cc-safety-net 2.5.2 → 2.6.0

package/dist/bin/hook.js

@@ -1,47 +1,49 @@
 #!/usr/bin/env node
-var Sg=["-h","--help"];function ro(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.entries(e.lists??{}),i=Object.fromEntries(n.map(([d])=>[d,!1])),s={},a=Object.fromEntries(o.map(([d])=>[d,[]])),l=[],c=[],u=!1,m=-1;for(let[d,f]of t.entries()){if(d<=m)continue;if(f==="--"){l.push(...t.slice(d+1));break}if(Sg.includes(f)){u=!0;continue}let g=n.find(([,C])=>C.includes(f));if(g){i[g[0]]=!0;continue}let p=r.find(([,C])=>C.includes(f));if(p){let C=t[d+1];if(C===void 0||C.startsWith("-")){c.push(`${f} requires a value`);continue}s[p[0]]=C,m=d+1;continue}let h=o.find(([,C])=>C.includes(f));if(h){let C=t.slice(d+1),b=C.findIndex((v)=>v.startsWith("-")),y=C.slice(0,b===-1?C.length:b);if(y.length===0){c.push(`${f} requires at least one value`);continue}a[h[0]]=[...a[h[0]]??[],...y],m=d+y.length;continue}if(f.startsWith("-")){c.push(`Unknown option for ${e.label}: ${f}`);continue}if(e.positionals==="tail"){l.push(...t.slice(d));break}l.push(f)}if(e.positionals!=="list"&&e.positionals!=="tail")c.push(...l.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:i,values:s,lists:a,positionals:l,help:u,errors:c}}var Wl=require("node:path");var Qi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",ct="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",sr="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ji={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},ir={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},X=Object.freeze({realpathAttempts:{cap:16384,...Ji},processedCandidateBytes:{cap:4194304,...Ji},pathEnvironmentExpansion:{cap:64,...Ji},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...ir},trackedHeredocFiles:{cap:64,...ir},controlFlowStates:{cap:64,...ir},wrapperPeelIterations:{cap:20,...ir},derivedCommandShape:ir});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(X[e].reason);this.kind=e}}function xe(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>X[t].cap)throw new D(t)}}}var vg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function yt(e){return Eg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Eg(e){return vg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var xg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hl(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":xg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Mg=["-h","--help"];function co(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.entries(e.lists??{}),i=Object.fromEntries(n.map(([d])=>[d,!1])),s={},a=Object.fromEntries(o.map(([d])=>[d,[]])),l=[],c=[],u=!1,m=-1;for(let[d,f]of t.entries()){if(d<=m)continue;if(f==="--"){l.push(...t.slice(d+1));break}if(Mg.includes(f)){u=!0;continue}let g=n.find(([,y])=>y.includes(f));if(g){i[g[0]]=!0;continue}let p=r.find(([,y])=>y.includes(f));if(p){let y=t[d+1];if(y===void 0||y.startsWith("-")){c.push(`${f} requires a value`);continue}s[p[0]]=y,m=d+1;continue}let h=o.find(([,y])=>y.includes(f));if(h){let y=t.slice(d+1),b=y.findIndex((E)=>E.startsWith("-")),C=y.slice(0,b===-1?y.length:b);if(C.length===0){c.push(`${f} requires at least one value`);continue}a[h[0]]=[...a[h[0]]??[],...C],m=d+C.length;continue}if(f.startsWith("-")){c.push(`Unknown option for ${e.label}: ${f}`);continue}if(e.positionals==="tail"){l.push(...t.slice(d));break}l.push(f)}if(e.positionals!=="list"&&e.positionals!=="tail")c.push(...l.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:i,values:s,lists:a,positionals:l,help:u,errors:c}}var Bl=require("node:path");var rs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",ut="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",dr="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var ns={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},ur={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},J=Object.freeze({realpathAttempts:{cap:16384,...ns},processedCandidateBytes:{cap:4194304,...ns},pathEnvironmentExpansion:{cap:64,...ns},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...ur},trackedHeredocFiles:{cap:64,...ur},controlFlowStates:{cap:64,...ur},wrapperPeelIterations:{cap:20,...ur},derivedCommandShape:ur});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(J[e].reason);this.kind=e}}function he(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>J[t].cap)throw new N(t)}}}var Dg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function yt(e){return Ng(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ng(e){return Dg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Lg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Vl(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Lg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function es(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function xn(e={}){return{reason:sr,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var wg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function oo(e,t={}){return{...wg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Bl(e){return Hl({...e,redact:yt})}function $l(e){return Hl({...e,redact:yt,askUser:!0})}function Ul(e){return yt(e instanceof Error?e.message:String(e))}var we=require("node:path");var Rg=256,io=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function De(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ar(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z]):(?:[/\\]|$)/,"$1:/")}function Ct(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function os(e,t){return ts(e,0,t)}function ts(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=ns(e,o+2),a=_g(e,o,t);if(a===null){if(io.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Ag(l,t,n),o=a+1;continue}let i=ns(e,o+1);if(!i){r+="$",o++;continue}r+=rs(i,n)??`$${i}`,o+=i.length+1}return r}function _g(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>X.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Ag(e,t,n){let r=e.slice(2,-1),o=ns(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return rs(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(io.has(o))throw new D("pathEnvironmentExpansion");return e}if(!io.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=rs(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":ts(i.slice(s.length),t+1,n);return l?ts(i.slice(s.length),t+1,n):""}function ns(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function rs(e,t){if(!io.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function I(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Vl(n,i);let s=t.realpath(i);if(s!==null)return jl(n,e,s,o);let a=we.dirname(i);if(a===i||o.length>=Rg)return jl(n,e,i,o);o.push(we.basename(i)),i=a}}function jl(e,t,n,r){let o=r.length===0?n:we.join(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Pg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Vl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Vl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ge(e,t,n,r){let o=ql(e,t,n);if(!o)return"";return I(o,n.paths,r).replace(/\\/g,"/")}function Kl(e,t,n,r,o){let i=ql(e,t,n);if(!i)return null;if(o(we.basename(i)))return I(i,n.paths,r).replace(/\\/g,"/");let s=Pg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function ql(e,t,n){let r=n.home,o=os(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?we.resolve(r,o.slice(2)):o,s=De(i);return we.normalize(we.isAbsolute(s)?s:we.resolve(t,s))}var ec=require("node:util"),Tg=new Set(["applypatch","patch"]),kg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Ig=new Set(["grep","grepsearch","rg"]),Og=new Set(["find","findbyname","glob"]),Mg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Dg=new Set(["command","diff","input","patch","patchtext"]),Yl=new TextEncoder,Ng=new TextDecoder,Lg=/\s/,Wg=64;class be extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var lr=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function tc(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function ao(e){return Mg.has(tc(e))}function nc(e){let t=tc(e);if(Tg.has(t))return"patch";if(Ig.has(t))return"grep";if(Og.has(t))return"glob";if(kg.has(t))return"path";return"unknown"}function Nt(e){if(!e||typeof e!=="object")return;ac(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)ut();return}if(t.get||t.set)ut();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function lo(e,t){return rc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function rc(e,t,n,r,o){let i=sc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>rc(l,t,i.array?n:t.has(oc(a)),r,o+1));return r.ancestors.delete(i.object),s}function oc(e){return e.replace(/-/g,"_").toLowerCase()}function co(e){return ic(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Fg)}function ic(e,t,n,r){let o=sc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>ic(a,o.array?t:Dg.has(oc(s)),n,r+1));return n.ancestors.delete(o.object),i}function Gg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>lr.maxDepth||t.nodes>lr.maxNodes)ut();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>lr.maxStringBytes||t.stringBytes>lr.maxAggregateStringBytes)ut()}function sc(e,t,n){if(Gg(e,t,n),!e||typeof e!=="object")return null;let r=ac(e);if(t.ancestors.has(e))ut();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>lr.maxKeys)ut();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)ut();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function ac(e){if(ec.types.isProxy(e))ut();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)ut();return t}function ut(){throw new be}function Fg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=zg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...is(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...is(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...as(so(c.slice(4),!0),so(u.slice(4),!0))),l++;continue}if(!r)t.push(...is(c))}return t}function zg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function is(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ql(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ql(n[1]);if(e.startsWith("diff --git "))return Hg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Jl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Jl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return qg(i[1]);return[]}function Hg(e){let t=Bg(e);if(t.length===2&&t[0]&&t[1])return as(t[0],t[1]);let n=$g(e);return n?as(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Bg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(en(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!en(e[n]))n++;t.push(e.slice(i,n));continue}let o=lc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(en(e[n]))n++;return n===e.length?t:[]}function $g(e){let t=0;while(t<e.length&&en(e[t]))t++;let n=e.length;while(n>t&&en(e[n-1]))n--;let r=0,o=t;while(o<n){if(!en(e[o])){o++;continue}let i=o;while(o<n&&en(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Wg)ut();if(Ug(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Ug(e,t,n,r,o){if(ss(e,t,n,r,o))return!0;let i=Zl(e,"/",t,n),s=Zl(e,"/",r,o);if(i<=t||s<=r)return!1;if(ss(e,t,i,r,s))return!1;return ss(e,i+1,n,s+1,o)}function ss(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Zl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function en(e){return e!==void 0&&Lg.test(e)}function lc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Ng.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Yl.encode(jg(s[0]??""))),o+=2}return null}function jg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Vg(e){return cr(Yg(e))}function as(e,t){if(e==="/dev/null")return Xl(t);if(t==="/dev/null")return Xl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(cr);let n=Kg(e,t)??(e===t?cc(e):null);return[e,t,...n?[n]:[]].flatMap(cr)}function Xl(e){let t=cc(e);return[e,...t?[t]:[]].flatMap(cr)}function cc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Kg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Jl(e){return Vg(so(e,!0))}function qg(e){return cr(so(e,!1))}function so(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=lc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Yg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function cr(e){return e===""||e==="/dev/null"?[]:[e]}function Ql(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Ye=require("node:path");function bt(e,t,n){if(Ct(e))return;let r=t.flatMap((i)=>uo(i,n));if(!r[0])return;let o=uo(Ye.isAbsolute(e)?e:Ye.resolve(r[0],e),n)[0];if(!o)return;return r.some((i)=>ur(o,i))?o:void 0}function ls(e,t,n){if(Ct(e))return;return uo(Ye.isAbsolute(e)?e:Ye.resolve(t,e),n)[0]}function St(e,t){return e.flatMap((n)=>uo(n,t))[0]}function vt(e,t,n){return ls(e,t,n)?"outside-workspace":"unusable"}function uo(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function ur(e,t){let n=Ye.relative(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ye.sep}`)&&!Ye.isAbsolute(n)}var Zg=8388608;async function uc(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>Zg)throw Xg(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function Xg(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function mo(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function se(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:nc(e)}}function dc(e,t,n,r,o,i){let s=e===void 0?i:e;if(typeof s!=="string"||s.trim()==="")return Se(r,t,n),null;let a=St([s],o);if(a)return{configCwd:a,executionCwd:a};return $e(r,t,n,{directory:"session",problem:"unusable",cwd:s}),null}function Se(e,t,n){e(xn({command:mc(t),toolName:n}))}function $e(e,t,n,r){e(oo(r,{command:mc(t),toolName:n}))}function mc(e){try{return Nt(e)}catch(t){if(!(t instanceof be))throw t;return}}var Rn=require("node:fs"),fo=require("node:os");var Cc=require("node:fs"),bc=require("node:path");var pc=require("node:child_process"),H=require("node:fs"),re=require("node:path"),Jg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Qg=5000;function gc(e,t=hh(),n=Qg){let r=eh(e),o=r===null?null:th(r);if(r===null||o===null)return null;let i=ph(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function eh(e){try{let t=H.realpathSync(re.resolve(e));return H.statSync(t).isDirectory()?t:null}catch{return null}}function th(e){let t=fh(e);if(!t)return null;try{let n=H.lstatSync(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=cs(t);if(!r?.commonDir)return null;if(!oh(r.gitDir,t))return null;return ih(r.gitDir,re.dirname(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function cs(e){try{let t=nh(e);if(!t)return null;let n=H.realpathSync(re.isAbsolute(t)?t:re.resolve(re.dirname(e),t));if(!H.statSync(n).isDirectory())return null;return{gitDir:n,commonDir:rh(n)}}catch{return null}}function nh(e){let t=H.readFileSync(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function rh(e){try{let t=H.readFileSync(re.join(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=H.realpathSync(re.isAbsolute(t)?t:re.resolve(e,t));return H.statSync(n).isDirectory()?n:null}catch{return null}}function oh(e,t){let n=sh(e);return n===null?!1:hc(e,n,t)}function ih(e,t){let n=ah(e);return n===null?!0:hc(e,n,t)}function sh(e){let t=re.join(e,"gitdir");if(!H.existsSync(t))return null;let n=H.readFileSync(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function ah(e){let t=re.join(e,"config.worktree");return H.existsSync(t)?ch(t):null}function hc(e,t,n){try{return lh(re.isAbsolute(t)?t:re.resolve(e,t),n)}catch{return!1}}function lh(e,t){try{let n=H.statSync(e),r=H.statSync(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return fc(H.realpathSync.native(e))===fc(H.realpathSync.native(t))}function fc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function ch(e){let t=H.readFileSync(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=uh(s[1]??"")}return r}function uh(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return mh(t.slice(1,-1))}var dh={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function mh(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:dh[n]??t)}function fh(e){try{return us(H.realpathSync(e))}catch{return null}}function us(e){let t=e;while(!0){let n=re.join(t,".git");if(H.existsSync(n))return n;let r=re.dirname(t);if(r===t)return null;t=r}}function ph(e,t,n,r){if(gh(t))return!0;if(n===null)return!0;let o=pc.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:yh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&yc(o.stdout.trim())}function gh(e){return[re.join(e.commonDir,"config"),re.join(e.gitDir,"config.worktree")].filter((t)=>H.existsSync(t)).some((t)=>Ch(t))}function hh(){return Jg.find((e)=>H.existsSync(e))??null}function dr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function yh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!dr(t)))}function Ch(e){let t;try{t=H.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(bh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=yc(c)}return r}function bh(e){return e==="include"||e.startsWith("includeif ")}function yc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Sc(e,t){if(e==="")return null;let n=xe(),r=us(ge(e,e,t,n)),o=r?Sh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Sh(e,t,n,r){try{let o=ge(e,t,n,r),i=Cc.statSync(e),s=i.isFile()?o:null,a=i.isFile()?cs(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[wn(ge(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[wn(e.replace(/\\/g,"/")),...l]:l)];return{entry:wn(o),markerFile:s?wn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=wn(bc.join(u,"hooks").replace(/\\/g,"/"));return[m,wn(ge(m,t,n,r))]}))]}}catch{return null}}function wn(e){return process.platform==="win32"?e.toLowerCase():e}var vh={realpath:(e)=>{try{return Rn.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=Rn.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Rn.statSync(e).isDirectory()}catch{return!1}}};function Ec(){return Eh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:De(process.env.HOME||fo.homedir()),tmpdir:fo.tmpdir(),paths:vh})}function Eh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>vc(n,i,()=>Sc(i,o)),worktreeFacts:(i)=>vc(r,i,()=>gc(i)),...t};return o}function vc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var _n=["fail_closed","paranoid_rm","paranoid_interpreters"],po={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var te={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},go=["standard","strict","paranoid"];function xc(e,t){if(!t)return e;return go.indexOf(t)>go.indexOf(e)?t:e}function wc(e){let t=ho(te.level,e);return go.find((n)=>n===t)}function Rc(e,t){return xc(e,wc(t))}function xh(e){let t=ho(te.level,e);if(!t)return;let n=wc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${te.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${go.join(", ")}.`);return}function wh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function _c(e){return wh(ho(te.auditScope,e))==="all"}function ms(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function fs(e={},t){let n=e.safety?.level??"standard",r=xh(t),o=xc(n,r),i=po[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${te.level.name}=${r}`),l.paranoidRm.push(`env ${te.level.name}=${r}`),l.paranoidInterpreters.push(`env ${te.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Et(te.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${te.strict.name}`);if(Et(te.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${te.paranoid.name}`),l.paranoidInterpreters.push(`env ${te.paranoid.name}`);if(Et(te.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${te.paranoidRm.name}`);if(Et(te.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${te.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Et(te.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:ms(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Et(e,t){let n=typeof e==="string"?ds(e,t):ho(e,t);return n==="1"||n?.toLowerCase()==="true"}function ds(e,t){return t.get(e)}function ho(e,t){let n=ds(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ds(e.legacyName,t);return}function Ac(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var gr=require("node:path");var G=require("node:fs"),V=require("node:path");function ps(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Rh=Symbol("PolicyFilesystemScope"),_h=Symbol("PolicyFilesystemTarget"),Ah=G.constants.O_NOFOLLOW??0;class he extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function tn(e,t){return{[Rh]:!0,root:V.resolve(e),label:t}}function Pc(e,t){let n=V.normalize(t);if(t===""||V.isAbsolute(t)||n===".."||n.startsWith(`..${V.sep}`))throw new he(e.label);return{[_h]:!0,scope:e,relativePath:n,path:V.join(e.root,n)}}function mr(e,t){return Pc(e,V.relative(e.root,V.resolve(t)))}function Tc(e,t="rules policy"){let n=V.resolve(e),r=V.parse(n).dir;return Pc(tn(r,t),V.relative(r,n))}function Co(e){return Ic(e.scope.label,()=>{if(!yo(e))return null;let t=G.openSync(e.path,G.constants.O_RDONLY|Ah);return Ph(t,()=>{let n=G.fstatSync(t);if(!n.isFile())throw new he(e.scope.label);let r=G.readFileSync(t,"utf-8"),o=G.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new he(e.scope.label);return yo(e),r})})}function kc(e,t){if(e.path===t.path)return!0;return Ic(e.scope.label,()=>{if(!yo(e)||!yo(t))return!1;let n=(r)=>V.join(G.realpathSync(V.parse(r).dir),V.parse(r).base);return n(e.path)===n(t.path)})}function Ic(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof he)throw r;throw new he(e)}}function Ph(e,t){try{return t()}finally{G.closeSync(e)}}function yo(e,t="file"){let n=Th(e.scope);if(!n)return!1;let r=e.relativePath.split(V.sep);for(let o of r.keys()){let i=V.join(e.scope.root,...r.slice(0,o+1)),s=G.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new he(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new he(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new he(e.scope.label);kh(n,G.realpathSync(i),e.scope.label)}return!0}function Th(e){if(!G.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!G.statSync(e.root).isDirectory())throw new he(e.label);return G.realpathSync(e.root)}function kh(e,t,n){let r=V.relative(e,t);if(r===".."||r.startsWith(`..${V.sep}`)||V.isAbsolute(r))throw new he(n)}var L=require("node:path");var nn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Oc="rulebook.json",Mc=".cc-safety-net/rules";var Dc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ih=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Oh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Mh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),HP=new RegExp(`^${Oh}/(${nn.source.slice(1,-1)})/${Mh}$`);function Dh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Nc(e){if(bo(e))try{return gs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return nn.test(e)?null:`Local rulebook sources must be bare names matching ${nn}: ${e}`}function gs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Dc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ih.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!nn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Dh(o),name:o}}function bo(e){return Dc.test(e)}var Lc="rule.json",So="policy.json",Wc=".cc-safety-net",Nh="rules",Lh="CC_SAFETY_NET_HOME",Gc="`cc-safety-net rule update`";function Wh(e){return L.resolve(e,Mc)}function Gh(e){return L.join(Wh(e),Lc)}function fr(e){return L.join(L.resolve(e),Wc,So)}function hs(e,t={}){return t.userConfigDir??(t.userConfigPath?L.dirname(t.userConfigPath):L.join(Fh(e),Nh))}function Fh(e){let t=e.env.get(Lh);return t?L.resolve(De(t)):L.join(e.home,Wc)}function zh(e,t={}){return L.join(hs(e,t),Lc)}function An(e,t={}){return L.join(L.dirname(hs(e,t)),So)}function Fc(e,t){let n=t.userConfigPath??zh(e,t),r=t.projectConfigPath??Gh(t.cwd),o=Hh(e,t),i=Bh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:mr(o,n),projectConfigTarget:mr(i,r)}}function Hh(e,t){let n=t.userConfigPath?L.dirname(L.dirname(L.resolve(t.userConfigPath))):L.dirname(L.resolve(t.userConfigDir??hs(e,t)));return tn(n,"user policy")}function Bh(e,t){let n=L.resolve(t),r=L.resolve(e),o=L.relative(n,r);if(o!==".."&&!o.startsWith(`..${L.sep}`)&&!L.isAbsolute(o))return tn(n,"project policy");return tn(L.dirname(L.dirname(r)),"project policy")}function zc(e,t){return L.join(e,t,Oc)}var Ne=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),Lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Wt=256,Q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Hc=new Set(["python","python3","python2","node","ruby","perl"]),vo=/^python(?:[23](?:\.\d+)*)?$/,Ue=new Set(["awk","gawk","nawk","mawk"]),Eo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Bc="Rulebook exceeds CC Safety Net's safe validation limits.",$c="Additional rulebook validation errors were omitted.",Ze=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Uc(e){if(ys(e.allowed_commands,Ze.maxAllowedCommands)||ys(e.rules,Ze.maxRules)||ys(e.tests,Ze.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ze,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ze.maxStringCodeUnits||i&&o.length>Ze.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ze.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ys(e,t){return Array.isArray(e)&&e.length>t}var Cs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var bs=64,Ss="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return A(e).toLowerCase()}function A(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function Re(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var $h={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},vs=new Set(["--init-file","--rcfile"]);function Es(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!$h[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Le(e){let t=A(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&vs.has(l)&&!s.includes("="))i++;continue}let a=Es(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function pr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function xo(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Uh(e))pr(n,t);return t.inSingle||t.inDouble}function Uh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);pr(s,n)}return t}var xs=new Set(["rm","find","xargs","parallel"]),jh=new Set(["git","busybox",...xs,...Q,...Hc,...Ue]),Vh=new Set(["python","node","ruby","perl"]);function jc(e){let t=O(e);return jh.has(t)||Xe(t)}function Xe(e){return Vh.has(Kh(e))}function Kh(e){let t=A(e).toLowerCase();return vo.test(t)?"python":t}function ws(e){try{let t=Co(qh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Xh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof he)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function qh(e){return typeof e==="string"?Tc(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),ue=(e,t)=>({path:e,message:t,kind:"custom"});function Vc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Pn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ue(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Rs=`must be one of ${Cs.join(", ")}`,Yh=/^[^/]+\/[^/]+$/,Zh=["version","rules","overrides","transparent_wrappers"];function Xh(e){let t=Jh(e);return{errors:_s(ay(t,Zh,(n)=>n.kind==="custom"),": "," "),sources:sy(e,t)}}function Jh(e){if(!Pn(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>bs;return[...e.version===1?[]:[w(["version"],"must be 1")],...Qh(e.rules,t),...ny(e.overrides),...oy(e.transparent_wrappers),...t?[]:ty(e.rules),...Pn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Yh.test(n)).map((n)=>ue(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...iy(e.transparent_wrappers)]}function Qh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),...Kc(e,bs)?[w(["rules"],Ss)]:[]];if(t)return[{path:["rules"],message:Ss,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...ey(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Kc(e,t){let n=qc(e);return n!==void 0&&!(n<=t)}function ey(e,t){let n=qc(e);return n!==void 0&&!(n>=t)}function qc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ty(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ue(["rules",r],"must be a non-empty rulebook source string")];let o=Nc(n);if(o)return[ue(["rules",r],o)];if(t.has(n))return[ue(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function ny(e){if(e===void 0)return[];if(!Pn(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Pn(n))return[w(["overrides",t],'must be "off" or an object')];return[...ry(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Ps(n.intent)?[]:[w(["overrides",t,"intent"],Rs)]]})}function ry(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),...Kc(e,Wt)?[w(t,`must be at most ${Wt} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>Wt?[w(t,`must be at most ${Wt} characters`)]:[]}function oy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return Lt.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function iy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!Lt.test(n))return[];if(t.has(n))return[ue(["transparent_wrappers",r],`duplicate command "${n}"`)];if(jc(n))return[ue(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function sy(e,t){let n=Pn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function ay(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function _s(e,t,n){return[...new Set(e.map((r)=>{let o=As(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function As(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Ps(e){return Cs.includes(e)}function Pn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Zc(e){let t=uy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ly=`required non-empty string up to ${Wt} characters`,Yc="must be a non-empty array of unique non-empty strings",cy="required non-empty array of non-empty strings";function uy(e){if(!Gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Uc(e))return{errors:[Bc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],..._s(dy(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ze.maxValidationErrors?[...t.slice(0,Ze.maxValidationErrors),$c]:t,ruleNames:new Set(Xc(e).map((n)=>n.toLowerCase()))}}function Xc(e){let t=Gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function dy(e,t){return[...typeof e.name==="string"&&nn.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...my(e.allowed_commands),...fy(e.rules,t),...yy(e.tests),...Cy(e),...by(e)]}function my(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&Lt.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!Lt.test(n))return[];if(t.has(n))return[ue(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function fy(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!Gt(n))return[w(["rules",r],"must be an object")];return t?gy(n,["rules",r]):py(n,["rules",r])}),...Vc(e)]}function py(e,t){return[...Jc(e.name,t),...Qc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&Lt.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...wo(e.block_args,[...t,"block_args"],"required non-empty array",!1),...eu(e.reason,t),...tu(e.intent,t)]}function gy(e,t){return[...Jc(e.name,t),...Qc(e.command,t),...eu(e.reason,t),...tu(e.intent,t),...hy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function Jc(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return nn.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function Qc(e,t){return typeof e==="string"&&Lt.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function eu(e,t){return typeof e==="string"&&e!==""&&e.length<=Wt?[]:[w([...t,"reason"],ly)]}function tu(e,t){return e===void 0||Ps(e)?[]:[w([...t,"intent"],Rs)]}function hy(e,t){if(!Gt(e))return[w(t,"required object")];return[...wo(e.command_path,[...t,"command_path"],cy,!1),...e.any_args===void 0?[]:wo(e.any_args,[...t,"any_args"],Yc,!0),...e.exclude_args===void 0?[]:wo(e.exclude_args,[...t,"exclude_args"],Yc,!0)]}function wo(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[ue([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ue(t,n)]:[],...r&&new Set(e).size!==e.length?[ue(t,"must not contain duplicate values")]:[]]}function yy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!Gt(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ue(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Cy(e){if(!Array.isArray(e.tests))return[];let t=new Set(Xc(e));return[...new Set(e.tests.flatMap((n)=>Gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ue(["tests"],`blocked fixture references unknown rule "${n}"`))}function by(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=Gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ue(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function Gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function au(e,t){let n=Fc(e,t),r;try{r=kc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof he)return Py(n,f.message);throw f}let o=ws(n.userConfigTarget),i=r?{config:null,errors:[]}:ws(n.projectConfigTarget),s=iu(n.userConfigPath,o.errors),a=iu(n.projectConfigPath,i.errors),l=new Set,c=o.config?nu(o.config,gr.dirname(n.userConfigPath),"user",n.userScope,l):su(),u=i.config?nu(i.config,gr.dirname(n.projectConfigPath),"project",n.projectScope,l):su(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...ru(c.rules,m),...ru(u.rules,d)],transparent_wrappers:_y(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?ou(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Ay(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?ou(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function nu(e,t,n,r=tn(gr.dirname(gr.dirname(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=vy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Sy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Sy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function vy(e,t,n){let r=Ey(e),o=zc(t,r),i=wy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${xy(e)}`]};let s=Ry(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ey(e){return bo(e)?gs(e).name:e}function xy(e){return bo(e)?`run ${Gc} to vendor ${e}`:"create that file or remove that source from the rules config"}function wy(e,t){try{return{content:Co(mr(t,e))}}catch(n){if(n instanceof he)return{error:n.message};throw n}}function Ry(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Zc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function _y(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function ru(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function ou(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Ay(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function iu(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Py(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function su(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}var No=require("node:fs");var lu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ts=new Set(lu.map((e)=>e.id)),Ro=lu,Ty=new Map(Ro.map((e)=>[e.id,e.intent]));function E(e,t){return{id:e,reason:t,intent:Ty.get(e)??"manual_only"}}var ks=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],_o={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},ky=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Iy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Iy.flatMap((e)=>ky.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ao=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],cu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Oy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Os=cu.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ms=cu.flatMap((e)=>Oy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),hr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ds=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ns=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],My=[...ks,_o,...Is,...Os,...Ms,hr,...Ds,...Ns,...Ao].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Po=new Set(Ao.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Ls=new Set(My.map((e)=>e.id));var We=require("node:path"),To=process.platform==="win32",uu=/[*?]/;function Ws(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(To?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(uu.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function yr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Gs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=yr(e.trim(),t);if(!We.isAbsolute(n))return"must be an absolute path or start with ~/";return Cr(n,t)}function Fs(e,t){let n=du(e,t);if(n===null)return"must be a non-empty path string";if(!We.isAbsolute(n))return null;if(Cr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Dy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ny="cannot cover the guard's own configuration";function du(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=To?n.replaceAll("\\","/"):n;return yr(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function zs(e,t){let n=du(e,t);if(n===null)return"must be a non-empty path string";let r=Ws(n)?.root??n;if(uu.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!We.isAbsolute(r))return null;if(Cr(r,t)!==null)return Dy;return Ly(r,t)?Ny:null}function Ly(e,t){let n=ko(e),r=ko(We.join(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${We.sep}`)}function Cr(e,t){let n=ko(e),r=ko(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(We.sep)?n:`${n}${We.sep}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function ko(e){let t=We.normalize(e);if(To)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(To?3:1)&&t.endsWith(We.sep))t=t.slice(0,-1);return t}var mu=30,Io=1,Oo=365;function fu(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var pu=new Set(Ro.filter((e)=>e.catastrophic).map((e)=>e.id));function _(e,t){if(!e)return null;if(pu.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ae(e,t,n){if(pu.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function gu(e,t){return Object.freeze(Object.fromEntries(Ro.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function hu(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:gu(e,t)})}var yu={standard:0,strict:1,paranoid:2};function Su(e,t,n=!1,r=e.safety.level){let o=Wy(e,t,r),i=new Set(n?o.map((u)=>u.field):[]),s=(u,m)=>i.has(u)?void 0:m,a=(u,m)=>Object.fromEntries(Object.entries(m??{}).filter(([d])=>!i.has(`${u}.${d}`))),l=(u,m)=>m?.filter((d)=>!i.has(`${u}.${d}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:Hs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:Hs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Hs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((u)=>u.message)}}function Hs(e,t){return[...new Set([...e,...t??[]])]}function Wy(e,t,n){let r=t.safety?.level,o=po[n];return[...r&&yu[r]<yu[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],..._n.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Cu("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...Cu("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!Po.has(i))),...e.destructive_command_protection.enabled?bu(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?bu(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function Cu(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function bu(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Us=new Set(["standard","strict","paranoid"]),wu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:mu}};function Ru(e,t){let n=Ky(An(e,t),e.home),r=Lo(fr(t.cwd),e.home),o=Fy(r.parsed,e.home),i=Et(te.projectTightenOnly,e.env),s=n.gui??wu,a=Object.keys(o.policy).length>0?Su(s,o.policy,i,Rc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),u=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?$s(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:u,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var Gy="project policy audit settings are ignored; audit is user scope only";function Fy(e,t){if(!Ge(e))return{policy:{},diagnostics:[]};let n=Ge(e.safety)?e.safety:{},r=Ge(e.workflow)?e.workflow:{},o=Ge(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ge(e.secret_protection)?e.secret_protection:{},s={...Us.has(n.level)?{level:n.level}:{},...Ge(n.overrides)?vu({overrides:_u(n.overrides,_n,["safety","overrides"],rn)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Do(o.overrides,Ts,Pu,rn)}:{},...o.allow_paths!==void 0?{allow_paths:kn(o.allow_paths,Gs,t,["destructive_command_protection","allow_paths"],rn)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Do(i.overrides,Ls,Tu,rn)}:{},...i.deny_paths!==void 0?{deny_paths:kn(i.deny_paths,Fs,t,["secret_protection","deny_paths"],rn)}:{},...i.allow_paths!==void 0?{allow_paths:kn(i.allow_paths,zs,t,["secret_protection","allow_paths"],rn)}:{}};return{policy:vu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Gy]}}function _u(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],js));return[]}))}function vu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var rn=()=>{return},js="must be a boolean",Vs="must be an object if provided",Au=`must be an integer between ${Io} and ${Oo}`,Pu={path:["destructive_command_protection","overrides"],label:"destructive command"},Tu={path:["secret_protection","overrides"],label:"secret protection"},zy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Hy(e,t){let n=[];return{policy:ku(e,t,(o)=>{n.push(o)}),issues:n}}function By(e,t){return ku(e,t,rn)}function ku(e,t,n){if(!Ge(e))return n(w([],"Config must be an object")),Mo();if(e.version!==1)n(w(["version"],"must be 1"));let r=Tn(e.safety,["safety"],["level","overrides"],n),o=Tn(r.overrides,["safety","overrides"],_n,n),i=Tn(e.workflow,["workflow"],["worktree_mode"],n),s=Tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=Tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=Tn(e.audit,["audit"],["retention_days"],n);return Iu(e,zy,[],n),{version:1,safety:{level:$y(r.level,n),overrides:_u(o,_n,["safety","overrides"],n)},workflow:{worktree_mode:Bs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Bs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Do(s.overrides,Ts,Pu,n),allow_paths:kn(s.allow_paths,Gs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Bs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Do(a.overrides,Ls,Tu,n),deny_paths:kn(a.deny_paths,Fs,t,["secret_protection","deny_paths"],n),allow_paths:kn(a.allow_paths,zs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Uy(l.retention_days,n)}}}function Tn(e,t,n,r){if(e===void 0)return{};if(!Ge(e))return r(w(t,Vs)),{};return Iu(e,n,t,r),e}function Iu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function $y(e,t){if(e===void 0)return"standard";if(Us.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Bs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,js));return n}function Uy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Io&&e<=Oo))t(w(["audit","retention_days"],Au));return fu(e)}function Do(e,t,n,r){if(e===void 0)return{};if(!Ge(e))return r(w(n.path,Vs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function kn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ue([...r,s],a):w([...r,s],a)),[]})}function Ge(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Mo(){return structuredClone(wu)}function Lo(e,t){if(!No.existsSync(e))return{exists:!1,policy:Mo(),errors:[]};try{let n=No.readFileSync(e,"utf-8");if(!n.trim())return{exists:!0,policy:Mo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Hy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Vy(i)}`),fallback:Ge(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Mo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var jy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Vs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[js,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Au,`not an integer between ${Io} and ${Oo}`]]);function Vy(e){let t=As(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=jy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Ky(e,t){let n=Lo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ge(r))return{policy:xu(),errors:[]};let o=By(r,t);return{policy:$s(o),gui:o,errors:[],levelPresent:Eu(r)}}if(n.parsed===void 0)return{policy:xu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:$s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Eu(n.parsed)}}function Eu(e){let t=Ge(e)&&Ge(e.safety)?e.safety:{};return Us.has(t.level)}function Ou(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Po].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function xu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Ou({}),denyPaths:[],allowPaths:[]}}}function $s(e){return{safety:qy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Ou(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function qy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Mu(e,t){let n=au(e,t),r=Ru(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Jy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Qy(o,Yy(n,r),s,r.policyScopes)}function Yy(e,t){let n=Xy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:eC(e.errors.length>0?Zy(e.errors):void 0,e.warnings.length>0?qs(e.warnings.join("; ")):void 0,n)}}function Zy(e){return`${qs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Xy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Jy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Qy(e,t,n=Object.freeze({}),r){let o=Ks(structuredClone(e)),i=r?{policyScopes:Ks(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ks(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ks(t);return Object.freeze(e)}function eC(...e){return qs(e.filter((t)=>!!t).join("; "))}function qs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Du(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ys(t.fail_closed,e.strict,"strict"),paranoid_rm:Ys(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ys(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:hu(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:ms({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ys(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}var qe=require("node:path");function br(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var tC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Wo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Sr(e){let t=Wo(e.words[0],"time")?1:0,n=t===1&&Wo(e.words[t],"-p")?t+1:t,r=t===1&&Wo(e.words[n],"--")?n+1:n,o=Wo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!tC.test(s.text));return i?.provenance==="literal"?i.text:void 0}var Ft=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Go(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function nC(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>_e(t)))})}function Fo(e,t,n){e.push(n),t.reset()}function zo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Zs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function In(e,t,n,r,o,i,s){return Zs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function _e(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return nC(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:_e(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Xs(e,t,n){if(t>=n||Lu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Lu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Nu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Nu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Js(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=rC(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?oC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Nu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Lu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function rC(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function oC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var zu=new Set(["&&","||","|","|&"]),iC=new Set(["!","do","elif","else","if","then","until","while"]);function Hu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return _e({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=$o(e,0,e.length,t,{used:0,max:t.maxWords},0);return _e({kind:"program",dialect:"posix",source:e,span:n,status:Vo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function $o(e,t,n,r,o,i,s){let a=[],l=[],c=Go(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);Fo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),Fu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(jo(f)){if(f===`
-`||f==="\r"){m();let T=f==="\r"&&e[d+1]===`
-`?d+2:d+1,k=a.at(-1);if(k?.kind!=="connector"||!zu.has(k.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,T),span:Object.freeze({start:d,end:T})}));if(u.length>0){let N=Js(e,T,n,u.splice(0));l.push(...N.issues),d=N.next;continue}d=T;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let g=c.start===-1?_C(e,d,n):void 0;if(g){if(ea(a,l),i>=r.maxDepth)return On(a,l,d,"depth-limit",r.maxDepth);if(!Qs(o))return On(a,l,d,"word-limit",r.maxWords);let T=$o(e,g.braceIndex+1,n,r,o,i+1,"}"),k=T.next,N={start:g.braceIndex+1,end:T.closed?k-1:k},ee=Wu(e,N,T);if(a.push({kind:"function",name:g.name,span:{start:d,end:k},body:ee}),l.push(...T.issues),T.pendingHeredocs.length>0||Er(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return Bo(a,l,T.next);if(!T.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=k;continue}let p=Uo(e,d);if(p){if(m(),!Yu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&fC(e,d,n))&&c.start===-1){if(ea(a,l),i>=r.maxDepth)return On(a,l,d,"depth-limit",r.maxDepth);let T=f==="("?")":"}",k=$o(e,d+1,n,r,o,i+1,T),N=k.next,ee={start:d+1,end:k.closed?N-1:N},Ce=Wu(e,ee,k);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:N},body:Ce}),l.push(...k.issues),k.pendingHeredocs.length>0||Er(k.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...k.pendingHeredocs),k.limited)return Bo(a,l,k.next);if(!k.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=N;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?cC(e,d):null;if(h){let T=c.words.at(-1),k=T&&T.span.end===d&&/^[0-9]+$/.test(T.raw)?Number(T.raw):void 0;if(k!==void 0)c.words.pop();let N=k===void 0?d:T?.span.start??d;c.start=c.start===-1?d:c.start;let ee=d+h.length;while(ee<n&&/[ \t]/.test(e[ee]??""))ee++;let Ce=e[ee],ht=ee>d+h.length&&Ce==="#",Oe=!Ce||jo(Ce)||!!Uo(e,ee)||Ce===s||Ce===")"||ht||(Ce==="<"||Ce===">")&&e[ee+1]!=="(",Jt=h==="<<"||h==="<<-",U=Jt?Xs(e,ee,n):void 0,W=U?{word:In(e,ee,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!Oe?ta(e,ee,n,r,o,i):void 0;if(W){if(l.push(...W.issues),W.limited)return Bo(a,l,W.next);if(!Qs(o))return On(a,l,W.next,"word-limit",r.maxWords)}let pe=W?.next??d+h.length,oe={kind:"redirection",operator:h,span:{start:N,end:pe},...k===void 0?{}:{fd:k},...W?{target:W.word}:{}};if(c.redirections.push(oe),Jt&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let ie=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(Me)=>{if(oe.heredoc=Me,Me.quotedDelimiter)return;ie.push(...aC(e,Me.bodySpan.start,Me.bodySpan.end,r,o,i+1))}})}if(!Jt&&!W)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(W)c.nested.push(...W.nested);c.end=pe,d=pe;continue}let C=c.start===-1;if(C)ea(a,l);let b=ta(e,d,n,r,o,i);if(l.push(...b.issues),b.limited)return Bo(a,l,b.next);let y=hC(c.words)?vC(e,b.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(y?.limitCode)return On(a,l,b.next,y.limitCode,y.limitCode==="word-limit"?r.maxWords:y.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let v=y?.words??[b.word];for(let T of v){if(!Qs(o))return On(a,l,b.next,"word-limit",r.maxWords);c.words.push(T)}if(c.start=c.start===-1?d:c.start,c.end=b.next,c.nested.push(...b.nested),C&&Zu(b.word))m();d=b.next>d?b.next:d+1}return m(),Fu(a,l),l.push(...AC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Wu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Vo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ta(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||jo(f)||(f===";"||f==="|"||f==="&")&&Uo(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=sC(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=vr(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=uC(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?Ko(e,a,n,r,o,i):null;if(p){let h=Bu(p,u,m);if(d||=h.limited,c=vr(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=ju(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=vr(c,"glob");s+=f,a++}return{word:In(e,t,a,s,c,l,c==="literal"?void 0:mC(e,t,a)),nested:u,issues:m,next:a,limited:d}}function sC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
-`){m+=2;continue}if(g==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=na(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=Ko(e,m,n,r,o,i);if(f){let g=Bu(f,l,c);if(m=g.next,u||=g.limited,a=vr(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let g=ju(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function Ko(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=na(e,t+u,n,m),f=d===-1?n:d,g=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:RC(e,t+u,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let b=[],y=[],v=!1,T=t+u;while(T<f){let k=Ko(e,T,f,r,o,i+1);if(!k){T++;continue}if(b.push(...k.program.nodes),y.push(...k.program.issues),v||=k.program.status==="limited",T=k.next,v)break}if(d===-1)y.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:_e({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Vo(y,v),issues:y,nodes:b}),next:g,provenance:"arithmetic"}}let p=$o(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],C=(c||l)&&Er(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:_e({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Vo([...p.issues,...h,...C],p.limited),issues:[...p.issues,...h,...C],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function aC(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?Ko(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Bu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function na(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Js(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=$u(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=lC(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Xs(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function lC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=$u(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function $u(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!PC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function Uo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function cC(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function jo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Uu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function uC(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=dC(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function dC(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Ho(e,t+1,n,16,2,t+1);if(r==="u")return Ho(e,t+1,n,16,4,t+1);if(r==="U")return Ho(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Ho(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Ho(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Vo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function ju(e,t,n,r,o){let i=Uu(e,t,n);return{text:r+e.slice(t,i),provenance:vr(o,"variable"),next:i}}function mC(e,t,n){let r=zo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=na(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Uu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function vr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function fC(e,t,n){return t+1>=n||jo(e[t+1]??"")||Uo(e,t+1)!==null}var pC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),gC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function hC(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=yC(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function yC(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return CC(e,t);if(n==="env")return bC(e,t);if(n==="sudo")return SC(e,t);return}function CC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function bC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(pC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function SC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(gC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Vu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Ku(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>qu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function vC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Ku(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>qu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>In(e,t.span.start,t.span.end,a,"literal",!1))}}function Ku(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Gu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Gu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...EC(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Gu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&wC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:xC(e,r)}}function EC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function xC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function wC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function qu(e,t){let n=`x${e}`,r=ta(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function RC(e,t,n,r){return _e({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function On(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Bo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Qs(e){return e.used++,e.used<=e.max}function _C(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Er(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Er(n.nodes));return(t.kind==="group"||t.kind==="function")&&Er(t.body.nodes)})}function AC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Yu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Fu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!zu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Zu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&iC.has(e.text)}function ea(e,t){let n=e.at(-1);if(!Yu(n))return;if(n?.kind==="command"&&Zu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function PC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Ju=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),TC=new Set(["gc","cat","type","cp","mv","rm"]),Qu=["-rec","-for","-path","-literalpath","-whatif"],kC=/^\$env:\w/i,IC=/^(?:\$\{?\w+\}?|~)\\./;function ed(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Ju].some((o)=>n.includes(o))&&!(n.includes("rm")&&Qu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!OC(n))return!1;let r=sa(e,t);if(td(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||ia(r).some(MC)}function td(e){return e.nodes.some((t)=>{if(t.kind==="group")return td(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function OC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function MC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Ju.has(n))return!0;let r=e.slice(t+1);if(n&&TC.has(n)&&r.some(DC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Qu.some((s)=>i.startsWith(s))})}function DC(e){return kC.test(e)||IC.test(e)}function sa(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return _e({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=aa(e,0,e.length,t,0);return _e({kind:"program",dialect:"powershell",source:e,span:n,status:FC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function aa(e,t,n,r,o,i=!1){let s=[],a=[],l=Go(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Fo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=GC(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let C=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(ra(e,d,C)),d=C;continue}d++;continue}let p=od(e,d);if(p){m(),s.push(ra(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(rd(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let C=aa(e,d+1,n,r,o+1,!0),b=C.closed?C.next-1:C.next,y=_e({kind:"program",dialect:"powershell",source:e.slice(d+1,b),span:{start:d+1,end:b},status:C.limited?"limited":C.issues.length>0?"partial":"complete",issues:C.issues,nodes:C.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:C.next}),body:y})),a.push(...C.issues),!C.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=C.words,u||=C.limited,d=C.next;continue}if(f==="}"){m(),s.push(ra(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let C=e[d+1]===f?d+2:d+1,b=C;while(/[ \t]/.test(e[b]??""))b++;let y=b<n?Xu(e,b,n,r,o):void 0,v=y?.next??C;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,C),span:Object.freeze({start:d,end:v}),...y?{target:y.word}:{}})),y)a.push(...y.issues),l.nested.push(...y.nested),c+=y.words,u||=y.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Zs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Xu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Xu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=NC(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=oa(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||od(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:In(e,t,f,i,s,a,s==="literal"?void 0:LC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function NC(e,t,n,r,o){let i=nd(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:_e({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[rd(r.maxDepth)],nodes:[]}),next:a};let l=aa(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:_e({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function nd(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function oa(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=oa(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=oa(r)}}return t}function LC(e,t,n){let r=zo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=nd(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=WC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function WC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function rd(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function ia(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return ia(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(ia)]})}function od(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function GC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function FC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ra(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Je(e,t="auto",n=Ft){if(t==="powershell"||t==="auto"&&ed(e.slice(0,n.maxInputLength),n))return sa(e,n);return Hu(e,n)}function R(e){return e.provenance==="command-substitution"?e.raw:e.text}function Mn(e,t){return e==="posix"?t:J(t.map((n)=>n.text))}function qo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function J(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function la(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function ne(e){return e.value.length}function xr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Fe(e,t){xr(e,t)}function on(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function K(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ca(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function q(e,t,n){if(t+n.length>ne(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function xt(e,t,n){return!on(S(e,t-1))&&q(e,t,n)&&!on(S(e,t+n.length))}function wt(e,t){return on(S(e,t-1))!==on(S(e,t))}function de(e){return e===`
-`||e===";"||e==="&"||e==="|"}function Dn(e){return e==="|"||e===";"}function Yo(e,t,n){let r=la(e,n);if(t==="rm")return zC(r);if(t==="dd")return BC(r);return ud(r,!0)}function Zo(e,t,n){let r=la(e,n);if(t==="rm")return $C(r);if(t==="reset-hard")return ld(r,"--ha","rd");if(t==="reset-merge")return ld(r,"--me","rge");if(t==="clean")return KC(r);if(t==="checkout")return YC(r);if(t==="push-force")return ZC(r);if(t==="push-refspec")return XC(r);if(t==="push-delete")return JC(r);if(t==="branch")return QC(r);if(t==="tag")return nb(r);if(t==="restore")return rb(r);return ud(r,!1)}function zC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=ne(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(xt(e,i,"rm")&&K(l)&&l!==`
-`)t=!0,i++;continue}let a=HC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===ne(e)){if(o>=0){let l=id(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(K(s)){if(o<0)continue;if(q(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=id(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function HC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(q(e,t,String.raw`\n`))return t+2;if(q(e,t,String.raw`\x0a`)||q(e,t,String.raw`\x0A`))return t+5;if(q(e,t,String.raw`\u000a`)||q(e,t,String.raw`\u000A`))return t+7;return q(e,t,String.raw`\012`)?t+4:-1}function id(e,t,n){if(sd(e,t,n,"recursive"))return{recursive:!0,force:!1};if(sd(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function sd(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!q(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function BC(e){let t=!1;for(let n=0;n<ne(e);n++){if(de(S(e,n))){t=!1;continue}if(xt(e,n,"dd")){t=!0,n++;continue}if(!t||!xt(e,n,"of")||!q(e,n,"of=/dev/"))continue;let r=n+8;if(r<ne(e)&&!K(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function $C(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ne(e);){let i=S(e,o);if(o===ne(e)||de(i)){t=!1,n=!1,r=!1,o++;continue}let s=jC(e,o);if(s>=0){if(UC(e,s))return!0;let a=s,l=!1;while(K(S(e,a)))l||=S(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(q(e,o,"--")&&(o===0||K(S(e,o-1)))&&(!S(e,o+2)||K(S(e,o+2))||de(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=q(e,o,"--recursive")&&wt(e,o+11)||ua(e,o,"recursive"),r||=q(e,o,"--force")&&wt(e,o+7)||ua(e,o,"force"),n&&r)return!0;o++}return!1}function ua(e,t,n){if(!q(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||K(o)||de(o))break;if(o!==n[r])return!1;r++}return r>0&&wt(e,t+r+2)}function UC(e,t){let n=t,r=!1,o=!1;while(n<ne(e)){while(K(S(e,n)))n++;let i=n;while(n<ne(e)&&!K(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&q(e,i,"--"))return!1;let s=ad(e,i,"recursive"),a=ad(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=VC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function ad(e,t,n){return q(e,t,`--${n}`)&&wt(e,t+n.length+2)||ua(e,t,n)}function jC(e,t){if(t>0&&on(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!K(S(e,n+1)))return-1;return n+1}function VC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&wt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function ld(e,t,n){return Rr(e,"reset",Dn,!0,(r)=>S(e,r)==="-"&&Nn(e,r,t,n)?!0:r)}function KC(e){return Rr(e,"clean",Dn,!0,(t)=>{if(S(e,t)!=="-")return t;if(Nn(e,t,"--fo","rce"))return!0;let n=wr(e,t,Dn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Xo(e,t,n){if(!xt(e,t,"git"))return null;let r=t+3;if(!K(S(e,r)))return{commandEnd:-1,next:r};while(K(S(e,r)))r++;while(r<ne(e)){if(de(S(e,r)))return{commandEnd:-1,next:r};let o=wr(e,r,de);if(xt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&q(e,r,"--"),s=qC(e,r,o);r=o;while(K(S(e,r)))r++;if(i)return{commandEnd:xt(e,r,n)?r+n.length:-1,next:wr(e,r,de)};if(!s)continue;if(r>=ne(e)||de(S(e,r)))return{commandEnd:-1,next:r};r=wr(e,r,de);while(K(S(e,r)))r++}return{commandEnd:-1,next:r}}function qC(e,t,n){for(let r of Ne)if(n-t===r.length&&q(e,t,r))return!0;return!1}function YC(e){return cd(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function ZC(e){return Rr(e,"push",Dn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!on(S(e,t+2))&&!q(e,t+2,"-with-lease"))return!0;let n=dd(e,t,"--fo","rce");if(n>=0&&!q(e,n,"-with-lease"))return!0;return t})}function XC(e){return Rr(e,"push",de,!1,(t)=>{if(K(S(e,t))&&S(e,t+1)==="+"&&t+2<ne(e)&&!de(S(e,t+2))&&!K(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function JC(e){return Rr(e,"push",de,!1,(t)=>{if(S(e,t)==="-"&&Nn(e,t,"--de","lete"))return!0;if(K(S(e,t))&&S(e,t+1)===":"&&t+2<ne(e)&&!K(S(e,t+2))&&!de(S(e,t+2)))return!0;return t})}function QC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ne(e);o++){if(o===ne(e)||de(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Xo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=wr(e,o,de),s=eb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function eb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(Nn(e,i,"--de","lete"))r=!0;if(Nn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&tb(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!wt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function tb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function nb(e){return cd(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function cd(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<ne(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(K(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Xo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&K(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(Nn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&wt(e,r+1))return!0;if(Dn(o))i.outerActive=!1}return!1}function Rr(e,t,n,r,o){let i=!1;for(let s=0;s<ne(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Xo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||K(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function rb(e){let t=!1;for(let n=0;n<ne(e);n++){if(ca(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Xo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(q(e,n+2,"staged")||q(e,n+2,"help")))t=!1}return t}function ud(e,t){let n=!1;for(let r=0;r<ne(e);r++){let o=S(e,r),i=t?ca(o):de(o);if(n&&K(o)&&S(e,r+1)==="-"&&xt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(xt(e,r,"find"))n=!0,r+=3}return!1}function wr(e,t,n){let r=t;while(r<ne(e)&&!K(S(e,r))&&!n(S(e,r)))r++;return r}function dd(e,t,n,r){if(!q(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return wt(e,o)?o:-1}function Nn(e,t,n,r){return dd(e,t,n,r)>=0}function je(e,t){xr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Fe(t,a);if((s.regex?.test(a)??!1)||s.scan&&Zo(a,s.scan,t))return E("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var ob=/^[A-Za-z_][A-Za-z0-9_]*=/;function fd(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;xr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return pd(t.nodes,r,i)}function pd(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return pd(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return ib(r,t,n)})}function ib(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!ob.test(o.text));return e.words.every((o,i)=>o===t||md(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||md(o.target.raw,n.anchored,!0)))}function md(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var _r=require("node:path");function Ar(e,t,n,r){let o=_r.isAbsolute(e)?_r.resolve(e):t?_r.resolve(t,e):void 0;if(!o)return;try{return I(o,n,r)}catch{return o}}function gd(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var Ln="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Pr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ma=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),sb=new Set(["-p","--print"]),ab=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),lb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),cb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ub=new Map([["python",new Set(["m"])]]),db=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),mb=new Set(["always","default","never"]),fb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),pb=/\\\r?\n/g,gb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function hd(e){return Qo(e).code}function Jo(e){return Qo(e).sources}function yd(e){return gb.get(pa(e))??[]}function Qo(e){let t=pa(e[0]??"");if(!ma.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Qe(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Qe(t,n,r,o,i,s);if(t==="node"&&sb.has(s)){let m=e[i+1];if(m===void 0)return Qe(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(yb(t,s)){let m=e[i+1];if(m===void 0)return Qe(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Qe(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Cb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=hb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Qe(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Qe(t,n,r,o);if(db.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&fb.has(s))||t==="python"&&!mb.has(m))return Qe(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(ub.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Qe(t,n,r,o)}if(ab.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(lb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(cb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Qe(t,n,r,o);if(c)i++}return Qe(t,n,r,o,void 0,void 0,!0)}function Qe(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function hb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function fa(e,t){return pa(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function pa(e){let t=A(e).toLowerCase();return vo.test(t)?"python":t}function yb(e,t){return ma.get(e)?.has(t)??!1}function Cb(e){return ma.get(e)?.has("--eval")??!1}function Tr(e,t,n=!1){let r=vb(e,t);if(!da(r,t))return!1;Fe(t,r);let o=Sb(r);if(da(o,t))return!0;if(Fe(t,o),!Cd.test(o))return!1;return!n||bb(r,t)}function bb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Cd.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:ga(i,c)}});if(s.some((l)=>ha(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&da(l.text,t)})}function ga(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function ha(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Cd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Sb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function da(e,t){if(Yo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Fe(t,e),r.test(e))return!0;if(Yo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Fe(t,e),r.test(e))return!0;if(Yo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Fe(t,e),n.some((o)=>Zo(o,r))))}function vb(e,t){return Fe(t,e),e.replace(pb,"")}var di=require("node:fs"),dt=require("node:path");var Ir=require("node:path");var zt=require("node:path");function Ht(e,t,n){if(Ct(t))throw Error("Unsupported Windows namespace path");let r=zt.isAbsolute(t)?zt.parse(t).root:"",o=r||e;for(let i of xb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=zt.dirname(o);continue}let s=Eb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Eb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${zt.sep}${t}`}function xb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var ya=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wb=new Set(ya),Rb=1024,bd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Sd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),_b=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ei(e){return wb.has(e)}function Ca(e){return ei(e)||bd.has(e)||Sd.has(e)||dr(e)}function Rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function vd(e,t){let n=Rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Rb?{state:"valid",count:r}:{state:"invalid"}}function ti(e,t,n){let o=e.match(_b)?.[1];if(!o||!Ca(o))return null;let i=e.indexOf("=");return{name:o,value:`${Rt(o,t,n)??""}${e.slice(i+1)}`}}function Ed(e){return wd(e,Sd)}function xd(e){return wd(e,bd)}function wd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var _d=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ve(e){if(!_d.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function ni(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ve(R(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ad(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function sn(e,t,n,r){if(!Ad(Wn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<X.wrapperPeelIterations.cap;m++){let d=Rd(i),f=ni(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&Wn(i).includes("=")&&!Pb(i)){let p=Tb(Wn(i),a,t.env)??ti(Wn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(Wn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=Ib(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=Db(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,C]of p.envAssignments)s.set(h,C),a.set(h,C)}if(g==="command")i=Nb(i);if(g==="builtin")i=i.slice(et(i,1)==="--"?2:1);if(Rd(i)===d)break}let u=ni(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Ab(u.words,o)}}function Ab(e,t){return e.some((n)=>!t.has(n))}function Rd(e){return e.map(R).join(" ")}function Wn(e){let t=e[0];return t?R(t):""}function et(e,t){let n=e[t];return n?R(n):void 0}function Pb(e){return _d.test(Wn(e))}function Tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var kb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ib(e,t,n){let r=1,o=n;while(r<e.length){let i=et(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=et(e,r+1);o=s?kr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=kr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=kr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(kb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Ob=new Set(["-i","-0","--null"]),Mb=new Set(["-u","--unset","-C","--chdir","-P"]);function Db(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=et(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=et(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:et(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Mb.has(c)){if(c==="-C"||c==="--chdir"){let m=et(e,a+1);s=m?kr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=kr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ve(c))break;while(a<e.length){let m=Ve(et(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(et(e,a)==="--")a++;return l(a)}return l(a)}function kr(e,t,n){if(t==="")return null;if(!e&&!Ir.isAbsolute(t))return null;let r=Ir.isAbsolute(t)?Ir.parse(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ht(r,t,n)}catch{return null}}function Nb(e){if(et(e,1)==="-v")return[...J(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=et(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Lb=/['"\\$`{}#]/;function ri(e,t){if(e.some((r)=>Lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Bt(e,t,n){return oi(e,t,n).tokens}function Wb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function $t(e,t,n,r=0){let o=oi(e,t,n),i=(o.envSplitValues??[]).flatMap(Wb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return $t(s,t,n,r+1)}function oi(e,t,n,r){if(!Ad(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=sn(J(e),t,n,r);return{tokens:o.words.map(R),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ea=Symbol("adopt-as-operand"),Gb=new Set(["env","sudo","command","builtin"]),Fb=new Set(["&&","||","|&","|","&",";"]),zb=new Set(["<<","<<<",">|"]),Hb=new Set(["|","|&"]),Bb=/[*@#?$!_-]/,$b=/^\w+(?::\w+)*/,Ub=Object.freeze([]),Or=Object.freeze({kind:"scope",edge:"enter"}),Mr=Object.freeze({kind:"scope",edge:"exit"}),jb=Object.freeze([]),Vb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Dr=new Set(["bash","sh","zsh","dash","ksh"]),Kb=256,Od=new WeakMap;function Md(e,t){let n=t.status==="complete"?new Set(va(t)):new Set,r=Zb(e,n);if(xo(r))return ii("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=an(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return ii("structural-limit",r,t);if(o.invalid)return ii("invalid",r,t);let s=ii("complete",r,t,o.assignmentFallbacks);return Od.set(s,Object.freeze(i)),s}function ai(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Dd(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=qb(a,s,n,r),c=a.length>0&&Hb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ea){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function li(e){return Dd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Ae(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Ae(i,t);return a?Ae(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Nr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function qb(e,t,n,r){let o=Nr(e)?new Map([...t.variables,...Yb(e,t.variables)]):t.variables,i=Bt([...e],n),s=A(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ge(Ae(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Yb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Ae(o,t)]]:[]})}function Dd(e){return Od.get(e)??Ub}function Zb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function ii(e,t,n,r=jb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function an(e,t){return e.nodes.flatMap((n,r)=>Xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[tt(nS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[tt(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[si("{"),...an(e.body,a),...s?[si("}")]:[]]:[Or,tt("("),...an(e.body,a),...s?[tt(")")]:[],Mr]}]}let o=sS(e,r.functions);if(o){if(r.depth>=Ft.maxDepth||++r.flags.expansions>Kb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Pd(e,r),si(";"),...an(o,{...r,depth:r.depth+1}),si(";")]},...Td(e,t,n,r)]}return[{start:e.span.start,events:Pd(e,r)},...Td(e,t,n,r)]}function Pd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ld(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Jb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Jb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ld(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[xa(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:rS(r),targetOrder:zb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Gd(t)}:{}}),...s===void 0?o:o.slice(1)]}function Td(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[xa(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[tt(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Nd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Qb(t,n,r):[]]}function Qb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Nd(n.source.slice(r.span.end,e.span.end),n)}]}function Nd(e,t){if(t.depth>=Ft.maxDepth)return t.flags.limited=!0,[];let n=Je(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=an(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ld(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?tt("glob"):s!==""||e.quoted&&o.length===0?xa(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ba(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(tt(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ba(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?an(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(Or,...g,Mr);continue}let m=u?an(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Or,...m,Mr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?tt("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Or,...m,...c.raw.endsWith(")")?[tt(")")]:[],Mr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>tt("(")),...d===1?[Or]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>tt(")")):[],...d===1?[Mr]:[])}return l(),o}function ba(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=kd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=kd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function kd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=tS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return eS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Bb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?$b:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function eS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ba(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function tS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function nS(e){return/^[\r\n]+$/.test(e)?";":e}function tt(e){return Object.freeze({kind:"operator",operator:e,boundary:Fb.has(e)})}function si(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function xa(e){return Object.freeze({kind:"word",text:e})}function rS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Lr(e){return Vb.has(e)||/^python\d/.test(e)}var oS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Wd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=oS.get(e)?.has(n)??!1;return Wd(e,t.slice(r?2:1))}function Sa(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Sa(e.slice(1));if(!Gb.has(t))return[...e];return Sa(Wd(t,e.slice(1)))}function Gd(e){let t=Sr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Sa(n<0?[]:e.words.slice(n).map((r)=>r.text))}function iS(e){let t=Gd(e)[0];if(t===void 0)return!1;let n=A(t).toLowerCase();return Lr(n)&&!Dr.has(n)}function va(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return va(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>va(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(iS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!lS(t))return r;return[...r,...o]})}function sS(e,t){let n=Sr(e);return n===void 0?void 0:t.get(n)}function Ut(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function aS(e){if(Ut(e.words[0],"git"))return Ut(e.words[1],"commit");if(!Ut(e.words[0],"gh")||!Ut(e.words[2],"create"))return!1;return Ut(e.words[1],"pr")||Ut(e.words[1],"issue")}function lS(e){return(Ut(e.words[0],"cat")||Ut(e.words[0],"tee")||aS(e))&&!e.words.some(Id)&&!e.redirections.some((n)=>Id(n.target))}function Id(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Fd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),zd=new Set([...Fd,"glob"]),cS=new Set([...zd,"pattern"]);class nt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Hd(e){let t=uS(),n=Nt(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:dS(e),store:t}}function Pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function _t(e,t){if(!e.includes("$"))return e;return os(e,t)}function uS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Je(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Md(i,a);return e.set(i,c),c},getCommandProgram:r}}function dS(e){let t=e.route.kind==="grep"?zd:e.route.kind==="glob"?cS:Fd;return[...lo(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?co(e.input):[]]}var mS=new Set(["-S","--suffix"]);function Gn(e,t,n,r,o){if(e.status==="structural-limit")throw new nt;if(e.status!=="complete")return o.findMalformedTarget(e.source);return ai(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Ae(i.target,s.variables),s)?i.target:null})}function ci(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&mS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var rt="Git metadata and hooks are protected. Ask the user before modifying them.";function $d(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(ao(e.invocation.toolName))return null;let a=e.paths.find((l)=>Bd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=Pe(e,"input-candidate");if(!i)return null;let s=Gn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>CS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Bd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function ln(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=mi(ge(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(wa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?ui(m,l):fS(m,l);if(n.markerFiles.some(u))return!0;return r&&Ra(n).some(u)}if(wa(a,n))return!0;return r&&Ra(n).some((c)=>ui(c,a))}function fS(e,t){let n=dt.relative(t,e);if(n===""||n.startsWith("..")||dt.isAbsolute(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function pS(e,t,n,r,o){return ln(e,t,n,!0,r,o)}function gS(e,t,n,r,o){if(!n)return!1;return wa(mi(ge(e,t,r,o)),n)}function Bd(e,t,n,r,o,i){let s=mi(ge(e,t,r,o));return i.includes(s)||jd(s,n)}function Ud(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>ui(i,mi(ge(s,t,r,o)))))}function wa(e,t){return t.entries.includes(e)||t.directories.includes(e)||jd(e,t)}function jd(e,t){return t.hooksDirectories.some((n)=>ui(e,n))}var hS=50000;function Vd(e,t){let n=[...new Set(Ra(e))];if(n.some((o)=>t(dt.basename(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=yS(o);if(!i)return!0;if(r+=i.length,r>hS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>dt.join(o,s.name)))}return!1}function yS(e){try{let t=di.lstatSync(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return di.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Ra(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function ui(e,t){let n=dt.relative(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!dt.isAbsolute(n)}function mi(e){return process.platform==="win32"?e.toLowerCase():e}function CS(e,t,n,r,o){if(Nr(e))return null;let i=$t([...e],r);if(A(i[0]??"").toLowerCase()!=="mv")return null;let s=ci(i.slice(1)),a=s.sources.find((l)=>pS(Ae(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&gS(Ae(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}var Y=require("node:path");var ze=require("node:path"),bS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],SS=` 	
-`;function Wr(e,t){if(cn(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!_a(e.get("TMPDIR")??"",t)}function Fn(e,t){if(e.has("TMPDIR"))return _a(e.get("TMPDIR")??"",t);let n=Aa(e,t);if(n===void 0)return!0;return _a(n,t)}function Aa(e,t){return Yd(e,t,"TMPDIR")}function _a(e,t){if(!e)return!1;if(ES(e))return!1;return zn(e,t)}function cn(e,t){let n=Yd(e,t,"IFS");return n!==void 0&&n!==""&&n!==SS}function zn(e,t){let n=fi(e,t.paths);if(n===null)return!1;return qd(t).some((r)=>Hn(n,r))}function gi(e,t){let n=fi(e,t.paths);if(n===null)return!1;return qd(t).some((r)=>pi(r)===pi(n))}var Kd=new WeakMap;function qd(e){let t=Kd.get(e);if(t)return t;let n=vS(e);return Kd.set(e,n),n}function vS(e){let t=bS.map((r)=>fi(r,e.paths)??ze.normalize(r)),n=fi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&xS(n))return[...t,n];return t}function ES(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Yd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function xS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function fi(e,t){try{let n=ze.normalize(e);if(!ze.isAbsolute(n))return n;let r=ze.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ze.join(i,o[s]??"");if(t.entryKind(a)==="missing")return ze.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Hn(e,t){let n=pi(e),r=pi(t);if(n===r)return!0;let o=r.endsWith(ze.sep)?r:`${r}${ze.sep}`;return n.startsWith(o)}function pi(e){return process.platform==="win32"?e.toLowerCase():e}var wS=process.platform==="win32",Zd=64,RS=16384;function Gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ae(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ae(n,o.id,t.paranoid))return null;return E(o.id,o.reason)}function Fr(e){let t=Vu(e,Zd,Zd,RS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:_S(e)}}function _S(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>AS(e.raw,n.span.start-e.span.start))}function AS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function jt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??xe();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:MS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ot(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&NS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Jd(e,t.posixShell);if(Ct(e))return{kind:"outside_anchored_cwd"};if(Ta(e,r))return{kind:"root_or_home_target"};if(TS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&ln(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(kS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(DS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&FS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>zS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(HS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(PS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function PS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Y.isAbsolute(r)||r.startsWith("~"))return!1;if(ka(r))return!1;if(Qd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return zn(Y.resolve(t.resolvedCwd,r),t.environment)}function Xd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ot(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(OS(i))return!1;if(gi(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Qd(r??i,s,t.environment.paths,t.budget))}function Ta(e,t=!1){let n=e.trim(),r=Y.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function TS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Y.isAbsolute(o)?o:t.resolvedCwd?Y.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Te(I(i,t.environment.paths,t.budget));if(s===Y.parse(s).root)return!0;return s===Te(I(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Te(e){let t=Y.normalize(e);if(wS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function kS(e,t,n,r,o,i,s,a){let l=e.trim();if(ka(l))return!1;if(!r&&zn(l,a))return!0;return(t||i&&s)&&n&&!o&&IS(l,n)}function IS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Jd(e.slice(n.length+1),t)})}function OS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Y.posix.normalize(`/${t[1]??""}`)==="/"}function ka(e){return e.split(/[\\/]+/).includes("..")}function MS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=yr(o.trim(),t);if(!Y.isAbsolute(i))return[];try{let s=I(i,n,r);if(Cr(s,I(t,n,r)))return[];return[Te(s)]}catch{return[]}})}function DS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ka(r))return!1;let o=n?r:yr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Y.isAbsolute(o)?o:i?Y.resolve(i,o):null;if(!s)return!1;try{let a=Te(I(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Y.sep)?l:`${l}${Y.sep}`))}catch{return!1}}function NS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Jd(e,t=!1){return e.includes("$")||e.includes("`")||LS(e)||t&&WS(e)}function LS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function WS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&GS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function GS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function FS(e,t,n,r){try{return Te(I(e,n,r))===Te(I(t,n,r))}catch{try{return Te(e)===Te(t)}catch{return!1}}}function zS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Te(I(Y.resolve(t,e),n,r))===Te(I(o,n,r))}catch{try{return Te(Y.resolve(t,e))===Te(o)}catch{return!1}}}function HS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Pa(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Pa(Y.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Pa(Y.resolve(a,e),t,i,s)}catch{return!1}}function Pa(e,t,n,r){try{return em(I(e,n,r),I(t,n,r))}catch{return!1}}function Qd(e,t,n,r){if(!t)return!1;try{return em(I(t,n,r),I(e,n,r))}catch{return!0}}function em(e,t){let n=Te(e),r=Te(t);return n.startsWith(`${r}${Y.sep}`)||n===r}var BS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),tm="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$S="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",rm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",US="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",jS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",VS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:rm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:rt},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:nm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:US},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:tm},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:$S},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:tm}};function om(e,t,n){return KS(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,jt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function KS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=YS(o),s=o[i];if(!s||!BS.has(ov(s.text)))return null;let a=qS(o.slice(i+1));if(a.whatIfProtected)return null;if(ae(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return E("powershell.remove-item-pipeline-dynamic-target",jS);for(let l of a.targets)if(!Ct(l.text)&&Ta(Oa(l.text)))return E(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",rm);for(let l of a.targets)if(n.resolvedCwd&&ln(Oa(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return E("powershell.remove-item-git-metadata",rt);if(!a.recursive||!a.force)return null;if(ae(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return E("powershell.remove-item-recursive-force-dynamic-target",nm);for(let l of a.targets){let c=Gr(ot(Oa(l.text),n),n,r,VS);if(c)return c}return null}function qS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(ZS(l))continue;if(s){t.push(Ia(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=JS(l.text);if(!c){t.push(Ia(l)),i=i||l.dynamic;continue}if(QS(c.name)){let u=c.value?XS(c.value,l):e[++a];if(u?.kind==="word"){t.push(Ia(u)),i=i||u.dynamic;continue}i=!0;continue}if(ev(c.name)){n=!0;continue}if(tv(c.name)){r=!0;continue}if(nv(c.name))o=rv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function YS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Ia(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function ZS(e){return e.kind==="word"&&e.text===","}function Oa(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function XS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function JS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function QS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function ev(e){return"recurse".startsWith(e)}function tv(e){return e.length>=2&&"force".startsWith(e)}function nv(e){return e==="wi"||"whatif".startsWith(e)}function rv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function ov(e){return e.toLowerCase()}var Bn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",hi="Unsupported heredoc syntax",zr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",im="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var iv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),sv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),av=new Set(["-o","--output","--query","--subscription"]),lv=new Set;function sm(e){if(e==="aws")return iv;if(e==="gcloud")return sv;if(e==="az")return av;return lv}var cv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),uv=new Set;function am(e){if(e==="git")return Ne;if(e==="docker")return cv;return uv}function At(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=Re(e);for(let o of t){if(!fv(n,o.command))continue;if(o.match){if(dv(n,e,o.match))return lm(o);continue}if(!pv(n,e,o.subcommand))continue;if(hv(e,new Set(o.block_args),r))return lm(o)}return null}function lm(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function dv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return mv(r,n.command_path,sm(e))}function mv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function fv(e,t){return e===O(t)}function pv(e,t,n){if(!n)return!0;return cm(t,1,n,am(e))}function cm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&gv(e,i,n,r))return!0;continue}return s===n}return!1}function gv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return cm(e,t+2,n,r)}function hv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var yv=new Set(["-e","--source"]),Cv=new Set(["-F","-v","--assign","--field-separator"]),um=new Set(["-f","--file"]),bv=new Set(["print","printf","return"]),dm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Sv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function mm(e,t,n){let r=!1;for(let o of vv(e)){let i=Ev(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?E("awk.system-dynamic",Sv):null}function Da(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&yv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Cv.has(a)||um.has(a))){let l=e[s+1];if(i&&=l!==void 0,um.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Br(e){return Da(e).sources}function vv(e){return Br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ev(e,t){Fe(t,e);let n=e.includes("system")?Na(e,t):null,r=xv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Na(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ci(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=fm(e,i+1);continue}if(s==="/"&&pm(e,i)){i=gm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Hr(e[a-1])||Hr(e[i]))continue;let l=yi(e,i);if(e[l]!=="(")continue;l=yi(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Ci(e,l,c);if(!u){r=!0,o=!0;continue}if(l=yi(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function xv(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Ci(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=fm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&pm(e,i)){let f=gm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Ma(e,i,"print")||Ma(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=yi(e,m);if(Ma(e,d,"getline")){o=!0;let f=_v(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Pv(s,a)){o=!0;let f=Rv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!wv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function yi(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function wv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Ci(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Av(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Rv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ci(e,t,n)}function _v(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Av(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Ma(e,t,n){return e.startsWith(n,t)&&!Hr(e[t-1])&&!Hr(e[t+n.length])}function Pv(e,t){return t!==null&&t>=e}function fm(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function pm(e,t){let n=Tv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Hr(e[r-1]))r--;return bv.has(e.slice(r,n+1))}function Tv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function gm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var kv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Iv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Ov="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function hm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function ym(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return E("dd.device-write",kv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return E("mkfs.device",Iv);if(e==="shred"&&n.length>0)return E("shred.target",Ov);return null}var Mv=new Set(["sudo","env","command","builtin"]),Dv=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function bi(e,t){let n=e[0];if(!n||!Cm(A(n),t))return null;let r=A(n),o=e[1]==="--"?2:1,i=Nv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Nv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=A(a)!==n&&Lv(a,r);if(l)i.push(s);if(!l&&Eo.has(O(a)))break;if(o)break}return i}function Lv(e,t){let n=A(e),r=O(e);return r==="git"||n==="busybox"||un(e)||xs.has(n)||hm(r)||Cm(n,t)||Q.has(r)||e==="$SHELL"||Xe(r)||Ue.has(r)||t.rules.some((o)=>o.command===n)}function Cm(e,t){return Dv.has(e)||t.transparentWrappers.includes(e)}function un(e){return Mv.has(e.toLowerCase())}function dn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function it(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Si([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Si(e,t,n,r,o,i,s,a,l){let c=oi(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=ri(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");La(a),yield*Si(f,t,m,r,o,i,s,a,l);return}if(un(u[0]??""))throw new D("wrapperPeelIterations");let d=bi(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])La(a),yield*Si(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Gv(u)){La(a),yield*Si(u.slice(1),t,m,r,o,i,s,a,l);return}yield Wv(u,m,r,o,i,l)}function Wv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:A(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function La(e){if(e.iterations>=X.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Gv(e){return A(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Wa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Pt(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ga(r,"recursive")){t=!0;continue}if(r==="-f"||Ga(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function vi(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ga(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ga(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Fv=["--init-file","--rcfile"],zv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function st(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function Tt(e){let t=A(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Le(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Sm(e){let t=A(e[0]??"").toLowerCase(),n=Hv(e,t),r=zv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Hv(e,t){let n=Le(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Fv.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&vs.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Es(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Bv="find -delete permanently removes files. Use -print first to preview.",$v="find -exec rm -rf is dangerous. Use explicit file list instead.",Uv=new Set(["-exec","-execdir","-ok","-okdir"]),jv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function vm(e,t){let n=e.map(R),r=Vv(e,n,t);if(r)return r;if(Ei(n,1)&&!Jv(e,n,t)){let s=_(E("find.delete",Bv),t.policy);if(s)return s}let o=t.budget??xe(),i=0;while(i<n.length){let s=n[i],a=kt(s??"");if(a>0){i+=a+1;continue}if(!mt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=$n(n,i);i=l.nextIndex;let c=eE(l.tokens,t.environment);if(c){let f=_(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?.(l.tokens,u?null:t.cwd)??null,d=m?.id.startsWith("custom.")?m:_(m,t.policy);if(d)return d}return null}function Vv(e,t,n){if(!Ei(t,1)&&!Fa(t,n.environment))return null;let o=$r(e)??J(["."]),i=jt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Fr(s);for(let l of a.expandedTargets??[R(s)]){let c=ot(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return E("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Kv(e,i.protectedGitMetadata,n.environment))return E("find.delete-git-metadata",rt)}}if(Xv(t)&&i.resolvedCwd&&Ud(o.map(R),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return E("find.delete-git-metadata",rt);return null}function Kv(e,t,n){if(!t)return!1;let r=e.map(R),o=[],i=!1,s=$r(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(mt(l)){let c=$n(r,a),u=$t([...c.tokens],n),m=vi(u),d=Q.has(A(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(Yv(c.text,l==="-iname"));a+=2;continue}if(!qv.has(l))return!1;a+=1+kt(l)}return o.length>0&&!Vd(t,(l)=>o.every((c)=>c.test(l)))}var qv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Yv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Zv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Fa(e,t){let n=0;while(n<e.length){if(!mt(e[n])){n++;continue}let r=$n(e,n),o=$t([...r.tokens],t),i=A(o[0]??"").toLowerCase(),s=Q.has(i)&&Zv.test((st(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function Xv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Jv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=$r(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Aa(o,n.environment),s=n.trustedTmpdirValue??Fn(o,n.environment),a=n.allowTmpdirVar??!Wr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??cn(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=jt(l),u=jt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!Hn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=Fr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[R(g)]).every((h)=>{let C=/^\.\/*$/.test(h)?f:void 0,b=C??h,y={targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected};if(!ae(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!C&&ot(b,c,y).kind==="within_anchored_cwd")return!0;return Xd(b,C?u:c,{...y,containmentTarget:Qv(b,i)})})})}function Qv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function $r(e){let t=(o)=>{let i=e[o];return i?R(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function eE(e,t){let n=Bt([...e],t);if(n.length===0)return null;let r=A(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=A(n[0]??"");if(r==="rm"&&Pt(n))return E("find.exec-rm-recursive-force",$v);return null}function $n(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ei(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(mt(r)){n=$n(e,n).nextIndex;continue}let o=kt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function kt(e){return jv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function mt(e){return e!==void 0&&Uv.has(e)}var Um=require("node:path");function Ur(e){let t=Je(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var tE=5,za="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function me(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function xm(e,t,n){let r=xi(e,t,n),o=nE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<tE;a++){let{subcommand:l,rest:c}=He(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=aE(m);if(d===null||d.length===0)return{blockedReason:za,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:za,expanded:!0,tokens:i}}function wm(e,t,n){return xi(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function He(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?A(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ne.has(o)?2:1}return{subcommand:null,rest:[]}}function nE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function xi(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?A(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=oE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...rE(e,t,n)]}}function rE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ha(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ha(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Em(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Em(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ne.has(i)){o+=2;continue}o++}return r}function oE(e,t){let n=iE(e,t),r=sE(e,t);return{blockedReason:n===null||r===null?za:null,entries:[...n??[],...r??[]]}}function iE(e,t){let n=Rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Ur(n);if(!o)return null;for(let i of o){let s=Ha(i);if(!s)return null;r.push(s)}return r}function sE(e,t){let n=vd(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ha(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Em(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Rt(e.slice(r+1),t,n)}}function aE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Ur(t)}var lE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",cE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",uE="git checkout --force discards uncommitted changes. Use 'git stash' first.",dE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",mE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",fE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",pE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",gE="git switch --force discards uncommitted changes. Use 'git stash' first.",hE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",yE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",CE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",bE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",SE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",vE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",EE="git push --force destroys remote history. Use --force-with-lease for safer force push.",xE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",wE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",RE="git branch -D force-deletes without merge check. Use -d for safe delete.",_E="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",AE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",PE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",TE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",kE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",IE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",OE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",ME=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),DE=new Set(["--recurse-submodules","--track","-t"]),Ba=new Set(["-b","-B","-U"]),$a=new Set(["-c","-C"]),NE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Un=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function _m(e,t){let{subcommand:n,rest:r}=He(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Vt(LE(r,t));case"switch":return Vt(GE(r));case"restore":return Vt(zE(r));case"reset":return BE(r);case"clean":return Vt(UE(r));case"rm":return Vt(jE(r));case"push":return mn(VE(r));case"branch":return mn(YE(r));case"stash":return mn(ex(r));case"worktree":return mn(tx(r));case"rebase":return Vt(ZE(r));case"merge":return Vt(XE(r));case"tag":return mn(JE(r));case"reflog":return mn(QE(r));default:return null}}function Vt(e){return e?{...e,localDiscard:!0}:null}function mn(e){return e?{...e,localDiscard:!1}:null}function LE(e,t){let{index:n,before:r}=me(e),o=Re(r,{shortOptsWithValue:Ba});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return E("git.checkout-force",uE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return E("git.checkout-pathspec-from-file",mE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return E("git.checkout-ref-path",dE);return E("git.checkout-double-dash",lE)}let i=FE(e);if(i.length>=2)return E("git.checkout-ambiguous",fE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(WE(s)||t(s))return E("git.checkout-double-dash",cE);return null}function WE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function GE(e){let{before:t}=me(e);if(t.some((r)=>M(r,"--discard-changes")))return E("git.switch-discard-changes",pE);let n=Re(t,{shortOptsWithValue:$a});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return E("git.switch-force",gE);return null}function FE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(ME.has(r)){n+=2;continue}if(DE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function zE(e){let t=HE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?E("git.restore-worktree",yE):E("git.restore-unstaged",hE)}function HE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(NE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function BE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=E("git.reset-hard",CE);break}if(M(n,"--merge")){t=E("git.reset-merge",bE);break}}if(!t)return null;return $E(e)?mn(t):Vt(t)}function $E(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function UE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=Re(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return E("git.clean-force",SE);return null}function jE(e){let t=!1,n=!1,r=!1;for(let o of me(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=Re([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?E("git.rm-force",vE):null}function VE(e){let{before:t,after:n}=me(e),r=Re(t);if(t.some((s)=>M(s,"--mirror")))return E("git.push-mirror",wE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Rm(t,n).some(KE))return E("git.push-force",EE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Rm(t,n).some(qE))return E("git.push-delete",xE);return null}function Rm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function KE(e){return e.startsWith("+")||e.includes(":+")}function qE(e){return e.length>1&&e.startsWith(":")}function YE(e){let{before:t}=me(e),n=Re(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return E("git.branch-force-delete",RE);return null}function ZE(e){let{before:t}=me(e);return t.some((n)=>M(n,"--abort"))?E("git.rebase-abort",_E):null}function XE(e){let{before:t}=me(e);return t.some((n)=>M(n,"--abort"))?E("git.merge-abort",AE):null}function JE(e){let{before:t}=me(e);return Re(t).has("-d")||t.some((r)=>M(r,"--delete"))?E("git.tag-delete",PE):null}function QE(e){return e[0]==="delete"?E("git.reflog-delete",TE):null}function ex(e){for(let t of e){if(t==="drop")return E("git.stash-drop",kE);if(t==="clear")return E("git.stash-clear",IE)}return null}function tx(e){let{before:t}=me(e);if(!t.includes("remove"))return null;let r=Re(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return E("git.worktree-remove-force",OE);return null}var It=require("node:path");var ja="TMPDIR",Va="IFS",Pm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Tm=/^[A-Za-z_][A-Za-z0-9_]*$/,km=new Set(["export","typeset","declare","readonly"]),nx=new Set(["builtin","command","time"]),rx=new Set(["do","then","else"]),ox=new Set(["do","then","case"]),Am=new Set(["done","fi","esac"]),ix=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Im(e,t){return e.map((n)=>n.provenance==="variable"&&Gm(n.text)?Om(n.text,t.shellAssignments):R(n))}function Om(e,t){return e.replace(ix,(n,r,o)=>t.get(r??o??"")??n)}function ft(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=Om(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function Mm(e,t){return{env:e,effectiveEnvAssignments:cx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Dm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ka(e,t){let n=Lm(e,t),r=e[0]??"";if(ox.has(r))t.bodyDepth+=1;if(r==="elif"||Am.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Am.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);qa(t,a)});let o=n.commandIndex;if(o!==-1&&km.has(e[o]??""))e.filter((a)=>Tm.test(a)&&Ua(a)).forEach((a)=>{ux(t,a)});let i=o===-1?-1:Wm(e,o);if(i===-1||e[i]!=="unset")return;let s=mx(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}dx(t,a)})}function Nm(e,t){let n=Lm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Lm(e,t){let n=rx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Gm(a)),o=r!==-1&&km.has(e[Wm(e,r)]??""),i=lx(t);return{assignments:e.flatMap((a,l)=>{let c=sx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!ei(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Wm(e,t){let n=t;while(nx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Gm(e){return Ve(e)!==null||Pm.test(e)}function sx(e,t,n){return Ve(e)??ax(e,t,n)}function ax(e,t,n){let r=ti(e,n,t);if(r)return r;let o=e.match(Pm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ua(e){return e===ja||e===Va||Ca(e)}function lx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function cx(e,t){let n=[ja,Va].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function qa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function ux(e,t){qa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function dx(e,t){if(!Ua(t)&&!Tm.test(t))return;if(e.shellAssignments.set(t,""),ei(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ua(t)||t===ja||t===Va||dr(t)){qa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function mx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var zm=require("node:path");function wi(e,t){return ya.some((n)=>t?.has(n)||e.has(n))}function jn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(zm.resolve(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Fm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Fm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ne.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Fm(e,t,n){try{let r=Ht(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Hm(e,t,n){if(!t.localDiscard||!n.worktreeMode||wi(n.environment.env,n.envAssignments))return null;let r=jn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ya(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ya(e,t,n){let{subcommand:r,rest:o}=He(e),i=r?.toLowerCase();if(t.dynamicArguments||fx(o)||Cx(e,t.environment.env,t.envAssignments,n)||hx(o)||px(i,o))return!0;return i==="clean"&&yx(o)>1}function fx(e){return e.some((t)=>/[$*?[]/.test(t))}function px(e,t){if(e==="checkout"){let{before:n}=me(t),r=Re(n,{shortOptsWithValue:Ba}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=me(t),r=Re(n,{shortOptsWithValue:$a}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||gx(s))||r.has("-C");return o&&i}return!1}function gx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function hx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function yx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Cx(e,t,n,r){if(Rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=xi(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>Sx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||bx(s.value);if(xd(n))return!0;return r.recursiveSubmodules}function bx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Sx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Bm(e,t,n){let r=e.map((l)=>ft(l,n.shellAssignments??new Map)??R(l)),o=n.environment.paths,i=jn(r,n.cwd,o),s=n.originalCwd?o.realpath(It.resolve(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||wi(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Ex(e,n.shellAssignments,o):$m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!vx(a,r,t,n)||!zn(a,n.environment)||gi(a,n.environment)||Hn(s,a)||Hn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function vx(e,t,n,r){let o=r.environment.paths,i=It.join(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Ya(t,r,a)}function Ex(e,t,n){let r=He(e.map(R)).rest,{before:o,after:i}=me(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&ft(l,t??new Map))??a;if(!It.isAbsolute(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function $m(e,t){if(t.entryKind(It.join(e,".git"))!=="missing")return e;let n=It.dirname(e);return n===e?null:$m(n,t)}var xx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",wx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ri(e,t){return jm(e,t)}function jm(e,t,n){let r=e.map(R),o=xm(r,t.environment.env,t.envAssignments),i=o.blockedReason?_(E("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Ed(t.envAssignments)||wm(r,t.environment.env,t.envAssignments))&&Rx(s))return E("git.ssh-env",xx);let a=_m(s,(c)=>{let u=jn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Um.resolve(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Hm(r,a,t)??Bm(e,a,t);if(!l)return a;return n?.(l),null}function Vm(e,t){let n=null;return{match:jm(e,t,(o)=>{n=o}),relaxation:n}}function Rx(e){let{subcommand:t,rest:n}=He(e),r=t?.toLowerCase();if(!r)return!1;if(wx.has(r))return!0;if(r==="archive")return me(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&_x(n)}function _x(e){return e.find((t)=>!Ax(t))?.toLowerCase()==="update"}function Ax(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}var vf=require("node:path");function Km(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function _i(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var qm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Px="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Tx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",kx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Ix="rm -rf in home directory is dangerous. Change to a project directory first.",Ym={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:kx},git_metadata_target:{id:"rm.git-metadata",reason:rt},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Tx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Ix},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:qm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Px},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:qm}};function Ai(e,t){let n=jt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(R),o=vi(r),i=Mx(e);for(let s of i){let a=Fr(s.word);if(o&&a.unsafeBraceExpansion){let l=_(Gr({kind:"outside_anchored_cwd"},n,t.policy,Ym),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=De(l),u={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&ln(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return E("rm.git-metadata",rt);if(!o)continue;for(let m of Ox(c,n,u)){let d=Gr(m,n,t.policy,Ym),f=_(d,t.policy);if(f)return f}}}return null}function Ox(e,t,n){let r=ot(e,t,n);if(r.kind==="cwd_self_target")return[r,ot(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=ot(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,ot(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Mx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=R(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Kt={kind:"none"},fn={kind:"dynamic"},Dx=new Set(["<","<<","<<-","<<<","<&","<>"]),Xm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Nx=/^(?:[0-9]+|[@*])$/,Lx=Ft.maxWords,Jm=Ft.maxInputLength;function Qm(e){if(!e||A(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function os(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Pn(e={}){return{reason:dr,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Wg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function uo(e,t={}){return{...Wg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Kl(e){return Vl({...e,redact:yt})}function ql(e){return Vl({...e,redact:yt,askUser:!0})}function Yl(e){return yt(e instanceof Error?e.message:String(e))}var Re=require("node:path");var Gg=256,mo=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ne(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function mr(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z]):(?:[/\\]|$)/,"$1:/")}function Ct(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ls(e,t){return is(e,0,t)}function is(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=ss(e,o+2),a=Fg(e,o,t);if(a===null){if(mo.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=zg(l,t,n),o=a+1;continue}let i=ss(e,o+1);if(!i){r+="$",o++;continue}r+=as(i,n)??`$${i}`,o+=i.length+1}return r}function Fg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>J.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function zg(e,t,n){let r=e.slice(2,-1),o=ss(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return as(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(mo.has(o))throw new N("pathEnvironmentExpansion");return e}if(!mo.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=as(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":is(i.slice(s.length),t+1,n);return l?is(i.slice(s.length),t+1,n):""}function ss(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function as(e,t){if(!mo.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function T(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Xl(n,i);let s=t.realpath(i);if(s!==null)return Zl(n,e,s,o);let a=Re.dirname(i);if(a===i||o.length>=Gg)return Zl(n,e,i,o);o.push(Re.basename(i)),i=a}}function Zl(e,t,n,r){let o=r.length===0?n:Re.join(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Hg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Xl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Xl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ye(e,t,n,r){let o=Ql(e,t,n);if(!o)return"";return T(o,n.paths,r).replace(/\\/g,"/")}function Jl(e,t,n,r,o){let i=Ql(e,t,n);if(!i)return null;if(o(Re.basename(i)))return T(i,n.paths,r).replace(/\\/g,"/");let s=Hg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Ql(e,t,n){let r=n.home,o=ls(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Re.resolve(r,o.slice(2)):o,s=Ne(i);return Re.normalize(Re.isAbsolute(s)?s:Re.resolve(t,s))}var ic=require("node:util"),Bg=new Set(["applypatch","patch"]),$g=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Ug=new Set(["grep","grepsearch","rg"]),jg=new Set(["find","findbyname","glob"]),Vg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Kg=new Set(["command","diff","input","patch","patchtext"]),ec=new TextEncoder,qg=new TextDecoder,Yg=/\s/,Zg=64;class ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var fr=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function sc(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function po(e){return Vg.has(sc(e))}function ac(e){let t=sc(e);if(Bg.has(t))return"patch";if(Ug.has(t))return"grep";if(jg.has(t))return"glob";if($g.has(t))return"path";return"unknown"}function Wt(e){if(!e||typeof e!=="object")return;mc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)dt();return}if(t.get||t.set)dt();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function go(e,t){return lc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function lc(e,t,n,r,o){let i=dc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>lc(l,t,i.array?n:t.has(cc(a)),r,o+1));return r.ancestors.delete(i.object),s}function cc(e){return e.replace(/-/g,"_").toLowerCase()}function ho(e){return uc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Jg)}function uc(e,t,n,r){let o=dc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>uc(a,o.array?t:Kg.has(cc(s)),n,r+1));return n.ancestors.delete(o.object),i}function Xg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>fr.maxDepth||t.nodes>fr.maxNodes)dt();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>fr.maxStringBytes||t.stringBytes>fr.maxAggregateStringBytes)dt()}function dc(e,t,n){if(Xg(e,t,n),!e||typeof e!=="object")return null;let r=mc(e);if(t.ancestors.has(e))dt();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>fr.maxKeys)dt();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)dt();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function mc(e){if(ic.types.isProxy(e))dt();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)dt();return t}function dt(){throw new ve}function Jg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Qg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...cs(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...cs(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...ds(fo(c.slice(4),!0),fo(u.slice(4),!0))),l++;continue}if(!r)t.push(...cs(c))}return t}function Qg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function cs(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return oc(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return oc(n[1]);if(e.startsWith("diff --git "))return eh(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return rc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return rc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ah(i[1]);return[]}function eh(e){let t=th(e);if(t.length===2&&t[0]&&t[1])return ds(t[0],t[1]);let n=nh(e);return n?ds(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function th(e){let t=[],n=0;while(n<e.length&&t.length<2){while(rn(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!rn(e[n]))n++;t.push(e.slice(i,n));continue}let o=fc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(rn(e[n]))n++;return n===e.length?t:[]}function nh(e){let t=0;while(t<e.length&&rn(e[t]))t++;let n=e.length;while(n>t&&rn(e[n-1]))n--;let r=0,o=t;while(o<n){if(!rn(e[o])){o++;continue}let i=o;while(o<n&&rn(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Zg)dt();if(rh(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function rh(e,t,n,r,o){if(us(e,t,n,r,o))return!0;let i=tc(e,"/",t,n),s=tc(e,"/",r,o);if(i<=t||s<=r)return!1;if(us(e,t,i,r,s))return!1;return us(e,i+1,n,s+1,o)}function us(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function tc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function rn(e){return e!==void 0&&Yg.test(e)}function fc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:qg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...ec.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...ec.encode(oh(s[0]??""))),o+=2}return null}function oh(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function ih(e){return pr(lh(e))}function ds(e,t){if(e==="/dev/null")return nc(t);if(t==="/dev/null")return nc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(pr);let n=sh(e,t)??(e===t?pc(e):null);return[e,t,...n?[n]:[]].flatMap(pr)}function nc(e){let t=pc(e);return[e,...t?[t]:[]].flatMap(pr)}function pc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function sh(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function rc(e){return ih(fo(e,!0))}function ah(e){return pr(fo(e,!1))}function fo(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=fc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function lh(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function pr(e){return e===""||e==="/dev/null"?[]:[e]}function oc(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Ze=require("node:path");function bt(e,t,n){if(Ct(e))return;let r=t.flatMap((i)=>yo(i,n));if(!r[0])return;let o=yo(Ze.isAbsolute(e)?e:Ze.resolve(r[0],e),n)[0];if(!o)return;return r.some((i)=>gr(o,i))?o:void 0}function ms(e,t,n){if(Ct(e))return;return yo(Ze.isAbsolute(e)?e:Ze.resolve(t,e),n)[0]}function St(e,t){return e.flatMap((n)=>yo(n,t))[0]}function vt(e,t,n){return ms(e,t,n)?"outside-workspace":"unusable"}function yo(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function gr(e,t){let n=Ze.relative(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ze.sep}`)&&!Ze.isAbsolute(n)}var ch=8388608;async function gc(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>ch)throw uh(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function uh(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function Co(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function Q(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:ac(e)}}function hc(e,t,n,r,o,i){let s=e===void 0?i:e;if(typeof s!=="string"||s.trim()==="")return Ee(r,t,n),null;let a=St([s],o);if(a)return{configCwd:a,executionCwd:a};return Ue(r,t,n,{directory:"session",problem:"unusable",cwd:s}),null}function Ee(e,t,n){e(Pn({command:yc(t),toolName:n}))}function Ue(e,t,n,r){e(uo(r,{command:yc(t),toolName:n}))}function yc(e){try{return Wt(e)}catch(t){if(!(t instanceof ve))throw t;return}}var Tn=require("node:fs"),bo=require("node:os");var xc=require("node:fs"),wc=require("node:path");var bc=require("node:child_process"),U=require("node:fs"),oe=require("node:path"),dh=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],mh=5000;function Sc(e,t=kh(),n=mh){let r=fh(e),o=r===null?null:ph(r);if(r===null||o===null)return null;let i=Ah(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function fh(e){try{let t=U.realpathSync(oe.resolve(e));return U.statSync(t).isDirectory()?t:null}catch{return null}}function ph(e){let t=_h(e);if(!t)return null;try{let n=U.lstatSync(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=fs(t);if(!r?.commonDir)return null;if(!yh(r.gitDir,t))return null;return Ch(r.gitDir,oe.dirname(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function fs(e){try{let t=gh(e);if(!t)return null;let n=U.realpathSync(oe.isAbsolute(t)?t:oe.resolve(oe.dirname(e),t));if(!U.statSync(n).isDirectory())return null;return{gitDir:n,commonDir:hh(n)}}catch{return null}}function gh(e){let t=U.readFileSync(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function hh(e){try{let t=U.readFileSync(oe.join(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=U.realpathSync(oe.isAbsolute(t)?t:oe.resolve(e,t));return U.statSync(n).isDirectory()?n:null}catch{return null}}function yh(e,t){let n=bh(e);return n===null?!1:vc(e,n,t)}function Ch(e,t){let n=Sh(e);return n===null?!0:vc(e,n,t)}function bh(e){let t=oe.join(e,"gitdir");if(!U.existsSync(t))return null;let n=U.readFileSync(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Sh(e){let t=oe.join(e,"config.worktree");return U.existsSync(t)?Eh(t):null}function vc(e,t,n){try{return vh(oe.isAbsolute(t)?t:oe.resolve(e,t),n)}catch{return!1}}function vh(e,t){try{let n=U.statSync(e),r=U.statSync(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Cc(U.realpathSync.native(e))===Cc(U.realpathSync.native(t))}function Cc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Eh(e){let t=U.readFileSync(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=xh(s[1]??"")}return r}function xh(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Rh(t.slice(1,-1))}var wh={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Rh(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:wh[n]??t)}function _h(e){try{return ps(U.realpathSync(e))}catch{return null}}function ps(e){let t=e;while(!0){let n=oe.join(t,".git");if(U.existsSync(n))return n;let r=oe.dirname(t);if(r===t)return null;t=r}}function Ah(e,t,n,r){if(Ph(t))return!0;if(n===null)return!0;let o=bc.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Th(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ec(o.stdout.trim())}function Ph(e){return[oe.join(e.commonDir,"config"),oe.join(e.gitDir,"config.worktree")].filter((t)=>U.existsSync(t)).some((t)=>Ih(t))}function kh(){return dh.find((e)=>U.existsSync(e))??null}function hr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Th(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!hr(t)))}function Ih(e){let t;try{t=U.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Oh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ec(c)}return r}function Oh(e){return e==="include"||e.startsWith("includeif ")}function Ec(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Rc(e,t){if(e==="")return null;let n=he(),r=ps(ye(e,e,t,n)),o=r?Mh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Mh(e,t,n,r){try{let o=ye(e,t,n,r),i=xc.statSync(e),s=i.isFile()?o:null,a=i.isFile()?fs(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[kn(ye(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[kn(e.replace(/\\/g,"/")),...l]:l)];return{entry:kn(o),markerFile:s?kn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=kn(wc.join(u,"hooks").replace(/\\/g,"/"));return[m,kn(ye(m,t,n,r))]}))]}}catch{return null}}function kn(e){return process.platform==="win32"?e.toLowerCase():e}var Dh={realpath:(e)=>{try{return Tn.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=Tn.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Tn.statSync(e).isDirectory()}catch{return!1}}};function Ac(){return Nh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ne(process.env.HOME||bo.homedir()),tmpdir:bo.tmpdir(),paths:Dh})}function Nh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>_c(n,i,()=>Rc(i,o)),worktreeFacts:(i)=>_c(r,i,()=>Sc(i)),...t};return o}function _c(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var In=["fail_closed","paranoid_rm","paranoid_interpreters"],So={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ne={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},vo=["standard","strict","paranoid"];function Pc(e,t){if(!t)return e;return vo.indexOf(t)>vo.indexOf(e)?t:e}function kc(e){let t=Eo(ne.level,e);return vo.find((n)=>n===t)}function Tc(e,t){return Pc(e,kc(t))}function Lh(e){let t=Eo(ne.level,e);if(!t)return;let n=kc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${ne.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${vo.join(", ")}.`);return}function Wh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Ic(e){return Wh(Eo(ne.auditScope,e))==="all"}function hs(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ys(e={},t){let n=e.safety?.level??"standard",r=Lh(t),o=Pc(n,r),i=So[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ne.level.name}=${r}`),l.paranoidRm.push(`env ${ne.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ne.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Et(ne.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ne.strict.name}`);if(Et(ne.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ne.paranoid.name}`),l.paranoidInterpreters.push(`env ${ne.paranoid.name}`);if(Et(ne.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ne.paranoidRm.name}`);if(Et(ne.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ne.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Et(ne.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:hs(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Et(e,t){let n=typeof e==="string"?gs(e,t):Eo(e,t);return n==="1"||n?.toLowerCase()==="true"}function gs(e,t){return t.get(e)}function Eo(e,t){let n=gs(e.name,t);if(n!==void 0)return n;if(e.legacyName)return gs(e.legacyName,t);return}function Oc(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var br=require("node:path");var F=require("node:fs"),q=require("node:path");function Cs(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gh=Symbol("PolicyFilesystemScope"),Fh=Symbol("PolicyFilesystemTarget"),zh=F.constants.O_NOFOLLOW??0;class Ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function on(e,t){return{[Gh]:!0,root:q.resolve(e),label:t}}function Mc(e,t){let n=q.normalize(t);if(t===""||q.isAbsolute(t)||n===".."||n.startsWith(`..${q.sep}`))throw new Ce(e.label);return{[Fh]:!0,scope:e,relativePath:n,path:q.join(e.root,n)}}function yr(e,t){return Mc(e,q.relative(e.root,q.resolve(t)))}function Dc(e,t="rules policy"){let n=q.resolve(e),r=q.parse(n).dir;return Mc(on(r,t),q.relative(r,n))}function wo(e){return Lc(e.scope.label,()=>{if(!xo(e))return null;let t=F.openSync(e.path,F.constants.O_RDONLY|zh);return Hh(t,()=>{let n=F.fstatSync(t);if(!n.isFile())throw new Ce(e.scope.label);let r=F.readFileSync(t,"utf-8"),o=F.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new Ce(e.scope.label);return xo(e),r})})}function Nc(e,t){if(e.path===t.path)return!0;return Lc(e.scope.label,()=>{if(!xo(e)||!xo(t))return!1;let n=(r)=>q.join(F.realpathSync(q.parse(r).dir),q.parse(r).base);return n(e.path)===n(t.path)})}function Lc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof Ce)throw r;throw new Ce(e)}}function Hh(e,t){try{return t()}finally{F.closeSync(e)}}function xo(e,t="file"){let n=Bh(e.scope);if(!n)return!1;let r=e.relativePath.split(q.sep);for(let o of r.keys()){let i=q.join(e.scope.root,...r.slice(0,o+1)),s=F.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new Ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new Ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new Ce(e.scope.label);$h(n,F.realpathSync(i),e.scope.label)}return!0}function Bh(e){if(!F.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!F.statSync(e.root).isDirectory())throw new Ce(e.label);return F.realpathSync(e.root)}function $h(e,t,n){let r=q.relative(e,t);if(r===".."||r.startsWith(`..${q.sep}`)||q.isAbsolute(r))throw new Ce(n)}var L=require("node:path");var sn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Wc="rulebook.json",Gc=".cc-safety-net/rules";var Fc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Uh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),lk=new RegExp(`^${jh}/(${sn.source.slice(1,-1)})/${Vh}$`);function Kh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function zc(e){if(Ro(e))try{return bs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return sn.test(e)?null:`Local rulebook sources must be bare names matching ${sn}: ${e}`}function bs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Fc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Uh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!sn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kh(o),name:o}}function Ro(e){return Fc.test(e)}var Hc="rule.json",_o="policy.json",Bc=".cc-safety-net",qh="rules",Yh="CC_SAFETY_NET_HOME",$c="`cc-safety-net rule update`";function Zh(e){return L.resolve(e,Gc)}function Xh(e){return L.join(Zh(e),Hc)}function On(e){return L.join(L.resolve(e),Bc,_o)}function Ss(e,t={}){return t.userConfigDir??(t.userConfigPath?L.dirname(t.userConfigPath):L.join(Jh(e),qh))}function Jh(e){let t=e.env.get(Yh);return t?L.resolve(Ne(t)):L.join(e.home,Bc)}function Qh(e,t={}){return L.join(Ss(e,t),Hc)}function an(e,t={}){return L.join(L.dirname(Ss(e,t)),_o)}function Uc(e,t){let n=he();return T(On(t.cwd),e.paths,n)===T(L.resolve(an(e,t)),e.paths,n)}function jc(e,t){let n=t.userConfigPath??Qh(e,t),r=t.projectConfigPath??Xh(t.cwd),o=ey(e,t),i=ty(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:yr(o,n),projectConfigTarget:yr(i,r)}}function ey(e,t){let n=t.userConfigPath?L.dirname(L.dirname(L.resolve(t.userConfigPath))):L.dirname(L.resolve(t.userConfigDir??Ss(e,t)));return on(n,"user policy")}function ty(e,t){let n=L.resolve(t),r=L.resolve(e),o=L.relative(n,r);if(o!==".."&&!o.startsWith(`..${L.sep}`)&&!L.isAbsolute(o))return on(n,"project policy");return on(L.dirname(L.dirname(r)),"project policy")}function Vc(e,t){return L.join(e,t,Wc)}var Le=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),Gt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Ft=256,te=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Kc=new Set(["python","python3","python2","node","ruby","perl"]),Ao=/^python(?:[23](?:\.\d+)*)?$/,je=new Set(["awk","gawk","nawk","mawk"]),Po=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var qc="Rulebook exceeds CC Safety Net's safe validation limits.",Yc="Additional rulebook validation errors were omitted.",Xe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Zc(e){if(vs(e.allowed_commands,Xe.maxAllowedCommands)||vs(e.rules,Xe.maxRules)||vs(e.tests,Xe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Xe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Xe.maxStringCodeUnits||i&&o.length>Xe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Xe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function vs(e,t){return Array.isArray(e)&&e.length>t}var Es=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var xs=64,ws="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return A(e).toLowerCase()}function A(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function _e(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ny={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Rs=new Set(["--init-file","--rcfile"]);function _s(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ny[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function We(e){let t=A(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Rs.has(l)&&!s.includes("="))i++;continue}let a=_s(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Cr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function ko(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of ry(e))Cr(n,t);return t.inSingle||t.inDouble}function ry(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Cr(s,n)}return t}var As=new Set(["rm","find","xargs","parallel"]),oy=new Set(["git","busybox",...As,...te,...Kc,...je]),iy=new Set(["python","node","ruby","perl"]);function Xc(e){let t=M(e);return oy.has(t)||Je(t)}function Je(e){return iy.has(sy(e))}function sy(e){let t=A(e).toLowerCase();return Ao.test(t)?"python":t}function Ps(e){try{let t=wo(ay(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=uy(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof Ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function ay(e){return typeof e==="string"?Dc(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),de=(e,t)=>({path:e,message:t,kind:"custom"});function Jc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Mn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[de(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ks=`must be one of ${Es.join(", ")}`,ly=/^[^/]+\/[^/]+$/,cy=["version","rules","overrides","transparent_wrappers"];function uy(e){let t=dy(e);return{errors:Ts(Sy(t,cy,(n)=>n.kind==="custom"),": "," "),sources:by(e,t)}}function dy(e){if(!Mn(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>xs;return[...e.version===1?[]:[w(["version"],"must be 1")],...my(e.rules,t),...gy(e.overrides),...yy(e.transparent_wrappers),...t?[]:py(e.rules),...Mn(e.overrides)?Object.keys(e.overrides).filter((n)=>!ly.test(n)).map((n)=>de(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Cy(e.transparent_wrappers)]}function my(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),...Qc(e,xs)?[w(["rules"],ws)]:[]];if(t)return[{path:["rules"],message:ws,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...fy(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Qc(e,t){let n=eu(e);return n!==void 0&&!(n<=t)}function fy(e,t){let n=eu(e);return n!==void 0&&!(n>=t)}function eu(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function py(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[de(["rules",r],"must be a non-empty rulebook source string")];let o=zc(n);if(o)return[de(["rules",r],o)];if(t.has(n))return[de(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function gy(e){if(e===void 0)return[];if(!Mn(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Mn(n))return[w(["overrides",t],'must be "off" or an object')];return[...hy(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Os(n.intent)?[]:[w(["overrides",t,"intent"],ks)]]})}function hy(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),...Qc(e,Ft)?[w(t,`must be at most ${Ft} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>Ft?[w(t,`must be at most ${Ft} characters`)]:[]}function yy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return Gt.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function Cy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!Gt.test(n))return[];if(t.has(n))return[de(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Xc(n))return[de(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function by(e,t){let n=Mn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Sy(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Ts(e,t,n){return[...new Set(e.map((r)=>{let o=Is(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Is(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Os(e){return Es.includes(e)}function Mn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function nu(e){let t=xy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var vy=`required non-empty string up to ${Ft} characters`,tu="must be a non-empty array of unique non-empty strings",Ey="required non-empty array of non-empty strings";function xy(e){if(!zt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Zc(e))return{errors:[qc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Ts(wy(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Xe.maxValidationErrors?[...t.slice(0,Xe.maxValidationErrors),Yc]:t,ruleNames:new Set(ru(e).map((n)=>n.toLowerCase()))}}function ru(e){let t=zt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=zt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function wy(e,t){return[...typeof e.name==="string"&&sn.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...Ry(e.allowed_commands),..._y(e.rules,t),...Ty(e.tests),...Iy(e),...Oy(e)]}function Ry(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&Gt.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!Gt.test(n))return[];if(t.has(n))return[de(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function _y(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!zt(n))return[w(["rules",r],"must be an object")];return t?Py(n,["rules",r]):Ay(n,["rules",r])}),...Jc(e)]}function Ay(e,t){return[...ou(e.name,t),...iu(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&Gt.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...To(e.block_args,[...t,"block_args"],"required non-empty array",!1),...su(e.reason,t),...au(e.intent,t)]}function Py(e,t){return[...ou(e.name,t),...iu(e.command,t),...su(e.reason,t),...au(e.intent,t),...ky(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function ou(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return sn.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function iu(e,t){return typeof e==="string"&&Gt.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function su(e,t){return typeof e==="string"&&e!==""&&e.length<=Ft?[]:[w([...t,"reason"],vy)]}function au(e,t){return e===void 0||Os(e)?[]:[w([...t,"intent"],ks)]}function ky(e,t){if(!zt(e))return[w(t,"required object")];return[...To(e.command_path,[...t,"command_path"],Ey,!1),...e.any_args===void 0?[]:To(e.any_args,[...t,"any_args"],tu,!0),...e.exclude_args===void 0?[]:To(e.exclude_args,[...t,"exclude_args"],tu,!0)]}function To(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[de([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[de(t,n)]:[],...r&&new Set(e).size!==e.length?[de(t,"must not contain duplicate values")]:[]]}function Ty(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!zt(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[de(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Iy(e){if(!Array.isArray(e.tests))return[];let t=new Set(ru(e));return[...new Set(e.tests.flatMap((n)=>zt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>de(["tests"],`blocked fixture references unknown rule "${n}"`))}function Oy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=zt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[de(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function zt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function fu(e,t){let n=jc(e,t),r;try{r=Nc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof Ce)return Hy(n,f.message);throw f}let o=Ps(n.userConfigTarget),i=r?{config:null,errors:[]}:Ps(n.projectConfigTarget),s=du(n.userConfigPath,o.errors),a=du(n.projectConfigPath,i.errors),l=new Set,c=o.config?lu(o.config,br.dirname(n.userConfigPath),"user",n.userScope,l):mu(),u=i.config?lu(i.config,br.dirname(n.projectConfigPath),"project",n.projectScope,l):mu(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...cu(c.rules,m),...cu(u.rules,d)],transparent_wrappers:Fy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?uu(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?zy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?uu(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function lu(e,t,n,r=on(br.dirname(br.dirname(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Dy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:My(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function My(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Dy(e,t,n){let r=Ny(e),o=Vc(t,r),i=Wy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Ly(e)}`]};let s=Gy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ny(e){return Ro(e)?bs(e).name:e}function Ly(e){return Ro(e)?`run ${$c} to vendor ${e}`:"create that file or remove that source from the rules config"}function Wy(e,t){try{return{content:wo(yr(t,e))}}catch(n){if(n instanceof Ce)return{error:n.message};throw n}}function Gy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:nu(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Fy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function cu(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function uu(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function zy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function du(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function mu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}var zo=require("node:fs");var pu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ms=new Set(pu.map((e)=>e.id)),Io=pu,By=new Map(Io.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:By.get(e)??"manual_only"}}var Ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Oo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},$y=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Uy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ns=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Uy.flatMap((e)=>$y.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Mo=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],gu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],jy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ls=gu.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ws=gu.flatMap((e)=>jy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Sr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Fs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Vy=[...Ds,Oo,...Ns,...Ls,...Ws,Sr,...Gs,...Fs,...Mo].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Do=new Set(Mo.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),zs=new Set(Vy.map((e)=>e.id));var Ge=require("node:path"),No=process.platform==="win32",hu=/[*?]/;function Hs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(No?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(hu.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function vr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Bs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=vr(e.trim(),t);if(!Ge.isAbsolute(n))return"must be an absolute path or start with ~/";return Er(n,t)}function $s(e,t){let n=yu(e,t);if(n===null)return"must be a non-empty path string";if(!Ge.isAbsolute(n))return null;if(Er(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Ky="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",qy="cannot cover the guard's own configuration";function yu(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=No?n.replaceAll("\\","/"):n;return vr(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Us(e,t){let n=yu(e,t);if(n===null)return"must be a non-empty path string";let r=Hs(n)?.root??n;if(hu.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Ge.isAbsolute(r))return null;if(Er(r,t)!==null)return Ky;return Yy(r,t)?qy:null}function Yy(e,t){let n=Lo(e),r=Lo(Ge.join(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Ge.sep}`)}function Er(e,t){let n=Lo(e),r=Lo(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Ge.sep)?n:`${n}${Ge.sep}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Lo(e){let t=Ge.normalize(e);if(No)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(No?3:1)&&t.endsWith(Ge.sep))t=t.slice(0,-1);return t}var Cu=30,Wo=1,Go=365;function bu(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Su=new Set(Io.filter((e)=>e.catastrophic).map((e)=>e.id));function _(e,t){if(!e)return null;if(Su.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ae(e,t,n){if(Su.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function vu(e,t){return Object.freeze(Object.fromEntries(Io.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Eu(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:vu(e,t)})}var xu={standard:0,strict:1,paranoid:2};function _u(e,t,n=!1,r=e.safety.level){let o=Zy(e,t,r),i=new Set(n?o.map((u)=>u.field):[]),s=(u,m)=>i.has(u)?void 0:m,a=(u,m)=>Object.fromEntries(Object.entries(m??{}).filter(([d])=>!i.has(`${u}.${d}`))),l=(u,m)=>m?.filter((d)=>!i.has(`${u}.${d}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:js(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:js(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:js(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((u)=>u.message)}}function js(e,t){return[...new Set([...e,...t??[]])]}function Zy(e,t,n){let r=t.safety?.level,o=So[n];return[...r&&xu[r]<xu[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...In.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...wu("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...wu("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!Do.has(i))),...e.destructive_command_protection.enabled?Ru(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?Ru(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function wu(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function Ru(e,t){return(t??[]).filter((n)=>!e.includes(n))}var qs=new Set(["standard","strict","paranoid"]),Tu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Cu}};function Iu(e,t){let n=sC(an(e,t),e.home),r=Uc(e,t)?{exists:!1,policy:xr(),errors:[]}:Ho(On(t.cwd),e.home),o=Jy(r.parsed,e.home),i=Et(ne.projectTightenOnly,e.env),s=n.gui??Tu,a=Object.keys(o.policy).length>0?_u(s,o.policy,i,Tc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),u=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?Ks(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:u,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var Xy="project policy audit settings are ignored; audit is user scope only";function Jy(e,t){if(!Fe(e))return{policy:{},diagnostics:[]};let n=Fe(e.safety)?e.safety:{},r=Fe(e.workflow)?e.workflow:{},o=Fe(e.destructive_command_protection)?e.destructive_command_protection:{},i=Fe(e.secret_protection)?e.secret_protection:{},s={...qs.has(n.level)?{level:n.level}:{},...Fe(n.overrides)?Au({overrides:Ou(n.overrides,In,["safety","overrides"],ln)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Fo(o.overrides,Ms,Du,ln)}:{},...o.allow_paths!==void 0?{allow_paths:Nn(o.allow_paths,Bs,t,["destructive_command_protection","allow_paths"],ln)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Fo(i.overrides,zs,Nu,ln)}:{},...i.deny_paths!==void 0?{deny_paths:Nn(i.deny_paths,$s,t,["secret_protection","deny_paths"],ln)}:{},...i.allow_paths!==void 0?{allow_paths:Nn(i.allow_paths,Us,t,["secret_protection","allow_paths"],ln)}:{}};return{policy:Au({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Xy]}}function Ou(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],Ys));return[]}))}function Au(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var ln=()=>{return},Ys="must be a boolean",Zs="must be an object if provided",Mu=`must be an integer between ${Wo} and ${Go}`,Du={path:["destructive_command_protection","overrides"],label:"destructive command"},Nu={path:["secret_protection","overrides"],label:"secret protection"},Qy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function eC(e,t){let n=[];return{policy:Lu(e,t,(o)=>{n.push(o)}),issues:n}}function tC(e,t){return Lu(e,t,ln)}function Lu(e,t,n){if(!Fe(e))return n(w([],"Config must be an object")),xr();if(e.version!==1)n(w(["version"],"must be 1"));let r=Dn(e.safety,["safety"],["level","overrides"],n),o=Dn(r.overrides,["safety","overrides"],In,n),i=Dn(e.workflow,["workflow"],["worktree_mode"],n),s=Dn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=Dn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=Dn(e.audit,["audit"],["retention_days"],n);return Wu(e,Qy,[],n),{version:1,safety:{level:nC(r.level,n),overrides:Ou(o,In,["safety","overrides"],n)},workflow:{worktree_mode:Vs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Vs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Fo(s.overrides,Ms,Du,n),allow_paths:Nn(s.allow_paths,Bs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Vs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Fo(a.overrides,zs,Nu,n),deny_paths:Nn(a.deny_paths,$s,t,["secret_protection","deny_paths"],n),allow_paths:Nn(a.allow_paths,Us,t,["secret_protection","allow_paths"],n)},audit:{retention_days:rC(l.retention_days,n)}}}function Dn(e,t,n,r){if(e===void 0)return{};if(!Fe(e))return r(w(t,Zs)),{};return Wu(e,n,t,r),e}function Wu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function nC(e,t){if(e===void 0)return"standard";if(qs.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Vs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,Ys));return n}function rC(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Wo&&e<=Go))t(w(["audit","retention_days"],Mu));return bu(e)}function Fo(e,t,n,r){if(e===void 0)return{};if(!Fe(e))return r(w(n.path,Zs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function Nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?de([...r,s],a):w([...r,s],a)),[]})}function Fe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function xr(){return structuredClone(Tu)}function Ho(e,t){if(!zo.existsSync(e))return{exists:!1,policy:xr(),errors:[]};try{let n=zo.readFileSync(e,"utf-8");if(!n.trim())return{exists:!0,policy:xr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=eC(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${iC(i)}`),fallback:Fe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:xr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var oC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Zs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ys,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Mu,`not an integer between ${Wo} and ${Go}`]]);function iC(e){let t=Is(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=oC.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function sC(e,t){let n=Ho(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Fe(r))return{policy:ku(),errors:[]};let o=tC(r,t);return{policy:Ks(o),gui:o,errors:[],levelPresent:Pu(r)}}if(n.parsed===void 0)return{policy:ku(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Ks(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Pu(n.parsed)}}function Pu(e){let t=Fe(e)&&Fe(e.safety)?e.safety:{};return qs.has(t.level)}function Gu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Do].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function ku(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Gu({}),denyPaths:[],allowPaths:[]}}}function Ks(e){return{safety:aC(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Gu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function aC(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Fu(e,t){let n=fu(e,t),r=Iu(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...dC(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return mC(o,lC(n,r),s,r.policyScopes)}function lC(e,t){let n=uC(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:fC(e.errors.length>0?cC(e.errors):void 0,e.warnings.length>0?Js(e.warnings.join("; ")):void 0,n)}}function cC(e){return`${Js(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function uC(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function dC(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function mC(e,t,n=Object.freeze({}),r){let o=Xs(structuredClone(e)),i=r?{policyScopes:Xs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Xs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Xs(t);return Object.freeze(e)}function fC(...e){return Js(e.filter((t)=>!!t).join("; "))}function Js(e){return/[.!?]$/.test(e)?e:`${e}.`}function zu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Qs(t.fail_closed,e.strict,"strict"),paranoid_rm:Qs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Qs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Eu(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:hs({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Qs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}var Ye=require("node:path");function wr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var pC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Bo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Rr(e){let t=Bo(e.words[0],"time")?1:0,n=t===1&&Bo(e.words[t],"-p")?t+1:t,r=t===1&&Bo(e.words[n],"--")?n+1:n,o=Bo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!pC.test(s.text));return i?.provenance==="literal"?i.text:void 0}var Ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function $o(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function gC(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>Ae(t)))})}function Uo(e,t,n){e.push(n),t.reset()}function jo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ea(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function Ln(e,t,n,r,o,i,s){return ea({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function Ae(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return gC(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:Ae(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function ta(e,t,n){if(t>=n||Bu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Bu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Hu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Hu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function na(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=hC(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?yC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Hu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Bu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function hC(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function yC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Ku=new Set(["&&","||","|","|&"]),CC=new Set(["!","do","elif","else","if","then","until","while"]);function qu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Ae({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=qo(e,0,e.length,t,r,0),i=AC(e,r.quotedExpansionEnd,o.nodes)?[...o.issues,Xu]:o.issues;return Ae({kind:"program",dialect:"posix",source:e,span:n,status:Zo(i,o.limited),issues:i,nodes:o.nodes})}function qo(e,t,n,r,o,i,s){let a=[],l=[],c=$o(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);Uo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),Vu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(Ar(f)){if(f===`
+`||f==="\r"){m();let k=f==="\r"&&e[d+1]===`
+`?d+2:d+1,I=a.at(-1);if(I?.kind!=="connector"||!Ku.has(I.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,k),span:Object.freeze({start:d,end:k})}));if(u.length>0){let O=na(e,k,n,u.splice(0));l.push(...O.issues),d=O.next;continue}d=k;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let g=c.start===-1?jC(e,d,n):void 0;if(g){if(oa(a,l),i>=r.maxDepth)return Wn(a,l,d,"depth-limit",r.maxDepth);if(!ra(o))return Wn(a,l,d,"word-limit",r.maxWords);let k=qo(e,g.braceIndex+1,n,r,o,i+1,"}"),I=k.next,O={start:g.braceIndex+1,end:k.closed?I-1:I},H=$u(e,O,k);if(a.push({kind:"function",name:g.name,span:{start:d,end:I},body:H}),l.push(...k.issues),k.pendingHeredocs.length>0||Pr(k.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...k.pendingHeredocs),k.limited)return Ko(a,l,k.next);if(!k.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=I;continue}let p=Yo(e,d);if(p){if(m(),!od(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&OC(e,d,n))&&c.start===-1){if(oa(a,l),i>=r.maxDepth)return Wn(a,l,d,"depth-limit",r.maxDepth);let k=f==="("?")":"}",I=qo(e,d+1,n,r,o,i+1,k),O=I.next,H={start:d+1,end:I.closed?O-1:O},Se=$u(e,H,I);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:O},body:Se}),l.push(...I.issues),I.pendingHeredocs.length>0||Pr(I.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...I.pendingHeredocs),I.limited)return Ko(a,l,I.next);if(!I.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=O;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?EC(e,d):null;if(h){let k=c.words.at(-1),I=k&&k.span.end===d&&/^[0-9]+$/.test(k.raw)?Number(k.raw):void 0;if(I!==void 0)c.words.pop();let O=I===void 0?d:k?.span.start??d;c.start=c.start===-1?d:c.start;let H=d+h.length;while(H<n&&/[ \t]/.test(e[H]??""))H++;let Se=e[H],ht=H>d+h.length&&Se==="#",Me=!Se||Ar(Se)||!!Yo(e,H)||Se===s||Se===")"||ht||(Se==="<"||Se===">")&&e[H+1]!=="(",tn=h==="<<"||h==="<<-",V=tn?ta(e,H,n):void 0,G=V?{word:Ln(e,H,V.next,V.delimiter,"literal",V.quoted),nested:[],issues:[],next:V.next,limited:!1}:!Me?ia(e,H,n,r,o,i):void 0;if(G){if(l.push(...G.issues),G.limited)return Ko(a,l,G.next);if(!ra(o))return Wn(a,l,G.next,"word-limit",r.maxWords)}let ge=G?.next??d+h.length,ie={kind:"redirection",operator:h,span:{start:O,end:ge},...I===void 0?{}:{fd:I},...G?{target:G.word}:{}};if(c.redirections.push(ie),tn&&!V)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(V){if(V.ambiguous||V.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let se=c.nested;u.push({delimiter:V.delimiter,quotedDelimiter:V.quoted,stripTabs:h==="<<-",attach:(De)=>{if(ie.heredoc=De,De.quotedDelimiter)return;let Lt=SC(e,De.bodySpan.start,De.bodySpan.end,r,o,i+1);se.push(...Lt.programs),l.push(...Lt.issues)}})}if(!tn&&!G)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(G)c.nested.push(...G.nested);c.end=ge,d=ge;continue}let y=c.start===-1;if(y)oa(a,l);let b=ia(e,d,n,r,o,i);if(l.push(...b.issues),b.limited)return Ko(a,l,b.next);let C=NC(c.words)?zC(e,b.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(C?.limitCode)return Wn(a,l,b.next,C.limitCode,C.limitCode==="word-limit"?r.maxWords:C.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=C?.words??[b.word];for(let k of E){if(!ra(o))return Wn(a,l,b.next,"word-limit",r.maxWords);c.words.push(k)}if(c.start=c.start===-1?d:c.start,c.end=b.next,c.nested.push(...b.nested),y&&id(b.word))m();d=b.next>d?b.next:d+1}return m(),Vu(a,l),l.push(...VC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function $u(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Zo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ia(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||Ar(f)||(f===";"||f==="|"||f==="&")&&Yo(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(f==='"'){l=!0;let y=bC(e,a,n,r,o,i);if(s+=y.text,u.push(...y.nested),m.push(...y.issues),d||=y.limited,c=_r(c,y.provenance),a=y.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let y=kC(e,a+2,n);if(s+=y.text,m.push(...y.issues),!y.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(f==="\\"){let y=e[a+1];if(!y){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
+`){a+=2;continue}s+=y,a+=2;continue}if(un(e,a))m.push(cn);let p=f==="$"||f==="<"||f===">"||f==="`"?kr(e,a,n,r,o,i):null,h=p?aa(p,u,m):Ju(e,a,n,r,o,i,u,m);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(d||=h.limited,c=_r(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let y=ed(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(f==="*"||f==="?"||f==="[")c=_r(c,"glob");s+=f,a++}return{word:Ln(e,t,a,s,c,l,c==="literal"?void 0:IC(e,t,a)),nested:u,issues:m,next:a,limited:d}}function bC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(un(e,m))c.push(cn);let f=kr(e,m,n,r,o,i),g=f?aa(f,l,c):Ju(e,m,n,r,o,i,l,c);if(g){if(g.provenance!=="command-substitution")s+=e.slice(m,g.next);if(m=g.next,u||=g.limited,a=_r(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=ed(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function kr(e,t,n,r,o,i){let s=Zu(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",u=l==="`",m=e[t]==="<"||e[t]===">",d=la(e,t+a,n,l),f=d===-1?n:d,g=d===-1?n:d+l.length;if(i>=r.maxDepth)return{program:UC(e,t+a,f,"depth-limit"),next:g,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],k=[],I=!1,O=t+a;while(O<f){let H=kr(e,O,f,r,o,i+1);if(!H){if(un(e,O))k.push(cn);O++;continue}if(E.push(...H.program.nodes),k.push(...H.program.issues),I||=H.program.status==="limited",O=H.next,I)break}if(d===-1)k.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:Ae({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Zo(k,I),issues:k,nodes:E}),next:g,provenance:"arithmetic"}}let p=qo(e,t+a,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(u||m)&&Pr(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],b=u&&/\\[\\$`\n]/.test(e.slice(t+a,f))?[PC]:[],C=[...p.issues,...h,...y,...b];return{program:Ae({kind:"program",dialect:"posix",source:e.slice(t+a,f),span:{start:t+a,end:f},status:Zo(C,p.limited),issues:C,nodes:p.nodes}),next:g,provenance:"command-substitution"}}function SC(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let u=c==="$"||c==="`"?kr(e,l,n,r,o,i):null;if(!u){if(un(e,l))a.push(cn);l++;continue}if(s.push(u.program),xC(e,l,u.next)&&wC(u.program))a.push(cn);l=u.next}return{programs:s,issues:a}}function aa(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function la(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let m=l==="\r"&&e[a+1]===`
+`?a+2:a+1,d=na(e,m,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=Yu(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let m=vC(e,a+3,n);if(m===-1)return-1;a=m+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let m=e[a+2]==="-",d=a+(m?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let f=ta(e,d,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:m,attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let u=i.pop();if(u){o=u;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function vC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Yu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Yu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!KC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function Yo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function EC(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function Ar(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var cn=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function un(e,t){if(e[t]!=="$")return!1;let n=Uu(e,t+1);if(e[n]!=="{")return!1;let r=e[Uu(e,n+1)]??"";return r==="|"||Ar(r)}function xC(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(un(e,r))return!0;return!1}function wC(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===cn.code)}function Uu(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
+`,n))n+=e[n+1]==="\r"?3:2;return n}function Zu(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var RC=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Xu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),_C=/\$\(|`|[<>]\(/g;function AC(e,t,n){let r=sa(n);return[...e.slice(t).matchAll(_C)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function sa(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>sa(n.nodes))];return t.kind==="group"||t.kind==="function"?sa(t.body.nodes):[]})}var PC=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Ju(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=Xo(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(RC);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(Xu);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let u=l.substitutions.some((m)=>{if(un(e,m))return a.push(cn),!1;let d=kr(e,m,c,r,o,i);return d!==null&&aa(d,s,a).limited});return{provenance:"variable",next:c,limited:u}}function Xo(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&un(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
+`,a+=l==="\\"?2:1;continue}let c=Zu(e,a);if(c){r.push(a);let u=la(e,a+c.length,n,c.closing);if(u===-1)break;a=u+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function Qu(e,t,n){if(e[t+1]==="{"){let o=Xo(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function kC(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=TC(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function TC(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Vo(e,t+1,n,16,2,t+1);if(r==="u")return Vo(e,t+1,n,16,4,t+1);if(r==="U")return Vo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Vo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Vo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Zo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"))return"invalid";return e.length>0?"partial":"complete"}function ed(e,t,n,r,o){let i=Qu(e,t,n);return{text:r+e.slice(t,i),provenance:_r(o,"variable"),next:i}}function IC(e,t,n){let r=jo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=la(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Qu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function _r(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function OC(e,t,n){return t+1>=n||Ar(e[t+1]??"")||Yo(e,t+1)!==null}var MC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),DC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function NC(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=LC(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function LC(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return WC(e,t);if(n==="env")return GC(e,t);if(n==="sudo")return FC(e,t);return}function WC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function GC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(MC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function FC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(DC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function td(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=nd(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>rd(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function zC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=nd(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>rd(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>Ln(e,t.span.start,t.span.end,a,"literal",!1))}}function nd(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>ju(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=ju(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...HC(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function ju(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&$C(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:BC(e,r)}}function HC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function BC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function $C(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function rd(e,t){let n=`x${e}`,r=ia(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function UC(e,t,n,r){return Ae({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function Wn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ko(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ra(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function jC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Pr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Pr(n.nodes));return(t.kind==="group"||t.kind==="function")&&Pr(t.body.nodes)})}function VC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function od(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Vu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Ku.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function id(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&CC.has(e.text)}function oa(e,t){let n=e.at(-1);if(!od(n))return;if(n?.kind==="command"&&id(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function KC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var ad=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),qC=new Set(["gc","cat","type","cp","mv","rm"]),ld=["-rec","-for","-path","-literalpath","-whatif"],YC=/^\$env:\w/i,ZC=/^(?:\$\{?\w+\}?|~)\\./;function cd(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...ad].some((o)=>n.includes(o))&&!(n.includes("rm")&&ld.some((o)=>n.includes(o)))&&!n.includes("<#")&&!XC(n))return!1;let r=ma(e,t);if(ud(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||da(r).some(JC)}function ud(e){return e.nodes.some((t)=>{if(t.kind==="group")return ud(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function XC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function JC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&ad.has(n))return!0;let r=e.slice(t+1);if(n&&qC.has(n)&&r.some(QC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return ld.some((s)=>i.startsWith(s))})}function QC(e){return YC.test(e)||ZC.test(e)}function ma(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Ae({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=fa(e,0,e.length,t,0);return Ae({kind:"program",dialect:"powershell",source:e,span:n,status:ob(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function fa(e,t,n,r,o,i=!1){let s=[],a=[],l=$o(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Uo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=rb(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(ca(e,d,y)),d=y;continue}d++;continue}let p=fd(e,d);if(p){m(),s.push(ca(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(md(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=fa(e,d+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,C=Ae({kind:"program",dialect:"powershell",source:e.slice(d+1,b),span:{start:d+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:C})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(ca(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let C=b<n?sd(e,b,n,r,o):void 0,E=C?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:E}),...C?{target:C.word}:{}})),C)a.push(...C.issues),l.nested.push(...C.nested),c+=C.words,u||=C.limited;l.end=E,d=E;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(ea({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=sd(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function sd(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=eb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=ua(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||fd(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:Ln(e,t,f,i,s,a,s==="literal"?void 0:tb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function eb(e,t,n,r,o){let i=dd(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:Ae({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[md(r.maxDepth)],nodes:[]}),next:a};let l=fa(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:Ae({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function dd(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ua(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ua(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ua(r)}}return t}function tb(e,t,n){let r=jo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=dd(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=nb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function nb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function md(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function da(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return da(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(da)]})}function fd(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function rb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function ob(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ca(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Qe(e,t="auto",n=Ht){if(t==="powershell"||t==="auto"&&cd(e.slice(0,n.maxInputLength),n))return ma(e,n);return qu(e,n)}function R(e){return e.provenance==="command-substitution"?e.raw:e.text}function Gn(e,t){return e==="posix"?t:ee(t.map((n)=>n.text))}function Jo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function ee(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function pa(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function re(e){return e.value.length}function Tr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function ze(e,t){Tr(e,t)}function dn(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function Y(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ga(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function Z(e,t,n){if(t+n.length>re(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function xt(e,t,n){return!dn(S(e,t-1))&&Z(e,t,n)&&!dn(S(e,t+n.length))}function wt(e,t){return dn(S(e,t-1))!==dn(S(e,t))}function me(e){return e===`
+`||e===";"||e==="&"||e==="|"}function Fn(e){return e==="|"||e===";"}function Qo(e,t,n){let r=pa(e,n);if(t==="rm")return ib(r);if(t==="dd")return ab(r);return bd(r,!0)}function ei(e,t,n){let r=pa(e,n);if(t==="rm")return lb(r);if(t==="reset-hard")return yd(r,"--ha","rd");if(t==="reset-merge")return yd(r,"--me","rge");if(t==="clean")return mb(r);if(t==="checkout")return pb(r);if(t==="push-force")return gb(r);if(t==="push-refspec")return hb(r);if(t==="push-delete")return yb(r);if(t==="branch")return Cb(r);if(t==="tag")return vb(r);if(t==="restore")return Eb(r);return bd(r,!1)}function ib(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=re(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(xt(e,i,"rm")&&Y(l)&&l!==`
+`)t=!0,i++;continue}let a=sb(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===re(e)){if(o>=0){let l=pd(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(Y(s)){if(o<0)continue;if(Z(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=pd(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function sb(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(Z(e,t,String.raw`\n`))return t+2;if(Z(e,t,String.raw`\x0a`)||Z(e,t,String.raw`\x0A`))return t+5;if(Z(e,t,String.raw`\u000a`)||Z(e,t,String.raw`\u000A`))return t+7;return Z(e,t,String.raw`\012`)?t+4:-1}function pd(e,t,n){if(gd(e,t,n,"recursive"))return{recursive:!0,force:!1};if(gd(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function gd(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Z(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function ab(e){let t=!1;for(let n=0;n<re(e);n++){if(me(S(e,n))){t=!1;continue}if(xt(e,n,"dd")){t=!0,n++;continue}if(!t||!xt(e,n,"of")||!Z(e,n,"of=/dev/"))continue;let r=n+8;if(r<re(e)&&!Y(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function lb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=re(e);){let i=S(e,o);if(o===re(e)||me(i)){t=!1,n=!1,r=!1,o++;continue}let s=ub(e,o);if(s>=0){if(cb(e,s))return!0;let a=s,l=!1;while(Y(S(e,a)))l||=S(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Z(e,o,"--")&&(o===0||Y(S(e,o-1)))&&(!S(e,o+2)||Y(S(e,o+2))||me(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Z(e,o,"--recursive")&&wt(e,o+11)||ha(e,o,"recursive"),r||=Z(e,o,"--force")&&wt(e,o+7)||ha(e,o,"force"),n&&r)return!0;o++}return!1}function ha(e,t,n){if(!Z(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||Y(o)||me(o))break;if(o!==n[r])return!1;r++}return r>0&&wt(e,t+r+2)}function cb(e,t){let n=t,r=!1,o=!1;while(n<re(e)){while(Y(S(e,n)))n++;let i=n;while(n<re(e)&&!Y(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&Z(e,i,"--"))return!1;let s=hd(e,i,"recursive"),a=hd(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=db(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function hd(e,t,n){return Z(e,t,`--${n}`)&&wt(e,t+n.length+2)||ha(e,t,n)}function ub(e,t){if(t>0&&dn(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!Y(S(e,n+1)))return-1;return n+1}function db(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&wt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function yd(e,t,n){return Or(e,"reset",Fn,!0,(r)=>S(e,r)==="-"&&zn(e,r,t,n)?!0:r)}function mb(e){return Or(e,"clean",Fn,!0,(t)=>{if(S(e,t)!=="-")return t;if(zn(e,t,"--fo","rce"))return!0;let n=Ir(e,t,Fn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function ti(e,t,n){if(!xt(e,t,"git"))return null;let r=t+3;if(!Y(S(e,r)))return{commandEnd:-1,next:r};while(Y(S(e,r)))r++;while(r<re(e)){if(me(S(e,r)))return{commandEnd:-1,next:r};let o=Ir(e,r,me);if(xt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Z(e,r,"--"),s=fb(e,r,o);r=o;while(Y(S(e,r)))r++;if(i)return{commandEnd:xt(e,r,n)?r+n.length:-1,next:Ir(e,r,me)};if(!s)continue;if(r>=re(e)||me(S(e,r)))return{commandEnd:-1,next:r};r=Ir(e,r,me);while(Y(S(e,r)))r++}return{commandEnd:-1,next:r}}function fb(e,t,n){for(let r of Le)if(n-t===r.length&&Z(e,t,r))return!0;return!1}function pb(e){return Cd(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function gb(e){return Or(e,"push",Fn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!dn(S(e,t+2))&&!Z(e,t+2,"-with-lease"))return!0;let n=Sd(e,t,"--fo","rce");if(n>=0&&!Z(e,n,"-with-lease"))return!0;return t})}function hb(e){return Or(e,"push",me,!1,(t)=>{if(Y(S(e,t))&&S(e,t+1)==="+"&&t+2<re(e)&&!me(S(e,t+2))&&!Y(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function yb(e){return Or(e,"push",me,!1,(t)=>{if(S(e,t)==="-"&&zn(e,t,"--de","lete"))return!0;if(Y(S(e,t))&&S(e,t+1)===":"&&t+2<re(e)&&!Y(S(e,t+2))&&!me(S(e,t+2)))return!0;return t})}function Cb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=re(e);o++){if(o===re(e)||me(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=ti(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=Ir(e,o,me),s=bb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function bb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(zn(e,i,"--de","lete"))r=!0;if(zn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&Sb(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!wt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function Sb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function vb(e){return Cd(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Cd(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<re(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(Y(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=ti(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&Y(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(zn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&wt(e,r+1))return!0;if(Fn(o))i.outerActive=!1}return!1}function Or(e,t,n,r,o){let i=!1;for(let s=0;s<re(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=ti(e,s,t);if(c){i=c.commandEnd>=0&&(!r||Y(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Eb(e){let t=!1;for(let n=0;n<re(e);n++){if(ga(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=ti(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(Z(e,n+2,"staged")||Z(e,n+2,"help")))t=!1}return t}function bd(e,t){let n=!1;for(let r=0;r<re(e);r++){let o=S(e,r),i=t?ga(o):me(o);if(n&&Y(o)&&S(e,r+1)==="-"&&xt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(xt(e,r,"find"))n=!0,r+=3}return!1}function Ir(e,t,n){let r=t;while(r<re(e)&&!Y(S(e,r))&&!n(S(e,r)))r++;return r}function Sd(e,t,n,r){if(!Z(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return wt(e,o)?o:-1}function zn(e,t,n,r){return Sd(e,t,n,r)>=0}function Ve(e,t){Tr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)ze(t,a);if((s.regex?.test(a)??!1)||s.scan&&ei(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var xb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ed(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Tr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return xd(t.nodes,r,i)}function xd(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return xd(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return wb(r,t,n)})}function wb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!xb.test(o.text));return e.words.every((o,i)=>o===t||vd(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||vd(o.target.raw,n.anchored,!0)))}function vd(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Mr=require("node:path");function Dr(e,t,n,r){let o=Mr.isAbsolute(e)?Mr.resolve(e):t?Mr.resolve(t,e):void 0;if(!o)return;try{return T(o,n,r)}catch{return o}}function wd(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var Hn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Nr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ca=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Rb=new Set(["-p","--print"]),_b=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Ab=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Pb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kb=new Map([["python",new Set(["m"])]]),Tb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Ib=new Set(["always","default","never"]),Ob=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Mb=/\\\r?\n/g,Db=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Rd(e){return ri(e).code}function ni(e){return ri(e).sources}function _d(e){return Db.get(Sa(e))??[]}function ri(e){let t=Sa(e[0]??"");if(!Ca.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return et(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return et(t,n,r,o,i,s);if(t==="node"&&Rb.has(s)){let m=e[i+1];if(m===void 0)return et(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Lb(t,s)){let m=e[i+1];if(m===void 0)return et(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return et(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Wb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Nb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,et(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return et(t,n,r,o);if(Tb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Ob.has(s))||t==="python"&&!Ib.has(m))return et(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(kb.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return et(t,n,r,o)}if(_b.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Ab.get(t)?.has(d)){if(m+1===s.length)i++;break}if(Pb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return et(t,n,r,o);if(c)i++}return et(t,n,r,o,void 0,void 0,!0)}function et(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function Nb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ba(e,t){return Sa(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Sa(e){let t=A(e).toLowerCase();return Ao.test(t)?"python":t}function Lb(e,t){return Ca.get(e)?.has(t)??!1}function Wb(e){return Ca.get(e)?.has("--eval")??!1}function Lr(e,t,n=!1){let r=zb(e,t);if(!ya(r,t))return!1;ze(t,r);let o=Fb(r);if(ya(o,t))return!0;if(ze(t,o),!Ad.test(o))return!1;return!n||Gb(r,t)}function Gb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Ad.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:va(i,c)}});if(s.some((l)=>Ea(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&ya(l.text,t)})}function va(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ea(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Ad=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Fb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ya(e,t){if(Qo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(ze(t,e),r.test(e))return!0;if(Qo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(ze(t,e),r.test(e))return!0;if(Qo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(ze(t,e),n.some((o)=>ei(o,r))))}function zb(e,t){return ze(t,e),e.replace(Mb,"")}var gi=require("node:fs"),mt=require("node:path");var Gr=require("node:path");var Bt=require("node:path");function $t(e,t,n){if(Ct(t))throw Error("Unsupported Windows namespace path");let r=Bt.isAbsolute(t)?Bt.parse(t).root:"",o=r||e;for(let i of Bb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Bt.dirname(o);continue}let s=Hb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Hb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Bt.sep}${t}`}function Bb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var xa=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],$b=new Set(xa),Ub=1024,Pd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),kd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),jb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function oi(e){return $b.has(e)}function wa(e){return oi(e)||Pd.has(e)||kd.has(e)||hr(e)}function Rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Td(e,t){let n=Rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Ub?{state:"valid",count:r}:{state:"invalid"}}function ii(e,t,n){let o=e.match(jb)?.[1];if(!o||!wa(o))return null;let i=e.indexOf("=");return{name:o,value:`${Rt(o,t,n)??""}${e.slice(i+1)}`}}function Id(e){return Md(e,kd)}function Od(e){return Md(e,Pd)}function Md(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Nd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ke(e){if(!Nd.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function si(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ke(R(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ld(e){let t=M(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function mn(e,t,n,r){if(!Ld(Bn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<J.wrapperPeelIterations.cap;m++){let d=Dd(i),f=si(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&Bn(i).includes("=")&&!Kb(i)){let p=qb(Bn(i),a,t.env)??ii(Bn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=M(Bn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=Zb(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=Qb(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=eS(i);if(g==="builtin")i=i.slice(tt(i,1)==="--"?2:1);if(Dd(i)===d)break}let u=si(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Vb(u.words,o)}}function Vb(e,t){return e.some((n)=>!t.has(n))}function Dd(e){return e.map(R).join(" ")}function Bn(e){let t=e[0];return t?R(t):""}function tt(e,t){let n=e[t];return n?R(n):void 0}function Kb(e){return Nd.test(Bn(e))}function qb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Yb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Zb(e,t,n){let r=1,o=n;while(r<e.length){let i=tt(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=tt(e,r+1);o=s?Wr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Wr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Wr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Yb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Xb=new Set(["-i","-0","--null"]),Jb=new Set(["-u","--unset","-C","--chdir","-P"]);function Qb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=tt(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Xb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=tt(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:tt(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Jb.has(c)){if(c==="-C"||c==="--chdir"){let m=tt(e,a+1);s=m?Wr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Wr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ke(c))break;while(a<e.length){let m=Ke(tt(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(tt(e,a)==="--")a++;return l(a)}return l(a)}function Wr(e,t,n){if(t==="")return null;if(!e&&!Gr.isAbsolute(t))return null;let r=Gr.isAbsolute(t)?Gr.parse(t).root:n.realpath(e??"/");if(r===null)return null;try{return $t(r,t,n)}catch{return null}}function eS(e){if(tt(e,1)==="-v")return[...ee(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=tt(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var tS=/['"\\$`{}#]/;function ai(e,t){if(e.some((r)=>tS.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Ut(e,t,n){return li(e,t,n).tokens}function nS(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function jt(e,t,n,r=0){let o=li(e,t,n),i=(o.envSplitValues??[]).flatMap(nS);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return jt(s,t,n,r+1)}function li(e,t,n,r){if(!Ld(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=mn(ee(e),t,n,r);return{tokens:o.words.map(R),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Pa=Symbol("adopt-as-operand"),rS=new Set(["env","sudo","command","builtin"]),oS=new Set(["&&","||","|&","|","&",";"]),iS=new Set(["<<","<<<",">|"]),sS=new Set(["|","|&"]),aS=/[*@#?$!_-]/,lS=/^\w+(?::\w+)*/,cS=Object.freeze([]),Fr=Object.freeze({kind:"scope",edge:"enter"}),zr=Object.freeze({kind:"scope",edge:"exit"}),uS=Object.freeze([]),dS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Hr=new Set(["bash","sh","zsh","dash","ksh"]),mS=256,Hd=new WeakMap;function Bd(e,t){let n=t.status==="complete"?new Set(Aa(t)):new Set,r=gS(e,n);if(ko(r))return ci("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=fn(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return ci("structural-limit",r,t);if(o.invalid)return ci("invalid",r,t);let s=ci("complete",r,t,o.assignmentFallbacks);return Hd.set(s,Object.freeze(i)),s}function di(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of $d(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=fS(a,s,n,r),c=a.length>0&&sS.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Pa){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function mi(e){return $d(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Pe(i,t);return a?Pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Br(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function fS(e,t,n,r){let o=Br(e)?new Map([...t.variables,...pS(e,t.variables)]):t.variables,i=Ut([...e],n),s=A(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ye(Pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function pS(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Pe(o,t)]]:[]})}function $d(e){return Hd.get(e)??cS}function gS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function ci(e,t,n,r=uS){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function fn(e,t){return e.nodes.flatMap((n,r)=>hS(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function hS(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[nt(vS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[nt(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ui("{"),...fn(e.body,a),...s?[ui("}")]:[]]:[Fr,nt("("),...fn(e.body,a),...s?[nt(")")]:[],zr]}]}let o=RS(e,r.functions);if(o){if(r.depth>=Ht.maxDepth||++r.flags.expansions>mS)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Wd(e,r),ui(";"),...fn(o,{...r,depth:r.depth+1}),ui(";")]},...Gd(e,t,n,r)]}return[{start:e.span.start,events:Wd(e,r)},...Gd(e,t,n,r)]}function Wd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:jd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:yS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function yS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?jd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ka(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:ES(r),targetOrder:iS.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Kd(t)}:{}}),...s===void 0?o:o.slice(1)]}function Gd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ka(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[nt(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Ud(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?CS(t,n,r):[]]}function CS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Ud(n.source.slice(r.span.end,e.span.end),n)}]}function Ud(e,t){if(t.depth>=Ht.maxDepth)return t.flags.limited=!0,[];let n=Qe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=fn(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function jd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?nt("glob"):s!==""||e.quoted&&o.length===0?ka(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Ra(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(nt(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Ra(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?fn(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(Fr,...g,zr);continue}let m=u?fn(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Fr,...m,zr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?nt("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Fr,...m,...c.raw.endsWith(")")?[nt(")")]:[],zr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>nt("(")),...d===1?[Fr]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>nt(")")):[],...d===1?[zr]:[])}return l(),o}function Ra(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Fd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Fd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Fd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?SS(e,t+2):Xo(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return bS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&aS.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?lS:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function bS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ra(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function SS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function vS(e){return/^[\r\n]+$/.test(e)?";":e}function nt(e){return Object.freeze({kind:"operator",operator:e,boundary:oS.has(e)})}function ui(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ka(e){return Object.freeze({kind:"word",text:e})}function ES(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function $r(e){return dS.has(e)||/^python\d/.test(e)}var xS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Vd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=xS.get(e)?.has(n)??!1;return Vd(e,t.slice(r?2:1))}function _a(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return _a(e.slice(1));if(!rS.has(t))return[...e];return _a(Vd(t,e.slice(1)))}function Kd(e){let t=Rr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return _a(n<0?[]:e.words.slice(n).map((r)=>r.text))}function wS(e){let t=Kd(e)[0];if(t===void 0)return!1;let n=A(t).toLowerCase();return $r(n)&&!Hr.has(n)}function Aa(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Aa(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Aa(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(wS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!AS(t))return r;return[...r,...o]})}function RS(e,t){let n=Rr(e);return n===void 0?void 0:t.get(n)}function Vt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function _S(e){if(Vt(e.words[0],"git"))return Vt(e.words[1],"commit");if(!Vt(e.words[0],"gh")||!Vt(e.words[2],"create"))return!1;return Vt(e.words[1],"pr")||Vt(e.words[1],"issue")}function AS(e){return(Vt(e.words[0],"cat")||Vt(e.words[0],"tee")||_S(e))&&!e.words.some(zd)&&!e.redirections.some((n)=>zd(n.target))}function zd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var qd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Yd=new Set([...qd,"glob"]),PS=new Set([...Yd,"folder","pattern","patterns"]);class rt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Zd(e){let t=kS(),n=Wt(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:TS(e),store:t}}function ke(e,t){return e.commands.find((n)=>n.usages.includes(t))}function _t(e,t){if(!e.includes("$"))return e;return ls(e,t)}function kS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Qe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Bd(i,a);return e.set(i,c),c},getCommandProgram:r}}function TS(e){let t=e.route.kind==="grep"?Yd:e.route.kind==="glob"?PS:qd;return[...go(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?ho(e.input):[]]}var IS=new Set(["-S","--suffix"]);function $n(e,t,n,r,o){if(e.status==="structural-limit")throw new rt;if(e.status!=="complete")return o.findMalformedTarget(e.source);return di(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Pe(i.target,s.variables),s)?i.target:null})}function fi(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&IS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ot="Git metadata and hooks are protected. Ask the user before modifying them.";function Jd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(po(e.invocation.toolName))return null;let a=e.paths.find((l)=>Xd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ke(e,"input-candidate");if(!i)return null;let s=$n(i.shell,o,n,r,{findSegmentTarget:(a,l)=>WS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Xd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function pn(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=hi(ye(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ta(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?pi(m,l):OS(m,l);if(n.markerFiles.some(u))return!0;return r&&Ia(n).some(u)}if(Ta(a,n))return!0;return r&&Ia(n).some((c)=>pi(c,a))}function OS(e,t){let n=mt.relative(t,e);if(n===""||n.startsWith("..")||mt.isAbsolute(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function MS(e,t,n,r,o){return pn(e,t,n,!0,r,o)}function DS(e,t,n,r,o){if(!n)return!1;return Ta(hi(ye(e,t,r,o)),n)}function Xd(e,t,n,r,o,i){let s=hi(ye(e,t,r,o));return i.includes(s)||em(s,n)}function Qd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>pi(i,hi(ye(s,t,r,o)))))}function Ta(e,t){return t.entries.includes(e)||t.directories.includes(e)||em(e,t)}function em(e,t){return t.hooksDirectories.some((n)=>pi(e,n))}var NS=50000;function tm(e,t){let n=[...new Set(Ia(e))];if(n.some((o)=>t(mt.basename(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=LS(o);if(!i)return!0;if(r+=i.length,r>NS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>mt.join(o,s.name)))}return!1}function LS(e){try{let t=gi.lstatSync(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return gi.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Ia(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function pi(e,t){let n=mt.relative(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!mt.isAbsolute(n)}function hi(e){return process.platform==="win32"?e.toLowerCase():e}function WS(e,t,n,r,o){if(Br(e))return null;let i=jt([...e],r);if(A(i[0]??"").toLowerCase()!=="mv")return null;let s=fi(i.slice(1)),a=s.sources.find((l)=>MS(Pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&DS(Pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}var X=require("node:path");var He=require("node:path"),GS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],FS=` 	
+`;function Ur(e,t){if(gn(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Oa(e.get("TMPDIR")??"",t)}function Un(e,t){if(e.has("TMPDIR"))return Oa(e.get("TMPDIR")??"",t);let n=Ma(e,t);if(n===void 0)return!0;return Oa(n,t)}function Ma(e,t){return om(e,t,"TMPDIR")}function Oa(e,t){if(!e)return!1;if(HS(e))return!1;return jn(e,t)}function gn(e,t){let n=om(e,t,"IFS");return n!==void 0&&n!==""&&n!==FS}function jn(e,t){let n=yi(e,t.paths);if(n===null)return!1;return rm(t).some((r)=>Vn(n,r))}function bi(e,t){let n=yi(e,t.paths);if(n===null)return!1;return rm(t).some((r)=>Ci(r)===Ci(n))}var nm=new WeakMap;function rm(e){let t=nm.get(e);if(t)return t;let n=zS(e);return nm.set(e,n),n}function zS(e){let t=GS.map((r)=>yi(r,e.paths)??He.normalize(r)),n=yi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&BS(n))return[...t,n];return t}function HS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function om(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function BS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function yi(e,t){try{let n=He.normalize(e);if(!He.isAbsolute(n))return n;let r=He.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=He.join(i,o[s]??"");if(t.entryKind(a)==="missing")return He.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Vn(e,t){let n=Ci(e),r=Ci(t);if(n===r)return!0;let o=r.endsWith(He.sep)?r:`${r}${He.sep}`;return n.startsWith(o)}function Ci(e){return process.platform==="win32"?e.toLowerCase():e}var $S=process.platform==="win32",im=64,US=16384;function jr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ae(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ae(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Vr(e){let t=td(e,im,im,US);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:jS(e)}}function jS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>VS(e.raw,n.span.start-e.span.start))}function VS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Kt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??he();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:JS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function it(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&ev(e))return{kind:"outside_anchored_cwd"};let o=!r&&am(e,t.posixShell);if(Ct(e))return{kind:"outside_anchored_cwd"};if(Na(e,r))return{kind:"root_or_home_target"};if(qS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&pn(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(YS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(QS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&ov(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>iv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(sv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(KS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function KS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(X.isAbsolute(r)||r.startsWith("~"))return!1;if(La(r))return!1;if(lm(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return jn(X.resolve(t.resolvedCwd,r),t.environment)}function sm(e,t,n={}){let{containmentTarget:r,...o}=n;if(it(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(XS(i))return!1;if(bi(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>lm(r??i,s,t.environment.paths,t.budget))}function Na(e,t=!1){let n=e.trim(),r=X.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function qS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=X.isAbsolute(o)?o:t.resolvedCwd?X.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Te(T(i,t.environment.paths,t.budget));if(s===X.parse(s).root)return!0;return s===Te(T(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Te(e){let t=X.normalize(e);if($S){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function YS(e,t,n,r,o,i,s,a){let l=e.trim();if(La(l))return!1;if(!r&&jn(l,a))return!0;return(t||i&&s)&&n&&!o&&ZS(l,n)}function ZS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!am(e.slice(n.length+1),t)})}function XS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return X.posix.normalize(`/${t[1]??""}`)==="/"}function La(e){return e.split(/[\\/]+/).includes("..")}function JS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=vr(o.trim(),t);if(!X.isAbsolute(i))return[];try{let s=T(i,n,r);if(Er(s,T(t,n,r)))return[];return[Te(s)]}catch{return[]}})}function QS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(La(r))return!1;let o=n?r:vr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=X.isAbsolute(o)?o:i?X.resolve(i,o):null;if(!s)return!1;try{let a=Te(T(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(X.sep)?l:`${l}${X.sep}`))}catch{return!1}}function ev(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function am(e,t=!1){return e.includes("$")||e.includes("`")||tv(e)||t&&nv(e)}function tv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function nv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&rv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function rv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function ov(e,t,n,r){try{return Te(T(e,n,r))===Te(T(t,n,r))}catch{try{return Te(e)===Te(t)}catch{return!1}}}function iv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Te(T(X.resolve(t,e),n,r))===Te(T(o,n,r))}catch{try{return Te(X.resolve(t,e))===Te(o)}catch{return!1}}}function sv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Da(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Da(X.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Da(X.resolve(a,e),t,i,s)}catch{return!1}}function Da(e,t,n,r){try{return cm(T(e,n,r),T(t,n,r))}catch{return!1}}function lm(e,t,n,r){if(!t)return!1;try{return cm(T(t,n,r),T(e,n,r))}catch{return!0}}function cm(e,t){let n=Te(e),r=Te(t);return n.startsWith(`${r}${X.sep}`)||n===r}var av=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),um="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",mm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",cv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",uv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",dv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:mm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ot},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:dm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:cv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:lv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:um}};function fm(e,t,n){return mv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,Kt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function mv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=pv(o),s=o[i];if(!s||!av.has(xv(s.text)))return null;let a=fv(o.slice(i+1));if(a.whatIfProtected)return null;if(ae(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",uv);for(let l of a.targets)if(!Ct(l.text)&&Na(Ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",mm);for(let l of a.targets)if(n.resolvedCwd&&pn(Ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ot);if(!a.recursive||!a.force)return null;if(ae(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",dm);for(let l of a.targets){let c=jr(it(Ga(l.text),n),n,r,dv);if(c)return c}return null}function fv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(gv(l))continue;if(s){t.push(Wa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=yv(l.text);if(!c){t.push(Wa(l)),i=i||l.dynamic;continue}if(Cv(c.name)){let u=c.value?hv(c.value,l):e[++a];if(u?.kind==="word"){t.push(Wa(u)),i=i||u.dynamic;continue}i=!0;continue}if(bv(c.name)){n=!0;continue}if(Sv(c.name)){r=!0;continue}if(vv(c.name))o=Ev(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function pv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Wa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function gv(e){return e.kind==="word"&&e.text===","}function Ga(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function hv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function yv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Cv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function bv(e){return"recurse".startsWith(e)}function Sv(e){return e.length>=2&&"force".startsWith(e)}function vv(e){return e==="wi"||"whatif".startsWith(e)}function Ev(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function xv(e){return e.toLowerCase()}var Kn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Si="Unsupported heredoc syntax",Kr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",pm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var wv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Rv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),_v=new Set(["-o","--output","--query","--subscription"]),Av=new Set;function gm(e){if(e==="aws")return wv;if(e==="gcloud")return Rv;if(e==="az")return _v;return Av}var Pv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),kv=new Set;function hm(e){if(e==="git")return Le;if(e==="docker")return Pv;return kv}function At(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=_e(e);for(let o of t){if(!Ov(n,o.command))continue;if(o.match){if(Tv(n,e,o.match))return ym(o);continue}if(!Mv(n,e,o.subcommand))continue;if(Nv(e,new Set(o.block_args),r))return ym(o)}return null}function ym(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function Tv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Iv(r,n.command_path,gm(e))}function Iv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Ov(e,t){return e===M(t)}function Mv(e,t,n){if(!n)return!0;return Cm(t,1,n,hm(e))}function Cm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Dv(e,i,n,r))return!0;continue}return s===n}return!1}function Dv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Cm(e,t+2,n,r)}function Nv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Lv=new Set(["-e","--source"]),Wv=new Set(["-F","-v","--assign","--field-separator"]),bm=new Set(["-f","--file"]),Gv=new Set(["print","printf","return"]),Sm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Fv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function vm(e,t,n){let r=!1;for(let o of zv(e)){let i=Hv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Fv):null}function za(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Lv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Wv.has(a)||bm.has(a))){let l=e[s+1];if(i&&=l!==void 0,bm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Yr(e){return za(e).sources}function zv(e){return Yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Hv(e,t){ze(t,e);let n=e.includes("system")?Ha(e,t):null,r=Bv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ha(e,t){ze(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ei(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Em(e,i+1);continue}if(s==="/"&&xm(e,i)){i=wm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,qr(e[a-1])||qr(e[i]))continue;let l=vi(e,i);if(e[l]!=="(")continue;l=vi(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Ei(e,l,c);if(!u){r=!0,o=!0;continue}if(l=vi(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Bv(e,t){ze(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Ei(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Em(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&xm(e,i)){let f=wm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Fa(e,i,"print")||Fa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=vi(e,m);if(Fa(e,d,"getline")){o=!0;let f=jv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Kv(s,a)){o=!0;let f=Uv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!$v(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function qr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function vi(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function $v(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Ei(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Vv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Uv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ei(e,t,n)}function jv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Vv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Fa(e,t,n){return e.startsWith(n,t)&&!qr(e[t-1])&&!qr(e[t+n.length])}function Kv(e,t){return t!==null&&t>=e}function Em(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function xm(e,t){let n=qv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(qr(e[r-1]))r--;return Gv.has(e.slice(r,n+1))}function qv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function wm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Yv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xv="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Rm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function _m(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",Yv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",Zv);if(e==="shred"&&n.length>0)return v("shred.target",Xv);return null}var Jv=new Set(["sudo","env","command","builtin"]),Qv=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function xi(e,t){let n=e[0];if(!n||!Am(A(n),t))return null;let r=A(n),o=e[1]==="--"?2:1,i=eE(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function eE(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=A(a)!==n&&tE(a,r);if(l)i.push(s);if(!l&&Po.has(M(a)))break;if(o)break}return i}function tE(e,t){let n=A(e),r=M(e);return r==="git"||n==="busybox"||hn(e)||As.has(n)||Rm(r)||Am(n,t)||te.has(r)||e==="$SHELL"||Je(r)||je.has(r)||t.rules.some((o)=>o.command===n)}function Am(e,t){return Qv.has(e)||t.transparentWrappers.includes(e)}function hn(e){return Jv.has(e.toLowerCase())}function yn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function st(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return wi([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*wi(e,t,n,r,o,i,s,a,l){let c=li(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=ai(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");Ba(a),yield*wi(f,t,m,r,o,i,s,a,l);return}if(hn(u[0]??""))throw new N("wrapperPeelIterations");let d=xi(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])Ba(a),yield*wi(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(rE(u)){Ba(a),yield*wi(u.slice(1),t,m,r,o,i,s,a,l);return}yield nE(u,m,r,o,i,l)}function nE(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:A(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ba(e){if(e.iterations>=J.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function rE(e){return A(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function $a(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Pt(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ua(r,"recursive")){t=!0;continue}if(r==="-f"||Ua(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Ri(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ua(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ua(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var oE=["--init-file","--rcfile"],iE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function at(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Pm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Pm(e,t,!1);if(r!==null)return r}}return null}function kt(e){let t=A(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return We(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Pm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function km(e){let t=A(e[0]??"").toLowerCase(),n=sE(e,t),r=iE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function sE(e,t){let n=We(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?oE.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Rs.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=_s(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var aE="find -delete permanently removes files. Use -print first to preview.",lE="find -exec rm -rf is dangerous. Use explicit file list instead.",cE=new Set(["-exec","-execdir","-ok","-okdir"]),uE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Tm(e,t){let n=e.map(R),r=dE(e,n,t);if(r)return r;if(_i(n,1)&&!yE(e,n,t)){let s=_(v("find.delete",aE),t.policy);if(s)return s}let o=t.budget??he(),i=0;while(i<n.length){let s=n[i],a=Tt(s??"");if(a>0){i+=a+1;continue}if(!ft(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=qn(n,i);i=l.nextIndex;let c=bE(l.tokens,t.environment);if(c){let f=_(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?.(l.tokens,u?null:t.cwd)??null,d=m?.id.startsWith("custom.")?m:_(m,t.policy);if(d)return d}return null}function dE(e,t,n){if(!_i(t,1)&&!ja(t,n.environment))return null;let o=Zr(e)??ee(["."]),i=Kt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Vr(s);for(let l of a.expandedTargets??[R(s)]){let c=it(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!mE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",ot)}}if(hE(t)&&i.resolvedCwd&&Qd(o.map(R),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",ot);return null}function mE(e,t,n){if(!t)return!1;let r=e.map(R),o=[],i=!1,s=Zr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(ft(l)){let c=qn(r,a),u=jt([...c.tokens],n),m=Ri(u),d=te.has(A(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(pE(c.text,l==="-iname"));a+=2;continue}if(!fE.has(l))return!1;a+=1+Tt(l)}return o.length>0&&!tm(t,(l)=>o.every((c)=>c.test(l)))}var fE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function pE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var gE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function ja(e,t){let n=0;while(n<e.length){if(!ft(e[n])){n++;continue}let r=qn(e,n),o=jt([...r.tokens],t),i=A(o[0]??"").toLowerCase(),s=te.has(i)&&gE.test((at(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function hE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function yE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Zr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ma(o,n.environment),s=n.trustedTmpdirValue??Un(o,n.environment),a=n.allowTmpdirVar??!Ur(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gn(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Kt(l),u=Kt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!Vn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=Vr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[R(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,b=y??h,C={targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected};if(!ae(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&it(b,c,C).kind==="within_anchored_cwd")return!0;return sm(b,y?u:c,{...C,containmentTarget:CE(b,i)})})})}function CE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Zr(e){let t=(o)=>{let i=e[o];return i?R(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function bE(e,t){let n=Ut([...e],t);if(n.length===0)return null;let r=A(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=A(n[0]??"");if(r==="rm"&&Pt(n))return v("find.exec-rm-recursive-force",lE);return null}function qn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function _i(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(ft(r)){n=qn(e,n).nextIndex;continue}let o=Tt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Tt(e){return uE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function ft(e){return e!==void 0&&cE.has(e)}var Qm=require("node:path");function Xr(e){let t=Qe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var SE=5,Va="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function fe(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Om(e,t,n){let r=Ai(e,t,n),o=vE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<SE;a++){let{subcommand:l,rest:c}=Be(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=_E(m);if(d===null||d.length===0)return{blockedReason:Va,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:Va,expanded:!0,tokens:i}}function Mm(e,t,n){return Ai(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Be(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?A(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Le.has(o)?2:1}return{subcommand:null,rest:[]}}function vE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Ai(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?A(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=xE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...EE(e,t,n)]}}function EE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ka(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ka(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Im(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Im(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Le.has(i)){o+=2;continue}o++}return r}function xE(e,t){let n=wE(e,t),r=RE(e,t);return{blockedReason:n===null||r===null?Va:null,entries:[...n??[],...r??[]]}}function wE(e,t){let n=Rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Xr(n);if(!o)return null;for(let i of o){let s=Ka(i);if(!s)return null;r.push(s)}return r}function RE(e,t){let n=Td(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ka(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Im(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Rt(e.slice(r+1),t,n)}}function _E(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Xr(t)}var AE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",PE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",kE="git checkout --force discards uncommitted changes. Use 'git stash' first.",TE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",IE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",OE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",ME="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",DE="git switch --force discards uncommitted changes. Use 'git stash' first.",NE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",LE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",WE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",GE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",FE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",zE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",HE="git push --force destroys remote history. Use --force-with-lease for safer force push.",BE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",$E="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",UE="git branch -D force-deletes without merge check. Use -d for safe delete.",jE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",VE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",KE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",qE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",YE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",ZE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",XE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",JE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),QE=new Set(["--recurse-submodules","--track","-t"]),qa=new Set(["-b","-B","-U"]),Ya=new Set(["-c","-C"]),ex=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function D(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Yn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Nm(e,t){let{subcommand:n,rest:r}=Be(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return qt(tx(r,t));case"switch":return qt(rx(r));case"restore":return qt(ix(r));case"reset":return ax(r);case"clean":return qt(cx(r));case"rm":return qt(ux(r));case"push":return Cn(dx(r));case"branch":return Cn(px(r));case"stash":return Cn(bx(r));case"worktree":return Cn(Sx(r));case"rebase":return qt(gx(r));case"merge":return qt(hx(r));case"tag":return Cn(yx(r));case"reflog":return Cn(Cx(r));default:return null}}function qt(e){return e?{...e,localDiscard:!0}:null}function Cn(e){return e?{...e,localDiscard:!1}:null}function tx(e,t){let{index:n,before:r}=fe(e),o=_e(r,{shortOptsWithValue:qa});if(r.some((a)=>D(a,"--force"))||o.has("-f"))return v("git.checkout-force",kE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(D(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",IE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",TE);return v("git.checkout-double-dash",AE)}let i=ox(e);if(i.length>=2)return v("git.checkout-ambiguous",OE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>D(a,"--detach")||D(a,"--track")))return null;if(nx(s)||t(s))return v("git.checkout-double-dash",PE);return null}function nx(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function rx(e){let{before:t}=fe(e);if(t.some((r)=>D(r,"--discard-changes")))return v("git.switch-discard-changes",ME);let n=_e(t,{shortOptsWithValue:Ya});if(t.some((r)=>D(r,"--force"))||n.has("-f"))return v("git.switch-force",DE);return null}function ox(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(JE.has(r)){n+=2;continue}if(QE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function ix(e){let t=sx(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",LE):v("git.restore-unstaged",NE)}function sx(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(ex.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function ax(e){let t=null;for(let n of e){if(D(n,"--hard")){t=v("git.reset-hard",WE);break}if(D(n,"--merge")){t=v("git.reset-merge",GE);break}}if(!t)return null;return lx(e)?Cn(t):qt(t)}function lx(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function cx(e){for(let n of e)if(n==="-n"||D(n,"--dry-run"))return null;let t=_e(e.filter((n)=>n!=="--"));if(e.some((n)=>D(n,"--force"))||t.has("-f"))return v("git.clean-force",FE);return null}function ux(e){let t=!1,n=!1,r=!1;for(let o of fe(e).before){if(D(o,"--no-force")){t=!1;continue}if(D(o,"--force")){t=!0;continue}if(D(o,"--no-cached")){n=!1;continue}if(D(o,"--cached")){n=!0;continue}if(D(o,"--no-dry-run")){r=!1;continue}if(D(o,"--dry-run")){r=!0;continue}let i=_e([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",zE):null}function dx(e){let{before:t,after:n}=fe(e),r=_e(t);if(t.some((s)=>D(s,"--mirror")))return v("git.push-mirror",$E);if(t.some((s)=>D(s,"--force"))||r.has("-f")||Dm(t,n).some(mx))return v("git.push-force",HE);if(t.some((s)=>D(s,"--delete"))||r.has("-d")||Dm(t,n).some(fx))return v("git.push-delete",BE);return null}function Dm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function mx(e){return e.startsWith("+")||e.includes(":+")}function fx(e){return e.length>1&&e.startsWith(":")}function px(e){let{before:t}=fe(e),n=_e(t),r=n.has("-D")||n.has("-d")||t.some((i)=>D(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>D(i,"--force"));if(r&&o)return v("git.branch-force-delete",UE);return null}function gx(e){let{before:t}=fe(e);return t.some((n)=>D(n,"--abort"))?v("git.rebase-abort",jE):null}function hx(e){let{before:t}=fe(e);return t.some((n)=>D(n,"--abort"))?v("git.merge-abort",VE):null}function yx(e){let{before:t}=fe(e);return _e(t).has("-d")||t.some((r)=>D(r,"--delete"))?v("git.tag-delete",KE):null}function Cx(e){return e[0]==="delete"?v("git.reflog-delete",qE):null}function bx(e){for(let t of e){if(t==="drop")return v("git.stash-drop",YE);if(t==="clear")return v("git.stash-clear",ZE)}return null}function Sx(e){let{before:t}=fe(e);if(!t.includes("remove"))return null;let r=_e(t);if(t.some((o)=>D(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",XE);return null}var It=require("node:path");var Xa="TMPDIR",Ja="IFS",Wm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Gm=/^[A-Za-z_][A-Za-z0-9_]*$/,Fm=new Set(["export","typeset","declare","readonly"]),vx=new Set(["builtin","command","time"]),Ex=new Set(["do","then","else"]),xx=new Set(["do","then","case"]),Lm=new Set(["done","fi","esac"]),wx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function zm(e,t){return e.map((n)=>n.provenance==="variable"&&Km(n.text)?Hm(n.text,t.shellAssignments):R(n))}function Hm(e,t){return e.replace(wx,(n,r,o)=>t.get(r??o??"")??n)}function pt(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=Hm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function Bm(e,t){return{env:e,effectiveEnvAssignments:Px(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function $m(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Qa(e,t){let n=jm(e,t),r=e[0]??"";if(xx.has(r))t.bodyDepth+=1;if(r==="elif"||Lm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Lm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);el(t,a)});let o=n.commandIndex;if(o!==-1&&Fm.has(e[o]??""))e.filter((a)=>Gm.test(a)&&Za(a)).forEach((a)=>{kx(t,a)});let i=o===-1?-1:Vm(e,o);if(i===-1||e[i]!=="unset")return;let s=Ix(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}Tx(t,a)})}function Um(e,t){let n=jm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function jm(e,t){let n=Ex.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Km(a)),o=r!==-1&&Fm.has(e[Vm(e,r)]??""),i=Ax(t);return{assignments:e.flatMap((a,l)=>{let c=Rx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!oi(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Vm(e,t){let n=t;while(vx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Km(e){return Ke(e)!==null||Wm.test(e)}function Rx(e,t,n){return Ke(e)??_x(e,t,n)}function _x(e,t,n){let r=ii(e,n,t);if(r)return r;let o=e.match(Wm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Za(e){return e===Xa||e===Ja||wa(e)}function Ax(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function Px(e,t){let n=[Xa,Ja].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function el(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function kx(e,t){el(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function Tx(e,t){if(!Za(t)&&!Gm.test(t))return;if(e.shellAssignments.set(t,""),oi(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Za(t)||t===Xa||t===Ja||hr(t)){el(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Ix(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var Ym=require("node:path");function Pi(e,t){return xa.some((n)=>t?.has(n)||e.has(n))}function Zn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(Ym.resolve(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=qm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=qm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Le.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function qm(e,t,n){try{let r=$t(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Zm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Pi(n.environment.env,n.envAssignments))return null;let r=Zn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(tl(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function tl(e,t,n){let{subcommand:r,rest:o}=Be(e),i=r?.toLowerCase();if(t.dynamicArguments||Ox(o)||Wx(e,t.environment.env,t.envAssignments,n)||Nx(o)||Mx(i,o))return!0;return i==="clean"&&Lx(o)>1}function Ox(e){return e.some((t)=>/[$*?[]/.test(t))}function Mx(e,t){if(e==="checkout"){let{before:n}=fe(t),r=_e(n,{shortOptsWithValue:qa}),o=n.some((s)=>D(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=fe(t),r=_e(n,{shortOptsWithValue:Ya}),o=n.some((s)=>D(s,"--force"))||n.some((s)=>D(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||Dx(s))||r.has("-C");return o&&i}return!1}function Dx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Nx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Lx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Wx(e,t,n,r){if(Rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Ai(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>Fx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Gx(s.value);if(Od(n))return!0;return r.recursiveSubmodules}function Gx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Fx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Xm(e,t,n){let r=e.map((l)=>pt(l,n.shellAssignments??new Map)??R(l)),o=n.environment.paths,i=Zn(r,n.cwd,o),s=n.originalCwd?o.realpath(It.resolve(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Pi(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Hx(e,n.shellAssignments,o):Jm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!zx(a,r,t,n)||!jn(a,n.environment)||bi(a,n.environment)||Vn(s,a)||Vn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function zx(e,t,n,r){let o=r.environment.paths,i=It.join(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!tl(t,r,a)}function Hx(e,t,n){let r=Be(e.map(R)).rest,{before:o,after:i}=fe(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&pt(l,t??new Map))??a;if(!It.isAbsolute(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Jm(e,t){if(t.entryKind(It.join(e,".git"))!=="missing")return e;let n=It.dirname(e);return n===e?null:Jm(n,t)}var Bx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",$x=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ki(e,t){return ef(e,t)}function ef(e,t,n){let r=e.map(R),o=Om(r,t.environment.env,t.envAssignments),i=o.blockedReason?_(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Id(t.envAssignments)||Mm(r,t.environment.env,t.envAssignments))&&Ux(s))return v("git.ssh-env",Bx);let a=Nm(s,(c)=>{let u=Zn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Qm.resolve(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Zm(r,a,t)??Xm(e,a,t);if(!l)return a;return n?.(l),null}function tf(e,t){let n=null;return{match:ef(e,t,(o)=>{n=o}),relaxation:n}}function Ux(e){let{subcommand:t,rest:n}=Be(e),r=t?.toLowerCase();if(!r)return!1;if($x.has(r))return!0;if(r==="archive")return fe(n).before.some((o)=>D(o,"--remote"));return r==="remote"&&jx(n)}function jx(e){return e.find((t)=>!Vx(t))?.toLowerCase()==="update"}function Vx(e){return e==="-v"||D(e,"--verbose")||D(e,"--no-verbose")}var Tf=require("node:path");function nf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Ti(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var rf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Kx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Yx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Zx="rm -rf in home directory is dangerous. Change to a project directory first.",of={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Yx},git_metadata_target:{id:"rm.git-metadata",reason:ot},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:qx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Zx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:rf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Kx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:rf}};function Ii(e,t){let n=Kt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(R),o=Ri(r),i=Jx(e);for(let s of i){let a=Vr(s.word);if(o&&a.unsafeBraceExpansion){let l=_(jr({kind:"outside_anchored_cwd"},n,t.policy,of),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=Ne(l),u={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&pn(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",ot);if(!o)continue;for(let m of Xx(c,n,u)){let d=jr(m,n,t.policy,of),f=_(d,t.policy);if(f)return f}}}return null}function Xx(e,t,n){let r=it(e,t,n);if(r.kind==="cwd_self_target")return[r,it(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=it(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,it(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Jx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=R(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Yt={kind:"none"},bn={kind:"dynamic"},Qx=new Set(["<","<<","<<-","<<<","<&","<>"]),af=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,ew=/^(?:[0-9]+|[@*])$/,tw=Ht.maxWords,lf=Ht.maxInputLength;function cf(e){if(!e||A(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Pi(e){let t=Vn(e[1])==="--"?2:1;if(e.length<=t)return Kt;let n=e.slice(t);if(!n.every(Vr))return fn;return{kind:"literal",source:n.map(R).join(" ")}}function ef(e){let t=Vn(e[1])==="--"?2:1,n=e[t],r=Vn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Kt;if(!Vr(n))return fn;return{kind:"literal",source:r}}function Ti(e,t){let n=rf(e);if(n===-1)return Kt;let r=Gx(t);if(!r)return Kt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=zx(s,e,n,r.ifs);if(!a)return fn;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>Lx||i>Jm)return fn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ki)].filter((s)=>s!==null).join(" ")}}function tf(e,t){let n=rf(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Vr)||o)return t;let i=r.map(Vn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?ki(p):"").join(" ")).join(" "),s.length>Jm)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function nf(e,t,n,r){if(!Le(e.map(R)).readsStdinAsCommands)return Kt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Dx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Kt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return fn;return{kind:"literal",source:o.target.text}}if(!n)return Kt;return r===void 0?fn:{kind:"literal",source:r}}function Ot(e,t=new Map){let n=Le(e.map(R)).scriptIndex;if(n===null)return Kt;let r=e[n],o=Vn(r);if(qo(r,o))return{kind:"literal",source:o};let i=r?ft(r,t):null;return i===null?fn:{kind:"literal",source:i}}var Wx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Qa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ve(s)!==null)return!1;let a=A(O(s));return!Wx.has(a)&&!Q.has(a)&&!un(a)}function rf(e){return Le(e.map(R)).commandIndex??-1}function Gx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Fx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function Fx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function zx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Za(o):Hx(o,r);if(e.parameter==="*"){let a=Za(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Xa(l,r)}let i=t[n+1+e.parameter];if(i&&!Vr(i))return;let s=Vn(i);return e.quoted?[s]:Xa(s,r)}function Za(e){return e.every(Vr)?e.map(R):void 0}function Hx(e,t){let n=Za(e);if(!n)return;let r=n.map((o)=>Xa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Xa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Oi(e){let t=Xn(e[1])==="--"?2:1;if(e.length<=t)return Yt;let n=e.slice(t);if(!n.every(Qr))return bn;return{kind:"literal",source:n.map(R).join(" ")}}function uf(e){let t=Xn(e[1])==="--"?2:1,n=e[t],r=Xn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Yt;if(!Qr(n))return bn;return{kind:"literal",source:r}}function Mi(e,t){let n=ff(e);if(n===-1)return Yt;let r=rw(t);if(!r)return Yt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=iw(s,e,n,r.ifs);if(!a)return bn;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>tw||i>lf)return bn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Di)].filter((s)=>s!==null).join(" ")}}function df(e,t){let n=ff(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Qr)||o)return t;let i=r.map(Xn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?Di(p):"").join(" ")).join(" "),s.length>lf)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function mf(e,t,n,r){if(!We(e.map(R)).readsStdinAsCommands)return Yt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Qx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Yt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return bn;return{kind:"literal",source:o.target.text}}if(!n)return Yt;return r===void 0?bn:{kind:"literal",source:r}}function Ot(e,t=new Map){let n=We(e.map(R)).scriptIndex;if(n===null)return Yt;let r=e[n],o=Xn(r);if(Jo(r,o))return{kind:"literal",source:o};let i=r?pt(r,t):null;return i===null?bn:{kind:"literal",source:i}}var nw=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function il(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ke(s)!==null)return!1;let a=A(M(s));return!nw.has(a)&&!te.has(a)&&!hn(a)}function ff(e){return We(e.map(R)).commandIndex??-1}function rw(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ow);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function ow(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function iw(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?nl(o):sw(o,r);if(e.parameter==="*"){let a=nl(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:rl(l,r)}let i=t[n+1+e.parameter];if(i&&!Qr(i))return;let s=Xn(i);return e.quoted?[s]:rl(s,r)}function nl(e){return e.every(Qr)?e.map(R):void 0}function sw(e,t){let n=nl(e);if(!n)return;let r=n.map((o)=>rl(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function rl(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(R(e)):e.provenance==="literal"}function Vn(e){return e?R(e):""}function ki(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function el(e,t){return Ja(Je(e,"posix"),t)}function Kr(e){return el(e,new Set(Array.from(e.matchAll(Xm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ja(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ja(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ja(o,n))||of(r.words,n))return!0;Vx(r,n)}return!1}function of(e,t){let n=e.findIndex((s)=>Ve(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(jr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Zm(e[s],t)}if(Q.has(o)){let s=e.slice(n),a=Le(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Zm(s[l],t)}let i=Bx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return of(e.slice(i),t)}function Bx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return $x(e,t+1);if(r==="exec")return Ux(e,t+1);if(r==="env")return jx(e,t+1,n);return null}function $x(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Ux(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function jx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return jr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return jr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ve(i))continue;return r}return null}function Vx(e,t){if(!e.words.every((n)=>Ve(n.text)!==null))return;for(let n of e.words){let r=Ve(n.text);if(!r)continue;if(jr(n,t))t.add(r.name)}}function jr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Xm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Nx.test(o)||t.has(o))}))}function Zm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||jr(e,t))}var tl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",nl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Kx="__CC_SAFETY_NET_XARGS_INPUT__",Ii="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Oi="rm",qx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Yx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Zx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Xx=/^(?:[0-9]+|[@*])$/;function lf(e,t){let n=e.map(R),{childStart:r,replacementToken:o}=pn(n),i=n.slice(r),s=E("xargs.shell-dynamic",nl);if(Qx(i,o,t)&&_(s,t.policy))return _(s,t.policy);for(let a of it(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?_(s,t.policy):null;if(c)return c;let u=pf(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&mf(l,o),d=t.analyzeChild(l,{...dn(a,t),dynamicInput:u,dynamicSourceInput:m||uf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:E("xargs.rm-recursive-force-dynamic",tl)});if(d)return d;let f=Jx(l,o,t.policy?.rules??[],_(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,Kx]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),C=t.analyzeChild(p,{...dn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(C)return C}let g=At(l,t.policy?.rules??[]);if(g)return g}return null}function Jx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=At([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function cf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Km(e,r,t.length,n);return o===null?[]:[o]}function uf(e,t,n,r,o,i,s){if(Q.has(t)){if(Tt(e))return!1;if(n!==null&&ew(e,n,s))return!0;let a=st(e);if(!a){let l=Ot(J(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!df(a,n,s))return!0;if(je(a))return!0;return tw(a,n,r)}if(Xe(t))return sf(e,n,Qo,yd(t));if(Ue.has(t))return sf(e,n,Da,dm);if(t==="eval"){let a=Pi(J(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return nw(e,n,i);if(t==="git"){let a=He(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Un.has(a.subcommand.toLowerCase())&&ff(a.rest,n).some((l)=>l.includes(n))}return!1}function df(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return je(i)===null&&n(i)===null}function sf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ii]).sources.some((a)=>a.value===Ii);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ii}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ii}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>cf(l,t,a))));return _i(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Qx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(it(e,n),(i)=>i.head)),o=t===null?[...e,Oi]:e.map((i,s)=>s===0?i:i.replaceAll(t,Oi));return Array.from(it(o,n)).some((i)=>i.head===Oi&&!r.has(Oi))}function mf(e,t){return ff(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function ff(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function pf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function ew(e,t,n){let r=Le(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!df(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return cf(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=Le(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function tw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(qx))if(af(o,r))return!0;for(let o of e.matchAll(Yx))for(let i of(o[1]??"").matchAll(Zx))if(af(i,r))return!0;return el(e,r)}function af(e,t){let n=e[1]??e[2];return n!==void 0&&(Xx.test(n)||t.has(n))}function nw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(mt(s)){let l=$n(e,i);i=l.nextIndex-1;for(let c of it(l.tokens,{environment:n,cwd:void 0})){let u=pf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&mf(c.tokens,t)||uf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=kt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function pn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var qr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",rw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",ow="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Di=/\{[^{}\s]*\}/g,gf=/\{\}|\{-?\d+\}/g,hf=/[\s;&|<>()$`\\"']/,iw=["e","f","source","file","-e","-f","--source","--file"],sw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],aw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),lw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),yf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),cw=new Set(["--workdir","--wd"]),Cf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ke(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Ef(e){return Ke([...e],(t)=>je(t))}function xf(e,t){let n=e.map(R);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=Kn(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Nf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=Kn(t);if(g)return g;let p=Ef(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=hw(t);if(g)return g}if(u!==void 0&&a){let g=Kn(t);if(g)return g}let d=yw(u,t.cwd,t.environment.paths);if(d===null){let g=Kn(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...it(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some(il)){let p=Kn(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=Tf(f.envAssignments,f.cwd,a);return Ke(g,(h)=>t.analyzeNested(h,p))}return Ke(it(i,f),(g)=>uw(g,o,t,f))}function uw(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(Mf)){let v=Kn(n);if(v)return v}let c=Ef(l);if(c)return c;let u=l.some(F),m=o||u,d=s&&m,f=Tf(e.envAssignments,e.wrapperCwd,i||d),g=m?{...f,worktreeMode:!1}:f,p=a.join(" "),h=F(p.split(/[ \t\n=]/,1)[0]??""),C=!t.quotesCommand&&(h||a.some((v)=>hf.test(v))),b=h||hf.test(a[0]??""),y=C&&b&&t.jobs.length>0?null:dw(e,t,n,r,g,u);if(y||!C)return y;return wf(F(p)?p:`${p} {}`,!h,e,t,n,r,g)}function dw(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,u=e.tokens,m=a||i;if(Q.has(e.head)){let f=()=>{if(!a||s.length===0)return null;return Ke(s,(h)=>n.analyzeChild(Mi(u,h,n.budget),dn(e,r)))};if(Tt(u))return f();let g=st(u);if(g){if(Df(g)){let y=qt(n);if(y)return y;if(s.length===0)return null;return Ke(s,(v)=>n.analyzeNested(If(g,v,n.budget),o))}if(F(g))return wf(g,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((y)=>Ti(J(y===void 0?u:a?u.map((v)=>kf(v,y)):[...u,...y]),g)):[];if(h.some((y)=>y.kind==="dynamic")){let y=qt(n);if(y)return y}let C=h.flatMap((y)=>y.kind==="literal"?[y.source]:[]);if(C.length>0)return n.budget.charge("derivedTokens",C.length),Ke(C,(y)=>n.analyzeNested(y,o));if(Kr(g)){let y=qt(n);if(y)return y}let b=n.analyzeNested(g,o);if(b)return b;if(m)return qt(n);return null}let p=Ot(J(u));if(p.kind==="dynamic"||p.kind==="literal"&&F(p.source))return qt(n)??f();if(p.kind==="literal")return f();if(s.length>0){let h=qt(n);if(h)return h;let C=f();if(C)return C;if(a)return null;let b=s.flatMap((y)=>y[0]===void 0?[]:[y[0]]);return n.budget.charge("derivedTokens",b.length),Ke(b,(y)=>n.analyzeNested(y,o))}if(m||c)return qt(n)??f();return null}if(e.head==="rm"&&Pt(u)){if(a&&s.length>0)return Ke(s,(g)=>rl(Mi(u,g,n.budget,gf),e.cwd,r));if(s.length>0)return Ke(s,(g)=>rl(Sf(u,g,n.budget),e.cwd,r));let f=rl(u.flatMap((g,p)=>{if(p===0||!F(g))return[g];return g.startsWith("-")?[g.replace(gf,"")]:[]}),e.cwd,r);if(f)return f;return Pf(n)}let d=s.length>0?s:[void 0];return Ke(d,(f)=>{let g=f===void 0?u:a?Mi(u,f,n.budget):Sf(u,f,n.budget),p=E("parallel.shell-dynamic",Yr),h=c&&e.head==="find"?gw(g,r):null,C=_f(g,c,n)??h?.customResult??null,b=O(e.head),y=c&&(b==="rm"&&ol(g)||b==="xargs"&&Af(g)||h?.rmOptions===!0),v=c&&(y||h?.executedSource===!0||h===null&&Rf(g,b)),T=n.analyzeChild(g,{...dn(e,r),worktreeMode:l||c||m?!1:n.worktreeMode,dynamicInput:c||m,dynamicRmInput:y,dynamicSourceInput:C!==null||v,shellDynamicMatch:p,dynamicSourceMatch:p,rmDynamicMatch:E("parallel.rm-recursive-force-dynamic",qr)});if(v){let k=_(p,n.policy);if(k)return k}return T??C??At(g,n.policy?.rules??[])})}function wf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Ke(r.jobs,(c)=>o.analyzeNested(If(e,t?c.map(ki):c,o.budget),s));let a=Ur(e);if(a?.[0]&&O(a[0])==="rm"&&Pt(a)){let c=Pf(o);if(c)return c}return(a?o.analyzeChild(a,{...dn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:E("parallel.shell-dynamic",Yr),rmDynamicMatch:E("parallel.rm-recursive-force-dynamic",qr)}):null)??o.analyzeNested(e,s)}function Rf(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Q.has(t))return pw(e);if(t==="git")return mw(e);if(t==="find")return!0;if(Ue.has(t))return bf(e,iw,Br);if(Xe(t))return bf(e,sw,Jo);return!1}function ol(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||Df(o)))}function mw(e){if(fw(e))return!0;let t=He(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!Un.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function fw(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function pw(e){if(Tt(e))return!1;let t=st(e);if(t!==null)return F(t);let n=Ot(J(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function bf(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Cf]).some((o)=>o.value===Cf);return _i(r,t,(o)=>n(e.map((i)=>kf(i,[o]))))}function _f(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return qt(n);return Ke(o,(i)=>At([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function gw(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of it(i,t))n.executedSource||=Rf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&ol(a.tokens)||a.head==="xargs"&&Af(a.tokens),n.customResult??=_f(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(mt(a)){i=[],n.executedSource||=F(a);continue}let l=kt(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Af(e){let t=e.slice(pn(e).childStart);return O(t[0]??"")==="rm"&&ol(t)}function Ni(e,t){return(n)=>_(E(e,t),n.policy)}var qt=Ni("parallel.shell-dynamic",Yr),hw=Ni("parallel.command-stream-dynamic",rw),Kn=Ni("parallel.command-stream-dynamic",ow),Pf=Ni("parallel.rm-recursive-force-dynamic",qr);function rl(e,t,n){return _(Ai(J(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:cn(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Fn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Tf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function kf(e,t){return e.replace(Di,(n)=>Of(n,t))}function Mi(e,t,n,r=Di){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Of(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function If(e,t,n){return Mi([e],t,n)[0]??""}function Sf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Of(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Di)!==-1}function Mf(e){if(il(e))return!0;for(let t of e.matchAll(Di))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function il(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Df(e){return/^\{[^{}\s]*\}$/.test(e)}function yw(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!vf.isAbsolute(e))return null;try{return Ht(t??e,e,n)}catch{return null}}function Nf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,u=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let v=Wa(e,t+1);n.push(...v.templateTokens),r=t+1,o=v.markerIndex;break}if(!p.startsWith("-")){let v=Wa(e,t);n.push(...v.templateTokens),r=t,o=v.markerIndex;break}let h=e[t+1],C=p.indexOf("="),b=C===-1?p:p.slice(0,C),y=C===-1?void 0:p.slice(C+1);if(p==="--dry-run"){c=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){u||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){u=!0,t+=2;continue}if(b==="--replace"||p.startsWith("-i")&&p.length>2){let v=b==="--replace"?y:p.slice(2);u||=v!==""&&v!=="{}",t++;continue}if(p==="-a"||lw.has(b)){u=!0,t+=y===void 0?2:1;continue}if(p==="-q"||p==="--quote"){s=!0,t++;continue}if(p==="--pipe"||p==="--pipepart"){a=!0,t++;continue}if(b==="--env"){u=!0,t+=y===void 0?2:1;continue}if(yf.has(b)||p.startsWith("-S")&&p.length>2){i=!0,t+=yf.has(p)?2:1;continue}if(cw.has(b)){u=!0;let v=y??h;if(v===void 0||v===":::"||v==="--"){t++;continue}l=v,t+=y===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&y!==void 0){t++;continue}if(aw.has(p)){if(h===void 0||h===":::"||h==="--"){u=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}u||=n.some(c?il:Mf);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let C=e[h];if(C===":::"){m.push(p),p=[];continue}if(C!==void 0)p.push(C)}m.push(p)}u||=m.length>1;let d=Cw(m),f=n.some(F),g=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:f,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:g,unsupported:u,workdir:l,dryRun:c}}function Cw(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>X.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>X.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function Lf(e){return Nf(e).childStart}var bw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Li="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function al(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function sl(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Gf(e,t,n,r,o=!1,i){let a=(br(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ae(i,"shell.dynamic-executable",o)?E("shell.dynamic-executable",bw):null;return _(a,i)??Ff(e,t,n,o,i)}function Ff(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>al(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=Mn(e,t),l=vw(a);if(ae(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return _(E("shell.dynamic-structure",Li),o);if(_(Ri(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&R(m)==="--");if(ae(o,"shell.dynamic-structure",r)&&c&&Un.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return _(E("shell.dynamic-structure",Li),o);return null}if(s==="find")return ae(o,"shell.dynamic-structure",r)&&Ew(t)?_(E("shell.dynamic-structure",Li),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&R(c)==="--"),l=Pt(t.map(R));return ae(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?_(E("shell.dynamic-structure",Li),o):null}if(s==="xargs")return Wf(e,t.slice(pn(t.map(R)).childStart),"xargs",n,r,o);if(s==="parallel")return Wf(e,t.slice(Lf(t.map(R))),"parallel",n,r,o);return null}function Wf(e,t,n,r,o,i){if(t.length===0)return null;let s=Sw(t,r);if(br(e,s)){let l=_(E(`${n}.shell-dynamic`,n==="xargs"?nl:Yr),i);if(l)return l}let a=Ff(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>al(l)&&sl(l)))return _(E(`${n}.rm-recursive-force-dynamic`,n==="xargs"?tl:qr),i);return null}function Sw(e,t){let n=sn(e,t),r=n.rewritten?J(n.words.map(R)):n.words,o=r[0];return o&&R(o)==="busybox"?r.slice(1):r}function vw(e){let t=1;while(t<e.length){let n=e[t],r=n?R(n):"";if(Ne.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Ew(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=al(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||sl(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||sl(s)))return!0;continue}if(t=!0,a)return!0;let l=kt(s.text);if(l>0){n=l;continue}if(mt(s.text))o=!0,r=!0}return!1}function ll(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!qo(t[n.tokenIndex],n.value)})}var Bf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ai(e.words,Hf(e))},{heads:new Set(["git"]),analyze:(e)=>Ri(e.words,cl(e))},{heads:new Set(["find"]),analyze:(e)=>vm(e.words,{...Hf(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>lf(e.words,{...zf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>xf(e.words,{...zf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qn(e.options.analyzeNested(t,n))})}];function zf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function qn(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function Hf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:cn(e.envAssignments,e.options.environment),trustedTmpdirValue:Fn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function cl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function jf(e){return Bf.find((t)=>t.heads.has(e))?.analyze}function Zn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((P)=>o==="posix"?R(P):P.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=ni(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=sn(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let x=[...g,...i(f.words)].join(" "),P=je(x);if(P)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:P.reason}),ve(P);if(n.strict)return ke(r);let z=ri(g,i(f.words));if(z){n.budget.charge("derivedTokens",z.length);let ce=n.analyzeNested(z.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(ce)return ce}}let p=f.rewritten?J(i(f.words)):Mn(o,f.words),h=i(p),C={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-p.length),output:h})}let b=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),y=h[0];if(!y)return null;if(un(y))throw new D("wrapperPeelIterations");let v=O(y),T=f.cwd===null?void 0:f.cwd??u,k=f.cwd===null?void 0:m,N=f.cwd===void 0?n.effectiveCwd:f.cwd,ee=s?s.allowTmpdirVar:!Wr(b,n.environment),Ce=Gf(o,f.words,n.environment,t===0,n.strict,n.policy);if(Ce)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Ce.reason}),ve(Ce);let ht=bi(h,n.policy);if(ht){for(let x of[ht.childIndex,...ht.alternativeChildIndices]){$f(C.wrapperNormalizationBudget);let P=p.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ht.wrapper,output:i(P)});let z=Zn(P,t,{...C,effectiveCwd:N,envAssignments:b});if(z)return z}return null}let Oe=l?void 0:v==="eval"?Pi(p):v==="trap"&&!a?ef(p):void 0;if(a&&s&&v==="eval"){if(Oe?.kind==="dynamic")return Yn(s,n.policy);if(Oe?.kind==="literal"){let x=n.analyzeNested(Oe.source,{effectiveCwd:N,envAssignments:b});if(x)return x}return Xn(s,n.policy)}if(Oe?.kind==="dynamic"&&(n.strict||!n.commandView||!Qa(n.commandView)))return ke(r);if(Oe?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:Oe.source,depth:t+1});let x=n.analyzeNested(Oe.source,{effectiveCwd:N,envAssignments:b,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?Q.has(v):Kf(y,v)){if(Tt(h))return null;if(a&&s){let x=st(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let z=Yn(s,n.policy);if(z)return z}if(Kr(x)){let z=Yn(s,n.policy);if(z)return z}return n.analyzeNested(x,{effectiveCwd:N,envAssignments:b})}let P=Ot(p);if(P.kind==="dynamic")return Yn(s,n.policy);if(P.kind==="literal")return s.dynamicSourceInput?Yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Yn(s,n.policy):null}if(l){let x=st(h),P=x?n.analyzeNested(x,{effectiveCwd:N,envAssignments:b}):Ot(p).kind==="dynamic"?ke(r):null;if(P)return P}if(s===void 0){let x=_w(h,b,N,n,r,t);if(x)return x;let P=st(h);if(P){let En=Ti(p,P);if(En.kind==="dynamic")return ke(r);let Xi=En.kind==="literal"?En.source:tf(p,P),Fl=Aw(Xi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:Fl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Fl,depth:t+1});let zl=n.analyzeNested(Xi,{effectiveCwd:N,envAssignments:b});if(zl)return zl;return Kr(Xi)?ke(r):null}let z=Ot(p,n.strict?void 0:n.shellAssignments);if(z.kind==="dynamic")return ke(r);if(z.kind==="literal")return Wi(z.source,N,b,n,r,t);let ce=nf(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ce.kind==="dynamic")return ke(r);if(ce.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ce.source,depth:t+1}),n.analyzeNested(ce.source,{effectiveCwd:N,envAssignments:b})}}if(!s&&(v==="source"||v===".")){let x=h[1]==="-p"?2:null;if(x!==null){let En=n.commandView?p[x]:void 0;if(!En)return null;if(En.provenance!=="literal")return ke(r)}let P=x===null?1:3,z=h[P]==="--"?P+1:P,ce=n.commandView?p[z]:void 0;if(!ce)return null;if(ce.provenance==="literal")return Wi(ce.text,N,b,n,r,t);if(n.strict||!n.commandView||!Qa(n.commandView))return ke(r)}if(Ue.has(v)&&!l){if(!s&&n.strict&&ll(Br(h),p))return ke(r);let x=mm(h,(z)=>qn(n.analyzeNested(z,{effectiveCwd:N,envAssignments:b}))),P=_(x,n.policy);if(P)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:P.reason}),ve(P)}if(Xe(v)&&!l){if(!s&&n.strict&&ll(Jo(h),p))return ke(r);let x=hd(h);if(a&&s)return ww(v,x,N,b,n,s);if(x){let P=ae(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:x,paranoidBlocked:P}),P){let ce=_(E("interpreter.one-liner-paranoid",Pr),n.policy);if(ce)return ve(ce)}if(fa(v,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let z=n.analyzeNested(x,{effectiveCwd:N,envAssignments:b});if(z&&!Vf(z,x))return z;if(Tr(x,void 0,!n.strict)){let ce=_(E("interpreter.dangerous-command",Ln),n.policy);if(ce)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:Ln}),ve(ce)}r=void 0}}if(v==="busybox"&&h.length>1)return $f(C.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Zn(p.slice(1),t,{...C,effectiveCwd:N,envAssignments:b});let U=s?null:_(ym(v,h),n.policy);if(U)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:U.reason}),ve(U);let W=r===C.trace?C:{...C,trace:r},pe={words:p,head:v,cwd:T,originalCwd:k,envAssignments:b,allowTmpdirVar:ee,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:N,options:W,analyzeChildTokens:(x,P)=>a&&s?dl(x,t,W,{...s,cwd:P??void 0,effectiveCwd:P??void 0}):qn(Zn(J(x),t+1,{...W,child:void 0,commandView:void 0,effectiveCwd:P,envAssignments:b}))??At(x,W.policy.rules),analyzeChild:(x,P)=>dl(x,t,W,P)},oe=s&&(v==="xargs"||v==="parallel")?void 0:jf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:ee});let ie=r&&v==="git"?Vm(pe.words,cl(pe)):void 0,Me=Uf(ie?ie.match:oe?.(pe)??null,n.policy);if(r)Pw(pe,Me,ie?.relaxation??null);if(Me)return ve(Me);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Pt(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Xn(s,n.policy):null)??Rw(s,n.policy)}let Qt=!s&&oe===void 0&&!Eo.has(v),or=r&&Qt?[]:void 0;if(Qt)for(let x=1;x<h.length;x++){let P=h[x];if(!P)continue;or?.push(P);let z=Uf(xw(h,x,t,W,T,k,N,b),n.policy);if(z)return r?.recordSegment({type:"fallback-scan",tokensScanned:or??[],embeddedCommandFound:O(P)}),ve(z)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:or??[]}),l&&s&&!s.wrappedByTransparent)return null;let Be=At(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Be,reason:Be?.reason}),Be)return ve(Be);return a&&s?Xn(s,n.policy):null}function dl(e,t,n,r){return qn(Zn(J(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function xw(e,t,n,r,o,i,s,a){for(let l of it(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(Kf(c,u)||jf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=dl(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!Wr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function ww(e,t,n,r,o,i){if(!t)return Xn(i,o.policy);if(ae(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=_(E("interpreter.one-liner-paranoid",Pr),o.policy);if(a)return ve(a)}if(fa(e,t))return Xn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Vf(s,t))return s;if(Tr(t,void 0,!o.strict)){let a=_(E("interpreter.dangerous-command",Ln),o.policy);if(a)return ve(a)}return Xn(i,o.policy)}function Vf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(hi)||e.reason===Bn)&&!xo(t);return n||r}function Yn(e,t){let n=e.shellDynamicMatch?_(e.shellDynamicMatch,t):null;return n?ve(n):null}function Xn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?_(e.dynamicSourceMatch,t):null;return n?ve(n):null}function Rw(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?_(e.rmDynamicMatch,t):null;return n?ve(n):null}function _w(e,t,n,r,o,i){let s=Sm(e);if(s.argvSource?.kind==="absent")return ke(o);if(s.argvSourceApplies&&s.argvSource){let l=Wi(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Wi(a,n,t,r,o,i,!0)}function Wi(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ke(o);let a=Ar(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ke(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Aw(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Pw(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function $f(e){if(e.iterations>=X.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ve(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function ke(e){return e?.recordSegment({type:"error",message:zr}),ve(Tw())}function Tw(){return{id:"analysis.dynamic-shell-source",reason:zr,intent:"stop_and_explain"}}function Kf(e,t){return Q.has(t)||e==="$SHELL"||e==="${SHELL}"||Q.has(A(t))}function Uf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:_(e,t)}var kw=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Iw=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Ow(e,t){let n=Zf(e,t);if(n.length===0)return!1;let r=n[Yf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return kw.test(e.join(" "))}function qf(e,t,n,r,o){if(e.dialect==="powershell"){let y=Mw(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return ul(Ww(y.target),t,n.paths)}let i=e.words.map(R),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!Ow(i,n))return s?null:void 0;if(!t)return null;let a=Zf(i,n,t),l=Yf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((u===-1?c:c.slice(0,u)).some((y)=>!/^-[LP]+$/.test(y)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length>1)return null;let g=f[0],p=r.get("HOME")||n.home;if(g===void 0)return ul(p,t,n.paths);let h=e.words.find((y)=>y.provenance==="variable"&&y.text===g),C=e.words.find((y)=>y.text===g&&/^~(?:\/|$)/.test(y.raw)),b=h?ft(h,new Map([...r,["HOME",p]])):C?`${p}${g.slice(1)}`:g;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return ul(b,t,n.paths)}function ul(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=Ht(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function Mw(e,t){let n=Dw(e[0])?1:0,r=e[n];if(!Nw(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Iw.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Lw(e.slice(n+1),t)}function Dw(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Nw(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Lw(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function Ww(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Yf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Zf(e,t,n){let r=Gw(e);return Bt([...r],t,n)}function Gw(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Fw="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",gn="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function yl(e,t,n,r){if(t>=X.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:ct}),{reason:ct,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Je(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:ct}),{reason:ct,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return hl(e,n);let u=`${hi}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return np(e,n),{reason:Bn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return np(e,n),{reason:Bn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return hl(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Mm(n.environment.env,n.envAssignments);return zi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function zi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=zw(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,C=a==="||"?p?.success??[]:[],b=a==="&&"?p?.failure??[]:[],y={connector:a,skippedSuccessStates:C,skippedFailureStates:b};if(Yt(d)&&!Yt(a))l=y;let v=Yt(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Yt(a)?l??y:y,T=hn(v.connector)||hn(d);if(u.kind==="function"){let U=h.flatMap((pe)=>{let oe=yn(pe);return oe.functionDefinitions.set(u.name,u.body),ml(pe,[oe],f,d==="&",hn(d))}),W=fl(U,[],v.skippedSuccessStates,v.skippedFailureStates,v.connector,d);i=W.states,s=W.conditionalStates,a=void 0;continue}if(u.kind==="group"){let U=[],W=[];for(let oe of h){let ie=zi(u.body,t,n,r,[yn(oe)]);if(ie.result)return ie;if(U.push(...ml(oe,ie.states,f,d==="&",hn(d))),T)W.push(oe,...f?ie.states.map((Me)=>Gi(oe,Me)):ie.states)}let pe=fl(U,W,v.skippedSuccessStates,v.skippedFailureStates,v.connector,d);i=pe.states,s=pe.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let k=cR(e.nodes[c-1]),N=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),ee=e.nodes[c-2],Ce=Yt(a)&&ee?.kind==="command"?Qm(ee)??Bw(ee):void 0,ht=[],Oe=[];for(let U of h){let W=$w(u,t,n,r,[yn(U)]);if(W.result)return{result:W.result,states:i};let pe=e.dialect==="powershell"?W.states:W.states.map((oe)=>Gi(U,oe));for(let oe of pe){let ie=yn(oe),Me=Vw(u,t,n.trace?{...n,trace:rp(n.trace,N)}:n,r,ie,Yt(a),Ce);if(Me)return{result:Me,states:i};let rr=hR(u,ie.functionDefinitions);if(rr)n.budget.charge("derivedTokens",Hi(rr));let Qt=rr?t+1>=X.recursionDepth.cap?pl(u.displayText,n,[ie]):zi(rr,t+1,n,r,[ie]):{result:null,states:pR(u,ie).flatMap((Be)=>uR(u,oe,Be,k))};if(Qt.result)return Qt;ht.push(...ml(U,Qt.states,f,d==="&",hn(d)));let or=typeof ie.effectiveCwd==="string"&&ie.effectiveCwd!==oe.effectiveCwd&&u.redirections.every((Be)=>["<",">",">>",">|"].includes(Be.operator)&&Be.target?.text==="/dev/null");if(T&&(k||!or))Oe.push(U),Oe.push(...Qt.states.map((Be)=>f?Gi(U,Be):Be))}}let Jt=fl(ht,Oe,v.skippedSuccessStates,v.skippedFailureStates,v.connector,d);i=Jt.states,s=Jt.conditionalStates,a=void 0}return{result:null,states:i}}function zw(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Yt(r)||Yt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&Hw(e,t)}function ml(e,t,n,r,o){let i=n?t.map((a)=>Gi(e,a)):[...t],s=o?i.flatMap((a)=>Jn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function Gi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function Hw(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(Uw(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Yt(e){return e==="|"||e==="|&"}function Bw(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function hn(e){return e==="&&"||e==="||"}function fl(e,t,n,r,o,i){let s={success:Fi([...n,...e]),failure:Fi([...r,...t])},a=hn(i)?s:void 0;return{states:hn(o)||a?Fi([...s.success,...s.failure]):s.success,conditionalStates:a}}function rp(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function $w(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=jw(e);if(s){if(t+1>=X.recursionDepth.cap)return pl(s,n,o);let a=Je(s,"powershell");if(a.status==="limited")return pl(s,n,o);if(a.status!=="complete")return Xf(i,n,r,o);n.budget.charge("derivedTokens",Hi(a)),i.push({program:a,depth:t+1})}}return Xf(i,n,r,o)}function Uw(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Xf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=zi(i.program,i.depth,t,n,[yn(a)]);if(l.result)return l;s.push(...l.states)}o=Fi(s)}return{result:null,states:o}}function jw(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Hi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Hi(o),0):n.kind==="group"||n.kind==="function"?Hi(n.body):0),0)}function pl(e,t,n){return t.trace?.recordSegment({type:"error",message:ct}),{result:{reason:ct,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function Vw(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:Xw(n.environment.paths,o.createdDirectories,n.budget)}},l=rR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};op(e,o,"before-consumer",a.environment.paths,a.budget);let c=Mn(e.dialect,e.words),u=c.map(R),m=e.displayText,d=Im(c,o.shellGitContextState),f=Nm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=_(om(e,i,CR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return yR(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!br(e.dialect,e.words)){let h=_(je(u[0]),a.policy),C=h!==null&&!a.strict&&fd(e,a.rootProgram);if(h&&!C)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let b=Jf(e,l,o,f,s,a);if(b)return b;return Ka(d,o.shellGitContextState),null}let g=Zn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,C)=>{let b=C&&Object.hasOwn(C,"effectiveCwd")?C.effectiveCwd:o.effectiveCwd,y=yl(h,t+1,{...a,effectiveCwd:b,envAssignments:C?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:C?.functionDefinitions,worktreeMode:C?.worktreeMode??a.worktreeMode,trace:a.trace?rp(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(g)return{...g,segment:m};let p=Jf(e,l,o,f,s,a);if(p)return p;return Ka(d,o.shellGitContextState),null}function Jf(e,t,n,r,o,i){let s=oR(e,t,n,r??new Map,i);if(s)return s;return op(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Yw(e,t,n,i.environment.paths,i.budget),Jw(e,n,i.environment.paths,i.budget),aR(e,n,o,i.environment,i.trace),null}var Kw=new Set([">>","<>"]);function op(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?qw(s):Kw.has(s.operator)))continue;Qf(s.target,t,r,o)}if(n!=="before-consumer"||!fe(e.words[0],"tee"))return;let i=sp(e.words.slice(1));if(!i)return;for(let s of i.operands)Qf(s,t,r,o)}function qw(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Qf(e,t,n,r){let o=e?.provenance==="literal"?Ar(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Yw(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of Zw(e,n.shellGitContextState.shellAssignments)){let a=Ar(s,n.effectiveCwd,r,o);if(!a||!gd(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=X.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Zw(e,t){let n=gl(tR(e.redirections)?.target,t),r=n===void 0?[]:[n];if(fe(e.words[0],"cat"))return eR(e.words)?r:[];if(!fe(e.words[0],"tee"))return[];let o=sp(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>gl(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function gl(e,t){if(nR(e))return e.text;return(e&&ft(e,t))??void 0}function Xw(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=I(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${qe.sep}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?I(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function Jw(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!fe(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>gl(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!qe.isAbsolute(c)&&!l)continue;let u=I(qe.resolve(l??"",c),n,r);if(a?Qw(u,n):n.isDirectory(qe.dirname(u))&&ip(u,n))t.createdDirectories.add(u)}}function Qw(e,t){let n=qe.parse(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>qe.join(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||ip(o(i),t)}function ip(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function eR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function tR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function sp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&ft(s,t)===null)return;if(r&&fe(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function nR(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function fe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Cl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function rR(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return gn;let r=n[0];if(!r?.heredoc)return gn;let o=/\$\(|`/.test(r.heredoc.body);if(!Cl(r.heredoc)&&(!t||o))return Fw;if(r.fd!==void 0&&r.fd!==0)return gn;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return gn;let i=e.redirections.some((l)=>l!==r&&ep(l.target));if(fe(e.words[0],"cat"))return i?gn:void 0;if(fe(e.words[0],"tee"))return i||e.words.slice(1).some(ep)?gn:void 0;let s=e.words[0],a=e.words[1];if(fe(s,"git")&&(fe(a,"apply")||fe(a,"commit")))return;if(fe(s,"gh")&&(fe(a,"pr")||fe(a,"issue"))&&fe(e.words[2],"create"))return;return gn}function ep(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function oR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(sR(e,i,n,r,o))return null;let a=iR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=hl(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function iR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Cl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=fe(e.words[0],"uv")&&fe(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Xe(i.text))return;let s=o.findIndex((m)=>fe(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=ae(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=_(E("interpreter.one-liner-paranoid",Pr),n.policy);if(m)return m}if(!Tr(l,void 0,!n.strict))return null;let u=_(E("interpreter.dangerous-command",Ln),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function sR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Cl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=sn(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(R),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Q.has(l)&&!Q.has(A(l)))return!1;return Tt(a)}function aR(e,t,n,r,o){let i=qf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(R).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var lR=new Set(["fi","done","esac"]);function cR(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function uR(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&lR.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let d=yn(n);return d.effectiveCwd=m,d})}function dR(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var mR=/^[A-Za-z_][A-Za-z0-9_]*$/,fR=8;function pR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!mR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=fR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=yn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function yn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Dm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function Fi(e){let t=[];for(let n of e){if(!t.some((r)=>gR(r,n)))t.push(n);if(t.length>X.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function gR(e,t){return e.effectiveCwd===t.effectiveCwd&&dR(e.compoundBodies,t.compoundBodies)&&Jn(e.shellGitContextState.env,t.shellGitContextState.env)&&Jn(e.literalHeredocFiles,t.literalHeredocFiles)&&Jn(e.functionDefinitions,t.functionDefinitions)&&Jn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Jn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&tp(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&tp(e.createdDirectories,t.createdDirectories)}function tp(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Jn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function hR(e,t){let n=Sr(e);return n===void 0?void 0:t.get(n)}function yR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function CR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function hl(e,t){let n=_(je(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function np(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Bn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var bR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function ap(e,t,n,r){let o=yl(e,0,{...t,...Du(t),budget:t.budget??xe(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function lp(e,t,n){try{return{decision:e()}}catch(r){let o=SR(r,t,n);if(!o)throw r;return o}}function SR(e,t,n){if(!(e instanceof D)||!bR.has(e.kind))return null;let r=X[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var vR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Sl=new Set(["cc-safety-net","ccsn"]),ER=new Set(["bunx","npx","pnpx"]),xR=new Set(["pnpm","yarn"]),wR=new Set(["npm","pnpm","yarn"]),RR=new Set(["bun","node"]);function $i(e,t,n={}){if(Sl.has(e))return 0;if(ER.has(e)){if(n.broad)return bl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Bi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&wR.has(e)&&n.broad&&t[r]==="exec"){let o=bl(t.slice(r+1));return o===null?null:r+1+o}if(xR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Bi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=bl(t.slice(r+1));return o===null?null:r+1+o}if(RR.has(e)){let o=n.broad&&r!==-1?r:0;if(cp(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&cp(t[o+1]))return o+2}return null}function bl(e){let t=e.findIndex((r)=>Bi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Bi(r))break;n++}return n}function Bi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Sl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Sl.has(e.slice(0,t))}function cp(e){let t=e?.replaceAll("\\","/");return[...vR].some((n)=>t===n||t?.endsWith(`/${n}`))}var up="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function dp(e,t,n){let r=Pe(e,"input-candidate");if(!r)return null;let o=Gn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>_R(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function _R(e,t){let n=Bt([...e],t),r=n.slice(1),o=$i(A(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}var Zr=require("node:path");var gp="This path contains the protected policy config and you must not modify or delete it.",AR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function hp(e,t,n){let r=MR(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return mp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=Pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?fp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=fp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return mp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||ao(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function mp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Xr(a,n,r,o,i));return s?{target:s}:null}function fp(e,t,n,r,o){let i=Gn(e,t,r,o,{findSegmentTarget:(s,a)=>PR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Xr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>OR(s,t,n,r,o)?.target??null});return i?{target:i}:null}function PR(e,t,n,r,o){if(Nr(e))return null;let i=$t([...e],r),s=A(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&TR(a)){let l=kR(a).find((c)=>pp(Ae(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ei(i,1)||Fa(i,r)){let c=($r(J(i))??J(["."])).find((u)=>{let m=Ae(u.text,t.variables);return Xr(m,t.cwd,n,r,o)||pp(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=ci(a).sources.find((c)=>DR(Ae(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(IR(i,s))return null;for(let l of[...e,...i])for(let c of yp(l))if(Xr(Ae(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function TR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function kR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function IR(e,t){if(!AR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function OR(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of yp(i))if(Xr(s,t,n,r,o))return{target:s};return null}function yp(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function MR(e,t,n){let r=(a)=>Jr(ge(a,e.executionCwd,t,n)),o=r(An(t)),i=[r(fr(e.executionCwd)),r(fr(e.configCwd))],s=new Set(i.map((a)=>Zr.dirname(a)));for(let a=Zr.dirname(o);;a=Zr.dirname(a))if(s.add(a),Zr.dirname(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Xr(e,t,n,r,o){let i=Kl(e,t,r,o,(s)=>Jr(s)===So);return i!==null&&n.files.has(Jr(i))}function pp(e,t,n,r,o){return n.directoriesAndAncestors.has(Jr(ge(e,t,r,o)))}function DR(e,t,n,r,o){let i=Jr(ge(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Jr(e){return process.platform==="win32"?e.toLowerCase():e}var Ee=require("node:path"),Tp=require("node:url");var kp="Access to a sensitive path is not allowed.",Ip=new Set(["echo","printf"]),NR=new Set(["find"]),LR=new Set(["!","do","elif","else","if","then","until","while"]),WR=new Set(["-exec","-execdir"]),GR=new Set([";","+"]),FR=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),zR=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Op=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),HR=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),BR=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Mp=new Set(["-c","-e","-r","-E","--eval","--exec"]),$R=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),UR=new Set(["grep","rg"]),jR=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),VR=new Set(["commit","merge","notes","stash","tag"]),KR=new Set(["-m","--message"]),qR=new Set(["--grep"]),Cp=new Set(["jq","gojq","jaq"]),bp="f",Sp="file",YR="files",ZR=new Set(["e","f"]),XR=new Set(["regexp","file"]),JR=new Set(["e","f","A","B","C","m"]),QR=new Set(["regexp","file","after-context","before-context","context","max-count"]),vl="__CC_SAFETY_NET_PIPE_INPUT__",xl=/[\w./~@+-]*[./~][\w./~@+-]*/g,e_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,t_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,n_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,vp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Ep=/\b(?:system|exec|spawn|popen)\s*$/,r_=/\b(?:eval|exec)\s*\(/g,o_=/\b(?:eval|exec)\s*$/,i_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function xp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(nA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=eA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(zp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!Rl(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Rl(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&rA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Dp(e,t,n,r,o={}){let i=wp(e,n,r),s=xp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=xp(i,t,e.invocation.context.configCwd,n,r,new Set(wp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&s_(e,n)?null:a}function s_(e,t){let n=Pe(e,"input-candidate")??Pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of li(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(_t(s.text,t))}let o=Dt(r);if(o.length===0)return!1;let i=lt(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return _l(i,o.slice(1))}function _l(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>FR.has(n))}function wp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=Pe(e,"input-candidate");return[...s?Qn(s.shell,e.store,r,t,o,n,a_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function a_(e){return e.program.dialect==="powershell"}function Qn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new nt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...W_(_t(e.source,r),t,n,r,o,i)],l=(c)=>_t(C_(c,s),r);return ai(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...ji(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...c_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Np(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>u_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ea;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function Al(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new nt;return s.status==="complete"?Qn(s,t,n,r,o,i):null}function ji(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,C)=>!s.has(C));if(Cp.has(lt(Dt(p)[0]??"").toLowerCase()))return[...e.filter((h,C)=>s.has(C)).map(a),...ji(p,t,n,r,o,i)]}let l=y_(e).map(a),c=Dt(e);if(c.length===0)return l;let u=c[0]??"",m=lt(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!LR.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&_l(lt(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=l_(u,m,d);if(g)return[...l,...g.map(a)];if(Ip.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...Lp(e).map(a)]:l;if(m==="eval")return[...l,...Al(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:gt(m,p)).map(a)];if(m==="git")return[...l,...S_(d).map(a)];if(m==="gh")return[...l,...wl(m,d,jR).map(a)];if(Cp.has(m))return[...l,...b_(d).map(a)];if(UR.has(m))return[...l,...j_(d).map(a)];if(NR.has(m))return[...l,...w_(d,t,n,r,o,i).map(a)];if(Ue.has(m))return[...l,...d.flatMap((p)=>gt("awk",p)).map(a),...d.flatMap((p)=>__(p,t,n,r,o,i)),...d.flatMap(A_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>gt(m,p)).map(a),...v_(d).map(a)];if(Lr(m)){let p=Dr.has(m)?Le([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new nt;if(h.status==="complete")return[...l,...Qn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((C)=>!C.startsWith("-")).map(a)]}return[...l,...R_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>gt(m,p)).map(a)]}function l_(e,t,n){let r=$i(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function c_(e,t,n,r,o,i,s){if(p_(t,n,r,o,i,s)){let a=Dt(e),l=_l(lt(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...Lp(e),...l].map((c)=>({target:c,cwd:i}))}return Np(t,d_(e),n,r,o,i,s,()=>[])}function u_(e,t,n,r,o,i,s){let a=Dt(e);if(!Lr(lt(a[0]??"").toLowerCase()))return[];return Al(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Np(e,t,n,r,o,i,s,a){let l=g_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Dr.has(l)?Qn(n.getShellSyntax(c),n,r,o,i,s):Ui(l,c,n,r,o,i,s))}function Lp(e){let t=Dt(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase();if(!Ip.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Pl(r.replaceAll("%%","%"))];return t.slice(1)}function d_(e){let t=Dt(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return m_(r);return[]}function m_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Pl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>f_(t,r.slice(i*n,(i+1)*n)))}function f_(e,t){let n=0;return Pl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Pl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function p_(e,t,n,r,o,i){let s=Dt(e);if(s.length===0||lt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=pn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,vl]:l.map((m)=>m.split(c).join(vl));return ji(u,t,n,r,o,i).some((m)=>m.target.includes(vl))}function g_(e){let t=Dt(e);if(t.length===0)return null;let n=lt(t[0]??"").toLowerCase();if(!Lr(n))return null;return h_(n,t.slice(1))?n:null}function h_(e,t){let n=Tl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Mp.has(o)||Wp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(i_.get(n)?.has(o))r++;continue}return!1}return!0}function Tl(e){return/^python\d/.test(e)?"python":e}function y_(e){let t=[];for(let n of e){if(Fp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Rp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function C_(e,t){if(!t||!Rp.test(e))return e;return`~${e.replace(Rp,"").replace(/\\/g,"/")}`}function gt(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function b_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>gt("jq",i))}return e.flatMap((r,o)=>o===t?[]:gt("jq",r))}function S_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...VR.has(r)?wl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),KR):wl("git",e.slice(n),qR)];if(t.push(...gt("git",r)),!Ne.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:gt("git",o)),n++}return t}function wl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>gt(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...gt(e,i))}return r}function v_(e){return e.flatMap((t,n)=>{let r=x_(t);if(r!==null)return _p(r.flag,r.value);let o=E_(e[n-1]);return o===null?[]:_p(o,t)})}function _p(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return El(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return El(t.slice(n+1))}return t.startsWith("@")?El(t.slice(1)):[]}function E_(e){if(e===void 0)return null;if(Op.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function x_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Op.has(r)?{flag:r,value:e.slice(n+1)}:null}function El(e){return e===""||e==="-"?[]:[e]}function w_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!WR.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>GR.has(f)),m=u===-1?c:c.slice(0,u),d=ji(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!zR.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function R_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Mp.has(c)||Wp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...Ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...Ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Wp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return $R.get(t[t.length-1]??"")?.has(Tl(e))??!1}function __(e,t,n,r,o,i){if(!e.includes("system"))return[];return Na(e)?.commands.flatMap((s)=>Qn(t.getShellSyntax(s),t,n,r,o,i))??[]}function A_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function P_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(kl),...e.match(xl)??[]]}function Ui(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=k_(t,T_(e));if(l.kind==="unmaskable")return P_(t).map(a);let c=l.masked.match(vp)!==null||l.literals.some((p)=>Ep.test(l.masked.slice(0,p.start))),u=l.masked.match(r_)!==null||l.literals.some((p)=>o_.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!Dr.has(e),d=m&&!(D_(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(vp),(p)=>{let h=p.index+p[0].length;return{start:h,end:ga(l.masked,h)}}):[],g=!m||f.some((p)=>ha(l.masked,p.start))?l.literals:l.literals.filter((p)=>Ep.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>kl(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(xl)??[]).map(a),...c?g.flatMap((p)=>Al(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>Ui(e,p.text.replace(/\\(.)/g,(h,C)=>C==="n"?`
-`:C),n,r,o,i,s)):[],...(l.masked.match(xl)??[]).map(a)]}function T_(e){let t=Tl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function k_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(t_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&M_(e,o))return{kind:"unmaskable"};let a=t==="python"?I_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=O_(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&n_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function I_(e,t){return e_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function O_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function M_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function D_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(HR.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>BR.has(i)))continue;if(o.length>1)return!0;if(N_(e,r)===".")return!0;if(L_(e,r+n.length)==="(")return!0}return!1}function N_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function L_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function W_(e,t,n,r,o,i){return B_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Qn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...G_(a,r)?F_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function G_(e,t){let n=li(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||lt(_t(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=_t(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function F_(e,t){return li(e).flatMap((n)=>n.kind==="word"?[_t(n.text,t)]:n.kind==="redirection"&&n.target?[_t(n.target,t)]:[]).flatMap(kl)}function kl(e){let t=H_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||z_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function z_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function H_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function B_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(pr(o,n))continue;if(Gp(e,r,n)){let i=$_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=U_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function $_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(pr(i,n))continue;if(Gp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function U_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Gp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function j_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===YR)o=!0;if(XR.has(m))r=!0;if(d!==void 0){if(m===Sp)t.push(d);continue}if(QR.has(m)){let f=e[l+1];if(m===Sp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(ZR.has(h))r=!0;if(JR.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===bp)t.push(f);continue}let g=e[l+1];if(d===bp&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Dt(e){let t=e.findIndex((n)=>!Fp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Fp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var V_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),K_=".env.",q_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Y_=[".env.example.",".env.sample."];function Z_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function X_(e){return e.length>0&&!/\s/.test(e)}function Rl(e,t,n,r){let o=zp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function zp(e,t,n,r){try{return to(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var J_=new Set(["node_modules","__pycache__"]),Q_=[["vendor","bundle"],["vendor","cache"]];function eA(e,t,n,r,o){if(Z_(e))return null;let i=pt(e,t,r,o);if(!i)return null;let s=j(i.split("/").pop()??""),a=j(i),l=()=>X_(s)||Rl(e,t,r,o);if(q_.has(s)||Y_.some((d)=>s.startsWith(d)))return null;let c=j(sA(e,t,r,o));for(let d of Is){let f=`~/${d.suffixParts.join("/")}`;if((Pp(a,f)||Pp(c,f))&&Mt(d.id,n))return d.id}let u=tA(i,t,n,r,o);if(u)return u;if(V_.has(s))return null;for(let d of ks)if(s===d.basename&&Mt(d.id,n))return d.id;if(s.startsWith(K_)&&Mt(_o.id,n)&&l())return _o.id;for(let d of Os)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&Mt(d.id,n)&&l())return d.id}for(let d of Ms)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Mt(d.id,n))return d.id}if(oA(a))return null;if(!s.includes(".")&&hr.pattern.test(s)&&Mt(hr.id,n))return hr.id;let m=iA(s,n);if(m)return m;return null}function tA(e,t,n,r,o){return Ao.find((i)=>{if(!Mt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return B(e,Z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=j(e).split("/");return B(e,Z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||eo(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return B(e,pt("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=Z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return B(e,s,["auth.json",".credentials.json"])||Qr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=Z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=j(e).split("/").at(-1)??"";return B(e,s,["config.toml"])||a.endsWith(".config.toml")&&B(e,s,[a])}case"secret.cli.gemini":return B(e,ye(Z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=j(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ye(Z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return B(e,ye(Z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?eo(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>B(e,pt(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=Z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return B(e,s,["config.json"])||Qr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return B(e,Z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=Z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=Z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return B(e,s,["server.token"])||Qr(e,s,["credentials"])||Qr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=j(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||B(e,Z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||B(e,Z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ye(Z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=j(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return B(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&B(e,s,[a])||c.some((u)=>eo(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ye(Z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ye(Z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(j(e).split("/").at(-1)??"")||B(e,s,["config.json"])||(c?.trim()?eo(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>B(e,pt(u,t,r,o),l))}case"secret.cli.pi":return B(e,Z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return B(e,Z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=pt("~",t,r,o);return[ye(Z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ye(s,".local","share","amp")].some((l)=>B(e,l,["secrets.json"]))||Qr(e,ye(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ye(Z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ye(pt("~",t,r,o),".config","amp")],l=j(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>B(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?eo(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ye(Z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ye(Z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return B(e,pt("~/.cursor",t,r,o),["auth.json"])||B(e,s,["auth.json"])||j(e).split("/").at(-1)==="mcp-auth.json"&&Cn(j(e),j(a))}case"secret.cli.cursor.config":{let s=j(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return B(e,Z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=j(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||B(e,Z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||B(e,pt("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Ap=new WeakMap;function Z(e,t,n,r,o){let i=Ap.get(o)??new Map;Ap.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=pt(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function B(e,t,n){return n.some((r)=>Hp(e,ye(t,r)))}function Qr(e,t,n){return n.some((r)=>Cn(j(e),j(ye(t,r))))}function eo(e,t,n,r,o){return Hp(e,pt(t,n,r,o))}function Hp(e,t){return j(e)===j(t)}function ye(e,...t){return at([e,...t].filter(Boolean).join("/"))}function nA(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(to(e,t,o,i));return n.some((a)=>Cn(s,j(to(a,r,o,i))))}function rA(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(to(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?at(I(De(a),o.paths,i)):"",c=j(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=j(u?at(I(Ee.resolve(De(u)),o.paths,i)):l&&at(I(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Cn(s,m))return!1;return n.some((d)=>{let f=Ws(d);if(f&&Ee.posix.basename(s)!==j(f.name))return!1;let g=j(to(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Cn(s,g)&&!(f&&s===g)})}function oA(e){let t=e.split("/");return t.some((n)=>J_.has(n))||Q_.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function iA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ds)if(r===o.extension&&Mt(o.id,t))return o.id;for(let o of Ns)if(o.pattern.test(r)&&Mt(o.id,t))return o.id;return null}function j(e){return e.toLowerCase()}function Mt(e,t){return!t?.disabledRules?.includes(e)}function pt(e,t,n,r){let{home:o,normalized:i}=Il(e,n,r);if(!i)return"";if(!o)return i;let s=Ol(i,o),a=Ee.isAbsolute(s)?s:at(Ee.resolve(t,s)),l=at(I(a,n.paths,r));if(!Cn(l,o)){if(Ee.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Pp(e,t){return e===t||e.startsWith(`${t}/`)}function sA(e,t,n,r){let{home:o,normalized:i}=Il(e,n,r);if(!i||!o)return"";let s=Ol(i,o),a=Ee.posix.normalize(Ee.isAbsolute(s)?s:at(Ee.resolve(t,s))),l=at(De(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Cn(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function to(e,t,n,r){let{home:o,normalized:i}=Il(e,n,r);if(!i)return"";let s=o?Ol(i,o):i;return at(I(Ee.isAbsolute(s)?s:Ee.resolve(t,s),n.paths,r))}function Il(e,t,n){let r=t.env.get("HOME")??t.home,o=r?at(I(De(r),t.paths,n)):"",i=at(De(aA(_t(e,t))));return{home:o,normalized:i}}function aA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Tp.fileURLToPath(e)}catch{return e}}function Ol(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ye(t,e.slice(2));return e}function lA(e){if(process.platform==="win32")return!0;return Ee.win32.parse(e).root.length>1}function at(e){let t=e.trim(),n=(t.includes("\\")&&lA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Cn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function lt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class bn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var cA={findPolicyMutation:hp,findGitMetadataMutation:$d,resolveGitMetadata:dA,loadPolicySnapshot:Mu,findSensitiveTarget:Dp,analyzeCommand:ap,getModes:fs},uA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Bp(e,t){let n={...cA,...t.dependencies},r=pA(e),o=no(e)?e.command:r,i=Zt("policy-protection",o,()=>Hd(e)),s=Pe(i,"input-candidate"),a=Pe(i,"declared-command");if(no(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:ct,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:im,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=xe(),c=Zt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Zt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let y=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:gp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:y,segment:u.target}}}}let m=Zt("policy-protection",o,()=>dp(i,t.environment,l));if(m){let y=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:up,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:y,segment:m.target}}}}let d=Zt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let y=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:rt,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:y,segment:d.target}}}}let f=Zt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...mA(f)},C=g.secretProtection.enabled===!1?null:Zt("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:no(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(C){let y=o??C.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:kp,intent:"hard_stop",ruleId:C.ruleId,evidence:{command:y,segment:C.target}}}}if(!no(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ml("command-validation",o),...h};let b=Zt("command-analysis",o,()=>lp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},fA(i),i.store),e.command,t.trace));if(b.decision){let y=!p.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===zr&&!uA.test(b.decision.evidence?.segment??"")&&je(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:y?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function dA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function mA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function fA(e){return Pe(e,"declared-command")?.program}function pA(e){try{return Nt(e.input)}catch(t){let n=no(e)?e.command:void 0;throw new bn("policy-protection",Ml("policy-protection",t instanceof be?void 0:n,t),t)}}function Zt(e,t,n){try{return n()}catch(r){throw new bn(e,Ml(e,r instanceof be?void 0:t,r),r)}}function Ml(e,t,n){let r=n instanceof D||n instanceof nt;return{stage:e,decision:{kind:"deny",reason:r?Qi:sr,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function no(e){return e.route.kind==="command"}var Ki=require("node:fs"),tr=require("node:path");var le=require("node:fs"),er=require("node:path");function $p(e,t={}){return Lo(An(e,t),e.home).policy.audit.retention_days}var Nl=86400000,gA=".last-prune",hA=/^\d{4}-\d{2}$/,yA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Up=(e)=>Math.floor(e/Nl);function Vp(e,t,n=()=>new Date){try{let r=n().getTime();if(!le.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=er.join(t,gA),i=le.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Up(i)===Up(r))return;let s=r-$p(e)*Nl,a=new Date(r).toISOString().slice(0,7);for(let l of Dl(t)){if(l.isDirectory()){CA(er.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))bA(er.join(t,l.name),s)}le.writeFileSync(o,"",{mode:384}),le.utimesSync(o,r/1000,r/1000)}catch{}}function CA(e,t,n){for(let r of Dl(e)){if(!r.isDirectory()||!hA.test(r.name))continue;let o=er.join(e,r.name);for(let i of Dl(o)){if(!i.isFile())continue;let s=yA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Nl;if(!Number.isFinite(a)||a>=t)continue;Kp(er.join(o,i.name))}if(r.name!==n)jp(o)}jp(e)}function bA(e,t){try{let n=le.lstatSync(e);if(n.mtimeMs>=t)return;let r=le.readFileSync(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(SA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(le.lstatSync(e).mtimeMs!==n.mtimeMs)return;Kp(e)}catch{}}function SA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Dl(e){try{return le.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Kp(e){try{le.unlinkSync(e)}catch{}}function jp(e){try{le.rmdirSync(e)}catch{}}var vA="2.5.2",EA=1e4,xA=2000,wA=256,RA=32768;function _A(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function AA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ll(e,t,n,r,o,i,s={}){let a=_A(t);if(!a)return;let l=TA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Vi(yt(n),s.failureStage?Number.POSITIVE_INFINITY:EA),m=Vi(yt(r),xA),d=s.toolName?Vi(yt(s.toolName),wA):void 0,f=i===null?void 0:Vi(yt(i),RA),g=tr.join(l,AA(f?.value??null),c.slice(0,7));Ki.mkdirSync(g,{recursive:!0,mode:448});let p=tr.join(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??ps)(),v:vA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Ki.appendFileSync(p,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Vp(e,l,s.now)}catch{}}function Vi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function PA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&tr.isAbsolute(n)?n:null}function TA(e){let t=PA(e);return t?tr.join(t,".cc-safety-net","logs"):null}function Yp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=qp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?qp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function qp(e){return"command"in e?e.command??"":""}function Zp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ll(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Xp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ll(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Qp(e,t,n){try{let r=Bp(t,{environment:e,...n.guard});return Jp(e,t,r,n),r}catch(r){if(!(r instanceof bn))throw r;throw Jp(e,t,r.evaluation,n,!(r.cause instanceof be),{stage:r.stage,errorCode:kA(r.cause)}),r}}function Jp(e,t,n,r,o=!0,i){Zp(e,Yp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function kA(e){if(e instanceof D)return X[e.kind].errorCode;if(e instanceof be)return"tool-input-limit";if(e instanceof nt)return"structural-shell-syntax-limit";return"unexpected-error"}var Sn=(e,t,n,r,o)=>dc(e.cwd,t,n,r,o.paths,process.cwd()),qi=(e,t,n)=>(r,o,i,s,a)=>{let l=Sn(r,o,i,s,a);if(!l)return null;let c=r.tool_input;if(!t.has(i)||!c||!Object.hasOwn(c,e))return l;let u=c[e];if(n?.emptyMeansSessionCwd&&u==="")return l;if(typeof u!=="string"||u.trim()==="")return Se(s,o,i),null;let m=n?.allowOutsideSessionCwd?ls(u,l.configCwd,a.paths):bt(u,[l.configCwd],a.paths);if(m)return{configCwd:l.configCwd,executionCwd:m};return $e(s,o,i,{directory:"requested",problem:vt(u,l.configCwd,a.paths),cwd:u}),null};function IA(e,t){console.log(JSON.stringify(e(Bl(t))))}async function OA(e){let t;try{t=(await uc(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return mo(t,e,"Failed to parse hook input JSON.")}async function MA(e){let t=Ec(),n=await OA(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){Se(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=WA(n),s=(g,p)=>{Xp(t,g,()=>e.getSessionId(n),{agent:r,shape:o,toolName:p,cwd:g.cwd??i}),e.outputDeny(g)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){Se((g)=>s(g),LA(n));return}let l=a,c=(g)=>s(g,l),u;try{u=e.getToolInput(n,l,c,t)}catch(g){if(!(g instanceof be))throw g;Se(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=Nt(u.input)}catch(g){if(!(g instanceof be))throw g;Se(c,void 0,l);return}let f=Ac(l,u.input,u.route,m,d??null);try{let g=Qp(t,f,{guard:{auditAllowed:_c(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),p=es(g,{includeEvidence:!0,toolName:g.stage==="command-analysis"?void 0:l});if(p){if(p.unverifiedByStandardMode&&e.outputAsk&&e.canPromptPerson?.(n)){e.outputAsk(p);return}e.outputDeny(p);return}e.outputAllow?.()}catch(g){if(!(g instanceof bn))throw g;DA(g,t.env);let p=es(g.evaluation,{includeEvidence:!0,toolName:g.evaluation.stage==="command-analysis"?void 0:l});if(p)e.outputDeny(p);return}}function DA(e,t){if(!Et(te.debug,t))return;console.error(`CC Safety Net debug: ${NA(e.stage)}: ${Ul(e.cause)}`)}function NA(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function LA(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function WA(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ie(e){let t=(s)=>IA(e.createDenyOutput,s),n=e.createAskOutput,r=n?(s)=>console.log(JSON.stringify(n($l(s)))):void 0,o=e.createAllowOutput,i=o?()=>console.log(JSON.stringify(o())):void 0;try{await MA({...e,outputDeny:t,outputAsk:r,outputAllow:i})}catch(s){console.error("CC Safety Net error:",s),t(xn())}}var GA=new Map([["run_command","auto"]]),FA=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function eg(e){return se(e,GA)}async function tg(){await Ie({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:$A(e.toolCall?.args,t),route:eg(t)}),getContext:zA,getSessionId:(e)=>e.conversationId})}function zA(e,t,n,r,o){let i=BA(e);if(!i[0])return Xt(r,t,n),null;let s=i.flatMap((u)=>{let m=St([u],o.paths);return m?[m]:[]});if(!s[0])return Xt(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;if(n!=="run_command"){let u;try{u=HA(t,n,s,o.paths)}catch(m){if(m instanceof be)return Xt(r,void 0,n),null;if(!(m instanceof D))throw m;return Xt(r,t,n),null}if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return Xt(r,t,n),null;let c=bt(l,s,o.paths);if(c){let u=ng(c,s);if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:c}}return Xt(r,t,n,{directory:"requested",problem:vt(l,s[0],o.paths),cwd:l}),null}function HA(e,t,n,r){let o=eg(t),i=[...lo(e,FA),...o.kind==="patch"?co(e):[]].filter(Wl.isAbsolute),s=xe(),a=new Set(i.flatMap((l)=>{let c=ng(I(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function ng(e,t){return t.filter((n)=>ur(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function Xt(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0,i={command:typeof o==="string"?o:void 0,toolName:n};e(r?oo(r,i):xn(i))}function BA(e){if(e.workspacePaths===void 0)return[process.cwd()];return Array.isArray(e.workspacePaths)?e.workspacePaths.filter((t)=>typeof t==="string"&&t.trim()!==""):[]}function $A(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var UA=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],Yi=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:8,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:8,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:7,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:7,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:9,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:10,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:11,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:12,install:{order:12,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:13,install:{order:13,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:14,install:{order:14,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:UA}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],zL=Yi.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),rg=Yi.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),HL=Yi.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),BL=Object.fromEntries(Yi.map((e)=>[e.id,e.displayName]));var vn=require("node:path");function og(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!vn.isAbsolute(e))return"unknown";try{let n=xe(),r=typeof e==="string"&&e?I(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||vn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||vn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||vn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!vn.isAbsolute(l))return[];return ur(r,I(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("COPILOT_CLI")==="1")return"copilot-cli";if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var Zi="PreToolUse",ig="BeforeTool",sg="pre_tool_call";async function nr(e){await Ie({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"deny",permissionDecisionReason:t}}),...e.canPromptPerson?{canPromptPerson:e.canPromptPerson,createAskOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"ask",permissionDecisionReason:t}})}:{},isSupported:(t)=>t.hook_event_name===Zi,getToolName:(t)=>t.tool_name,getToolInput:(t,n,r,o)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n,t.tool_input,o)}),getContext:e.getContext??Sn,getSessionId:(t)=>t.session_id})}var jA=new Map([["Bash","posix"],["PowerShell","powershell"],["Monitor","posix"]]);function VA(e,t,n){if(e==="Bash"&&n.env.get("COPILOT_CLI")==="1")return{kind:"command",shell:"auto"};return e==="Monitor"&&t?.command===void 0?se(e,new Map):se(e,jA)}async function ag(){await nr({agent:"claude-code",getAgent:(e,t)=>og(e.transcript_path,t),canPromptPerson:(e)=>["default","acceptEdits","plan"].includes(e.permission_mode??""),getToolRoute:VA})}var KA=new Map([["Bash","auto"]]);async function lg(){await nr({agent:"codex",getToolRoute:(e)=>se(e,KA)})}var qA=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function YA(e){return se(e,qA)}async function cg(){await Ie({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{let r=YA(t);if(typeof e.toolArgs==="object"&&e.toolArgs!==null)return{ok:!0,input:e.toolArgs,route:r};if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};if(r.kind==="patch"&&e.toolArgs.trimStart().startsWith("*** Begin Patch"))return{ok:!0,input:e.toolArgs,route:r};let i=mo(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(i===void 0)return{ok:!1};return{ok:!0,input:i,route:r}},getContext:Sn,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var ZA=new Map([["Shell","auto"]]);function XA(e){return se(e,ZA)}async function ug(){await Ie({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:XA(t)}),getContext:JA,getSessionId:(e)=>e.conversation_id})}function JA(e,t,n,r,o){let i=QA(e);if(!i[0])return Se(r,t,n),null;let s=i.flatMap((d)=>{let f=St([d],o.paths);return f?[f]:[]});if(!s[0])return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;let a=eP(e.cwd),l=bt(a,s,o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:vt(a,s[0],o.paths),cwd:a}),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l};let c=t.working_directory;if(typeof c!=="string"||c.trim()==="")return Se(r,t,n),null;let u=ar(c),m=bt(u,s,o.paths);if(!m)return $e(r,t,n,{directory:"requested",problem:vt(u,s[0],o.paths),cwd:u}),null;return{configCwd:l,executionCwd:m}}function QA(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[ar(e.cwd)]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="").map((t)=>ar(t))}function eP(e){return typeof e==="string"&&e.trim()!==""?ar(e):"."}var dg=new Map([["run_shell_command","auto"]]);function tP(e){return se(e,dg)}async function mg(){await Ie({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===ig,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:tP(t)}),getContext:qi("dir_path",dg,{emptyMeansSessionCwd:!0,allowOutsideSessionCwd:!0}),getSessionId:(e)=>e.session_id})}var nP=new Map([["run_terminal_command","auto"],["monitor","auto"]]);function rP(e){return se(e,nP)}async function fg(){await Ie({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return Se(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:rP(t)}},getContext:oP,getSessionId:(e)=>e.sessionId})}function oP(e,t,n,r,o){let i=iP(e);if(!i)return Se(r,t,n),null;let s=St([i],o.paths);if(!s)return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i}),null;let a=sP(e.cwd),l=bt(a,[s],o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:vt(a,s,o.paths),cwd:a}),null;return{configCwd:l,executionCwd:l}}function iP(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?t:void 0}function sP(e){return typeof e==="string"&&e.trim()!==""?e:"."}var pg=require("node:path");var aP=new Map([["terminal","posix"]]);async function gg(){await Ie({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===sg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:se(t,aP)}),getContext:lP,getSessionId:(e)=>e.session_id})}function lP(e,t,n,r,o){let i=Sn(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return Se(r,t,n),null;let a=St([pg.resolve(i.configCwd,s)],o.paths);if(!a)return $e(r,t,n,{directory:"requested",problem:"unusable",cwd:s}),null;return{...i,executionCwd:a}}var hg=new Map([["Bash","posix"]]);function cP(e){return se(e,hg)}async function yg(){await nr({agent:"kimi-code",getToolRoute:cP,getContext:qi("cwd",hg)})}var uP={"antigravity-cli":tg,"claude-code":ag,codex:lg,"copilot-cli":cg,cursor:ug,"gemini-cli":mg,"grok-build":fg,"hermes-agent":gg,"kimi-code":yg},Gl=rg.map((e)=>({...e,run:uP[e.id]}));function Cg(e){let t=ro({label:"hook",booleans:Object.fromEntries(Gl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Gl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function bg(e){return Gl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function dP(){let e=process.argv.slice(2),t=e[0],n=ro({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=Cg(e.slice(1));if(i){await i.run();return}}let o=bg(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}dP().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Qr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(R(e)):e.provenance==="literal"}function Xn(e){return e?R(e):""}function Di(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function sl(e,t){return ol(Qe(e,"posix"),t)}function eo(e){return sl(e,new Set(Array.from(e.matchAll(af)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ol(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ol(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ol(o,n))||pf(r.words,n))return!0;dw(r,n)}return!1}function pf(e,t){let n=e.findIndex((s)=>Ke(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Jr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return sf(e[s],t)}if(te.has(o)){let s=e.slice(n),a=We(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&sf(s[l],t)}let i=aw(e,n,t);if(i===null)return!1;if(i===-1)return!0;return pf(e.slice(i),t)}function aw(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return lw(e,t+1);if(r==="exec")return cw(e,t+1);if(r==="env")return uw(e,t+1,n);return null}function lw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function cw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function uw(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Jr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Jr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ke(i))continue;return r}return null}function dw(e,t){if(!e.words.every((n)=>Ke(n.text)!==null))return;for(let n of e.words){let r=Ke(n.text);if(!r)continue;if(Jr(n,t))t.add(r.name)}}function Jr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(af)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(ew.test(o)||t.has(o))}))}function sf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Jr(e,t))}var al="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ll="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",mw="__CC_SAFETY_NET_XARGS_INPUT__",Ni="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Li="rm",fw=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,pw=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,gw=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,hw=/^(?:[0-9]+|[@*])$/;function yf(e,t){let n=e.map(R),{childStart:r,replacementToken:o}=Sn(n),i=n.slice(r),s=v("xargs.shell-dynamic",ll);if(Cw(i,o,t)&&_(s,t.policy))return _(s,t.policy);for(let a of st(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?_(s,t.policy):null;if(c)return c;let u=xf(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&vf(l,o),d=t.analyzeChild(l,{...yn(a,t),dynamicInput:u,dynamicSourceInput:m||bf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",al)});if(d)return d;let f=yw(l,o,t.policy?.rules??[],_(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,mw]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(p,{...yn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=At(l,t.policy?.rules??[]);if(g)return g}return null}function yw(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=At([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Cf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=nf(e,r,t.length,n);return o===null?[]:[o]}function bf(e,t,n,r,o,i,s){if(te.has(t)){if(kt(e))return!1;if(n!==null&&bw(e,n,s))return!0;let a=at(e);if(!a){let l=Ot(ee(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Sf(a,n,s))return!0;if(Ve(a))return!0;return Sw(a,n,r)}if(Je(t))return gf(e,n,ri,_d(t));if(je.has(t))return gf(e,n,za,Sm);if(t==="eval"){let a=Oi(ee(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return vw(e,n,i);if(t==="git"){let a=Be(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Yn.has(a.subcommand.toLowerCase())&&Ef(a.rest,n).some((l)=>l.includes(n))}return!1}function Sf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ve(i)===null&&n(i)===null}function gf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ni]).sources.some((a)=>a.value===Ni);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ni}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ni}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Cf(l,t,a))));return Ti(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Cw(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(st(e,n),(i)=>i.head)),o=t===null?[...e,Li]:e.map((i,s)=>s===0?i:i.replaceAll(t,Li));return Array.from(st(o,n)).some((i)=>i.head===Li&&!r.has(Li))}function vf(e,t){return Ef(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Ef(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function xf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function bw(e,t,n){let r=We(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Sf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Cf(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=We(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function Sw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(fw))if(hf(o,r))return!0;for(let o of e.matchAll(pw))for(let i of(o[1]??"").matchAll(gw))if(hf(i,r))return!0;return sl(e,r)}function hf(e,t){let n=e[1]??e[2];return n!==void 0&&(hw.test(n)||t.has(n))}function vw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(ft(s)){let l=qn(e,i);i=l.nextIndex-1;for(let c of st(l.tokens,{environment:n,cwd:void 0})){let u=xf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&vf(c.tokens,t)||bf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=Tt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Sn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var to="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",no="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ew="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",xw="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Gi=/\{[^{}\s]*\}/g,wf=/\{\}|\{-?\d+\}/g,Rf=/[\s;&|<>()$`\\"']/,ww=["e","f","source","file","-e","-f","--source","--file"],Rw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],_w=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Aw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),_f=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Pw=new Set(["--workdir","--wd"]),Af="__CC_SAFETY_NET_PARALLEL_SOURCE__";function qe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function If(e){return qe([...e],(t)=>Ve(t))}function Of(e,t){let n=e.map(R);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=Jn(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Uf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=Jn(t);if(g)return g;let p=If(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=Nw(t);if(g)return g}if(u!==void 0&&a){let g=Jn(t);if(g)return g}let d=Lw(u,t.cwd,t.environment.paths);if(d===null){let g=Jn(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...st(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some(dl)){let p=Jn(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=Gf(f.envAssignments,f.cwd,a);return qe(g,(h)=>t.analyzeNested(h,p))}return qe(st(i,f),(g)=>kw(g,o,t,f))}function kw(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(Bf)){let E=Jn(n);if(E)return E}let c=If(l);if(c)return c;let u=l.some(z),m=o||u,d=s&&m,f=Gf(e.envAssignments,e.wrapperCwd,i||d),g=m?{...f,worktreeMode:!1}:f,p=a.join(" "),h=z(p.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>Rf.test(E))),b=h||Rf.test(a[0]??""),C=y&&b&&t.jobs.length>0?null:Tw(e,t,n,r,g,u);if(C||!y)return C;return Mf(z(p)?p:`${p} {}`,!h,e,t,n,r,g)}function Tw(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,u=e.tokens,m=a||i;if(te.has(e.head)){let f=()=>{if(!a||s.length===0)return null;return qe(s,(h)=>n.analyzeChild(Wi(u,h,n.budget),yn(e,r)))};if(kt(u))return f();let g=at(u);if(g){if($f(g)){let C=Zt(n);if(C)return C;if(s.length===0)return null;return qe(s,(E)=>n.analyzeNested(zf(g,E,n.budget),o))}if(z(g))return Mf(g,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((C)=>Mi(ee(C===void 0?u:a?u.map((E)=>Ff(E,C)):[...u,...C]),g)):[];if(h.some((C)=>C.kind==="dynamic")){let C=Zt(n);if(C)return C}let y=h.flatMap((C)=>C.kind==="literal"?[C.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),qe(y,(C)=>n.analyzeNested(C,o));if(eo(g)){let C=Zt(n);if(C)return C}let b=n.analyzeNested(g,o);if(b)return b;if(m)return Zt(n);return null}let p=Ot(ee(u));if(p.kind==="dynamic"||p.kind==="literal"&&z(p.source))return Zt(n)??f();if(p.kind==="literal")return f();if(s.length>0){let h=Zt(n);if(h)return h;let y=f();if(y)return y;if(a)return null;let b=s.flatMap((C)=>C[0]===void 0?[]:[C[0]]);return n.budget.charge("derivedTokens",b.length),qe(b,(C)=>n.analyzeNested(C,o))}if(m||c)return Zt(n)??f();return null}if(e.head==="rm"&&Pt(u)){if(a&&s.length>0)return qe(s,(g)=>cl(Wi(u,g,n.budget,wf),e.cwd,r));if(s.length>0)return qe(s,(g)=>cl(kf(u,g,n.budget),e.cwd,r));let f=cl(u.flatMap((g,p)=>{if(p===0||!z(g))return[g];return g.startsWith("-")?[g.replace(wf,"")]:[]}),e.cwd,r);if(f)return f;return Wf(n)}let d=s.length>0?s:[void 0];return qe(d,(f)=>{let g=f===void 0?u:a?Wi(u,f,n.budget):kf(u,f,n.budget),p=v("parallel.shell-dynamic",no),h=c&&e.head==="find"?Dw(g,r):null,y=Nf(g,c,n)??h?.customResult??null,b=M(e.head),C=c&&(b==="rm"&&ul(g)||b==="xargs"&&Lf(g)||h?.rmOptions===!0),E=c&&(C||h?.executedSource===!0||h===null&&Df(g,b)),k=n.analyzeChild(g,{...yn(e,r),worktreeMode:l||c||m?!1:n.worktreeMode,dynamicInput:c||m,dynamicRmInput:C,dynamicSourceInput:y!==null||E,shellDynamicMatch:p,dynamicSourceMatch:p,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",to)});if(E){let I=_(p,n.policy);if(I)return I}return k??y??At(g,n.policy?.rules??[])})}function Mf(e,t,n,r,o,i,s){if(r.jobs.length>0)return qe(r.jobs,(c)=>o.analyzeNested(zf(e,t?c.map(Di):c,o.budget),s));let a=Xr(e);if(a?.[0]&&M(a[0])==="rm"&&Pt(a)){let c=Wf(o);if(c)return c}return(a?o.analyzeChild(a,{...yn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",no),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",to)}):null)??o.analyzeNested(e,s)}function Df(e,t){if(z(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(te.has(t))return Mw(e);if(t==="git")return Iw(e);if(t==="find")return!0;if(je.has(t))return Pf(e,ww,Yr);if(Je(t))return Pf(e,Rw,ni);return!1}function ul(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(z))return t===-1;return n.some((o)=>z(o)&&(o.startsWith("-")||$f(o)))}function Iw(e){if(Ow(e))return!0;let t=Be(e);if(t.subcommand===null||z(t.subcommand))return!0;if(!Yn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(z))return n===-1;return r.some(z)}function Ow(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(z(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(z(n))return!0;continue}if(z(n))return!0}return!1}function Mw(e){if(kt(e))return!1;let t=at(e);if(t!==null)return z(t);let n=Ot(ee(e));if(n.kind==="literal")return z(n.source);if(n.kind==="dynamic")return!0;return!e.some(z)}function Pf(e,t,n){let r=n(e);if(r.some((o)=>z(o.value)))return!0;if(!e.some(z))return n([...e,Af]).some((o)=>o.value===Af);return Ti(r,t,(o)=>n(e.map((i)=>Ff(i,[o]))))}function Nf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(z))return Zt(n);return qe(o,(i)=>At([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Dw(e,t){let n={customResult:null,executedSource:!e.some(z),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(z))return;for(let a of st(i,t))n.executedSource||=Df(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&ul(a.tokens)||a.head==="xargs"&&Lf(a.tokens),n.customResult??=Nf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=z(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(ft(a)){i=[],n.executedSource||=z(a);continue}let l=Tt(a);if(l>0){o=l,n.executedSource||=z(a);continue}n.executedSource||=z(a)}return s(),n}function Lf(e){let t=e.slice(Sn(e).childStart);return M(t[0]??"")==="rm"&&ul(t)}function Fi(e,t){return(n)=>_(v(e,t),n.policy)}var Zt=Fi("parallel.shell-dynamic",no),Nw=Fi("parallel.command-stream-dynamic",Ew),Jn=Fi("parallel.command-stream-dynamic",xw),Wf=Fi("parallel.rm-recursive-force-dynamic",to);function cl(e,t,n){return _(Ii(ee(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gn(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Un(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Gf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Ff(e,t){return e.replace(Gi,(n)=>Hf(n,t))}function Wi(e,t,n,r=Gi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Hf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function zf(e,t,n){return Wi([e],t,n)[0]??""}function kf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Hf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function z(e){return e.search(Gi)!==-1}function Bf(e){if(dl(e))return!0;for(let t of e.matchAll(Gi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function dl(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function $f(e){return/^\{[^{}\s]*\}$/.test(e)}function Lw(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Tf.isAbsolute(e))return null;try{return $t(t??e,e,n)}catch{return null}}function Uf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,u=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=$a(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=$a(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=p.indexOf("="),b=y===-1?p:p.slice(0,y),C=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){c=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){u||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){u=!0,t+=2;continue}if(b==="--replace"||p.startsWith("-i")&&p.length>2){let E=b==="--replace"?C:p.slice(2);u||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Aw.has(b)){u=!0,t+=C===void 0?2:1;continue}if(p==="-q"||p==="--quote"){s=!0,t++;continue}if(p==="--pipe"||p==="--pipepart"){a=!0,t++;continue}if(b==="--env"){u=!0,t+=C===void 0?2:1;continue}if(_f.has(b)||p.startsWith("-S")&&p.length>2){i=!0,t+=_f.has(p)?2:1;continue}if(Pw.has(b)){u=!0;let E=C??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=C===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&C!==void 0){t++;continue}if(_w.has(p)){if(h===void 0||h===":::"||h==="--"){u=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}u||=n.some(c?dl:Bf);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){m.push(p),p=[];continue}if(y!==void 0)p.push(y)}m.push(p)}u||=m.length>1;let d=Ww(m),f=n.some(z),g=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:f,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:g,unsupported:u,workdir:l,dryRun:c}}function Ww(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>J.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>J.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function jf(e){return Uf(e).childStart}var Gw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",zi="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function fl(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ml(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Kf(e,t,n,r,o=!1,i){let a=(wr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ae(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",Gw):null;return _(a,i)??qf(e,t,n,o,i)}function qf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>fl(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=Gn(e,t),l=zw(a);if(ae(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return _(v("shell.dynamic-structure",zi),o);if(_(ki(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&R(m)==="--");if(ae(o,"shell.dynamic-structure",r)&&c&&Yn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return _(v("shell.dynamic-structure",zi),o);return null}if(s==="find")return ae(o,"shell.dynamic-structure",r)&&Hw(t)?_(v("shell.dynamic-structure",zi),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&R(c)==="--"),l=Pt(t.map(R));return ae(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?_(v("shell.dynamic-structure",zi),o):null}if(s==="xargs")return Vf(e,t.slice(Sn(t.map(R)).childStart),"xargs",n,r,o);if(s==="parallel")return Vf(e,t.slice(jf(t.map(R))),"parallel",n,r,o);return null}function Vf(e,t,n,r,o,i){if(t.length===0)return null;let s=Fw(t,r);if(wr(e,s)){let l=_(v(`${n}.shell-dynamic`,n==="xargs"?ll:no),i);if(l)return l}let a=qf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>fl(l)&&ml(l)))return _(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?al:to),i);return null}function Fw(e,t){let n=mn(e,t),r=n.rewritten?ee(n.words.map(R)):n.words,o=r[0];return o&&R(o)==="busybox"?r.slice(1):r}function zw(e){let t=1;while(t<e.length){let n=e[t],r=n?R(n):"";if(Le.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Hw(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=fl(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ml(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ml(s)))return!0;continue}if(t=!0,a)return!0;let l=Tt(s.text);if(l>0){n=l;continue}if(ft(s.text))o=!0,r=!0}return!1}function pl(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Jo(t[n.tokenIndex],n.value)})}var Xf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ii(e.words,Zf(e))},{heads:new Set(["git"]),analyze:(e)=>ki(e.words,gl(e))},{heads:new Set(["find"]),analyze:(e)=>Tm(e.words,{...Zf(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>yf(e.words,{...Yf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Qn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Of(e.words,{...Yf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Qn(e.options.analyzeNested(t,n))})}];function Yf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Qn(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function Zf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gn(e.envAssignments,e.options.environment),trustedTmpdirValue:Un(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function gl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function ep(e){return Xf.find((t)=>t.heads.has(e))?.analyze}function tr(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((P)=>o==="posix"?R(P):P.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=si(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=mn(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let x=[...g,...i(f.words)].join(" "),P=Ve(x);if(P)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:P.reason}),xe(P);if(n.strict)return Ie(r);let B=ai(g,i(f.words));if(B){n.budget.charge("derivedTokens",B.length);let ue=n.analyzeNested(B.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(ue)return ue}}let p=f.rewritten?ee(i(f.words)):Gn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-p.length),output:h})}let b=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),C=h[0];if(!C)return null;if(hn(C))throw new N("wrapperPeelIterations");let E=M(C),k=f.cwd===null?void 0:f.cwd??u,I=f.cwd===null?void 0:m,O=f.cwd===void 0?n.effectiveCwd:f.cwd,H=s?s.allowTmpdirVar:!Ur(b,n.environment),Se=Kf(o,f.words,n.environment,t===0,n.strict,n.policy);if(Se)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Se.reason}),xe(Se);let ht=xi(h,n.policy);if(ht){for(let x of[ht.childIndex,...ht.alternativeChildIndices]){Jf(y.wrapperNormalizationBudget);let P=p.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ht.wrapper,output:i(P)});let B=tr(P,t,{...y,effectiveCwd:O,envAssignments:b});if(B)return B}return null}let Me=l?void 0:E==="eval"?Oi(p):E==="trap"&&!a?uf(p):void 0;if(a&&s&&E==="eval"){if(Me?.kind==="dynamic")return er(s,n.policy);if(Me?.kind==="literal"){let x=n.analyzeNested(Me.source,{effectiveCwd:O,envAssignments:b});if(x)return x}return nr(s,n.policy)}if(Me?.kind==="dynamic"&&(n.strict||!n.commandView||!il(n.commandView)))return Ie(r);if(Me?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:Me.source,depth:t+1});let x=n.analyzeNested(Me.source,{effectiveCwd:O,envAssignments:b,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?te.has(E):np(C,E)){if(kt(h))return null;if(a&&s){let x=at(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let B=er(s,n.policy);if(B)return B}if(eo(x)){let B=er(s,n.policy);if(B)return B}return n.analyzeNested(x,{effectiveCwd:O,envAssignments:b})}let P=Ot(p);if(P.kind==="dynamic")return er(s,n.policy);if(P.kind==="literal")return s.dynamicSourceInput?er(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?er(s,n.policy):null}if(l){let x=at(h),P=x?n.analyzeNested(x,{effectiveCwd:O,envAssignments:b}):Ot(p).kind==="dynamic"?Ie(r):null;if(P)return P}if(s===void 0){let x=jw(h,b,O,n,r,t);if(x)return x;let P=at(h);if(P){let An=Mi(p,P);if(An.kind==="dynamic")return Ie(r);let ts=An.kind==="literal"?An.source:df(p,P),Ul=Vw(ts);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:Ul}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Ul,depth:t+1});let jl=n.analyzeNested(ts,{effectiveCwd:O,envAssignments:b});if(jl)return jl;return eo(ts)?Ie(r):null}let B=Ot(p,n.strict?void 0:n.shellAssignments);if(B.kind==="dynamic")return Ie(r);if(B.kind==="literal")return Hi(B.source,O,b,n,r,t);let ue=mf(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ue.kind==="dynamic")return Ie(r);if(ue.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ue.source,depth:t+1}),n.analyzeNested(ue.source,{effectiveCwd:O,envAssignments:b})}}if(!s&&(E==="source"||E===".")){let x=h[1]==="-p"?2:null;if(x!==null){let An=n.commandView?p[x]:void 0;if(!An)return null;if(An.provenance!=="literal")return Ie(r)}let P=x===null?1:3,B=h[P]==="--"?P+1:P,ue=n.commandView?p[B]:void 0;if(!ue)return null;if(ue.provenance==="literal")return Hi(ue.text,O,b,n,r,t);if(n.strict||!n.commandView||!il(n.commandView))return Ie(r)}if(je.has(E)&&!l){if(!s&&n.strict&&pl(Yr(h),p))return Ie(r);let x=vm(h,(B)=>Qn(n.analyzeNested(B,{effectiveCwd:O,envAssignments:b}))),P=_(x,n.policy);if(P)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:P.reason}),xe(P)}if(Je(E)&&!l){if(!s&&n.strict&&pl(ni(h),p))return Ie(r);let x=Rd(h);if(a&&s)return $w(E,x,O,b,n,s);if(x){let P=ae(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:x,paranoidBlocked:P}),P){let ue=_(v("interpreter.one-liner-paranoid",Nr),n.policy);if(ue)return xe(ue)}if(ba(E,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let B=n.analyzeNested(x,{effectiveCwd:O,envAssignments:b});if(B&&!tp(B,x))return B;if(Lr(x,void 0,!n.strict)){let ue=_(v("interpreter.dangerous-command",Hn),n.policy);if(ue)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:Hn}),xe(ue)}r=void 0}}if(E==="busybox"&&h.length>1)return Jf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),tr(p.slice(1),t,{...y,effectiveCwd:O,envAssignments:b});let V=s?null:_(_m(E,h),n.policy);if(V)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:V.reason}),xe(V);let G=r===y.trace?y:{...y,trace:r},ge={words:p,head:E,cwd:k,originalCwd:I,envAssignments:b,allowTmpdirVar:H,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:O,options:G,analyzeChildTokens:(x,P)=>a&&s?yl(x,t,G,{...s,cwd:P??void 0,effectiveCwd:P??void 0}):Qn(tr(ee(x),t+1,{...G,child:void 0,commandView:void 0,effectiveCwd:P,envAssignments:b}))??At(x,G.policy.rules),analyzeChild:(x,P)=>yl(x,t,G,P)},ie=s&&(E==="xargs"||E==="parallel")?void 0:ep(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:H});let se=r&&E==="git"?tf(ge.words,gl(ge)):void 0,De=Qf(se?se.match:ie?.(ge)??null,n.policy);if(r)Kw(ge,De,se?.relaxation??null);if(De)return xe(De);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(Pt(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?nr(s,n.policy):null)??Uw(s,n.policy)}let nn=!s&&ie===void 0&&!Po.has(E),cr=r&&nn?[]:void 0;if(nn)for(let x=1;x<h.length;x++){let P=h[x];if(!P)continue;cr?.push(P);let B=Qf(Bw(h,x,t,G,k,I,O,b),n.policy);if(B)return r?.recordSegment({type:"fallback-scan",tokensScanned:cr??[],embeddedCommandFound:M(P)}),xe(B)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:cr??[]}),l&&s&&!s.wrappedByTransparent)return null;let $e=At(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!$e,reason:$e?.reason}),$e)return xe($e);return a&&s?nr(s,n.policy):null}function yl(e,t,n,r){return Qn(tr(ee(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function Bw(e,t,n,r,o,i,s,a){for(let l of st(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(np(c,u)||ep(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=yl(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!Ur(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function $w(e,t,n,r,o,i){if(!t)return nr(i,o.policy);if(ae(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=_(v("interpreter.one-liner-paranoid",Nr),o.policy);if(a)return xe(a)}if(ba(e,t))return nr(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!tp(s,t))return s;if(Lr(t,void 0,!o.strict)){let a=_(v("interpreter.dangerous-command",Hn),o.policy);if(a)return xe(a)}return nr(i,o.policy)}function tp(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Si)||e.reason===Kn)&&!ko(t);return n||r}function er(e,t){let n=e.shellDynamicMatch?_(e.shellDynamicMatch,t):null;return n?xe(n):null}function nr(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?_(e.dynamicSourceMatch,t):null;return n?xe(n):null}function Uw(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?_(e.rmDynamicMatch,t):null;return n?xe(n):null}function jw(e,t,n,r,o,i){let s=km(e);if(s.argvSource?.kind==="absent")return Ie(o);if(s.argvSourceApplies&&s.argvSource){let l=Hi(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Hi(a,n,t,r,o,i,!0)}function Hi(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Ie(o);let a=Dr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Ie(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Vw(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Kw(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Jf(e){if(e.iterations>=J.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function xe(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function Ie(e){return e?.recordSegment({type:"error",message:Kr}),xe(qw())}function qw(){return{id:"analysis.dynamic-shell-source",reason:Kr,intent:"stop_and_explain"}}function np(e,t){return te.has(t)||e==="$SHELL"||e==="${SHELL}"||te.has(A(t))}function Qf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:_(e,t)}var Yw=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Zw=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Xw(e,t){let n=ip(e,t);if(n.length===0)return!1;let r=n[op(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Yw.test(e.join(" "))}function rp(e,t,n,r,o){if(e.dialect==="powershell"){let C=Jw(e.words,o);if(C.kind==="none")return;if(!t||C.kind==="unknown")return null;return hl(nR(C.target),t,n.paths)}let i=e.words.map(R),s=i.some((C)=>/^CDPATH\+?=/.test(C));if(!Xw(i,n))return s?null:void 0;if(!t)return null;let a=ip(i,n,t),l=op(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((C)=>C.length<=1||!C.startsWith("-")||C==="--");if((u===-1?c:c.slice(0,u)).some((C)=>!/^-[LP]+$/.test(C)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length>1)return null;let g=f[0],p=r.get("HOME")||n.home;if(g===void 0)return hl(p,t,n.paths);let h=e.words.find((C)=>C.provenance==="variable"&&C.text===g),y=e.words.find((C)=>C.text===g&&/^~(?:\/|$)/.test(C.raw)),b=h?pt(h,new Map([...r,["HOME",p]])):y?`${p}${g.slice(1)}`:g;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return hl(b,t,n.paths)}function hl(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=$t(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function Jw(e,t){let n=Qw(e[0])?1:0,r=e[n];if(!eR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Zw.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return tR(e.slice(n+1),t)}function Qw(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function eR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function tR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function nR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function op(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function ip(e,t,n){let r=rR(e);return Ut([...r],t,n)}function rR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var oR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",vn="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function xl(e,t,n,r){if(t>=J.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:ut}),{reason:ut,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Qe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:ut}),{reason:ut,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return El(e,n);let u=`${Si}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return dp(e,n),{reason:Kn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return dp(e,n),{reason:Kn,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return El(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Bm(n.environment.env,n.envAssignments);return Ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=iR(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],b=a==="&&"?p?.failure??[]:[],C={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(Xt(d)&&!Xt(a))l=C;let E=Xt(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Xt(a)?l??C:C,k=En(E.connector)||En(d);if(u.kind==="function"){let V=h.flatMap((ge)=>{let ie=xn(ge);return ie.functionDefinitions.set(u.name,u.body),Cl(ge,[ie],f,d==="&",En(d))}),G=bl(V,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=G.states,s=G.conditionalStates,a=void 0;continue}if(u.kind==="group"){let V=[],G=[];for(let ie of h){let se=Ui(u.body,t,n,r,[xn(ie)]);if(se.result)return se;if(V.push(...Cl(ie,se.states,f,d==="&",En(d))),k)G.push(ie,...f?se.states.map((De)=>Bi(ie,De)):se.states)}let ge=bl(V,G,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=ge.states,s=ge.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let I=PR(e.nodes[c-1]),O=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),H=e.nodes[c-2],Se=Xt(a)&&H?.kind==="command"?cf(H)??aR(H):void 0,ht=[],Me=[];for(let V of h){let G=lR(u,t,n,r,[xn(V)]);if(G.result)return{result:G.result,states:i};let ge=e.dialect==="powershell"?G.states:G.states.map((ie)=>Bi(V,ie));for(let ie of ge){let se=xn(ie),De=dR(u,t,n.trace?{...n,trace:mp(n.trace,O)}:n,r,se,Xt(a),Se);if(De)return{result:De,states:i};let Lt=NR(u,se.functionDefinitions);if(Lt)n.budget.charge("derivedTokens",ji(Lt));let nn=Lt?t+1>=J.recursionDepth.cap?Sl(u.displayText,n,[se]):Ui(Lt,t+1,n,r,[se]):{result:null,states:MR(u,se).flatMap(($e)=>kR(u,ie,$e,I))};if(nn.result)return nn;ht.push(...Cl(V,nn.states,f,d==="&",En(d)));let cr=typeof se.effectiveCwd==="string"&&se.effectiveCwd!==ie.effectiveCwd&&u.redirections.every(($e)=>["<",">",">>",">|"].includes($e.operator)&&$e.target?.text==="/dev/null");if(k&&(I||!cr))Me.push(V),Me.push(...nn.states.map(($e)=>f?Bi(V,$e):$e))}}let tn=bl(ht,Me,E.skippedSuccessStates,E.skippedFailureStates,E.connector,d);i=tn.states,s=tn.conditionalStates,a=void 0}return{result:null,states:i}}function iR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Xt(r)||Xt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&sR(e,t)}function Cl(e,t,n,r,o){let i=n?t.map((a)=>Bi(e,a)):[...t],s=o?i.flatMap((a)=>rr(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function Bi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function sR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(cR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Xt(e){return e==="|"||e==="|&"}function aR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function bl(e,t,n,r,o,i){let s={success:$i([...n,...e]),failure:$i([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?$i([...s.success,...s.failure]):s.success,conditionalStates:a}}function mp(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function lR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=uR(e);if(s){if(t+1>=J.recursionDepth.cap)return Sl(s,n,o);let a=Qe(s,"powershell");if(a.status==="limited")return Sl(s,n,o);if(a.status!=="complete")return sp(i,n,r,o);n.budget.charge("derivedTokens",ji(a)),i.push({program:a,depth:t+1})}}return sp(i,n,r,o)}function cR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function sp(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Ui(i.program,i.depth,t,n,[xn(a)]);if(l.result)return l;s.push(...l.states)}o=$i(s)}return{result:null,states:o}}function uR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ji(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ji(o),0):n.kind==="group"||n.kind==="function"?ji(n.body):0),0)}function Sl(e,t,n){return t.trace?.recordSegment({type:"error",message:ut}),{result:{reason:ut,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function dR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:hR(n.environment.paths,o.createdDirectories,n.budget)}},l=ER(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};fp(e,o,"before-consumer",a.environment.paths,a.budget);let c=Gn(e.dialect,e.words),u=c.map(R),m=e.displayText,d=zm(c,o.shellGitContextState),f=Um(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=_(fm(e,i,WR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return LR(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!wr(e.dialect,e.words)){let h=_(Ve(u[0]),a.policy),y=h!==null&&!a.strict&&Ed(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let b=ap(e,l,o,f,s,a);if(b)return b;return Qa(d,o.shellGitContextState),null}let g=tr(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let b=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,C=xl(h,t+1,{...a,effectiveCwd:b,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?mp(a.trace,a.trace.currentSegmentIndex,!0):void 0});return C?{reason:C.reason,ruleId:C.ruleId,intent:C.intent}:null}});if(g)return{...g,segment:m};let p=ap(e,l,o,f,s,a);if(p)return p;return Qa(d,o.shellGitContextState),null}function ap(e,t,n,r,o,i){let s=xR(e,t,n,r??new Map,i);if(s)return s;return fp(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),pR(e,t,n,i.environment.paths,i.budget),yR(e,n,i.environment.paths,i.budget),_R(e,n,o,i.environment,i.trace),null}var mR=new Set([">>","<>"]);function fp(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?fR(s):mR.has(s.operator)))continue;lp(s.target,t,r,o)}if(n!=="before-consumer"||!pe(e.words[0],"tee"))return;let i=gp(e.words.slice(1));if(!i)return;for(let s of i.operands)lp(s,t,r,o)}function fR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function lp(e,t,n,r){let o=e?.provenance==="literal"?Dr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function pR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of gR(e,n.shellGitContextState.shellAssignments)){let a=Dr(s,n.effectiveCwd,r,o);if(!a||!wd(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=J.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function gR(e,t){let n=vl(SR(e.redirections)?.target,t),r=n===void 0?[]:[n];if(pe(e.words[0],"cat"))return bR(e.words)?r:[];if(!pe(e.words[0],"tee"))return[];let o=gp(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>vl(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function vl(e,t){if(vR(e))return e.text;return(e&&pt(e,t))??void 0}function hR(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=T(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${Ye.sep}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?T(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function yR(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!pe(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>vl(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!Ye.isAbsolute(c)&&!l)continue;let u=T(Ye.resolve(l??"",c),n,r);if(a?CR(u,n):n.isDirectory(Ye.dirname(u))&&pp(u,n))t.createdDirectories.add(u)}}function CR(e,t){let n=Ye.parse(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>Ye.join(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||pp(o(i),t)}function pp(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function bR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function SR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function gp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&pt(s,t)===null)return;if(r&&pe(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function vR(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function pe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function wl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function ER(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return vn;let r=n[0];if(!r?.heredoc)return vn;let o=/\$\(|`/.test(r.heredoc.body);if(!wl(r.heredoc)&&(!t||o))return oR;if(r.fd!==void 0&&r.fd!==0)return vn;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return vn;let i=e.redirections.some((l)=>l!==r&&cp(l.target));if(pe(e.words[0],"cat"))return i?vn:void 0;if(pe(e.words[0],"tee"))return i||e.words.slice(1).some(cp)?vn:void 0;let s=e.words[0],a=e.words[1];if(pe(s,"git")&&(pe(a,"apply")||pe(a,"commit")))return;if(pe(s,"gh")&&(pe(a,"pr")||pe(a,"issue"))&&pe(e.words[2],"create"))return;return vn}function cp(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function xR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(RR(e,i,n,r,o))return null;let a=wR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=El(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function wR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!wl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=pe(e.words[0],"uv")&&pe(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Je(i.text))return;let s=o.findIndex((m)=>pe(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=ae(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=_(v("interpreter.one-liner-paranoid",Nr),n.policy);if(m)return m}if(!Lr(l,void 0,!n.strict))return null;let u=_(v("interpreter.dangerous-command",Hn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function RR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!wl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=mn(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(R),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!te.has(l)&&!te.has(A(l)))return!1;return kt(a)}function _R(e,t,n,r,o){let i=rp(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(R).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var AR=new Set(["fi","done","esac"]);function PR(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function kR(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&AR.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let d=xn(n);return d.effectiveCwd=m,d})}function TR(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var IR=/^[A-Za-z_][A-Za-z0-9_]*$/,OR=8;function MR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!IR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=OR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=xn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function xn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:$m(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function $i(e){let t=[];for(let n of e){if(!t.some((r)=>DR(r,n)))t.push(n);if(t.length>J.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function DR(e,t){return e.effectiveCwd===t.effectiveCwd&&TR(e.compoundBodies,t.compoundBodies)&&rr(e.shellGitContextState.env,t.shellGitContextState.env)&&rr(e.literalHeredocFiles,t.literalHeredocFiles)&&rr(e.functionDefinitions,t.functionDefinitions)&&rr(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&rr(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&up(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&up(e.createdDirectories,t.createdDirectories)}function up(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function rr(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function NR(e,t){let n=Rr(e);return n===void 0?void 0:t.get(n)}function LR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function WR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function El(e,t){let n=_(Ve(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function dp(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Kn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var GR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function hp(e,t,n,r){let o=xl(e,0,{...t,...zu(t),budget:t.budget??he(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function yp(e,t,n){try{return{decision:e()}}catch(r){let o=FR(r,t,n);if(!o)throw r;return o}}function FR(e,t,n){if(!(e instanceof N)||!GR.has(e.kind))return null;let r=J[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var zR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),_l=new Set(["cc-safety-net","ccsn"]),HR=new Set(["bunx","npx","pnpx"]),BR=new Set(["pnpm","yarn"]),$R=new Set(["npm","pnpm","yarn"]),UR=new Set(["bun","node"]);function Ki(e,t,n={}){if(_l.has(e))return 0;if(HR.has(e)){if(n.broad)return Rl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Vi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&$R.has(e)&&n.broad&&t[r]==="exec"){let o=Rl(t.slice(r+1));return o===null?null:r+1+o}if(BR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Vi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Rl(t.slice(r+1));return o===null?null:r+1+o}if(UR.has(e)){let o=n.broad&&r!==-1?r:0;if(Cp(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Cp(t[o+1]))return o+2}return null}function Rl(e){let t=e.findIndex((r)=>Vi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Vi(r))break;n++}return n}function Vi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return _l.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return _l.has(e.slice(0,t))}function Cp(e){let t=e?.replaceAll("\\","/");return[...zR].some((n)=>t===n||t?.endsWith(`/${n}`))}var bp="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Sp(e,t,n){let r=ke(e,"input-candidate");if(!r)return null;let o=$n(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>jR(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function jR(e,t){let n=Ut([...e],t),r=n.slice(1),o=Ki(A(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}var ro=require("node:path");var wp="This path contains the protected policy config and you must not modify or delete it.",VR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Rp(e,t,n){let r=JR(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return vp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ke(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Ep(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Ep(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return vp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||po(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function vp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>oo(a,n,r,o,i));return s?{target:s}:null}function Ep(e,t,n,r,o){let i=$n(e,t,r,o,{findSegmentTarget:(s,a)=>KR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>oo(s,a.cwd,n,r,o),findMalformedTarget:(s)=>XR(s,t,n,r,o)?.target??null});return i?{target:i}:null}function KR(e,t,n,r,o){if(Br(e))return null;let i=jt([...e],r),s=A(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&qR(a)){let l=YR(a).find((c)=>xp(Pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(_i(i,1)||ja(i,r)){let c=(Zr(ee(i))??ee(["."])).find((u)=>{let m=Pe(u.text,t.variables);return oo(m,t.cwd,n,r,o)||xp(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=fi(a).sources.find((c)=>QR(Pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(ZR(i,s))return null;for(let l of[...e,...i])for(let c of _p(l))if(oo(Pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function qR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function YR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function ZR(e,t){if(!VR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function XR(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of _p(i))if(oo(s,t,n,r,o))return{target:s};return null}function _p(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function JR(e,t,n){let r=(a)=>io(ye(a,e.executionCwd,t,n)),o=r(an(t)),i=[r(On(e.executionCwd)),r(On(e.configCwd))],s=new Set(i.map((a)=>ro.dirname(a)));for(let a=ro.dirname(o);;a=ro.dirname(a))if(s.add(a),ro.dirname(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function oo(e,t,n,r,o){let i=Jl(e,t,r,o,(s)=>io(s)===_o);return i!==null&&n.files.has(io(i))}function xp(e,t,n,r,o){return n.directoriesAndAncestors.has(io(ye(e,t,r,o)))}function QR(e,t,n,r,o){let i=io(ye(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function io(e){return process.platform==="win32"?e.toLowerCase():e}var we=require("node:path"),Gp=require("node:url");var Fp="Access to a sensitive path is not allowed.",zp=new Set(["echo","printf"]),e_=new Set(["find"]),t_=new Set(["!","do","elif","else","if","then","until","while"]),n_=new Set(["-exec","-execdir"]),r_=new Set([";","+"]),o_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),i_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Hp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),s_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),a_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Bp=new Set(["-c","-e","-r","-E","--eval","--exec"]),l_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),c_=new Set(["grep","rg"]),u_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),d_=new Set(["commit","merge","notes","stash","tag"]),m_=new Set(["-m","--message"]),f_=new Set(["--grep"]),Ap=new Set(["jq","gojq","jaq"]),Pp="f",kp="file",p_="files",g_=new Set(["e","f"]),h_=new Set(["regexp","file"]),y_=new Set(["e","f","A","B","C","m"]),C_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Al="__CC_SAFETY_NET_PIPE_INPUT__",kl=/[\w./~@+-]*[./~][\w./~@+-]*/g,b_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,S_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,v_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Tp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Ip=/\b(?:system|exec|spawn|popen)\s*$/,E_=/\b(?:eval|exec)\s*\(/g,x_=/\b(?:eval|exec)\s*$/,w_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Op(e,t,n,r,o,i){for(let s of e){let a=s.target;if(SA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=CA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(Xp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!Yi(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Yi(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&vA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function $p(e,t,n,r,o={}){let i=Mp(e,n,r),s=Op(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Op(i,t,e.invocation.context.configCwd,n,r,new Set(Mp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&R_(e,n)?null:a}function R_(e,t){let n=ke(e,"input-candidate")??ke(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of mi(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(_t(s.text,t))}let o=Dt(r);if(o.length===0)return!1;let i=ct(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Il(i,o.slice(1))}function Il(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>o_.has(n))}function Mp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ke(e,"input-candidate");return[...s?ir(s.shell,e.store,r,t,o,n,__(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function __(e){return e.program.dialect==="powershell"}function ir(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new rt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...eA(_t(e.source,r),t,n,r,o,i)],l=(c)=>_t(W_(c,s),r);return di(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...Zi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...P_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Up(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>k_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Pa;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function Ol(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new rt;return s.status==="complete"?ir(s,t,n,r,o,i):null}function Zi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(Ap.has(ct(Dt(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Zi(p,t,n,r,o,i)]}let l=L_(e).map(a),c=Dt(e);if(c.length===0)return l;let u=c[0]??"",m=ct(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!t_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&Il(ct(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=A_(u,m,d);if(g)return[...l,...g.map(a)];if(zp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...jp(e).map(a)]:l;if(m==="eval")return[...l,...Ol(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:gt(m,p)).map(a)];if(m==="git")return[...l,...F_(d).map(a)];if(m==="gh")return[...l,...Tl(m,d,u_).map(a)];if(Ap.has(m))return[...l,...G_(d).map(a)];if(c_.has(m))return[...l,...lA(d).map(a)];if(e_.has(m))return[...l,...H_(d,t,n,r,o,i).map(a)];if(je.has(m))return[...l,...d.flatMap((p)=>gt("awk",p)).map(a),...d.flatMap((p)=>$_(p,t,n,r,o,i)),...d.flatMap(U_).map(a)];if(m==="curl")return[...l,...d.filter((p,h)=>Kp(p)===null&&Vp(d[h-1])===null).flatMap((p)=>gt(m,p)).map(a),...z_(d).map(a)];if($r(m)){let p=Hr.has(m)?We([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new rt;if(h.status==="complete")return[...l,...ir(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...B_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>gt(m,p)).map(a)]}function A_(e,t,n){let r=Ki(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function P_(e,t,n,r,o,i,s){if(M_(t,n,r,o,i,s)){let a=Dt(e),l=Il(ct(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...jp(e),...l].map((c)=>({target:c,cwd:i}))}return Up(t,T_(e),n,r,o,i,s,()=>[])}function k_(e,t,n,r,o,i,s){let a=Dt(e);if(!$r(ct(a[0]??"").toLowerCase()))return[];return Ol(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Up(e,t,n,r,o,i,s,a){let l=D_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Hr.has(l)?ir(n.getShellSyntax(c),n,r,o,i,s):qi(l,c,n,r,o,i,s))}function jp(e){let t=Dt(e);if(t.length===0)return[];let n=ct(t[0]??"").toLowerCase();if(!zp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ml(r.replaceAll("%%","%"))];return t.slice(1)}function T_(e){let t=Dt(e);if(t.length===0)return[];let n=ct(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return I_(r);return[]}function I_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ml(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>O_(t,r.slice(i*n,(i+1)*n)))}function O_(e,t){let n=0;return Ml(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ml(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function M_(e,t,n,r,o,i){let s=Dt(e);if(s.length===0||ct(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Sn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Al]:l.map((m)=>m.split(c).join(Al));return Zi(u,t,n,r,o,i).some((m)=>m.target.includes(Al))}function D_(e){let t=Dt(e);if(t.length===0)return null;let n=ct(t[0]??"").toLowerCase();if(!$r(n))return null;return N_(n,t.slice(1))?n:null}function N_(e,t){let n=Dl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Bp.has(o)||qp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(w_.get(n)?.has(o))r++;continue}return!1}return!0}function Dl(e){return/^python\d/.test(e)?"python":e}function L_(e){let t=[];for(let n of e){if(Zp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Dp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function W_(e,t){if(!t||!Dp.test(e))return e;return`~${e.replace(Dp,"").replace(/\\/g,"/")}`}function gt(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function G_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>gt("jq",i))}return e.flatMap((r,o)=>o===t?[]:gt("jq",r))}function F_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...d_.has(r)?Tl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),m_):Tl("git",e.slice(n),f_)];if(t.push(...gt("git",r)),!Le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:gt("git",o)),n++}return t}function Tl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>gt(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...gt(e,i))}return r}function z_(e){return e.flatMap((t,n)=>{let r=Kp(t);if(r!==null)return Np(r.flag,r.value);let o=Vp(e[n-1]);return o===null?[]:Np(o,t)})}function Np(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Pl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Pl(t.slice(n+1))}return t.startsWith("@")?Pl(t.slice(1)):[]}function Vp(e){if(e===void 0)return null;if(Hp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Kp(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Hp.has(r)?{flag:r,value:e.slice(n+1)}:null}function Pl(e){return e===""||e==="-"?[]:[e]}function H_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!n_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>r_.has(f)),m=u===-1?c:c.slice(0,u),d=Zi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!i_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function B_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Bp.has(c)||qp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...qi(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...qi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function qp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return l_.get(t[t.length-1]??"")?.has(Dl(e))??!1}function $_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ha(e)?.commands.flatMap((s)=>ir(t.getShellSyntax(s),t,n,r,o,i))??[]}function U_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function j_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Nl),...e.match(kl)??[]]}function qi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=K_(t,V_(e));if(l.kind==="unmaskable")return j_(t).map(a);let c=l.masked.match(Tp)!==null||l.literals.some((p)=>Ip.test(l.masked.slice(0,p.start))),u=l.masked.match(E_)!==null||l.literals.some((p)=>x_.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!Hr.has(e),d=m&&!(X_(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(Tp),(p)=>{let h=p.index+p[0].length;return{start:h,end:va(l.masked,h)}}):[],g=!m||f.some((p)=>Ea(l.masked,p.start))?l.literals:l.literals.filter((p)=>Ip.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>Nl(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(kl)??[]).map(a),...c?g.flatMap((p)=>Ol(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>qi(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(kl)??[]).map(a)]}function V_(e){let t=Dl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function K_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(S_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Z_(e,o))return{kind:"unmaskable"};let a=t==="python"?q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=Y_(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&v_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function q_(e,t){return b_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function Y_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Z_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function X_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(s_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>a_.has(i)))continue;if(o.length>1)return!0;if(J_(e,r)===".")return!0;if(Q_(e,r+n.length)==="(")return!0}return!1}function J_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Q_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function eA(e,t,n,r,o,i){return iA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...ir(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...tA(a,r)?nA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function tA(e,t){let n=mi(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||ct(_t(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=_t(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function nA(e,t){return mi(e).flatMap((n)=>n.kind==="word"?[_t(n.text,t)]:n.kind==="redirection"&&n.target?[_t(n.target,t)]:[]).flatMap(Nl)}function Nl(e){let t=oA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||rA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function rA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function oA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function iA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Cr(o,n))continue;if(Yp(e,r,n)){let i=sA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=aA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function sA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Cr(i,n))continue;if(Yp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function aA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Yp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function lA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===p_)o=!0;if(h_.has(m))r=!0;if(d!==void 0){if(m===kp)t.push(d);continue}if(C_.has(m)){let f=e[l+1];if(m===kp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(g_.has(h))r=!0;if(y_.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===Pp)t.push(f);continue}let g=e[l+1];if(d===Pp&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Dt(e){let t=e.findIndex((n)=>!Zp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Zp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var cA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),uA=".env.",dA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),mA=[".env.example.",".env.sample."];function fA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function pA(e){return e.length>0&&!/\s/.test(e)}function Yi(e,t,n,r){let o=Xp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Xp(e,t,n,r){try{return ao(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var gA=/[?&][^?&=/]+=/,hA=new Set(["node_modules","__pycache__"]),yA=[["vendor","bundle"],["vendor","cache"]];function CA(e,t,n,r,o){if(fA(e))return null;let i=Oe(e,t,r,o);if(!i)return null;let s=j(i.split("/").pop()??""),a=j(i),l=()=>pA(s)||Yi(e,t,r,o);if(dA.has(s)||mA.some((d)=>s.startsWith(d)))return null;let c=j(wA(e,t,r,o));for(let d of Ns){let f=`~/${d.suffixParts.join("/")}`;if((Wp(a,f)||Wp(c,f))&&Mt(d.id,n))return d.id}let u=bA(i,t,n,r,o);if(u)return u;if(cA.has(s))return null;for(let d of Ds)if(s===d.basename&&Mt(d.id,n))return d.id;if(s.startsWith(uA)&&Mt(Oo.id,n)&&l())return Oo.id;for(let d of Ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&Mt(d.id,n)&&l())return d.id}for(let d of Ws)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Mt(d.id,n))return d.id}if(EA(a))return null;if(!s.includes(".")&&Sr.pattern.test(s)&&Mt(Sr.id,n))return Sr.id;if(gA.test(e)&&!Yi(e,t,r,o))return null;let m=xA(s,n);if(m)return m;return null}function bA(e,t,n,r,o){return Mo.find((i)=>{if(!Mt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=j(e).split("/");return W(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||so(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Oe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||or(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=j(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=j(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(K(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?so(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Oe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||or(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||or(e,s,["credentials"])||or(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=j(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=j(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>so(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=le(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(K(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(j(e).split("/").at(-1)??"")||W(e,s,["config.json"])||(c?.trim()?so(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Oe(u,t,r,o),l))}case"secret.cli.pi":return W(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Oe("~",t,r,o);return[le(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||or(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(Oe("~",t,r,o),".config","amp")],l=j(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?so(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(K(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Oe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||j(e).split("/").at(-1)==="mcp-auth.json"&&wn(j(e),j(a))}case"secret.cli.cursor.config":{let s=j(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=j(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Oe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return W(e,Oe("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=j(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||W(e,Oe("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),Oe("~/.local/share",t,r,o)].some((s)=>W(e,le(s,"devin"),["credentials.toml"])||or(e,le(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),Oe("~/.config",t,r,o)].some((s)=>W(e,le(s,"devin"),["config.json"]));default:return!1}})?.id??null}var Lp=new WeakMap;function K(e,t,n,r,o){let i=Lp.get(o)??new Map;Lp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Oe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Jp(e,le(t,r)))}function or(e,t,n){return n.some((r)=>wn(j(e),j(le(t,r))))}function so(e,t,n,r,o){return Jp(e,Oe(t,n,r,o))}function Jp(e,t){return j(e)===j(t)}function le(e,...t){return lt([e,...t].filter(Boolean).join("/"))}function SA(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(ao(e,t,o,i));return n.some((a)=>wn(s,j(ao(a,r,o,i))))}function vA(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(ao(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?lt(T(Ne(a),o.paths,i)):"",c=j(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=j(u?lt(T(we.resolve(Ne(u)),o.paths,i)):l&&lt(T(`${l}/.cc-safety-net`,o.paths,i)));if(m&&wn(s,m))return!1;return n.some((d)=>{let f=Hs(d);if(f&&we.posix.basename(s)!==j(f.name))return!1;let g=j(ao(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return wn(s,g)&&!(f&&s===g)})}function EA(e){let t=e.split("/");return t.some((n)=>hA.has(n))||yA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function xA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Gs)if(r===o.extension&&Mt(o.id,t))return o.id;for(let o of Fs)if(o.pattern.test(r)&&Mt(o.id,t))return o.id;return null}function j(e){return e.toLowerCase()}function Mt(e,t){return!t?.disabledRules?.includes(e)}function Oe(e,t,n,r){let{home:o,normalized:i}=Ll(e,n,r);if(!i)return"";if(!o)return i;let s=Wl(i,o),a=we.isAbsolute(s)?s:lt(we.resolve(t,s)),l=lt(T(a,n.paths,r));if(!wn(l,o)){if(we.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Wp(e,t){return e===t||e.startsWith(`${t}/`)}function wA(e,t,n,r){let{home:o,normalized:i}=Ll(e,n,r);if(!i||!o)return"";let s=Wl(i,o),a=we.posix.normalize(we.isAbsolute(s)?s:lt(we.resolve(t,s))),l=lt(Ne(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&wn(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function ao(e,t,n,r){let{home:o,normalized:i}=Ll(e,n,r);if(!i)return"";let s=o?Wl(i,o):i;return lt(T(we.isAbsolute(s)?s:we.resolve(t,s),n.paths,r))}function Ll(e,t,n){let r=t.env.get("HOME")??t.home,o=r?lt(T(Ne(r),t.paths,n)):"",i=lt(Ne(RA(_t(e,t))));return{home:o,normalized:i}}function RA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Gp.fileURLToPath(e)}catch{return e}}function Wl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function _A(e){if(process.platform==="win32")return!0;return we.win32.parse(e).root.length>1}function lt(e){let t=e.trim(),n=(t.includes("\\")&&_A(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function wn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function ct(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Rn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var AA={findPolicyMutation:Rp,findGitMetadataMutation:Jd,resolveGitMetadata:kA,loadPolicySnapshot:Fu,findSensitiveTarget:$p,analyzeCommand:hp,getModes:ys},PA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Qp(e,t){let n={...AA,...t.dependencies},r=OA(e),o=lo(e)?e.command:r,i=Jt("policy-protection",o,()=>Zd(e)),s=ke(i,"input-candidate"),a=ke(i,"declared-command");if(lo(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:ut,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:pm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=he(),c=Jt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Jt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:wp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let m=Jt("policy-protection",o,()=>Sp(i,t.environment,l));if(m){let C=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:bp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:C,segment:m.target}}}}let d=Jt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ot,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let f=Jt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...TA(f)},y=g.secretProtection.enabled===!1?null:Jt("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:lo(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!lo(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Gl("command-validation",o),...h};let b=Jt("command-analysis",o,()=>yp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},IA(i),i.store),e.command,t.trace));if(b.decision){let C=!p.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===Kr&&!PA.test(b.decision.evidence?.segment??"")&&Ve(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function kA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function TA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function IA(e){return ke(e,"declared-command")?.program}function OA(e){try{return Wt(e.input)}catch(t){let n=lo(e)?e.command:void 0;throw new Rn("policy-protection",Gl("policy-protection",t instanceof ve?void 0:n,t),t)}}function Jt(e,t,n){try{return n()}catch(r){throw new Rn(e,Gl(e,r instanceof ve?void 0:t,r),r)}}function Gl(e,t,n){let r=n instanceof N||n instanceof rt;return{stage:e,decision:{kind:"deny",reason:r?rs:dr,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function lo(e){return e.route.kind==="command"}var Ji=require("node:fs"),ar=require("node:path");var ce=require("node:fs"),sr=require("node:path");function eg(e,t={}){return Ho(an(e,t),e.home).policy.audit.retention_days}var zl=86400000,MA=".last-prune",DA=/^\d{4}-\d{2}$/,NA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tg=(e)=>Math.floor(e/zl);function rg(e,t,n=()=>new Date){try{let r=n().getTime();if(!ce.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=sr.join(t,MA),i=ce.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tg(i)===tg(r))return;let s=r-eg(e)*zl,a=new Date(r).toISOString().slice(0,7);for(let l of Fl(t)){if(l.isDirectory()){LA(sr.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))WA(sr.join(t,l.name),s)}ce.writeFileSync(o,"",{mode:384}),ce.utimesSync(o,r/1000,r/1000)}catch{}}function LA(e,t,n){for(let r of Fl(e)){if(!r.isDirectory()||!DA.test(r.name))continue;let o=sr.join(e,r.name);for(let i of Fl(o)){if(!i.isFile())continue;let s=NA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+zl;if(!Number.isFinite(a)||a>=t)continue;og(sr.join(o,i.name))}if(r.name!==n)ng(o)}ng(e)}function WA(e,t){try{let n=ce.lstatSync(e);if(n.mtimeMs>=t)return;let r=ce.readFileSync(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(GA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ce.lstatSync(e).mtimeMs!==n.mtimeMs)return;og(e)}catch{}}function GA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Fl(e){try{return ce.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function og(e){try{ce.unlinkSync(e)}catch{}}function ng(e){try{ce.rmdirSync(e)}catch{}}var FA="2.6.0",zA=1e4,HA=2000,BA=256,$A=32768;function UA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function jA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Hl(e,t,n,r,o,i,s={}){let a=UA(t);if(!a)return;let l=KA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Xi(yt(n),s.failureStage?Number.POSITIVE_INFINITY:zA),m=Xi(yt(r),HA),d=s.toolName?Xi(yt(s.toolName),BA):void 0,f=i===null?void 0:Xi(yt(i),$A),g=ar.join(l,jA(f?.value??null),c.slice(0,7));Ji.mkdirSync(g,{recursive:!0,mode:448});let p=ar.join(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Cs)(),v:FA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Ji.appendFileSync(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),rg(e,l,s.now)}catch{}}function Xi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function VA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&ar.isAbsolute(n)?n:null}function KA(e){let t=VA(e);return t?ar.join(t,".cc-safety-net","logs"):null}function sg(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ig(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ig(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ig(e){return"command"in e?e.command??"":""}function ag(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Hl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lg(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Hl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function ug(e,t,n){try{let r=Qp(t,{environment:e,...n.guard});return cg(e,t,r,n),r}catch(r){if(!(r instanceof Rn))throw r;throw cg(e,t,r.evaluation,n,!(r.cause instanceof ve),{stage:r.stage,errorCode:qA(r.cause)}),r}}function cg(e,t,n,r,o=!0,i){ag(e,sg(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function qA(e){if(e instanceof N)return J[e.kind].errorCode;if(e instanceof ve)return"tool-input-limit";if(e instanceof rt)return"structural-shell-syntax-limit";return"unexpected-error"}var Nt=(e,t,n,r,o)=>hc(e.cwd,t,n,r,o.paths,process.cwd()),Qi=(e,t,n)=>(r,o,i,s,a)=>{let l=Nt(r,o,i,s,a);if(!l)return null;let c=r.tool_input;if(!t.has(i)||!c||!Object.hasOwn(c,e))return l;let u=c[e];if(n?.emptyMeansSessionCwd&&u==="")return l;if(typeof u!=="string"||u.trim()==="")return Ee(s,o,i),null;let m=n?.allowOutsideSessionCwd?ms(u,l.configCwd,a.paths):bt(u,[l.configCwd],a.paths);if(m)return{configCwd:l.configCwd,executionCwd:m};return Ue(s,o,i,{directory:"requested",problem:vt(u,l.configCwd,a.paths),cwd:u}),null};function YA(e,t){console.log(JSON.stringify(e(Kl(t))))}async function ZA(e){let t;try{t=(await gc(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Co(t,e,"Failed to parse hook input JSON.")}async function XA(e){let t=Ac(),n=await ZA(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){Ee(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=tP(n),s=(g,p)=>{lg(t,g,()=>e.getSessionId(n),{agent:r,shape:o,toolName:p,cwd:g.cwd??i}),e.outputDeny(g)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){Ee((g)=>s(g),eP(n));return}let l=a,c=(g)=>s(g,l),u;try{u=e.getToolInput(n,l,c,t)}catch(g){if(!(g instanceof ve))throw g;Ee(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=Wt(u.input)}catch(g){if(!(g instanceof ve))throw g;Ee(c,void 0,l);return}let f=Oc(l,u.input,u.route,m,d??null);try{let g=ug(t,f,{guard:{auditAllowed:Ic(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),p=os(g,{includeEvidence:!0,toolName:g.stage==="command-analysis"?void 0:l});if(p){if(p.unverifiedByStandardMode&&e.outputAsk&&e.canPromptPerson?.(n)){e.outputAsk(p);return}e.outputDeny(p);return}e.outputAllow?.()}catch(g){if(!(g instanceof Rn))throw g;JA(g,t.env);let p=os(g.evaluation,{includeEvidence:!0,toolName:g.evaluation.stage==="command-analysis"?void 0:l});if(p)e.outputDeny(p);return}}function JA(e,t){if(!Et(ne.debug,t))return;console.error(`CC Safety Net debug: ${QA(e.stage)}: ${Yl(e.cause)}`)}function QA(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function eP(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function tP(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function be(e){let t=(s)=>YA(e.createDenyOutput,s),n=e.createAskOutput,r=n?(s)=>console.log(JSON.stringify(n(ql(s)))):void 0,o=e.createAllowOutput,i=o?()=>console.log(JSON.stringify(o())):void 0;try{await XA({...e,outputDeny:t,outputAsk:r,outputAllow:i})}catch(s){console.error("CC Safety Net error:",s),t(Pn())}}var nP=new Map([["run_command","auto"]]),rP=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function dg(e){return Q(e,nP)}async function mg(){await be({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:aP(e.toolCall?.args,t),route:dg(t)}),getContext:oP,getSessionId:(e)=>e.conversationId})}function oP(e,t,n,r,o){let i=sP(e);if(!i[0])return Qt(r,t,n),null;let s=i.flatMap((u)=>{let m=St([u],o.paths);return m?[m]:[]});if(!s[0])return Qt(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;if(n!=="run_command"){let u;try{u=iP(t,n,s,o.paths)}catch(m){if(m instanceof ve)return Qt(r,void 0,n),null;if(!(m instanceof N))throw m;return Qt(r,t,n),null}if(!u)return Qt(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return Qt(r,t,n),null;let c=bt(l,s,o.paths);if(c){let u=fg(c,s);if(!u)return Qt(r,t,n),null;return{configCwd:u,executionCwd:c}}return Qt(r,t,n,{directory:"requested",problem:vt(l,s[0],o.paths),cwd:l}),null}function iP(e,t,n,r){let o=dg(t),i=[...go(e,rP),...o.kind==="patch"?ho(e):[]].filter(Bl.isAbsolute),s=he(),a=new Set(i.flatMap((l)=>{let c=fg(T(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function fg(e,t){return t.filter((n)=>gr(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function Qt(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0,i={command:typeof o==="string"?o:void 0,toolName:n};e(r?uo(r,i):Pn(i))}function sP(e){if(e.workspacePaths===void 0)return[process.cwd()];return Array.isArray(e.workspacePaths)?e.workspacePaths.filter((t)=>typeof t==="string"&&t.trim()!==""):[]}function aP(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var lP=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],es=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:10,runtime:{order:8,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:10,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:9,runtime:{order:7,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:9,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:11,runtime:{order:9,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:12,runtime:{order:10,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:12,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:13,runtime:{order:11,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:13,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:14,install:{order:14,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:15,install:{order:15,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:16,install:{order:16,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:lP}},{id:"devin",displayName:"Devin CLI",doctorOrder:7,runtime:{order:5,flags:["-dv","--devin"],description:"Run as Devin CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:7,flag:"--devin",artifactKind:"hook config",probeCommand:["devin","--version"]}},{id:"droid",displayName:"Factory Droid",doctorOrder:8,runtime:{order:6,flags:["-fd","--droid"],description:"Run as Factory Droid PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--droid",artifactKind:"hook config",probeCommand:["droid","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],c1=es.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),pg=es.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),u1=es.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),d1=Object.fromEntries(es.map((e)=>[e.id,e.displayName]));var _n=require("node:path");function gg(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!_n.isAbsolute(e))return"unknown";try{let n=he(),r=typeof e==="string"&&e?T(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||_n.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||_n.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||_n.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!_n.isAbsolute(l))return[];return gr(r,T(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("COPILOT_CLI")==="1")return"copilot-cli";if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var lr="PreToolUse",hg="BeforeTool",yg="pre_tool_call";async function en(e){await be({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:lr,permissionDecision:"deny",permissionDecisionReason:t}}),...e.canPromptPerson?{canPromptPerson:e.canPromptPerson,createAskOutput:(t)=>({hookSpecificOutput:{hookEventName:lr,permissionDecision:"ask",permissionDecisionReason:t}})}:{},isSupported:(t)=>t.hook_event_name===lr,getToolName:(t)=>t.tool_name,getToolInput:(t,n,r,o)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n,t.tool_input,o)}),getContext:e.getContext??Nt,getSessionId:(t)=>t.session_id})}var cP=new Map([["Bash","posix"],["PowerShell","powershell"],["Monitor","posix"]]);function uP(e,t,n){if(e==="Bash"&&n.env.get("COPILOT_CLI")==="1")return{kind:"command",shell:"auto"};return e==="Monitor"&&t?.command===void 0?Q(e,new Map):Q(e,cP)}async function Cg(){await en({agent:"claude-code",getAgent:(e,t)=>gg(e.transcript_path,t),canPromptPerson:(e)=>["default","acceptEdits","plan"].includes(e.permission_mode??""),getToolRoute:uP})}var dP=new Map([["Bash","auto"]]);async function bg(){await en({agent:"codex",getToolRoute:(e)=>Q(e,dP)})}var mP=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function fP(e){return Q(e,mP)}async function Sg(){await be({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{let r=fP(t);if(typeof e.toolArgs==="object"&&e.toolArgs!==null)return{ok:!0,input:e.toolArgs,route:r};if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};if(r.kind==="patch"&&e.toolArgs.trimStart().startsWith("*** Begin Patch"))return{ok:!0,input:e.toolArgs,route:r};let i=Co(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(i===void 0)return{ok:!1};return{ok:!0,input:i,route:r}},getContext:Nt,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var pP=new Map([["Shell","auto"]]);function gP(e){return Q(e,pP)}async function vg(){await be({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:gP(t)}),getContext:hP,getSessionId:(e)=>e.conversation_id})}function hP(e,t,n,r,o){let i=yP(e);if(!i[0])return Ee(r,t,n),null;let s=i.flatMap((d)=>{let f=St([d],o.paths);return f?[f]:[]});if(!s[0])return Ue(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;let a=CP(e.cwd),l=bt(a,s,o.paths);if(!l)return Ue(r,t,n,{directory:"session",problem:vt(a,s[0],o.paths),cwd:a}),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l};let c=t.working_directory;if(typeof c!=="string"||c.trim()==="")return Ee(r,t,n),null;let u=mr(c),m=bt(u,s,o.paths);if(!m)return Ue(r,t,n,{directory:"requested",problem:vt(u,s[0],o.paths),cwd:u}),null;return{configCwd:l,executionCwd:m}}function yP(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[mr(e.cwd)]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="").map((t)=>mr(t))}function CP(e){return typeof e==="string"&&e.trim()!==""?mr(e):"."}var bP=new Map([["exec","auto"]]);function SP(e,t){if(e!=="write_to_process"||typeof t!=="object"||t===null)return;let n=t.text_input;return typeof n==="string"&&n!==""?n:void 0}async function Eg(){await be({agent:"devin",createDenyOutput:(e)=>({decision:"block",reason:e}),isSupported:(e)=>e.hook_event_name===lr,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>{let n=SP(t,e.tool_input);if(n===void 0)return{ok:!0,input:e.tool_input,route:Q(t,bP)};return{ok:!0,input:{command:n},route:{kind:"command",shell:"auto"}}},getContext:(e,...t)=>Nt({},...t),getSessionId:(e)=>typeof e.session_id==="string"&&e.session_id!==""?e.session_id:void 0})}var vP=new Map([["Execute","auto"]]);async function xg(){await en({agent:"droid",getToolRoute:(e)=>Q(e,vP)})}var wg=new Map([["run_shell_command","auto"]]);function EP(e){return Q(e,wg)}async function Rg(){await be({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===hg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:EP(t)}),getContext:Qi("dir_path",wg,{emptyMeansSessionCwd:!0,allowOutsideSessionCwd:!0}),getSessionId:(e)=>e.session_id})}var xP=new Map([["run_terminal_command","auto"],["monitor","auto"]]);function wP(e){return Q(e,xP)}async function _g(){await be({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return Ee(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:wP(t)}},getContext:RP,getSessionId:(e)=>e.sessionId})}function RP(e,t,n,r,o){let i=_P(e);if(!i)return Ee(r,t,n),null;let s=St([i],o.paths);if(!s)return Ue(r,t,n,{directory:"session",problem:"unusable",cwd:i}),null;let a=AP(e.cwd),l=bt(a,[s],o.paths);if(!l)return Ue(r,t,n,{directory:"session",problem:vt(a,s,o.paths),cwd:a}),null;return{configCwd:l,executionCwd:l}}function _P(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?t:void 0}function AP(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Ag=require("node:path");var PP=new Map([["terminal","posix"]]);async function Pg(){await be({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===yg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Q(t,PP)}),getContext:kP,getSessionId:(e)=>e.session_id})}function kP(e,t,n,r,o){let i=Nt(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return Ee(r,t,n),null;let a=St([Ag.resolve(i.configCwd,s)],o.paths);if(!a)return Ue(r,t,n,{directory:"requested",problem:"unusable",cwd:s}),null;return{...i,executionCwd:a}}var kg=new Map([["Bash","posix"]]);function TP(e){return Q(e,kg)}async function Tg(){await en({agent:"kimi-code",getToolRoute:TP,getContext:Qi("cwd",kg)})}var IP={"antigravity-cli":mg,"claude-code":Cg,codex:bg,"copilot-cli":Sg,cursor:vg,devin:Eg,droid:xg,"gemini-cli":Rg,"grok-build":_g,"hermes-agent":Pg,"kimi-code":Tg},$l=pg.map((e)=>({...e,run:IP[e.id]}));function Ig(e){let t=co({label:"hook",booleans:Object.fromEntries($l.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=$l.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Og(e){return $l.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function OP(){let e=process.argv.slice(2),t=e[0],n=co({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=Ig(e.slice(1));if(i){await i.run();return}}let o=Og(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}OP().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});