(u)){_a(a),yield*Ko(u.slice(1),t,m,r,o,i,s,a,l);return}yield pE(u,m,r,o,i,l)}function pE(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:A(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function _a(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new W("wrapperPeelIterations");e.iterations++}function gE(e){return A(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function wa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function st(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Aa(r,"recursive")){t=!0;continue}if(r==="-f"||Aa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function qo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Aa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Aa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var hE=["--init-file","--rcfile"],yE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ue(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function at(e){let t=A(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return xe(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Cm(e){let t=A(e[0]??"").toLowerCase(),n=bE(e,t),r=yE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function bE(e,t){let n=xe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hE.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ss.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=as(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var CE="find -delete permanently removes files. Use -print first to preview.",SE="find -exec rm -rf is dangerous. Use explicit file list instead.",vE=new Set(["-exec","-execdir","-ok","-okdir"]),EE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Sm(e,t){let n=e.map(_),r=xE(e,n,t);if(r)return r;if(Yo(n,1)&&!IE(e,n,t)){let s=w(v("find.delete",CE),t.policy);if(s)return s}let o=t.budget??Pe(),i=0;while(i<n.length){let s=n[i],a=lt(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=_n(n,i);i=l.nextIndex;let c=kE(l.tokens,t.environment);if(c){let f=w(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?.(l.tokens,u?null:t.cwd)??null,d=m?.id.startsWith("custom.")?m:w(m,t.policy);if(d)return d}return null}function xE(e,t,n){if(!Yo(t,1)&&!Pa(t,n.environment))return null;let o=Rr(e)??q(["."]),i=xt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Sr(s);for(let l of a.expandedTargets??[_(s)]){let c=Be(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!RE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",ze)}}if(PE(t)&&i.resolvedCwd&&Fd(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",ze);return null}function RE(e,t,n){if(!t)return!1;let r=e.map(_),o=[],i=!1,s=Rr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=_n(r,a),u=vt([...c.tokens],n),m=qo(u),d=Y.has(A(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(wE(c.text,l==="-iname"));a+=2;continue}if(!_E.has(l))return!1;a+=1+lt(l)}return o.length>0&&!Bd(t,(l)=>o.every((c)=>c.test(l)))}var _E=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function wE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var AE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Pa(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=_n(e,n),o=vt([...r.tokens],t),i=A(o[0]??"").toLowerCase(),s=Y.has(i)&&AE.test((Ue(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function PE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function IE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Rr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ga(o,n.environment),s=n.trustedTmpdirValue??vn(o,n.environment),a=n.allowTmpdirVar??!br(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=xt(l),u=xt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!xn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=Sr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[_(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,C=y??h,b={targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected};if(!ee(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&Be(C,c,b).kind==="within_anchored_cwd")return!0;return Zd(C,y?u:c,{...b,containmentTarget:TE(C,i)})})})}function TE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Rr(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function kE(e,t){let n=St([...e],t);if(n.length===0)return null;let r=A(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=A(n[0]??"");if(r==="rm"&&st(n))return v("find.exec-rm-recursive-force",SE);return null}function _n(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Yo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=_n(e,n).nextIndex;continue}let o=lt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function lt(e){return EE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&vE.has(e)}import{resolve as oR}from"path";function _r(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var OE=5,Ia="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Em(e,t,n){let r=Zo(e,t,n),o=ME(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<OE;a++){let{subcommand:l,rest:c}=we(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=GE(m);if(d===null||d.length===0)return{blockedReason:Ia,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:Ia,expanded:!0,tokens:i}}function xm(e,t,n){return Zo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function we(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?A(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ee.has(o)?2:1}return{subcommand:null,rest:[]}}function ME(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Zo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?A(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=NE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...DE(e,t,n)]}}function DE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ta(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ta(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=vm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=vm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ee.has(i)){o+=2;continue}o++}return r}function NE(e,t){let n=LE(e,t),r=WE(e,t);return{blockedReason:n===null||r===null?Ia:null,entries:[...n??[],...r??[]]}}function LE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=_r(n);if(!o)return null;for(let i of o){let s=Ta(i);if(!s)return null;r.push(s)}return r}function WE(e,t){let n=fd(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ta(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function vm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function GE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return _r(t)}var FE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",zE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",BE="git checkout --force discards uncommitted changes. Use 'git stash' first.",$E="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",UE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",HE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",jE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",VE="git switch --force discards uncommitted changes. Use 'git stash' first.",KE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",qE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",YE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",ZE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",XE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",JE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",QE="git push --force destroys remote history. Use --force-with-lease for safer force push.",ex="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",tx="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",nx="git branch -D force-deletes without merge check. Use -d for safe delete.",rx="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",ox="git merge --abort discards merge conflict resolutions. Use 'git status' first.",ix="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",sx="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",ax="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",lx="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",cx="git worktree remove --force can delete uncommitted changes. Remove --force flag.",ux=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),dx=new Set(["--recurse-submodules","--track","-t"]),ka=new Set(["-b","-B","-U"]),Oa=new Set(["-c","-C"]),mx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var wn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function _m(e,t){let{subcommand:n,rest:r}=we(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Rt(fx(r,t));case"switch":return Rt(gx(r));case"restore":return Rt(yx(r));case"reset":return Cx(r);case"clean":return Rt(vx(r));case"rm":return Rt(Ex(r));case"push":return qt(xx(r));case"branch":return qt(wx(r));case"stash":return qt(kx(r));case"worktree":return qt(Ox(r));case"rebase":return Rt(Ax(r));case"merge":return Rt(Px(r));case"tag":return qt(Ix(r));case"reflog":return qt(Tx(r));default:return null}}function Rt(e){return e?{...e,localDiscard:!0}:null}function qt(e){return e?{...e,localDiscard:!1}:null}function fx(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:ka});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return v("git.checkout-force",BE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",UE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",$E);return v("git.checkout-double-dash",FE)}let i=hx(e);if(i.length>=2)return v("git.checkout-ambiguous",HE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(px(s)||t(s))return v("git.checkout-double-dash",zE);return null}function px(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function gx(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return v("git.switch-discard-changes",jE);let n=me(t,{shortOptsWithValue:Oa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return v("git.switch-force",VE);return null}function hx(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(ux.has(r)){n+=2;continue}if(dx.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function yx(e){let t=bx(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",qE):v("git.restore-unstaged",KE)}function bx(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(mx.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Cx(e){let t=null;for(let n of e){if(M(n,"--hard")){t=v("git.reset-hard",YE);break}if(M(n,"--merge")){t=v("git.reset-merge",ZE);break}}if(!t)return null;return Sx(e)?qt(t):Rt(t)}function Sx(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function vx(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return v("git.clean-force",XE);return null}function Ex(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",JE):null}function xx(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return v("git.push-mirror",tx);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Rm(t,n).some(Rx))return v("git.push-force",QE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Rm(t,n).some(_x))return v("git.push-delete",ex);return null}function Rm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Rx(e){return e.startsWith("+")||e.includes(":+")}function _x(e){return e.length>1&&e.startsWith(":")}function wx(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return v("git.branch-force-delete",nx);return null}function Ax(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.rebase-abort",rx):null}function Px(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.merge-abort",ox):null}function Ix(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?v("git.tag-delete",ix):null}function Tx(e){return e[0]==="delete"?v("git.reflog-delete",sx):null}function kx(e){for(let t of e){if(t==="drop")return v("git.stash-drop",ax);if(t==="clear")return v("git.stash-clear",lx)}return null}function Ox(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",cx);return null}import{dirname as Qx,isAbsolute as eR,join as zm,resolve as tR}from"path";var Da="TMPDIR",Na="IFS",Am=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Pm=/^[A-Za-z_][A-Za-z0-9_]*$/,Im=new Set(["export","typeset","declare","readonly"]),Mx=new Set(["builtin","command","time"]),Dx=new Set(["do","then","else"]),Nx=new Set(["do","then","case"]),wm=new Set(["done","fi","esac"]),Lx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Tm(e,t){return e.map((n)=>n.provenance==="variable"&&Wm(n.text)?km(n.text,t.shellAssignments):_(n))}function km(e,t){return e.replace(Lx,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=km(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function Om(e,t){return{env:e,effectiveEnvAssignments:zx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Mm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function La(e,t){let n=Nm(e,t),r=e[0]??"";if(Nx.has(r))t.bodyDepth+=1;if(r==="elif"||wm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(wm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Wa(t,a)});let o=n.commandIndex;if(o!==-1&&Im.has(e[o]??""))e.filter((a)=>Pm.test(a)&&Ma(a)).forEach((a)=>{Bx(t,a)});let i=o===-1?-1:Lm(e,o);if(i===-1||e[i]!=="unset")return;let s=Ux(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}$x(t,a)})}function Dm(e,t){let n=Nm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Nm(e,t){let n=Dx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Wm(a)),o=r!==-1&&Im.has(e[Lm(e,r)]??""),i=Fx(t);return{assignments:e.flatMap((a,l)=>{let c=Wx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Ao(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Lm(e,t){let n=t;while(Mx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Wm(e){return ke(e)!==null||Am.test(e)}function Wx(e,t,n){return ke(e)??Gx(e,t,n)}function Gx(e,t,n){let r=Po(e,n,t);if(r)return r;let o=e.match(Am)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ma(e){return e===Da||e===Na||sa(e)}function Fx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function zx(e,t){let n=[Da,Na].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Bx(e,t){Wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function $x(e,t){if(!Ma(t)&&!Pm.test(t))return;if(e.shellAssignments.set(t,""),Ao(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ma(t)||t===Da||t===Na||Kn(t)){Wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Ux(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as Hx}from"path";function Xo(e,t){return ia.some((n)=>t?.has(n)||e.has(n))}function An(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(Hx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Gm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Gm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ee.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Gm(e,t,n){try{let r=Ct(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Fm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Xo(n.environment.env,n.envAssignments))return null;let r=An(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ga(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ga(e,t,n){let{subcommand:r,rest:o}=we(e),i=r?.toLowerCase();if(t.dynamicArguments||jx(o)||Zx(e,t.environment.env,t.envAssignments,n)||qx(o)||Vx(i,o))return!0;return i==="clean"&&Yx(o)>1}function jx(e){return e.some((t)=>/[$*?[]/.test(t))}function Vx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:ka}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Oa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||Kx(s))||r.has("-C");return o&&i}return!1}function Kx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function qx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Yx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Zx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Zo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>Jx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Xx(s.value);if(gd(n))return!0;return r.recursiveSubmodules}function Xx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Jx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Bm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??_(l)),o=n.environment.paths,i=An(r,n.cwd,o),s=n.originalCwd?o.realpath(tR(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Xo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?rR(e,n.shellAssignments,o):$m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!nR(a,r,t,n)||!En(a,n.environment)||Bo(a,n.environment)||xn(s,a)||xn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function nR(e,t,n,r){let o=r.environment.paths,i=zm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Ga(t,r,a)}function rR(e,t,n){let r=we(e.map(_)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&Ye(l,t??new Map))??a;if(!eR(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function $m(e,t){if(t.entryKind(zm(e,".git"))!=="missing")return e;let n=Qx(e);return n===e?null:$m(n,t)}var iR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",sR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Jo(e,t){return Um(e,t)}function Um(e,t,n){let r=e.map(_),o=Em(r,t.environment.env,t.envAssignments),i=o.blockedReason?w(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((pd(t.envAssignments)||xm(r,t.environment.env,t.envAssignments))&&aR(s))return v("git.ssh-env",iR);let a=_m(s,(c)=>{let u=An(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(oR(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Fm(r,a,t)??Bm(e,a,t);if(!l)return a;return n?.(l),null}function Hm(e,t){let n=null;return{match:Um(e,t,(o)=>{n=o}),relaxation:n}}function aR(e){let{subcommand:t,rest:n}=we(e),r=t?.toLowerCase();if(!r)return!1;if(sR.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&lR(n)}function lR(e){return e.find((t)=>!cR(t))?.toLowerCase()==="update"}function cR(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as FR}from"path";function jm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Qo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Vm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",uR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mR="rm -rf targeting root or home directory is extremely dangerous and always blocked.",fR="rm -rf in home directory is dangerous. Change to a project directory first.",Km={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mR},git_metadata_target:{id:"rm.git-metadata",reason:ze},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:dR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:fR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Vm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:uR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Vm}};function ei(e,t){let n=xt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=qo(r),i=gR(e);for(let s of i){let a=Sr(s.word);if(o&&a.unsafeBraceExpansion){let l=w(Cr({kind:"outside_anchored_cwd"},n,t.policy,Km),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=ve(l),u={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Ut(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",ze);if(!o)continue;for(let m of pR(c,n,u)){let d=Cr(m,n,t.policy,Km),f=w(d,t.policy);if(f)return f}}}return null}function pR(e,t,n){let r=Be(e,t,n);if(r.kind==="cwd_self_target")return[r,Be(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Be(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Be(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function gR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var _t={kind:"none"},Yt={kind:"dynamic"},hR=new Set(["<","<<","<<-","<<<","<&","<>"]),Ym=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,yR=/^(?:[0-9]+|[@*])$/,bR=bt.maxWords,Zm=bt.maxInputLength;function Xm(e){if(!e||A(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=_n(e[1])==="--"?2:1;if(e.length<=t)return xt;let n=e.slice(t);if(!n.every(xr))return Vt;return{kind:"literal",source:n.map(_).join(" ")}}function zm(e){let t=_n(e[1])==="--"?2:1,n=e[t],r=_n(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return xt;if(!xr(n))return Vt;return{kind:"literal",source:r}}function ei(e,t){let n=Um(e);if(n===-1)return xt;let r=Jx(t);if(!r)return xt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=eR(s,e,n,r.ifs);if(!a)return Vt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>Zx||i>Gm)return Vt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Hm)].filter((s)=>s!==null).join(" ")}}function Bm(e,t){let n=Um(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(xr)||o)return t;let i=r.map(_n),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let m=d[1]??d[2],u=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?Hm(g):"").join(" ")).join(" "),s.length>Gm)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function $m(e,t,n,r){if(!xe(e.map(_)).readsStdinAsCommands)return xt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&qx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return xt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Vt;return{kind:"literal",source:o.target.text}}if(!n)return xt;return r===void 0?Vt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=xe(e.map(_)).scriptIndex;if(n===null)return xt;let r=e[n],o=_n(r);if(bo(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?Vt:{kind:"literal",source:i}}var Xx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ie(s)!==null)return!1;let a=T(O(s));return!Xx.has(a)&&!Y.has(a)&&!Ut(a)}function Um(e){return xe(e.map(_)).commandIndex??-1}function Jx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Qx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function Qx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function eR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):tR(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!xr(i))return;let s=_n(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(xr)?e.map(_):void 0}function tR(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ti(e){let t=Pn(e[1])==="--"?2:1;if(e.length<=t)return _t;let n=e.slice(t);if(!n.every(Ar))return Yt;return{kind:"literal",source:n.map(_).join(" ")}}function Jm(e){let t=Pn(e[1])==="--"?2:1,n=e[t],r=Pn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return _t;if(!Ar(n))return Yt;return{kind:"literal",source:r}}function ni(e,t){let n=tf(e);if(n===-1)return _t;let r=SR(t);if(!r)return _t;let o=[],i=r.command?.length??0;for(let s of r.references){let a=ER(s,e,n,r.ifs);if(!a)return Yt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>bR||i>Zm)return Yt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ri)].filter((s)=>s!==null).join(" ")}}function Qm(e,t){let n=tf(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Ar)||o)return t;let i=r.map(Pn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?ri(p):"").join(" ")).join(" "),s.length>Zm)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function ef(e,t,n,r){if(!xe(e.map(_)).readsStdinAsCommands)return _t;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&hR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return _t;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Yt;return{kind:"literal",source:o.target.text}}if(!n)return _t;return r===void 0?Yt:{kind:"literal",source:r}}function ct(e,t=new Map){let n=xe(e.map(_)).scriptIndex;if(n===null)return _t;let r=e[n],o=Pn(r);if(vo(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?Yt:{kind:"literal",source:i}}var CR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function $a(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||ke(s)!==null)return!1;let a=A(O(s));return!CR.has(a)&&!Y.has(a)&&!Vt(a)}function tf(e){return xe(e.map(_)).commandIndex??-1}function SR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(vR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function vR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function ER(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Fa(o):xR(o,r);if(e.parameter==="*"){let a=Fa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:za(l,r)}let i=t[n+1+e.parameter];if(i&&!Ar(i))return;let s=Pn(i);return e.quoted?[s]:za(s,r)}function Fa(e){return e.every(Ar)?e.map(_):void 0}function xR(e,t){let n=Fa(e);if(!n)return;let r=n.map((o)=>za(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function za(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function xr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function _n(e){return e?_(e):""}function Hm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(Ne(e,"posix"),t)}function Rr(e){return Wa(e,new Set(Array.from(e.matchAll(Wm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||jm(r.words,n))return!0;sR(r,n)}return!1}function jm(e,t){let n=e.findIndex((s)=>Ie(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Er(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Lm(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=xe(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Lm(s[l],t)}let i=nR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return jm(e.slice(i),t)}function nR(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return rR(e,t+1);if(r==="exec")return oR(e,t+1);if(r==="env")return iR(e,t+1,n);return null}function rR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function oR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function iR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Er(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Er(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ie(i))continue;return r}return null}function sR(e,t){if(!e.words.every((n)=>Ie(n.text)!==null))return;for(let n of e.words){let r=Ie(n.text);if(!r)continue;if(Er(n,t))t.add(r.name)}}function Er(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Wm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Yx.test(o)||t.has(o))}))}function Lm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Er(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",aR="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",lR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,cR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,uR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,dR=/^(?:[0-9]+|[@*])$/;function qm(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=Kt(n),i=n.slice(r),s=v("xargs.shell-dynamic",Fa);if(fR(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let d=ef(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Jm(l,o),u=t.analyzeChild(l,{...Ht(a,t),dynamicInput:d,dynamicSourceInput:m||Zm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ga)});if(u)return u;let f=mR(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,aR]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...Ht(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=it(l,t.policy?.rules??[]);if(p)return p}return null}function mR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Ym(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Om(e,r,t.length,n);return o===null?[]:[o]}function Zm(e,t,n,r,o,i,s){if(Y.has(t)){if(st(e))return!1;if(n!==null&&pR(e,n,s))return!0;let a=Ue(e);if(!a){let l=lt(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Xm(a,n,s))return!0;if(Te(a))return!0;return gR(a,n,r)}if(De(t))return Vm(e,n,Ro,Xu(t));if(Pe.has(t))return Vm(e,n,ya,Xd);if(t==="eval"){let a=Qo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return hR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Rn.has(a.subcommand.toLowerCase())&&Qm(a.rest,n).some((l)=>l.includes(n))}return!1}function Xm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Te(i)===null&&n(i)===null}function Vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Ym(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function fR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(Be(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function Jm(e,t){return Qm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Qm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function ef(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function pR(e,t,n){let r=xe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Xm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Ym(a,t,s).some((d)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,d):f),u=xe(m);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(m[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(m[u.scriptIndex]??"").includes(d)})}))}function gR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(lR))if(Km(o,r))return!0;for(let o of e.matchAll(cR))for(let i of(o[1]??"").matchAll(uR))if(Km(i,r))return!0;return Wa(e,r)}function Km(e,t){let n=e[1]??e[2];return n!==void 0&&(dR.test(n)||t.has(n))}function hR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=xn(e,i);i=l.nextIndex-1;for(let c of Be(l.tokens,{environment:n,cwd:void 0})){let d=ef(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Jm(c.tokens,t)||Zm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Kt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var wr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",_r="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",CR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",bR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,tf=/\{\}|\{-?\d+\}/g,SR=["e","f","source","file","-e","-f","--source","--file"],vR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],ER=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),xR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),nf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),RR=new Set(["--workdir","--wd"]),rf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Oe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function cf(e){return Oe([...e],(t)=>Te(t))}function uf(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=An(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=bf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=An(t);if(p)return p;let g=cf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=IR(t);if(p)return p}if(d!==void 0&&a){let p=An(t);if(p)return p}let u=kR(d,t.cwd,t.environment.paths);if(u===null){let p=An(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Be(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some($a)){let g=An(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=pf(f.envAssignments,f.cwd,a);return Oe(p,(h)=>t.analyzeNested(h,g))}return Oe(Be(i,f),(p)=>wR(p,o,t,f))}function wR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(yf)){let h=An(n);if(h)return h}let d=cf(c);if(d)return d;let m=c.some(B),u=i||m,f=a&&u,p=pf(e.envAssignments,e.wrapperCwd,s||f);if(Y.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Oe(o,(C)=>n.analyzeChild(ri(l,C,n.budget),Ht(e,r)))};if(st(l))return h();let y=Ue(l);if(y){if(Cf(y)){let E=Rt(n);if(E)return E;if(o.length===0)return null;return Oe(o,(I)=>n.analyzeNested(af(y,I,n.budget),p))}if(B(y)){if(o.length>0)return Oe(o,(W)=>n.analyzeNested(af(y,W,n.budget),p));let E=vr(y);if(E?.[0]&&O(E[0])==="rm"&&$e(E)){let W=sf(n);if(W)return W}let I=E?n.analyzeChild(E,{...Ht(e,r),dynamicInput:a,shellDynamicMatch:v("parallel.shell-dynamic",_r),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",wr)}):null;if(I)return I;return n.analyzeNested(y,p)}let C=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((E)=>ei(q(E===void 0?l:i?l.map((I)=>gf(I,E)):[...l,...E]),y)):[];if(C.some((E)=>E.kind==="dynamic")){let E=Rt(n);if(E)return E}let x=C.flatMap((E)=>E.kind==="literal"?[E.source]:[]);if(x.length>0)return n.budget.charge("derivedTokens",x.length),Oe(x,(E)=>n.analyzeNested(E,p));if(Rr(y)){let E=Rt(n);if(E)return E}let A=n.analyzeNested(y,p);if(A)return A;if(u)return Rt(n);return null}let b=lt(q(l));if(b.kind==="dynamic"||b.kind==="literal"&&B(b.source))return Rt(n)??h();if(b.kind==="literal")return h();if(o.length>0){let C=Rt(n);if(C)return C;let x=h();if(x)return x;if(i)return null;let A=o.flatMap((E)=>E[0]===void 0?[]:[E[0]]);return n.budget.charge("derivedTokens",A.length),Oe(A,(E)=>n.analyzeNested(E,p))}if(u||a)return Rt(n)??h();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Oe(o,(y)=>za(ri(l,y,n.budget,tf),e.cwd,r));if(o.length>0)return Oe(o,(y)=>za(lf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,b)=>{if(b===0||!B(y))return[y];return y.startsWith("-")?[y.replace(tf,"")]:[]}),e.cwd,r);if(h)return h;return sf(n)}let g=o.length>0?o:[void 0];return Oe(g,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):lf(l,h,n.budget),b=v("parallel.shell-dynamic",_r),C=a&&e.head==="find"?TR(y,r):null,x=mf(y,a,n)??C?.customResult??null,A=O(e.head),E=a&&(A==="rm"&&Ba(y)||A==="xargs"&&ff(y)||C?.rmOptions===!0),I=a&&(E||C?.executedSource===!0||C===null&&df(y,A)),W=n.analyzeChild(y,{...Ht(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:E,dynamicSourceInput:x!==null||I,shellDynamicMatch:b,dynamicSourceMatch:b,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",wr)});if(I){let Q=P(b,n.policy);if(Q)return Q}return W??x??it(y,n.policy?.rules??[])})}function df(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return PR(e);if(t==="git")return _R(e);if(t==="find")return!0;if(Pe.has(t))return of(e,SR,br);if(De(t))return of(e,vR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||Cf(o)))}function _R(e){if(AR(e))return!0;let t=_e(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!Rn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function AR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function PR(e){if(st(e))return!1;let t=Ue(e);if(t!==null)return B(t);let n=lt(q(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function of(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,rf]).some((o)=>o.value===rf);return Xo(r,t,(o)=>n(e.map((i)=>gf(i,[o]))))}function mf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return Rt(n);return Oe(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function TR(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of Be(i,t))n.executedSource||=df(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&ff(a.tokens),n.customResult??=mf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=B(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function ff(e){let t=e.slice(Kt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>P(v(e,t),n.policy)}var Rt=ii("parallel.shell-dynamic",_r),IR=ii("parallel.command-stream-dynamic",CR),An=ii("parallel.command-stream-dynamic",bR),sf=ii("parallel.rm-recursive-force-dynamic",wr);function za(e,t,n){return P(Jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Bt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function pf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function gf(e,t){return e.replace(oi,(n)=>hf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=hf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function af(e,t,n){return ri([e],t,n)[0]??""}function lf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function hf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(oi)!==-1}function yf(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Cf(e){return/^\{[^{}\s]*\}$/.test(e)}function kR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!yR(e))return null;try{return ht(t??e,e,n)}catch{return null}}function bf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let C=Sa(e,t+1);n.push(...C.templateTokens),r=t+1,o=C.markerIndex;break}if(!p.startsWith("-")){let C=Sa(e,t);n.push(...C.templateTokens),r=t,o=C.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),b=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let C=y==="--replace"?b:p.slice(2);c||=C!==""&&C!=="{}",t++;continue}if(p==="-a"||xR.has(y)){c=!0,t+=b===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=b===void 0?2:1;continue}if(nf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=nf.has(p)?2:1;continue}if(RR.has(y)){c=!0;let C=b??g;if(C===void 0||C===":::"||C==="--"){t++;continue}a=C,t+=b===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&b!==void 0){t++;continue}if(ER.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?$a:yf);let d=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){d.push(p),p=[];continue}if(h!==void 0)p.push(h)}d.push(p)}c||=d.length>1;let m=OR(d),u=n.some(B),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function OR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>K.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>K.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Sf(e){return bf(e).childStart}var MR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ef(e,t,n,r,o=!1,i){let a=(Xn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",MR):null;return P(a,i)??xf(e,t,n,o,i)}function xf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=NR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(v("shell.dynamic-structure",si),o);if(P(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&_(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&Rn.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return P(v("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&LR(t)?P(v("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(v("shell.dynamic-structure",si),o):null}if(s==="xargs")return vf(e,t.slice(Kt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return vf(e,t.slice(Sf(t.map(_))),"parallel",n,r,o);return null}function vf(e,t,n,r,o,i){if(t.length===0)return null;let s=DR(t,r);if(Xn(e,s)){let l=P(v(`${n}.shell-dynamic`,n==="xargs"?Fa:_r),i);if(l)return l}let a=xf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return P(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:wr),i);return null}function DR(e,t){let n=Gt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function NR(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(Ee.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function LR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!bo(t[n.tokenIndex],n.value)})}var wf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>am(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>qm(e.words,{...Rf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>uf(e.words,{...Rf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})}];function Rf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function qt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function Pf(e){return wf.find((t)=>t.heads.has(e))?.analyze}function Tn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Ao(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Gt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),k=Te(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),de(k);if(n.strict)return ye(r);let G=Po(p,i(f.words));if(G){n.budget.charge("derivedTokens",G.length);let te=n.analyzeNested(G.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?q(i(f.words)):pn(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),C=h[0];if(!C)return null;if(Ut(C))throw new N("wrapperPeelIterations");let x=O(C),A=f.cwd===null?void 0:f.cwd??d,E=f.cwd===null?void 0:m,I=f.cwd===void 0?n.effectiveCwd:f.cwd,W=s?s.allowTmpdirVar:!pr(b,n.environment),Q=Ef(o,f.words,n.environment,t===0,n.strict,n.policy);if(Q)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Q.reason}),de(Q);let Je=Ho(h,n.policy);if(Je){for(let R of[Je.childIndex,...Je.alternativeChildIndices]){_f(y.wrapperNormalizationBudget);let k=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:Je.wrapper,output:i(k)});let G=Tn(k,t,{...y,effectiveCwd:I,envAssignments:b});if(G)return G}return null}let Ce=l?void 0:x==="eval"?Qo(g):x==="trap"&&!a?zm(g):void 0;if(a&&s&&x==="eval"){if(Ce?.kind==="dynamic")return Pn(s,n.policy);if(Ce?.kind==="literal"){let R=n.analyzeNested(Ce.source,{effectiveCwd:I,envAssignments:b});if(R)return R}return In(s,n.policy)}if(Ce?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(Ce?.kind==="literal"){r?.recordSegment({type:"recurse",reason:x==="eval"?"shell-eval":"shell-trap",innerCommand:Ce.source,depth:t+1});let R=n.analyzeNested(Ce.source,{effectiveCwd:I,envAssignments:b,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?Y.has(x):If(C,x)){if(st(h))return null;if(a&&s){let R=Ue(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let G=Pn(s,n.policy);if(G)return G}if(Rr(R)){let G=Pn(s,n.policy);if(G)return G}return n.analyzeNested(R,{effectiveCwd:I,envAssignments:b})}let k=lt(g);if(k.kind==="dynamic")return Pn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Pn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Pn(s,n.policy):null}if(l){let R=Ue(h),k=R?n.analyzeNested(R,{effectiveCwd:I,envAssignments:b}):lt(g).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=zR(h,b,I,n,r,t);if(R)return R;let k=Ue(h);if(k){let tn=ei(g,k);if(tn.kind==="dynamic")return ye(r);let Si=tn.kind==="literal"?tn.source:Bm(g,k),El=BR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:x,innerCommand:El}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:El,depth:t+1});let xl=n.analyzeNested(Si,{effectiveCwd:I,envAssignments:b});if(xl)return xl;return Rr(Si)?ye(r):null}let G=lt(g,n.strict?void 0:n.shellAssignments);if(G.kind==="dynamic")return ye(r);if(G.kind==="literal")return ai(G.source,I,b,n,r,t);let te=$m(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:I,envAssignments:b})}}if(!s&&(x==="source"||x===".")){let R=h[1]==="-p"?2:null;if(R!==null){let tn=n.commandView?g[R]:void 0;if(!tn)return null;if(tn.provenance!=="literal")return ye(r)}let k=R===null?1:3,G=h[k]==="--"?k+1:k,te=n.commandView?g[G]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,I,b,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(Pe.has(x)&&!l){if(!s&&n.strict&&ja(br(h),g))return ye(r);let R=Jd(h,(G)=>qt(n.analyzeNested(G,{effectiveCwd:I,envAssignments:b}))),k=P(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),de(k)}if(De(x)&&!l){if(!s&&n.strict&&ja(xo(h),g))return ye(r);let R=Zu(h);if(a&&s)return GR(x,R,I,b,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:x,codeArg:R,paranoidBlocked:k}),k){let te=P(v("interpreter.one-liner-paranoid",ir),n.policy);if(te)return de(te)}if(Ys(x,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let G=n.analyzeNested(R,{effectiveCwd:I,envAssignments:b});if(G&&!Tf(G,R))return G;if(sr(R,void 0,!n.strict)){let te=P(v("interpreter.dangerous-command",yn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:yn}),de(te)}r=void 0}}if(x==="busybox"&&h.length>1)return _f(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Tn(g.slice(1),t,{...y,effectiveCwd:I,envAssignments:b});let z=s?null:P(rm(x,h),n.policy);if(z)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:z.reason}),de(z);let D=r===y.trace?y:{...y,trace:r},ae={words:g,head:x,cwd:A,originalCwd:E,envAssignments:b,allowTmpdirVar:W,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:I,options:D,analyzeChildTokens:(R,k)=>a&&s?qa(R,t,D,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):qt(Tn(q(R),t+1,{...D,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:b}))??it(R,D.policy.rules),analyzeChild:(R,k)=>qa(R,t,D,k)},X=s&&(x==="xargs"||x==="parallel")?void 0:Pf(x);if(x==="rm"||x==="xargs"||x==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:W});let J=r&&x==="git"?km(ae.words,Va(ae)):void 0,be=Af(J?J.match:X?.(ae)??null,n.policy);if(r)$R(ae,be,J?.relaxation??null);if(be)return de(be);if(a&&s&&(x==="rm"||x==="rmdir")){if(!(x==="rm"&&($e(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?In(s,n.policy):null)??FR(s,n.policy)}let Pt=!s&&X===void 0&&!jr.has(x),Dn=r&&Pt?[]:void 0;if(Pt)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Dn?.push(k);let G=Af(WR(h,R,t,D,A,E,I,b),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:Dn??[],embeddedCommandFound:O(k)}),de(G)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Dn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ae=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ae,reason:Ae?.reason}),Ae)return de(Ae);return a&&s?In(s,n.policy):null}function qa(e,t,n,r){return qt(Tn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function WR(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=O(c);if(If(c,d)||Pf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=qa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!pr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function GR(e,t,n,r,o,i){if(!t)return In(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(v("interpreter.one-liner-paranoid",ir),o.policy);if(a)return de(a)}if(Ys(e,t))return In(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Tf(s,t))return s;if(sr(t,void 0,!o.strict)){let a=P(v("interpreter.dangerous-command",yn),o.policy);if(a)return de(a)}return In(i,o.policy)}function Tf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===En)&&!Vr(t);return n||r}function Pn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function In(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function FR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function zR(e,t,n,r,o,i){let s=sm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=or(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function BR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function $R(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function _f(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:yr}),de(UR())}function UR(){return{id:"",reason:yr,intent:"stop_and_explain"}}function If(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(T(t))}function Af(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var HR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,jR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function VR(e,t){let n=Mf(e,t);if(n.length===0)return!1;let r=n[Of(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return HR.test(e.join(" "))}function kf(e,t,n,r,o){if(e.dialect==="powershell"){let C=KR(e.words,o);if(C.kind==="none")return;if(!t||C.kind==="unknown")return null;return Ka(XR(C.target),t,n.paths)}let i=e.words.map(_),s=i.some((C)=>/^CDPATH\+?=/.test(C));if(!VR(i,n))return s?null:void 0;if(!t)return null;let a=Mf(i,n,t),l=Of(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((C)=>C.length<=1||!C.startsWith("-")||C==="--");if((d===-1?c:c.slice(0,d)).some((C)=>!/^-[LP]+$/.test(C)))return null;let u=d===-1?[]:c.slice(d),f=u[0]==="--"?u.slice(1):u;if(f.length>1)return null;let p=f[0],g=r.get("HOME")||n.home;if(p===void 0)return Ka(g,t,n.paths);let h=e.words.find((C)=>C.provenance==="variable"&&C.text===p),y=e.words.find((C)=>C.text===p&&/^~(?:\/|$)/.test(C.raw)),b=h?Ye(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return Ka(b,t,n.paths)}function Ka(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=ht(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function KR(e,t){let n=qR(e[0])?1:0,r=e[n];if(!YR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!jR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return ZR(e.slice(n+1),t)}function qR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function YR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function ZR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function XR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Of(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Mf(e,t,n){let r=JR(e);return yt([...r],t,n)}function JR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var iw="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Yt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function el(e,t,n,r){if(t>=K.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Qa(e,n);let d=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Ff(e,n),{reason:En,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ff(e,n),{reason:En,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Qa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=bm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let m=e.nodes[c+1],u=m?.kind==="connector"?m.operator:void 0,f=sw(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],C={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(wt(u)&&!wt(a))l=C;let x=wt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??C:C,A=Zt(x.connector)||Zt(u);if(d.kind==="function"){let z=h.flatMap((ae)=>{let X=Xt(ae);return X.functionDefinitions.set(d.name,d.body),Ya(ae,[X],f,u==="&",Zt(u))}),D=Za(z,[],x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=D.states,s=D.conditionalStates,a=void 0;continue}if(d.kind==="group"){let z=[],D=[];for(let X of h){let J=ui(d.body,t,n,r,[Xt(X)]);if(J.result)return J;if(z.push(...Ya(X,J.states,f,u==="&",Zt(u))),A)D.push(X,...f?J.states.map((be)=>li(X,be)):J.states)}let ae=Za(z,D,x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=ae.states,s=ae.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let E=Tw(e.nodes[c-1]),I=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),W=e.nodes[c-2],Q=wt(a)&&W?.kind==="command"?Fm(W)??lw(W):void 0,Je=[],Ce=[];for(let z of h){let D=cw(d,t,n,r,[Xt(z)]);if(D.result)return{result:D.result,states:i};let ae=e.dialect==="powershell"?D.states:D.states.map((X)=>li(z,X));for(let X of ae){let J=Xt(X),be=mw(d,t,n.trace?{...n,trace:zf(n.trace,I)}:n,r,J,wt(a),Q);if(be)return{result:be,states:i};let Mn=Lw(d,J.functionDefinitions);if(Mn)n.budget.charge("derivedTokens",di(Mn));let Pt=Mn?t+1>=K.recursionDepth.cap?Xa(d.displayText,n,[J]):ui(Mn,t+1,n,r,[J]):{result:null,states:Dw(d,J).flatMap((Ae)=>Iw(d,X,Ae,E))};if(Pt.result)return Pt;Je.push(...Ya(z,Pt.states,f,u==="&",Zt(u)));let Dn=typeof J.effectiveCwd==="string"&&J.effectiveCwd!==X.effectiveCwd&&d.redirections.every((Ae)=>["<",">",">>",">|"].includes(Ae.operator)&&Ae.target?.text==="/dev/null");if(A&&(E||!Dn))Ce.push(z),Ce.push(...Pt.states.map((Ae)=>f?li(z,Ae):Ae))}}let At=Za(Je,Ce,x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=At.states,s=At.conditionalStates,a=void 0}return{result:null,states:i}}function sw(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&aw(e,t)}function Ya(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>kn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function aw(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(uw(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function lw(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Zt(e){return e==="&&"||e==="||"}function Za(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Zt(i)?s:void 0;return{states:Zt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function zf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function cw(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=dw(e);if(s){if(t+1>=K.recursionDepth.cap)return Xa(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return Xa(s,n,o);if(a.status!=="complete")return Df(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Df(i,n,r,o)}function uw(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[Xt(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function dw(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Xa(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function mw(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:yw(n.environment.paths,o.createdDirectories,n.budget)}},l=xw(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Bf(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words),d=c.map(_),m=e.displayText,u=ym(c,o.shellGitContextState),f=vm(u,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Hd(e,i,Gw(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return Ww(m,h)}if(d.length===1&&d[0]?.includes(" ")&&!Xn(e.dialect,e.words)){let h=P(Te(d[0]),a.policy),y=h!==null&&!a.strict&&Vu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let b=Nf(e,l,o,f,s,a);if(b)return b;return Ia(u,o.shellGitContextState),null}let p=Tn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let b=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,C=el(h,t+1,{...a,effectiveCwd:b,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?zf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return C?{reason:C.reason,ruleId:C.ruleId,intent:C.intent}:null}});if(p)return{...p,segment:m};let g=Nf(e,l,o,f,s,a);if(g)return g;return Ia(u,o.shellGitContextState),null}function Nf(e,t,n,r,o,i){let s=Rw(e,t,n,r??new Map,i);if(s)return s;return Bf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),gw(e,t,n,i.environment.paths,i.budget),Cw(e,n,i.environment.paths,i.budget),Aw(e,n,o,i.environment,i.trace),null}var fw=new Set([">>","<>"]);function Bf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?pw(s):fw.has(s.operator)))continue;Lf(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=Uf(e.words.slice(1));if(!i)return;for(let s of i.operands)Lf(s,t,r,o)}function pw(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Lf(e,t,n,r){let o=e?.provenance==="literal"?or(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function gw(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of hw(e,n.shellGitContextState.shellAssignments)){let a=or(s,n.effectiveCwd,r,o);if(!a||!Yu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=K.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function hw(e,t){let n=Ja(vw(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return Sw(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=Uf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Ja(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Ja(e,t){if(Ew(e))return e.text;return(e&&Ye(e,t))??void 0}function yw(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=L(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${ow}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?L(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function Cw(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Ja(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!ew(c)&&!l)continue;let d=L(rw(l??"",c),n,r);if(a?bw(d,n):n.isDirectory(QR(d))&&$f(d,n))t.createdDirectories.add(d)}}function bw(e,t){let n=nw(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>tw(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||$f(o(i),t)}function $f(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function Sw(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function vw(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Uf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function Ew(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function tl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function xw(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Yt;let r=n[0];if(!r?.heredoc)return Yt;let o=/\$\(|`/.test(r.heredoc.body);if(!tl(r.heredoc)&&(!t||o))return iw;if(r.fd!==void 0&&r.fd!==0)return Yt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Yt;let i=e.redirections.some((l)=>l!==r&&Wf(l.target));if(se(e.words[0],"cat"))return i?Yt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Wf)?Yt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return Yt}function Wf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Rw(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(_w(e,i,n,r,o))return null;let a=ww(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Qa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function ww(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!tl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!De(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(v("interpreter.one-liner-paranoid",ir),n.policy);if(m)return m}if(!sr(l,void 0,!n.strict))return null;let d=P(v("interpreter.dangerous-command",yn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function _w(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!tl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Gt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(T(l)))return!1;return st(a)}function Aw(e,t,n,r,o){let i=kf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var Pw=new Set(["fi","done","esac"]);function Tw(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function Iw(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&Pw.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let u=Xt(n);return u.effectiveCwd=m,u})}function kw(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var Ow=/^[A-Za-z_][A-Za-z0-9_]*$/,Mw=8;function Dw(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!Ow.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Mw&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Xt(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Xt(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Sm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>Nw(r,n)))t.push(n);if(t.length>K.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function Nw(e,t){return e.effectiveCwd===t.effectiveCwd&&kw(e.compoundBodies,t.compoundBodies)&&kn(e.shellGitContextState.env,t.shellGitContextState.env)&&kn(e.literalHeredocFiles,t.literalHeredocFiles)&&kn(e.functionDefinitions,t.functionDefinitions)&&kn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&kn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Gf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Gf(e.createdDirectories,t.createdDirectories)}function Gf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function kn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Lw(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function Ww(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Gw(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Qa(e,t){let n=P(Te(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ff(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:En},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Fw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Hf(e,t,n,r){let o=el(e,0,{...t,...fu(t),budget:t.budget??Se(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function jf(e,t,n){try{return{decision:e()}}catch(r){let o=zw(r,t,n);if(!o)throw r;return o}}function zw(e,t,n){if(!(e instanceof N)||!Fw.has(e.kind))return null;let r=K[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Bw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),rl=new Set(["cc-safety-net","ccsn"]),$w=new Set(["bunx","npx","pnpx"]),Uw=new Set(["pnpm","yarn"]),Hw=new Set(["npm","pnpm","yarn"]),jw=new Set(["bun","node"]);function fi(e,t,n={}){if(rl.has(e))return 0;if($w.has(e)){if(n.broad)return nl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Hw.has(e)&&n.broad&&t[r]==="exec"){let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(Uw.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(jw.has(e)){let o=n.broad&&r!==-1?r:0;if(Vf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Vf(t[o+1]))return o+2}return null}function nl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return rl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return rl.has(e.slice(0,t))}function Vf(e){let t=e?.replaceAll("\\","/");return[...Bw].some((n)=>t===n||t?.endsWith(`/${n}`))}var Kf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function qf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=bn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Vw(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Vw(e,t){let n=yt([...e],t),r=n.slice(1),o=fi(T(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var Jf="This path contains the protected policy config and you must not modify or delete it.",Kw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Qf(e,t,n){let r=Qw(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Yf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Zf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Zf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Yf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Nr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Yf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Ar(a,n,r,o,i));return s?{target:s}:null}function Zf(e,t,n,r,o){let i=bn(e,t,r,o,{findSegmentTarget:(s,a)=>qw(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Ar(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Jw(s,t,n,r,o)?.target??null});return i?{target:i}:null}function qw(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r),s=T(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Yw(a)){let l=Zw(a).find((c)=>Xf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(Sr(q(i))??q(["."])).find((d)=>{let m=pe(d.text,t.variables);return Ar(m,t.cwd,n,r,o)||Xf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>e_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Xw(i,s))return null;for(let l of[...e,...i])for(let c of ep(l))if(Ar(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function Yw(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Zw(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Xw(e,t){if(!Kw.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Jw(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of ep(i))if(Ar(s,t,n,r,o))return{target:s};return null}function ep(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Qw(e,t,n){let r=(a)=>Pr(le(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Vn(e.executionCwd)),r(Vn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Ar(e,t,n,r,o){let i=Vl(e,t,r,o,(s)=>Pr(s)===Ur);return i!==null&&n.files.has(Pr(i))}function Xf(e,t,n,r,o){return n.directoriesAndAncestors.has(Pr(le(e,t,r,o)))}function e_(e,t,n,r,o){let i=Pr(le(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Pr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as mp,resolve as yi,win32 as t_}from"path";import{fileURLToPath as n_}from"url";var fp="Access to a sensitive path is not allowed.",pp=new Set(["echo","printf"]),r_=new Set(["find"]),o_=new Set(["!","do","elif","else","if","then","until","while"]),i_=new Set(["-exec","-execdir"]),s_=new Set([";","+"]),a_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),l_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),gp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),c_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),u_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),hp=new Set(["-c","-e","-r","-E","--eval","--exec"]),d_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),m_=new Set(["grep","rg"]),f_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),p_=new Set(["commit","merge","notes","stash","tag"]),g_=new Set(["-m","--message"]),h_=new Set(["--grep"]),tp=new Set(["jq","gojq","jaq"]),np="f",rp="file",y_="files",C_=new Set(["e","f"]),b_=new Set(["regexp","file"]),S_=new Set(["e","f","A","B","C","m"]),v_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ol="__CC_SAFETY_NET_PIPE_INPUT__",sl=/[\w./~@+-]*[./~][\w./~@+-]*/g,E_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,x_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,R_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,op=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,ip=/\b(?:system|exec|spawn|popen)\s*$/,w_=/\b(?:eval|exec)\s*\(/g,__=/\b(?:eval|exec)\s*$/,A_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function sp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(RA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=EA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(xp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!ll(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!ll(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&wA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function yp(e,t,n,r,o={}){let i=ap(e,n,r),s=sp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=sp(i,t,e.invocation.context.configCwd,n,r,new Set(ap(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&P_(e,n)?null:a}function P_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=je(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return cl(i,o.slice(1))}function cl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>a_.has(n))}function ap(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?On(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function On(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iA(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(z_(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...Ci(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Cp(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:d.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function ul(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?On(s,t,n,r,o,i):null}function Ci(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(tp.has(je(ut(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Ci(g,t,n,r,o,i)]}let l=F_(e).map(a),c=ut(e);if(c.length===0)return l;let d=c[0]??"",m=je(d).toLowerCase(),u=c.slice(1),f=c.findIndex((g)=>!o_.has(g));if(n.skipMetadataOnlySegments===!0&&f!==-1&&cl(je(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=I_(d,m,u);if(p)return[...l,...p.map(a)];if(pp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...bp(e).map(a)]:l;if(m==="eval")return[...l,...ul(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Xe(m,g)).map(a)];if(m==="git")return[...l,...$_(u).map(a)];if(m==="gh")return[...l,...al(m,u,f_).map(a)];if(tp.has(m))return[...l,...B_(u).map(a)];if(m_.has(m))return[...l,...fA(u).map(a)];if(r_.has(m))return[...l,...V_(u,t,n,r,o,i).map(a)];if(Pe.has(m))return[...l,...u.flatMap((g)=>Xe("awk",g)).map(a),...u.flatMap((g)=>q_(g,t,n,r,o,i)),...u.flatMap(Y_).map(a)];if(m==="curl")return[...l,...u.flatMap((g)=>Xe(m,g)).map(a),...U_(u).map(a)];if(mr(m)){let g=ur.has(m)?xe([m,...u]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...On(h,t,n,r,o,i),...u.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...K_(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((g)=>Xe(m,g)).map(a)]}function I_(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s)){let a=ut(e),l=cl(je(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...bp(e),...l].map((c)=>({target:c,cwd:i}))}return Cp(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=ut(e);if(!mr(je(a[0]??"").toLowerCase()))return[];return ul(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Cp(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>ur.has(l)?On(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function bp(e){let t=ut(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase();if(!pp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[dl(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=ut(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return D_(r);return[]}function D_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[dl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>N_(t,r.slice(i*n,(i+1)*n)))}function N_(e,t){let n=0;return dl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function dl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=ut(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Kt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,ol]:l.map((m)=>m.split(c).join(ol));return Ci(d,t,n,r,o,i).some((m)=>m.target.includes(ol))}function W_(e){let t=ut(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!mr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(hp.has(o)||Sp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(A_.get(n)?.has(o))r++;continue}return!1}return!0}function ml(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Ep(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var lp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!lp.test(e))return e;return`~${e.replace(lp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...p_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),g_):al("git",e.slice(n),h_)];if(t.push(...Xe("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return cp(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:cp(o,t)})}function cp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if(gp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return gp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!i_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>s_.has(f)),m=d===-1?c:c.slice(0,d),u=Ci(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!l_.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(hp.has(c)||Sp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Sp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return d_.get(t[t.length-1]??"")?.has(ml(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>On(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(fl),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=J_(t,X_(e));if(l.kind==="unmaskable")return Z_(t).map(a);let c=l.masked.match(op)!==null||l.literals.some((g)=>ip.test(l.masked.slice(0,g.start))),d=l.masked.match(w_)!==null||l.literals.some((g)=>__.test(l.masked.slice(0,g.start))),m=r.inlineLiteralsPresumedData===!0&&!ur.has(e),u=m&&!(nA(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(op),(g)=>{let h=g.index+g[0].length;return{start:h,end:Xs(l.masked,h)}}):[],p=!m||f.some((g)=>Js(l.masked,g.start))?l.literals:l.literals.filter((g)=>ip.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...u.map((g)=>g.text).filter((g)=>g!=="").map(a),...u.flatMap((g)=>fl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(sl)??[]).map(a),...c?p.flatMap((g)=>ul(g.text,n,r,o,i,s)??[a(g.text)]):[],...d?l.literals.flatMap((g)=>hi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function X_(e){let t=ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(x_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tA(e,o))return{kind:"unmaskable"};let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=eA(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&R_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Q_(e,t){return E_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function eA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(c_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>u_.has(i)))continue;if(o.length>1)return!0;if(rA(e,r)===".")return!0;if(oA(e,r+n.length)==="(")return!0}return!1}function rA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function oA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iA(e,t,n,r,o,i){return uA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...On(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...sA(a,r)?aA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sA(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aA(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(fl)}function fl(e){let t=cA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Kn(o,n))continue;if(vp(e,r,n)){let i=dA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Kn(i,n))continue;if(vp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function vp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===y_)o=!0;if(b_.has(m))r=!0;if(u!==void 0){if(m===rp)t.push(u);continue}if(v_.has(m)){let f=e[l+1];if(m===rp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(C_.has(h))r=!0;if(S_.has(h)){u=h,f=m.slice(g+1);break}}if(u==="")continue;if(f.length>0){if(u===np)t.push(f);continue}let p=e[l+1];if(u===np&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Ep(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Ep(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gA=".env.",hA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yA=[".env.example.",".env.sample."];function CA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=xp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function xp(e,t,n,r){try{return kr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var SA=new Set(["node_modules","__pycache__"]),vA=[["vendor","bundle"],["vendor","cache"]];function EA(e,t,n,r,o){if(CA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>bA(s)||ll(e,t,r,o);if(hA.has(s)||yA.some((u)=>s.startsWith(u)))return null;let c=U(PA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((dp(a,f)||dp(c,f))&&ct(u.id,n))return u.id}let d=xA(i,t,n,r,o);if(d)return d;if(pA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(gA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(_A(a))return null;if(!s.includes(".")&&qn.pattern.test(s)&&ct(qn.id,n))return qn.id;let m=AA(s,n);if(m)return m;return null}function xA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Tr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ir(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Tr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Tr(e,s,["credentials"])||Tr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((d)=>Ir(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Ir(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>F(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ue(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Tr(e,ue(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ue(Ze("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>F(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ir(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ue(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ze("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&Jt(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var up=new WeakMap;function V(e,t,n,r,o){let i=up.get(o)??new Map;up.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>Rp(e,ue(t,r)))}function Tr(e,t,n){return n.some((r)=>Jt(U(e),U(ue(t,r))))}function Ir(e,t,n,r,o){return Rp(e,Ze(t,n,r,o))}function Rp(e,t){return U(e)===U(t)}function ue(e,...t){return He([e,...t].filter(Boolean).join("/"))}function RA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));return n.some((a)=>Jt(s,U(kr(a,r,o,i))))}function wA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(L(ve(a),o.paths,i)):"",c=U(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=U(d?He(L(yi(ve(d)),o.paths,i)):l&&He(L(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=bs(u);if(f&&mp.basename(s)!==U(f.name))return!1;let p=U(kr(f?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Jt(s,p)&&!(f&&s===p)})}function _A(e){let t=e.split("/");return t.some((n)=>SA.has(n))||vA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function AA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:He(yi(t,s)),l=He(L(a,n.paths,r));if(!Jt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function dp(e,t){return e===t||e.startsWith(`${t}/`)}function PA(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=mp.normalize(gi(s)?s:He(yi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function kr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return He(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(L(ve(r),t.paths,n)):"",i=He(ve(TA(ot(e,t))));return{home:o,normalized:i}}function TA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return n_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ue(t,e.slice(2));return e}function IA(e){if(process.platform==="win32")return!0;return t_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&IA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var kA={findPolicyMutation:Qf,findGitMetadataMutation:wd,resolveGitMetadata:MA,loadPolicySnapshot:mu,findSensitiveTarget:yp,analyzeCommand:Hf,getModes:zi},OA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function wp(e,t){let n={...kA,...t.dependencies},r=LA(e),o=Or(e)?e.command:r,i=_t("policy-protection",o,()=>fr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Or(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:jd,intent:"stop_and_explain"}};let l=Se(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Jf,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=_t("policy-protection",o,()=>qf(i,t.environment,l));if(m){let C=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Kf,intent:"hard_stop",evidence:{command:C,segment:m.target}}}}let u=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ke,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...DA(f)},y=p.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Or(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!Or(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let b=_t("command-analysis",o,()=>jf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},NA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===yr&&!OA.test(b.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function MA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function DA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function NA(e){return ge(e,"declared-command")?.program}function LA(e){try{return zn(e.input)}catch(t){let n=Or(e)?e.command:void 0;throw new Qt("policy-protection",hl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new Qt(e,hl(e,r instanceof Qe?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ei:Ln,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Or(e){return e.route.kind==="command"}import{appendFileSync as YA,mkdirSync as ZA}from"fs";import{isAbsolute as XA,join as bl}from"path";import{lstatSync as Ap,readdirSync as WA,readFileSync as GA,rmdirSync as FA,statSync as Pp,unlinkSync as zA,utimesSync as BA,writeFileSync as $A}from"fs";import{join as Mr}from"path";function _p(e,t={}){return so(ln(e,t),e.home).policy.audit.retention_days}var Cl=86400000,UA=".last-prune",HA=/^\d{4}-\d{2}$/,jA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Tp=(e)=>Math.floor(e/Cl);function kp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Pp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Mr(t,UA),i=Pp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Tp(i)===Tp(r))return;let s=r-_p(e)*Cl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){VA(Mr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))KA(Mr(t,l.name),s)}$A(o,"",{mode:384}),BA(o,r/1000,r/1000)}catch{}}function VA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!HA.test(r.name))continue;let o=Mr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=jA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Cl;if(!Number.isFinite(a)||a>=t)continue;Op(Mr(o,i.name))}if(r.name!==n)Ip(o)}Ip(e)}function KA(e,t){try{let n=Ap(e);if(n.mtimeMs>=t)return;let r=GA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(qA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Ap(e).mtimeMs!==n.mtimeMs)return;Op(e)}catch{}}function qA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return WA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Op(e){try{zA(e)}catch{}}function Ip(e){try{FA(e)}catch{}}var JA="2.5.1",QA=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:QA),m=bi(dt(r),eP),u=s.toolName?bi(dt(s.toolName),tP):void 0,f=i===null?void 0:bi(dt(i),nP),p=bl(l,oP(f?.value??null),c.slice(0,7));ZA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:JA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};YA(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),kp(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&XA(n)?n:null}function sP(e){let t=iP(e);return t?bl(t,".cc-safety-net","logs"):null}function Dp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Mp(e){return"command"in e?e.command??"":""}function Np(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Gp(e,t,n){try{let r=wp(t,{environment:e,...n.guard});return Wp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw Wp(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:aP(r.cause)}),r}}function Wp(e,t,n,r,o=!0,i){Np(e,Dp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return K[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function en(e,t={}){return{malformed:!0,denial:Wn(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Fp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Wn())}}}function lP(e,t,n,r){let o=rc();if(n.cancelled?.(t))return n.block(Wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=Rl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Gp(o,i,{guard:{auditAllowed:oc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Qt))throw l;if(It(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var cP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>dP(e,t,n),getSessionId:(e)=>pP(e),allow:{action:"allow"},block:(e)=>gP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},zp=uP();function uP(e={}){return Fp(cP,e)}function dP(e,t,n){if(!e||typeof e!=="object")return en(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return en(null);if(!r.input||typeof r.input!=="object")return en(null,{toolName:r.tool});let o=mP(t);if(!o)return en(null,{toolName:r.tool});let i=Yl(".",[o],n);if(!i)return vl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=fP(t,e);if(!s.ok)return en(i,{toolName:r.tool});if(!s.command)return nn(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return en(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Zl(a,i,n);if(!l)return vl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return nn(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function mP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function fP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function pP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function gP(e){return{action:"reject-and-continue",message:wl(e)}}function hP(e){e.on("tool.call",(t)=>zp(t,e))}export{hP as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Ar(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function Pn(e){return e?_(e):""}function ri(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Ua(e,t){return Ba(Ne(e,"posix"),t)}function Pr(e){return Ua(e,new Set(Array.from(e.matchAll(Ym)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ba(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ba(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ba(o,n))||nf(r.words,n))return!0;PR(r,n)}return!1}function nf(e,t){let n=e.findIndex((s)=>ke(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(wr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return qm(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=xe(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&qm(s[l],t)}let i=RR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return nf(e.slice(i),t)}function RR(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return _R(e,t+1);if(r==="exec")return wR(e,t+1);if(r==="env")return AR(e,t+1,n);return null}function _R(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function wR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function AR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return wr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return wr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(ke(i))continue;return r}return null}function PR(e,t){if(!e.words.every((n)=>ke(n.text)!==null))return;for(let n of e.words){let r=ke(n.text);if(!r)continue;if(wr(n,t))t.add(r.name)}}function wr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Ym)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(yR.test(o)||t.has(o))}))}function qm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||wr(e,t))}var Ha="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ja="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",IR="__CC_SAFETY_NET_XARGS_INPUT__",oi="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ii="rm",TR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,kR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,OR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,MR=/^(?:[0-9]+|[@*])$/;function sf(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=Zt(n),i=n.slice(r),s=v("xargs.shell-dynamic",ja);if(NR(i,o,t)&&w(s,t.policy))return w(s,t.policy);for(let a of $e(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?w(s,t.policy):null;if(c)return c;let u=mf(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&uf(l,o),d=t.analyzeChild(l,{...Kt(a,t),dynamicInput:u,dynamicSourceInput:m||lf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ha)});if(d)return d;let f=DR(l,o,t.policy?.rules??[],w(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,IR]:l,h=o!==null&&(l.some((C)=>C.includes(o))||Array.from(a.envAssignments.values()).some((C)=>C.includes(o))),y=t.analyzeChild(p,{...Kt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function DR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function af(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=jm(e,r,t.length,n);return o===null?[]:[o]}function lf(e,t,n,r,o,i,s){if(Y.has(t)){if(at(e))return!1;if(n!==null&&LR(e,n,s))return!0;let a=Ue(e);if(!a){let l=ct(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!cf(a,n,s))return!0;if(Te(a))return!0;return WR(a,n,r)}if(De(t))return rf(e,n,wo,cd(t));if(Ie.has(t))return rf(e,n,xa,um);if(t==="eval"){let a=ti(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return GR(e,n,i);if(t==="git"){let a=we(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&wn.has(a.subcommand.toLowerCase())&&df(a.rest,n).some((l)=>l.includes(n))}return!1}function cf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Te(i)===null&&n(i)===null}function rf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,oi]).sources.some((a)=>a.value===oi);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${oi}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${oi}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>af(l,t,a))));return Qo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function NR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from($e(e,n),(i)=>i.head)),o=t===null?[...e,ii]:e.map((i,s)=>s===0?i:i.replaceAll(t,ii));return Array.from($e(o,n)).some((i)=>i.head===ii&&!r.has(ii))}function uf(e,t){return df(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function df(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function mf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function LR(e,t,n){let r=xe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!cf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return af(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=xe(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function WR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(TR))if(of(o,r))return!0;for(let o of e.matchAll(kR))for(let i of(o[1]??"").matchAll(OR))if(of(i,r))return!0;return Ua(e,r)}function of(e,t){let n=e[1]??e[2];return n!==void 0&&(MR.test(n)||t.has(n))}function GR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=_n(e,i);i=l.nextIndex-1;for(let c of $e(l.tokens,{environment:n,cwd:void 0})){let u=mf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&uf(c.tokens,t)||lf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=lt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Zt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Ir="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Tr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",zR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",BR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ai=/\{[^{}\s]*\}/g,ff=/\{\}|\{-?\d+\}/g,pf=/[\s;&|<>()$`\\"']/,$R=["e","f","source","file","-e","-f","--source","--file"],UR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],HR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),jR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),gf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),VR=new Set(["--workdir","--wd"]),hf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Oe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Cf(e){return Oe([...e],(t)=>Te(t))}function Sf(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=In(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Of(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=In(t);if(g)return g;let p=Cf(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=QR(t);if(g)return g}if(u!==void 0&&a){let g=In(t);if(g)return g}let d=e_(u,t.cwd,t.environment.paths);if(d===null){let g=In(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...$e(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some(qa)){let p=In(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=wf(f.envAssignments,f.cwd,a);return Oe(g,(h)=>t.analyzeNested(h,p))}return Oe($e(i,f),(g)=>KR(g,o,t,f))}function KR(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(Tf)){let E=In(n);if(E)return E}let c=Cf(l);if(c)return c;let u=l.some(G),m=o||u,d=s&&m,f=wf(e.envAssignments,e.wrapperCwd,i||d),g=m?{...f,worktreeMode:!1}:f,p=a.join(" "),h=G(p.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>pf.test(E))),C=h||pf.test(a[0]??""),b=y&&C&&t.jobs.length>0?null:qR(e,t,n,r,g,u);if(b||!y)return b;return vf(G(p)?p:`${p} {}`,!h,e,t,n,r,g)}function qR(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,u=e.tokens,m=a||i;if(Y.has(e.head)){let f=()=>{if(!a||s.length===0)return null;return Oe(s,(h)=>n.analyzeChild(si(u,h,n.budget),Kt(e,r)))};if(at(u))return f();let g=Ue(u);if(g){if(kf(g)){let b=wt(n);if(b)return b;if(s.length===0)return null;return Oe(s,(E)=>n.analyzeNested(Pf(g,E,n.budget),o))}if(G(g))return vf(g,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((b)=>ni(q(b===void 0?u:a?u.map((E)=>Af(E,b)):[...u,...b]),g)):[];if(h.some((b)=>b.kind==="dynamic")){let b=wt(n);if(b)return b}let y=h.flatMap((b)=>b.kind==="literal"?[b.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),Oe(y,(b)=>n.analyzeNested(b,o));if(Pr(g)){let b=wt(n);if(b)return b}let C=n.analyzeNested(g,o);if(C)return C;if(m)return wt(n);return null}let p=ct(q(u));if(p.kind==="dynamic"||p.kind==="literal"&&G(p.source))return wt(n)??f();if(p.kind==="literal")return f();if(s.length>0){let h=wt(n);if(h)return h;let y=f();if(y)return y;if(a)return null;let C=s.flatMap((b)=>b[0]===void 0?[]:[b[0]]);return n.budget.charge("derivedTokens",C.length),Oe(C,(b)=>n.analyzeNested(b,o))}if(m||c)return wt(n)??f();return null}if(e.head==="rm"&&st(u)){if(a&&s.length>0)return Oe(s,(g)=>Va(si(u,g,n.budget,ff),e.cwd,r));if(s.length>0)return Oe(s,(g)=>Va(bf(u,g,n.budget),e.cwd,r));let f=Va(u.flatMap((g,p)=>{if(p===0||!G(g))return[g];return g.startsWith("-")?[g.replace(ff,"")]:[]}),e.cwd,r);if(f)return f;return _f(n)}let d=s.length>0?s:[void 0];return Oe(d,(f)=>{let g=f===void 0?u:a?si(u,f,n.budget):bf(u,f,n.budget),p=v("parallel.shell-dynamic",Tr),h=c&&e.head==="find"?JR(g,r):null,y=xf(g,c,n)??h?.customResult??null,C=O(e.head),b=c&&(C==="rm"&&Ka(g)||C==="xargs"&&Rf(g)||h?.rmOptions===!0),E=c&&(b||h?.executedSource===!0||h===null&&Ef(g,C)),I=n.analyzeChild(g,{...Kt(e,r),worktreeMode:l||c||m?!1:n.worktreeMode,dynamicInput:c||m,dynamicRmInput:b,dynamicSourceInput:y!==null||E,shellDynamicMatch:p,dynamicSourceMatch:p,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Ir)});if(E){let T=w(p,n.policy);if(T)return T}return I??y??it(g,n.policy?.rules??[])})}function vf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Oe(r.jobs,(c)=>o.analyzeNested(Pf(e,t?c.map(ri):c,o.budget),s));let a=_r(e);if(a?.[0]&&O(a[0])==="rm"&&st(a)){let c=_f(o);if(c)return c}return(a?o.analyzeChild(a,{...Kt(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",Tr),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Ir)}):null)??o.analyzeNested(e,s)}function Ef(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return XR(e);if(t==="git")return YR(e);if(t==="find")return!0;if(Ie.has(t))return yf(e,$R,xr);if(De(t))return yf(e,UR,_o);return!1}function Ka(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||kf(o)))}function YR(e){if(ZR(e))return!0;let t=we(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!wn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function ZR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function XR(e){if(at(e))return!1;let t=Ue(e);if(t!==null)return G(t);let n=ct(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function yf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,hf]).some((o)=>o.value===hf);return Qo(r,t,(o)=>n(e.map((i)=>Af(i,[o]))))}function xf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return wt(n);return Oe(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function JR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of $e(i,t))n.executedSource||=Ef(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ka(a.tokens)||a.head==="xargs"&&Rf(a.tokens),n.customResult??=xf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=G(a);continue}let l=lt(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Rf(e){let t=e.slice(Zt(e).childStart);return O(t[0]??"")==="rm"&&Ka(t)}function li(e,t){return(n)=>w(v(e,t),n.policy)}var wt=li("parallel.shell-dynamic",Tr),QR=li("parallel.command-stream-dynamic",zR),In=li("parallel.command-stream-dynamic",BR),_f=li("parallel.rm-recursive-force-dynamic",Ir);function Va(e,t,n){return w(ei(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:vn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function wf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Af(e,t){return e.replace(ai,(n)=>If(n,t))}function si(e,t,n,r=ai){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=If(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Pf(e,t,n){return si([e],t,n)[0]??""}function bf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function If(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(ai)!==-1}function Tf(e){if(qa(e))return!0;for(let t of e.matchAll(ai))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function qa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function kf(e){return/^\{[^{}\s]*\}$/.test(e)}function e_(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!FR(e))return null;try{return Ct(t??e,e,n)}catch{return null}}function Of(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,u=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=wa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=wa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=p.indexOf("="),C=y===-1?p:p.slice(0,y),b=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){c=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){u||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){u=!0,t+=2;continue}if(C==="--replace"||p.startsWith("-i")&&p.length>2){let E=C==="--replace"?b:p.slice(2);u||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||jR.has(C)){u=!0,t+=b===void 0?2:1;continue}if(p==="-q"||p==="--quote"){s=!0,t++;continue}if(p==="--pipe"||p==="--pipepart"){a=!0,t++;continue}if(C==="--env"){u=!0,t+=b===void 0?2:1;continue}if(gf.has(C)||p.startsWith("-S")&&p.length>2){i=!0,t+=gf.has(p)?2:1;continue}if(VR.has(C)){u=!0;let E=b??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=b===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&b!==void 0){t++;continue}if(HR.has(p)){if(h===void 0||h===":::"||h==="--"){u=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}u||=n.some(c?qa:Tf);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){m.push(p),p=[];continue}if(y!==void 0)p.push(y)}m.push(p)}u||=m.length>1;let d=t_(m),f=n.some(G),g=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:f,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:g,unsupported:u,workdir:l,dryRun:c}}function t_(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>K.derivedTokens.cap)throw new W("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>K.derivedTokens.cap)throw new W("derivedTokens");o.push([...i,s])}t=o}return t}function Mf(e){return Of(e).childStart}var n_="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ci="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Za(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ya(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Nf(e,t,n,r,o=!1,i){let a=(er(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ee(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",n_):null;return w(a,i)??Lf(e,t,n,o,i)}function Lf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Za(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=gn(e,t),l=o_(a);if(ee(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return w(v("shell.dynamic-structure",ci),o);if(w(Jo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&_(m)==="--");if(ee(o,"shell.dynamic-structure",r)&&c&&wn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return w(v("shell.dynamic-structure",ci),o);return null}if(s==="find")return ee(o,"shell.dynamic-structure",r)&&i_(t)?w(v("shell.dynamic-structure",ci),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&_(c)==="--"),l=st(t.map(_));return ee(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?w(v("shell.dynamic-structure",ci),o):null}if(s==="xargs")return Df(e,t.slice(Zt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Df(e,t.slice(Mf(t.map(_))),"parallel",n,r,o);return null}function Df(e,t,n,r,o,i){if(t.length===0)return null;let s=r_(t,r);if(er(e,s)){let l=w(v(`${n}.shell-dynamic`,n==="xargs"?ja:Tr),i);if(l)return l}let a=Lf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Za(l)&&Ya(l)))return w(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ha:Ir),i);return null}function r_(e,t){let n=Bt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function o_(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(Ee.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function i_(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Za(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ya(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ya(s)))return!0;continue}if(t=!0,a)return!0;let l=lt(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function Xa(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!vo(t[n.tokenIndex],n.value)})}var Ff=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>ei(e.words,Gf(e))},{heads:new Set(["git"]),analyze:(e)=>Jo(e.words,Ja(e))},{heads:new Set(["find"]),analyze:(e)=>Sm(e.words,{...Gf(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>sf(e.words,{...Wf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Sf(e.words,{...Wf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})}];function Wf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Tn(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function Gf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ht(e.envAssignments,e.options.environment),trustedTmpdirValue:vn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function Ja(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function $f(e){return Ff.find((t)=>t.heads.has(e))?.analyze}function On(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((P)=>o==="posix"?_(P):P.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Io(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Bt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let x=[...g,...i(f.words)].join(" "),P=Te(x);if(P)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:P.reason}),de(P);if(n.strict)return ye(r);let z=To(g,i(f.words));if(z){n.budget.charge("derivedTokens",z.length);let ne=n.analyzeNested(z.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(ne)return ne}}let p=f.rewritten?q(i(f.words)):gn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-p.length),output:h})}let C=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),b=h[0];if(!b)return null;if(Vt(b))throw new W("wrapperPeelIterations");let E=O(b),I=f.cwd===null?void 0:f.cwd??u,T=f.cwd===null?void 0:m,k=f.cwd===void 0?n.effectiveCwd:f.cwd,F=s?s.allowTmpdirVar:!br(C,n.environment),ue=Nf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ue)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ue.reason}),de(ue);let Xe=Vo(h,n.policy);if(Xe){for(let x of[Xe.childIndex,...Xe.alternativeChildIndices]){zf(y.wrapperNormalizationBudget);let P=p.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:Xe.wrapper,output:i(P)});let z=On(P,t,{...y,effectiveCwd:k,envAssignments:C});if(z)return z}return null}let Ce=l?void 0:E==="eval"?ti(p):E==="trap"&&!a?Jm(p):void 0;if(a&&s&&E==="eval"){if(Ce?.kind==="dynamic")return kn(s,n.policy);if(Ce?.kind==="literal"){let x=n.analyzeNested(Ce.source,{effectiveCwd:k,envAssignments:C});if(x)return x}return Mn(s,n.policy)}if(Ce?.kind==="dynamic"&&(n.strict||!n.commandView||!$a(n.commandView)))return ye(r);if(Ce?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:Ce.source,depth:t+1});let x=n.analyzeNested(Ce.source,{effectiveCwd:k,envAssignments:C,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?Y.has(E):Hf(b,E)){if(at(h))return null;if(a&&s){let x=Ue(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let z=kn(s,n.policy);if(z)return z}if(Pr(x)){let z=kn(s,n.policy);if(z)return z}return n.analyzeNested(x,{effectiveCwd:k,envAssignments:C})}let P=ct(p);if(P.kind==="dynamic")return kn(s,n.policy);if(P.kind==="literal")return s.dynamicSourceInput?kn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?kn(s,n.policy):null}if(l){let x=Ue(h),P=x?n.analyzeNested(x,{effectiveCwd:k,envAssignments:C}):ct(p).kind==="dynamic"?ye(r):null;if(P)return P}if(s===void 0){let x=c_(h,C,k,n,r,t);if(x)return x;let P=Ue(h);if(P){let rn=ni(p,P);if(rn.kind==="dynamic")return ye(r);let Ri=rn.kind==="literal"?rn.source:Qm(p,P),Al=u_(Ri);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:Al}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Al,depth:t+1});let Pl=n.analyzeNested(Ri,{effectiveCwd:k,envAssignments:C});if(Pl)return Pl;return Pr(Ri)?ye(r):null}let z=ct(p,n.strict?void 0:n.shellAssignments);if(z.kind==="dynamic")return ye(r);if(z.kind==="literal")return ui(z.source,k,C,n,r,t);let ne=ef(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return ye(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:k,envAssignments:C})}}if(!s&&(E==="source"||E===".")){let x=h[1]==="-p"?2:null;if(x!==null){let rn=n.commandView?p[x]:void 0;if(!rn)return null;if(rn.provenance!=="literal")return ye(r)}let P=x===null?1:3,z=h[P]==="--"?P+1:P,ne=n.commandView?p[z]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ui(ne.text,k,C,n,r,t);if(n.strict||!n.commandView||!$a(n.commandView))return ye(r)}if(Ie.has(E)&&!l){if(!s&&n.strict&&Xa(xr(h),p))return ye(r);let x=dm(h,(z)=>Tn(n.analyzeNested(z,{effectiveCwd:k,envAssignments:C}))),P=w(x,n.policy);if(P)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:P.reason}),de(P)}if(De(E)&&!l){if(!s&&n.strict&&Xa(_o(h),p))return ye(r);let x=ld(h);if(a&&s)return a_(E,x,k,C,n,s);if(x){let P=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:x,paranoidBlocked:P}),P){let ne=w(v("interpreter.one-liner-paranoid",ur),n.policy);if(ne)return de(ne)}if(ta(E,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let z=n.analyzeNested(x,{effectiveCwd:k,envAssignments:C});if(z&&!Uf(z,x))return z;if(dr(x,void 0,!n.strict)){let ne=w(v("interpreter.dangerous-command",bn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:bn}),de(ne)}r=void 0}}if(E==="busybox"&&h.length>1)return zf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),On(p.slice(1),t,{...y,effectiveCwd:k,envAssignments:C});let U=s?null:w(hm(E,h),n.policy);if(U)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:U.reason}),de(U);let L=r===y.trace?y:{...y,trace:r},ae={words:p,head:E,cwd:I,originalCwd:T,envAssignments:C,allowTmpdirVar:F,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:k,options:L,analyzeChildTokens:(x,P)=>a&&s?el(x,t,L,{...s,cwd:P??void 0,effectiveCwd:P??void 0}):Tn(On(q(x),t+1,{...L,child:void 0,commandView:void 0,effectiveCwd:P,envAssignments:C}))??it(x,L.policy.rules),analyzeChild:(x,P)=>el(x,t,L,P)},J=s&&(E==="xargs"||E==="parallel")?void 0:$f(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:C.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:F});let Q=r&&E==="git"?Hm(ae.words,Ja(ae)):void 0,Se=Bf(Q?Q.match:J?.(ae)??null,n.policy);if(r)d_(ae,Se,Q?.relaxation??null);if(Se)return de(Se);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(st(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Mn(s,n.policy):null)??l_(s,n.policy)}let Tt=!s&&J===void 0&&!Yr.has(E),Wn=r&&Tt?[]:void 0;if(Tt)for(let x=1;x<h.length;x++){let P=h[x];if(!P)continue;Wn?.push(P);let z=Bf(s_(h,x,t,L,I,T,k,C),n.policy);if(z)return r?.recordSegment({type:"fallback-scan",tokensScanned:Wn??[],embeddedCommandFound:O(P)}),de(z)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Wn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ae=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ae,reason:Ae?.reason}),Ae)return de(Ae);return a&&s?Mn(s,n.policy):null}function el(e,t,n,r){return Tn(On(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function s_(e,t,n,r,o,i,s,a){for(let l of $e(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(Hf(c,u)||$f(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=el(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!br(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function a_(e,t,n,r,o,i){if(!t)return Mn(i,o.policy);if(ee(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=w(v("interpreter.one-liner-paranoid",ur),o.policy);if(a)return de(a)}if(ta(e,t))return Mn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Uf(s,t))return s;if(dr(t,void 0,!o.strict)){let a=w(v("interpreter.dangerous-command",bn),o.policy);if(a)return de(a)}return Mn(i,o.policy)}function Uf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Uo)||e.reason===Rn)&&!Zr(t);return n||r}function kn(e,t){let n=e.shellDynamicMatch?w(e.shellDynamicMatch,t):null;return n?de(n):null}function Mn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?w(e.dynamicSourceMatch,t):null;return n?de(n):null}function l_(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?w(e.rmDynamicMatch,t):null;return n?de(n):null}function c_(e,t,n,r,o,i){let s=Cm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ui(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ui(a,n,t,r,o,i,!0)}function ui(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=cr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function u_(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function d_(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function zf(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new W("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:vr}),de(m_())}function m_(){return{id:"analysis.dynamic-shell-source",reason:vr,intent:"stop_and_explain"}}function Hf(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(A(t))}function Bf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:w(e,t)}var f_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,p_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function g_(e,t){let n=Kf(e,t);if(n.length===0)return!1;let r=n[Vf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return f_.test(e.join(" "))}function jf(e,t,n,r,o){if(e.dialect==="powershell"){let b=h_(e.words,o);if(b.kind==="none")return;if(!t||b.kind==="unknown")return null;return Qa(S_(b.target),t,n.paths)}let i=e.words.map(_),s=i.some((b)=>/^CDPATH\+?=/.test(b));if(!g_(i,n))return s?null:void 0;if(!t)return null;let a=Kf(i,n,t),l=Vf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((b)=>b.length<=1||!b.startsWith("-")||b==="--");if((u===-1?c:c.slice(0,u)).some((b)=>!/^-[LP]+$/.test(b)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length>1)return null;let g=f[0],p=r.get("HOME")||n.home;if(g===void 0)return Qa(p,t,n.paths);let h=e.words.find((b)=>b.provenance==="variable"&&b.text===g),y=e.words.find((b)=>b.text===g&&/^~(?:\/|$)/.test(b.raw)),C=h?Ye(h,new Map([...r,["HOME",p]])):y?`${p}${g.slice(1)}`:g;if(C===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(C)&&(s||n.env.has("CDPATH")))return null;return Qa(C,t,n.paths)}function Qa(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=Ct(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function h_(e,t){let n=y_(e[0])?1:0,r=e[n];if(!b_(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!p_.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return C_(e.slice(n+1),t)}function y_(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function b_(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function C_(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function S_(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Vf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Kf(e,t,n){let r=v_(e);return St([...r],t,n)}function v_(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var P_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Xt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function sl(e,t,n,r){if(t>=K.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return il(e,n);let u=`${Uo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Qf(e,n),{reason:Rn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Qf(e,n),{reason:Rn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return il(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Om(n.environment.env,n.envAssignments);return fi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function fi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=I_(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],C=a==="&&"?p?.failure??[]:[],b={connector:a,skippedSuccessStates:y,skippedFailureStates:C};if(At(d)&&!At(a))l=b;let E=At(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:At(a)?l??b:b,I=Jt(E.connector)||Jt(d);if(u.kind==="function"){let U=h.flatMap((ae)=>{let J=Qt(ae);return J.functionDefinitions.set(u.name,u.body),tl(ae,[J],f,d==="&",Jt(d))}),L=nl(U,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=L.states,s=L.conditionalStates,a=void 0;continue}if(u.kind==="group"){let U=[],L=[];for(let J of h){let Q=fi(u.body,t,n,r,[Qt(J)]);if(Q.result)return Q;if(U.push(...tl(J,Q.states,f,d==="&",Jt(d))),I)L.push(J,...f?Q.states.map((Se)=>di(J,Se)):Q.states)}let ae=nl(U,L,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=ae.states,s=ae.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let T=J_(e.nodes[c-1]),k=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),F=e.nodes[c-2],ue=At(a)&&F?.kind==="command"?Xm(F)??k_(F):void 0,Xe=[],Ce=[];for(let U of h){let L=O_(u,t,n,r,[Qt(U)]);if(L.result)return{result:L.result,states:i};let ae=e.dialect==="powershell"?L.states:L.states.map((J)=>di(U,J));for(let J of ae){let Q=Qt(J),Se=N_(u,t,n.trace?{...n,trace:ep(n.trace,k)}:n,r,Q,At(a),ue);if(Se)return{result:Se,states:i};let mt=iw(u,Q.functionDefinitions);if(mt)n.budget.charge("derivedTokens",pi(mt));let Tt=mt?t+1>=K.recursionDepth.cap?rl(u.displayText,n,[Q]):fi(mt,t+1,n,r,[Q]):{result:null,states:rw(u,Q).flatMap((Ae)=>Q_(u,J,Ae,T))};if(Tt.result)return Tt;Xe.push(...tl(U,Tt.states,f,d==="&",Jt(d)));let Wn=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==J.effectiveCwd&&u.redirections.every((Ae)=>["<",">",">>",">|"].includes(Ae.operator)&&Ae.target?.text==="/dev/null");if(I&&(T||!Wn))Ce.push(U),Ce.push(...Tt.states.map((Ae)=>f?di(U,Ae):Ae))}}let It=nl(Xe,Ce,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=It.states,s=It.conditionalStates,a=void 0}return{result:null,states:i}}function I_(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(At(r)||At(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&T_(e,t)}function tl(e,t,n,r,o){let i=n?t.map((a)=>di(e,a)):[...t],s=o?i.flatMap((a)=>Dn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function di(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function T_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(M_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function At(e){return e==="|"||e==="|&"}function k_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Jt(e){return e==="&&"||e==="||"}function nl(e,t,n,r,o,i){let s={success:mi([...n,...e]),failure:mi([...r,...t])},a=Jt(i)?s:void 0;return{states:Jt(o)||a?mi([...s.success,...s.failure]):s.success,conditionalStates:a}}function ep(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function O_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=D_(e);if(s){if(t+1>=K.recursionDepth.cap)return rl(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return rl(s,n,o);if(a.status!=="complete")return qf(i,n,r,o);n.budget.charge("derivedTokens",pi(a)),i.push({program:a,depth:t+1})}}return qf(i,n,r,o)}function M_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function qf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=fi(i.program,i.depth,t,n,[Qt(a)]);if(l.result)return l;s.push(...l.states)}o=mi(s)}return{result:null,states:o}}function D_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function pi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+pi(o),0):n.kind==="group"||n.kind==="function"?pi(n.body):0),0)}function rl(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function N_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:z_(n.environment.paths,o.createdDirectories,n.budget)}},l=V_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};tp(e,o,"before-consumer",a.environment.paths,a.budget);let c=gn(e.dialect,e.words),u=c.map(_),m=e.displayText,d=Tm(c,o.shellGitContextState),f=Dm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=w(rm(e,i,aw(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return sw(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!er(e.dialect,e.words)){let h=w(Te(u[0]),a.policy),y=h!==null&&!a.strict&&od(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let C=Yf(e,l,o,f,s,a);if(C)return C;return La(d,o.shellGitContextState),null}let g=On(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let C=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,b=sl(h,t+1,{...a,effectiveCwd:C,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?ep(a.trace,a.trace.currentSegmentIndex,!0):void 0});return b?{reason:b.reason,ruleId:b.ruleId,intent:b.intent}:null}});if(g)return{...g,segment:m};let p=Yf(e,l,o,f,s,a);if(p)return p;return La(d,o.shellGitContextState),null}function Yf(e,t,n,r,o,i){let s=K_(e,t,n,r??new Map,i);if(s)return s;return tp(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),G_(e,t,n,i.environment.paths,i.budget),B_(e,n,i.environment.paths,i.budget),Z_(e,n,o,i.environment,i.trace),null}var L_=new Set([">>","<>"]);function tp(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?W_(s):L_.has(s.operator)))continue;Zf(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=rp(e.words.slice(1));if(!i)return;for(let s of i.operands)Zf(s,t,r,o)}function W_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Zf(e,t,n,r){let o=e?.provenance==="literal"?cr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function G_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of F_(e,n.shellGitContextState.shellAssignments)){let a=cr(s,n.effectiveCwd,r,o);if(!a||!ad(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=K.trackedHeredocFiles.cap)throw new W("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function F_(e,t){let n=ol(H_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return U_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=rp(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>ol(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function ol(e,t){if(j_(e))return e.text;return(e&&Ye(e,t))??void 0}function z_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=D(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${A_}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?D(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function B_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>ol(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!x_(c)&&!l)continue;let u=D(w_(l??"",c),n,r);if(a?$_(u,n):n.isDirectory(E_(u))&&np(u,n))t.createdDirectories.add(u)}}function $_(e,t){let n=__(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>R_(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||np(o(i),t)}function np(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function U_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function H_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function rp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function j_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function al(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function V_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Xt;let r=n[0];if(!r?.heredoc)return Xt;let o=/\$\(|`/.test(r.heredoc.body);if(!al(r.heredoc)&&(!t||o))return P_;if(r.fd!==void 0&&r.fd!==0)return Xt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Xt;let i=e.redirections.some((l)=>l!==r&&Xf(l.target));if(se(e.words[0],"cat"))return i?Xt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Xf)?Xt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return Xt}function Xf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function K_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Y_(e,i,n,r,o))return null;let a=q_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=il(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function q_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!al(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!De(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=w(v("interpreter.one-liner-paranoid",ur),n.policy);if(m)return m}if(!dr(l,void 0,!n.strict))return null;let u=w(v("interpreter.dangerous-command",bn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function Y_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!al(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Bt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(A(l)))return!1;return at(a)}function Z_(e,t,n,r,o){let i=jf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var X_=new Set(["fi","done","esac"]);function J_(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function Q_(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&X_.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let d=Qt(n);return d.effectiveCwd=m,d})}function ew(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var tw=/^[A-Za-z_][A-Za-z0-9_]*$/,nw=8;function rw(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!tw.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=nw&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Qt(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Qt(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Mm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function mi(e){let t=[];for(let n of e){if(!t.some((r)=>ow(r,n)))t.push(n);if(t.length>K.controlFlowStates.cap)throw new W("controlFlowStates")}return t}function ow(e,t){return e.effectiveCwd===t.effectiveCwd&&ew(e.compoundBodies,t.compoundBodies)&&Dn(e.shellGitContextState.env,t.shellGitContextState.env)&&Dn(e.literalHeredocFiles,t.literalHeredocFiles)&&Dn(e.functionDefinitions,t.functionDefinitions)&&Dn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Dn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Jf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Jf(e.createdDirectories,t.createdDirectories)}function Jf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Dn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function iw(e,t){let n=tr(e);return n===void 0?void 0:t.get(n)}function sw(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function aw(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function il(e,t){let n=w(Te(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Qf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Rn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var lw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function op(e,t,n,r){let o=sl(e,0,{...t,...Eu(t),budget:t.budget??Pe(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function ip(e,t,n){try{return{decision:e()}}catch(r){let o=cw(r,t,n);if(!o)throw r;return o}}function cw(e,t,n){if(!(e instanceof W)||!lw.has(e.kind))return null;let r=K[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var uw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),cl=new Set(["cc-safety-net","ccsn"]),dw=new Set(["bunx","npx","pnpx"]),mw=new Set(["pnpm","yarn"]),fw=new Set(["npm","pnpm","yarn"]),pw=new Set(["bun","node"]);function hi(e,t,n={}){if(cl.has(e))return 0;if(dw.has(e)){if(n.broad)return ll(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return gi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&fw.has(e)&&n.broad&&t[r]==="exec"){let o=ll(t.slice(r+1));return o===null?null:r+1+o}if(mw.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&gi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=ll(t.slice(r+1));return o===null?null:r+1+o}if(pw.has(e)){let o=n.broad&&r!==-1?r:0;if(sp(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&sp(t[o+1]))return o+2}return null}function ll(e){let t=e.findIndex((r)=>gi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!gi(r))break;n++}return n}function gi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return cl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return cl.has(e.slice(0,t))}function sp(e){let t=e?.replaceAll("\\","/");return[...uw].some((n)=>t===n||t?.endsWith(`/${n}`))}var ap="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function lp(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=Sn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>gw(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function gw(e,t){let n=St([...e],t),r=n.slice(1),o=hi(A(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as yi}from"path";var mp="This path contains the protected policy config and you must not modify or delete it.",hw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function fp(e,t,n){let r=Ew(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return cp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?up(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=up(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return cp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Gr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function cp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>kr(a,n,r,o,i));return s?{target:s}:null}function up(e,t,n,r,o){let i=Sn(e,t,r,o,{findSegmentTarget:(s,a)=>yw(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>kr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>vw(s,t,n,r,o)?.target??null});return i?{target:i}:null}function yw(e,t,n,r,o){if(hr(e))return null;let i=vt([...e],r),s=A(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&bw(a)){let l=Cw(a).find((c)=>dp(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Yo(i,1)||Pa(i,r)){let c=(Rr(q(i))??q(["."])).find((u)=>{let m=pe(u.text,t.variables);return kr(m,t.cwd,n,r,o)||dp(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Lo(a).sources.find((c)=>xw(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Sw(i,s))return null;for(let l of[...e,...i])for(let c of pp(l))if(kr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function bw(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Cw(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Sw(e,t){if(!hw.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function vw(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of pp(i))if(kr(s,t,n,r,o))return{target:s};return null}function pp(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Ew(e,t,n){let r=(a)=>Or(le(a,e.executionCwd,t,n)),o=r(Lt(t)),i=[r(cn(e.executionCwd)),r(cn(e.configCwd))],s=new Set(i.map((a)=>yi(a)));for(let a=yi(o);;a=yi(a))if(s.add(a),yi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function kr(e,t,n,r,o){let i=Xl(e,t,r,o,(s)=>Or(s)===Kr);return i!==null&&n.files.has(Or(i))}function dp(e,t,n,r,o){return n.directoriesAndAncestors.has(Or(le(e,t,r,o)))}function xw(e,t,n,r,o){let i=Or(le(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Or(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as bi,posix as wp,resolve as vi,win32 as Rw}from"path";import{fileURLToPath as _w}from"url";var Ap="Access to a sensitive path is not allowed.",Pp=new Set(["echo","printf"]),ww=new Set(["find"]),Aw=new Set(["!","do","elif","else","if","then","until","while"]),Pw=new Set(["-exec","-execdir"]),Iw=new Set([";","+"]),Tw=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),kw=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Ip=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Ow=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Mw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Tp=new Set(["-c","-e","-r","-E","--eval","--exec"]),Dw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Nw=new Set(["grep","rg"]),Lw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),Ww=new Set(["commit","merge","notes","stash","tag"]),Gw=new Set(["-m","--message"]),Fw=new Set(["--grep"]),gp=new Set(["jq","gojq","jaq"]),hp="f",yp="file",zw="files",Bw=new Set(["e","f"]),$w=new Set(["regexp","file"]),Uw=new Set(["e","f","A","B","C","m"]),Hw=new Set(["regexp","file","after-context","before-context","context","max-count"]),ul="__CC_SAFETY_NET_PIPE_INPUT__",ml=/[\w./~@+-]*[./~][\w./~@+-]*/g,jw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Vw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Kw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,bp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Cp=/\b(?:system|exec|spawn|popen)\s*$/,qw=/\b(?:eval|exec)\s*\(/g,Yw=/\b(?:eval|exec)\s*$/,Zw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Sp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(VA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=HA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(Fp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!Si(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Si(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&KA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function kp(e,t,n,r,o={}){let i=vp(e,n,r),s=Sp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Sp(i,t,e.invocation.context.configCwd,n,r,new Set(vp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Xw(e,n)?null:a}function Xw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of No(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=dt(r);if(o.length===0)return!1;let i=je(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return pl(i,o.slice(1))}function pl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>Tw.has(n))}function vp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Ln(s.shell,e.store,r,t,o,n,Jw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Jw(e){return e.program.dialect==="powershell"}function Ln(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...wA(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(cA(c,s),r);return Do(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...Ei(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...eA(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Op(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>tA(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ua;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function gl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Ln(s,t,n,r,o,i):null}function Ei(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(gp.has(je(dt(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Ei(p,t,n,r,o,i)]}let l=lA(e).map(a),c=dt(e);if(c.length===0)return l;let u=c[0]??"",m=je(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!Aw.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&pl(je(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=Qw(u,m,d);if(g)return[...l,...g.map(a)];if(Pp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...Mp(e).map(a)]:l;if(m==="eval")return[...l,...gl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Ze(m,p)).map(a)];if(m==="git")return[...l,...dA(d).map(a)];if(m==="gh")return[...l,...fl(m,d,Lw).map(a)];if(gp.has(m))return[...l,...uA(d).map(a)];if(Nw.has(m))return[...l,...DA(d).map(a)];if(ww.has(m))return[...l,...fA(d,t,n,r,o,i).map(a)];if(Ie.has(m))return[...l,...d.flatMap((p)=>Ze("awk",p)).map(a),...d.flatMap((p)=>gA(p,t,n,r,o,i)),...d.flatMap(hA).map(a)];if(m==="curl")return[...l,...d.filter((p,h)=>Np(p)===null&&Dp(d[h-1])===null).flatMap((p)=>Ze(m,p)).map(a),...mA(d).map(a)];if(yr(m)){let p=gr.has(m)?xe([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Ln(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...pA(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>Ze(m,p)).map(a)]}function Qw(e,t,n){let r=hi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function eA(e,t,n,r,o,i,s){if(iA(t,n,r,o,i,s)){let a=dt(e),l=pl(je(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...Mp(e),...l].map((c)=>({target:c,cwd:i}))}return Op(t,nA(e),n,r,o,i,s,()=>[])}function tA(e,t,n,r,o,i,s){let a=dt(e);if(!yr(je(a[0]??"").toLowerCase()))return[];return gl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Op(e,t,n,r,o,i,s,a){let l=sA(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>gr.has(l)?Ln(n.getShellSyntax(c),n,r,o,i,s):Ci(l,c,n,r,o,i,s))}function Mp(e){let t=dt(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase();if(!Pp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[hl(r.replaceAll("%%","%"))];return t.slice(1)}function nA(e){let t=dt(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return rA(r);return[]}function rA(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[hl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>oA(t,r.slice(i*n,(i+1)*n)))}function oA(e,t){let n=0;return hl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function hl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function iA(e,t,n,r,o,i){let s=dt(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Zt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ul]:l.map((m)=>m.split(c).join(ul));return Ei(u,t,n,r,o,i).some((m)=>m.target.includes(ul))}function sA(e){let t=dt(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!yr(n))return null;return aA(n,t.slice(1))?n:null}function aA(e,t){let n=yl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Tp.has(o)||Lp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(Zw.get(n)?.has(o))r++;continue}return!1}return!0}function yl(e){return/^python\d/.test(e)?"python":e}function lA(e){let t=[];for(let n of e){if(Gp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Ep=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function cA(e,t){if(!t||!Ep.test(e))return e;return`~${e.replace(Ep,"").replace(/\\/g,"/")}`}function Ze(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function uA(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ze("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ze("jq",r))}function dA(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...Ww.has(r)?fl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),Gw):fl("git",e.slice(n),Fw)];if(t.push(...Ze("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ze("git",o)),n++}return t}function fl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ze(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ze(e,i))}return r}function mA(e){return e.flatMap((t,n)=>{let r=Np(t);if(r!==null)return xp(r.flag,r.value);let o=Dp(e[n-1]);return o===null?[]:xp(o,t)})}function xp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return dl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return dl(t.slice(n+1))}return t.startsWith("@")?dl(t.slice(1)):[]}function Dp(e){if(e===void 0)return null;if(Ip.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Np(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Ip.has(r)?{flag:r,value:e.slice(n+1)}:null}function dl(e){return e===""||e==="-"?[]:[e]}function fA(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Pw.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>Iw.has(f)),m=u===-1?c:c.slice(0,u),d=Ei(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!kw.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function pA(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Tp.has(c)||Lp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...Ci(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...Ci(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Lp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Dw.get(t[t.length-1]??"")?.has(yl(e))??!1}function gA(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ra(e)?.commands.flatMap((s)=>Ln(t.getShellSyntax(s),t,n,r,o,i))??[]}function hA(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function yA(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(bl),...e.match(ml)??[]]}function Ci(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=CA(t,bA(e));if(l.kind==="unmaskable")return yA(t).map(a);let c=l.masked.match(bp)!==null||l.literals.some((p)=>Cp.test(l.masked.slice(0,p.start))),u=l.masked.match(qw)!==null||l.literals.some((p)=>Yw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!gr.has(e),d=m&&!(xA(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(bp),(p)=>{let h=p.index+p[0].length;return{start:h,end:ra(l.masked,h)}}):[],g=!m||f.some((p)=>oa(l.masked,p.start))?l.literals:l.literals.filter((p)=>Cp.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>bl(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(ml)??[]).map(a),...c?g.flatMap((p)=>gl(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>Ci(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(ml)??[]).map(a)]}function bA(e){let t=yl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function CA(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(Vw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&EA(e,o))return{kind:"unmaskable"};let a=t==="python"?SA(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=vA(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&Kw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function SA(e,t){return jw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function vA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function EA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function xA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Ow.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Mw.has(i)))continue;if(o.length>1)return!0;if(RA(e,r)===".")return!0;if(_A(e,r+n.length)==="(")return!0}return!1}function RA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function _A(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function wA(e,t,n,r,o,i){return kA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Ln(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...AA(a,r)?PA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function AA(e,t){let n=No(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function PA(e,t){return No(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(bl)}function bl(e){let t=TA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||IA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function IA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function TA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function kA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Yn(o,n))continue;if(Wp(e,r,n)){let i=OA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=MA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function OA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Yn(i,n))continue;if(Wp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function MA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Wp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function DA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===zw)o=!0;if($w.has(m))r=!0;if(d!==void 0){if(m===yp)t.push(d);continue}if(Hw.has(m)){let f=e[l+1];if(m===yp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(Bw.has(h))r=!0;if(Uw.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===hp)t.push(f);continue}let g=e[l+1];if(d===hp&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function dt(e){let t=e.findIndex((n)=>!Gp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Gp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var NA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),LA=".env.",WA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),GA=[".env.example.",".env.sample."];function FA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function zA(e){return e.length>0&&!/\s/.test(e)}function Si(e,t,n,r){let o=Fp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Fp(e,t,n,r){try{return Dr(e,t,n,r)}catch(o){if(o instanceof W)throw o;return""}}var BA=/[?&][^?&=/]+=/,$A=new Set(["node_modules","__pycache__"]),UA=[["vendor","bundle"],["vendor","cache"]];function HA(e,t,n,r,o){if(FA(e))return null;let i=be(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>zA(s)||Si(e,t,r,o);if(WA.has(s)||GA.some((d)=>s.startsWith(d)))return null;let c=B(ZA(e,t,r,o));for(let d of hs){let f=`~/${d.suffixParts.join("/")}`;if((_p(a,f)||_p(c,f))&&ut(d.id,n))return d.id}let u=jA(i,t,n,r,o);if(u)return u;if(NA.has(s))return null;for(let d of gs)if(s===d.basename&&ut(d.id,n))return d.id;if(s.startsWith(LA)&&ut(eo.id,n)&&l())return eo.id;for(let d of ys)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&ut(d.id,n)&&l())return d.id}for(let d of bs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ut(d.id,n))return d.id}if(qA(a))return null;if(!s.includes(".")&&Zn.pattern.test(s)&&ut(Zn.id,n))return Zn.id;if(BA.test(e)&&!Si(e,t,r,o))return null;let m=YA(s,n);if(m)return m;return null}function jA(e,t,n,r,o){return to.find((i)=>{if(!ut(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return N(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return N(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Mr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return N(e,be("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return N(e,s,["auth.json",".credentials.json"])||Nn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return N(e,s,["config.toml"])||a.endsWith(".config.toml")&&N(e,s,[a])}case"secret.cli.gemini":return N(e,te(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[te(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return N(e,te(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Mr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>N(e,be(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return N(e,s,["config.json"])||Nn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return N(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return N(e,s,["server.token"])||Nn(e,s,["credentials"])||Nn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||N(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||N(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=te(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return N(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&N(e,s,[a])||c.some((u)=>Mr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[te(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||N(e,s,["config.json"])||(c?.trim()?Mr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>N(e,be(u,t,r,o),l))}case"secret.cli.pi":return N(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return N(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=be("~",t,r,o);return[te(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),te(s,".local","share","amp")].some((l)=>N(e,l,["secrets.json"]))||Nn(e,te(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),te(be("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>N(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Mr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=te(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return N(e,be("~/.cursor",t,r,o),["auth.json"])||N(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&en(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return N(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||N(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||N(e,be("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return N(e,be("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||N(e,be("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),be("~/.local/share",t,r,o)].some((s)=>N(e,te(s,"devin"),["credentials.toml"])||Nn(e,te(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),be("~/.config",t,r,o)].some((s)=>N(e,te(s,"devin"),["config.json"]));default:return!1}})?.id??null}var Rp=new WeakMap;function H(e,t,n,r,o){let i=Rp.get(o)??new Map;Rp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=be(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function N(e,t,n){return n.some((r)=>zp(e,te(t,r)))}function Nn(e,t,n){return n.some((r)=>en(B(e),B(te(t,r))))}function Mr(e,t,n,r,o){return zp(e,be(t,n,r,o))}function zp(e,t){return B(e)===B(t)}function te(e,...t){return He([e,...t].filter(Boolean).join("/"))}function VA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Dr(e,t,o,i));return n.some((a)=>en(s,B(Dr(a,r,o,i))))}function KA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Dr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(D(ve(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?He(D(vi(ve(u)),o.paths,i)):l&&He(D(`${l}/.cc-safety-net`,o.paths,i)));if(m&&en(s,m))return!1;return n.some((d)=>{let f=xs(d);if(f&&wp.basename(s)!==B(f.name))return!1;let g=B(Dr(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return en(s,g)&&!(f&&s===g)})}function qA(e){let t=e.split("/");return t.some((n)=>$A.has(n))||UA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function YA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Cs)if(r===o.extension&&ut(o.id,t))return o.id;for(let o of Ss)if(o.pattern.test(r)&&ut(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ut(e,t){return!t?.disabledRules?.includes(e)}function be(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i)return"";if(!o)return i;let s=Sl(i,o),a=bi(s)?s:He(vi(t,s)),l=He(D(a,n.paths,r));if(!en(l,o)){if(bi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function _p(e,t){return e===t||e.startsWith(`${t}/`)}function ZA(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i||!o)return"";let s=Sl(i,o),a=wp.normalize(bi(s)?s:He(vi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&en(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Dr(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i)return"";let s=o?Sl(i,o):i;return He(D(bi(s)?s:vi(t,s),n.paths,r))}function Cl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(D(ve(r),t.paths,n)):"",i=He(ve(XA(ot(e,t))));return{home:o,normalized:i}}function XA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return _w(e)}catch{return e}}function Sl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return te(t,e.slice(2));return e}function JA(e){if(process.platform==="win32")return!0;return Rw.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&JA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function en(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class tn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var QA={findPolicyMutation:fp,findGitMetadataMutation:Gd,resolveGitMetadata:tP,loadPolicySnapshot:vu,findSensitiveTarget:kp,analyzeCommand:op,getModes:ji},eP=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Bp(e,t){let n={...QA,...t.dependencies},r=oP(e),o=Nr(e)?e.command:r,i=Pt("policy-protection",o,()=>Dd(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Nr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:om,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=Pe(),c=Pt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Pt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let b=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:mp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:b,segment:u.target}}}}let m=Pt("policy-protection",o,()=>lp(i,t.environment,l));if(m){let b=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ap,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:b,segment:m.target}}}}let d=Pt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let b=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ze,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:b,segment:d.target}}}}let f=Pt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...nP(f)},y=g.secretProtection.enabled===!1?null:Pt("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Nr(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let b=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Ap,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:b,segment:y.target}}}}if(!Nr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...vl("command-validation",o),...h};let C=Pt("command-analysis",o,()=>ip(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},rP(i),i.store),e.command,t.trace));if(C.decision){let b=!p.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===vr&&!eP.test(C.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:b?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function tP(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function nP(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function rP(e){return ge(e,"declared-command")?.program}function oP(e){try{return Un(e.input)}catch(t){let n=Nr(e)?e.command:void 0;throw new tn("policy-protection",vl("policy-protection",t instanceof Je?void 0:n,t),t)}}function Pt(e,t,n){try{return n()}catch(r){throw new tn(e,vl(e,r instanceof Je?void 0:t,r),r)}}function vl(e,t,n){let r=n instanceof W||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?wi:Fn,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Nr(e){return e.route.kind==="command"}import{appendFileSync as yP,mkdirSync as bP}from"fs";import{isAbsolute as CP,join as Rl}from"path";import{lstatSync as Up,readdirSync as iP,readFileSync as sP,rmdirSync as aP,statSync as Hp,unlinkSync as lP,utimesSync as cP,writeFileSync as uP}from"fs";import{join as Lr}from"path";function $p(e,t={}){return co(Lt(e,t),e.home).policy.audit.retention_days}var xl=86400000,dP=".last-prune",mP=/^\d{4}-\d{2}$/,fP=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,jp=(e)=>Math.floor(e/xl);function Kp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Hp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Lr(t,dP),i=Hp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&jp(i)===jp(r))return;let s=r-$p(e)*xl,a=new Date(r).toISOString().slice(0,7);for(let l of El(t)){if(l.isDirectory()){pP(Lr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))gP(Lr(t,l.name),s)}uP(o,"",{mode:384}),cP(o,r/1000,r/1000)}catch{}}function pP(e,t,n){for(let r of El(e)){if(!r.isDirectory()||!mP.test(r.name))continue;let o=Lr(e,r.name);for(let i of El(o)){if(!i.isFile())continue;let s=fP.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+xl;if(!Number.isFinite(a)||a>=t)continue;qp(Lr(o,i.name))}if(r.name!==n)Vp(o)}Vp(e)}function gP(e,t){try{let n=Up(e);if(n.mtimeMs>=t)return;let r=sP(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(hP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Up(e).mtimeMs!==n.mtimeMs)return;qp(e)}catch{}}function hP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function El(e){try{return iP(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function qp(e){try{lP(e)}catch{}}function Vp(e){try{aP(e)}catch{}}var SP="2.6.0",vP=1e4,EP=2000,xP=256,RP=32768;function _P(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function wP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function _l(e,t,n,r,o,i,s={}){let a=_P(t);if(!a)return;let l=PP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=xi(ft(n),s.failureStage?Number.POSITIVE_INFINITY:vP),m=xi(ft(r),EP),d=s.toolName?xi(ft(s.toolName),xP):void 0,f=i===null?void 0:xi(ft(i),RP),g=Rl(l,wP(f?.value??null),c.slice(0,7));bP(g,{recursive:!0,mode:448});let p=Rl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Vi)(),v:SP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};yP(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Kp(e,l,s.now)}catch{}}function xi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function AP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&CP(n)?n:null}function PP(e){let t=AP(e);return t?Rl(t,".cc-safety-net","logs"):null}function Zp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Yp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Yp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Yp(e){return"command"in e?e.command??"":""}function Xp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;_l(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Jp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;_l(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function eg(e,t,n){try{let r=Bp(t,{environment:e,...n.guard});return Qp(e,t,r,n),r}catch(r){if(!(r instanceof tn))throw r;throw Qp(e,t,r.evaluation,n,!(r.cause instanceof Je),{stage:r.stage,errorCode:IP(r.cause)}),r}}function Qp(e,t,n,r,o=!0,i){Xp(e,Zp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function IP(e){if(e instanceof W)return K[e.kind].errorCode;if(e instanceof Je)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function nn(e,t={}){return{malformed:!0,denial:zn(t),cwd:e}}function wl(e,t){return{malformed:!0,denial:Ai(e,t),cwd:e.cwd}}function tg(e,t={}){return(n,r)=>{try{return TP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(zn())}}}function TP(e,t,n,r){let o=lc();if(n.cancelled?.(t))return n.block(zn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Jp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Il(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=eg(o,i,{guard:{auditAllowed:mc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof tn))throw l;if(et(Z.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${kl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var kP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>MP(e,t,n),getSessionId:(e)=>LP(e),allow:{action:"allow"},block:(e)=>WP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},ng=OP();function OP(e={}){return tg(kP,e)}function MP(e,t,n){if(!e||typeof e!=="object")return nn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return nn(null);if(!r.input||typeof r.input!=="object")return nn(null,{toolName:r.tool});let o=DP(t);if(!o)return nn(null,{toolName:r.tool});let i=ec(".",[o],n);if(!i)return wl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=NP(t,e);if(!s.ok)return nn(i,{toolName:r.tool});if(!s.command)return Gi(r.tool,r.input,{kind:ki(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return nn(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=tc(a,i,n);if(!l)return wl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return Gi(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function DP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function NP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function LP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function WP(e){return{action:"reject-and-continue",message:Tl(e)}}function GP(e){e.on("tool.call",(t)=>ng(t,e))}export{GP as default};