cc-safety-net 2.5.2 → 2.6.0

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,51 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.5.2
+// version: 2.6.0
 // @bun
-var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Nn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Dn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Dn},trackedHeredocFiles:{cap:64,...Dn},controlFlowStates:{cap:64,...Dn},wrapperPeelIterations:{cap:20,...Dn},derivedCommandShape:Dn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function je(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var Vp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function mt(e){return Kp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Kp(e){return Vp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var qp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":qp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var wi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Fn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var _i={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Gn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,..._i},processedCandidateBytes:{cap:4194304,..._i},pathEnvironmentExpansion:{cap:64,..._i},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Gn},trackedHeredocFiles:{cap:64,...Gn},controlFlowStates:{cap:64,...Gn},wrapperPeelIterations:{cap:20,...Gn},derivedCommandShape:Gn});class W extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Pe(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new W(t)}}}var rg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ft(e){return og(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function og(e){return rg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var ig={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function sg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":ig[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function Rl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Ln(e={}){return{reason:Nn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Zp={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function xi(e,t={}){return{...Zp[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function wl(e){return Yp({...e,redact:mt})}function _l(e){return mt(e instanceof Error?e.message:String(e))}import{types as Xp}from"util";var Jp=new Set(["applypatch","patch"]),Qp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),eg=new Set(["grep","grepsearch","rg"]),tg=new Set(["find","findbyname","glob"]),ng=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),rg=new Set(["command","diff","input","patch","patchtext"]),Al=new TextEncoder,og=new TextDecoder,ig=/\s/,sg=64;class Je extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Wn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ol(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Mr(e){return ng.has(Ol(e))}function Ai(e){let t=Ol(e);if(Jp.has(t))return"patch";if(eg.has(t))return"grep";if(tg.has(t))return"glob";if(Qp.has(t))return"path";return"unknown"}function Fn(e){if(!e||typeof e!=="object")return;Fl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ml(e,t){return Dl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Dl(e,t,n,r,o){let i=Gl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Dl(l,t,i.array?n:t.has(Nl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Nl(e){return e.replace(/-/g,"_").toLowerCase()}function Ll(e){return Wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(lg)}function Wl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Wl(a,o.array?t:rg.has(Nl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ag(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Wn.maxDepth||t.nodes>Wn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Wn.maxStringBytes||t.stringBytes>Wn.maxAggregateStringBytes)Ve()}function Gl(e,t,n){if(ag(e,t,n),!e||typeof e!=="object")return null;let r=Fl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Wn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Fl(e){if(Xp.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Je}function lg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=cg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(Or(c.slice(4),!0),Or(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function cg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return ug(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return yg(i[1]);return[]}function ug(e){let t=dg(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=mg(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function dg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Tt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Tt(e[n]))n++;t.push(e.slice(i,n));continue}let o=zl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Tt(e[n]))n++;return n===e.length?t:[]}function mg(e){let t=0;while(t<e.length&&Tt(e[t]))t++;let n=e.length;while(n>t&&Tt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Tt(e[o])){o++;continue}let i=o;while(o<n&&Tt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>sg)Ve();if(fg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function fg(e,t,n,r,o){if(wi(e,t,n,r,o))return!0;let i=Pl(e,"/",t,n),s=Pl(e,"/",r,o);if(i<=t||s<=r)return!1;if(wi(e,t,i,r,s))return!1;return wi(e,i+1,n,s+1,o)}function wi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Pl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Tt(e){return e!==void 0&&ig.test(e)}function zl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:og.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Al.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Al.encode(pg(s[0]??""))),o+=2}return null}function pg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function gg(e){return Gn(bg(e))}function _i(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Gn);let n=hg(e,t)??(e===t?Bl(e):null);return[e,t,...n?[n]:[]].flatMap(Gn)}function Tl(e){let t=Bl(e);return[e,...t?[t]:[]].flatMap(Gn)}function Bl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function hg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return gg(Or(e,!0))}function yg(e){return Gn(Or(e,!1))}function Or(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=zl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function bg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Gn(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Ag,resolve as ql,sep as Pg}from"path";import{basename as Hl,dirname as Cg,isAbsolute as Sg,join as vg,normalize as Eg,resolve as $l}from"path";var xg=256,Dr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=Rg(e,o,t);if(a===null){if(Dr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=wg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function Rg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function wg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Dr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Dr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Dr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function L(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){jl(n,i);let s=t.realpath(i);if(s!==null)return Ul(n,e,s,o);let a=Cg(i);if(a===i||o.length>=xg)return Ul(n,e,i,o);o.push(Hl(i)),i=a}}function Ul(e,t,n,r){let o=r.length===0?n:vg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _g(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;jl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function jl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ae(e,t,n,r){let o=Kl(e,t,n);if(!o)return"";return L(o,n.paths,r).replace(/\\/g,"/")}function Vl(e,t,n,r,o){let i=Kl(e,t,n);if(!i)return null;if(o(Hl(i)))return L(i,n.paths,r).replace(/\\/g,"/");let s=_g(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Kl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?$l(r,o.slice(2)):o,s=Se(i);return Eg(Sg(s)?s:$l(t,s))}function Yl(e,t,n){if(Qe(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:ql(r[0],e),n)[0];if(!o)return;return r.some((i)=>Tg(o,i))?o:void 0}function Zl(e,t,n){if(Qe(e))return;return Oi(Mi(e)?e:ql(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Tg(e,t){let n=Ag(t,e);return n===""||n!==".."&&!n.startsWith(`..${Pg}`)&&!Mi(n)}function Di(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as rh,realpathSync as oh,statSync as ih}from"fs";import{homedir as sh,tmpdir as ah}from"os";import{statSync as eh}from"fs";import{join as th}from"path";import{spawnSync as Ig}from"child_process";import{existsSync as Bn,lstatSync as kg,readFileSync as $n,realpathSync as en,statSync as zn}from"fs";import{dirname as Ni,isAbsolute as Li,join as tn,resolve as Nr}from"path";var Og=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Mg=5000;function Jl(e,t=Zg(),n=Mg){let r=Dg(e),o=r===null?null:Ng(r);if(r===null||o===null)return null;let i=qg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Dg(e){try{let t=en(Nr(e));return zn(t).isDirectory()?t:null}catch{return null}}function Ng(e){let t=Kg(e);if(!t)return null;try{let n=kg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Wi(t);if(!r?.commonDir)return null;if(!Gg(r.gitDir,t))return null;return Fg(r.gitDir,Ni(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Wi(e){try{let t=Lg(e);if(!t)return null;let n=en(Li(t)?t:Nr(Ni(e),t));if(!zn(n).isDirectory())return null;return{gitDir:n,commonDir:Wg(n)}}catch{return null}}function Lg(e){let t=$n(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Wg(e){try{let t=$n(tn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=en(Li(t)?t:Nr(e,t));return zn(n).isDirectory()?n:null}catch{return null}}function Gg(e,t){let n=zg(e);return n===null?!1:Ql(e,n,t)}function Fg(e,t){let n=Bg(e);return n===null?!0:Ql(e,n,t)}function zg(e){let t=tn(e,"gitdir");if(!Bn(t))return null;let n=$n(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Bg(e){let t=tn(e,"config.worktree");return Bn(t)?Ug(t):null}function Ql(e,t,n){try{return $g(Li(t)?t:Nr(e,t),n)}catch{return!1}}function $g(e,t){try{let n=zn(e),r=zn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Xl(en.native(e))===Xl(en.native(t))}function Xl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Ug(e){let t=$n(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Hg(s[1]??"")}return r}function Hg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Vg(t.slice(1,-1))}var jg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Vg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:jg[n]??t)}function Kg(e){try{return Gi(en(e))}catch{return null}}function Gi(e){let t=e;while(!0){let n=tn(t,".git");if(Bn(n))return n;let r=Ni(t);if(r===t)return null;t=r}}function qg(e,t,n,r){if(Yg(t))return!0;if(n===null)return!0;let o=Ig(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Xg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ec(o.stdout.trim())}function Yg(e){return[tn(e.commonDir,"config"),tn(e.gitDir,"config.worktree")].filter((t)=>Bn(t)).some((t)=>Jg(t))}function Zg(){return Og.find((e)=>Bn(e))??null}function Un(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Xg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Un(t)))}function Jg(e){let t;try{t=$n(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Qg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ec(c)}return r}function Qg(e){return e==="include"||e.startsWith("includeif ")}function ec(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function tc(e,t){if(e==="")return null;let n=je(),r=Gi(ae(e,e,t,n)),o=r?nh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function nh(e,t,n,r){try{let o=ae(e,t,n,r),i=eh(e),s=i.isFile()?o:null,a=i.isFile()?Wi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[nn(ae(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[nn(e.replace(/\\/g,"/")),...l]:l)];return{entry:nn(o),markerFile:s?nn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=nn(th(u,"hooks").replace(/\\/g,"/"));return[m,nn(ae(m,t,n,r))]}))]}}catch{return null}}function nn(e){return process.platform==="win32"?e.toLowerCase():e}var lh={realpath:(e)=>{try{return oh(e)}catch{return null}},entryKind:(e)=>{let t=rh(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return ih(e).isDirectory()}catch{return!1}}};function rc(){return ch({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||sh()),tmpdir:ah(),paths:lh})}function ch(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>nc(n,i,()=>tc(i,o)),worktreeFacts:(i)=>nc(r,i,()=>Jl(i)),...t};return o}function nc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var rn=["fail_closed","paranoid_rm","paranoid_interpreters"],Lr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Z={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},Wr=["standard","strict","paranoid"];function oc(e,t){if(!t)return e;return Wr.indexOf(t)>Wr.indexOf(e)?t:e}function ic(e){let t=Gr(Z.level,e);return Wr.find((n)=>n===t)}function sc(e,t){return oc(e,ic(t))}function uh(e){let t=Gr(Z.level,e);if(!t)return;let n=ic(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${Z.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Wr.join(", ")}.`);return}function dh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function ac(e){return dh(Gr(Z.auditScope,e))==="all"}function zi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Bi(e={},t){let n=e.safety?.level??"standard",r=uh(t),o=oc(n,r),i=Lr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Z.level.name}=${r}`),l.paranoidRm.push(`env ${Z.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Z.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(et(Z.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Z.strict.name}`);if(et(Z.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Z.paranoid.name}`),l.paranoidInterpreters.push(`env ${Z.paranoid.name}`);if(et(Z.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Z.paranoidRm.name}`);if(et(Z.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Z.paranoidInterpreters.name}`);let c=!!e.worktreeMode||et(Z.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:zi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function et(e,t){let n=typeof e==="string"?Fi(e,t):Gr(e,t);return n==="1"||n?.toLowerCase()==="true"}function Fi(e,t){return t.get(e)}function Gr(e,t){let n=Fi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Fi(e.legacyName,t);return}import{dirname as Kr}from"path";import{closeSync as mh,constants as lc,fstatSync as fh,fsyncSync as sT,lstatSync as Hi,mkdirSync as aT,openSync as ph,readdirSync as lT,readFileSync as gh,realpathSync as ji,renameSync as cT,rmdirSync as uT,statSync as hh,unlinkSync as dT,writeFileSync as mT}from"fs";import{isAbsolute as cc,join as Vi,normalize as yh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var bh=Symbol("PolicyFilesystemScope"),Ch=Symbol("PolicyFilesystemTarget"),Sh=lc.O_NOFOLLOW??0;class le extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function It(e,t){return{[bh]:!0,root:qi(e),label:t}}function uc(e,t){let n=yh(t);if(t===""||cc(t)||n===".."||n.startsWith(`..${Yi}`))throw new le(e.label);return{[Ch]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function Hn(e,t){return uc(e,Ki(e.root,qi(t)))}function dc(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return uc(It(r,t),Ki(r,n))}function zr(e){return fc(e.scope.label,()=>{if(!Fr(e))return null;let t=ph(e.path,lc.O_RDONLY|Sh);return vh(t,()=>{let n=fh(t);if(!n.isFile())throw new le(e.scope.label);let r=gh(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new le(e.scope.label);return Fr(e),r})})}function mc(e,t){if(e.path===t.path)return!0;return fc(e.scope.label,()=>{if(!Fr(e)||!Fr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function fc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof le)throw r;throw new le(e)}}function vh(e,t){try{return t()}finally{mh(e)}}function Fr(e,t="file"){let n=Eh(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new le(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new le(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new le(e.scope.label);xh(n,ji(i),e.scope.label)}return!0}function Eh(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!hh(e.root).isDirectory())throw new le(e.label);return ji(e.root)}function xh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||cc(r))throw new le(n)}import{dirname as Ot,isAbsolute as Ph,join as Dt,relative as Th,resolve as Mt,sep as Ih}from"path";var kt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,pc="rulebook.json",gc=".cc-safety-net/rules";var hc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Rh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,wh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),_h="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),hT=new RegExp(`^${wh}/(${kt.source.slice(1,-1)})/${_h}$`);function Ah(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function yc(e){if(Br(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return kt.test(e)?null:`Local rulebook sources must be bare names matching ${kt}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(hc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Rh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!kt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Ah(o),name:o}}function Br(e){return hc.test(e)}var bc="rule.json",$r="policy.json",Cc=".cc-safety-net",kh="rules",Oh="CC_SAFETY_NET_HOME",Sc="`cc-safety-net rule update`";function Mh(e){return Mt(e,gc)}function Dh(e){return Dt(Mh(e),bc)}function jn(e){return Dt(Mt(e),Cc,$r)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Ot(t.userConfigPath):Dt(Nh(e),kh))}function Nh(e){let t=e.env.get(Oh);return t?Mt(Se(t)):Dt(e.home,Cc)}function Lh(e,t={}){return Dt(Xi(e,t),bc)}function on(e,t={}){return Dt(Ot(Xi(e,t)),$r)}function vc(e,t){let n=t.userConfigPath??Lh(e,t),r=t.projectConfigPath??Dh(t.cwd),o=Wh(e,t),i=Gh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Hn(o,n),projectConfigTarget:Hn(i,r)}}function Wh(e,t){let n=t.userConfigPath?Ot(Ot(Mt(t.userConfigPath))):Ot(Mt(t.userConfigDir??Xi(e,t)));return It(n,"user policy")}function Gh(e,t){let n=Mt(t),r=Mt(e),o=Th(n,r);if(o!==".."&&!o.startsWith(`..${Ih}`)&&!Ph(o))return It(n,"project policy");return It(Ot(Ot(r)),"project policy")}function Ec(e,t){return Dt(e,t,pc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ft=/^[a-zA-Z][a-zA-Z0-9_-]*$/,pt=256,q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),xc=new Set(["python","python3","python2","node","ruby","perl"]),Ur=/^python(?:[23](?:\.\d+)*)?$/,Ae=new Set(["awk","gawk","nawk","mawk"]),Hr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Rc="Rulebook exceeds CC Safety Net's safe validation limits.",wc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function _c(e){if(Ji(e.allowed_commands,ke.maxAllowedCommands)||Ji(e.rules,ke.maxRules)||Ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function k(e){return A(e).toLowerCase()}function A(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Fh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Fh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ee(e){let t=A(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Vn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function jr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of zh(e))Vn(n,t);return t.inSingle||t.inDouble}function zh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Vn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Bh=new Set(["git","busybox",...os,...q,...xc,...Ae]),$h=new Set(["python","node","ruby","perl"]);function Ac(e){let t=k(e);return Bh.has(t)||Oe(t)}function Oe(e){return $h.has(Uh(e))}function Uh(e){let t=A(e).toLowerCase();return Ur.test(t)?"python":t}function is(e){try{let t=zr(Hh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Kh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof le)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Hh(e){return typeof e==="string"?dc(e):e}var R=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Pc(e){let t=new Set;return e.flatMap((n,r)=>{let o=sn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,jh=/^[^/]+\/[^/]+$/,Vh=["version","rules","overrides","transparent_wrappers"];function Kh(e){let t=qh(e);return{errors:as(ry(t,Vh,(n)=>n.kind==="custom"),": "," "),sources:ny(e,t)}}function qh(e){if(!sn(e))return[R([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[R(["version"],"must be 1")],...Yh(e.rules,t),...Jh(e.overrides),...ey(e.transparent_wrappers),...t?[]:Xh(e.rules),...sn(e.overrides)?Object.keys(e.overrides).filter((n)=>!jh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...ty(e.transparent_wrappers)]}function Yh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[R(["rules"],"must be an array of rulebook source strings"),...Tc(e,es)?[R(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[R(["rules",r],"must be a rulebook source string"),...Zh(n,1)?[R(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[R(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Tc(e,t){let n=Ic(e);return n!==void 0&&!(n<=t)}function Zh(e,t){let n=Ic(e);return n!==void 0&&!(n>=t)}function Ic(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Xh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=yc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Jh(e){if(e===void 0)return[];if(!sn(e))return[R(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!sn(n))return[R(["overrides",t],'must be "off" or an object')];return[...Qh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[R(["overrides",t,"intent"],ss)]]})}function Qh(e,t){if(typeof e!=="string")return[R(t,"required non-empty string"),...Tc(e,pt)?[R(t,`must be at most ${pt} characters`)]:[]];if(e==="")return[R(t,"required non-empty string")];return e.length>pt?[R(t,`must be at most ${pt} characters`)]:[]}function ey(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[R(["transparent_wrappers",n],"must be a command string")];return ft.test(t)?[]:[R(["transparent_wrappers",n],"must match command pattern")]})}function ty(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Ac(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function ny(e,t){let n=sn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function ry(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function sn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Oc(e){let t=sy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var oy=`required non-empty string up to ${pt} characters`,kc="must be a non-empty array of unique non-empty strings",iy="required non-empty array of non-empty strings";function sy(e){if(!gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!_c(e))return{errors:[Rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ay(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),wc]:t,ruleNames:new Set(Mc(e).map((n)=>n.toLowerCase()))}}function Mc(e){let t=gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ay(e,t){return[...typeof e.name==="string"&&kt.test(e.name)?[]:[R(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[R(["version"],"required non-empty string")],...ly(e.allowed_commands),...cy(e.rules,t),...fy(e.tests),...py(e),...gy(e)]}function ly(e){if(!Array.isArray(e))return[R(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ft.test(n)?[]:[R(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function cy(e,t){if(!Array.isArray(e))return[R(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!gt(n))return[R(["rules",r],"must be an object")];return t?dy(n,["rules",r]):uy(n,["rules",r])}),...Pc(e)]}function uy(e,t){return[...Dc(e.name,t),...Nc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ft.test(e.subcommand)?[]:[R([...t,"subcommand"],"must match command pattern")],...Vr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Lc(e.reason,t),...Wc(e.intent,t)]}function dy(e,t){return[...Dc(e.name,t),...Nc(e.command,t),...Lc(e.reason,t),...Wc(e.intent,t),...my(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[R([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[R([...t,"block_args"],"not supported in rulebook_version 2")]]}function Dc(e,t){if(typeof e!=="string")return[R([...t,"name"],"required string")];return kt.test(e)?[]:[R([...t,"name"],"must match rule name pattern")]}function Nc(e,t){return typeof e==="string"&&ft.test(e)?[]:[R([...t,"command"],"required string matching command pattern")]}function Lc(e,t){return typeof e==="string"&&e!==""&&e.length<=pt?[]:[R([...t,"reason"],oy)]}function Wc(e,t){return e===void 0||cs(e)?[]:[R([...t,"intent"],ss)]}function my(e,t){if(!gt(e))return[R(t,"required object")];return[...Vr(e.command_path,[...t,"command_path"],iy,!1),...e.any_args===void 0?[]:Vr(e.any_args,[...t,"any_args"],kc,!0),...e.exclude_args===void 0?[]:Vr(e.exclude_args,[...t,"exclude_args"],kc,!0)]}function Vr(e,t,n,r){if(!Array.isArray(e))return[R(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[R([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function fy(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!gt(t))return[R(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[R(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[R(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[R(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function py(e){if(!Array.isArray(e.tests))return[];let t=new Set(Mc(e));return[...new Set(e.tests.flatMap((n)=>gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function gy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Uc(e,t){let n=vc(e,t),r;try{r=mc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof le)return Ry(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Bc(n.userConfigPath,o.errors),a=Bc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Gc(o.config,Kr(n.userConfigPath),"user",n.userScope,l):$c(),u=i.config?Gc(i.config,Kr(n.projectConfigPath),"project",n.projectScope,l):$c(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Fc(c.rules,m),...Fc(u.rules,d)],transparent_wrappers:Ey(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?zc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?xy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?zc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Gc(e,t,n,r=It(Kr(Kr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=yy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:hy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function hy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function yy(e,t,n){let r=by(e),o=Ec(t,r),i=Sy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Cy(e)}`]};let s=vy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function by(e){return Br(e)?Zi(e).name:e}function Cy(e){return Br(e)?`run ${Sc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Sy(e,t){try{return{content:zr(Hn(t,e))}}catch(n){if(n instanceof le)return{error:n.message};throw n}}function vy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Oc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Ey(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Fc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function zc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function xy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Bc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Ry(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function $c(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Ly,readFileSync as Wy}from"fs";var Hc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(Hc.map((e)=>e.id)),qr=Hc,wy=new Map(qr.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:wy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Yr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},_y=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Ay=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Ay.flatMap((e)=>_y.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Zr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],jc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Py=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=jc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=jc.flatMap((e)=>Py.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Kn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ty=[...ds,Yr,...ms,...fs,...ps,Kn,...gs,...hs,...Zr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Xr=new Set(Zr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(Ty.map((e)=>e.id));import{isAbsolute as bs,join as Iy,normalize as ky,sep as Jr}from"path";var Qr=process.platform==="win32",Vc=/[*?]/;function Cs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Qr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Vc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function qn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=qn(e.trim(),t);if(!bs(n))return"must be an absolute path or start with ~/";return Yn(n,t)}function vs(e,t){let n=Kc(e,t);if(n===null)return"must be a non-empty path string";if(!bs(n))return null;if(Yn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Oy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",My="cannot cover the guard's own configuration";function Kc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=Qr?n.replaceAll("\\","/"):n;return qn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Kc(e,t);if(n===null)return"must be a non-empty path string";let r=Cs(n)?.root??n;if(Vc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bs(r))return null;if(Yn(r,t)!==null)return Oy;return Dy(r,t)?My:null}function Dy(e,t){let n=eo(e),r=eo(Iy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Jr}`)}function Yn(e,t){let n=eo(e),r=eo(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Jr)?n:`${n}${Jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function eo(e){let t=ky(e);if(Qr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Qr?3:1)&&t.endsWith(Jr))t=t.slice(0,-1);return t}var qc=30,to=1,no=365;function Yc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Zc=new Set(qr.filter((e)=>e.catastrophic).map((e)=>e.id));function _(e,t){if(!e)return null;if(Zc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ee(e,t,n){if(Zc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Xc(e,t){return Object.freeze(Object.fromEntries(qr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Jc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Xc(e,t)})}var Qc={standard:0,strict:1,paranoid:2};function nu(e,t,n=!1,r=e.safety.level){let o=Ny(e,t,r),i=new Set(n?o.map((u)=>u.field):[]),s=(u,m)=>i.has(u)?void 0:m,a=(u,m)=>Object.fromEntries(Object.entries(m??{}).filter(([d])=>!i.has(`${u}.${d}`))),l=(u,m)=>m?.filter((d)=>!i.has(`${u}.${d}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:xs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((u)=>u.message)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function Ny(e,t,n){let r=t.safety?.level,o=Lr[n];return[...r&&Qc[r]<Qc[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...rn.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...eu("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...eu("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!Xr.has(i))),...e.destructive_command_protection.enabled?tu(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?tu(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function eu(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function tu(e,t){return(t??[]).filter((n)=>!e.includes(n))}var _s=new Set(["standard","strict","paranoid"]),su={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:qc}};function au(e,t){let n=Ky(on(e,t),e.home),r=io(jn(t.cwd),e.home),o=Fy(r.parsed,e.home),i=et(Z.projectTightenOnly,e.env),s=n.gui??su,a=Object.keys(o.policy).length>0?nu(s,o.policy,i,sc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),u=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?ws(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:u,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var Gy="project policy audit settings are ignored; audit is user scope only";function Fy(e,t){if(!xe(e))return{policy:{},diagnostics:[]};let n=xe(e.safety)?e.safety:{},r=xe(e.workflow)?e.workflow:{},o=xe(e.destructive_command_protection)?e.destructive_command_protection:{},i=xe(e.secret_protection)?e.secret_protection:{},s={..._s.has(n.level)?{level:n.level}:{},...xe(n.overrides)?ru({overrides:lu(n.overrides,rn,["safety","overrides"],Nt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:oo(o.overrides,us,uu,Nt)}:{},...o.allow_paths!==void 0?{allow_paths:ln(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Nt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:oo(i.overrides,ys,du,Nt)}:{},...i.deny_paths!==void 0?{deny_paths:ln(i.deny_paths,vs,t,["secret_protection","deny_paths"],Nt)}:{},...i.allow_paths!==void 0?{allow_paths:ln(i.allow_paths,Es,t,["secret_protection","allow_paths"],Nt)}:{}};return{policy:ru({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Gy]}}function lu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(R([...n,o],As));return[]}))}function ru(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Nt=()=>{return},As="must be a boolean",Ps="must be an object if provided",cu=`must be an integer between ${to} and ${no}`,uu={path:["destructive_command_protection","overrides"],label:"destructive command"},du={path:["secret_protection","overrides"],label:"secret protection"},zy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function By(e,t){let n=[];return{policy:mu(e,t,(o)=>{n.push(o)}),issues:n}}function $y(e,t){return mu(e,t,Nt)}function mu(e,t,n){if(!xe(e))return n(R([],"Config must be an object")),ro();if(e.version!==1)n(R(["version"],"must be 1"));let r=an(e.safety,["safety"],["level","overrides"],n),o=an(r.overrides,["safety","overrides"],rn,n),i=an(e.workflow,["workflow"],["worktree_mode"],n),s=an(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=an(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=an(e.audit,["audit"],["retention_days"],n);return fu(e,zy,[],n),{version:1,safety:{level:Uy(r.level,n),overrides:lu(o,rn,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:oo(s.overrides,us,uu,n),allow_paths:ln(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:oo(a.overrides,ys,du,n),deny_paths:ln(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:ln(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Hy(l.retention_days,n)}}}function an(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(R(t,Ps)),{};return fu(e,n,t,r),e}function fu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Uy(e,t){if(e===void 0)return"standard";if(_s.has(e))return e;return t(R(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(R(t,As));return n}function Hy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=to&&e<=no))t(R(["audit","retention_days"],cu));return Yc(e)}function oo(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(R(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(R([...n.path,o],'must be "on" or "off"')),[]}))}function ln(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(R(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):R([...r,s],a)),[]})}function xe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ro(){return structuredClone(su)}function io(e,t){if(!Ly(e))return{exists:!1,policy:ro(),errors:[]};try{let n=Wy(e,"utf-8");if(!n.trim())return{exists:!0,policy:ro(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=By(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Vy(i)}`),fallback:xe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:ro(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var jy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[cu,`not an integer between ${to} and ${no}`]]);function Vy(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=jy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Ky(e,t){let n=io(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!xe(r))return{policy:iu(),errors:[]};let o=$y(r,t);return{policy:ws(o),gui:o,errors:[],levelPresent:ou(r)}}if(n.parsed===void 0)return{policy:iu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ws(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:ou(n.parsed)}}function ou(e){let t=xe(e)&&xe(e.safety)?e.safety:{};return _s.has(t.level)}function pu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Xr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function iu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:pu({}),denyPaths:[],allowPaths:[]}}}function ws(e){return{safety:qy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:pu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function qy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function gu(e,t){let n=Uc(e,t),r=au(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Jy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Qy(o,Yy(n,r),s,r.policyScopes)}function Yy(e,t){let n=Xy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:eb(e.errors.length>0?Zy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Zy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Xy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Jy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Qy(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function eb(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function hu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Jc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:zi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as iw,isAbsolute as sw,join as aw,parse as lw,resolve as cw,sep as uw}from"path";function Zn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var tb=/^[A-Za-z_][A-Za-z0-9_]*=/;function so(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Xn(e){let t=so(e.words[0],"time")?1:0,n=t===1&&so(e.words[t],"-p")?t+1:t,r=t===1&&so(e.words[n],"--")?n+1:n,o=so(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!tb.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function ao(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function nb(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function lo(e,t,n){e.push(n),t.reset()}function co(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function cn(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return nb(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||bu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!bu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=yu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=yu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=rb(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?ob(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function yu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function bu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function rb(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function ob(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Eu=new Set(["&&","||","|","|&"]),ib=new Set(["!","do","elif","else","if","then","until","while"]);function xu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=fo(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:ho(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function fo(e,t,n,r,o,i,s){let a=[],l=[],c=ao(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);lo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),vu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(go(f)){if(f===`
-`||f==="\r"){m();let T=f==="\r"&&e[d+1]===`
-`?d+2:d+1,I=a.at(-1);if(I?.kind!=="connector"||!Eu.has(I.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,T),span:Object.freeze({start:d,end:T})}));if(u.length>0){let M=Ds(e,T,n,u.splice(0));l.push(...M.issues),d=M.next;continue}d=T;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let g=c.start===-1?_b(e,d,n):void 0;if(g){if(Ls(a,l),i>=r.maxDepth)return un(a,l,d,"depth-limit",r.maxDepth);if(!Ns(o))return un(a,l,d,"word-limit",r.maxWords);let T=fo(e,g.braceIndex+1,n,r,o,i+1,"}"),I=T.next,M={start:g.braceIndex+1,end:T.closed?I-1:I},Y=Cu(e,M,T);if(a.push({kind:"function",name:g.name,span:{start:d,end:I},body:Y}),l.push(...T.issues),T.pendingHeredocs.length>0||Qn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return mo(a,l,T.next);if(!T.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=I;continue}let p=po(e,d);if(p){if(m(),!ku(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&fb(e,d,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return un(a,l,d,"depth-limit",r.maxDepth);let T=f==="("?")":"}",I=fo(e,d+1,n,r,o,i+1,T),M=I.next,Y={start:d+1,end:I.closed?M-1:M},ue=Cu(e,Y,I);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:M},body:ue}),l.push(...I.issues),I.pendingHeredocs.length>0||Qn(I.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...I.pendingHeredocs),I.limited)return mo(a,l,I.next);if(!I.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=M;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?cb(e,d):null;if(h){let T=c.words.at(-1),I=T&&T.span.end===d&&/^[0-9]+$/.test(T.raw)?Number(T.raw):void 0;if(I!==void 0)c.words.pop();let M=I===void 0?d:T?.span.start??d;c.start=c.start===-1?d:c.start;let Y=d+h.length;while(Y<n&&/[ \t]/.test(e[Y]??""))Y++;let ue=e[Y],Xe=Y>d+h.length&&ue==="#",be=!ue||go(ue)||!!po(e,Y)||ue===s||ue===")"||Xe||(ue==="<"||ue===">")&&e[Y+1]!=="(",At=h==="<<"||h==="<<-",z=At?Ms(e,Y,n):void 0,D=z?{word:cn(e,Y,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!be?Ws(e,Y,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return mo(a,l,D.next);if(!Ns(o))return un(a,l,D.next,"word-limit",r.maxWords)}let se=D?.next??d+h.length,J={kind:"redirection",operator:h,span:{start:M,end:se},...I===void 0?{}:{fd:I},...D?{target:D.word}:{}};if(c.redirections.push(J),At&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;u.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:h==="<<-",attach:(Ce)=>{if(J.heredoc=Ce,Ce.quotedDelimiter)return;Q.push(...ab(e,Ce.bodySpan.start,Ce.bodySpan.end,r,o,i+1))}})}if(!At&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=se,d=se;continue}let b=c.start===-1;if(b)Ls(a,l);let C=Ws(e,d,n,r,o,i);if(l.push(...C.issues),C.limited)return mo(a,l,C.next);let y=hb(c.words)?vb(e,C.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(y?.limitCode)return un(a,l,C.next,y.limitCode,y.limitCode==="word-limit"?r.maxWords:y.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=y?.words??[C.word];for(let T of E){if(!Ns(o))return un(a,l,C.next,"word-limit",r.maxWords);c.words.push(T)}if(c.start=c.start===-1?d:c.start,c.end=C.next,c.nested.push(...C.nested),b&&Ou(C.word))m();d=C.next>d?C.next:d+1}return m(),vu(a,l),l.push(...Ab(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Cu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ho(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||go(f)||(f===";"||f==="|"||f==="&")&&po(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=sb(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Jn(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=ub(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?yo(e,a,n,r,o,i):null;if(p){let h=Ru(p,u,m);if(d||=h.limited,c=Jn(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=Au(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Jn(c,"glob");s+=f,a++}return{word:cn(e,t,a,s,c,l,c==="literal"?void 0:mb(e,t,a)),nested:u,issues:m,next:a,limited:d}}function sb(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
-`){m+=2;continue}if(g==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=Gs(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=yo(e,m,n,r,o,i);if(f){let g=Ru(f,l,c);if(m=g.next,u||=g.limited,a=Jn(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let g=Au(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function yo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Gs(e,t+u,n,m),f=d===-1?n:d,g=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:wb(e,t+u,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let C=[],y=[],E=!1,T=t+u;while(T<f){let I=yo(e,T,f,r,o,i+1);if(!I){T++;continue}if(C.push(...I.program.nodes),y.push(...I.program.issues),E||=I.program.status==="limited",T=I.next,E)break}if(d===-1)y.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ho(y,E),issues:y,nodes:C}),next:g,provenance:"arithmetic"}}let p=fo(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],b=(c||l)&&Qn(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ho([...p.issues,...h,...b],p.limited),issues:[...p.issues,...h,...b],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function ab(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?yo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ds(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=wu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=lb(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Ms(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function lb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=wu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function wu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Pb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function po(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function cb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function go(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function _u(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function ub(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=db(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function db(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return uo(e,t+1,n,16,2,t+1);if(r==="u")return uo(e,t+1,n,16,4,t+1);if(r==="U")return uo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return uo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function uo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ho(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Au(e,t,n,r,o){let i=_u(e,t,n);return{text:r+e.slice(t,i),provenance:Jn(o,"variable"),next:i}}function mb(e,t,n){let r=co(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=Gs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=_u(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function fb(e,t,n){return t+1>=n||go(e[t+1]??"")||po(e,t+1)!==null}var pb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),gb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function hb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=yb(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function yb(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return bb(e,t);if(n==="env")return Cb(e,t);if(n==="sudo")return Sb(e,t);return}function bb(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Cb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(pb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Sb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(gb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Pu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Tu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Iu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function vb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Tu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Iu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>cn(e,t.span.start,t.span.end,a,"literal",!1))}}function Tu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Su(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Su(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Eb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Su(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Rb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:xb(e,r)}}function Eb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function xb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Rb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Iu(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function wb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function un(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function mo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function _b(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Qn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Qn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Qn(t.body.nodes)})}function Ab(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function ku(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function vu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Eu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ou(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&ib.has(e.text)}function Ls(e,t){let n=e.at(-1);if(!ku(n))return;if(n?.kind==="command"&&Ou(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Pb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Du=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Tb=new Set(["gc","cat","type","cp","mv","rm"]),Nu=["-rec","-for","-path","-literalpath","-whatif"],Ib=/^\$env:\w/i,kb=/^(?:\$\{?\w+\}?|~)\\./;function Lu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Du].some((o)=>n.includes(o))&&!(n.includes("rm")&&Nu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Ob(n))return!1;let r=$s(e,t);if(Wu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(Mb)}function Wu(e){return e.nodes.some((t)=>{if(t.kind==="group")return Wu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Ob(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Mb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Du.has(n))return!0;let r=e.slice(t+1);if(n&&Tb.has(n)&&r.some(Db))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Nu.some((s)=>i.startsWith(s))})}function Db(e){return Ib.test(e)||kb.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Fb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=ao(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};lo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=Gb(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let b=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Fs(e,d,b)),d=b;continue}d++;continue}let p=zu(e,d);if(p){m(),s.push(Fs(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Fu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let b=Us(e,d+1,n,r,o+1,!0),C=b.closed?b.next-1:b.next,y=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,C),span:{start:d+1,end:C},status:b.limited?"limited":b.issues.length>0?"partial":"complete",issues:b.issues,nodes:b.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:b.next}),body:y})),a.push(...b.issues),!b.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=b.words,u||=b.limited,d=b.next;continue}if(f==="}"){m(),s.push(Fs(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let b=e[d+1]===f?d+2:d+1,C=b;while(/[ \t]/.test(e[C]??""))C++;let y=C<n?Mu(e,C,n,r,o):void 0,E=y?.next??b;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,b),span:Object.freeze({start:d,end:E}),...y?{target:y.word}:{}})),y)a.push(...y.issues),l.nested.push(...y.nested),c+=y.words,u||=y.limited;l.end=E,d=E;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Os({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Mu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Mu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=Nb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=zs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||zu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:cn(e,t,f,i,s,a,s==="literal"?void 0:Lb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function Nb(e,t,n,r,o){let i=Gu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Fu(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Gu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function Lb(e,t,n){let r=co(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Gu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Wb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Wb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Fu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function zu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Gb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Fb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=ht){if(t==="powershell"||t==="auto"&&Lu(e.slice(0,n.maxInputLength),n))return $s(e,n);return xu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function dn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function bo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function er(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){er(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function U(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function H(e,t,n){if(t+n.length>X(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Lt(S(e,t-1))&&H(e,t,n)&&!Lt(S(e,t+n.length))}function nt(e,t){return Lt(S(e,t-1))!==Lt(S(e,t))}function re(e){return e===`
-`||e===";"||e==="&"||e==="|"}function mn(e){return e==="|"||e===";"}function Co(e,t,n){let r=Hs(e,n);if(t==="rm")return zb(r);if(t==="dd")return $b(r);return Vu(r,!0)}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return Ub(r);if(t==="reset-hard")return Hu(r,"--ha","rd");if(t==="reset-merge")return Hu(r,"--me","rge");if(t==="clean")return Kb(r);if(t==="checkout")return Yb(r);if(t==="push-force")return Zb(r);if(t==="push-refspec")return Xb(r);if(t==="push-delete")return Jb(r);if(t==="branch")return Qb(r);if(t==="tag")return nC(r);if(t==="restore")return rC(r);return Vu(r,!1)}function zb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(tt(e,i,"rm")&&U(l)&&l!==`
-`)t=!0,i++;continue}let a=Bb(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=Bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(U(s)){if(o<0)continue;if(H(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Bb(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(H(e,t,String.raw`\n`))return t+2;if(H(e,t,String.raw`\x0a`)||H(e,t,String.raw`\x0A`))return t+5;if(H(e,t,String.raw`\u000a`)||H(e,t,String.raw`\u000A`))return t+7;return H(e,t,String.raw`\012`)?t+4:-1}function Bu(e,t,n){if($u(e,t,n,"recursive"))return{recursive:!0,force:!1};if($u(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function $u(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!H(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function $b(e){let t=!1;for(let n=0;n<X(e);n++){if(re(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!H(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!U(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function Ub(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=S(e,o);if(o===X(e)||re(i)){t=!1,n=!1,r=!1,o++;continue}let s=jb(e,o);if(s>=0){if(Hb(e,s))return!0;let a=s,l=!1;while(U(S(e,a)))l||=S(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(H(e,o,"--")&&(o===0||U(S(e,o-1)))&&(!S(e,o+2)||U(S(e,o+2))||re(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=H(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=H(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!H(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||U(o)||re(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function Hb(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(U(S(e,n)))n++;let i=n;while(n<X(e)&&!U(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&H(e,i,"--"))return!1;let s=Uu(e,i,"recursive"),a=Uu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=Vb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Uu(e,t,n){return H(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function jb(e,t){if(t>0&&Lt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!U(S(e,n+1)))return-1;return n+1}function Vb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&nt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Hu(e,t,n){return nr(e,"reset",mn,!0,(r)=>S(e,r)==="-"&&fn(e,r,t,n)?!0:r)}function Kb(e){return nr(e,"clean",mn,!0,(t)=>{if(S(e,t)!=="-")return t;if(fn(e,t,"--fo","rce"))return!0;let n=tr(e,t,mn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function vo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!U(S(e,r)))return{commandEnd:-1,next:r};while(U(S(e,r)))r++;while(r<X(e)){if(re(S(e,r)))return{commandEnd:-1,next:r};let o=tr(e,r,re);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&H(e,r,"--"),s=qb(e,r,o);r=o;while(U(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:tr(e,r,re)};if(!s)continue;if(r>=X(e)||re(S(e,r)))return{commandEnd:-1,next:r};r=tr(e,r,re);while(U(S(e,r)))r++}return{commandEnd:-1,next:r}}function qb(e,t,n){for(let r of ve)if(n-t===r.length&&H(e,t,r))return!0;return!1}function Yb(e){return ju(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Zb(e){return nr(e,"push",mn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Lt(S(e,t+2))&&!H(e,t+2,"-with-lease"))return!0;let n=Ku(e,t,"--fo","rce");if(n>=0&&!H(e,n,"-with-lease"))return!0;return t})}function Xb(e){return nr(e,"push",re,!1,(t)=>{if(U(S(e,t))&&S(e,t+1)==="+"&&t+2<X(e)&&!re(S(e,t+2))&&!U(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function Jb(e){return nr(e,"push",re,!1,(t)=>{if(S(e,t)==="-"&&fn(e,t,"--de","lete"))return!0;if(U(S(e,t))&&S(e,t+1)===":"&&t+2<X(e)&&!U(S(e,t+2))&&!re(S(e,t+2)))return!0;return t})}function Qb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||re(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=vo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=tr(e,o,re),s=eC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function eC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(fn(e,i,"--de","lete"))r=!0;if(fn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&tC(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function tC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function nC(e){return ju(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function ju(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(U(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=vo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&U(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(fn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(mn(o))i.outerActive=!1}return!1}function nr(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=vo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||U(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function rC(e){let t=!1;for(let n=0;n<X(e);n++){if(js(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=vo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(H(e,n+2,"staged")||H(e,n+2,"help")))t=!1}return t}function Vu(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=S(e,r),i=t?js(o):re(o);if(n&&U(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function tr(e,t,n){let r=t;while(r<X(e)&&!U(S(e,r))&&!n(S(e,r)))r++;return r}function Ku(e,t,n,r){if(!H(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function fn(e,t,n,r){return Ku(e,t,n,r)>=0}function Pe(e,t){er(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&So(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var oC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Yu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;er(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Zu(t.nodes,r,i)}function Zu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Zu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return iC(r,t,n)})}function iC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!oC.test(o.text));return e.words.every((o,i)=>o===t||qu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||qu(o.target.raw,n.anchored,!0)))}function qu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as sC,resolve as Xu}from"path";function rr(e,t,n,r){let o=sC(e)?Xu(e):t?Xu(t,e):void 0;if(!o)return;try{return L(o,n,r)}catch{return o}}function Ju(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var pn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",or="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),aC=new Set(["-p","--print"]),lC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),cC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),uC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),dC=new Map([["python",new Set(["m"])]]),mC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),fC=new Set(["always","default","never"]),pC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),gC=/\\\r?\n/g,hC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Qu(e){return xo(e).code}function Eo(e){return xo(e).sources}function ed(e){return hC.get(Zs(e))??[]}function xo(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&aC.has(s)){let m=e[i+1];if(m===void 0)return De(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(bC(t,s)){let m=e[i+1];if(m===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(CC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=yC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if(mC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&pC.has(s))||t==="python"&&!fC.has(m))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(dC.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return De(t,n,r,o)}if(lC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(cC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(uC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function yC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=A(e).toLowerCase();return Ur.test(t)?"python":t}function bC(e,t){return qs.get(e)?.has(t)??!1}function CC(e){return qs.get(e)?.has("--eval")??!1}function ir(e,t,n=!1){let r=EC(e,t);if(!Ks(r,t))return!1;Re(t,r);let o=vC(r);if(Ks(o,t))return!0;if(Re(t,o),!td.test(o))return!1;return!n||SC(r,t)}function SC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>td.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var td=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function vC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(Co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(Co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(Co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>So(o,r))))}function EC(e,t){return Re(t,e),e.replace(gC,"")}import{lstatSync as CS,readdirSync as SS}from"fs";import{basename as vS,isAbsolute as Ad,join as ES,relative as Pd}from"path";import{isAbsolute as ld,parse as OC}from"path";import{dirname as xC,isAbsolute as RC,parse as wC,sep as _C}from"path";function yt(e,t,n){if(Qe(t))throw Error("Unsupported Windows namespace path");let r=RC(t)?wC(t).root:"",o=r||e;for(let i of PC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=xC(o);continue}let s=AC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function AC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${_C}${t}`}function PC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],TC=new Set(Qs),IC=1024,nd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),rd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),kC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ro(e){return TC.has(e)}function ea(e){return Ro(e)||nd.has(e)||rd.has(e)||Un(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function od(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=IC?{state:"valid",count:r}:{state:"invalid"}}function wo(e,t,n){let o=e.match(kC)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function id(e){return ad(e,rd)}function sd(e){return ad(e,nd)}function ad(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ud=/^[A-Za-z_][A-Za-z0-9_]*=/;function Te(e){if(!ud.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function _o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Te(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function dd(e){let t=k(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!dd(gn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=cd(i),f=_o(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&gn(i).includes("=")&&!DC(i)){let p=NC(gn(i),a,t.env)??wo(gn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=k(gn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=WC(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=zC(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,b]of p.envAssignments)s.set(h,b),a.set(h,b)}if(g==="command")i=BC(i);if(g==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(cd(i)===d)break}let u=_o(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:MC(u.words,o)}}function MC(e,t){return e.some((n)=>!t.has(n))}function cd(e){return e.map(w).join(" ")}function gn(e){let t=e[0];return t?w(t):""}function Ne(e,t){let n=e[t];return n?w(n):void 0}function DC(e){return ud.test(gn(e))}function NC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var LC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function WC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?sr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=sr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=sr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(LC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var GC=new Set(["-i","-0","--null"]),FC=new Set(["-u","--unset","-C","--chdir","-P"]);function zC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(GC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Ne(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(FC.has(c)){if(c==="-C"||c==="--chdir"){let m=Ne(e,a+1);s=m?sr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=sr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Te(c))break;while(a<e.length){let m=Te(Ne(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function sr(e,t,n){if(t==="")return null;if(!e&&!ld(t))return null;let r=ld(t)?OC(t).root:n.realpath(e??"/");if(r===null)return null;try{return yt(r,t,n)}catch{return null}}function BC(e){if(Ne(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var $C=/['"\\$`{}#]/;function Ao(e,t){if(e.some((r)=>$C.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function bt(e,t,n){return Po(e,t,n).tokens}function UC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=Po(e,t,n),i=(o.envSplitValues??[]).flatMap(UC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function Po(e,t,n,r){if(!dd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),HC=new Set(["env","sudo","command","builtin"]),jC=new Set(["&&","||","|&","|","&",";"]),VC=new Set(["<<","<<<",">|"]),KC=new Set(["|","|&"]),qC=/[*@#?$!_-]/,YC=/^\w+(?::\w+)*/,ZC=Object.freeze([]),ar=Object.freeze({kind:"scope",edge:"enter"}),lr=Object.freeze({kind:"scope",edge:"exit"}),XC=Object.freeze([]),JC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),cr=new Set(["bash","sh","zsh","dash","ksh"]),QC=256,hd=new WeakMap;function yd(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=nS(e,n);if(jr(r))return To("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Gt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return To("structural-limit",r,t);if(o.invalid)return To("invalid",r,t);let s=To("complete",r,t,o.assignmentFallbacks);return hd.set(s,Object.freeze(i)),s}function ko(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of bd(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=eS(a,s,n,r),c=a.length>0&&KC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===oa){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Oo(e){return bd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function ur(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function eS(e,t,n,r){let o=ur(e)?new Map([...t.variables,...tS(e,t.variables)]):t.variables,i=bt([...e],n),s=A(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ae(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function tS(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function bd(e){return hd.get(e)??ZC}function nS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function To(e,t,n,r=XC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Gt(e,t){return e.nodes.flatMap((n,r)=>rS(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function rS(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(lS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Io("{"),...Gt(e.body,a),...s?[Io("}")]:[]]:[ar,Le("("),...Gt(e.body,a),...s?[Le(")")]:[],lr]}]}let o=mS(e,r.functions);if(o){if(r.depth>=ht.maxDepth||++r.flags.expansions>QC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...md(e,r),Io(";"),...Gt(o,{...r,depth:r.depth+1}),Io(";")]},...fd(e,t,n,r)]}return[{start:e.span.start,events:md(e,r)},...fd(e,t,n,r)]}function md(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Sd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:oS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function oS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Sd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:cS(r),targetOrder:VC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function fd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Cd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?iS(t,n,r):[]]}function iS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Cd(n.source.slice(r.span.end,e.span.end),n)}]}function Cd(e,t){if(t.depth>=ht.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Gt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Sd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?Gt(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(ar,...g,lr);continue}let m=u?Gt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(ar,...m,lr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),ar,...m,...c.raw.endsWith(")")?[Le(")")]:[],lr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[ar]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[lr]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=pd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=pd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function pd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=aS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return sS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&qC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?YC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function sS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function aS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function lS(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:jC.has(e)})}function Io(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function cS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function dr(e){return JC.has(e)||/^python\d/.test(e)}var uS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function vd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=uS.get(e)?.has(n)??!1;return vd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!HC.has(t))return[...e];return na(vd(t,e.slice(1)))}function Ed(e){let t=Xn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function dS(e){let t=Ed(e)[0];if(t===void 0)return!1;let n=A(t).toLowerCase();return dr(n)&&!cr.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(dS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!pS(t))return r;return[...r,...o]})}function mS(e,t){let n=Xn(e);return n===void 0?void 0:t.get(n)}function St(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function fS(e){if(St(e.words[0],"git"))return St(e.words[1],"commit");if(!St(e.words[0],"gh")||!St(e.words[2],"create"))return!1;return St(e.words[1],"pr")||St(e.words[1],"issue")}function pS(e){return(St(e.words[0],"cat")||St(e.words[0],"tee")||fS(e))&&!e.words.some(gd)&&!e.redirections.some((n)=>gd(n.target))}function gd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var xd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Rd=new Set([...xd,"glob"]),gS=new Set([...Rd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function wd(e){let t=hS(),n=Fn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:yS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function hS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=yd(i,a);return e.set(i,c),c},getCommandProgram:r}}function yS(e){let t=e.route.kind==="grep"?Rd:e.route.kind==="glob"?gS:xd;return[...Ml(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Ll(e.input):[]]}var bS=new Set(["-S","--suffix"]);function hn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return ko(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Mo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&bS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ge="Git metadata and hooks are protected. Ask the user before modifying them.";function Td(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Mr(e.invocation.toolName))return null;let a=e.paths.find((l)=>_d(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=hn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>PS(a,l,t,n,r),isRedirectionTarget:(a,l)=>_d(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ft(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=No(ae(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Do(m,l):xS(m,l);if(n.markerFiles.some(u))return!0;return r&&aa(n).some(u)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>Do(c,a))}function xS(e,t){let n=Pd(t,e);if(n===""||n.startsWith("..")||Ad(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function RS(e,t,n,r,o){return Ft(e,t,n,!0,r,o)}function wS(e,t,n,r,o){if(!n)return!1;return sa(No(ae(e,t,r,o)),n)}function _d(e,t,n,r,o,i){let s=No(ae(e,t,r,o));return i.includes(s)||kd(s,n)}function Id(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Do(i,No(ae(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||kd(e,t)}function kd(e,t){return t.hooksDirectories.some((n)=>Do(e,n))}var _S=50000;function Od(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(vS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=AS(o);if(!i)return!0;if(r+=i.length,r>_S)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>ES(o,s.name)))}return!1}function AS(e){try{let t=CS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return SS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Do(e,t){let n=Pd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Ad(n)}function No(e){return process.platform==="win32"?e.toLowerCase():e}function PS(e,t,n,r,o){if(ur(e))return null;let i=Ct([...e],r);if(A(i[0]??"").toLowerCase()!=="mv")return null;let s=Mo(i.slice(1)),a=s.sources.find((l)=>RS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&wS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Fo,normalize as LS,parse as WS,posix as zd,resolve as Bt,sep as da}from"path";import{isAbsolute as TS,join as Md,normalize as Ld,parse as IS,sep as Dd}from"path";var kS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],OS=` 	
-`;function mr(e,t){if(zt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function yn(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Gd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(DS(e))return!1;return bn(e,t)}function zt(e,t){let n=Gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==OS}function bn(e,t){let n=Lo(e,t.paths);if(n===null)return!1;return Wd(t).some((r)=>Cn(n,r))}function Go(e,t){let n=Lo(e,t.paths);if(n===null)return!1;return Wd(t).some((r)=>Wo(r)===Wo(n))}var Nd=new WeakMap;function Wd(e){let t=Nd.get(e);if(t)return t;let n=MS(e);return Nd.set(e,n),n}function MS(e){let t=kS.map((r)=>Lo(r,e.paths)??Ld(r)),n=Lo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&NS(n))return[...t,n];return t}function DS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function NS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Lo(e,t){try{let n=Ld(e);if(!TS(n))return n;let r=IS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Md(i,o[s]??"");if(t.entryKind(a)==="missing")return Md(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Cn(e,t){let n=Wo(e),r=Wo(t);if(n===r)return!0;let o=r.endsWith(Dd)?r:`${r}${Dd}`;return n.startsWith(o)}function Wo(e){return process.platform==="win32"?e.toLowerCase():e}var GS=process.platform==="win32",Fd=64,FS=16384;function fr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ee(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ee(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function pr(e){let t=Pu(e,Fd,Fd,FS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:zS(e)}}function zS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>BS(e.raw,n.span.start-e.span.start))}function BS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??je();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:KS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&YS(e))return{kind:"outside_anchored_cwd"};let o=!r&&$d(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(US(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ft(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(HS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(qS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&QS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>ev(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(tv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if($S(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function $S(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Fo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Ud(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Bt(t.resolvedCwd,r),t.environment)}function Bd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(VS(i))return!1;if(Go(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Ud(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=zd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function US(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Fo(o)?o:t.resolvedCwd?Bt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===WS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=LS(e);if(GS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function HS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&jS(l,n)}function jS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!$d(e.slice(n.length+1),t)})}function VS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return zd.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function KS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=qn(o.trim(),t);if(!Fo(i))return[];try{let s=L(i,n,r);if(Yn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function qS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:qn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Fo(o)?o:i?Bt(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function YS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function $d(e,t=!1){return e.includes("$")||e.includes("`")||ZS(e)||t&&XS(e)}function ZS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function XS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&JS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function JS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function QS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function ev(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L(Bt(t,e),n,r))===he(L(o,n,r))}catch{try{return he(Bt(t,e))===he(o)}catch{return!1}}}function tv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Bt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Bt(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Hd(L(e,n,r),L(t,n,r))}catch{return!1}}function Ud(e,t,n,r){if(!t)return!1;try{return Hd(L(t,n,r),L(e,n,r))}catch{return!0}}function Hd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var nv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),jd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",rv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Vd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Kd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ov="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",iv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",sv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Kd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ge},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Vd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ov},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:jd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:rv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:jd}};function qd(e,t,n){return av(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function av(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=cv(o),s=o[i];if(!s||!nv.has(bv(s.text)))return null;let a=lv(o.slice(i+1));if(a.whatIfProtected)return null;if(ee(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",iv);for(let l of a.targets)if(!Qe(l.text)&&ma(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Kd);for(let l of a.targets)if(n.resolvedCwd&&Ft(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",Ge);if(!a.recursive||!a.force)return null;if(ee(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Vd);for(let l of a.targets){let c=fr(Fe(ga(l.text),n),n,r,sv);if(c)return c}return null}function lv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(uv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=mv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(fv(c.name)){let u=c.value?dv(c.value,l):e[++a];if(u?.kind==="word"){t.push(pa(u)),i=i||u.dynamic;continue}i=!0;continue}if(pv(c.name)){n=!0;continue}if(gv(c.name)){r=!0;continue}if(hv(c.name))o=yv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function cv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function uv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function dv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function mv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function fv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function pv(e){return"recurse".startsWith(e)}function gv(e){return e.length>=2&&"force".startsWith(e)}function hv(e){return e==="wi"||"whatif".startsWith(e)}function yv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function bv(e){return e.toLowerCase()}var Sn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",zo="Unsupported heredoc syntax",gr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Yd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Cv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Sv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),vv=new Set(["-o","--output","--query","--subscription"]),Ev=new Set;function Zd(e){if(e==="aws")return Cv;if(e==="gcloud")return Sv;if(e==="az")return vv;return Ev}var xv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Rv=new Set;function Xd(e){if(e==="git")return ve;if(e==="docker")return xv;return Rv}function it(e,t){if(e.length===0||t.length===0)return null;let n=k(e[0]??""),r=me(e);for(let o of t){if(!Av(n,o.command))continue;if(o.match){if(wv(n,e,o.match))return Jd(o);continue}if(!Pv(n,e,o.subcommand))continue;if(Iv(e,new Set(o.block_args),r))return Jd(o)}return null}function Jd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function wv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return _v(r,n.command_path,Zd(e))}function _v(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Av(e,t){return e===k(t)}function Pv(e,t,n){if(!n)return!0;return Qd(t,1,n,Xd(e))}function Qd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Tv(e,i,n,r))return!0;continue}return s===n}return!1}function Tv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Qd(e,t+2,n,r)}function Iv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var kv=new Set(["-e","--source"]),Ov=new Set(["-F","-v","--assign","--field-separator"]),em=new Set(["-f","--file"]),Mv=new Set(["print","printf","return"]),tm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Dv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function nm(e,t,n){let r=!1;for(let o of Nv(e)){let i=Lv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Dv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&kv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Ov.has(a)||em.has(a))){let l=e[s+1];if(i&&=l!==void 0,em.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function yr(e){return ya(e).sources}function Nv(e){return yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Lv(e,t){Re(t,e);let n=e.includes("system")?ba(e,t):null,r=Wv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ba(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=$o(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=rm(e,i+1);continue}if(s==="/"&&om(e,i)){i=im(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,hr(e[a-1])||hr(e[i]))continue;let l=Bo(e,i);if(e[l]!=="(")continue;l=Bo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=$o(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Bo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Wv(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=$o(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=rm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&om(e,i)){let f=im(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Bo(e,m);if(ha(e,d,"getline")){o=!0;let f=zv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if($v(s,a)){o=!0;let f=Fv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!Gv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Bo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Gv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function $o(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Bv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Fv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return $o(e,t,n)}function zv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Bv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!hr(e[t-1])&&!hr(e[t+n.length])}function $v(e,t){return t!==null&&t>=e}function rm(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function om(e,t){let n=Uv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(hr(e[r-1]))r--;return Mv.has(e.slice(r,n+1))}function Uv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function im(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Hv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",jv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Vv="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function sm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function am(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",Hv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",jv);if(e==="shred"&&n.length>0)return v("shred.target",Vv);return null}var Kv=new Set(["sudo","env","command","builtin"]),qv=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Uo(e,t){let n=e[0];if(!n||!lm(A(n),t))return null;let r=A(n),o=e[1]==="--"?2:1,i=Yv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Yv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=A(a)!==n&&Zv(a,r);if(l)i.push(s);if(!l&&Hr.has(k(a)))break;if(o)break}return i}function Zv(e,t){let n=A(e),r=k(e);return r==="git"||n==="busybox"||$t(e)||os.has(n)||sm(r)||lm(n,t)||q.has(r)||e==="$SHELL"||Oe(r)||Ae.has(r)||t.rules.some((o)=>o.command===n)}function lm(e,t){return qv.has(e)||t.transparentWrappers.includes(e)}function $t(e){return Kv.has(e.toLowerCase())}function Ut(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Ho([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Ho(e,t,n,r,o,i,s,a,l){let c=Po(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Ao(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");Ca(a),yield*Ho(f,t,m,r,o,i,s,a,l);return}if($t(u[0]??""))throw new N("wrapperPeelIterations");let d=Uo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])Ca(a),yield*Ho(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Jv(u)){Ca(a),yield*Ho(u.slice(1),t,m,r,o,i,s,a,l);return}yield Xv(u,m,r,o,i,l)}function Xv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:A(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ca(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function Jv(e){return A(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function st(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function jo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Qv=["--init-file","--rcfile"],eE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Be(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return cm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=cm(e,t,!1);if(r!==null)return r}}return null}function at(e){let t=A(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ee(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function cm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function um(e){let t=A(e[0]??"").toLowerCase(),n=tE(e,t),r=eE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function tE(e,t){let n=Ee(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Qv.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var nE="find -delete permanently removes files. Use -print first to preview.",rE="find -exec rm -rf is dangerous. Use explicit file list instead.",oE=new Set(["-exec","-execdir","-ok","-okdir"]),iE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function dm(e,t){let n=e.map(w),r=sE(e,n,t);if(r)return r;if(Vo(n,1)&&!mE(e,n,t)){let s=_(v("find.delete",nE),t.policy);if(s)return s}let o=t.budget??je(),i=0;while(i<n.length){let s=n[i],a=lt(s??"");if(a>0){i+=a+1;continue}if(!Ke(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=vn(n,i);i=l.nextIndex;let c=pE(l.tokens,t.environment);if(c){let f=_(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?.(l.tokens,u?null:t.cwd)??null,d=m?.id.startsWith("custom.")?m:_(m,t.policy);if(d)return d}return null}function sE(e,t,n){if(!Vo(t,1)&&!Ea(t,n.environment))return null;let o=br(e)??K(["."]),i=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=pr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!aE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",Ge)}}if(dE(t)&&i.resolvedCwd&&Id(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",Ge);return null}function aE(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=br(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(Ke(l)){let c=vn(r,a),u=Ct([...c.tokens],n),m=jo(u),d=q.has(A(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(cE(c.text,l==="-iname"));a+=2;continue}if(!lE.has(l))return!1;a+=1+lt(l)}return o.length>0&&!Od(t,(l)=>o.every((c)=>c.test(l)))}var lE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function cE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var uE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!Ke(e[n])){n++;continue}let r=vn(e,n),o=Ct([...r.tokens],t),i=A(o[0]??"").toLowerCase(),s=q.has(i)&&uE.test((Be(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function dE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function mE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=br(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??yn(o,n.environment),a=n.allowTmpdirVar??!mr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??zt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=vt(l),u=vt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!Cn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=pr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[w(g)]).every((h)=>{let b=/^\.\/*$/.test(h)?f:void 0,C=b??h,y={targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected};if(!ee(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!b&&Fe(C,c,y).kind==="within_anchored_cwd")return!0;return Bd(C,b?u:c,{...y,containmentTarget:fE(C,i)})})})}function fE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function br(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function pE(e,t){let n=bt([...e],t);if(n.length===0)return null;let r=A(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=A(n[0]??"");if(r==="rm"&&st(n))return v("find.exec-rm-recursive-force",rE);return null}function vn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Vo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Ke(r)){n=vn(e,n).nextIndex;continue}let o=lt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function lt(e){return iE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Ke(e){return e!==void 0&&oE.has(e)}import{resolve as Bx}from"path";function Cr(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var gE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function oe(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function fm(e,t,n){let r=Ko(e,t,n),o=hE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<gE;a++){let{subcommand:l,rest:c}=we(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=vE(m);if(d===null||d.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function pm(e,t,n){return Ko(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function we(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?A(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function hE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Ko(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?A(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=bE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...yE(e,t,n)]}}function yE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=mm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=mm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function bE(e,t){let n=CE(e,t),r=SE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function CE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Cr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function SE(e,t){let n=od(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function mm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function vE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Cr(t)}var EE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",xE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",RE="git checkout --force discards uncommitted changes. Use 'git stash' first.",wE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",_E="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",AE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",PE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",TE="git switch --force discards uncommitted changes. Use 'git stash' first.",IE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",kE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",OE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",ME="git reset --merge can lose uncommitted changes. Use 'git stash' first.",DE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",NE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",LE="git push --force destroys remote history. Use --force-with-lease for safer force push.",WE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",GE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",FE="git branch -D force-deletes without merge check. Use -d for safe delete.",zE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",BE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",$E="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",UE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",HE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",jE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",VE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",KE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),qE=new Set(["--recurse-submodules","--track","-t"]),wa=new Set(["-b","-B","-U"]),_a=new Set(["-c","-C"]),YE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function hm(e,t){let{subcommand:n,rest:r}=we(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Et(ZE(r,t));case"switch":return Et(JE(r));case"restore":return Et(ex(r));case"reset":return nx(r);case"clean":return Et(ox(r));case"rm":return Et(ix(r));case"push":return Ht(sx(r));case"branch":return Ht(cx(r));case"stash":return Ht(px(r));case"worktree":return Ht(gx(r));case"rebase":return Et(ux(r));case"merge":return Et(dx(r));case"tag":return Ht(mx(r));case"reflog":return Ht(fx(r));default:return null}}function Et(e){return e?{...e,localDiscard:!0}:null}function Ht(e){return e?{...e,localDiscard:!1}:null}function ZE(e,t){let{index:n,before:r}=oe(e),o=me(r,{shortOptsWithValue:wa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return v("git.checkout-force",RE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",_E)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",wE);return v("git.checkout-double-dash",EE)}let i=QE(e);if(i.length>=2)return v("git.checkout-ambiguous",AE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(XE(s)||t(s))return v("git.checkout-double-dash",xE);return null}function XE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function JE(e){let{before:t}=oe(e);if(t.some((r)=>O(r,"--discard-changes")))return v("git.switch-discard-changes",PE);let n=me(t,{shortOptsWithValue:_a});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return v("git.switch-force",TE);return null}function QE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(KE.has(r)){n+=2;continue}if(qE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function ex(e){let t=tx(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",kE):v("git.restore-unstaged",IE)}function tx(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(YE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function nx(e){let t=null;for(let n of e){if(O(n,"--hard")){t=v("git.reset-hard",OE);break}if(O(n,"--merge")){t=v("git.reset-merge",ME);break}}if(!t)return null;return rx(e)?Ht(t):Et(t)}function rx(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function ox(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return v("git.clean-force",DE);return null}function ix(e){let t=!1,n=!1,r=!1;for(let o of oe(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",NE):null}function sx(e){let{before:t,after:n}=oe(e),r=me(t);if(t.some((s)=>O(s,"--mirror")))return v("git.push-mirror",GE);if(t.some((s)=>O(s,"--force"))||r.has("-f")||gm(t,n).some(ax))return v("git.push-force",LE);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||gm(t,n).some(lx))return v("git.push-delete",WE);return null}function gm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function ax(e){return e.startsWith("+")||e.includes(":+")}function lx(e){return e.length>1&&e.startsWith(":")}function cx(e){let{before:t}=oe(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return v("git.branch-force-delete",FE);return null}function ux(e){let{before:t}=oe(e);return t.some((n)=>O(n,"--abort"))?v("git.rebase-abort",zE):null}function dx(e){let{before:t}=oe(e);return t.some((n)=>O(n,"--abort"))?v("git.merge-abort",BE):null}function mx(e){let{before:t}=oe(e);return me(t).has("-d")||t.some((r)=>O(r,"--delete"))?v("git.tag-delete",$E):null}function fx(e){return e[0]==="delete"?v("git.reflog-delete",UE):null}function px(e){for(let t of e){if(t==="drop")return v("git.stash-drop",HE);if(t==="clear")return v("git.stash-clear",jE)}return null}function gx(e){let{before:t}=oe(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",VE);return null}import{dirname as Lx,isAbsolute as Wx,join as km,resolve as Gx}from"path";var Pa="TMPDIR",Ta="IFS",bm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Cm=/^[A-Za-z_][A-Za-z0-9_]*$/,Sm=new Set(["export","typeset","declare","readonly"]),hx=new Set(["builtin","command","time"]),yx=new Set(["do","then","else"]),bx=new Set(["do","then","case"]),ym=new Set(["done","fi","esac"]),Cx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function vm(e,t){return e.map((n)=>n.provenance==="variable"&&Pm(n.text)?Em(n.text,t.shellAssignments):w(n))}function Em(e,t){return e.replace(Cx,(n,r,o)=>t.get(r??o??"")??n)}function qe(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=Em(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function xm(e,t){return{env:e,effectiveEnvAssignments:xx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Rm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=_m(e,t),r=e[0]??"";if(bx.has(r))t.bodyDepth+=1;if(r==="elif"||ym.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(ym.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&Sm.has(e[o]??""))e.filter((a)=>Cm.test(a)&&Aa(a)).forEach((a)=>{Rx(t,a)});let i=o===-1?-1:Am(e,o);if(i===-1||e[i]!=="unset")return;let s=_x(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}wx(t,a)})}function wm(e,t){let n=_m(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function _m(e,t){let n=yx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Pm(a)),o=r!==-1&&Sm.has(e[Am(e,r)]??""),i=Ex(t);return{assignments:e.flatMap((a,l)=>{let c=Sx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Ro(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Am(e,t){let n=t;while(hx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Pm(e){return Te(e)!==null||bm.test(e)}function Sx(e,t,n){return Te(e)??vx(e,t,n)}function vx(e,t,n){let r=wo(e,n,t);if(r)return r;let o=e.match(bm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function Ex(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function xx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Rx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function wx(e,t){if(!Aa(t)&&!Cm.test(t))return;if(e.shellAssignments.set(t,""),Ro(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||Un(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function _x(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as Ax}from"path";function qo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function xn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(Ax(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Tm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Tm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Tm(e,t,n){try{let r=yt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Im(e,t,n){if(!t.localDiscard||!n.worktreeMode||qo(n.environment.env,n.envAssignments))return null;let r=xn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=we(e),i=r?.toLowerCase();if(t.dynamicArguments||Px(o)||Mx(e,t.environment.env,t.envAssignments,n)||kx(o)||Tx(i,o))return!0;return i==="clean"&&Ox(o)>1}function Px(e){return e.some((t)=>/[$*?[]/.test(t))}function Tx(e,t){if(e==="checkout"){let{before:n}=oe(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=oe(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||Ix(s))||r.has("-C");return o&&i}return!1}function Ix(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function kx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Ox(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Mx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Ko(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>Nx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Dx(s.value);if(sd(n))return!0;return r.recursiveSubmodules}function Dx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Nx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Om(e,t,n){let r=e.map((l)=>qe(l,n.shellAssignments??new Map)??w(l)),o=n.environment.paths,i=xn(r,n.cwd,o),s=n.originalCwd?o.realpath(Gx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||qo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?zx(e,n.shellAssignments,o):Mm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Fx(a,r,t,n)||!bn(a,n.environment)||Go(a,n.environment)||Cn(s,a)||Cn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Fx(e,t,n,r){let o=r.environment.paths,i=km(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function zx(e,t,n){let r=we(e.map(w)).rest,{before:o,after:i}=oe(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&qe(l,t??new Map))??a;if(!Wx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Mm(e,t){if(t.entryKind(km(e,".git"))!=="missing")return e;let n=Lx(e);return n===e?null:Mm(n,t)}var $x="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Ux=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Yo(e,t){return Dm(e,t)}function Dm(e,t,n){let r=e.map(w),o=fm(r,t.environment.env,t.envAssignments),i=o.blockedReason?_(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((id(t.envAssignments)||pm(r,t.environment.env,t.envAssignments))&&Hx(s))return v("git.ssh-env",$x);let a=hm(s,(c)=>{let u=xn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Bx(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Im(r,a,t)??Om(e,a,t);if(!l)return a;return n?.(l),null}function Nm(e,t){let n=null;return{match:Dm(e,t,(o)=>{n=o}),relaxation:n}}function Hx(e){let{subcommand:t,rest:n}=we(e),r=t?.toLowerCase();if(!r)return!1;if(Ux.has(r))return!0;if(r==="archive")return oe(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&jx(n)}function jx(e){return e.find((t)=>!Vx(t))?.toLowerCase()==="update"}function Vx(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as ER}from"path";function Lm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Zo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Wm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Kx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Yx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Zx="rm -rf in home directory is dangerous. Change to a project directory first.",Gm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Yx},git_metadata_target:{id:"rm.git-metadata",reason:Ge},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:qx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Zx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Wm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Kx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Wm}};function Xo(e,t){let n=vt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=jo(r),i=Jx(e);for(let s of i){let a=pr(s.word);if(o&&a.unsafeBraceExpansion){let l=_(fr({kind:"outside_anchored_cwd"},n,t.policy,Gm),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=Se(l),u={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Ft(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",Ge);if(!o)continue;for(let m of Xx(c,n,u)){let d=fr(m,n,t.policy,Gm),f=_(d,t.policy);if(f)return f}}}return null}function Xx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Jx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var xt={kind:"none"},jt={kind:"dynamic"},Qx=new Set(["<","<<","<<-","<<<","<&","<>"]),zm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,eR=/^(?:[0-9]+|[@*])$/,tR=ht.maxWords,Bm=ht.maxInputLength;function $m(e){if(!e||A(k(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function Il(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function zn(e={}){return{reason:Fn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var ag={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Ai(e,t={}){return{...ag[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Tl(e){return sg({...e,redact:ft})}function kl(e){return ft(e instanceof Error?e.message:String(e))}import{types as lg}from"util";var cg=new Set(["applypatch","patch"]),ug=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),dg=new Set(["grep","grepsearch","rg"]),mg=new Set(["find","findbyname","glob"]),fg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),pg=new Set(["command","diff","input","patch","patchtext"]),Ol=new TextEncoder,gg=new TextDecoder,hg=/\s/,yg=64;class Je extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Bn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Wl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Gr(e){return fg.has(Wl(e))}function ki(e){let t=Wl(e);if(cg.has(t))return"patch";if(dg.has(t))return"grep";if(mg.has(t))return"glob";if(ug.has(t))return"path";return"unknown"}function Un(e){if(!e||typeof e!=="object")return;Hl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Gl(e,t){return Fl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Fl(e,t,n,r,o){let i=Ul(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Fl(l,t,i.array?n:t.has(zl(a)),r,o+1));return r.ancestors.delete(i.object),s}function zl(e){return e.replace(/-/g,"_").toLowerCase()}function Bl(e){return $l(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Cg)}function $l(e,t,n,r){let o=Ul(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>$l(a,o.array?t:pg.has(zl(s)),n,r+1));return n.ancestors.delete(o.object),i}function bg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Bn.maxDepth||t.nodes>Bn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Bn.maxStringBytes||t.stringBytes>Bn.maxAggregateStringBytes)Ke()}function Ul(e,t,n){if(bg(e,t,n),!e||typeof e!=="object")return null;let r=Hl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Bn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Hl(e){if(lg.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Je}function Cg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Sg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Pi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Pi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ti(Wr(c.slice(4),!0),Wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Pi(c))}return t}function Sg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Pi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ll(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ll(n[1]);if(e.startsWith("diff --git "))return vg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Nl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Nl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Pg(i[1]);return[]}function vg(e){let t=Eg(e);if(t.length===2&&t[0]&&t[1])return Ti(t[0],t[1]);let n=xg(e);return n?Ti(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Eg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(kt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!kt(e[n]))n++;t.push(e.slice(i,n));continue}let o=jl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(kt(e[n]))n++;return n===e.length?t:[]}function xg(e){let t=0;while(t<e.length&&kt(e[t]))t++;let n=e.length;while(n>t&&kt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!kt(e[o])){o++;continue}let i=o;while(o<n&&kt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>yg)Ke();if(Rg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Rg(e,t,n,r,o){if(Ii(e,t,n,r,o))return!0;let i=Ml(e,"/",t,n),s=Ml(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ii(e,t,i,r,s))return!1;return Ii(e,i+1,n,s+1,o)}function Ii(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Ml(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function kt(e){return e!==void 0&&hg.test(e)}function jl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:gg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Ol.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Ol.encode(_g(s[0]??""))),o+=2}return null}function _g(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function wg(e){return $n(Ig(e))}function Ti(e,t){if(e==="/dev/null")return Dl(t);if(t==="/dev/null")return Dl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap($n);let n=Ag(e,t)??(e===t?Vl(e):null);return[e,t,...n?[n]:[]].flatMap($n)}function Dl(e){let t=Vl(e);return[e,...t?[t]:[]].flatMap($n)}function Vl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Ag(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Nl(e){return wg(Wr(e,!0))}function Pg(e){return $n(Wr(e,!1))}function Wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=jl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Ig(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function $n(e){return e===""||e==="/dev/null"?[]:[e]}function Ll(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Wi,relative as Gg,resolve as Ql,sep as Fg}from"path";import{basename as Yl,dirname as Tg,isAbsolute as kg,join as Og,normalize as Mg,resolve as Kl}from"path";var Dg=256,Fr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ni(e,t){return Oi(e,0,t)}function Oi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Mi(e,o+2),a=Ng(e,o,t);if(a===null){if(Fr.has(s))throw new W("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Lg(l,t,n),o=a+1;continue}let i=Mi(e,o+1);if(!i){r+="$",o++;continue}r+=Di(i,n)??`$${i}`,o+=i.length+1}return r}function Ng(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new W("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Lg(e,t,n){let r=e.slice(2,-1),o=Mi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Di(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Fr.has(o))throw new W("pathEnvironmentExpansion");return e}if(!Fr.has(o))return e;if(s.endsWith("="))throw new W("pathEnvironmentExpansion");let a=Di(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new W("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Oi(i.slice(s.length),t+1,n);return l?Oi(i.slice(s.length),t+1,n):""}function Mi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Di(e,t){if(!Fr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function D(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Zl(n,i);let s=t.realpath(i);if(s!==null)return ql(n,e,s,o);let a=Tg(i);if(a===i||o.length>=Dg)return ql(n,e,i,o);o.push(Yl(i)),i=a}}function ql(e,t,n,r){let o=r.length===0?n:Og(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Wg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Zl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Zl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Jl(e,t,n);if(!o)return"";return D(o,n.paths,r).replace(/\\/g,"/")}function Xl(e,t,n,r,o){let i=Jl(e,t,n);if(!i)return null;if(o(Yl(i)))return D(i,n.paths,r).replace(/\\/g,"/");let s=Wg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Jl(e,t,n){let r=n.home,o=Ni(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Kl(r,o.slice(2)):o,s=ve(i);return Mg(kg(s)?s:Kl(t,s))}function ec(e,t,n){if(Qe(e))return;let r=t.flatMap((i)=>Li(i,n));if(!r[0])return;let o=Li(Wi(e)?e:Ql(r[0],e),n)[0];if(!o)return;return r.some((i)=>zg(o,i))?o:void 0}function tc(e,t,n){if(Qe(e))return;return Li(Wi(e)?e:Ql(t,e),n)[0]}function Li(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function zg(e,t){let n=Gg(t,e);return n===""||n!==".."&&!n.startsWith(`..${Fg}`)&&!Wi(n)}function Gi(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as ph,realpathSync as gh,statSync as hh}from"fs";import{homedir as yh,tmpdir as bh}from"os";import{statSync as dh}from"fs";import{join as mh}from"path";import{spawnSync as Bg}from"child_process";import{existsSync as jn,lstatSync as $g,readFileSync as Vn,realpathSync as on,statSync as Hn}from"fs";import{dirname as Fi,isAbsolute as zi,join as sn,resolve as zr}from"path";var Ug=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Hg=5000;function rc(e,t=ah(),n=Hg){let r=jg(e),o=r===null?null:Vg(r);if(r===null||o===null)return null;let i=ih(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function jg(e){try{let t=on(zr(e));return Hn(t).isDirectory()?t:null}catch{return null}}function Vg(e){let t=oh(e);if(!t)return null;try{let n=$g(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Bi(t);if(!r?.commonDir)return null;if(!Yg(r.gitDir,t))return null;return Zg(r.gitDir,Fi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Bi(e){try{let t=Kg(e);if(!t)return null;let n=on(zi(t)?t:zr(Fi(e),t));if(!Hn(n).isDirectory())return null;return{gitDir:n,commonDir:qg(n)}}catch{return null}}function Kg(e){let t=Vn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function qg(e){try{let t=Vn(sn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=on(zi(t)?t:zr(e,t));return Hn(n).isDirectory()?n:null}catch{return null}}function Yg(e,t){let n=Xg(e);return n===null?!1:oc(e,n,t)}function Zg(e,t){let n=Jg(e);return n===null?!0:oc(e,n,t)}function Xg(e){let t=sn(e,"gitdir");if(!jn(t))return null;let n=Vn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Jg(e){let t=sn(e,"config.worktree");return jn(t)?eh(t):null}function oc(e,t,n){try{return Qg(zi(t)?t:zr(e,t),n)}catch{return!1}}function Qg(e,t){try{let n=Hn(e),r=Hn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return nc(on.native(e))===nc(on.native(t))}function nc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function eh(e){let t=Vn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=th(s[1]??"")}return r}function th(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return rh(t.slice(1,-1))}var nh={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function rh(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:nh[n]??t)}function oh(e){try{return $i(on(e))}catch{return null}}function $i(e){let t=e;while(!0){let n=sn(t,".git");if(jn(n))return n;let r=Fi(t);if(r===t)return null;t=r}}function ih(e,t,n,r){if(sh(t))return!0;if(n===null)return!0;let o=Bg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:lh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ic(o.stdout.trim())}function sh(e){return[sn(e.commonDir,"config"),sn(e.gitDir,"config.worktree")].filter((t)=>jn(t)).some((t)=>ch(t))}function ah(){return Ug.find((e)=>jn(e))??null}function Kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function lh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Kn(t)))}function ch(e){let t;try{t=Vn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(uh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ic(c)}return r}function uh(e){return e==="include"||e.startsWith("includeif ")}function ic(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function sc(e,t){if(e==="")return null;let n=Pe(),r=$i(le(e,e,t,n)),o=r?fh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function fh(e,t,n,r){try{let o=le(e,t,n,r),i=dh(e),s=i.isFile()?o:null,a=i.isFile()?Bi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[an(le(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[an(e.replace(/\\/g,"/")),...l]:l)];return{entry:an(o),markerFile:s?an(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=an(mh(u,"hooks").replace(/\\/g,"/"));return[m,an(le(m,t,n,r))]}))]}}catch{return null}}function an(e){return process.platform==="win32"?e.toLowerCase():e}var Ch={realpath:(e)=>{try{return gh(e)}catch{return null}},entryKind:(e)=>{let t=ph(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return hh(e).isDirectory()}catch{return!1}}};function lc(){return Sh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ve(process.env.HOME||yh()),tmpdir:bh(),paths:Ch})}function Sh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>ac(n,i,()=>sc(i,o)),worktreeFacts:(i)=>ac(r,i,()=>rc(i)),...t};return o}function ac(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var ln=["fail_closed","paranoid_rm","paranoid_interpreters"],Br={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Z={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},$r=["standard","strict","paranoid"];function cc(e,t){if(!t)return e;return $r.indexOf(t)>$r.indexOf(e)?t:e}function uc(e){let t=Ur(Z.level,e);return $r.find((n)=>n===t)}function dc(e,t){return cc(e,uc(t))}function vh(e){let t=Ur(Z.level,e);if(!t)return;let n=uc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${Z.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${$r.join(", ")}.`);return}function Eh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function mc(e){return Eh(Ur(Z.auditScope,e))==="all"}function Hi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ji(e={},t){let n=e.safety?.level??"standard",r=vh(t),o=cc(n,r),i=Br[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Z.level.name}=${r}`),l.paranoidRm.push(`env ${Z.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Z.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(et(Z.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Z.strict.name}`);if(et(Z.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Z.paranoid.name}`),l.paranoidInterpreters.push(`env ${Z.paranoid.name}`);if(et(Z.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Z.paranoidRm.name}`);if(et(Z.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Z.paranoidInterpreters.name}`);let c=!!e.worktreeMode||et(Z.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Hi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function et(e,t){let n=typeof e==="string"?Ui(e,t):Ur(e,t);return n==="1"||n?.toLowerCase()==="true"}function Ui(e,t){return t.get(e)}function Ur(e,t){let n=Ui(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Ui(e.legacyName,t);return}import{dirname as Jr}from"path";import{closeSync as xh,constants as fc,fstatSync as Rh,fsyncSync as EI,lstatSync as qi,mkdirSync as xI,openSync as _h,readdirSync as RI,readFileSync as wh,realpathSync as Yi,renameSync as _I,rmdirSync as wI,statSync as Ah,unlinkSync as AI,writeFileSync as PI}from"fs";import{isAbsolute as pc,join as Zi,normalize as Ph,parse as Ki,relative as Xi,resolve as Ji,sep as Qi}from"path";function Vi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Ih=Symbol("PolicyFilesystemScope"),Th=Symbol("PolicyFilesystemTarget"),kh=fc.O_NOFOLLOW??0;class ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Ot(e,t){return{[Ih]:!0,root:Ji(e),label:t}}function gc(e,t){let n=Ph(t);if(t===""||pc(t)||n===".."||n.startsWith(`..${Qi}`))throw new ce(e.label);return{[Th]:!0,scope:e,relativePath:n,path:Zi(e.root,n)}}function qn(e,t){return gc(e,Xi(e.root,Ji(t)))}function hc(e,t="rules policy"){let n=Ji(e),r=Ki(n).dir;return gc(Ot(r,t),Xi(r,n))}function jr(e){return bc(e.scope.label,()=>{if(!Hr(e))return null;let t=_h(e.path,fc.O_RDONLY|kh);return Oh(t,()=>{let n=Rh(t);if(!n.isFile())throw new ce(e.scope.label);let r=wh(t,"utf-8"),o=qi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ce(e.scope.label);return Hr(e),r})})}function yc(e,t){if(e.path===t.path)return!0;return bc(e.scope.label,()=>{if(!Hr(e)||!Hr(t))return!1;let n=(r)=>Zi(Yi(Ki(r).dir),Ki(r).base);return n(e.path)===n(t.path)})}function bc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ce)throw r;throw new ce(e)}}function Oh(e,t){try{return t()}finally{xh(e)}}function Hr(e,t="file"){let n=Mh(e.scope);if(!n)return!1;let r=e.relativePath.split(Qi);for(let o of r.keys()){let i=Zi(e.scope.root,...r.slice(0,o+1)),s=qi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ce(e.scope.label);Dh(n,Yi(i),e.scope.label)}return!0}function Mh(e){if(!qi(e.root,{throwIfNoEntry:!1}))return null;if(!Ah(e.root).isDirectory())throw new ce(e.label);return Yi(e.root)}function Dh(e,t,n){let r=Xi(e,t);if(r===".."||r.startsWith(`..${Qi}`)||pc(r))throw new ce(n)}import{dirname as Dt,isAbsolute as Fh,join as Nt,relative as zh,resolve as pt,sep as Bh}from"path";var Mt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Cc="rulebook.json",Sc=".cc-safety-net/rules";var vc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Nh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Lh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Wh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),OI=new RegExp(`^${Lh}/(${Mt.source.slice(1,-1)})/${Wh}$`);function Gh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Ec(e){if(Vr(e))try{return es(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Mt.test(e)?null:`Local rulebook sources must be bare names matching ${Mt}: ${e}`}function es(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(vc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Nh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Mt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Gh(o),name:o}}function Vr(e){return vc.test(e)}var xc="rule.json",Kr="policy.json",Rc=".cc-safety-net",$h="rules",Uh="CC_SAFETY_NET_HOME",_c="`cc-safety-net rule update`";function Hh(e){return pt(e,Sc)}function jh(e){return Nt(Hh(e),xc)}function cn(e){return Nt(pt(e),Rc,Kr)}function ts(e,t={}){return t.userConfigDir??(t.userConfigPath?Dt(t.userConfigPath):Nt(Vh(e),$h))}function Vh(e){let t=e.env.get(Uh);return t?pt(ve(t)):Nt(e.home,Rc)}function Kh(e,t={}){return Nt(ts(e,t),xc)}function Lt(e,t={}){return Nt(Dt(ts(e,t)),Kr)}function wc(e,t){let n=Pe();return D(cn(t.cwd),e.paths,n)===D(pt(Lt(e,t)),e.paths,n)}function Ac(e,t){let n=t.userConfigPath??Kh(e,t),r=t.projectConfigPath??jh(t.cwd),o=qh(e,t),i=Yh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:qn(o,n),projectConfigTarget:qn(i,r)}}function qh(e,t){let n=t.userConfigPath?Dt(Dt(pt(t.userConfigPath))):Dt(pt(t.userConfigDir??ts(e,t)));return Ot(n,"user policy")}function Yh(e,t){let n=pt(t),r=pt(e),o=zh(n,r);if(o!==".."&&!o.startsWith(`..${Bh}`)&&!Fh(o))return Ot(n,"project policy");return Ot(Dt(Dt(r)),"project policy")}function Pc(e,t){return Nt(e,t,Cc)}var Ee=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),gt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ht=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Ic=new Set(["python","python3","python2","node","ruby","perl"]),qr=/^python(?:[23](?:\.\d+)*)?$/,Ie=new Set(["awk","gawk","nawk","mawk"]),Yr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Tc="Rulebook exceeds CC Safety Net's safe validation limits.",kc="Additional rulebook validation errors were omitted.",Me=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Oc(e){if(ns(e.allowed_commands,Me.maxAllowedCommands)||ns(e.rules,Me.maxRules)||ns(e.tests,Me.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Me,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Me.maxStringCodeUnits||i&&o.length>Me.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Me.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ns(e,t){return Array.isArray(e)&&e.length>t}var rs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var os=64,is="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return A(e).toLowerCase()}function A(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Zh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ss=new Set(["--init-file","--rcfile"]);function as(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Zh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function xe(e){let t=A(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ss.has(l)&&!s.includes("="))i++;continue}let a=as(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Yn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Zr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Xh(e))Yn(n,t);return t.inSingle||t.inDouble}function Xh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Yn(s,n)}return t}var ls=new Set(["rm","find","xargs","parallel"]),Jh=new Set(["git","busybox",...ls,...Y,...Ic,...Ie]),Qh=new Set(["python","node","ruby","perl"]);function Mc(e){let t=O(e);return Jh.has(t)||De(t)}function De(e){return Qh.has(ey(e))}function ey(e){let t=A(e).toLowerCase();return qr.test(t)?"python":t}function cs(e){try{let t=jr(ty(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=oy(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function ty(e){return typeof e==="string"?hc(e):e}var R=(e,t)=>({path:e,message:t,kind:"typed"}),re=(e,t)=>({path:e,message:t,kind:"custom"});function Dc(e){let t=new Set;return e.flatMap((n,r)=>{let o=un(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[re(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var us=`must be one of ${rs.join(", ")}`,ny=/^[^/]+\/[^/]+$/,ry=["version","rules","overrides","transparent_wrappers"];function oy(e){let t=iy(e);return{errors:ds(py(t,ry,(n)=>n.kind==="custom"),": "," "),sources:fy(e,t)}}function iy(e){if(!un(e))return[R([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>os;return[...e.version===1?[]:[R(["version"],"must be 1")],...sy(e.rules,t),...cy(e.overrides),...dy(e.transparent_wrappers),...t?[]:ly(e.rules),...un(e.overrides)?Object.keys(e.overrides).filter((n)=>!ny.test(n)).map((n)=>re(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...my(e.transparent_wrappers)]}function sy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[R(["rules"],"must be an array of rulebook source strings"),...Nc(e,os)?[R(["rules"],is)]:[]];if(t)return[{path:["rules"],message:is,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[R(["rules",r],"must be a rulebook source string"),...ay(n,1)?[R(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[R(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Nc(e,t){let n=Lc(e);return n!==void 0&&!(n<=t)}function ay(e,t){let n=Lc(e);return n!==void 0&&!(n>=t)}function Lc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ly(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[re(["rules",r],"must be a non-empty rulebook source string")];let o=Ec(n);if(o)return[re(["rules",r],o)];if(t.has(n))return[re(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function cy(e){if(e===void 0)return[];if(!un(e))return[R(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!un(n))return[R(["overrides",t],'must be "off" or an object')];return[...uy(n.reason,["overrides",t,"reason"]),...n.intent===void 0||fs(n.intent)?[]:[R(["overrides",t,"intent"],us)]]})}function uy(e,t){if(typeof e!=="string")return[R(t,"required non-empty string"),...Nc(e,ht)?[R(t,`must be at most ${ht} characters`)]:[]];if(e==="")return[R(t,"required non-empty string")];return e.length>ht?[R(t,`must be at most ${ht} characters`)]:[]}function dy(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[R(["transparent_wrappers",n],"must be a command string")];return gt.test(t)?[]:[R(["transparent_wrappers",n],"must match command pattern")]})}function my(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!gt.test(n))return[];if(t.has(n))return[re(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Mc(n))return[re(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function fy(e,t){let n=un(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function py(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ds(e,t,n){return[...new Set(e.map((r)=>{let o=ms(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ms(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function fs(e){return rs.includes(e)}function un(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Gc(e){let t=yy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var gy=`required non-empty string up to ${ht} characters`,Wc="must be a non-empty array of unique non-empty strings",hy="required non-empty array of non-empty strings";function yy(e){if(!yt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Oc(e))return{errors:[Tc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ds(by(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Me.maxValidationErrors?[...t.slice(0,Me.maxValidationErrors),kc]:t,ruleNames:new Set(Fc(e).map((n)=>n.toLowerCase()))}}function Fc(e){let t=yt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=yt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function by(e,t){return[...typeof e.name==="string"&&Mt.test(e.name)?[]:[R(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[R(["version"],"required non-empty string")],...Cy(e.allowed_commands),...Sy(e.rules,t),...Ry(e.tests),..._y(e),...wy(e)]}function Cy(e){if(!Array.isArray(e))return[R(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&gt.test(n)?[]:[R(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!gt.test(n))return[];if(t.has(n))return[re(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Sy(e,t){if(!Array.isArray(e))return[R(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!yt(n))return[R(["rules",r],"must be an object")];return t?Ey(n,["rules",r]):vy(n,["rules",r])}),...Dc(e)]}function vy(e,t){return[...zc(e.name,t),...Bc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&gt.test(e.subcommand)?[]:[R([...t,"subcommand"],"must match command pattern")],...Xr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...$c(e.reason,t),...Uc(e.intent,t)]}function Ey(e,t){return[...zc(e.name,t),...Bc(e.command,t),...$c(e.reason,t),...Uc(e.intent,t),...xy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[R([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[R([...t,"block_args"],"not supported in rulebook_version 2")]]}function zc(e,t){if(typeof e!=="string")return[R([...t,"name"],"required string")];return Mt.test(e)?[]:[R([...t,"name"],"must match rule name pattern")]}function Bc(e,t){return typeof e==="string"&&gt.test(e)?[]:[R([...t,"command"],"required string matching command pattern")]}function $c(e,t){return typeof e==="string"&&e!==""&&e.length<=ht?[]:[R([...t,"reason"],gy)]}function Uc(e,t){return e===void 0||fs(e)?[]:[R([...t,"intent"],us)]}function xy(e,t){if(!yt(e))return[R(t,"required object")];return[...Xr(e.command_path,[...t,"command_path"],hy,!1),...e.any_args===void 0?[]:Xr(e.any_args,[...t,"any_args"],Wc,!0),...e.exclude_args===void 0?[]:Xr(e.exclude_args,[...t,"exclude_args"],Wc,!0)]}function Xr(e,t,n,r){if(!Array.isArray(e))return[R(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[R([...t,s],"must be a non-empty string")];return i===""?[re([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[re(t,n)]:[],...r&&new Set(e).size!==e.length?[re(t,"must not contain duplicate values")]:[]]}function Ry(e){if(e===void 0)return[];if(!Array.isArray(e))return[R(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!yt(t))return[R(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[R(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[R(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[R(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[re(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function _y(e){if(!Array.isArray(e.tests))return[];let t=new Set(Fc(e));return[...new Set(e.tests.flatMap((n)=>yt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>re(["tests"],`blocked fixture references unknown rule "${n}"`))}function wy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=yt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[re(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function yt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Yc(e,t){let n=Ac(e,t),r;try{r=yc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ce)return Ny(n,f.message);throw f}let o=cs(n.userConfigTarget),i=r?{config:null,errors:[]}:cs(n.projectConfigTarget),s=Kc(n.userConfigPath,o.errors),a=Kc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Hc(o.config,Jr(n.userConfigPath),"user",n.userScope,l):qc(),u=i.config?Hc(i.config,Jr(n.projectConfigPath),"project",n.projectScope,l):qc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...jc(c.rules,m),...jc(u.rules,d)],transparent_wrappers:My(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Vc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Dy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Vc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Hc(e,t,n,r=Ot(Jr(Jr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Py(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Ay(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Ay(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Py(e,t,n){let r=Iy(e),o=Pc(t,r),i=ky(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Ty(e)}`]};let s=Oy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Iy(e){return Vr(e)?es(e).name:e}function Ty(e){return Vr(e)?`run ${_c} to vendor ${e}`:"create that file or remove that source from the rules config"}function ky(e,t){try{return{content:jr(qn(t,e))}}catch(n){if(n instanceof ce)return{error:n.message};throw n}}function Oy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Gc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function My(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function jc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Vc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Dy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Kc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Ny(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function qc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Ky,readFileSync as qy}from"fs";var Zc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ps=new Set(Zc.map((e)=>e.id)),Qr=Zc,Ly=new Map(Qr.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:Ly.get(e)??"manual_only"}}var gs=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],eo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Wy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Gy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],hs=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Gy.flatMap((e)=>Wy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var to=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Xc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ys=Xc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),bs=Xc.flatMap((e)=>Fy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Cs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ss=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],zy=[...gs,eo,...hs,...ys,...bs,Zn,...Cs,...Ss,...to].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),no=new Set(to.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),vs=new Set(zy.map((e)=>e.id));import{isAbsolute as Es,join as By,normalize as $y,sep as ro}from"path";var oo=process.platform==="win32",Jc=/[*?]/;function xs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(oo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Jc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Xn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Rs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Xn(e.trim(),t);if(!Es(n))return"must be an absolute path or start with ~/";return Jn(n,t)}function _s(e,t){let n=Qc(e,t);if(n===null)return"must be a non-empty path string";if(!Es(n))return null;if(Jn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hy="cannot cover the guard's own configuration";function Qc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=oo?n.replaceAll("\\","/"):n;return Xn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ws(e,t){let n=Qc(e,t);if(n===null)return"must be a non-empty path string";let r=xs(n)?.root??n;if(Jc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Es(r))return null;if(Jn(r,t)!==null)return Uy;return jy(r,t)?Hy:null}function jy(e,t){let n=io(e),r=io(By(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${ro}`)}function Jn(e,t){let n=io(e),r=io(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(ro)?n:`${n}${ro}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function io(e){let t=$y(e);if(oo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(oo?3:1)&&t.endsWith(ro))t=t.slice(0,-1);return t}var eu=30,so=1,ao=365;function tu(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var nu=new Set(Qr.filter((e)=>e.catastrophic).map((e)=>e.id));function w(e,t){if(!e)return null;if(nu.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ee(e,t,n){if(nu.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function ru(e,t){return Object.freeze(Object.fromEntries(Qr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function ou(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:ru(e,t)})}var iu={standard:0,strict:1,paranoid:2};function lu(e,t,n=!1,r=e.safety.level){let o=Vy(e,t,r),i=new Set(n?o.map((u)=>u.field):[]),s=(u,m)=>i.has(u)?void 0:m,a=(u,m)=>Object.fromEntries(Object.entries(m??{}).filter(([d])=>!i.has(`${u}.${d}`))),l=(u,m)=>m?.filter((d)=>!i.has(`${u}.${d}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:As(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:As(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:As(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((u)=>u.message)}}function As(e,t){return[...new Set([...e,...t??[]])]}function Vy(e,t,n){let r=t.safety?.level,o=Br[n];return[...r&&iu[r]<iu[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...ln.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...su("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...su("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!no.has(i))),...e.destructive_command_protection.enabled?au(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?au(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function su(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function au(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Ts=new Set(["standard","strict","paranoid"]),mu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:eu}};function fu(e,t){let n=ob(Lt(e,t),e.home),r=wc(e,t)?{exists:!1,policy:Qn(),errors:[]}:co(cn(t.cwd),e.home),o=Zy(r.parsed,e.home),i=et(Z.projectTightenOnly,e.env),s=n.gui??mu,a=Object.keys(o.policy).length>0?lu(s,o.policy,i,dc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),u=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?Is(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:u,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var Yy="project policy audit settings are ignored; audit is user scope only";function Zy(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={...Ts.has(n.level)?{level:n.level}:{},...Re(n.overrides)?cu({overrides:pu(n.overrides,ln,["safety","overrides"],Wt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:lo(o.overrides,ps,hu,Wt)}:{},...o.allow_paths!==void 0?{allow_paths:mn(o.allow_paths,Rs,t,["destructive_command_protection","allow_paths"],Wt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:lo(i.overrides,vs,yu,Wt)}:{},...i.deny_paths!==void 0?{deny_paths:mn(i.deny_paths,_s,t,["secret_protection","deny_paths"],Wt)}:{},...i.allow_paths!==void 0?{allow_paths:mn(i.allow_paths,ws,t,["secret_protection","allow_paths"],Wt)}:{}};return{policy:cu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Yy]}}function pu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(R([...n,o],ks));return[]}))}function cu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Wt=()=>{return},ks="must be a boolean",Os="must be an object if provided",gu=`must be an integer between ${so} and ${ao}`,hu={path:["destructive_command_protection","overrides"],label:"destructive command"},yu={path:["secret_protection","overrides"],label:"secret protection"},Xy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Jy(e,t){let n=[];return{policy:bu(e,t,(o)=>{n.push(o)}),issues:n}}function Qy(e,t){return bu(e,t,Wt)}function bu(e,t,n){if(!Re(e))return n(R([],"Config must be an object")),Qn();if(e.version!==1)n(R(["version"],"must be 1"));let r=dn(e.safety,["safety"],["level","overrides"],n),o=dn(r.overrides,["safety","overrides"],ln,n),i=dn(e.workflow,["workflow"],["worktree_mode"],n),s=dn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=dn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=dn(e.audit,["audit"],["retention_days"],n);return Cu(e,Xy,[],n),{version:1,safety:{level:eb(r.level,n),overrides:pu(o,ln,["safety","overrides"],n)},workflow:{worktree_mode:Ps(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ps(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:lo(s.overrides,ps,hu,n),allow_paths:mn(s.allow_paths,Rs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ps(a.enabled,["secret_protection","enabled"],!0,n),overrides:lo(a.overrides,vs,yu,n),deny_paths:mn(a.deny_paths,_s,t,["secret_protection","deny_paths"],n),allow_paths:mn(a.allow_paths,ws,t,["secret_protection","allow_paths"],n)},audit:{retention_days:tb(l.retention_days,n)}}}function dn(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(R(t,Os)),{};return Cu(e,n,t,r),e}function Cu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function eb(e,t){if(e===void 0)return"standard";if(Ts.has(e))return e;return t(R(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ps(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(R(t,ks));return n}function tb(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=so&&e<=ao))t(R(["audit","retention_days"],gu));return tu(e)}function lo(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(R(n.path,Os)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(R([...n.path,o],'must be "on" or "off"')),[]}))}function mn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(R(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?re([...r,s],a):R([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qn(){return structuredClone(mu)}function co(e,t){if(!Ky(e))return{exists:!1,policy:Qn(),errors:[]};try{let n=qy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qn(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Jy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${rb(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qn(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var nb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Os,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ks,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[gu,`not an integer between ${so} and ${ao}`]]);function rb(e){let t=ms(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=nb.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function ob(e,t){let n=co(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:du(),errors:[]};let o=Qy(r,t);return{policy:Is(o),gui:o,errors:[],levelPresent:uu(r)}}if(n.parsed===void 0)return{policy:du(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Is(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:uu(n.parsed)}}function uu(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return Ts.has(t.level)}function Su(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...no].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function du(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Su({}),denyPaths:[],allowPaths:[]}}}function Is(e){return{safety:ib(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Su(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function ib(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function vu(e,t){let n=Yc(e,t),r=fu(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...cb(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return ub(o,sb(n,r),s,r.policyScopes)}function sb(e,t){let n=lb(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:db(e.errors.length>0?ab(e.errors):void 0,e.warnings.length>0?Ds(e.warnings.join("; ")):void 0,n)}}function ab(e){return`${Ds(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function lb(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function cb(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function ub(e,t,n=Object.freeze({}),r){let o=Ms(structuredClone(e)),i=r?{policyScopes:Ms(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ms(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ms(t);return Object.freeze(e)}function db(...e){return Ds(e.filter((t)=>!!t).join("; "))}function Ds(e){return/[.!?]$/.test(e)?e:`${e}.`}function Eu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ns(t.fail_closed,e.strict,"strict"),paranoid_rm:Ns(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ns(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:ou(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Hi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ns(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as E_,isAbsolute as x_,join as R_,parse as __,resolve as w_,sep as A_}from"path";function er(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var mb=/^[A-Za-z_][A-Za-z0-9_]*=/;function uo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function tr(e){let t=uo(e.words[0],"time")?1:0,n=t===1&&uo(e.words[t],"-p")?t+1:t,r=t===1&&uo(e.words[n],"--")?n+1:n,o=uo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!mb.test(s.text));return i?.provenance==="literal"?i.text:void 0}var bt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function mo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function fb(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function fo(e,t,n){e.push(n),t.reset()}function po(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ls(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function fn(e,t,n,r,o,i,s){return Ls({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return fb(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ws(e,t,n){if(t>=n||Ru(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Ru(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=xu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=xu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Gs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=pb(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?gb(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function xu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Ru(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function pb(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function gb(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Iu=new Set(["&&","||","|","|&"]),hb=new Set(["!","do","elif","else","if","then","until","while"]);function Tu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=yo(e,0,e.length,t,r,0),i=_b(e,r.quotedExpansionEnd,o.nodes)?[...o.issues,Mu]:o.issues;return fe({kind:"program",dialect:"posix",source:e,span:n,status:Co(i,o.limited),issues:i,nodes:o.nodes})}function yo(e,t,n,r,o,i,s){let a=[],l=[],c=mo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);fo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),Pu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(rr(f)){if(f===`
+`||f==="\r"){m();let I=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!Iu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,I),span:Object.freeze({start:d,end:I})}));if(u.length>0){let k=Gs(e,I,n,u.splice(0));l.push(...k.issues),d=k.next;continue}d=I;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let g=c.start===-1?Ub(e,d,n):void 0;if(g){if(zs(a,l),i>=r.maxDepth)return pn(a,l,d,"depth-limit",r.maxDepth);if(!Fs(o))return pn(a,l,d,"word-limit",r.maxWords);let I=yo(e,g.braceIndex+1,n,r,o,i+1,"}"),T=I.next,k={start:g.braceIndex+1,end:I.closed?T-1:T},F=_u(e,k,I);if(a.push({kind:"function",name:g.name,span:{start:d,end:T},body:F}),l.push(...I.issues),I.pendingHeredocs.length>0||or(I.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...I.pendingHeredocs),I.limited)return ho(a,l,I.next);if(!I.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let p=bo(e,d);if(p){if(m(),!zu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Tb(e,d,n))&&c.start===-1){if(zs(a,l),i>=r.maxDepth)return pn(a,l,d,"depth-limit",r.maxDepth);let I=f==="("?")":"}",T=yo(e,d+1,n,r,o,i+1,I),k=T.next,F={start:d+1,end:T.closed?k-1:k},ue=_u(e,F,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:k},body:ue}),l.push(...T.issues),T.pendingHeredocs.length>0||or(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return ho(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=k;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Sb(e,d):null;if(h){let I=c.words.at(-1),T=I&&I.span.end===d&&/^[0-9]+$/.test(I.raw)?Number(I.raw):void 0;if(T!==void 0)c.words.pop();let k=T===void 0?d:I?.span.start??d;c.start=c.start===-1?d:c.start;let F=d+h.length;while(F<n&&/[ \t]/.test(e[F]??""))F++;let ue=e[F],Xe=F>d+h.length&&ue==="#",Ce=!ue||rr(ue)||!!bo(e,F)||ue===s||ue===")"||Xe||(ue==="<"||ue===">")&&e[F+1]!=="(",It=h==="<<"||h==="<<-",U=It?Ws(e,F,n):void 0,L=U?{word:fn(e,F,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!Ce?Bs(e,F,n,r,o,i):void 0;if(L){if(l.push(...L.issues),L.limited)return ho(a,l,L.next);if(!Fs(o))return pn(a,l,L.next,"word-limit",r.maxWords)}let ae=L?.next??d+h.length,J={kind:"redirection",operator:h,span:{start:k,end:ae},...T===void 0?{}:{fd:T},...L?{target:L.word}:{}};if(c.redirections.push(J),It&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(Se)=>{if(J.heredoc=Se,Se.quotedDelimiter)return;let mt=bb(e,Se.bodySpan.start,Se.bodySpan.end,r,o,i+1);Q.push(...mt.programs),l.push(...mt.issues)}})}if(!It&&!L)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(L)c.nested.push(...L.nested);c.end=ae,d=ae;continue}let y=c.start===-1;if(y)zs(a,l);let C=Bs(e,d,n,r,o,i);if(l.push(...C.issues),C.limited)return ho(a,l,C.next);let b=Mb(c.words)?Gb(e,C.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(b?.limitCode)return pn(a,l,C.next,b.limitCode,b.limitCode==="word-limit"?r.maxWords:b.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=b?.words??[C.word];for(let I of E){if(!Fs(o))return pn(a,l,C.next,"word-limit",r.maxWords);c.words.push(I)}if(c.start=c.start===-1?d:c.start,c.end=C.next,c.nested.push(...C.nested),y&&Bu(C.word))m();d=C.next>d?C.next:d+1}return m(),Pu(a,l),l.push(...Hb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function _u(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Co(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Bs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||rr(f)||(f===";"||f==="|"||f==="&")&&bo(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(f==='"'){l=!0;let y=yb(e,a,n,r,o,i);if(s+=y.text,u.push(...y.nested),m.push(...y.issues),d||=y.limited,c=nr(c,y.provenance),a=y.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let y=Ab(e,a+2,n);if(s+=y.text,m.push(...y.issues),!y.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(f==="\\"){let y=e[a+1];if(!y){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
+`){a+=2;continue}s+=y,a+=2;continue}if(Ft(e,a))m.push(Gt);let p=f==="$"||f==="<"||f===">"||f==="`"?ir(e,a,n,r,o,i):null,h=p?Us(p,u,m):Du(e,a,n,r,o,i,u,m);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(d||=h.limited,c=nr(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let y=Lu(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(f==="*"||f==="?"||f==="[")c=nr(c,"glob");s+=f,a++}return{word:fn(e,t,a,s,c,l,c==="literal"?void 0:Ib(e,t,a)),nested:u,issues:m,next:a,limited:d}}function yb(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(Ft(e,m))c.push(Gt);let f=ir(e,m,n,r,o,i),g=f?Us(f,l,c):Du(e,m,n,r,o,i,l,c);if(g){if(g.provenance!=="command-substitution")s+=e.slice(m,g.next);if(m=g.next,u||=g.limited,a=nr(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=Lu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ir(e,t,n,r,o,i){let s=Ou(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",u=l==="`",m=e[t]==="<"||e[t]===">",d=Hs(e,t+a,n,l),f=d===-1?n:d,g=d===-1?n:d+l.length;if(i>=r.maxDepth)return{program:$b(e,t+a,f,"depth-limit"),next:g,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],I=[],T=!1,k=t+a;while(k<f){let F=ir(e,k,f,r,o,i+1);if(!F){if(Ft(e,k))I.push(Gt);k++;continue}if(E.push(...F.program.nodes),I.push(...F.program.issues),T||=F.program.status==="limited",k=F.next,T)break}if(d===-1)I.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Co(I,T),issues:I,nodes:E}),next:g,provenance:"arithmetic"}}let p=yo(e,t+a,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(u||m)&&or(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],C=u&&/\\[\\$`\n]/.test(e.slice(t+a,f))?[wb]:[],b=[...p.issues,...h,...y,...C];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Co(b,p.limited),issues:b,nodes:p.nodes}),next:g,provenance:"command-substitution"}}function bb(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let u=c==="$"||c==="`"?ir(e,l,n,r,o,i):null;if(!u){if(Ft(e,l))a.push(Gt);l++;continue}if(s.push(u.program),vb(e,l,u.next)&&Eb(u.program))a.push(Gt);l=u.next}return{programs:s,issues:a}}function Us(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Hs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let m=l==="\r"&&e[a+1]===`
+`?a+2:a+1,d=Gs(e,m,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=ku(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let m=Cb(e,a+3,n);if(m===-1)return-1;a=m+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let m=e[a+2]==="-",d=a+(m?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let f=Ws(e,d,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:m,attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let u=i.pop();if(u){o=u;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function Cb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ku(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ku(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!jb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function bo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Sb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function rr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var Gt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Ft(e,t){if(e[t]!=="$")return!1;let n=wu(e,t+1);if(e[n]!=="{")return!1;let r=e[wu(e,n+1)]??"";return r==="|"||rr(r)}function vb(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Ft(e,r))return!0;return!1}function Eb(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===Gt.code)}function wu(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
+`,n))n+=e[n+1]==="\r"?3:2;return n}function Ou(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var xb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Mu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),Rb=/\$\(|`|[<>]\(/g;function _b(e,t,n){let r=$s(n);return[...e.slice(t).matchAll(Rb)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function $s(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>$s(n.nodes))];return t.kind==="group"||t.kind==="function"?$s(t.body.nodes):[]})}var wb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Du(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=So(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(xb);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(Mu);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let u=l.substitutions.some((m)=>{if(Ft(e,m))return a.push(Gt),!1;let d=ir(e,m,c,r,o,i);return d!==null&&Us(d,s,a).limited});return{provenance:"variable",next:c,limited:u}}function So(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Ft(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
+`,a+=l==="\\"?2:1;continue}let c=Ou(e,a);if(c){r.push(a);let u=Hs(e,a+c.length,n,c.closing);if(u===-1)break;a=u+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function Nu(e,t,n){if(e[t+1]==="{"){let o=So(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Ab(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Pb(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Pb(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return go(e,t+1,n,16,2,t+1);if(r==="u")return go(e,t+1,n,16,4,t+1);if(r==="U")return go(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return go(e,t,n,8,3,t+1);return{text:r,next:t+1}}function go(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Co(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"))return"invalid";return e.length>0?"partial":"complete"}function Lu(e,t,n,r,o){let i=Nu(e,t,n);return{text:r+e.slice(t,i),provenance:nr(o,"variable"),next:i}}function Ib(e,t,n){let r=po(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=Hs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Nu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function nr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Tb(e,t,n){return t+1>=n||rr(e[t+1]??"")||bo(e,t+1)!==null}var kb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Db(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Db(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Nb(e,t);if(n==="env")return Lb(e,t);if(n==="sudo")return Wb(e,t);return}function Nb(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Lb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(kb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Wb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ob.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Wu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Gu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Fu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Gb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Gu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Fu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>fn(e,t.span.start,t.span.end,a,"literal",!1))}}function Gu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Au(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Au(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Fb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Au(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Bb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:zb(e,r)}}function Fb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function zb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Bb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Fu(e,t){let n=`x${e}`,r=Bs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function $b(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function pn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ho(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Fs(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function Ub(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function or(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>or(n.nodes));return(t.kind==="group"||t.kind==="function")&&or(t.body.nodes)})}function Hb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function zu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Pu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Iu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Bu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&hb.has(e.text)}function zs(e,t){let n=e.at(-1);if(!zu(n))return;if(n?.kind==="command"&&Bu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function jb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Uu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Vb=new Set(["gc","cat","type","cp","mv","rm"]),Hu=["-rec","-for","-path","-literalpath","-whatif"],Kb=/^\$env:\w/i,qb=/^(?:\$\{?\w+\}?|~)\\./;function ju(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Uu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Hu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Yb(n))return!1;let r=qs(e,t);if(Vu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ks(r).some(Zb)}function Vu(e){return e.nodes.some((t)=>{if(t.kind==="group")return Vu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Yb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Zb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Uu.has(n))return!0;let r=e.slice(t+1);if(n&&Vb.has(n)&&r.some(Xb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Hu.some((s)=>i.startsWith(s))})}function Xb(e){return Kb.test(e)||qb.test(e)}function qs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ys(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:nC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ys(e,t,n,r,o,i=!1){let s=[],a=[],l=mo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};fo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=tC(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(js(e,d,y)),d=y;continue}d++;continue}let p=Yu(e,d);if(p){m(),s.push(js(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(qu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ys(e,d+1,n,r,o+1,!0),C=y.closed?y.next-1:y.next,b=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,C),span:{start:d+1,end:C},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:b})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(js(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,C=y;while(/[ \t]/.test(e[C]??""))C++;let b=C<n?$u(e,C,n,r,o):void 0,E=b?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:E}),...b?{target:b.word}:{}})),b)a.push(...b.issues),l.nested.push(...b.nested),c+=b.words,u||=b.limited;l.end=E,d=E;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ls({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=$u(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function $u(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=Jb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=Vs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Yu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:fn(e,t,f,i,s,a,s==="literal"?void 0:Qb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function Jb(e,t,n,r,o){let i=Ku(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[qu(r.maxDepth)],nodes:[]}),next:a};let l=Ys(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Ku(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Vs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Vs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Vs(r)}}return t}function Qb(e,t,n){let r=po(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Ku(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=eC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function eC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function qu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ks(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ks(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ks)]})}function Yu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function tC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function nC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function js(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=bt){if(t==="powershell"||t==="auto"&&ju(e.slice(0,n.maxInputLength),n))return qs(e,n);return Tu(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function gn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function vo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Zs(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function sr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function _e(e,t){sr(e,t)}function zt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Xs(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>X(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!zt(S(e,t-1))&&V(e,t,n)&&!zt(S(e,t+n.length))}function nt(e,t){return zt(S(e,t-1))!==zt(S(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function hn(e){return e==="|"||e===";"}function Eo(e,t,n){let r=Zs(e,n);if(t==="rm")return rC(r);if(t==="dd")return iC(r);return td(r,!0)}function xo(e,t,n){let r=Zs(e,n);if(t==="rm")return sC(r);if(t==="reset-hard")return Qu(r,"--ha","rd");if(t==="reset-merge")return Qu(r,"--me","rge");if(t==="clean")return uC(r);if(t==="checkout")return mC(r);if(t==="push-force")return fC(r);if(t==="push-refspec")return pC(r);if(t==="push-delete")return gC(r);if(t==="branch")return hC(r);if(t==="tag")return CC(r);if(t==="restore")return SC(r);return td(r,!1)}function rC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(tt(e,i,"rm")&&j(l)&&l!==`
+`)t=!0,i++;continue}let a=oC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=Zu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Zu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function oC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function Zu(e,t,n){if(Xu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Xu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Xu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function iC(e){let t=!1;for(let n=0;n<X(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!j(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function sC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=S(e,o);if(o===X(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=lC(e,o);if(s>=0){if(aC(e,s))return!0;let a=s,l=!1;while(j(S(e,a)))l||=S(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(S(e,o-1)))&&(!S(e,o+2)||j(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&nt(e,o+11)||Js(e,o,"recursive"),r||=V(e,o,"--force")&&nt(e,o+7)||Js(e,o,"force"),n&&r)return!0;o++}return!1}function Js(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||j(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function aC(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(j(S(e,n)))n++;let i=n;while(n<X(e)&&!j(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Ju(e,i,"recursive"),a=Ju(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=cC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Ju(e,t,n){return V(e,t,`--${n}`)&&nt(e,t+n.length+2)||Js(e,t,n)}function lC(e,t){if(t>0&&zt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!j(S(e,n+1)))return-1;return n+1}function cC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&nt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Qu(e,t,n){return lr(e,"reset",hn,!0,(r)=>S(e,r)==="-"&&yn(e,r,t,n)?!0:r)}function uC(e){return lr(e,"clean",hn,!0,(t)=>{if(S(e,t)!=="-")return t;if(yn(e,t,"--fo","rce"))return!0;let n=ar(e,t,hn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Ro(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!j(S(e,r)))return{commandEnd:-1,next:r};while(j(S(e,r)))r++;while(r<X(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=ar(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=dC(e,r,o);r=o;while(j(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:ar(e,r,oe)};if(!s)continue;if(r>=X(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=ar(e,r,oe);while(j(S(e,r)))r++}return{commandEnd:-1,next:r}}function dC(e,t,n){for(let r of Ee)if(n-t===r.length&&V(e,t,r))return!0;return!1}function mC(e){return ed(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function fC(e){return lr(e,"push",hn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!zt(S(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=nd(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function pC(e){return lr(e,"push",oe,!1,(t)=>{if(j(S(e,t))&&S(e,t+1)==="+"&&t+2<X(e)&&!oe(S(e,t+2))&&!j(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function gC(e){return lr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&yn(e,t,"--de","lete"))return!0;if(j(S(e,t))&&S(e,t+1)===":"&&t+2<X(e)&&!j(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function hC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Ro(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=ar(e,o,oe),s=yC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function yC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(yn(e,i,"--de","lete"))r=!0;if(yn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&bC(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function bC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function CC(e){return ed(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function ed(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Ro(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(yn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(hn(o))i.outerActive=!1}return!1}function lr(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Ro(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function SC(e){let t=!1;for(let n=0;n<X(e);n++){if(Xs(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Ro(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function td(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=S(e,r),i=t?Xs(o):oe(o);if(n&&j(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function ar(e,t,n){let r=t;while(r<X(e)&&!j(S(e,r))&&!n(S(e,r)))r++;return r}function nd(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function yn(e,t,n,r){return nd(e,t,n,r)>=0}function Te(e,t){sr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)_e(t,a);if((s.regex?.test(a)??!1)||s.scan&&xo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var vC=/^[A-Za-z_][A-Za-z0-9_]*=/;function od(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;sr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return id(t.nodes,r,i)}function id(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return id(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return EC(r,t,n)})}function EC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!vC.test(o.text));return e.words.every((o,i)=>o===t||rd(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||rd(o.target.raw,n.anchored,!0)))}function rd(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as xC,resolve as sd}from"path";function cr(e,t,n,r){let o=xC(e)?sd(e):t?sd(t,e):void 0;if(!o)return;try{return D(o,n,r)}catch{return o}}function ad(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var bn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ur="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ea=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),RC=new Set(["-p","--print"]),_C=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),wC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),AC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),PC=new Map([["python",new Set(["m"])]]),IC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),TC=new Set(["always","default","never"]),kC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),OC=/\\\r?\n/g,MC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function ld(e){return wo(e).code}function _o(e){return wo(e).sources}function cd(e){return MC.get(na(e))??[]}function wo(e){let t=na(e[0]??"");if(!ea.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&RC.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(NC(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(LC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=DC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(IC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&kC.has(s))||t==="python"&&!TC.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(PC.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Le(t,n,r,o)}if(_C.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(wC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(AC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function DC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ta(e,t){return na(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function na(e){let t=A(e).toLowerCase();return qr.test(t)?"python":t}function NC(e,t){return ea.get(e)?.has(t)??!1}function LC(e){return ea.get(e)?.has("--eval")??!1}function dr(e,t,n=!1){let r=FC(e,t);if(!Qs(r,t))return!1;_e(t,r);let o=GC(r);if(Qs(o,t))return!0;if(_e(t,o),!ud.test(o))return!1;return!n||WC(r,t)}function WC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>ud.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:ra(i,c)}});if(s.some((l)=>oa(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&Qs(l.text,t)})}function ra(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function oa(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var ud=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function GC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Qs(e,t){if(Eo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(_e(t,e),r.test(e))return!0;if(Eo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(_e(t,e),r.test(e))return!0;if(Eo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(_e(t,e),n.some((o)=>xo(o,r))))}function FC(e,t){return _e(t,e),e.replace(OC,"")}import{lstatSync as LS,readdirSync as WS}from"fs";import{basename as GS,isAbsolute as Ld,join as FS,relative as Wd}from"path";import{isAbsolute as yd,parse as YC}from"path";import{dirname as zC,isAbsolute as BC,parse as $C,sep as UC}from"path";function Ct(e,t,n){if(Qe(t))throw Error("Unsupported Windows namespace path");let r=BC(t)?$C(t).root:"",o=r||e;for(let i of jC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=zC(o);continue}let s=HC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function HC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${UC}${t}`}function jC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var ia=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],VC=new Set(ia),KC=1024,dd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),md=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),qC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ao(e){return VC.has(e)}function sa(e){return Ao(e)||dd.has(e)||md.has(e)||Kn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function fd(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=KC?{state:"valid",count:r}:{state:"invalid"}}function Po(e,t,n){let o=e.match(qC)?.[1];if(!o||!sa(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function pd(e){return hd(e,md)}function gd(e){return hd(e,dd)}function hd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Cd=/^[A-Za-z_][A-Za-z0-9_]*=/;function ke(e){if(!Cd.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Io(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=ke(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Sd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Bt(e,t,n,r){if(!Sd(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<K.wrapperPeelIterations.cap;m++){let d=bd(i),f=Io(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!XC(i)){let p=JC(Cn(i),a,t.env)??Po(Cn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(Cn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=eS(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=rS(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=oS(i);if(g==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(bd(i)===d)break}let u=Io(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:ZC(u.words,o)}}function ZC(e,t){return e.some((n)=>!t.has(n))}function bd(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function XC(e){return Cd.test(Cn(e))}function JC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var QC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function eS(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?mr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=mr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=mr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(QC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var tS=new Set(["-i","-0","--null"]),nS=new Set(["-u","--unset","-C","--chdir","-P"]);function rS(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(tS.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(nS.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?mr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=mr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!ke(c))break;while(a<e.length){let m=ke(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function mr(e,t,n){if(t==="")return null;if(!e&&!yd(t))return null;let r=yd(t)?YC(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ct(r,t,n)}catch{return null}}function oS(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var iS=/['"\\$`{}#]/;function To(e,t){if(e.some((r)=>iS.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function St(e,t,n){return ko(e,t,n).tokens}function sS(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function vt(e,t,n,r=0){let o=ko(e,t,n),i=(o.envSplitValues??[]).flatMap(sS);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return vt(s,t,n,r+1)}function ko(e,t,n,r){if(!Sd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Bt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ua=Symbol("adopt-as-operand"),aS=new Set(["env","sudo","command","builtin"]),lS=new Set(["&&","||","|&","|","&",";"]),cS=new Set(["<<","<<<",">|"]),uS=new Set(["|","|&"]),dS=/[*@#?$!_-]/,mS=/^\w+(?::\w+)*/,fS=Object.freeze([]),fr=Object.freeze({kind:"scope",edge:"enter"}),pr=Object.freeze({kind:"scope",edge:"exit"}),pS=Object.freeze([]),gS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),gr=new Set(["bash","sh","zsh","dash","ksh"]),hS=256,_d=new WeakMap;function wd(e,t){let n=t.status==="complete"?new Set(ca(t)):new Set,r=CS(e,n);if(Zr(r))return Oo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=$t(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Oo("structural-limit",r,t);if(o.invalid)return Oo("invalid",r,t);let s=Oo("complete",r,t,o.assignmentFallbacks);return _d.set(s,Object.freeze(i)),s}function Do(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Ad(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=yS(a,s,n,r),c=a.length>0&&uS.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ua){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function No(e){return Ad(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function hr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function yS(e,t,n,r){let o=hr(e)?new Map([...t.variables,...bS(e,t.variables)]):t.variables,i=St([...e],n),s=A(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function bS(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function Ad(e){return _d.get(e)??fS}function CS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Oo(e,t,n,r=pS){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function $t(e,t){return e.nodes.flatMap((n,r)=>SS(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function SS(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(_S(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Mo("{"),...$t(e.body,a),...s?[Mo("}")]:[]]:[fr,Ge("("),...$t(e.body,a),...s?[Ge(")")]:[],pr]}]}let o=IS(e,r.functions);if(o){if(r.depth>=bt.maxDepth||++r.flags.expansions>hS)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...vd(e,r),Mo(";"),...$t(o,{...r,depth:r.depth+1}),Mo(";")]},...Ed(e,t,n,r)]}return[{start:e.span.start,events:vd(e,r)},...Ed(e,t,n,r)]}function vd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Id(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:vS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function vS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Id(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[da(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:wS(r),targetOrder:cS.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:kd(t)}:{}}),...s===void 0?o:o.slice(1)]}function Ed(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[da(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Pd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?ES(t,n,r):[]]}function ES(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Pd(n.source.slice(r.span.end,e.span.end),n)}]}function Pd(e,t){if(t.depth>=bt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=$t(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Id(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?da(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of aa(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ge(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=aa(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?$t(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(fr,...g,pr);continue}let m=u?$t(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(fr,...m,pr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),fr,...m,...c.raw.endsWith(")")?[Ge(")")]:[],pr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Ge("(")),...d===1?[fr]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Ge(")")):[],...d===1?[pr]:[])}return l(),o}function aa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=xd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=xd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function xd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?RS(e,t+2):So(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return xS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&dS.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?mS:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function xS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=aa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function RS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function _S(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:lS.has(e)})}function Mo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function da(e){return Object.freeze({kind:"word",text:e})}function wS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function yr(e){return gS.has(e)||/^python\d/.test(e)}var AS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Td(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=AS.get(e)?.has(n)??!1;return Td(e,t.slice(r?2:1))}function la(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return la(e.slice(1));if(!aS.has(t))return[...e];return la(Td(t,e.slice(1)))}function kd(e){let t=tr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return la(n<0?[]:e.words.slice(n).map((r)=>r.text))}function PS(e){let t=kd(e)[0];if(t===void 0)return!1;let n=A(t).toLowerCase();return yr(n)&&!gr.has(n)}function ca(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ca(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ca(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(PS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!kS(t))return r;return[...r,...o]})}function IS(e,t){let n=tr(e);return n===void 0?void 0:t.get(n)}function Et(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function TS(e){if(Et(e.words[0],"git"))return Et(e.words[1],"commit");if(!Et(e.words[0],"gh")||!Et(e.words[2],"create"))return!1;return Et(e.words[1],"pr")||Et(e.words[1],"issue")}function kS(e){return(Et(e.words[0],"cat")||Et(e.words[0],"tee")||TS(e))&&!e.words.some(Rd)&&!e.redirections.some((n)=>Rd(n.target))}function Rd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Od=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Md=new Set([...Od,"glob"]),OS=new Set([...Md,"folder","pattern","patterns"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Dd(e){let t=MS(),n=Un(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:DS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return Ni(e,t)}function MS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=wd(i,a);return e.set(i,c),c},getCommandProgram:r}}function DS(e){let t=e.route.kind==="grep"?Md:e.route.kind==="glob"?OS:Od;return[...Gl(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Bl(e.input):[]]}var NS=new Set(["-S","--suffix"]);function Sn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Do(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Lo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&NS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ze="Git metadata and hooks are protected. Ask the user before modifying them.";function Gd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Gr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Nd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=Sn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>jS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Nd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ut(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Go(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ma(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Wo(m,l):zS(m,l);if(n.markerFiles.some(u))return!0;return r&&fa(n).some(u)}if(ma(a,n))return!0;return r&&fa(n).some((c)=>Wo(c,a))}function zS(e,t){let n=Wd(t,e);if(n===""||n.startsWith("..")||Ld(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function BS(e,t,n,r,o){return Ut(e,t,n,!0,r,o)}function $S(e,t,n,r,o){if(!n)return!1;return ma(Go(le(e,t,r,o)),n)}function Nd(e,t,n,r,o,i){let s=Go(le(e,t,r,o));return i.includes(s)||zd(s,n)}function Fd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Wo(i,Go(le(s,t,r,o)))))}function ma(e,t){return t.entries.includes(e)||t.directories.includes(e)||zd(e,t)}function zd(e,t){return t.hooksDirectories.some((n)=>Wo(e,n))}var US=50000;function Bd(e,t){let n=[...new Set(fa(e))];if(n.some((o)=>t(GS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=HS(o);if(!i)return!0;if(r+=i.length,r>US)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>FS(o,s.name)))}return!1}function HS(e){try{let t=LS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return WS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function fa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Wo(e,t){let n=Wd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Ld(n)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}function jS(e,t,n,r,o){if(hr(e))return null;let i=vt([...e],r);if(A(i[0]??"").toLowerCase()!=="mv")return null;let s=Lo(i.slice(1)),a=s.sources.find((l)=>BS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&$S(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as $o,normalize as QS,parse as ev,posix as Yd,resolve as jt,sep as ya}from"path";import{isAbsolute as VS,join as $d,normalize as jd,parse as KS,sep as Ud}from"path";var qS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],YS=` 	
+`;function br(e,t){if(Ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!pa(e.get("TMPDIR")??"",t)}function vn(e,t){if(e.has("TMPDIR"))return pa(e.get("TMPDIR")??"",t);let n=ga(e,t);if(n===void 0)return!0;return pa(n,t)}function ga(e,t){return Kd(e,t,"TMPDIR")}function pa(e,t){if(!e)return!1;if(XS(e))return!1;return En(e,t)}function Ht(e,t){let n=Kd(e,t,"IFS");return n!==void 0&&n!==""&&n!==YS}function En(e,t){let n=Fo(e,t.paths);if(n===null)return!1;return Vd(t).some((r)=>xn(n,r))}function Bo(e,t){let n=Fo(e,t.paths);if(n===null)return!1;return Vd(t).some((r)=>zo(r)===zo(n))}var Hd=new WeakMap;function Vd(e){let t=Hd.get(e);if(t)return t;let n=ZS(e);return Hd.set(e,n),n}function ZS(e){let t=qS.map((r)=>Fo(r,e.paths)??jd(r)),n=Fo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&JS(n))return[...t,n];return t}function XS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Kd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function JS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Fo(e,t){try{let n=jd(e);if(!VS(n))return n;let r=KS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=$d(i,o[s]??"");if(t.entryKind(a)==="missing")return $d(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function xn(e,t){let n=zo(e),r=zo(t);if(n===r)return!0;let o=r.endsWith(Ud)?r:`${r}${Ud}`;return n.startsWith(o)}function zo(e){return process.platform==="win32"?e.toLowerCase():e}var tv=process.platform==="win32",qd=64,nv=16384;function Cr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ee(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ee(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Sr(e){let t=Wu(e,qd,qd,nv);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:rv(e)}}function rv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>ov(e.raw,n.span.start-e.span.start))}function ov(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function xt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Pe();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:uv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Be(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&mv(e))return{kind:"outside_anchored_cwd"};let o=!r&&Xd(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(ba(e,r))return{kind:"root_or_home_target"};if(sv(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ut(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(av(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(dv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&hv(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>yv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(bv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(iv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function iv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if($o(r)||r.startsWith("~"))return!1;if(Ca(r))return!1;if(Jd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return En(jt(t.resolvedCwd,r),t.environment)}function Zd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Be(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(cv(i))return!1;if(Bo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Jd(r??i,s,t.environment.paths,t.budget))}function ba(e,t=!1){let n=e.trim(),r=Yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function sv(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=$o(o)?o:t.resolvedCwd?jt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(D(i,t.environment.paths,t.budget));if(s===ev(s).root)return!0;return s===he(D(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=QS(e);if(tv){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function av(e,t,n,r,o,i,s,a){let l=e.trim();if(Ca(l))return!1;if(!r&&En(l,a))return!0;return(t||i&&s)&&n&&!o&&lv(l,n)}function lv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Xd(e.slice(n.length+1),t)})}function cv(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Yd.normalize(`/${t[1]??""}`)==="/"}function Ca(e){return e.split(/[\\/]+/).includes("..")}function uv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Xn(o.trim(),t);if(!$o(i))return[];try{let s=D(i,n,r);if(Jn(s,D(t,n,r)))return[];return[he(s)]}catch{return[]}})}function dv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Ca(r))return!1;let o=n?r:Xn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=$o(o)?o:i?jt(i,o):null;if(!s)return!1;try{let a=he(D(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ya)?l:`${l}${ya}`))}catch{return!1}}function mv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Xd(e,t=!1){return e.includes("$")||e.includes("`")||fv(e)||t&&pv(e)}function fv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function pv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&gv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function gv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function hv(e,t,n,r){try{return he(D(e,n,r))===he(D(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function yv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(D(jt(t,e),n,r))===he(D(o,n,r))}catch{try{return he(jt(t,e))===he(o)}catch{return!1}}}function bv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ha(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ha(jt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ha(jt(a,e),t,i,s)}catch{return!1}}function ha(e,t,n,r){try{return Qd(D(e,n,r),D(t,n,r))}catch{return!1}}function Jd(e,t,n,r){if(!t)return!1;try{return Qd(D(t,n,r),D(e,n,r))}catch{return!0}}function Qd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${ya}`)||n===r}var Cv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),em="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Sv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",tm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",nm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",vv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Ev="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",xv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:nm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ze},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:tm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:vv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:em},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Sv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:em}};function rm(e,t,n){return Rv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,xt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function Rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=wv(o),s=o[i];if(!s||!Cv.has(Nv(s.text)))return null;let a=_v(o.slice(i+1));if(a.whatIfProtected)return null;if(ee(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",Ev);for(let l of a.targets)if(!Qe(l.text)&&ba(va(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",nm);for(let l of a.targets)if(n.resolvedCwd&&Ut(va(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ze);if(!a.recursive||!a.force)return null;if(ee(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",tm);for(let l of a.targets){let c=Cr(Be(va(l.text),n),n,r,xv);if(c)return c}return null}function _v(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Av(l))continue;if(s){t.push(Sa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Iv(l.text);if(!c){t.push(Sa(l)),i=i||l.dynamic;continue}if(Tv(c.name)){let u=c.value?Pv(c.value,l):e[++a];if(u?.kind==="word"){t.push(Sa(u)),i=i||u.dynamic;continue}i=!0;continue}if(kv(c.name)){n=!0;continue}if(Ov(c.name)){r=!0;continue}if(Mv(c.name))o=Dv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function wv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Sa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Av(e){return e.kind==="word"&&e.text===","}function va(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function Pv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Iv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Tv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function kv(e){return"recurse".startsWith(e)}function Ov(e){return e.length>=2&&"force".startsWith(e)}function Mv(e){return e==="wi"||"whatif".startsWith(e)}function Dv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Nv(e){return e.toLowerCase()}var Rn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Uo="Unsupported heredoc syntax",vr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",om="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Lv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Wv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Gv=new Set(["-o","--output","--query","--subscription"]),Fv=new Set;function im(e){if(e==="aws")return Lv;if(e==="gcloud")return Wv;if(e==="az")return Gv;return Fv}var zv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Bv=new Set;function sm(e){if(e==="git")return Ee;if(e==="docker")return zv;return Bv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Hv(n,o.command))continue;if(o.match){if($v(n,e,o.match))return am(o);continue}if(!jv(n,e,o.subcommand))continue;if(Kv(e,new Set(o.block_args),r))return am(o)}return null}function am(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function $v(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Uv(r,n.command_path,im(e))}function Uv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Hv(e,t){return e===O(t)}function jv(e,t,n){if(!n)return!0;return lm(t,1,n,sm(e))}function lm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Vv(e,i,n,r))return!0;continue}return s===n}return!1}function Vv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return lm(e,t+2,n,r)}function Kv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var qv=new Set(["-e","--source"]),Yv=new Set(["-F","-v","--assign","--field-separator"]),cm=new Set(["-f","--file"]),Zv=new Set(["print","printf","return"]),um=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Xv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function dm(e,t,n){let r=!1;for(let o of Jv(e)){let i=Qv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Xv):null}function xa(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&qv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Yv.has(a)||cm.has(a))){let l=e[s+1];if(i&&=l!==void 0,cm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function xr(e){return xa(e).sources}function Jv(e){return xr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Qv(e,t){_e(t,e);let n=e.includes("system")?Ra(e,t):null,r=eE(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ra(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=jo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=mm(e,i+1);continue}if(s==="/"&&fm(e,i)){i=pm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Er(e[a-1])||Er(e[i]))continue;let l=Ho(e,i);if(e[l]!=="(")continue;l=Ho(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=jo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Ho(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function eE(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=jo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=mm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&fm(e,i)){let f=pm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Ea(e,i,"print")||Ea(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Ho(e,m);if(Ea(e,d,"getline")){o=!0;let f=rE(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(iE(s,a)){o=!0;let f=nE(e,d);if(!f){r=!0,c=m,i=m;continue}if(!tE(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Er(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Ho(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function tE(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function jo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=oE(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function nE(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return jo(e,t,n)}function rE(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function oE(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Ea(e,t,n){return e.startsWith(n,t)&&!Er(e[t-1])&&!Er(e[t+n.length])}function iE(e,t){return t!==null&&t>=e}function mm(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function fm(e,t){let n=sE(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Er(e[r-1]))r--;return Zv.has(e.slice(r,n+1))}function sE(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function pm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var aE="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lE="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cE="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function gm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function hm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",aE);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",lE);if(e==="shred"&&n.length>0)return v("shred.target",cE);return null}var uE=new Set(["sudo","env","command","builtin"]),dE=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Vo(e,t){let n=e[0];if(!n||!ym(A(n),t))return null;let r=A(n),o=e[1]==="--"?2:1,i=mE(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function mE(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=A(a)!==n&&fE(a,r);if(l)i.push(s);if(!l&&Yr.has(O(a)))break;if(o)break}return i}function fE(e,t){let n=A(e),r=O(e);return r==="git"||n==="busybox"||Vt(e)||ls.has(n)||gm(r)||ym(n,t)||Y.has(r)||e==="$SHELL"||De(r)||Ie.has(r)||t.rules.some((o)=>o.command===n)}function ym(e,t){return dE.has(e)||t.transparentWrappers.includes(e)}function Vt(e){return uE.has(e.toLowerCase())}function Kt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function $e(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Ko([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Ko(e,t,n,r,o,i,s,a,l){let c=ko(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=To(c.envSplitValues,u);if(!f)throw new W("derivedCommandShape");_a(a),yield*Ko(f,t,m,r,o,i,s,a,l);return}if(Vt(u[0]??""))throw new W("wrapperPeelIterations");let d=Vo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])_a(a),yield*Ko(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(gE(u)){_a(a),yield*Ko(u.slice(1),t,m,r,o,i,s,a,l);return}yield pE(u,m,r,o,i,l)}function pE(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:A(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function _a(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new W("wrapperPeelIterations");e.iterations++}function gE(e){return A(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function wa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function st(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Aa(r,"recursive")){t=!0;continue}if(r==="-f"||Aa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function qo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Aa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Aa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var hE=["--init-file","--rcfile"],yE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ue(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function at(e){let t=A(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return xe(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Cm(e){let t=A(e[0]??"").toLowerCase(),n=bE(e,t),r=yE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function bE(e,t){let n=xe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hE.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ss.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=as(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var CE="find -delete permanently removes files. Use -print first to preview.",SE="find -exec rm -rf is dangerous. Use explicit file list instead.",vE=new Set(["-exec","-execdir","-ok","-okdir"]),EE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Sm(e,t){let n=e.map(_),r=xE(e,n,t);if(r)return r;if(Yo(n,1)&&!IE(e,n,t)){let s=w(v("find.delete",CE),t.policy);if(s)return s}let o=t.budget??Pe(),i=0;while(i<n.length){let s=n[i],a=lt(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=_n(n,i);i=l.nextIndex;let c=kE(l.tokens,t.environment);if(c){let f=w(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?.(l.tokens,u?null:t.cwd)??null,d=m?.id.startsWith("custom.")?m:w(m,t.policy);if(d)return d}return null}function xE(e,t,n){if(!Yo(t,1)&&!Pa(t,n.environment))return null;let o=Rr(e)??q(["."]),i=xt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Sr(s);for(let l of a.expandedTargets??[_(s)]){let c=Be(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!RE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",ze)}}if(PE(t)&&i.resolvedCwd&&Fd(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",ze);return null}function RE(e,t,n){if(!t)return!1;let r=e.map(_),o=[],i=!1,s=Rr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=_n(r,a),u=vt([...c.tokens],n),m=qo(u),d=Y.has(A(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(wE(c.text,l==="-iname"));a+=2;continue}if(!_E.has(l))return!1;a+=1+lt(l)}return o.length>0&&!Bd(t,(l)=>o.every((c)=>c.test(l)))}var _E=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function wE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var AE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Pa(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=_n(e,n),o=vt([...r.tokens],t),i=A(o[0]??"").toLowerCase(),s=Y.has(i)&&AE.test((Ue(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function PE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function IE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Rr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ga(o,n.environment),s=n.trustedTmpdirValue??vn(o,n.environment),a=n.allowTmpdirVar??!br(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=xt(l),u=xt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!xn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=Sr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[_(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,C=y??h,b={targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected};if(!ee(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&Be(C,c,b).kind==="within_anchored_cwd")return!0;return Zd(C,y?u:c,{...b,containmentTarget:TE(C,i)})})})}function TE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Rr(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function kE(e,t){let n=St([...e],t);if(n.length===0)return null;let r=A(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=A(n[0]??"");if(r==="rm"&&st(n))return v("find.exec-rm-recursive-force",SE);return null}function _n(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Yo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=_n(e,n).nextIndex;continue}let o=lt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function lt(e){return EE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&vE.has(e)}import{resolve as oR}from"path";function _r(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var OE=5,Ia="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Em(e,t,n){let r=Zo(e,t,n),o=ME(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<OE;a++){let{subcommand:l,rest:c}=we(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=GE(m);if(d===null||d.length===0)return{blockedReason:Ia,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:Ia,expanded:!0,tokens:i}}function xm(e,t,n){return Zo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function we(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?A(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ee.has(o)?2:1}return{subcommand:null,rest:[]}}function ME(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Zo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?A(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=NE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...DE(e,t,n)]}}function DE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ta(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ta(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=vm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=vm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ee.has(i)){o+=2;continue}o++}return r}function NE(e,t){let n=LE(e,t),r=WE(e,t);return{blockedReason:n===null||r===null?Ia:null,entries:[...n??[],...r??[]]}}function LE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=_r(n);if(!o)return null;for(let i of o){let s=Ta(i);if(!s)return null;r.push(s)}return r}function WE(e,t){let n=fd(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ta(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function vm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function GE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return _r(t)}var FE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",zE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",BE="git checkout --force discards uncommitted changes. Use 'git stash' first.",$E="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",UE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",HE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",jE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",VE="git switch --force discards uncommitted changes. Use 'git stash' first.",KE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",qE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",YE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",ZE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",XE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",JE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",QE="git push --force destroys remote history. Use --force-with-lease for safer force push.",ex="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",tx="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",nx="git branch -D force-deletes without merge check. Use -d for safe delete.",rx="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",ox="git merge --abort discards merge conflict resolutions. Use 'git status' first.",ix="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",sx="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",ax="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",lx="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",cx="git worktree remove --force can delete uncommitted changes. Remove --force flag.",ux=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),dx=new Set(["--recurse-submodules","--track","-t"]),ka=new Set(["-b","-B","-U"]),Oa=new Set(["-c","-C"]),mx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var wn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function _m(e,t){let{subcommand:n,rest:r}=we(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Rt(fx(r,t));case"switch":return Rt(gx(r));case"restore":return Rt(yx(r));case"reset":return Cx(r);case"clean":return Rt(vx(r));case"rm":return Rt(Ex(r));case"push":return qt(xx(r));case"branch":return qt(wx(r));case"stash":return qt(kx(r));case"worktree":return qt(Ox(r));case"rebase":return Rt(Ax(r));case"merge":return Rt(Px(r));case"tag":return qt(Ix(r));case"reflog":return qt(Tx(r));default:return null}}function Rt(e){return e?{...e,localDiscard:!0}:null}function qt(e){return e?{...e,localDiscard:!1}:null}function fx(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:ka});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return v("git.checkout-force",BE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",UE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",$E);return v("git.checkout-double-dash",FE)}let i=hx(e);if(i.length>=2)return v("git.checkout-ambiguous",HE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(px(s)||t(s))return v("git.checkout-double-dash",zE);return null}function px(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function gx(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return v("git.switch-discard-changes",jE);let n=me(t,{shortOptsWithValue:Oa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return v("git.switch-force",VE);return null}function hx(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(ux.has(r)){n+=2;continue}if(dx.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function yx(e){let t=bx(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",qE):v("git.restore-unstaged",KE)}function bx(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(mx.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Cx(e){let t=null;for(let n of e){if(M(n,"--hard")){t=v("git.reset-hard",YE);break}if(M(n,"--merge")){t=v("git.reset-merge",ZE);break}}if(!t)return null;return Sx(e)?qt(t):Rt(t)}function Sx(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function vx(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return v("git.clean-force",XE);return null}function Ex(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",JE):null}function xx(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return v("git.push-mirror",tx);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Rm(t,n).some(Rx))return v("git.push-force",QE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Rm(t,n).some(_x))return v("git.push-delete",ex);return null}function Rm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Rx(e){return e.startsWith("+")||e.includes(":+")}function _x(e){return e.length>1&&e.startsWith(":")}function wx(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return v("git.branch-force-delete",nx);return null}function Ax(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.rebase-abort",rx):null}function Px(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.merge-abort",ox):null}function Ix(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?v("git.tag-delete",ix):null}function Tx(e){return e[0]==="delete"?v("git.reflog-delete",sx):null}function kx(e){for(let t of e){if(t==="drop")return v("git.stash-drop",ax);if(t==="clear")return v("git.stash-clear",lx)}return null}function Ox(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",cx);return null}import{dirname as Qx,isAbsolute as eR,join as zm,resolve as tR}from"path";var Da="TMPDIR",Na="IFS",Am=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Pm=/^[A-Za-z_][A-Za-z0-9_]*$/,Im=new Set(["export","typeset","declare","readonly"]),Mx=new Set(["builtin","command","time"]),Dx=new Set(["do","then","else"]),Nx=new Set(["do","then","case"]),wm=new Set(["done","fi","esac"]),Lx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Tm(e,t){return e.map((n)=>n.provenance==="variable"&&Wm(n.text)?km(n.text,t.shellAssignments):_(n))}function km(e,t){return e.replace(Lx,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=km(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function Om(e,t){return{env:e,effectiveEnvAssignments:zx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Mm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function La(e,t){let n=Nm(e,t),r=e[0]??"";if(Nx.has(r))t.bodyDepth+=1;if(r==="elif"||wm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(wm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Wa(t,a)});let o=n.commandIndex;if(o!==-1&&Im.has(e[o]??""))e.filter((a)=>Pm.test(a)&&Ma(a)).forEach((a)=>{Bx(t,a)});let i=o===-1?-1:Lm(e,o);if(i===-1||e[i]!=="unset")return;let s=Ux(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}$x(t,a)})}function Dm(e,t){let n=Nm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Nm(e,t){let n=Dx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Wm(a)),o=r!==-1&&Im.has(e[Lm(e,r)]??""),i=Fx(t);return{assignments:e.flatMap((a,l)=>{let c=Wx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Ao(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Lm(e,t){let n=t;while(Mx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Wm(e){return ke(e)!==null||Am.test(e)}function Wx(e,t,n){return ke(e)??Gx(e,t,n)}function Gx(e,t,n){let r=Po(e,n,t);if(r)return r;let o=e.match(Am)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ma(e){return e===Da||e===Na||sa(e)}function Fx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function zx(e,t){let n=[Da,Na].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Bx(e,t){Wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function $x(e,t){if(!Ma(t)&&!Pm.test(t))return;if(e.shellAssignments.set(t,""),Ao(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ma(t)||t===Da||t===Na||Kn(t)){Wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Ux(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as Hx}from"path";function Xo(e,t){return ia.some((n)=>t?.has(n)||e.has(n))}function An(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(Hx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Gm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Gm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ee.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Gm(e,t,n){try{let r=Ct(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Fm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Xo(n.environment.env,n.envAssignments))return null;let r=An(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ga(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ga(e,t,n){let{subcommand:r,rest:o}=we(e),i=r?.toLowerCase();if(t.dynamicArguments||jx(o)||Zx(e,t.environment.env,t.envAssignments,n)||qx(o)||Vx(i,o))return!0;return i==="clean"&&Yx(o)>1}function jx(e){return e.some((t)=>/[$*?[]/.test(t))}function Vx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:ka}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Oa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||Kx(s))||r.has("-C");return o&&i}return!1}function Kx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function qx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Yx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Zx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Zo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>Jx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Xx(s.value);if(gd(n))return!0;return r.recursiveSubmodules}function Xx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Jx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Bm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??_(l)),o=n.environment.paths,i=An(r,n.cwd,o),s=n.originalCwd?o.realpath(tR(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Xo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?rR(e,n.shellAssignments,o):$m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!nR(a,r,t,n)||!En(a,n.environment)||Bo(a,n.environment)||xn(s,a)||xn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function nR(e,t,n,r){let o=r.environment.paths,i=zm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Ga(t,r,a)}function rR(e,t,n){let r=we(e.map(_)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&Ye(l,t??new Map))??a;if(!eR(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function $m(e,t){if(t.entryKind(zm(e,".git"))!=="missing")return e;let n=Qx(e);return n===e?null:$m(n,t)}var iR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",sR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Jo(e,t){return Um(e,t)}function Um(e,t,n){let r=e.map(_),o=Em(r,t.environment.env,t.envAssignments),i=o.blockedReason?w(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((pd(t.envAssignments)||xm(r,t.environment.env,t.envAssignments))&&aR(s))return v("git.ssh-env",iR);let a=_m(s,(c)=>{let u=An(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(oR(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Fm(r,a,t)??Bm(e,a,t);if(!l)return a;return n?.(l),null}function Hm(e,t){let n=null;return{match:Um(e,t,(o)=>{n=o}),relaxation:n}}function aR(e){let{subcommand:t,rest:n}=we(e),r=t?.toLowerCase();if(!r)return!1;if(sR.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&lR(n)}function lR(e){return e.find((t)=>!cR(t))?.toLowerCase()==="update"}function cR(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as FR}from"path";function jm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Qo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Vm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",uR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mR="rm -rf targeting root or home directory is extremely dangerous and always blocked.",fR="rm -rf in home directory is dangerous. Change to a project directory first.",Km={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mR},git_metadata_target:{id:"rm.git-metadata",reason:ze},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:dR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:fR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Vm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:uR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Vm}};function ei(e,t){let n=xt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=qo(r),i=gR(e);for(let s of i){let a=Sr(s.word);if(o&&a.unsafeBraceExpansion){let l=w(Cr({kind:"outside_anchored_cwd"},n,t.policy,Km),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=ve(l),u={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Ut(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",ze);if(!o)continue;for(let m of pR(c,n,u)){let d=Cr(m,n,t.policy,Km),f=w(d,t.policy);if(f)return f}}}return null}function pR(e,t,n){let r=Be(e,t,n);if(r.kind==="cwd_self_target")return[r,Be(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Be(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Be(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function gR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var _t={kind:"none"},Yt={kind:"dynamic"},hR=new Set(["<","<<","<<-","<<<","<&","<>"]),Ym=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,yR=/^(?:[0-9]+|[@*])$/,bR=bt.maxWords,Zm=bt.maxInputLength;function Xm(e){if(!e||A(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Jo(e){let t=Rn(e[1])==="--"?2:1;if(e.length<=t)return xt;let n=e.slice(t);if(!n.every(vr))return jt;return{kind:"literal",source:n.map(w).join(" ")}}function Um(e){let t=Rn(e[1])==="--"?2:1,n=e[t],r=Rn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return xt;if(!vr(n))return jt;return{kind:"literal",source:r}}function Qo(e,t){let n=Vm(e);if(n===-1)return xt;let r=rR(t);if(!r)return xt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=iR(s,e,n,r.ifs);if(!a)return jt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>tR||i>Bm)return jt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ei)].filter((s)=>s!==null).join(" ")}}function Hm(e,t){let n=Vm(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(vr)||o)return t;let i=r.map(Rn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?ei(p):"").join(" ")).join(" "),s.length>Bm)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function jm(e,t,n,r){if(!Ee(e.map(w)).readsStdinAsCommands)return xt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Qx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return xt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return jt;return{kind:"literal",source:o.target.text}}if(!n)return xt;return r===void 0?jt:{kind:"literal",source:r}}function ct(e,t=new Map){let n=Ee(e.map(w)).scriptIndex;if(n===null)return xt;let r=e[n],o=Rn(r);if(bo(r,o))return{kind:"literal",source:o};let i=r?qe(r,t):null;return i===null?jt:{kind:"literal",source:i}}var nR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Te(s)!==null)return!1;let a=A(k(s));return!nR.has(a)&&!q.has(a)&&!$t(a)}function Vm(e){return Ee(e.map(w)).commandIndex??-1}function rR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(oR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function oR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function iR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):sR(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!vr(i))return;let s=Rn(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(vr)?e.map(w):void 0}function sR(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ti(e){let t=Pn(e[1])==="--"?2:1;if(e.length<=t)return _t;let n=e.slice(t);if(!n.every(Ar))return Yt;return{kind:"literal",source:n.map(_).join(" ")}}function Jm(e){let t=Pn(e[1])==="--"?2:1,n=e[t],r=Pn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return _t;if(!Ar(n))return Yt;return{kind:"literal",source:r}}function ni(e,t){let n=tf(e);if(n===-1)return _t;let r=SR(t);if(!r)return _t;let o=[],i=r.command?.length??0;for(let s of r.references){let a=ER(s,e,n,r.ifs);if(!a)return Yt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>bR||i>Zm)return Yt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ri)].filter((s)=>s!==null).join(" ")}}function Qm(e,t){let n=tf(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Ar)||o)return t;let i=r.map(Pn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?ri(p):"").join(" ")).join(" "),s.length>Zm)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function ef(e,t,n,r){if(!xe(e.map(_)).readsStdinAsCommands)return _t;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&hR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return _t;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Yt;return{kind:"literal",source:o.target.text}}if(!n)return _t;return r===void 0?Yt:{kind:"literal",source:r}}function ct(e,t=new Map){let n=xe(e.map(_)).scriptIndex;if(n===null)return _t;let r=e[n],o=Pn(r);if(vo(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?Yt:{kind:"literal",source:i}}var CR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function $a(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||ke(s)!==null)return!1;let a=A(O(s));return!CR.has(a)&&!Y.has(a)&&!Vt(a)}function tf(e){return xe(e.map(_)).commandIndex??-1}function SR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(vR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function vR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function ER(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Fa(o):xR(o,r);if(e.parameter==="*"){let a=Fa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:za(l,r)}let i=t[n+1+e.parameter];if(i&&!Ar(i))return;let s=Pn(i);return e.quoted?[s]:za(s,r)}function Fa(e){return e.every(Ar)?e.map(_):void 0}function xR(e,t){let n=Fa(e);if(!n)return;let r=n.map((o)=>za(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function za(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Rn(e){return e?w(e):""}function ei(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(Me(e,"posix"),t)}function Er(e){return Wa(e,new Set(Array.from(e.matchAll(zm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||Km(r.words,n))return!0;dR(r,n)}return!1}function Km(e,t){let n=e.findIndex((s)=>Te(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Sr(r,t))return!0;let o=k(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Fm(e[s],t)}if(q.has(o)){let s=e.slice(n),a=Ee(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Fm(s[l],t)}let i=aR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Km(e.slice(i),t)}function aR(e,t,n){let r=k(e[t]?.text??"");if(r==="command")return lR(e,t+1);if(r==="exec")return cR(e,t+1);if(r==="env")return uR(e,t+1,n);return null}function lR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function cR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function uR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Sr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Sr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Te(i))continue;return r}return null}function dR(e,t){if(!e.words.every((n)=>Te(n.text)!==null))return;for(let n of e.words){let r=Te(n.text);if(!r)continue;if(Sr(n,t))t.add(r.name)}}function Sr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(zm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(eR.test(o)||t.has(o))}))}function Fm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Sr(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",mR="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",fR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,pR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,gR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,hR=/^(?:[0-9]+|[@*])$/;function Zm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Vt(n),i=n.slice(r),s=v("xargs.shell-dynamic",Fa);if(bR(i,o,t)&&_(s,t.policy))return _(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?_(s,t.policy):null;if(c)return c;let u=nf(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&ef(l,o),d=t.analyzeChild(l,{...Ut(a,t),dynamicInput:u,dynamicSourceInput:m||Jm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ga)});if(d)return d;let f=yR(l,o,t.policy?.rules??[],_(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,mR]:l,h=o!==null&&(l.some((C)=>C.includes(o))||Array.from(a.envAssignments.values()).some((C)=>C.includes(o))),b=t.analyzeChild(p,{...Ut(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(b)return b}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function yR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=k(e[0]??"");if(!n.some((i)=>k(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Xm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Lm(e,r,t.length,n);return o===null?[]:[o]}function Jm(e,t,n,r,o,i,s){if(q.has(t)){if(at(e))return!1;if(n!==null&&CR(e,n,s))return!0;let a=Be(e);if(!a){let l=ct(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Qm(a,n,s))return!0;if(Pe(a))return!0;return SR(a,n,r)}if(Oe(t))return qm(e,n,xo,ed(t));if(Ae.has(t))return qm(e,n,ya,tm);if(t==="eval"){let a=Jo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return vR(e,n,i);if(t==="git"){let a=we(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&tf(a.rest,n).some((l)=>l.includes(n))}return!1}function Qm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Pe(i)===null&&n(i)===null}function qm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Xm(l,t,a))));return Zo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function bR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(ze(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function ef(e,t){return tf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function tf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function nf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function CR(e,t,n){let r=Ee(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Qm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Xm(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=Ee(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function SR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(fR))if(Ym(o,r))return!0;for(let o of e.matchAll(pR))for(let i of(o[1]??"").matchAll(gR))if(Ym(i,r))return!0;return Wa(e,r)}function Ym(e,t){let n=e[1]??e[2];return n!==void 0&&(hR.test(n)||t.has(n))}function vR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Ke(s)){let l=vn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=nf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&ef(c.tokens,t)||Jm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=lt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Vt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var xr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Rr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",xR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",RR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,rf=/\{\}|\{-?\d+\}/g,of=/[\s;&|<>()$`\\"']/,wR=["e","f","source","file","-e","-f","--source","--file"],_R=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],AR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),PR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),sf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),TR=new Set(["--workdir","--wd"]),af="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function uf(e){return Ie([...e],(t)=>Pe(t))}function df(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=wn(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=xf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=wn(t);if(g)return g;let p=uf(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=LR(t);if(g)return g}if(u!==void 0&&a){let g=wn(t);if(g)return g}let d=WR(u,t.cwd,t.environment.paths);if(d===null){let g=wn(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some($a)){let p=wn(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=yf(f.envAssignments,f.cwd,a);return Ie(g,(h)=>t.analyzeNested(h,p))}return Ie(ze(i,f),(g)=>IR(g,o,t,f))}function IR(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(vf)){let E=wn(n);if(E)return E}let c=uf(l);if(c)return c;let u=l.some(W),m=o||u,d=s&&m,f=yf(e.envAssignments,e.wrapperCwd,i||d),g=m?{...f,worktreeMode:!1}:f,p=a.join(" "),h=W(p.split(/[ \t\n=]/,1)[0]??""),b=!t.quotesCommand&&(h||a.some((E)=>of.test(E))),C=h||of.test(a[0]??""),y=b&&C&&t.jobs.length>0?null:kR(e,t,n,r,g,u);if(y||!b)return y;return mf(W(p)?p:`${p} {}`,!h,e,t,n,r,g)}function kR(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,u=e.tokens,m=a||i;if(q.has(e.head)){let f=()=>{if(!a||s.length===0)return null;return Ie(s,(h)=>n.analyzeChild(ri(u,h,n.budget),Ut(e,r)))};if(at(u))return f();let g=Be(u);if(g){if(Ef(g)){let y=Rt(n);if(y)return y;if(s.length===0)return null;return Ie(s,(E)=>n.analyzeNested(Cf(g,E,n.budget),o))}if(W(g))return mf(g,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((y)=>Qo(K(y===void 0?u:a?u.map((E)=>bf(E,y)):[...u,...y]),g)):[];if(h.some((y)=>y.kind==="dynamic")){let y=Rt(n);if(y)return y}let b=h.flatMap((y)=>y.kind==="literal"?[y.source]:[]);if(b.length>0)return n.budget.charge("derivedTokens",b.length),Ie(b,(y)=>n.analyzeNested(y,o));if(Er(g)){let y=Rt(n);if(y)return y}let C=n.analyzeNested(g,o);if(C)return C;if(m)return Rt(n);return null}let p=ct(K(u));if(p.kind==="dynamic"||p.kind==="literal"&&W(p.source))return Rt(n)??f();if(p.kind==="literal")return f();if(s.length>0){let h=Rt(n);if(h)return h;let b=f();if(b)return b;if(a)return null;let C=s.flatMap((y)=>y[0]===void 0?[]:[y[0]]);return n.budget.charge("derivedTokens",C.length),Ie(C,(y)=>n.analyzeNested(y,o))}if(m||c)return Rt(n)??f();return null}if(e.head==="rm"&&st(u)){if(a&&s.length>0)return Ie(s,(g)=>za(ri(u,g,n.budget,rf),e.cwd,r));if(s.length>0)return Ie(s,(g)=>za(cf(u,g,n.budget),e.cwd,r));let f=za(u.flatMap((g,p)=>{if(p===0||!W(g))return[g];return g.startsWith("-")?[g.replace(rf,"")]:[]}),e.cwd,r);if(f)return f;return hf(n)}let d=s.length>0?s:[void 0];return Ie(d,(f)=>{let g=f===void 0?u:a?ri(u,f,n.budget):cf(u,f,n.budget),p=v("parallel.shell-dynamic",Rr),h=c&&e.head==="find"?NR(g,r):null,b=pf(g,c,n)??h?.customResult??null,C=k(e.head),y=c&&(C==="rm"&&Ba(g)||C==="xargs"&&gf(g)||h?.rmOptions===!0),E=c&&(y||h?.executedSource===!0||h===null&&ff(g,C)),T=n.analyzeChild(g,{...Ut(e,r),worktreeMode:l||c||m?!1:n.worktreeMode,dynamicInput:c||m,dynamicRmInput:y,dynamicSourceInput:b!==null||E,shellDynamicMatch:p,dynamicSourceMatch:p,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",xr)});if(E){let I=_(p,n.policy);if(I)return I}return T??b??it(g,n.policy?.rules??[])})}function mf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Ie(r.jobs,(c)=>o.analyzeNested(Cf(e,t?c.map(ei):c,o.budget),s));let a=Cr(e);if(a?.[0]&&k(a[0])==="rm"&&st(a)){let c=hf(o);if(c)return c}return(a?o.analyzeChild(a,{...Ut(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",Rr),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",xr)}):null)??o.analyzeNested(e,s)}function ff(e,t){if(W(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(q.has(t))return DR(e);if(t==="git")return OR(e);if(t==="find")return!0;if(Ae.has(t))return lf(e,wR,yr);if(Oe(t))return lf(e,_R,Eo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(W))return t===-1;return n.some((o)=>W(o)&&(o.startsWith("-")||Ef(o)))}function OR(e){if(MR(e))return!0;let t=we(e);if(t.subcommand===null||W(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(W))return n===-1;return r.some(W)}function MR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(W(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(W(n))return!0;continue}if(W(n))return!0}return!1}function DR(e){if(at(e))return!1;let t=Be(e);if(t!==null)return W(t);let n=ct(K(e));if(n.kind==="literal")return W(n.source);if(n.kind==="dynamic")return!0;return!e.some(W)}function lf(e,t,n){let r=n(e);if(r.some((o)=>W(o.value)))return!0;if(!e.some(W))return n([...e,af]).some((o)=>o.value===af);return Zo(r,t,(o)=>n(e.map((i)=>bf(i,[o]))))}function pf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>k(i.command)===k(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(W))return Rt(n);return Ie(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function NR(e,t){let n={customResult:null,executedSource:!e.some(W),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(W))return;for(let a of ze(i,t))n.executedSource||=ff(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&gf(a.tokens),n.customResult??=pf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=W(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Ke(a)){i=[],n.executedSource||=W(a);continue}let l=lt(a);if(l>0){o=l,n.executedSource||=W(a);continue}n.executedSource||=W(a)}return s(),n}function gf(e){let t=e.slice(Vt(e).childStart);return k(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>_(v(e,t),n.policy)}var Rt=ii("parallel.shell-dynamic",Rr),LR=ii("parallel.command-stream-dynamic",xR),wn=ii("parallel.command-stream-dynamic",RR),hf=ii("parallel.rm-recursive-force-dynamic",xr);function za(e,t,n){return _(Xo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:zt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:yn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function yf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function bf(e,t){return e.replace(oi,(n)=>Sf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Sf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Cf(e,t,n){return ri([e],t,n)[0]??""}function cf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Sf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function W(e){return e.search(oi)!==-1}function vf(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Ef(e){return/^\{[^{}\s]*\}$/.test(e)}function WR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!ER(e))return null;try{return yt(t??e,e,n)}catch{return null}}function xf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,u=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=Sa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=Sa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],b=p.indexOf("="),C=b===-1?p:p.slice(0,b),y=b===-1?void 0:p.slice(b+1);if(p==="--dry-run"){c=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){u||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){u=!0,t+=2;continue}if(C==="--replace"||p.startsWith("-i")&&p.length>2){let E=C==="--replace"?y:p.slice(2);u||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||PR.has(C)){u=!0,t+=y===void 0?2:1;continue}if(p==="-q"||p==="--quote"){s=!0,t++;continue}if(p==="--pipe"||p==="--pipepart"){a=!0,t++;continue}if(C==="--env"){u=!0,t+=y===void 0?2:1;continue}if(sf.has(C)||p.startsWith("-S")&&p.length>2){i=!0,t+=sf.has(p)?2:1;continue}if(TR.has(C)){u=!0;let E=y??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=y===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&y!==void 0){t++;continue}if(AR.has(p)){if(h===void 0||h===":::"||h==="--"){u=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}u||=n.some(c?$a:vf);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let b=e[h];if(b===":::"){m.push(p),p=[];continue}if(b!==void 0)p.push(b)}m.push(p)}u||=m.length>1;let d=GR(m),f=n.some(W),g=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:f,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:g,unsupported:u,workdir:l,dryRun:c}}function GR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Rf(e){return xf(e).childStart}var FR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function _f(e,t,n,r,o=!1,i){let a=(Zn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ee(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",FR):null;return _(a,i)??Af(e,t,n,o,i)}function Af(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=k(t[0]?.text??"");if(s==="git"){let a=dn(e,t),l=BR(a);if(ee(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return _(v("shell.dynamic-structure",si),o);if(_(Yo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(ee(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return _(v("shell.dynamic-structure",si),o);return null}if(s==="find")return ee(o,"shell.dynamic-structure",r)&&$R(t)?_(v("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=st(t.map(w));return ee(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?_(v("shell.dynamic-structure",si),o):null}if(s==="xargs")return wf(e,t.slice(Vt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return wf(e,t.slice(Rf(t.map(w))),"parallel",n,r,o);return null}function wf(e,t,n,r,o,i){if(t.length===0)return null;let s=zR(t,r);if(Zn(e,s)){let l=_(v(`${n}.shell-dynamic`,n==="xargs"?Fa:Rr),i);if(l)return l}let a=Af(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return _(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:xr),i);return null}function zR(e,t){let n=Wt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function BR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function $R(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=lt(s.text);if(l>0){n=l;continue}if(Ke(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!bo(t[n.tokenIndex],n.value)})}var If=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Xo(e.words,Tf(e))},{heads:new Set(["git"]),analyze:(e)=>Yo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>dm(e.words,{...Tf(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>Zm(e.words,{...Pf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>_n(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>df(e.words,{...Pf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>_n(e.options.analyzeNested(t,n))})}];function Pf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function _n(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function Tf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:zt(e.envAssignments,e.options.environment),trustedTmpdirValue:yn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function Mf(e){return If.find((t)=>t.heads.has(e))?.analyze}function Pn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((P)=>o==="posix"?w(P):P.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=_o(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Wt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let x=[...g,...i(f.words)].join(" "),P=Pe(x);if(P)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:P.reason}),de(P);if(n.strict)return ye(r);let G=Ao(g,i(f.words));if(G){n.budget.charge("derivedTokens",G.length);let te=n.analyzeNested(G.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let p=f.rewritten?K(i(f.words)):dn(o,f.words),h=i(p),b={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-p.length),output:h})}let C=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),y=h[0];if(!y)return null;if($t(y))throw new N("wrapperPeelIterations");let E=k(y),T=f.cwd===null?void 0:f.cwd??u,I=f.cwd===null?void 0:m,M=f.cwd===void 0?n.effectiveCwd:f.cwd,Y=s?s.allowTmpdirVar:!mr(C,n.environment),ue=_f(o,f.words,n.environment,t===0,n.strict,n.policy);if(ue)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ue.reason}),de(ue);let Xe=Uo(h,n.policy);if(Xe){for(let x of[Xe.childIndex,...Xe.alternativeChildIndices]){kf(b.wrapperNormalizationBudget);let P=p.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:Xe.wrapper,output:i(P)});let G=Pn(P,t,{...b,effectiveCwd:M,envAssignments:C});if(G)return G}return null}let be=l?void 0:E==="eval"?Jo(p):E==="trap"&&!a?Um(p):void 0;if(a&&s&&E==="eval"){if(be?.kind==="dynamic")return An(s,n.policy);if(be?.kind==="literal"){let x=n.analyzeNested(be.source,{effectiveCwd:M,envAssignments:C});if(x)return x}return Tn(s,n.policy)}if(be?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(be?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:be.source,depth:t+1});let x=n.analyzeNested(be.source,{effectiveCwd:M,envAssignments:C,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?q.has(E):Nf(y,E)){if(at(h))return null;if(a&&s){let x=Be(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let G=An(s,n.policy);if(G)return G}if(Er(x)){let G=An(s,n.policy);if(G)return G}return n.analyzeNested(x,{effectiveCwd:M,envAssignments:C})}let P=ct(p);if(P.kind==="dynamic")return An(s,n.policy);if(P.kind==="literal")return s.dynamicSourceInput?An(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?An(s,n.policy):null}if(l){let x=Be(h),P=x?n.analyzeNested(x,{effectiveCwd:M,envAssignments:C}):ct(p).kind==="dynamic"?ye(r):null;if(P)return P}if(s===void 0){let x=VR(h,C,M,n,r,t);if(x)return x;let P=Be(h);if(P){let Qt=Qo(p,P);if(Qt.kind==="dynamic")return ye(r);let Si=Qt.kind==="literal"?Qt.source:Hm(p,P),El=KR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:El}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:El,depth:t+1});let xl=n.analyzeNested(Si,{effectiveCwd:M,envAssignments:C});if(xl)return xl;return Er(Si)?ye(r):null}let G=ct(p,n.strict?void 0:n.shellAssignments);if(G.kind==="dynamic")return ye(r);if(G.kind==="literal")return ai(G.source,M,C,n,r,t);let te=jm(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:M,envAssignments:C})}}if(!s&&(E==="source"||E===".")){let x=h[1]==="-p"?2:null;if(x!==null){let Qt=n.commandView?p[x]:void 0;if(!Qt)return null;if(Qt.provenance!=="literal")return ye(r)}let P=x===null?1:3,G=h[P]==="--"?P+1:P,te=n.commandView?p[G]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,M,C,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(Ae.has(E)&&!l){if(!s&&n.strict&&ja(yr(h),p))return ye(r);let x=nm(h,(G)=>_n(n.analyzeNested(G,{effectiveCwd:M,envAssignments:C}))),P=_(x,n.policy);if(P)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:P.reason}),de(P)}if(Oe(E)&&!l){if(!s&&n.strict&&ja(Eo(h),p))return ye(r);let x=Qu(h);if(a&&s)return HR(E,x,M,C,n,s);if(x){let P=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:x,paranoidBlocked:P}),P){let te=_(v("interpreter.one-liner-paranoid",or),n.policy);if(te)return de(te)}if(Ys(E,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let G=n.analyzeNested(x,{effectiveCwd:M,envAssignments:C});if(G&&!Df(G,x))return G;if(ir(x,void 0,!n.strict)){let te=_(v("interpreter.dangerous-command",pn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:pn}),de(te)}r=void 0}}if(E==="busybox"&&h.length>1)return kf(b.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Pn(p.slice(1),t,{...b,effectiveCwd:M,envAssignments:C});let z=s?null:_(am(E,h),n.policy);if(z)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:z.reason}),de(z);let D=r===b.trace?b:{...b,trace:r},se={words:p,head:E,cwd:T,originalCwd:I,envAssignments:C,allowTmpdirVar:Y,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:M,options:D,analyzeChildTokens:(x,P)=>a&&s?qa(x,t,D,{...s,cwd:P??void 0,effectiveCwd:P??void 0}):_n(Pn(K(x),t+1,{...D,child:void 0,commandView:void 0,effectiveCwd:P,envAssignments:C}))??it(x,D.policy.rules),analyzeChild:(x,P)=>qa(x,t,D,P)},J=s&&(E==="xargs"||E==="parallel")?void 0:Mf(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:C.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Y});let Q=r&&E==="git"?Nm(se.words,Va(se)):void 0,Ce=Of(Q?Q.match:J?.(se)??null,n.policy);if(r)qR(se,Ce,Q?.relaxation??null);if(Ce)return de(Ce);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(st(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Tn(s,n.policy):null)??jR(s,n.policy)}let Pt=!s&&J===void 0&&!Hr.has(E),Mn=r&&Pt?[]:void 0;if(Pt)for(let x=1;x<h.length;x++){let P=h[x];if(!P)continue;Mn?.push(P);let G=Of(UR(h,x,t,D,T,I,M,C),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:Mn??[],embeddedCommandFound:k(P)}),de(G)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Mn??[]}),l&&s&&!s.wrappedByTransparent)return null;let _e=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_e,reason:_e?.reason}),_e)return de(_e);return a&&s?Tn(s,n.policy):null}function qa(e,t,n,r){return _n(Pn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function UR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=k(c);if(Nf(c,u)||Mf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=qa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!mr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function HR(e,t,n,r,o,i){if(!t)return Tn(i,o.policy);if(ee(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=_(v("interpreter.one-liner-paranoid",or),o.policy);if(a)return de(a)}if(Ys(e,t))return Tn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Df(s,t))return s;if(ir(t,void 0,!o.strict)){let a=_(v("interpreter.dangerous-command",pn),o.policy);if(a)return de(a)}return Tn(i,o.policy)}function Df(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(zo)||e.reason===Sn)&&!jr(t);return n||r}function An(e,t){let n=e.shellDynamicMatch?_(e.shellDynamicMatch,t):null;return n?de(n):null}function Tn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?_(e.dynamicSourceMatch,t):null;return n?de(n):null}function jR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?_(e.rmDynamicMatch,t):null;return n?de(n):null}function VR(e,t,n,r,o,i){let s=um(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=rr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function KR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function qR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function kf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:gr}),de(YR())}function YR(){return{id:"analysis.dynamic-shell-source",reason:gr,intent:"stop_and_explain"}}function Nf(e,t){return q.has(t)||e==="$SHELL"||e==="${SHELL}"||q.has(A(t))}function Of(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:_(e,t)}var ZR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,XR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function JR(e,t){let n=Gf(e,t);if(n.length===0)return!1;let r=n[Wf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return ZR.test(e.join(" "))}function Lf(e,t,n,r,o){if(e.dialect==="powershell"){let y=QR(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return Ka(rw(y.target),t,n.paths)}let i=e.words.map(w),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!JR(i,n))return s?null:void 0;if(!t)return null;let a=Gf(i,n,t),l=Wf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((u===-1?c:c.slice(0,u)).some((y)=>!/^-[LP]+$/.test(y)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length>1)return null;let g=f[0],p=r.get("HOME")||n.home;if(g===void 0)return Ka(p,t,n.paths);let h=e.words.find((y)=>y.provenance==="variable"&&y.text===g),b=e.words.find((y)=>y.text===g&&/^~(?:\/|$)/.test(y.raw)),C=h?qe(h,new Map([...r,["HOME",p]])):b?`${p}${g.slice(1)}`:g;if(C===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(C)&&(s||n.env.has("CDPATH")))return null;return Ka(C,t,n.paths)}function Ka(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=yt(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function QR(e,t){let n=ew(e[0])?1:0,r=e[n];if(!tw(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!XR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return nw(e.slice(n+1),t)}function ew(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function tw(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function nw(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function rw(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Wf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Gf(e,t,n){let r=ow(e);return bt([...r],t,n)}function ow(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var dw="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Kt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function el(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Qa(e,n);let u=`${zo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Hf(e,n),{reason:Sn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Hf(e,n),{reason:Sn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Qa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=xm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=mw(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,b=a==="||"?p?.success??[]:[],C=a==="&&"?p?.failure??[]:[],y={connector:a,skippedSuccessStates:b,skippedFailureStates:C};if(wt(d)&&!wt(a))l=y;let E=wt(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??y:y,T=qt(E.connector)||qt(d);if(u.kind==="function"){let z=h.flatMap((se)=>{let J=Yt(se);return J.functionDefinitions.set(u.name,u.body),Ya(se,[J],f,d==="&",qt(d))}),D=Za(z,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=D.states,s=D.conditionalStates,a=void 0;continue}if(u.kind==="group"){let z=[],D=[];for(let J of h){let Q=ui(u.body,t,n,r,[Yt(J)]);if(Q.result)return Q;if(z.push(...Ya(J,Q.states,f,d==="&",qt(d))),T)D.push(J,...f?Q.states.map((Ce)=>li(J,Ce)):Q.states)}let se=Za(z,D,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=se.states,s=se.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let I=Nw(e.nodes[c-1]),M=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),Y=e.nodes[c-2],ue=wt(a)&&Y?.kind==="command"?$m(Y)??pw(Y):void 0,Xe=[],be=[];for(let z of h){let D=gw(u,t,n,r,[Yt(z)]);if(D.result)return{result:D.result,states:i};let se=e.dialect==="powershell"?D.states:D.states.map((J)=>li(z,J));for(let J of se){let Q=Yt(J),Ce=bw(u,t,n.trace?{...n,trace:jf(n.trace,M)}:n,r,Q,wt(a),ue);if(Ce)return{result:Ce,states:i};let On=$w(u,Q.functionDefinitions);if(On)n.budget.charge("derivedTokens",di(On));let Pt=On?t+1>=V.recursionDepth.cap?Xa(u.displayText,n,[Q]):ui(On,t+1,n,r,[Q]):{result:null,states:zw(u,Q).flatMap((_e)=>Lw(u,J,_e,I))};if(Pt.result)return Pt;Xe.push(...Ya(z,Pt.states,f,d==="&",qt(d)));let Mn=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==J.effectiveCwd&&u.redirections.every((_e)=>["<",">",">>",">|"].includes(_e.operator)&&_e.target?.text==="/dev/null");if(T&&(I||!Mn))be.push(z),be.push(...Pt.states.map((_e)=>f?li(z,_e):_e))}}let At=Za(Xe,be,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=At.states,s=At.conditionalStates,a=void 0}return{result:null,states:i}}function mw(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&fw(e,t)}function Ya(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>In(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function fw(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(hw(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function pw(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function qt(e){return e==="&&"||e==="||"}function Za(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=qt(i)?s:void 0;return{states:qt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function jf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function gw(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=yw(e);if(s){if(t+1>=V.recursionDepth.cap)return Xa(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Xa(s,n,o);if(a.status!=="complete")return Ff(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Ff(i,n,r,o)}function hw(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Ff(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[Yt(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function yw(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Xa(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function bw(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:xw(n.environment.paths,o.createdDirectories,n.budget)}},l=Tw(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Vf(e,o,"before-consumer",a.environment.paths,a.budget);let c=dn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=vm(c,o.shellGitContextState),f=wm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=_(qd(e,i,Hw(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return Uw(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Zn(e.dialect,e.words)){let h=_(Pe(u[0]),a.policy),b=h!==null&&!a.strict&&Yu(e,a.rootProgram);if(h&&!b)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let C=zf(e,l,o,f,s,a);if(C)return C;return Ia(d,o.shellGitContextState),null}let g=Pn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,b)=>{let C=b&&Object.hasOwn(b,"effectiveCwd")?b.effectiveCwd:o.effectiveCwd,y=el(h,t+1,{...a,effectiveCwd:C,envAssignments:b?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:b?.functionDefinitions,worktreeMode:b?.worktreeMode??a.worktreeMode,trace:a.trace?jf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(g)return{...g,segment:m};let p=zf(e,l,o,f,s,a);if(p)return p;return Ia(d,o.shellGitContextState),null}function zf(e,t,n,r,o,i){let s=Iw(e,t,n,r??new Map,i);if(s)return s;return Vf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),vw(e,t,n,i.environment.paths,i.budget),Rw(e,n,i.environment.paths,i.budget),Mw(e,n,o,i.environment,i.trace),null}var Cw=new Set([">>","<>"]);function Vf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?Sw(s):Cw.has(s.operator)))continue;Bf(s.target,t,r,o)}if(n!=="before-consumer"||!ie(e.words[0],"tee"))return;let i=qf(e.words.slice(1));if(!i)return;for(let s of i.operands)Bf(s,t,r,o)}function Sw(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Bf(e,t,n,r){let o=e?.provenance==="literal"?rr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function vw(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of Ew(e,n.shellGitContextState.shellAssignments)){let a=rr(s,n.effectiveCwd,r,o);if(!a||!Ju(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Ew(e,t){let n=Ja(Aw(e.redirections)?.target,t),r=n===void 0?[]:[n];if(ie(e.words[0],"cat"))return _w(e.words)?r:[];if(!ie(e.words[0],"tee"))return[];let o=qf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Ja(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Ja(e,t){if(Pw(e))return e.text;return(e&&qe(e,t))??void 0}function xw(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=L(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${uw}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?L(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function Rw(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!ie(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Ja(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!sw(c)&&!l)continue;let u=L(cw(l??"",c),n,r);if(a?ww(u,n):n.isDirectory(iw(u))&&Kf(u,n))t.createdDirectories.add(u)}}function ww(e,t){let n=lw(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>aw(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||Kf(o(i),t)}function Kf(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function _w(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Aw(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function qf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&qe(s,t)===null)return;if(r&&ie(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function Pw(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function ie(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function tl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Tw(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Kt;let r=n[0];if(!r?.heredoc)return Kt;let o=/\$\(|`/.test(r.heredoc.body);if(!tl(r.heredoc)&&(!t||o))return dw;if(r.fd!==void 0&&r.fd!==0)return Kt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Kt;let i=e.redirections.some((l)=>l!==r&&$f(l.target));if(ie(e.words[0],"cat"))return i?Kt:void 0;if(ie(e.words[0],"tee"))return i||e.words.slice(1).some($f)?Kt:void 0;let s=e.words[0],a=e.words[1];if(ie(s,"git")&&(ie(a,"apply")||ie(a,"commit")))return;if(ie(s,"gh")&&(ie(a,"pr")||ie(a,"issue"))&&ie(e.words[2],"create"))return;return Kt}function $f(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Iw(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Ow(e,i,n,r,o))return null;let a=kw(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Qa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function kw(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!tl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=ie(e.words[0],"uv")&&ie(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Oe(i.text))return;let s=o.findIndex((m)=>ie(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=_(v("interpreter.one-liner-paranoid",or),n.policy);if(m)return m}if(!ir(l,void 0,!n.strict))return null;let u=_(v("interpreter.dangerous-command",pn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function Ow(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!tl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=k(a[0]??"");if((s.envSplitValues?.length??0)>0||!q.has(l)&&!q.has(A(l)))return!1;return at(a)}function Mw(e,t,n,r,o){let i=Lf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var Dw=new Set(["fi","done","esac"]);function Nw(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function Lw(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&Dw.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let d=Yt(n);return d.effectiveCwd=m,d})}function Ww(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var Gw=/^[A-Za-z_][A-Za-z0-9_]*$/,Fw=8;function zw(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!Gw.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Fw&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Yt(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Yt(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Rm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>Bw(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function Bw(e,t){return e.effectiveCwd===t.effectiveCwd&&Ww(e.compoundBodies,t.compoundBodies)&&In(e.shellGitContextState.env,t.shellGitContextState.env)&&In(e.literalHeredocFiles,t.literalHeredocFiles)&&In(e.functionDefinitions,t.functionDefinitions)&&In(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&In(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Uf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Uf(e.createdDirectories,t.createdDirectories)}function Uf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function In(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function $w(e,t){let n=Xn(e);return n===void 0?void 0:t.get(n)}function Uw(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Hw(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Qa(e,t){let n=_(Pe(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Hf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Sn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var jw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Yf(e,t,n,r){let o=el(e,0,{...t,...hu(t),budget:t.budget??je(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function Zf(e,t,n){try{return{decision:e()}}catch(r){let o=Vw(r,t,n);if(!o)throw r;return o}}function Vw(e,t,n){if(!(e instanceof N)||!jw.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Kw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),rl=new Set(["cc-safety-net","ccsn"]),qw=new Set(["bunx","npx","pnpx"]),Yw=new Set(["pnpm","yarn"]),Zw=new Set(["npm","pnpm","yarn"]),Xw=new Set(["bun","node"]);function fi(e,t,n={}){if(rl.has(e))return 0;if(qw.has(e)){if(n.broad)return nl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Zw.has(e)&&n.broad&&t[r]==="exec"){let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(Yw.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(Xw.has(e)){let o=n.broad&&r!==-1?r:0;if(Xf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Xf(t[o+1]))return o+2}return null}function nl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return rl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return rl.has(e.slice(0,t))}function Xf(e){let t=e?.replaceAll("\\","/");return[...Kw].some((n)=>t===n||t?.endsWith(`/${n}`))}var Jf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Qf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=hn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Jw(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Jw(e,t){let n=bt([...e],t),r=n.slice(1),o=fi(A(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var rp="This path contains the protected policy config and you must not modify or delete it.",Qw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function op(e,t,n){let r=i_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return ep(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?tp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=tp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return ep(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Mr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function ep(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>wr(a,n,r,o,i));return s?{target:s}:null}function tp(e,t,n,r,o){let i=hn(e,t,r,o,{findSegmentTarget:(s,a)=>e_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>wr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>o_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function e_(e,t,n,r,o){if(ur(e))return null;let i=Ct([...e],r),s=A(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&t_(a)){let l=n_(a).find((c)=>np(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Vo(i,1)||Ea(i,r)){let c=(br(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return wr(m,t.cwd,n,r,o)||np(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Mo(a).sources.find((c)=>s_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(r_(i,s))return null;for(let l of[...e,...i])for(let c of ip(l))if(wr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function t_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function n_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function r_(e,t){if(!Qw.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function o_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of ip(i))if(wr(s,t,n,r,o))return{target:s};return null}function ip(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function i_(e,t,n){let r=(a)=>_r(ae(a,e.executionCwd,t,n)),o=r(on(t)),i=[r(jn(e.executionCwd)),r(jn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function wr(e,t,n,r,o){let i=Vl(e,t,r,o,(s)=>_r(s)===$r);return i!==null&&n.files.has(_r(i))}function np(e,t,n,r,o){return n.directoriesAndAncestors.has(_r(ae(e,t,r,o)))}function s_(e,t,n,r,o){let i=_r(ae(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function _r(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as yp,resolve as yi,win32 as a_}from"path";import{fileURLToPath as l_}from"url";var bp="Access to a sensitive path is not allowed.",Cp=new Set(["echo","printf"]),c_=new Set(["find"]),u_=new Set(["!","do","elif","else","if","then","until","while"]),d_=new Set(["-exec","-execdir"]),m_=new Set([";","+"]),f_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),p_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Sp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),g_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),h_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),vp=new Set(["-c","-e","-r","-E","--eval","--exec"]),y_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),b_=new Set(["grep","rg"]),C_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),S_=new Set(["commit","merge","notes","stash","tag"]),v_=new Set(["-m","--message"]),E_=new Set(["--grep"]),sp=new Set(["jq","gojq","jaq"]),ap="f",lp="file",x_="files",R_=new Set(["e","f"]),w_=new Set(["regexp","file"]),__=new Set(["e","f","A","B","C","m"]),A_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ol="__CC_SAFETY_NET_PIPE_INPUT__",sl=/[\w./~@+-]*[./~][\w./~@+-]*/g,P_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,T_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,I_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,cp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,up=/\b(?:system|exec|spawn|popen)\s*$/,k_=/\b(?:eval|exec)\s*\(/g,O_=/\b(?:eval|exec)\s*$/,M_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function dp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(IA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=PA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(Pp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!ll(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!ll(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&kA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Ep(e,t,n,r,o={}){let i=mp(e,n,r),s=dp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=dp(i,t,e.invocation.context.configCwd,n,r,new Set(mp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&D_(e,n)?null:a}function D_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Oo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=dt(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return cl(i,o.slice(1))}function cl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>f_.has(n))}function mp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?kn(s.shell,e.store,r,t,o,n,N_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function N_(e){return e.program.dialect==="powershell"}function kn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...dA(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(V_(c,s),r);return ko(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...bi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...W_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...xp(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>G_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function ul(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?kn(s,t,n,r,o,i):null}function bi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,b)=>!s.has(b));if(sp.has(Ue(dt(p)[0]??"").toLowerCase()))return[...e.filter((h,b)=>s.has(b)).map(a),...bi(p,t,n,r,o,i)]}let l=j_(e).map(a),c=dt(e);if(c.length===0)return l;let u=c[0]??"",m=Ue(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!u_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&cl(Ue(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=L_(u,m,d);if(g)return[...l,...g.map(a)];if(Cp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...Rp(e).map(a)]:l;if(m==="eval")return[...l,...ul(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Ze(m,p)).map(a)];if(m==="git")return[...l,...q_(d).map(a)];if(m==="gh")return[...l,...al(m,d,C_).map(a)];if(sp.has(m))return[...l,...K_(d).map(a)];if(b_.has(m))return[...l,...CA(d).map(a)];if(c_.has(m))return[...l,...J_(d,t,n,r,o,i).map(a)];if(Ae.has(m))return[...l,...d.flatMap((p)=>Ze("awk",p)).map(a),...d.flatMap((p)=>eA(p,t,n,r,o,i)),...d.flatMap(tA).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>Ze(m,p)).map(a),...Y_(d).map(a)];if(dr(m)){let p=cr.has(m)?Ee([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...kn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((b)=>!b.startsWith("-")).map(a)]}return[...l,...Q_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>Ze(m,p)).map(a)]}function L_(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function W_(e,t,n,r,o,i,s){if($_(t,n,r,o,i,s)){let a=dt(e),l=cl(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...Rp(e),...l].map((c)=>({target:c,cwd:i}))}return xp(t,F_(e),n,r,o,i,s,()=>[])}function G_(e,t,n,r,o,i,s){let a=dt(e);if(!dr(Ue(a[0]??"").toLowerCase()))return[];return ul(t,n,r,o,i,s)??[{target:t,cwd:i}]}function xp(e,t,n,r,o,i,s,a){let l=U_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>cr.has(l)?kn(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function Rp(e){let t=dt(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!Cp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[dl(r.replaceAll("%%","%"))];return t.slice(1)}function F_(e){let t=dt(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return z_(r);return[]}function z_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[dl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>B_(t,r.slice(i*n,(i+1)*n)))}function B_(e,t){let n=0;return dl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function dl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function $_(e,t,n,r,o,i){let s=dt(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Vt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ol]:l.map((m)=>m.split(c).join(ol));return bi(u,t,n,r,o,i).some((m)=>m.target.includes(ol))}function U_(e){let t=dt(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!dr(n))return null;return H_(n,t.slice(1))?n:null}function H_(e,t){let n=ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(vp.has(o)||wp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(M_.get(n)?.has(o))r++;continue}return!1}return!0}function ml(e){return/^python\d/.test(e)?"python":e}function j_(e){let t=[];for(let n of e){if(Ap(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var fp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function V_(e,t){if(!t||!fp.test(e))return e;return`~${e.replace(fp,"").replace(/\\/g,"/")}`}function Ze(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function K_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ze("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ze("jq",r))}function q_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...S_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),v_):al("git",e.slice(n),E_)];if(t.push(...Ze("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ze("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ze(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ze(e,i))}return r}function Y_(e){return e.flatMap((t,n)=>{let r=X_(t);if(r!==null)return pp(r.flag,r.value);let o=Z_(e[n-1]);return o===null?[]:pp(o,t)})}function pp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function Z_(e){if(e===void 0)return null;if(Sp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function X_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Sp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function J_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!d_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>m_.has(f)),m=u===-1?c:c.slice(0,u),d=bi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!p_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Q_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(vp.has(c)||wp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...hi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function wp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return y_.get(t[t.length-1]??"")?.has(ml(e))??!1}function eA(e,t,n,r,o,i){if(!e.includes("system"))return[];return ba(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function tA(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function nA(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(fl),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=oA(t,rA(e));if(l.kind==="unmaskable")return nA(t).map(a);let c=l.masked.match(cp)!==null||l.literals.some((p)=>up.test(l.masked.slice(0,p.start))),u=l.masked.match(k_)!==null||l.literals.some((p)=>O_.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!cr.has(e),d=m&&!(lA(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(cp),(p)=>{let h=p.index+p[0].length;return{start:h,end:Xs(l.masked,h)}}):[],g=!m||f.some((p)=>Js(l.masked,p.start))?l.literals:l.literals.filter((p)=>up.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>fl(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(sl)??[]).map(a),...c?g.flatMap((p)=>ul(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>hi(e,p.text.replace(/\\(.)/g,(h,b)=>b==="n"?`
-`:b),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function rA(e){let t=ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function oA(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(T_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&aA(e,o))return{kind:"unmaskable"};let a=t==="python"?iA(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=sA(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&I_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function iA(e,t){return P_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function sA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function aA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function lA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(g_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>h_.has(i)))continue;if(o.length>1)return!0;if(cA(e,r)===".")return!0;if(uA(e,r+n.length)==="(")return!0}return!1}function cA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function uA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function dA(e,t,n,r,o,i){return hA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...mA(a,r)?fA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function mA(e,t){let n=Oo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function fA(e,t){return Oo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(fl)}function fl(e){let t=gA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||pA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function pA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function gA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function hA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Vn(o,n))continue;if(_p(e,r,n)){let i=yA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=bA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function yA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Vn(i,n))continue;if(_p(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function bA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function _p(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function CA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===x_)o=!0;if(w_.has(m))r=!0;if(d!==void 0){if(m===lp)t.push(d);continue}if(A_.has(m)){let f=e[l+1];if(m===lp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(R_.has(h))r=!0;if(__.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===ap)t.push(f);continue}let g=e[l+1];if(d===ap&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function dt(e){let t=e.findIndex((n)=>!Ap(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Ap(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var SA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),vA=".env.",EA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),xA=[".env.example.",".env.sample."];function RA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function wA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=Pp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Pp(e,t,n,r){try{return Tr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var _A=new Set(["node_modules","__pycache__"]),AA=[["vendor","bundle"],["vendor","cache"]];function PA(e,t,n,r,o){if(RA(e))return null;let i=Ye(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>wA(s)||ll(e,t,r,o);if(EA.has(s)||xA.some((d)=>s.startsWith(d)))return null;let c=B(DA(e,t,r,o));for(let d of ms){let f=`~/${d.suffixParts.join("/")}`;if((hp(a,f)||hp(c,f))&&ut(d.id,n))return d.id}let u=TA(i,t,n,r,o);if(u)return u;if(SA.has(s))return null;for(let d of ds)if(s===d.basename&&ut(d.id,n))return d.id;if(s.startsWith(vA)&&ut(Yr.id,n)&&l())return Yr.id;for(let d of fs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&ut(d.id,n)&&l())return d.id}for(let d of ps)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ut(d.id,n))return d.id}if(OA(a))return null;if(!s.includes(".")&&Kn.pattern.test(s)&&ut(Kn.id,n))return Kn.id;let m=MA(s,n);if(m)return m;return null}function TA(e,t,n,r,o){return Zr.find((i)=>{if(!ut(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return F(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Pr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ye("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Ar(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ce(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(j(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ce(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Pr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ye(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Ar(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Ar(e,s,["credentials"])||Ar(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((u)=>Pr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(j(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Pr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>F(e,Ye(u,t,r,o),l))}case"secret.cli.pi":return F(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ye("~",t,r,o);return[ce(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Ar(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ye("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>F(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Pr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(j(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ye("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Zt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ye("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var gp=new WeakMap;function j(e,t,n,r,o){let i=gp.get(o)??new Map;gp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ye(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>Tp(e,ce(t,r)))}function Ar(e,t,n){return n.some((r)=>Zt(B(e),B(ce(t,r))))}function Pr(e,t,n,r,o){return Tp(e,Ye(t,n,r,o))}function Tp(e,t){return B(e)===B(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function IA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Tr(e,t,o,i));return n.some((a)=>Zt(s,B(Tr(a,r,o,i))))}function kA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Tr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(L(Se(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?$e(L(yi(Se(u)),o.paths,i)):l&&$e(L(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Zt(s,m))return!1;return n.some((d)=>{let f=Cs(d);if(f&&yp.basename(s)!==B(f.name))return!1;let g=B(Tr(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Zt(s,g)&&!(f&&s===g)})}function OA(e){let t=e.split("/");return t.some((n)=>_A.has(n))||AA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function MA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ut(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ut(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ut(e,t){return!t?.disabledRules?.includes(e)}function Ye(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:$e(yi(t,s)),l=$e(L(a,n.paths,r));if(!Zt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function hp(e,t){return e===t||e.startsWith(`${t}/`)}function DA(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=yp.normalize(gi(s)?s:$e(yi(t,s))),l=$e(Se(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Zt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Tr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return $e(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(L(Se(r),t.paths,n)):"",i=$e(Se(NA(ot(e,t))));return{home:o,normalized:i}}function NA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return l_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function LA(e){if(process.platform==="win32")return!0;return a_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&LA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Zt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Xt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var WA={findPolicyMutation:op,findGitMetadataMutation:Td,resolveGitMetadata:FA,loadPolicySnapshot:gu,findSensitiveTarget:Ep,analyzeCommand:Yf,getModes:Bi},GA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Ip(e,t){let n={...WA,...t.dependencies},r=$A(e),o=Ir(e)?e.command:r,i=_t("policy-protection",o,()=>wd(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Ir(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Yd,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=je(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let y=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:rp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:y,segment:u.target}}}}let m=_t("policy-protection",o,()=>Qf(i,t.environment,l));if(m){let y=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Jf,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:y,segment:m.target}}}}let d=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let y=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ge,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:y,segment:d.target}}}}let f=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...zA(f)},b=g.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Ir(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(b){let y=o??b.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:bp,intent:"hard_stop",ruleId:b.ruleId,evidence:{command:y,segment:b.target}}}}if(!Ir(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let C=_t("command-analysis",o,()=>Zf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},BA(i),i.store),e.command,t.trace));if(C.decision){let y=!p.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===gr&&!GA.test(C.decision.evidence?.segment??"")&&Pe(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:y?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function FA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function zA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function BA(e){return ge(e,"declared-command")?.program}function $A(e){try{return Fn(e.input)}catch(t){let n=Ir(e)?e.command:void 0;throw new Xt("policy-protection",hl("policy-protection",t instanceof Je?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new Xt(e,hl(e,r instanceof Je?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ei:Nn,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Ir(e){return e.route.kind==="command"}import{appendFileSync as tP,mkdirSync as nP}from"fs";import{isAbsolute as rP,join as Cl}from"path";import{lstatSync as Op,readdirSync as UA,readFileSync as HA,rmdirSync as jA,statSync as Mp,unlinkSync as VA,utimesSync as KA,writeFileSync as qA}from"fs";import{join as kr}from"path";function kp(e,t={}){return io(on(e,t),e.home).policy.audit.retention_days}var bl=86400000,YA=".last-prune",ZA=/^\d{4}-\d{2}$/,XA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Dp=(e)=>Math.floor(e/bl);function Lp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Mp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=kr(t,YA),i=Mp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Dp(i)===Dp(r))return;let s=r-kp(e)*bl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){JA(kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))QA(kr(t,l.name),s)}qA(o,"",{mode:384}),KA(o,r/1000,r/1000)}catch{}}function JA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!ZA.test(r.name))continue;let o=kr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=XA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+bl;if(!Number.isFinite(a)||a>=t)continue;Wp(kr(o,i.name))}if(r.name!==n)Np(o)}Np(e)}function QA(e,t){try{let n=Op(e);if(n.mtimeMs>=t)return;let r=HA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(eP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Op(e).mtimeMs!==n.mtimeMs)return;Wp(e)}catch{}}function eP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return UA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Wp(e){try{VA(e)}catch{}}function Np(e){try{jA(e)}catch{}}var oP="2.5.2",iP=1e4,sP=2000,aP=256,lP=32768;function cP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function uP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=cP(t);if(!a)return;let l=mP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Ci(mt(n),s.failureStage?Number.POSITIVE_INFINITY:iP),m=Ci(mt(r),sP),d=s.toolName?Ci(mt(s.toolName),aP):void 0,f=i===null?void 0:Ci(mt(i),lP),g=Cl(l,uP(f?.value??null),c.slice(0,7));nP(g,{recursive:!0,mode:448});let p=Cl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:oP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};tP(p,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Lp(e,l,s.now)}catch{}}function Ci(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function dP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&rP(n)?n:null}function mP(e){let t=dP(e);return t?Cl(t,".cc-safety-net","logs"):null}function Fp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Gp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Gp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Gp(e){return"command"in e?e.command??"":""}function zp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Bp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Up(e,t,n){try{let r=Ip(t,{environment:e,...n.guard});return $p(e,t,r,n),r}catch(r){if(!(r instanceof Xt))throw r;throw $p(e,t,r.evaluation,n,!(r.cause instanceof Je),{stage:r.stage,errorCode:fP(r.cause)}),r}}function $p(e,t,n,r,o=!0,i){zp(e,Fp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function fP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Je)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Jt(e,t={}){return{malformed:!0,denial:Ln(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Hp(e,t={}){return(n,r)=>{try{return pP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Ln())}}}function pP(e,t,n,r){let o=rc();if(n.cancelled?.(t))return n.block(Ln());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Bp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Rl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Up(o,i,{guard:{auditAllowed:ac(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Xt))throw l;if(et(Z.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var gP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>yP(e,t,n),getSessionId:(e)=>SP(e),allow:{action:"allow"},block:(e)=>vP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},jp=hP();function hP(e={}){return Hp(gP,e)}function yP(e,t,n){if(!e||typeof e!=="object")return Jt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Jt(null);if(!r.input||typeof r.input!=="object")return Jt(null,{toolName:r.tool});let o=bP(t);if(!o)return Jt(null,{toolName:r.tool});let i=Yl(".",[o],n);if(!i)return vl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=CP(t,e);if(!s.ok)return Jt(i,{toolName:r.tool});if(!s.command)return Di(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return Jt(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Zl(a,i,n);if(!l)return vl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return Di(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function bP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function CP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function SP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function vP(e){return{action:"reject-and-continue",message:wl(e)}}function EP(e){e.on("tool.call",(t)=>jp(t,e))}export{EP as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Ar(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function Pn(e){return e?_(e):""}function ri(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Ua(e,t){return Ba(Ne(e,"posix"),t)}function Pr(e){return Ua(e,new Set(Array.from(e.matchAll(Ym)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ba(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ba(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ba(o,n))||nf(r.words,n))return!0;PR(r,n)}return!1}function nf(e,t){let n=e.findIndex((s)=>ke(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(wr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return qm(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=xe(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&qm(s[l],t)}let i=RR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return nf(e.slice(i),t)}function RR(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return _R(e,t+1);if(r==="exec")return wR(e,t+1);if(r==="env")return AR(e,t+1,n);return null}function _R(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function wR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function AR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return wr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return wr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(ke(i))continue;return r}return null}function PR(e,t){if(!e.words.every((n)=>ke(n.text)!==null))return;for(let n of e.words){let r=ke(n.text);if(!r)continue;if(wr(n,t))t.add(r.name)}}function wr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Ym)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(yR.test(o)||t.has(o))}))}function qm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||wr(e,t))}var Ha="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ja="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",IR="__CC_SAFETY_NET_XARGS_INPUT__",oi="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ii="rm",TR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,kR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,OR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,MR=/^(?:[0-9]+|[@*])$/;function sf(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=Zt(n),i=n.slice(r),s=v("xargs.shell-dynamic",ja);if(NR(i,o,t)&&w(s,t.policy))return w(s,t.policy);for(let a of $e(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?w(s,t.policy):null;if(c)return c;let u=mf(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&uf(l,o),d=t.analyzeChild(l,{...Kt(a,t),dynamicInput:u,dynamicSourceInput:m||lf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ha)});if(d)return d;let f=DR(l,o,t.policy?.rules??[],w(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,IR]:l,h=o!==null&&(l.some((C)=>C.includes(o))||Array.from(a.envAssignments.values()).some((C)=>C.includes(o))),y=t.analyzeChild(p,{...Kt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function DR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function af(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=jm(e,r,t.length,n);return o===null?[]:[o]}function lf(e,t,n,r,o,i,s){if(Y.has(t)){if(at(e))return!1;if(n!==null&&LR(e,n,s))return!0;let a=Ue(e);if(!a){let l=ct(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!cf(a,n,s))return!0;if(Te(a))return!0;return WR(a,n,r)}if(De(t))return rf(e,n,wo,cd(t));if(Ie.has(t))return rf(e,n,xa,um);if(t==="eval"){let a=ti(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return GR(e,n,i);if(t==="git"){let a=we(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&wn.has(a.subcommand.toLowerCase())&&df(a.rest,n).some((l)=>l.includes(n))}return!1}function cf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Te(i)===null&&n(i)===null}function rf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,oi]).sources.some((a)=>a.value===oi);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${oi}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${oi}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>af(l,t,a))));return Qo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function NR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from($e(e,n),(i)=>i.head)),o=t===null?[...e,ii]:e.map((i,s)=>s===0?i:i.replaceAll(t,ii));return Array.from($e(o,n)).some((i)=>i.head===ii&&!r.has(ii))}function uf(e,t){return df(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function df(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function mf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function LR(e,t,n){let r=xe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!cf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return af(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=xe(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function WR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(TR))if(of(o,r))return!0;for(let o of e.matchAll(kR))for(let i of(o[1]??"").matchAll(OR))if(of(i,r))return!0;return Ua(e,r)}function of(e,t){let n=e[1]??e[2];return n!==void 0&&(MR.test(n)||t.has(n))}function GR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=_n(e,i);i=l.nextIndex-1;for(let c of $e(l.tokens,{environment:n,cwd:void 0})){let u=mf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&uf(c.tokens,t)||lf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=lt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Zt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Ir="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Tr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",zR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",BR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ai=/\{[^{}\s]*\}/g,ff=/\{\}|\{-?\d+\}/g,pf=/[\s;&|<>()$`\\"']/,$R=["e","f","source","file","-e","-f","--source","--file"],UR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],HR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),jR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),gf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),VR=new Set(["--workdir","--wd"]),hf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Oe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Cf(e){return Oe([...e],(t)=>Te(t))}function Sf(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=In(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Of(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=In(t);if(g)return g;let p=Cf(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=QR(t);if(g)return g}if(u!==void 0&&a){let g=In(t);if(g)return g}let d=e_(u,t.cwd,t.environment.paths);if(d===null){let g=In(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...$e(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some(qa)){let p=In(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=wf(f.envAssignments,f.cwd,a);return Oe(g,(h)=>t.analyzeNested(h,p))}return Oe($e(i,f),(g)=>KR(g,o,t,f))}function KR(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(Tf)){let E=In(n);if(E)return E}let c=Cf(l);if(c)return c;let u=l.some(G),m=o||u,d=s&&m,f=wf(e.envAssignments,e.wrapperCwd,i||d),g=m?{...f,worktreeMode:!1}:f,p=a.join(" "),h=G(p.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>pf.test(E))),C=h||pf.test(a[0]??""),b=y&&C&&t.jobs.length>0?null:qR(e,t,n,r,g,u);if(b||!y)return b;return vf(G(p)?p:`${p} {}`,!h,e,t,n,r,g)}function qR(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,u=e.tokens,m=a||i;if(Y.has(e.head)){let f=()=>{if(!a||s.length===0)return null;return Oe(s,(h)=>n.analyzeChild(si(u,h,n.budget),Kt(e,r)))};if(at(u))return f();let g=Ue(u);if(g){if(kf(g)){let b=wt(n);if(b)return b;if(s.length===0)return null;return Oe(s,(E)=>n.analyzeNested(Pf(g,E,n.budget),o))}if(G(g))return vf(g,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((b)=>ni(q(b===void 0?u:a?u.map((E)=>Af(E,b)):[...u,...b]),g)):[];if(h.some((b)=>b.kind==="dynamic")){let b=wt(n);if(b)return b}let y=h.flatMap((b)=>b.kind==="literal"?[b.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),Oe(y,(b)=>n.analyzeNested(b,o));if(Pr(g)){let b=wt(n);if(b)return b}let C=n.analyzeNested(g,o);if(C)return C;if(m)return wt(n);return null}let p=ct(q(u));if(p.kind==="dynamic"||p.kind==="literal"&&G(p.source))return wt(n)??f();if(p.kind==="literal")return f();if(s.length>0){let h=wt(n);if(h)return h;let y=f();if(y)return y;if(a)return null;let C=s.flatMap((b)=>b[0]===void 0?[]:[b[0]]);return n.budget.charge("derivedTokens",C.length),Oe(C,(b)=>n.analyzeNested(b,o))}if(m||c)return wt(n)??f();return null}if(e.head==="rm"&&st(u)){if(a&&s.length>0)return Oe(s,(g)=>Va(si(u,g,n.budget,ff),e.cwd,r));if(s.length>0)return Oe(s,(g)=>Va(bf(u,g,n.budget),e.cwd,r));let f=Va(u.flatMap((g,p)=>{if(p===0||!G(g))return[g];return g.startsWith("-")?[g.replace(ff,"")]:[]}),e.cwd,r);if(f)return f;return _f(n)}let d=s.length>0?s:[void 0];return Oe(d,(f)=>{let g=f===void 0?u:a?si(u,f,n.budget):bf(u,f,n.budget),p=v("parallel.shell-dynamic",Tr),h=c&&e.head==="find"?JR(g,r):null,y=xf(g,c,n)??h?.customResult??null,C=O(e.head),b=c&&(C==="rm"&&Ka(g)||C==="xargs"&&Rf(g)||h?.rmOptions===!0),E=c&&(b||h?.executedSource===!0||h===null&&Ef(g,C)),I=n.analyzeChild(g,{...Kt(e,r),worktreeMode:l||c||m?!1:n.worktreeMode,dynamicInput:c||m,dynamicRmInput:b,dynamicSourceInput:y!==null||E,shellDynamicMatch:p,dynamicSourceMatch:p,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Ir)});if(E){let T=w(p,n.policy);if(T)return T}return I??y??it(g,n.policy?.rules??[])})}function vf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Oe(r.jobs,(c)=>o.analyzeNested(Pf(e,t?c.map(ri):c,o.budget),s));let a=_r(e);if(a?.[0]&&O(a[0])==="rm"&&st(a)){let c=_f(o);if(c)return c}return(a?o.analyzeChild(a,{...Kt(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",Tr),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Ir)}):null)??o.analyzeNested(e,s)}function Ef(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return XR(e);if(t==="git")return YR(e);if(t==="find")return!0;if(Ie.has(t))return yf(e,$R,xr);if(De(t))return yf(e,UR,_o);return!1}function Ka(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||kf(o)))}function YR(e){if(ZR(e))return!0;let t=we(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!wn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function ZR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function XR(e){if(at(e))return!1;let t=Ue(e);if(t!==null)return G(t);let n=ct(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function yf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,hf]).some((o)=>o.value===hf);return Qo(r,t,(o)=>n(e.map((i)=>Af(i,[o]))))}function xf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return wt(n);return Oe(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function JR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of $e(i,t))n.executedSource||=Ef(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ka(a.tokens)||a.head==="xargs"&&Rf(a.tokens),n.customResult??=xf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=G(a);continue}let l=lt(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Rf(e){let t=e.slice(Zt(e).childStart);return O(t[0]??"")==="rm"&&Ka(t)}function li(e,t){return(n)=>w(v(e,t),n.policy)}var wt=li("parallel.shell-dynamic",Tr),QR=li("parallel.command-stream-dynamic",zR),In=li("parallel.command-stream-dynamic",BR),_f=li("parallel.rm-recursive-force-dynamic",Ir);function Va(e,t,n){return w(ei(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:vn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function wf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Af(e,t){return e.replace(ai,(n)=>If(n,t))}function si(e,t,n,r=ai){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=If(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Pf(e,t,n){return si([e],t,n)[0]??""}function bf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function If(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(ai)!==-1}function Tf(e){if(qa(e))return!0;for(let t of e.matchAll(ai))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function qa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function kf(e){return/^\{[^{}\s]*\}$/.test(e)}function e_(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!FR(e))return null;try{return Ct(t??e,e,n)}catch{return null}}function Of(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,u=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=wa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=wa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=p.indexOf("="),C=y===-1?p:p.slice(0,y),b=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){c=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){u||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){u=!0,t+=2;continue}if(C==="--replace"||p.startsWith("-i")&&p.length>2){let E=C==="--replace"?b:p.slice(2);u||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||jR.has(C)){u=!0,t+=b===void 0?2:1;continue}if(p==="-q"||p==="--quote"){s=!0,t++;continue}if(p==="--pipe"||p==="--pipepart"){a=!0,t++;continue}if(C==="--env"){u=!0,t+=b===void 0?2:1;continue}if(gf.has(C)||p.startsWith("-S")&&p.length>2){i=!0,t+=gf.has(p)?2:1;continue}if(VR.has(C)){u=!0;let E=b??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=b===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&b!==void 0){t++;continue}if(HR.has(p)){if(h===void 0||h===":::"||h==="--"){u=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}u||=n.some(c?qa:Tf);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){m.push(p),p=[];continue}if(y!==void 0)p.push(y)}m.push(p)}u||=m.length>1;let d=t_(m),f=n.some(G),g=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:f,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:g,unsupported:u,workdir:l,dryRun:c}}function t_(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>K.derivedTokens.cap)throw new W("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>K.derivedTokens.cap)throw new W("derivedTokens");o.push([...i,s])}t=o}return t}function Mf(e){return Of(e).childStart}var n_="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ci="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Za(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ya(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Nf(e,t,n,r,o=!1,i){let a=(er(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ee(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",n_):null;return w(a,i)??Lf(e,t,n,o,i)}function Lf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Za(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=gn(e,t),l=o_(a);if(ee(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return w(v("shell.dynamic-structure",ci),o);if(w(Jo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&_(m)==="--");if(ee(o,"shell.dynamic-structure",r)&&c&&wn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return w(v("shell.dynamic-structure",ci),o);return null}if(s==="find")return ee(o,"shell.dynamic-structure",r)&&i_(t)?w(v("shell.dynamic-structure",ci),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&_(c)==="--"),l=st(t.map(_));return ee(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?w(v("shell.dynamic-structure",ci),o):null}if(s==="xargs")return Df(e,t.slice(Zt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Df(e,t.slice(Mf(t.map(_))),"parallel",n,r,o);return null}function Df(e,t,n,r,o,i){if(t.length===0)return null;let s=r_(t,r);if(er(e,s)){let l=w(v(`${n}.shell-dynamic`,n==="xargs"?ja:Tr),i);if(l)return l}let a=Lf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Za(l)&&Ya(l)))return w(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ha:Ir),i);return null}function r_(e,t){let n=Bt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function o_(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(Ee.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function i_(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Za(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ya(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ya(s)))return!0;continue}if(t=!0,a)return!0;let l=lt(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function Xa(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!vo(t[n.tokenIndex],n.value)})}var Ff=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>ei(e.words,Gf(e))},{heads:new Set(["git"]),analyze:(e)=>Jo(e.words,Ja(e))},{heads:new Set(["find"]),analyze:(e)=>Sm(e.words,{...Gf(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>sf(e.words,{...Wf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Sf(e.words,{...Wf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})}];function Wf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Tn(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function Gf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ht(e.envAssignments,e.options.environment),trustedTmpdirValue:vn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function Ja(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function $f(e){return Ff.find((t)=>t.heads.has(e))?.analyze}function On(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((P)=>o==="posix"?_(P):P.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Io(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Bt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let x=[...g,...i(f.words)].join(" "),P=Te(x);if(P)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:P.reason}),de(P);if(n.strict)return ye(r);let z=To(g,i(f.words));if(z){n.budget.charge("derivedTokens",z.length);let ne=n.analyzeNested(z.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(ne)return ne}}let p=f.rewritten?q(i(f.words)):gn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-p.length),output:h})}let C=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),b=h[0];if(!b)return null;if(Vt(b))throw new W("wrapperPeelIterations");let E=O(b),I=f.cwd===null?void 0:f.cwd??u,T=f.cwd===null?void 0:m,k=f.cwd===void 0?n.effectiveCwd:f.cwd,F=s?s.allowTmpdirVar:!br(C,n.environment),ue=Nf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ue)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ue.reason}),de(ue);let Xe=Vo(h,n.policy);if(Xe){for(let x of[Xe.childIndex,...Xe.alternativeChildIndices]){zf(y.wrapperNormalizationBudget);let P=p.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:Xe.wrapper,output:i(P)});let z=On(P,t,{...y,effectiveCwd:k,envAssignments:C});if(z)return z}return null}let Ce=l?void 0:E==="eval"?ti(p):E==="trap"&&!a?Jm(p):void 0;if(a&&s&&E==="eval"){if(Ce?.kind==="dynamic")return kn(s,n.policy);if(Ce?.kind==="literal"){let x=n.analyzeNested(Ce.source,{effectiveCwd:k,envAssignments:C});if(x)return x}return Mn(s,n.policy)}if(Ce?.kind==="dynamic"&&(n.strict||!n.commandView||!$a(n.commandView)))return ye(r);if(Ce?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:Ce.source,depth:t+1});let x=n.analyzeNested(Ce.source,{effectiveCwd:k,envAssignments:C,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?Y.has(E):Hf(b,E)){if(at(h))return null;if(a&&s){let x=Ue(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let z=kn(s,n.policy);if(z)return z}if(Pr(x)){let z=kn(s,n.policy);if(z)return z}return n.analyzeNested(x,{effectiveCwd:k,envAssignments:C})}let P=ct(p);if(P.kind==="dynamic")return kn(s,n.policy);if(P.kind==="literal")return s.dynamicSourceInput?kn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?kn(s,n.policy):null}if(l){let x=Ue(h),P=x?n.analyzeNested(x,{effectiveCwd:k,envAssignments:C}):ct(p).kind==="dynamic"?ye(r):null;if(P)return P}if(s===void 0){let x=c_(h,C,k,n,r,t);if(x)return x;let P=Ue(h);if(P){let rn=ni(p,P);if(rn.kind==="dynamic")return ye(r);let Ri=rn.kind==="literal"?rn.source:Qm(p,P),Al=u_(Ri);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:Al}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Al,depth:t+1});let Pl=n.analyzeNested(Ri,{effectiveCwd:k,envAssignments:C});if(Pl)return Pl;return Pr(Ri)?ye(r):null}let z=ct(p,n.strict?void 0:n.shellAssignments);if(z.kind==="dynamic")return ye(r);if(z.kind==="literal")return ui(z.source,k,C,n,r,t);let ne=ef(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return ye(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:k,envAssignments:C})}}if(!s&&(E==="source"||E===".")){let x=h[1]==="-p"?2:null;if(x!==null){let rn=n.commandView?p[x]:void 0;if(!rn)return null;if(rn.provenance!=="literal")return ye(r)}let P=x===null?1:3,z=h[P]==="--"?P+1:P,ne=n.commandView?p[z]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ui(ne.text,k,C,n,r,t);if(n.strict||!n.commandView||!$a(n.commandView))return ye(r)}if(Ie.has(E)&&!l){if(!s&&n.strict&&Xa(xr(h),p))return ye(r);let x=dm(h,(z)=>Tn(n.analyzeNested(z,{effectiveCwd:k,envAssignments:C}))),P=w(x,n.policy);if(P)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:P.reason}),de(P)}if(De(E)&&!l){if(!s&&n.strict&&Xa(_o(h),p))return ye(r);let x=ld(h);if(a&&s)return a_(E,x,k,C,n,s);if(x){let P=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:x,paranoidBlocked:P}),P){let ne=w(v("interpreter.one-liner-paranoid",ur),n.policy);if(ne)return de(ne)}if(ta(E,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let z=n.analyzeNested(x,{effectiveCwd:k,envAssignments:C});if(z&&!Uf(z,x))return z;if(dr(x,void 0,!n.strict)){let ne=w(v("interpreter.dangerous-command",bn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:bn}),de(ne)}r=void 0}}if(E==="busybox"&&h.length>1)return zf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),On(p.slice(1),t,{...y,effectiveCwd:k,envAssignments:C});let U=s?null:w(hm(E,h),n.policy);if(U)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:U.reason}),de(U);let L=r===y.trace?y:{...y,trace:r},ae={words:p,head:E,cwd:I,originalCwd:T,envAssignments:C,allowTmpdirVar:F,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:k,options:L,analyzeChildTokens:(x,P)=>a&&s?el(x,t,L,{...s,cwd:P??void 0,effectiveCwd:P??void 0}):Tn(On(q(x),t+1,{...L,child:void 0,commandView:void 0,effectiveCwd:P,envAssignments:C}))??it(x,L.policy.rules),analyzeChild:(x,P)=>el(x,t,L,P)},J=s&&(E==="xargs"||E==="parallel")?void 0:$f(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:C.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:F});let Q=r&&E==="git"?Hm(ae.words,Ja(ae)):void 0,Se=Bf(Q?Q.match:J?.(ae)??null,n.policy);if(r)d_(ae,Se,Q?.relaxation??null);if(Se)return de(Se);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(st(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Mn(s,n.policy):null)??l_(s,n.policy)}let Tt=!s&&J===void 0&&!Yr.has(E),Wn=r&&Tt?[]:void 0;if(Tt)for(let x=1;x<h.length;x++){let P=h[x];if(!P)continue;Wn?.push(P);let z=Bf(s_(h,x,t,L,I,T,k,C),n.policy);if(z)return r?.recordSegment({type:"fallback-scan",tokensScanned:Wn??[],embeddedCommandFound:O(P)}),de(z)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Wn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ae=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ae,reason:Ae?.reason}),Ae)return de(Ae);return a&&s?Mn(s,n.policy):null}function el(e,t,n,r){return Tn(On(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function s_(e,t,n,r,o,i,s,a){for(let l of $e(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(Hf(c,u)||$f(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=el(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!br(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function a_(e,t,n,r,o,i){if(!t)return Mn(i,o.policy);if(ee(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=w(v("interpreter.one-liner-paranoid",ur),o.policy);if(a)return de(a)}if(ta(e,t))return Mn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Uf(s,t))return s;if(dr(t,void 0,!o.strict)){let a=w(v("interpreter.dangerous-command",bn),o.policy);if(a)return de(a)}return Mn(i,o.policy)}function Uf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Uo)||e.reason===Rn)&&!Zr(t);return n||r}function kn(e,t){let n=e.shellDynamicMatch?w(e.shellDynamicMatch,t):null;return n?de(n):null}function Mn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?w(e.dynamicSourceMatch,t):null;return n?de(n):null}function l_(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?w(e.rmDynamicMatch,t):null;return n?de(n):null}function c_(e,t,n,r,o,i){let s=Cm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ui(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ui(a,n,t,r,o,i,!0)}function ui(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=cr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function u_(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function d_(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function zf(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new W("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:vr}),de(m_())}function m_(){return{id:"analysis.dynamic-shell-source",reason:vr,intent:"stop_and_explain"}}function Hf(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(A(t))}function Bf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:w(e,t)}var f_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,p_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function g_(e,t){let n=Kf(e,t);if(n.length===0)return!1;let r=n[Vf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return f_.test(e.join(" "))}function jf(e,t,n,r,o){if(e.dialect==="powershell"){let b=h_(e.words,o);if(b.kind==="none")return;if(!t||b.kind==="unknown")return null;return Qa(S_(b.target),t,n.paths)}let i=e.words.map(_),s=i.some((b)=>/^CDPATH\+?=/.test(b));if(!g_(i,n))return s?null:void 0;if(!t)return null;let a=Kf(i,n,t),l=Vf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((b)=>b.length<=1||!b.startsWith("-")||b==="--");if((u===-1?c:c.slice(0,u)).some((b)=>!/^-[LP]+$/.test(b)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length>1)return null;let g=f[0],p=r.get("HOME")||n.home;if(g===void 0)return Qa(p,t,n.paths);let h=e.words.find((b)=>b.provenance==="variable"&&b.text===g),y=e.words.find((b)=>b.text===g&&/^~(?:\/|$)/.test(b.raw)),C=h?Ye(h,new Map([...r,["HOME",p]])):y?`${p}${g.slice(1)}`:g;if(C===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(C)&&(s||n.env.has("CDPATH")))return null;return Qa(C,t,n.paths)}function Qa(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=Ct(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function h_(e,t){let n=y_(e[0])?1:0,r=e[n];if(!b_(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!p_.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return C_(e.slice(n+1),t)}function y_(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function b_(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function C_(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function S_(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Vf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Kf(e,t,n){let r=v_(e);return St([...r],t,n)}function v_(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var P_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Xt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function sl(e,t,n,r){if(t>=K.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return il(e,n);let u=`${Uo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Qf(e,n),{reason:Rn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Qf(e,n),{reason:Rn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return il(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Om(n.environment.env,n.envAssignments);return fi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function fi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=I_(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],C=a==="&&"?p?.failure??[]:[],b={connector:a,skippedSuccessStates:y,skippedFailureStates:C};if(At(d)&&!At(a))l=b;let E=At(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:At(a)?l??b:b,I=Jt(E.connector)||Jt(d);if(u.kind==="function"){let U=h.flatMap((ae)=>{let J=Qt(ae);return J.functionDefinitions.set(u.name,u.body),tl(ae,[J],f,d==="&",Jt(d))}),L=nl(U,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=L.states,s=L.conditionalStates,a=void 0;continue}if(u.kind==="group"){let U=[],L=[];for(let J of h){let Q=fi(u.body,t,n,r,[Qt(J)]);if(Q.result)return Q;if(U.push(...tl(J,Q.states,f,d==="&",Jt(d))),I)L.push(J,...f?Q.states.map((Se)=>di(J,Se)):Q.states)}let ae=nl(U,L,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=ae.states,s=ae.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let T=J_(e.nodes[c-1]),k=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),F=e.nodes[c-2],ue=At(a)&&F?.kind==="command"?Xm(F)??k_(F):void 0,Xe=[],Ce=[];for(let U of h){let L=O_(u,t,n,r,[Qt(U)]);if(L.result)return{result:L.result,states:i};let ae=e.dialect==="powershell"?L.states:L.states.map((J)=>di(U,J));for(let J of ae){let Q=Qt(J),Se=N_(u,t,n.trace?{...n,trace:ep(n.trace,k)}:n,r,Q,At(a),ue);if(Se)return{result:Se,states:i};let mt=iw(u,Q.functionDefinitions);if(mt)n.budget.charge("derivedTokens",pi(mt));let Tt=mt?t+1>=K.recursionDepth.cap?rl(u.displayText,n,[Q]):fi(mt,t+1,n,r,[Q]):{result:null,states:rw(u,Q).flatMap((Ae)=>Q_(u,J,Ae,T))};if(Tt.result)return Tt;Xe.push(...tl(U,Tt.states,f,d==="&",Jt(d)));let Wn=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==J.effectiveCwd&&u.redirections.every((Ae)=>["<",">",">>",">|"].includes(Ae.operator)&&Ae.target?.text==="/dev/null");if(I&&(T||!Wn))Ce.push(U),Ce.push(...Tt.states.map((Ae)=>f?di(U,Ae):Ae))}}let It=nl(Xe,Ce,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=It.states,s=It.conditionalStates,a=void 0}return{result:null,states:i}}function I_(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(At(r)||At(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&T_(e,t)}function tl(e,t,n,r,o){let i=n?t.map((a)=>di(e,a)):[...t],s=o?i.flatMap((a)=>Dn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function di(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function T_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(M_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function At(e){return e==="|"||e==="|&"}function k_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Jt(e){return e==="&&"||e==="||"}function nl(e,t,n,r,o,i){let s={success:mi([...n,...e]),failure:mi([...r,...t])},a=Jt(i)?s:void 0;return{states:Jt(o)||a?mi([...s.success,...s.failure]):s.success,conditionalStates:a}}function ep(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function O_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=D_(e);if(s){if(t+1>=K.recursionDepth.cap)return rl(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return rl(s,n,o);if(a.status!=="complete")return qf(i,n,r,o);n.budget.charge("derivedTokens",pi(a)),i.push({program:a,depth:t+1})}}return qf(i,n,r,o)}function M_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function qf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=fi(i.program,i.depth,t,n,[Qt(a)]);if(l.result)return l;s.push(...l.states)}o=mi(s)}return{result:null,states:o}}function D_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function pi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+pi(o),0):n.kind==="group"||n.kind==="function"?pi(n.body):0),0)}function rl(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function N_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:z_(n.environment.paths,o.createdDirectories,n.budget)}},l=V_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};tp(e,o,"before-consumer",a.environment.paths,a.budget);let c=gn(e.dialect,e.words),u=c.map(_),m=e.displayText,d=Tm(c,o.shellGitContextState),f=Dm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=w(rm(e,i,aw(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return sw(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!er(e.dialect,e.words)){let h=w(Te(u[0]),a.policy),y=h!==null&&!a.strict&&od(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let C=Yf(e,l,o,f,s,a);if(C)return C;return La(d,o.shellGitContextState),null}let g=On(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let C=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,b=sl(h,t+1,{...a,effectiveCwd:C,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?ep(a.trace,a.trace.currentSegmentIndex,!0):void 0});return b?{reason:b.reason,ruleId:b.ruleId,intent:b.intent}:null}});if(g)return{...g,segment:m};let p=Yf(e,l,o,f,s,a);if(p)return p;return La(d,o.shellGitContextState),null}function Yf(e,t,n,r,o,i){let s=K_(e,t,n,r??new Map,i);if(s)return s;return tp(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),G_(e,t,n,i.environment.paths,i.budget),B_(e,n,i.environment.paths,i.budget),Z_(e,n,o,i.environment,i.trace),null}var L_=new Set([">>","<>"]);function tp(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?W_(s):L_.has(s.operator)))continue;Zf(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=rp(e.words.slice(1));if(!i)return;for(let s of i.operands)Zf(s,t,r,o)}function W_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Zf(e,t,n,r){let o=e?.provenance==="literal"?cr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function G_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of F_(e,n.shellGitContextState.shellAssignments)){let a=cr(s,n.effectiveCwd,r,o);if(!a||!ad(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=K.trackedHeredocFiles.cap)throw new W("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function F_(e,t){let n=ol(H_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return U_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=rp(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>ol(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function ol(e,t){if(j_(e))return e.text;return(e&&Ye(e,t))??void 0}function z_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=D(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${A_}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?D(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function B_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>ol(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!x_(c)&&!l)continue;let u=D(w_(l??"",c),n,r);if(a?$_(u,n):n.isDirectory(E_(u))&&np(u,n))t.createdDirectories.add(u)}}function $_(e,t){let n=__(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>R_(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||np(o(i),t)}function np(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function U_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function H_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function rp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function j_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function al(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function V_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Xt;let r=n[0];if(!r?.heredoc)return Xt;let o=/\$\(|`/.test(r.heredoc.body);if(!al(r.heredoc)&&(!t||o))return P_;if(r.fd!==void 0&&r.fd!==0)return Xt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Xt;let i=e.redirections.some((l)=>l!==r&&Xf(l.target));if(se(e.words[0],"cat"))return i?Xt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Xf)?Xt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return Xt}function Xf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function K_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Y_(e,i,n,r,o))return null;let a=q_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=il(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function q_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!al(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!De(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=ee(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=w(v("interpreter.one-liner-paranoid",ur),n.policy);if(m)return m}if(!dr(l,void 0,!n.strict))return null;let u=w(v("interpreter.dangerous-command",bn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function Y_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!al(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Bt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(A(l)))return!1;return at(a)}function Z_(e,t,n,r,o){let i=jf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var X_=new Set(["fi","done","esac"]);function J_(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function Q_(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&X_.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let d=Qt(n);return d.effectiveCwd=m,d})}function ew(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var tw=/^[A-Za-z_][A-Za-z0-9_]*$/,nw=8;function rw(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!tw.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=nw&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Qt(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Qt(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Mm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function mi(e){let t=[];for(let n of e){if(!t.some((r)=>ow(r,n)))t.push(n);if(t.length>K.controlFlowStates.cap)throw new W("controlFlowStates")}return t}function ow(e,t){return e.effectiveCwd===t.effectiveCwd&&ew(e.compoundBodies,t.compoundBodies)&&Dn(e.shellGitContextState.env,t.shellGitContextState.env)&&Dn(e.literalHeredocFiles,t.literalHeredocFiles)&&Dn(e.functionDefinitions,t.functionDefinitions)&&Dn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Dn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Jf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Jf(e.createdDirectories,t.createdDirectories)}function Jf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Dn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function iw(e,t){let n=tr(e);return n===void 0?void 0:t.get(n)}function sw(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function aw(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function il(e,t){let n=w(Te(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Qf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Rn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var lw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function op(e,t,n,r){let o=sl(e,0,{...t,...Eu(t),budget:t.budget??Pe(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function ip(e,t,n){try{return{decision:e()}}catch(r){let o=cw(r,t,n);if(!o)throw r;return o}}function cw(e,t,n){if(!(e instanceof W)||!lw.has(e.kind))return null;let r=K[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var uw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),cl=new Set(["cc-safety-net","ccsn"]),dw=new Set(["bunx","npx","pnpx"]),mw=new Set(["pnpm","yarn"]),fw=new Set(["npm","pnpm","yarn"]),pw=new Set(["bun","node"]);function hi(e,t,n={}){if(cl.has(e))return 0;if(dw.has(e)){if(n.broad)return ll(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return gi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&fw.has(e)&&n.broad&&t[r]==="exec"){let o=ll(t.slice(r+1));return o===null?null:r+1+o}if(mw.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&gi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=ll(t.slice(r+1));return o===null?null:r+1+o}if(pw.has(e)){let o=n.broad&&r!==-1?r:0;if(sp(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&sp(t[o+1]))return o+2}return null}function ll(e){let t=e.findIndex((r)=>gi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!gi(r))break;n++}return n}function gi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return cl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return cl.has(e.slice(0,t))}function sp(e){let t=e?.replaceAll("\\","/");return[...uw].some((n)=>t===n||t?.endsWith(`/${n}`))}var ap="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function lp(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=Sn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>gw(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function gw(e,t){let n=St([...e],t),r=n.slice(1),o=hi(A(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as yi}from"path";var mp="This path contains the protected policy config and you must not modify or delete it.",hw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function fp(e,t,n){let r=Ew(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return cp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?up(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=up(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return cp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Gr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function cp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>kr(a,n,r,o,i));return s?{target:s}:null}function up(e,t,n,r,o){let i=Sn(e,t,r,o,{findSegmentTarget:(s,a)=>yw(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>kr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>vw(s,t,n,r,o)?.target??null});return i?{target:i}:null}function yw(e,t,n,r,o){if(hr(e))return null;let i=vt([...e],r),s=A(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&bw(a)){let l=Cw(a).find((c)=>dp(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Yo(i,1)||Pa(i,r)){let c=(Rr(q(i))??q(["."])).find((u)=>{let m=pe(u.text,t.variables);return kr(m,t.cwd,n,r,o)||dp(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Lo(a).sources.find((c)=>xw(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Sw(i,s))return null;for(let l of[...e,...i])for(let c of pp(l))if(kr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function bw(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Cw(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Sw(e,t){if(!hw.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function vw(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of pp(i))if(kr(s,t,n,r,o))return{target:s};return null}function pp(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Ew(e,t,n){let r=(a)=>Or(le(a,e.executionCwd,t,n)),o=r(Lt(t)),i=[r(cn(e.executionCwd)),r(cn(e.configCwd))],s=new Set(i.map((a)=>yi(a)));for(let a=yi(o);;a=yi(a))if(s.add(a),yi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function kr(e,t,n,r,o){let i=Xl(e,t,r,o,(s)=>Or(s)===Kr);return i!==null&&n.files.has(Or(i))}function dp(e,t,n,r,o){return n.directoriesAndAncestors.has(Or(le(e,t,r,o)))}function xw(e,t,n,r,o){let i=Or(le(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Or(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as bi,posix as wp,resolve as vi,win32 as Rw}from"path";import{fileURLToPath as _w}from"url";var Ap="Access to a sensitive path is not allowed.",Pp=new Set(["echo","printf"]),ww=new Set(["find"]),Aw=new Set(["!","do","elif","else","if","then","until","while"]),Pw=new Set(["-exec","-execdir"]),Iw=new Set([";","+"]),Tw=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),kw=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Ip=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Ow=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Mw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Tp=new Set(["-c","-e","-r","-E","--eval","--exec"]),Dw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Nw=new Set(["grep","rg"]),Lw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),Ww=new Set(["commit","merge","notes","stash","tag"]),Gw=new Set(["-m","--message"]),Fw=new Set(["--grep"]),gp=new Set(["jq","gojq","jaq"]),hp="f",yp="file",zw="files",Bw=new Set(["e","f"]),$w=new Set(["regexp","file"]),Uw=new Set(["e","f","A","B","C","m"]),Hw=new Set(["regexp","file","after-context","before-context","context","max-count"]),ul="__CC_SAFETY_NET_PIPE_INPUT__",ml=/[\w./~@+-]*[./~][\w./~@+-]*/g,jw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Vw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Kw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,bp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Cp=/\b(?:system|exec|spawn|popen)\s*$/,qw=/\b(?:eval|exec)\s*\(/g,Yw=/\b(?:eval|exec)\s*$/,Zw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Sp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(VA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=HA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(Fp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!Si(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Si(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&KA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function kp(e,t,n,r,o={}){let i=vp(e,n,r),s=Sp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Sp(i,t,e.invocation.context.configCwd,n,r,new Set(vp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Xw(e,n)?null:a}function Xw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of No(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=dt(r);if(o.length===0)return!1;let i=je(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return pl(i,o.slice(1))}function pl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>Tw.has(n))}function vp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Ln(s.shell,e.store,r,t,o,n,Jw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Jw(e){return e.program.dialect==="powershell"}function Ln(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...wA(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(cA(c,s),r);return Do(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...Ei(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...eA(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Op(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>tA(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ua;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function gl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Ln(s,t,n,r,o,i):null}function Ei(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(gp.has(je(dt(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Ei(p,t,n,r,o,i)]}let l=lA(e).map(a),c=dt(e);if(c.length===0)return l;let u=c[0]??"",m=je(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!Aw.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&pl(je(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=Qw(u,m,d);if(g)return[...l,...g.map(a)];if(Pp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...Mp(e).map(a)]:l;if(m==="eval")return[...l,...gl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Ze(m,p)).map(a)];if(m==="git")return[...l,...dA(d).map(a)];if(m==="gh")return[...l,...fl(m,d,Lw).map(a)];if(gp.has(m))return[...l,...uA(d).map(a)];if(Nw.has(m))return[...l,...DA(d).map(a)];if(ww.has(m))return[...l,...fA(d,t,n,r,o,i).map(a)];if(Ie.has(m))return[...l,...d.flatMap((p)=>Ze("awk",p)).map(a),...d.flatMap((p)=>gA(p,t,n,r,o,i)),...d.flatMap(hA).map(a)];if(m==="curl")return[...l,...d.filter((p,h)=>Np(p)===null&&Dp(d[h-1])===null).flatMap((p)=>Ze(m,p)).map(a),...mA(d).map(a)];if(yr(m)){let p=gr.has(m)?xe([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Ln(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...pA(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>Ze(m,p)).map(a)]}function Qw(e,t,n){let r=hi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function eA(e,t,n,r,o,i,s){if(iA(t,n,r,o,i,s)){let a=dt(e),l=pl(je(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...Mp(e),...l].map((c)=>({target:c,cwd:i}))}return Op(t,nA(e),n,r,o,i,s,()=>[])}function tA(e,t,n,r,o,i,s){let a=dt(e);if(!yr(je(a[0]??"").toLowerCase()))return[];return gl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Op(e,t,n,r,o,i,s,a){let l=sA(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>gr.has(l)?Ln(n.getShellSyntax(c),n,r,o,i,s):Ci(l,c,n,r,o,i,s))}function Mp(e){let t=dt(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase();if(!Pp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[hl(r.replaceAll("%%","%"))];return t.slice(1)}function nA(e){let t=dt(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return rA(r);return[]}function rA(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[hl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>oA(t,r.slice(i*n,(i+1)*n)))}function oA(e,t){let n=0;return hl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function hl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function iA(e,t,n,r,o,i){let s=dt(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Zt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ul]:l.map((m)=>m.split(c).join(ul));return Ei(u,t,n,r,o,i).some((m)=>m.target.includes(ul))}function sA(e){let t=dt(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!yr(n))return null;return aA(n,t.slice(1))?n:null}function aA(e,t){let n=yl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Tp.has(o)||Lp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(Zw.get(n)?.has(o))r++;continue}return!1}return!0}function yl(e){return/^python\d/.test(e)?"python":e}function lA(e){let t=[];for(let n of e){if(Gp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Ep=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function cA(e,t){if(!t||!Ep.test(e))return e;return`~${e.replace(Ep,"").replace(/\\/g,"/")}`}function Ze(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function uA(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ze("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ze("jq",r))}function dA(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...Ww.has(r)?fl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),Gw):fl("git",e.slice(n),Fw)];if(t.push(...Ze("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ze("git",o)),n++}return t}function fl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ze(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ze(e,i))}return r}function mA(e){return e.flatMap((t,n)=>{let r=Np(t);if(r!==null)return xp(r.flag,r.value);let o=Dp(e[n-1]);return o===null?[]:xp(o,t)})}function xp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return dl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return dl(t.slice(n+1))}return t.startsWith("@")?dl(t.slice(1)):[]}function Dp(e){if(e===void 0)return null;if(Ip.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Np(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Ip.has(r)?{flag:r,value:e.slice(n+1)}:null}function dl(e){return e===""||e==="-"?[]:[e]}function fA(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Pw.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>Iw.has(f)),m=u===-1?c:c.slice(0,u),d=Ei(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!kw.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function pA(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Tp.has(c)||Lp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...Ci(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...Ci(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Lp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Dw.get(t[t.length-1]??"")?.has(yl(e))??!1}function gA(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ra(e)?.commands.flatMap((s)=>Ln(t.getShellSyntax(s),t,n,r,o,i))??[]}function hA(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function yA(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(bl),...e.match(ml)??[]]}function Ci(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=CA(t,bA(e));if(l.kind==="unmaskable")return yA(t).map(a);let c=l.masked.match(bp)!==null||l.literals.some((p)=>Cp.test(l.masked.slice(0,p.start))),u=l.masked.match(qw)!==null||l.literals.some((p)=>Yw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!gr.has(e),d=m&&!(xA(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(bp),(p)=>{let h=p.index+p[0].length;return{start:h,end:ra(l.masked,h)}}):[],g=!m||f.some((p)=>oa(l.masked,p.start))?l.literals:l.literals.filter((p)=>Cp.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>bl(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(ml)??[]).map(a),...c?g.flatMap((p)=>gl(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>Ci(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(ml)??[]).map(a)]}function bA(e){let t=yl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function CA(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(Vw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&EA(e,o))return{kind:"unmaskable"};let a=t==="python"?SA(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=vA(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&Kw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function SA(e,t){return jw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function vA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function EA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function xA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Ow.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Mw.has(i)))continue;if(o.length>1)return!0;if(RA(e,r)===".")return!0;if(_A(e,r+n.length)==="(")return!0}return!1}function RA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function _A(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function wA(e,t,n,r,o,i){return kA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Ln(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...AA(a,r)?PA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function AA(e,t){let n=No(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function PA(e,t){return No(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(bl)}function bl(e){let t=TA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||IA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function IA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function TA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function kA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Yn(o,n))continue;if(Wp(e,r,n)){let i=OA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=MA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function OA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Yn(i,n))continue;if(Wp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function MA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Wp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function DA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===zw)o=!0;if($w.has(m))r=!0;if(d!==void 0){if(m===yp)t.push(d);continue}if(Hw.has(m)){let f=e[l+1];if(m===yp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(Bw.has(h))r=!0;if(Uw.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===hp)t.push(f);continue}let g=e[l+1];if(d===hp&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function dt(e){let t=e.findIndex((n)=>!Gp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Gp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var NA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),LA=".env.",WA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),GA=[".env.example.",".env.sample."];function FA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function zA(e){return e.length>0&&!/\s/.test(e)}function Si(e,t,n,r){let o=Fp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Fp(e,t,n,r){try{return Dr(e,t,n,r)}catch(o){if(o instanceof W)throw o;return""}}var BA=/[?&][^?&=/]+=/,$A=new Set(["node_modules","__pycache__"]),UA=[["vendor","bundle"],["vendor","cache"]];function HA(e,t,n,r,o){if(FA(e))return null;let i=be(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>zA(s)||Si(e,t,r,o);if(WA.has(s)||GA.some((d)=>s.startsWith(d)))return null;let c=B(ZA(e,t,r,o));for(let d of hs){let f=`~/${d.suffixParts.join("/")}`;if((_p(a,f)||_p(c,f))&&ut(d.id,n))return d.id}let u=jA(i,t,n,r,o);if(u)return u;if(NA.has(s))return null;for(let d of gs)if(s===d.basename&&ut(d.id,n))return d.id;if(s.startsWith(LA)&&ut(eo.id,n)&&l())return eo.id;for(let d of ys)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&ut(d.id,n)&&l())return d.id}for(let d of bs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ut(d.id,n))return d.id}if(qA(a))return null;if(!s.includes(".")&&Zn.pattern.test(s)&&ut(Zn.id,n))return Zn.id;if(BA.test(e)&&!Si(e,t,r,o))return null;let m=YA(s,n);if(m)return m;return null}function jA(e,t,n,r,o){return to.find((i)=>{if(!ut(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return N(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return N(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Mr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return N(e,be("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return N(e,s,["auth.json",".credentials.json"])||Nn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return N(e,s,["config.toml"])||a.endsWith(".config.toml")&&N(e,s,[a])}case"secret.cli.gemini":return N(e,te(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[te(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return N(e,te(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Mr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>N(e,be(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return N(e,s,["config.json"])||Nn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return N(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return N(e,s,["server.token"])||Nn(e,s,["credentials"])||Nn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||N(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||N(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=te(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return N(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&N(e,s,[a])||c.some((u)=>Mr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[te(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||N(e,s,["config.json"])||(c?.trim()?Mr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>N(e,be(u,t,r,o),l))}case"secret.cli.pi":return N(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return N(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=be("~",t,r,o);return[te(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),te(s,".local","share","amp")].some((l)=>N(e,l,["secrets.json"]))||Nn(e,te(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),te(be("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>N(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Mr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=te(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=te(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return N(e,be("~/.cursor",t,r,o),["auth.json"])||N(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&en(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return N(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||N(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||N(e,be("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return N(e,be("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||N(e,be("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),be("~/.local/share",t,r,o)].some((s)=>N(e,te(s,"devin"),["credentials.toml"])||Nn(e,te(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),be("~/.config",t,r,o)].some((s)=>N(e,te(s,"devin"),["config.json"]));default:return!1}})?.id??null}var Rp=new WeakMap;function H(e,t,n,r,o){let i=Rp.get(o)??new Map;Rp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=be(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function N(e,t,n){return n.some((r)=>zp(e,te(t,r)))}function Nn(e,t,n){return n.some((r)=>en(B(e),B(te(t,r))))}function Mr(e,t,n,r,o){return zp(e,be(t,n,r,o))}function zp(e,t){return B(e)===B(t)}function te(e,...t){return He([e,...t].filter(Boolean).join("/"))}function VA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Dr(e,t,o,i));return n.some((a)=>en(s,B(Dr(a,r,o,i))))}function KA(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Dr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(D(ve(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?He(D(vi(ve(u)),o.paths,i)):l&&He(D(`${l}/.cc-safety-net`,o.paths,i)));if(m&&en(s,m))return!1;return n.some((d)=>{let f=xs(d);if(f&&wp.basename(s)!==B(f.name))return!1;let g=B(Dr(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return en(s,g)&&!(f&&s===g)})}function qA(e){let t=e.split("/");return t.some((n)=>$A.has(n))||UA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function YA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Cs)if(r===o.extension&&ut(o.id,t))return o.id;for(let o of Ss)if(o.pattern.test(r)&&ut(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ut(e,t){return!t?.disabledRules?.includes(e)}function be(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i)return"";if(!o)return i;let s=Sl(i,o),a=bi(s)?s:He(vi(t,s)),l=He(D(a,n.paths,r));if(!en(l,o)){if(bi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function _p(e,t){return e===t||e.startsWith(`${t}/`)}function ZA(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i||!o)return"";let s=Sl(i,o),a=wp.normalize(bi(s)?s:He(vi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&en(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Dr(e,t,n,r){let{home:o,normalized:i}=Cl(e,n,r);if(!i)return"";let s=o?Sl(i,o):i;return He(D(bi(s)?s:vi(t,s),n.paths,r))}function Cl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(D(ve(r),t.paths,n)):"",i=He(ve(XA(ot(e,t))));return{home:o,normalized:i}}function XA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return _w(e)}catch{return e}}function Sl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return te(t,e.slice(2));return e}function JA(e){if(process.platform==="win32")return!0;return Rw.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&JA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function en(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class tn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var QA={findPolicyMutation:fp,findGitMetadataMutation:Gd,resolveGitMetadata:tP,loadPolicySnapshot:vu,findSensitiveTarget:kp,analyzeCommand:op,getModes:ji},eP=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Bp(e,t){let n={...QA,...t.dependencies},r=oP(e),o=Nr(e)?e.command:r,i=Pt("policy-protection",o,()=>Dd(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Nr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:om,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=Pe(),c=Pt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Pt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let b=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:mp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:b,segment:u.target}}}}let m=Pt("policy-protection",o,()=>lp(i,t.environment,l));if(m){let b=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ap,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:b,segment:m.target}}}}let d=Pt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let b=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ze,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:b,segment:d.target}}}}let f=Pt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...nP(f)},y=g.secretProtection.enabled===!1?null:Pt("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Nr(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let b=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Ap,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:b,segment:y.target}}}}if(!Nr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...vl("command-validation",o),...h};let C=Pt("command-analysis",o,()=>ip(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},rP(i),i.store),e.command,t.trace));if(C.decision){let b=!p.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===vr&&!eP.test(C.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:b?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function tP(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function nP(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function rP(e){return ge(e,"declared-command")?.program}function oP(e){try{return Un(e.input)}catch(t){let n=Nr(e)?e.command:void 0;throw new tn("policy-protection",vl("policy-protection",t instanceof Je?void 0:n,t),t)}}function Pt(e,t,n){try{return n()}catch(r){throw new tn(e,vl(e,r instanceof Je?void 0:t,r),r)}}function vl(e,t,n){let r=n instanceof W||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?wi:Fn,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Nr(e){return e.route.kind==="command"}import{appendFileSync as yP,mkdirSync as bP}from"fs";import{isAbsolute as CP,join as Rl}from"path";import{lstatSync as Up,readdirSync as iP,readFileSync as sP,rmdirSync as aP,statSync as Hp,unlinkSync as lP,utimesSync as cP,writeFileSync as uP}from"fs";import{join as Lr}from"path";function $p(e,t={}){return co(Lt(e,t),e.home).policy.audit.retention_days}var xl=86400000,dP=".last-prune",mP=/^\d{4}-\d{2}$/,fP=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,jp=(e)=>Math.floor(e/xl);function Kp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Hp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Lr(t,dP),i=Hp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&jp(i)===jp(r))return;let s=r-$p(e)*xl,a=new Date(r).toISOString().slice(0,7);for(let l of El(t)){if(l.isDirectory()){pP(Lr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))gP(Lr(t,l.name),s)}uP(o,"",{mode:384}),cP(o,r/1000,r/1000)}catch{}}function pP(e,t,n){for(let r of El(e)){if(!r.isDirectory()||!mP.test(r.name))continue;let o=Lr(e,r.name);for(let i of El(o)){if(!i.isFile())continue;let s=fP.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+xl;if(!Number.isFinite(a)||a>=t)continue;qp(Lr(o,i.name))}if(r.name!==n)Vp(o)}Vp(e)}function gP(e,t){try{let n=Up(e);if(n.mtimeMs>=t)return;let r=sP(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(hP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Up(e).mtimeMs!==n.mtimeMs)return;qp(e)}catch{}}function hP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function El(e){try{return iP(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function qp(e){try{lP(e)}catch{}}function Vp(e){try{aP(e)}catch{}}var SP="2.6.0",vP=1e4,EP=2000,xP=256,RP=32768;function _P(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function wP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function _l(e,t,n,r,o,i,s={}){let a=_P(t);if(!a)return;let l=PP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=xi(ft(n),s.failureStage?Number.POSITIVE_INFINITY:vP),m=xi(ft(r),EP),d=s.toolName?xi(ft(s.toolName),xP):void 0,f=i===null?void 0:xi(ft(i),RP),g=Rl(l,wP(f?.value??null),c.slice(0,7));bP(g,{recursive:!0,mode:448});let p=Rl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Vi)(),v:SP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};yP(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Kp(e,l,s.now)}catch{}}function xi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function AP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&CP(n)?n:null}function PP(e){let t=AP(e);return t?Rl(t,".cc-safety-net","logs"):null}function Zp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Yp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Yp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Yp(e){return"command"in e?e.command??"":""}function Xp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;_l(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Jp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;_l(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function eg(e,t,n){try{let r=Bp(t,{environment:e,...n.guard});return Qp(e,t,r,n),r}catch(r){if(!(r instanceof tn))throw r;throw Qp(e,t,r.evaluation,n,!(r.cause instanceof Je),{stage:r.stage,errorCode:IP(r.cause)}),r}}function Qp(e,t,n,r,o=!0,i){Xp(e,Zp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function IP(e){if(e instanceof W)return K[e.kind].errorCode;if(e instanceof Je)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function nn(e,t={}){return{malformed:!0,denial:zn(t),cwd:e}}function wl(e,t){return{malformed:!0,denial:Ai(e,t),cwd:e.cwd}}function tg(e,t={}){return(n,r)=>{try{return TP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(zn())}}}function TP(e,t,n,r){let o=lc();if(n.cancelled?.(t))return n.block(zn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Jp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Il(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=eg(o,i,{guard:{auditAllowed:mc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof tn))throw l;if(et(Z.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${kl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var kP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>MP(e,t,n),getSessionId:(e)=>LP(e),allow:{action:"allow"},block:(e)=>WP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},ng=OP();function OP(e={}){return tg(kP,e)}function MP(e,t,n){if(!e||typeof e!=="object")return nn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return nn(null);if(!r.input||typeof r.input!=="object")return nn(null,{toolName:r.tool});let o=DP(t);if(!o)return nn(null,{toolName:r.tool});let i=ec(".",[o],n);if(!i)return wl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=NP(t,e);if(!s.ok)return nn(i,{toolName:r.tool});if(!s.command)return Gi(r.tool,r.input,{kind:ki(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return nn(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=tc(a,i,n);if(!l)return wl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return Gi(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function DP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function NP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function LP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function WP(e){return{action:"reject-and-continue",message:Tl(e)}}function GP(e){e.on("tool.call",(t)=>ng(t,e))}export{GP as default};