cc-safety-net 2.6.0 → 2.6.2

package/dist/chunks/index-wwg1vy7s.js

@@ -1,47 +0,0 @@
-var ra="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Bn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_o="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var na={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Ro={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...na},processedCandidateBytes:{cap:4194304,...na},pathEnvironmentExpansion:{cap:64,...na},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Ro},trackedHeredocFiles:{cap:64,...Ro},controlFlowStates:{cap:64,...Ro},wrapperPeelIterations:{cap:20,...Ro},derivedCommandShape:Ro});class s extends Error{kind;name="AnalysisLimit";constructor(G){super(a[G].reason);this.kind=G}}function _n(){let G=new Map;return{counters:G,resolvedPaths:new Map,charge(U,j=1){let K=(G.get(U)??0)+j;if(G.set(U,K),K>a[U].cap)throw new s(U)}}}var Ng=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function J(G){return Pe(G.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Pe(G){return Ng.reduce((U,j)=>U.replace(j,"<redacted>"),G.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Be(G){return Uc(G).reduceRight((U,j)=>`${U.slice(0,j.valueStart)}<redacted>${U.slice(j.valueEnd)}`,G)}function R(G){return Pe(Be(G))}function nt(G){return Uc(G).map((U)=>G.slice(U.valueStart,U.valueEnd))}function ze(G){return/[A-Za-z_][A-Za-z0-9_]*=/.test(G)}function Uc(G){return[...G.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((U)=>{let j=G[U.index-1];if(U.index>0&&j&&!/[\s"'([{]/.test(j))return[];let K=U.index+U[0].length;if(K>=G.length)return[];return[{valueStart:K,valueEnd:Lg(G,K)}]})}function Lg(G,U){if(G.startsWith("$(",U))return Wg(G,U);let j=G[U];if(j==='"'||j==="'"){for(let re=U+1;re<G.length;re++){if(j==='"'&&G[re]==="\\"){re++;continue}if(G[re]===j)return re+1}return G.length}let K=U;while(K<G.length&&!/\s/.test(G[K]??""))K++;return K}function Wg(G,U){let j=0,K;for(let re=U;re<G.length;re++){let oe=G[re];if(K){if(K==='"'&&oe==="\\"){re++;continue}if(oe===K)K=void 0;continue}if(oe==='"'||oe==="'"){K=oe;continue}if(oe==="$"&&G[re+1]==="("){j++,re++;continue}if(oe!==")")continue;if(j--,j===0)return re+1}return G.length}var Gg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Fg(G){let U=G.maxLen??200,j=G.redact??((re)=>re),K=(re)=>re.length>U?`${re.slice(0,U)}...`:re;return[G.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${j(G.reason)}`,G.ruleId?`Rule: ${G.ruleId}`:void 0,G.toolName?`Tool: ${G.toolName}`:void 0,G.command?`Command: ${K(j(G.command))}`:void 0,G.segment&&G.segment!==G.command?`Segment: ${K(j(G.segment))}`:void 0,G.cwd?`Working directory: ${K(j(G.cwd))}`:void 0,G.configWarning?`Config warning: ${j(G.configWarning)}`:void 0,G.askUser?"Approve only if you expected this command.":Gg[G.intent??"manual_only"]].filter((re)=>re!==void 0).join(`
-
-`)}function Ce(G,U){if(G.decision.kind!=="deny")return;let j=U.includeEvidence?G.decision.evidence:void 0;return{reason:G.decision.reason,ruleId:G.decision.ruleId,intent:G.decision.intent,command:j?.command,segment:j?.segment,toolName:U.toolName,...G.configFallback?{configWarning:G.configFallback.reason}:{},...G.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function O(G={}){return{reason:_o,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:G.command,segment:G.segment??G.command,toolName:G.toolName}}var zg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function D(G,U={}){return{...zg[G.directory][G.problem],command:U.command,toolName:U.toolName,cwd:G.cwd}}function Y(G){return Fg({...G,redact:J})}function rt(G){return J(G instanceof Error?G.message:String(G))}import{lstatSync as Eh,realpathSync as xh,statSync as Rh}from"node:fs";import{homedir as _h,tmpdir as wh}from"node:os";import{statSync as Ch}from"node:fs";import{join as Sh}from"node:path";import{basename as Vc,dirname as Bg,isAbsolute as $g,join as Ug,normalize as Hg,resolve as Hc}from"node:path";var jg=256,vi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function bn(G,U=process.platform){if(U!=="win32")return G;return G.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ir(G,U=process.platform){if(U!=="win32")return!1;return(G[0]==="/"||G[0]==="\\")&&(G[1]==="/"||G[1]==="\\")}function aa(G,U){return oa(G,0,U)}function oa(G,U,j){let K="",re=0;while(re<G.length){if(G[re]!=="$"){K+=G[re],re++;continue}if(G[re+1]==="{"){let de=ia(G,re+2),Se=Vg(G,re,U);if(Se===null){if(vi.has(de))throw new s("pathEnvironmentExpansion");K+=G.slice(re);break}let we=G.slice(re,Se+1);K+=Kg(we,U,j),re=Se+1;continue}let oe=ia(G,re+1);if(!oe){K+="$",re++;continue}K+=sa(oe,j)??`$${oe}`,re+=oe.length+1}return K}function Vg(G,U,j){let K=1;for(let re=U+2;re<G.length;re++){if(G[re]==="\\"){re++;continue}if(G[re]==="$"&&G[re+1]==="{"){if(K++,j+K>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");re++;continue}if(G[re]!=="}")continue;if(K--,K===0)return re}return null}function Kg(G,U,j){let K=G.slice(2,-1),re=ia(K,0);if(!re)return G;let oe=K.slice(re.length);if(!oe)return sa(re,j)??G;let de=[":-",":+",":=",":?","-","+","=","?"].find((We)=>oe.startsWith(We));if(!de){if(vi.has(re))throw new s("pathEnvironmentExpansion");return G}if(!vi.has(re))return G;if(de.endsWith("="))throw new s("pathEnvironmentExpansion");let Se=sa(re,j),we=de.startsWith(":")?Se!==null&&Se!=="":Se!==null;if(de.endsWith("?")&&!we)throw new s("pathEnvironmentExpansion");if(de.endsWith("-")||de.endsWith("?"))return we?Se??"":oa(oe.slice(de.length),U+1,j);return we?oa(oe.slice(de.length),U+1,j):""}function ia(G,U){if(!/[A-Za-z_]/.test(G[U]??""))return"";let j=U+1;while(/[A-Za-z0-9_]/.test(G[j]??""))j++;return G.slice(U,j)}function sa(G,U){if(!vi.has(G))return null;if(G==="HOME")return U.env.get("HOME")??U.home;return U.env.get(G)??null}function Dt(G,U,j){if(!G)return G;let K=j.resolvedPaths.get(G);if(K!==void 0)return K;let re=[],oe=G;while(!0){Kc(j,oe);let de=U.realpath(oe);if(de!==null)return jc(j,G,de,re);let Se=Bg(oe);if(Se===oe||re.length>=jg)return jc(j,G,oe,re);re.push(Vc(oe)),oe=Se}}function jc(G,U,j,K){let re=K.length===0?j:Ug(j,...K.reverse());return G.resolvedPaths.set(U,re),re}function qg(G,U,j){let K=j.resolvedPaths.get(G);if(K!==void 0)return K;Kc(j,G);let re=U.realpath(G);if(re!==null)j.resolvedPaths.set(G,re);return re}function Kc(G,U){G.charge("realpathAttempts"),G.charge("processedCandidateBytes",Buffer.byteLength(U))}function sn(G,U,j,K){let re=Yc(G,U,j);if(!re)return"";return Dt(re,j.paths,K).replace(/\\/g,"/")}function qc(G,U,j,K,re){let oe=Yc(G,U,j);if(!oe)return null;if(re(Vc(oe)))return Dt(oe,j.paths,K).replace(/\\/g,"/");let de=qg(oe,j.paths,K);return de===null?null:de.replace(/\\/g,"/")}function Yc(G,U,j){let K=j.home,re=aa(G.trim(),j).replace(/\\/g,"/");if(!re)return"";let oe=re==="~"?K:re.startsWith("~/")?Hc(K,re.slice(2)):re,de=bn(oe);return Hg($g(de)?de:Hc(U,de))}import{spawnSync as Yg}from"node:child_process";import{existsSync as Po,lstatSync as Zg,readFileSync as Ao,realpathSync as jr,statSync as wo}from"node:fs";import{dirname as la,isAbsolute as ca,join as Vr,resolve as Ei}from"node:path";var Xg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jg=5000;function Xc(G,U=gh(),j=Jg){let K=Qg(G),re=K===null?null:eh(K);if(K===null||re===null)return null;let oe=mh(K,re,U,j);return oe===null?null:{recursiveSubmodules:oe}}function Qg(G){try{let U=jr(Ei(G));return wo(U).isDirectory()?U:null}catch{return null}}function eh(G){let U=fh(G);if(!U)return null;try{let j=Zg(U);if(j.isSymbolicLink()||!j.isFile())return null;let K=ua(U);if(!K?.commonDir)return null;if(!rh(K.gitDir,U))return null;return oh(K.gitDir,la(U))?{gitDir:K.gitDir,commonDir:K.commonDir}:null}catch{return null}}function ua(G){try{let U=th(G);if(!U)return null;let j=jr(ca(U)?U:Ei(la(G),U));if(!wo(j).isDirectory())return null;return{gitDir:j,commonDir:nh(j)}}catch{return null}}function th(G){let U=Ao(G,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!U.startsWith("gitdir:"))return null;return U.slice(7).trim()||null}function nh(G){try{let U=Ao(Vr(G,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!U)return null;let j=jr(ca(U)?U:Ei(G,U));return wo(j).isDirectory()?j:null}catch{return null}}function rh(G,U){let j=ih(G);return j===null?!1:Jc(G,j,U)}function oh(G,U){let j=sh(G);return j===null?!0:Jc(G,j,U)}function ih(G){let U=Vr(G,"gitdir");if(!Po(U))return null;let j=Ao(U,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return j===""?null:j}function sh(G){let U=Vr(G,"config.worktree");return Po(U)?lh(U):null}function Jc(G,U,j){try{return ah(ca(U)?U:Ei(G,U),j)}catch{return!1}}function ah(G,U){try{let j=wo(G),K=wo(U);if(j.ino!==0&&K.ino!==0&&j.dev===K.dev&&j.ino===K.ino)return!0}catch{}return Zc(jr.native(G))===Zc(jr.native(U))}function Zc(G){let U=G.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),j=U.length>1&&U.endsWith("/")?U.slice(0,-1):U;return process.platform==="win32"?j.toLowerCase():j}function lh(G){let U=Ao(G,"utf-8"),j=!1,K=null;for(let re of U.split(/\r?\n/)){let oe=re.trim();if(oe===""||oe.startsWith("#")||oe.startsWith(";"))continue;if(oe.startsWith("[")){j=/^\[core\]$/i.test(oe);continue}if(!j)continue;let de=oe.match(/^worktree\s*=\s*(.*)$/i);if(de)K=ch(de[1]??"")}return K}function ch(G){let U=G.trim();if(!U.startsWith('"')||!U.endsWith('"'))return U;return dh(U.slice(1,-1))}var uh={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function dh(G){return G.replace(/\\(.?)/gs,(U,j)=>j===""?U:uh[j]??U)}function fh(G){try{return da(jr(G))}catch{return null}}function da(G){let U=G;while(!0){let j=Vr(U,".git");if(Po(j))return j;let K=la(U);if(K===U)return null;U=K}}function mh(G,U,j,K){if(ph(U))return!0;if(j===null)return!0;let re=Yg(j,["config","--get","submodule.recurse"],{cwd:G,encoding:"utf8",env:hh(process.env),stdio:["ignore","pipe","ignore"],timeout:K});if(re.error!==void 0||re.status!==0&&re.status!==1)return null;return re.status===0&&Qc(re.stdout.trim())}function ph(G){return[Vr(G.commonDir,"config"),Vr(G.gitDir,"config.worktree")].filter((U)=>Po(U)).some((U)=>yh(U))}function gh(){return Xg.find((G)=>Po(G))??null}function To(G){return G==="GIT_CONFIG_COUNT"||G==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(G)}function hh(G){return Object.fromEntries(Object.entries(G).filter(([U])=>!To(U)))}function yh(G){let U;try{U=Ao(G,"utf-8")}catch{return!0}let j="",K=!1;for(let re of U.split(/\r?\n/)){let oe=re.trim();if(oe===""||oe.startsWith("#")||oe.startsWith(";"))continue;let de=oe.match(/^\[([^\]]+)\]$/);if(de){j=de[1]?.trim().toLowerCase()??"";continue}let Se=oe.indexOf("="),we=(Se===-1?oe:oe.slice(0,Se)).trim().toLowerCase(),We=Se===-1?"true":oe.slice(Se+1).trim();if(bh(j)&&we==="path")return!0;if(j==="submodule"&&we==="recurse")K=Qc(We)}return K}function bh(G){return G==="include"||G.startsWith("includeif ")}function Qc(G){let U=G.toLowerCase();return U!=="false"&&U!=="no"&&U!=="off"&&U!=="0"}function eu(G,U){if(G==="")return null;let j=_n(),K=da(sn(G,G,U,j)),re=K?vh(K,G,U,j):null;if(!re)return null;return Object.freeze({entries:Object.freeze([re.entry]),markerFiles:Object.freeze(re.markerFile?[re.markerFile]:[]),directories:Object.freeze(re.directories),hooksDirectories:Object.freeze(re.hooksDirectories)})}function vh(G,U,j,K){try{let re=sn(G,U,j,K),oe=Ch(G),de=oe.isFile()?re:null,Se=oe.isFile()?ua(G):null,we=(oe.isDirectory()?[re]:[Se?.gitDir,Se?.commonDir]).flatMap((ft)=>ft?[Kr(sn(ft,U,j,K))]:[]),We=[...new Set(oe.isDirectory()?[Kr(G.replace(/\\/g,"/")),...we]:we)];return{entry:Kr(re),markerFile:de?Kr(de):null,directories:We,hooksDirectories:[...new Set(We.flatMap((ft)=>{let pt=Kr(Sh(ft,"hooks").replace(/\\/g,"/"));return[pt,Kr(sn(pt,U,j,K))]}))]}}catch{return null}}function Kr(G){return process.platform==="win32"?G.toLowerCase():G}var Ph={realpath:(G)=>{try{return xh(G)}catch{return null}},entryKind:(G)=>{let U=Eh(G,{throwIfNoEntry:!1});if(!U)return"missing";return U.isSymbolicLink()?"symlink":"present"},isDirectory:(G)=>{try{return Rh(G).isDirectory()}catch{return!1}}};function c(){return Ah({env:new Map(Object.entries(process.env).flatMap(([G,U])=>U===void 0?[]:[[G,U]])),home:bn(process.env.HOME||_h()),tmpdir:wh(),paths:Ph})}function Ah(G,U={}){let j=new Map,K=new Map,re={...G,gitMetadata:(oe)=>tu(j,oe,()=>eu(oe,re)),worktreeFacts:(oe)=>tu(K,oe,()=>Xc(oe)),...U};return re}function tu(G,U,j){let K=G.get(U);if(K!==void 0)return K;let re=j();return G.set(U,re),re}import{accessSync as Xh,constants as yu,statSync as Jh}from"node:fs";import{isAbsolute as bu,relative as Qh,resolve as ey,sep as ty}from"node:path";import{types as Th}from"node:util";var Ih=new Set(["applypatch","patch"]),kh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Oh=new Set(["grep","grepsearch","rg"]),Mh=new Set(["find","findbyname","glob"]),Dh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Nh=new Set(["command","diff","input","patch","patchtext"]),nu=new TextEncoder,Lh=new TextDecoder,Wh=/\s/,Gh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Io=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function au(G){return G.replace(/[-_\s]/g,"").toLowerCase()}function Ri(G){return Dh.has(au(G))}function P(G){let U=au(G);if(Ih.has(U))return"patch";if(Oh.has(U))return"grep";if(Mh.has(U))return"glob";if(kh.has(U))return"path";return"unknown"}function ie(G){if(!G||typeof G!=="object")return;pu(G);let U=Object.getOwnPropertyDescriptor(G,"command");if(!U){if("command"in G)$n();return}if(U.get||U.set)$n();let j=U.value;return typeof j==="string"&&j!==""?j:void 0}function lu(G,U){return cu(G,U,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function cu(G,U,j,K,re){let oe=mu(G,K,re);if(typeof G==="string")return j?[G]:[];if(!oe)return[];let de=oe.entries.flatMap(([Se,we])=>cu(we,U,oe.array?j:U.has(uu(Se)),K,re+1));return K.ancestors.delete(oe.object),de}function uu(G){return G.replace(/-/g,"_").toLowerCase()}function du(G){return fu(G,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(zh)}function fu(G,U,j,K){let re=mu(G,j,K);if(typeof G==="string")return U?[G]:[];if(!re)return[];let oe=re.entries.flatMap(([de,Se])=>fu(Se,re.array?U:Nh.has(uu(de)),j,K+1));return j.ancestors.delete(re.object),oe}function Fh(G,U,j){if(U.nodes++,G!==null&&typeof G==="object"&&j>Io.maxDepth||U.nodes>Io.maxNodes)$n();if(typeof G!=="string")return;let K=Buffer.byteLength(G);if(U.stringBytes+=K,K>Io.maxStringBytes||U.stringBytes>Io.maxAggregateStringBytes)$n()}function mu(G,U,j){if(Fh(G,U,j),!G||typeof G!=="object")return null;let K=pu(G);if(U.ancestors.has(G))$n();let re=Reflect.ownKeys(G);if(U.keys+=re.length,U.keys>Io.maxKeys)$n();let oe=re.flatMap((de)=>{let Se=Object.getOwnPropertyDescriptor(G,de);if(!Se||Se.get||Se.set)$n();return typeof de==="string"&&Se.enumerable?[[de,Se.value]]:[]});return U.ancestors.add(G),{object:G,array:K,entries:oe}}function pu(G){if(Th.isProxy(G))$n();let U=Array.isArray(G),j=Object.getPrototypeOf(G);if(U&&j!==Array.prototype||!U&&j!==Object.prototype&&j!==null)$n();return U}function $n(){throw new f}function zh(G){let U=[],j=G.split(/\r?\n/),K=!1,re=!1,oe=null,de=null,Se=()=>{re=!1,oe=null,de=null};for(let we=0;we<j.length;we++){let We=j[we]??"";if(We==="*** Begin Patch"){K=!0,Se();continue}if(We==="*** End Patch"){K=!1,Se();continue}if(We.startsWith("@@")){let ft=Bh(We);if(re=!0,oe=ft?.oldLines??null,de=ft?.newLines??null,oe===0&&de===0)Se();continue}if(re&&oe!==null&&de!==null){let ft=We.startsWith(" ")||We.startsWith("-")?1:0,pt=We.startsWith(" ")||We.startsWith("+")?1:0;if(oe=Math.max(0,oe-ft),de=Math.max(0,de-pt),oe===0&&de===0)Se();continue}if(We.startsWith("*** ")){Se(),U.push(...fa(We));continue}if(re)continue;if(We.startsWith("diff --git ")){U.push(...fa(We));continue}if(We.startsWith("--- ")){let ft=j[we+1]??"";if(!ft.startsWith("+++ "))continue;U.push(...pa(xi(We.slice(4),!0),xi(ft.slice(4),!0))),we++;continue}if(!K)U.push(...fa(We))}return U}function Bh(G){let U=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(G);if(!U)return null;return{oldLines:Number(U[1]??1),newLines:Number(U[2]??1)}}function fa(G){let U=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(G);if(U?.[1])return su(U[1]);let j=/^\*\*\* Move to: (.+)$/.exec(G);if(j?.[1])return su(j[1]);if(G.startsWith("diff --git "))return $h(G.slice(11));let K=/^--- (.+)$/.exec(G);if(K?.[1])return iu(K[1]);let re=/^\+\+\+ (.+)$/.exec(G);if(re?.[1])return iu(re[1]);let oe=/^(?:rename|copy) (?:from|to) (.+)$/.exec(G);if(oe?.[1])return Yh(oe[1]);return[]}function $h(G){let U=Uh(G);if(U.length===2&&U[0]&&U[1])return pa(U[0],U[1]);let j=Hh(G);return j?pa(G.slice(j.oldStart,j.oldEnd),G.slice(j.newStart,j.newEnd)):[]}function Uh(G){let U=[],j=0;while(j<G.length&&U.length<2){while(vr(G[j]))j++;if(j>=G.length)break;let K=G[j]==='"'||G[j]==="'"?G[j]:void 0;if(!K){let oe=j;while(j<G.length&&!vr(G[j]))j++;U.push(G.slice(oe,j));continue}let re=gu(G,j,K);if(!re)return[];U.push(re.value),j=re.end}while(vr(G[j]))j++;return j===G.length?U:[]}function Hh(G){let U=0;while(U<G.length&&vr(G[U]))U++;let j=G.length;while(j>U&&vr(G[j-1]))j--;let K=0,re=U;while(re<j){if(!vr(G[re])){re++;continue}let oe=re;while(re<j&&vr(G[re]))re++;if(oe===U||re===j)continue;if(K++,K>Gh)$n();if(jh(G,U,oe,re,j))return{oldStart:U,oldEnd:oe,newStart:re,newEnd:j}}return null}function jh(G,U,j,K,re){if(ma(G,U,j,K,re))return!0;let oe=ru(G,"/",U,j),de=ru(G,"/",K,re);if(oe<=U||de<=K)return!1;if(ma(G,U,oe,K,de))return!1;return ma(G,oe+1,j,de+1,re)}function ma(G,U,j,K,re){if(j-U!==re-K)return!1;for(let oe=0;oe<j-U;oe++)if(G[U+oe]!==G[K+oe])return!1;return!0}function ru(G,U,j,K){for(let re=j;re<K;re++)if(G[re]===U)return re;return-1}function vr(G){return G!==void 0&&Wh.test(G)}function gu(G,U,j){let K=[],re=U+1;while(re<G.length){let oe=String.fromCodePoint(G.codePointAt(re)??0);if(oe===j)return{value:Lh.decode(Uint8Array.from(K)),end:re+1};if(oe!=="\\"||j==="'"){K.push(...nu.encode(oe)),re+=oe.length;continue}let de=G.slice(re+1),Se=/^[0-7]{1,3}/.exec(de)?.[0];if(Se){K.push(Number.parseInt(Se,8)),re+=Se.length+1;continue}K.push(...nu.encode(Vh(de[0]??""))),re+=2}return null}function Vh(G){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[G]??G}function Kh(G){return ko(Zh(G))}function pa(G,U){if(G==="/dev/null")return ou(U);if(U==="/dev/null")return ou(G);if(G.startsWith("a/")&&U.startsWith("b/"))return[G.slice(2),U.slice(2)].flatMap(ko);let j=qh(G,U)??(G===U?hu(G):null);return[G,U,...j?[j]:[]].flatMap(ko)}function ou(G){let U=hu(G);return[G,...U?[U]:[]].flatMap(ko)}function hu(G){let U=G.indexOf("/");return U>0&&U<G.length-1?G.slice(U+1):null}function qh(G,U){let j=G.indexOf("/"),K=U.indexOf("/");if(j<1||K<1)return null;if(G.slice(0,j)===U.slice(0,K))return null;let re=G.slice(j+1);return re===U.slice(K+1)?re:null}function iu(G){return Kh(xi(G,!0))}function Yh(G){return ko(xi(G,!1))}function xi(G,U){let j=G.trim(),K=j[0]==='"'||j[0]==="'"?j[0]:void 0;if(K){let re=gu(j,0,K);if(re&&(U||j.slice(re.end).trim()===""))return re.value}return U?j.split("\t",1)[0]?.trim()??"":j}function Zh(G){return G.startsWith("a/")||G.startsWith("b/")?G.slice(2):G}function ko(G){return G===""||G==="/dev/null"?[]:[G]}function su(G){let U=G.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return U===""||U==="/dev/null"?[]:[U]}function fe(G){try{if(!Jh(G).isDirectory())return!1;return Xh(G,yu.R_OK|yu.X_OK),!0}catch{return!1}}function it(G,U,j){if(ir(G))return;let K=U.flatMap((oe)=>ga(oe,j));if(!K[0])return;let re=ga(bu(G)?G:ey(K[0],G),j)[0];if(!re)return;return K.some((oe)=>ny(re,oe))?re:void 0}function qe(G,U){return G.flatMap((j)=>ga(j,U))[0]}function ga(G,U){let j=U.realpath(G);if(j===null)return[];return U.isDirectory(j)?[j]:[]}function ny(G,U){let j=Qh(U,G);return j===""||j!==".."&&!j.startsWith(`..${ty}`)&&!bu(j)}var ry=8388608;async function Ke(G){let U=[],j=0;for await(let K of G){let re=typeof K==="string"?Buffer.from(K,"utf-8"):Buffer.from(K.buffer,K.byteOffset,K.byteLength);if(j+=re.byteLength,j>ry)throw oy(G),Error("hook input byte limit exceeded");U.push(re)}return Buffer.concat(U,j).toString("utf-8")}function oy(G){let U=G.destroy??G.cancel;if(!U)return;try{Promise.resolve(U.call(G)).catch(()=>{})}catch{}}function u(G,U,j,K,re){if(j.kind!=="command")return{toolName:G,input:U,route:j,context:K};return{toolName:G,input:U,route:j,context:K,command:re}}var qr=["fail_closed","paranoid_rm","paranoid_interpreters"],_i={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var n={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},wi=["standard","strict","paranoid"];function Cu(G,U){if(!U)return G;return wi.indexOf(U)>wi.indexOf(G)?U:G}function Su(G){let U=pe(n.level,G);return wi.find((j)=>j===U)}function vu(G,U){return Cu(G,Su(U))}function iy(G){let U=pe(n.level,G);if(!U)return;let j=Su(G);if(j)return j;console.error(`CC Safety Net: ignored invalid ${n.level.name}=${JSON.stringify(U.slice(0,40))}. Use ${wi.join(", ")}.`);return}function Ve(G){if(G===void 0||G==="all")return"all";if(G==="blocked")return"blocked";return"invalid"}function Ee(G){return Ve(pe(n.auditScope,G))==="all"}function ha(G){if(G.failClosed&&G.paranoidRm&&G.paranoidInterpreters)return"paranoid";if(G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"strict";if(!G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"standard";return"custom"}function T(G={},U){let j=G.safety?.level??"standard",K=iy(U),re=Cu(j,K),oe=_i[re],de={failClosed:oe.fail_closed,paranoidRm:oe.paranoid_rm,paranoidInterpreters:oe.paranoid_interpreters},Se={failClosed:re===j?"preset":"environment",paranoidRm:re===j?"preset":"environment",paranoidInterpreters:re===j?"preset":"environment"},we={failClosed:[`policy safety.level=${j}`],paranoidRm:[`policy safety.level=${j}`],paranoidInterpreters:[`policy safety.level=${j}`]};if(re!==j)we.failClosed.push(`env ${n.level.name}=${K}`),we.paranoidRm.push(`env ${n.level.name}=${K}`),we.paranoidInterpreters.push(`env ${n.level.name}=${K}`);if(G.safety?.overrides?.failClosed!==void 0)de.failClosed=G.safety.overrides.failClosed,Se.failClosed="capability_override",we.failClosed.push("policy safety.overrides.fail_closed");if(G.safety?.overrides?.paranoidRm!==void 0)de.paranoidRm=G.safety.overrides.paranoidRm,Se.paranoidRm="capability_override",we.paranoidRm.push("policy safety.overrides.paranoid_rm");if(G.safety?.overrides?.paranoidInterpreters!==void 0)de.paranoidInterpreters=G.safety.overrides.paranoidInterpreters,Se.paranoidInterpreters="capability_override",we.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(x(n.strict,U))de.failClosed=!0,Se.failClosed="environment",we.failClosed.push(`env ${n.strict.name}`);if(x(n.paranoid,U))de.paranoidRm=!0,de.paranoidInterpreters=!0,Se.paranoidRm="environment",Se.paranoidInterpreters="environment",we.paranoidRm.push(`env ${n.paranoid.name}`),we.paranoidInterpreters.push(`env ${n.paranoid.name}`);if(x(n.paranoidRm,U))de.paranoidRm=!0,Se.paranoidRm="environment",we.paranoidRm.push(`env ${n.paranoidRm.name}`);if(x(n.paranoidInterpreters,U))de.paranoidInterpreters=!0,Se.paranoidInterpreters="environment",we.paranoidInterpreters.push(`env ${n.paranoidInterpreters.name}`);let We=!!G.worktreeMode||x(n.worktree,U);return{strict:de.failClosed,paranoidRm:de.paranoidRm,paranoidInterpreters:de.paranoidInterpreters,worktreeMode:We,effectiveLevel:ha(de),capabilities:{fail_closed:{enabled:de.failClosed,source:Se.failClosed,sources:we.failClosed},paranoid_rm:{enabled:de.paranoidRm,source:Se.paranoidRm,sources:we.paranoidRm},paranoid_interpreters:{enabled:de.paranoidInterpreters,source:Se.paranoidInterpreters,sources:we.paranoidInterpreters}}}}function x(G,U){let j=typeof G==="string"?Oo(G,U):pe(G,U);return j==="1"||j?.toLowerCase()==="true"}function Oo(G,U){return U.get(G)}function pe(G,U){let j=Oo(G.name,U);if(j!==void 0)return j;if(G.legacyName)return Oo(G.legacyName,U);return}function ot(G,U){return Oo(G.name,U)!==void 0||!!G.legacyName&&Oo(G.legacyName,U)!==void 0}import{dirname as _r}from"node:path";import{closeSync as sy,constants as Mo,fstatSync as ya,fsyncSync as ay,lstatSync as wn,mkdirSync as Eu,openSync as xu,readdirSync as Ca,readFileSync as ly,realpathSync as Yr,renameSync as cy,rmdirSync as Ru,statSync as ba,unlinkSync as Sa,writeFileSync as uy}from"node:fs";import{isAbsolute as _u,join as Er,normalize as dy,parse as Pi,relative as va,resolve as Ea,sep as Ai}from"node:path";function Ie(){let G=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${G()}${G()}`}var fy=Symbol("PolicyFilesystemScope"),my=Symbol("PolicyFilesystemTarget"),wu=Mo.O_NOFOLLOW??0;class o extends Error{name="PolicyFilesystemError";constructor(G){super(`Unable to access ${G} filesystem safely.`)}}function v(G,U){return{[fy]:!0,root:Ea(G),label:U}}function Do(G,U){let j=dy(U);if(U===""||_u(U)||j===".."||j.startsWith(`..${Ai}`))throw new o(G.label);return{[my]:!0,scope:G,relativePath:j,path:Er(G.root,j)}}function i(G,U){return Do(G,va(G.root,Ea(U)))}function se(G,U="rules policy"){let j=Ea(G),K=Pi(j).dir;return Do(v(K,U),va(K,j))}function r(G){return Kn(G.scope.label,()=>{if(!Qt(G))return null;let U=xu(G.path,Mo.O_RDONLY|wu);return Au(U,()=>{let j=ya(U);if(!j.isFile())throw new o(G.scope.label);let K=ly(U,"utf-8"),re=wn(G.path);if(!re.isFile()||re.isSymbolicLink()||j.dev!==re.dev||j.ino!==re.ino)throw new o(G.scope.label);return Qt(G),K})})}function g(G,U,j=384,K){let re=`${G.path}.${Ie()}.tmp`;Kn(G.scope.label,()=>{gy(G),Qt(G);let oe=xu(re,Mo.O_CREAT|Mo.O_EXCL|Mo.O_WRONLY|wu,j),de=Au(oe,()=>{let Se=ya(oe);if(!Se.isFile())throw new o(G.scope.label);uy(oe,U,"utf-8"),ay(oe);let we=ya(oe);if(!we.isFile()||we.dev!==Se.dev||we.ino!==Se.ino)throw new o(G.scope.label);return we});Qt(G),yy(G,re,de.dev,de.ino),cy(re,G.path),K?.(G.path),Qt(G)},()=>by(re))}function Pu(G,U){if(G.path===U.path)return!0;return Kn(G.scope.label,()=>{if(!Qt(G)||!Qt(U))return!1;let j=(K)=>Er(Yr(Pi(K).dir),Pi(K).base);return j(G.path)===j(U.path)})}function me(G){let U=Kn(G.scope.label,()=>{if(!Qt(G,"directory"))return null;let j=Ca(G.path);return Qt(G,"directory"),j});if(!U)return null;return Kn(G.scope.label,()=>{let j=U.map((K)=>{let re=Do(G.scope,Er(G.relativePath,K)),oe=wn(re.path);if(oe.isSymbolicLink()||!oe.isFile()&&!oe.isDirectory())throw new o(G.scope.label);return Ti(xa(G.scope),Yr(re.path),G.scope.label),{name:K,kind:oe.isDirectory()?"directory":"file"}});return Qt(G,"directory"),j})}function H(G){Kn(G.scope.label,()=>{if(!Qt(G))return;Sa(G.path),Qt(G)})}function st(G){Kn(G.scope.label,()=>{if(!py(G))return;Iu(G),Qt(G,"directory")})}function at(G){Kn(G.scope.label,()=>{if(!Qt(G,"directory"))return;Ru(G.path),Qt(G,"directory")})}function py(G){return Kn(G.scope.label,()=>{if(!Qt(G,"directory"))return!1;return Tu(G),!0})}function Kn(G,U,j){try{return U()}catch(K){if(j?.(),K instanceof o)throw K;throw new o(G)}}function Au(G,U){try{return U()}finally{sy(G)}}function Qt(G,U="file"){let j=ku(G.scope);if(!j)return!1;let K=G.relativePath.split(Ai);for(let re of K.keys()){let oe=Er(G.scope.root,...K.slice(0,re+1)),de=wn(oe,{throwIfNoEntry:!1});if(!de)return!1;if(de.isSymbolicLink())throw new o(G.scope.label);if(re<K.length-1&&!de.isDirectory())throw new o(G.scope.label);if(re===K.length-1&&(U==="file"?!de.isFile():!de.isDirectory()))throw new o(G.scope.label);Ti(j,Yr(oe),G.scope.label)}return!0}function Tu(G){for(let U of Ca(G.path)){let j=Do(G.scope,Er(G.relativePath,U)),K=wn(j.path);if(K.isSymbolicLink()||!K.isDirectory()&&!K.isFile())throw new o(G.scope.label);if(K.isDirectory())Tu(j)}Qt(G,"directory")}function Iu(G){for(let U of Ca(G.path)){let j=Do(G.scope,Er(G.relativePath,U)),K=wn(j.path);if(K.isSymbolicLink())throw new o(G.scope.label);if(K.isDirectory()){Iu(j);continue}if(!K.isFile())throw new o(G.scope.label);Sa(j.path)}Ru(G.path)}function gy(G){hy(G.scope);let U=xa(G.scope),j=G.relativePath.split(Ai).slice(0,-1);for(let K of j.keys()){let re=Er(G.scope.root,...j.slice(0,K+1));if(!wn(re,{throwIfNoEntry:!1}))Eu(re,{mode:448});let oe=wn(re);if(!oe.isDirectory()||oe.isSymbolicLink())throw new o(G.scope.label);Ti(U,Yr(re),G.scope.label)}}function hy(G){if(wn(G.root,{throwIfNoEntry:!1})){if(!ba(G.root).isDirectory())throw new o(G.label);return}let U=[],j=G.root;while(!wn(j,{throwIfNoEntry:!1})){U.unshift(j);let K=Pi(j).dir;if(K===j)throw new o(G.label);j=K}if(!ba(j).isDirectory())throw new o(G.label);for(let K of U){Eu(K,{mode:448});let re=wn(K);if(!re.isDirectory()||re.isSymbolicLink())throw new o(G.label)}}function ku(G){if(!wn(G.root,{throwIfNoEntry:!1}))return null;if(!ba(G.root).isDirectory())throw new o(G.label);return Yr(G.root)}function xa(G){let U=ku(G);if(!U)throw new o(G.label);return U}function yy(G,U,j,K){let re=wn(U);if(!re.isFile()||re.isSymbolicLink()||re.dev!==j||re.ino!==K)throw new o(G.scope.label);Ti(xa(G.scope),Yr(U),G.scope.label)}function Ti(G,U,j){let K=va(G,U);if(K===".."||K.startsWith(`..${Ai}`)||_u(K))throw new o(j)}function by(G){try{Sa(G)}catch{}}import{dirname as xr,isAbsolute as xy,join as Rr,relative as Ry,resolve as sr,sep as _y}from"node:path";var d=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ge="rulebook.json",he=".cc-safety-net/rules";var Ou=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,Cy=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Mu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Sy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),vy="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ct=new RegExp(`^${Sy}/(${d.source.slice(1,-1)})/${vy}$`);function Ey(G){return`.cc-safety-net/rules/${G}/rulebook.json`}function Du(G){if(S(G))try{return N(G),null}catch(U){return U instanceof Error?U.message:String(U)}return d.test(G)?null:`Local rulebook sources must be bare names matching ${d}: ${G}`}function N(G){if(G.startsWith("github:"))throw Error(`Invalid rulebook source: ${G}`);let U=G.match(Ou);if(!U?.[1]||!U[2]||!U[3])throw Error(`Invalid GitHub rulebook source: ${G}`);let j=U[3].lastIndexOf("/");if(j<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);let K=U[3].slice(0,j),re=U[3].slice(j+1);if(!K||!Mu.test(K))throw Error(`GitHub rulebook refs must use valid path segments: ${G}`);if(!re||!d.test(re))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);return{owner:U[1],repo:U[2],ref:K,path:Ey(re),name:re}}function Z(G){return Cy.test(G)}function ae(G){return Mu.test(G)}function S(G){return Ou.test(G)}function lt(G){if(!d.test(G))throw Error(`Local rulebook sources must be bare names matching ${d}: ${G}`)}var Nu="rule.json",Ii="policy.json",Lu=".cc-safety-net",wy="rules",Py="CC_SAFETY_NET_HOME",Wu="`cc-safety-net rule update`";function Ay(G){return sr(G,he)}function _(G){return Rr(Ay(G),Nu)}function h(G){return Rr(sr(G),Lu,Ii)}function ke(G,U={}){return U.userConfigDir??(U.userConfigPath?xr(U.userConfigPath):Rr(Ty(G),wy))}function Ty(G){let U=G.env.get(Py);return U?sr(bn(U)):Rr(G.home,Lu)}function W(G,U={}){return Rr(ke(G,U),Nu)}function l(G,U={}){return Rr(xr(ke(G,U)),Ii)}function L(G,U){let j=_n();return Dt(h(U.cwd),G.paths,j)===Dt(sr(l(G,U)),G.paths,j)}function X(G,U){let j=U.userConfigPath??W(G,U),K=U.projectConfigPath??_(U.cwd),re=Je(G,U),oe=Ye(K,U.cwd);return{userConfigPath:j,projectConfigPath:K,userScope:re,projectScope:oe,userConfigTarget:i(re,j),projectConfigTarget:i(oe,K)}}function Je(G,U){let j=U.userConfigPath?xr(xr(sr(U.userConfigPath))):xr(sr(U.userConfigDir??ke(G,U)));return v(j,"user policy")}function Ye(G,U){let j=sr(U),K=sr(G),re=Ry(j,K);if(re!==".."&&!re.startsWith(`..${_y}`)&&!xy(re))return v(j,"project policy");return v(xr(xr(K)),"project policy")}function F(G,U){return Rr(G,U,ge)}var Cn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,I=256,Vt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Gu=new Set(["python","python3","python2","node","ruby","perl"]),ki=/^python(?:[23](?:\.\d+)*)?$/,Pn=new Set(["awk","gawk","nawk","mawk"]),Oi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Fu="Rulebook exceeds CC Safety Net's safe validation limits.",zu="Additional rulebook validation errors were omitted.",kn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Bu(G){if(Ra(G.allowed_commands,kn.maxAllowedCommands)||Ra(G.rules,kn.maxRules)||Ra(G.tests,kn.maxTests))return!1;let{maxAggregateStringCodeUnits:U,maxTotalBlockArgs:j}=kn,K=(re,oe=!1)=>{if(typeof re!=="string")return!0;if(re.length>kn.maxStringCodeUnits||oe&&re.length>kn.maxFixtureCommandCodeUnits||re.length>U)return!1;return U-=re.length,!0};if(!K(G.name)||!K(G.version)||!K(G.description)||!K(G.author)||!K(G.migrated_from))return!1;if(Array.isArray(G.allowed_commands)){for(let re of G.allowed_commands)if(!K(re))return!1}if(Array.isArray(G.rules))for(let re of G.rules){if(!re||typeof re!=="object")continue;let oe=re;if(!K(oe.name)||!K(oe.command)||!K(oe.subcommand)||!K(oe.reason)||!K(oe.intent))return!1;let de=oe.match&&typeof oe.match==="object"?oe.match:{};for(let Se of[oe.block_args,de.command_path,de.any_args,de.exclude_args]){if(!Array.isArray(Se))continue;if(Se.length>kn.maxBlockArgsPerRule||Se.length>j)return!1;j-=Se.length;for(let we of Se)if(!K(we))return!1}}if(Array.isArray(G.tests))for(let re of G.tests){if(!re||typeof re!=="object")continue;let oe=re;if(!K(oe.command,!0)||!K(oe.expect)||!K(oe.rule))return!1}return!0}function Ra(G,U){return Array.isArray(G)&&G.length>U}var _a=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ye=64,be="Rule config exceeds CC Safety Net's safe source limit.";function Ot(G){return Pt(G).toLowerCase()}function Pt(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}function cn(G,U){let j=new Set,K=!1;for(let re of G){if(re==="--"){K=!0;continue}if(K)continue;if(re.startsWith("-")&&!re.startsWith("--")&&re.length>1)for(let oe=1;oe<re.length;oe++){let de=re[oe];if(!de||!/[a-zA-Z]/.test(de))break;let Se=`-${de}`;if(j.add(Se),U?.shortOptsWithValue?.has(Se))break}}return j}var Iy={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},wa=new Set(["--init-file","--rcfile"]);function Pa(G,U,j,K){let re=!1,oe=0,de=!1,Se=!1,we=!1;for(let We=1;We<U.length;We++){let ft=U[We];if(ft===void 0)break;if(G==="ksh"&&ft==="o"&&We+1<U.length){if(K==="argv"){let pt=U.slice(We+1);if(U[0]==="-"&&(pt==="c"||pt[0]==="-"&&pt.endsWith("c")))de=!0}break}if(G==="ksh"&&ft==="o"&&We+1===U.length&&(j?.startsWith("-")||j?.startsWith("+")))break;if(G==="zsh"&&ft==="o"&&We+1<U.length)break;if(K==="startup"&&ft==="i")re=U[0]==="-";if(K==="argv"&&U[0]==="-"&&ft==="c")de=!0;if(K==="argv"&&ft==="n")we=U[0]==="-";if(K==="argv"&&ft==="s")Se=U[0]==="-";if(!Iy[G]?.includes(ft))continue;if(We+1===U.length)oe++;break}return{interactive:re,followingValues:oe,commandSelected:de,stdinMode:Se,syntaxCheck:we}}function Sn(G){let U=Pt(G[0]??"").toLowerCase(),j=!1,K=!1,re=!1;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(de===void 0)break;if(de==="--"){let we=j&&G[oe+1]!==void 0?oe+1:null;return{command:we===null?null:G[we]??null,commandIndex:we,scriptIndex:!j&&!K&&G[oe+1]!==void 0?oe+1:null,readsStdinAsCommands:!j&&(K||G[oe+1]===void 0),syntaxCheck:re}}if(de==="-"||de[0]!=="-"&&de[0]!=="+")return{command:j?de:null,commandIndex:j?oe:null,scriptIndex:!j&&!K&&de!=="-"?oe:null,readsStdinAsCommands:!j&&(K||de==="-"),syntaxCheck:re};if(de.startsWith("--")){let we=de.split("=",1)[0]??de;if(U==="bash"&&wa.has(we)&&!de.includes("="))oe++;continue}let Se=Pa(U,de,G[oe+1],"argv");if(Se.commandSelected)j=!0;if(Se.syntaxCheck)re=!0;if(Se.stdinMode)K=!0;oe+=Se.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!j,syntaxCheck:re}}function No(G,U){if(U.escaped)return U.escaped=!1,!0;if(G==="\\"&&!U.inSingle)return U.escaped=!0,!0;if(G==="'"&&!U.inDouble)return U.inSingle=!U.inSingle,!0;if(G==='"'&&!U.inSingle)return U.inDouble=!U.inDouble,!0;return!1}function Mi(G){let U={inSingle:!1,inDouble:!1,escaped:!1};for(let j of ky(G))No(j,U);return U.inSingle||U.inDouble}function ky(G){let U="",j={inSingle:!1,inDouble:!1,escaped:!1},K=!1,re=!0;for(let oe=0;oe<G.length;oe++){let de=G[oe];if(!de)break;if(K){if(de===`
-`||de==="\r")U+=de,K=!1,j.escaped=!1;continue}if(de==="#"&&!j.inSingle&&!j.inDouble&&re){K=!0;continue}if(U+=de,!j.inSingle&&!j.inDouble&&!j.escaped)re=/[\s;&|()<>]/.test(de);No(de,j)}return U}var Aa=new Set(["rm","find","xargs","parallel"]),Oy=new Set(["git","busybox",...Aa,...Vt,...Gu,...Pn]),My=new Set(["python","node","ruby","perl"]);function Ae(G){let U=Ot(G);return Oy.has(U)||On(U)}function On(G){return My.has(Dy(G))}function Dy(G){let U=Pt(G).toLowerCase();return ki.test(U)?"python":U}var ut={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(G){try{let U=r(Ny(G));if(U===null)return{config:null,errors:[]};if(!U.trim())return{config:null,errors:["Config file is empty"]};let j=JSON.parse(U),K=Ze(j);if(K.errors.length>0)return{config:null,errors:K.errors};return{config:{version:1,rules:j.rules??[],overrides:j.overrides??{},transparent_wrappers:j.transparent_wrappers??[]},errors:[]}}catch(U){if(U instanceof o)return{config:null,errors:[U.message]};let j=U instanceof Error?U.message:String(U);return{config:null,errors:[U instanceof SyntaxError?"Invalid JSON":j]}}}function Ny(G){return typeof G==="string"?se(G):G}var e=(G,U)=>({path:G,message:U,kind:"typed"}),en=(G,U)=>({path:G,message:U,kind:"custom"});function Oe(G){let U=new Set;return G.flatMap((j,K)=>{let re=Zr(j)?j.name:void 0;if(typeof re!=="string")return[];if(U.has(re.toLowerCase()))return[en(["rules",K,"name"],`duplicate rule name "${re}"`)];return U.add(re.toLowerCase()),[]})}var Re=`must be one of ${_a.join(", ")}`,Ly=/^[^/]+\/[^/]+$/,Wy=["version","rules","overrides","transparent_wrappers"];function Ze(G){let U=Gy(G);return{errors:ce(Xe(U,Wy,(j)=>j.kind==="custom"),": "," "),sources:Vy(G,U)}}function Gy(G){if(!Zr(G))return[e([],"Config must be an object")];let U=Array.isArray(G.rules)&&G.rules.length>ye;return[...G.version===1?[]:[e(["version"],"must be 1")],...Fy(G.rules,U),...$y(G.overrides),...Hy(G.transparent_wrappers),...U?[]:By(G.rules),...Zr(G.overrides)?Object.keys(G.overrides).filter((j)=>!Ly.test(j)).map((j)=>en(["overrides",j],"must use <rulebook-name>/<rule-name>")):[],...jy(G.transparent_wrappers)]}function Fy(G,U){if(G===void 0)return[];if(!Array.isArray(G))return[e(["rules"],"must be an array of rulebook source strings"),...$u(G,ye)?[e(["rules"],be)]:[]];if(U)return[{path:["rules"],message:be,kind:"limit"}];return G.flatMap((j,K)=>{if(typeof j!=="string")return[e(["rules",K],"must be a rulebook source string"),...zy(j,1)?[e(["rules",K],"must be a non-empty rulebook source string")]:[]];return j===""?[e(["rules",K],"must be a non-empty rulebook source string")]:[]})}function $u(G,U){let j=Uu(G);return j!==void 0&&!(j<=U)}function zy(G,U){let j=Uu(G);return j!==void 0&&!(j>=U)}function Uu(G){if(G===null||G===void 0)return;let U=G.length;return U===void 0?void 0:Number(U)}function By(G){if(!Array.isArray(G))return[];let U=new Set;return G.flatMap((j,K)=>{if(typeof j!=="string"||j==="")return[];if(j.trim()==="")return[en(["rules",K],"must be a non-empty rulebook source string")];let re=Du(j);if(re)return[en(["rules",K],re)];if(U.has(j))return[en(["rules",K],`duplicate rulebook source "${j}"`)];return U.add(j),[]})}function $y(G){if(G===void 0)return[];if(!Zr(G))return[e(["overrides"],"must be an object if provided")];return Object.keys(G).flatMap((U)=>{let j=G[U];if(j==="off")return[];if(!Zr(j))return[e(["overrides",U],'must be "off" or an object')];return[...Uy(j.reason,["overrides",U,"reason"]),...j.intent===void 0||Te(j.intent)?[]:[e(["overrides",U,"intent"],Re)]]})}function Uy(G,U){if(typeof G!=="string")return[e(U,"required non-empty string"),...$u(G,I)?[e(U,`must be at most ${I} characters`)]:[]];if(G==="")return[e(U,"required non-empty string")];return G.length>I?[e(U,`must be at most ${I} characters`)]:[]}function Hy(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["transparent_wrappers"],"must be an array of command strings")];return G.flatMap((U,j)=>{if(typeof U!=="string")return[e(["transparent_wrappers",j],"must be a command string")];return w.test(U)?[]:[e(["transparent_wrappers",j],"must match command pattern")]})}function jy(G){if(!Array.isArray(G))return[];let U=new Set;return G.flatMap((j,K)=>{if(typeof j!=="string"||!w.test(j))return[];if(U.has(j))return[en(["transparent_wrappers",K],`duplicate command "${j}"`)];if(Ae(j))return[en(["transparent_wrappers",K],`reserved command "${j}" cannot be a wrapper`)];return U.add(j),[]})}function Vy(G,U){let j=Zr(G)?G.rules:void 0;if(!Array.isArray(j))return new Set;if(U.some((re)=>re.path.length===1&&re.path[0]==="rules"))return new Set;let K=new Set(U.filter((re)=>re.path[0]==="rules"&&typeof re.path[1]==="number").map((re)=>re.path[1]));return new Set(j.filter((re,oe)=>typeof re==="string"&&!K.has(oe)))}function Xe(G,U,j){let K=G.map((de)=>de.path[1]),re=[...new Set(K.filter((de)=>typeof de==="string"))],oe=(de,Se)=>[de.path.length===0?-1:U.indexOf(String(de.path[0])),typeof Se==="number"?Se:re.indexOf(String(Se)),j(de)?0:1];return G.map((de,Se)=>({issue:de,rank:oe(de,K[Se])})).sort((de,Se)=>de.rank[0]-Se.rank[0]||de.rank[1]-Se.rank[1]||de.rank[2]-Se.rank[2]).map((de)=>de.issue)}function ce(G,U,j){return[...new Set(G.map((K)=>{let re=Ta(K.path);if(K.kind==="unknownKeys")return`${re?`${re}.`:""}unknown field "${K.message}"`;if(K.kind==="key"||K.kind==="limit"||K.path.length===0)return K.message;return`${re}${K.path.length===1?j:U}${K.message}`}))]}function Ta(G){return G.map((U,j)=>{if(typeof U==="number")return`[${U}]`;return j===0?String(U):`.${String(U)}`}).join("")}function Te(G){return _a.includes(G)}function Zr(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function le(G){let U=Yy(G);if(U.errors.length>0)throw Error(U.errors.join("; "));return G}var Ky=`required non-empty string up to ${I} characters`,Hu="must be a non-empty array of unique non-empty strings",qy="required non-empty array of non-empty strings";function Yy(G){if(!ar(G))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Bu(G))return{errors:[Fu],ruleNames:new Set};let U=[...G.rulebook_version===1||G.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ce(Zy(G,G.rulebook_version===2),": ",": ")];return{errors:U.length>kn.maxValidationErrors?[...U.slice(0,kn.maxValidationErrors),zu]:U,ruleNames:new Set(De(G).map((j)=>j.toLowerCase()))}}function De(G){let U=ar(G)?G.rules:void 0;return(Array.isArray(U)?U:[]).flatMap((j)=>{let K=ar(j)?j.name:void 0;return typeof K==="string"?[K]:[]})}function Zy(G,U){return[...typeof G.name==="string"&&d.test(G.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof G.version==="string"&&G.version!==""?[]:[e(["version"],"required non-empty string")],...Xy(G.allowed_commands),...Jy(G.rules,U),...nb(G.tests),...rb(G),...ob(G)]}function Xy(G){if(!Array.isArray(G))return[e(["allowed_commands"],"required array")];let U=new Set;return[...G.flatMap((j,K)=>typeof j==="string"&&w.test(j)?[]:[e(["allowed_commands",K],"must match command pattern")]),...G.flatMap((j,K)=>{if(typeof j!=="string"||!w.test(j))return[];if(U.has(j))return[en(["allowed_commands",K],`duplicate command "${j}"`)];return U.add(j),[]})]}function Jy(G,U){if(!Array.isArray(G))return[e(["rules"],"required array")];return[...G.flatMap((j,K)=>{if(!ar(j))return[e(["rules",K],"must be an object")];return U?eb(j,["rules",K]):Qy(j,["rules",K])}),...Oe(G)]}function Qy(G,U){return[...ju(G.name,U),...Vu(G.command,U),...G.subcommand===void 0||typeof G.subcommand==="string"&&w.test(G.subcommand)?[]:[e([...U,"subcommand"],"must match command pattern")],...Di(G.block_args,[...U,"block_args"],"required non-empty array",!1),...Ku(G.reason,U),...qu(G.intent,U)]}function eb(G,U){return[...ju(G.name,U),...Vu(G.command,U),...Ku(G.reason,U),...qu(G.intent,U),...tb(G.match,[...U,"match"]),...G.subcommand===void 0?[]:[e([...U,"subcommand"],"not supported in rulebook_version 2")],...G.block_args===void 0?[]:[e([...U,"block_args"],"not supported in rulebook_version 2")]]}function ju(G,U){if(typeof G!=="string")return[e([...U,"name"],"required string")];return d.test(G)?[]:[e([...U,"name"],"must match rule name pattern")]}function Vu(G,U){return typeof G==="string"&&w.test(G)?[]:[e([...U,"command"],"required string matching command pattern")]}function Ku(G,U){return typeof G==="string"&&G!==""&&G.length<=I?[]:[e([...U,"reason"],Ky)]}function qu(G,U){return G===void 0||Te(G)?[]:[e([...U,"intent"],Re)]}function tb(G,U){if(!ar(G))return[e(U,"required object")];return[...Di(G.command_path,[...U,"command_path"],qy,!1),...G.any_args===void 0?[]:Di(G.any_args,[...U,"any_args"],Hu,!0),...G.exclude_args===void 0?[]:Di(G.exclude_args,[...U,"exclude_args"],Hu,!0)]}function Di(G,U,j,K){if(!Array.isArray(G))return[e(U,j)];let re=G.flatMap((oe,de)=>{if(typeof oe!=="string")return[e([...U,de],"must be a non-empty string")];return oe===""?[en([...U,de],"must be a non-empty string")]:[]});if(G.some((oe)=>typeof oe!=="string"))return re;return[...re,...G.length===0?[en(U,j)]:[],...K&&new Set(G).size!==G.length?[en(U,"must not contain duplicate values")]:[]]}function nb(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["tests"],"must be an array if provided")];return G.flatMap((U,j)=>{if(!ar(U))return[e(["tests",j],"must be an object")];return[...typeof U.command==="string"&&U.command.trim()!==""?[]:[e(["tests",j,"command"],"required non-empty string")],...U.expect==="blocked"||U.expect==="allowed"?[]:[e(["tests",j,"expect"],'must be "blocked" or "allowed"')],...U.rule===void 0||typeof U.rule==="string"?[]:[e(["tests",j,"rule"],"must be a string if provided")],...U.expect==="blocked"&&typeof U.rule!=="string"?[en(["tests",j,"rule"],"required string for blocked fixtures")]:[]]})}function rb(G){if(!Array.isArray(G.tests))return[];let U=new Set(De(G));return[...new Set(G.tests.flatMap((j)=>ar(j)&&j.expect==="blocked"&&typeof j.rule==="string"?[j.rule]:[]))].filter((j)=>!U.has(j)).map((j)=>en(["tests"],`blocked fixture references unknown rule "${j}"`))}function ob(G){if(!Array.isArray(G.allowed_commands)||!Array.isArray(G.rules))return[];let U=new Set(G.allowed_commands.filter((j)=>typeof j==="string"));return G.rules.flatMap((j,K)=>{let re=ar(j)?j.command:void 0;if(typeof re!=="string"||U.has(re))return[];return[en(["rules",K,"command"],`"${re}" must be listed in allowed_commands`)]})}function ar(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function Q(G,U){let j=X(G,U),K;try{K=Pu(j.userConfigTarget,j.projectConfigTarget)}catch(gt){if(gt instanceof o)return mb(j,gt.message);throw gt}let re=m(j.userConfigTarget),oe=K?{config:null,errors:[]}:m(j.projectConfigTarget),de=Zu(j.userConfigPath,re.errors),Se=Zu(j.projectConfigPath,oe.errors),we=new Set,We=re.config?Ia(re.config,_r(j.userConfigPath),"user",j.userScope,we):Xu(),ft=oe.config?Ia(oe.config,_r(j.projectConfigPath),"project",j.projectScope,we):Xu(),pt=re.config?.overrides??{},mt=oe.config?.overrides??{};return{rules:[...Yu(We.rules,pt),...Yu(ft.rules,mt)],transparent_wrappers:db(re.config,oe.config),rulebooks:[...We.rulebooks,...ft.rulebooks],errors:[...de,...Se,...We.errors,...ft.errors],warnings:[...We.warnings,...ft.warnings,...We.canValidateOverrides?ka(pt,We.knownRuleIds,j.userConfigPath):[],...We.canValidateOverrides?fb(mt,We.knownRuleIds,j.projectConfigPath):[],...ft.canValidateOverrides?ka(mt,ft.knownRuleIds,j.projectConfigPath):[]],userConfig:re.config??void 0,projectConfig:oe.config??void 0,...j}}function B(G,U){let j=ib(G,U);if(!j)return[];return[...j.scope.errors,...j.scope.warnings,...sb(j.config,j.scope,G)]}function ib(G,U){let j=U??v(_r(_r(G)),"rules policy"),K=m(i(j,G)).config;if(!K)return null;return{config:K,scope:Ia(K,_r(G),"project",j)}}function sb(G,U,j){return U.canValidateOverrides?ka(G.overrides??{},U.knownRuleIds,j):[]}function Ia(G,U,j,K=v(_r(_r(U)),j==="user"?"user policy":"project policy"),re=new Set){let oe=[],de=[],Se=G.rules.flatMap((We)=>{let ft=lb(We,U,K);if(ft.errors.length>0||!ft.rulebook)return oe.push(...ft.errors),[];let pt=ft.rulebook;if(re.has(pt.name))return de.push(`duplicate active rulebook name "${pt.name}" for ${We}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return re.add(pt.name),[{rules:ab(pt),rulebook:{source:j,spec:We,name:pt.name,version:pt.version,rules:pt.rules.map((mt)=>`${pt.name}/${mt.name}`)}}]}),we=Se.flatMap((We)=>We.rules);return{rules:we,rulebooks:Se.map((We)=>We.rulebook),knownRuleIds:new Set(we.map((We)=>We.name)),errors:oe,warnings:de,canValidateOverrides:oe.length===0}}function ab(G){if(G.rulebook_version===2)return G.rules.map((U)=>({name:`${G.name}/${U.name}`,command:U.command,block_args:[],match:U.match,reason:U.reason,intent:U.intent}));return G.rules.map((U)=>({...U,name:`${G.name}/${U.name}`,match:void 0}))}function lb(G,U,j){let K=Ne(G),re=F(U,K),oe=ub(re,j);if("error"in oe)return{rulebook:null,errors:[oe.error]};if(oe.content===null)return{rulebook:null,errors:[`missing rulebook file ${re} for ${G}; ${cb(G)}`]};let de=xe(oe.content);if("problem"in de)return{rulebook:null,errors:[`invalid rulebook ${re}: ${de.problem}; fix that file`]};if(de.rulebook.name!==K)return{rulebook:null,errors:[`rulebook name "${de.rulebook.name}" in ${re} must match source "${G}"; fix that file`]};return{rulebook:de.rulebook,errors:[]}}function Ne(G){return S(G)?N(G).name:G}function cb(G){return S(G)?`run ${Wu} to vendor ${G}`:"create that file or remove that source from the rules config"}function ub(G,U){try{return{content:r(i(U,G))}}catch(j){if(j instanceof o)return{error:j.message};throw j}}function xe(G){let U;try{U=JSON.parse(G)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:le(U)}}catch(j){return{problem:j instanceof Error?j.message:"invalid rulebook"}}}function db(G,U){return[...new Set([...G?.transparent_wrappers??[],...U?.transparent_wrappers??[]])]}function Yu(G,U){return G.flatMap((j)=>{let K=U[j.name];if(K==="off")return[];if(K&&typeof K==="object")return[{...j,intent:K.intent??j.intent,reason:K.reason}];return[j]})}function ka(G,U,j){return Object.keys(G).filter((K)=>!U.has(K)).map((K)=>`unknown override key "${K}" in ${j}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function fb(G,U,j){return Object.keys(G).filter((K)=>U.has(K)).map((K)=>`project override cannot target user-scoped rule "${K}" in ${j}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Zu(G,U){return U.map((j)=>j.startsWith("Unable to access ")?j:`${G}: ${j}`)}function mb(G,U){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[U],warnings:[],userConfigPath:G.userConfigPath,projectConfigPath:G.projectConfigPath}}function Xu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Rb,readFileSync as _b}from"node:fs";var Ju=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Oa=new Set(Ju.map((G)=>G.id)),z=Ju,pb=new Map(z.map((G)=>[G.id,G.intent]));function xt(G,U){return{id:G,reason:U,intent:pb.get(G)??"manual_only"}}var Ma=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ni={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},gb=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],hb=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Da=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...hb.flatMap((G)=>gb.map((U)=>({id:["secret.home",G.idSlug,U.slice(1)].join("."),category:"Home path",label:[G.label,U].join(""),description:["Blocks home ",G.label,U," credential backup files."].join(""),suffixParts:[...G.directoryParts,[G.basename,U].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Li=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Qu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],yb=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Na=Qu.map((G)=>({id:`secret.variant.${G.slug}.separator`,category:"Variant",label:`${G.label}-* / ${G.label}_*`,description:`Blocks ${G.label} variants with dash or underscore suffixes.`,prefix:G.prefix})),La=Qu.flatMap((G)=>yb.map((U)=>({id:`secret.variant.${G.slug}.${U.slice(1)}`,category:"Variant",label:`${G.label}${U}`,description:`Blocks ${G.label}${U} private credential variants.`,prefix:G.prefix,suffix:U}))),Lo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Wa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((G)=>({id:`secret.ext.${G}`,category:"Extension",label:`.${G}`,description:`Blocks files with the .${G} extension.`,extension:G})),Ga=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Qe=[...Ma,Ni,...Da,...Na,...La,Lo,...Wa,...Ga,...Li].map((G)=>({id:G.id,category:G.category,label:G.label,...G.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in G?{paths:G.paths}:{description:G.description}})),Wi=new Set(Li.flatMap((G)=>G.category==="Coding CLI config"?[G.id]:[])),Fa=new Set(Qe.map((G)=>G.id));import{isAbsolute as za,join as bb,normalize as Cb,sep as Gi}from"node:path";var Fi=process.platform==="win32",ed=/[*?]/;function Ba(G){let U=G.trim(),j=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Fi?U.replaceAll("\\","/"):U);if(!j)return null;let K=j[1]??"",re=j[2]??"";if(ed.test(K)||re==="."||re==="..")return null;return{root:K||"/",name:re}}function Wo(G,U){if(G==="~")return U;if(G.startsWith("~/"))return`${U}${G.slice(1)}`;return G}function $a(G,U){if(typeof G!=="string"||G.trim()==="")return"must be a non-empty path string";let j=Wo(G.trim(),U);if(!za(j))return"must be an absolute path or start with ~/";return Go(j,U)}function Ua(G,U){let j=td(G,U);if(j===null)return"must be a non-empty path string";if(!za(j))return null;if(Go(j,U)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Sb="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",vb="cannot cover the guard's own configuration";function td(G,U){if(typeof G!=="string"||G.trim()==="")return null;let j=G.trim(),K=Fi?j.replaceAll("\\","/"):j;return Wo(K.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),U)}function Ha(G,U){let j=td(G,U);if(j===null)return"must be a non-empty path string";let K=Ba(j)?.root??j;if(ed.test(K))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!za(K))return null;if(Go(K,U)!==null)return Sb;return Eb(K,U)?vb:null}function Eb(G,U){let j=zi(G),K=zi(bb(U,".cc-safety-net"));return j===K||j.startsWith(`${K}${Gi}`)}function Go(G,U){let j=zi(G),K=zi(U);if(j===K)return"cannot be the home directory";let re=j.endsWith(Gi)?j:`${j}${Gi}`;if(K.startsWith(re))return"cannot contain the home directory";return null}function zi(G){let U=Cb(G);if(Fi)U=U.replace(/\//g,"\\").toLowerCase();if(U.length>(Fi?3:1)&&U.endsWith(Gi))U=U.slice(0,-1);return U}var nd=30,Bi=1,$i=365;function rd(G){if(typeof G!=="number"||!Number.isInteger(G))return 30;if(G<1)return 1;return G>365?365:G}var od=new Set(z.filter((G)=>G.catastrophic).map((G)=>G.id));function wt(G,U){if(!G)return null;if(od.has(G.id))return G;if(U?.destructiveCommandProtectionEnabled===!1)return null;let j=U?.effectiveDestructiveCommandRules[G.id];return j&&!j.enabled?null:G}function Zt(G,U,j){if(od.has(U))return!0;if(G?.destructiveCommandProtectionEnabled===!1)return!1;return G?.effectiveDestructiveCommandRules[U]?.enabled??j}function V(G,U){return Object.freeze(Object.fromEntries(z.map((j)=>{let K=j.activationCapability?U[j.activationCapability]:void 0,re=K?.enabled??!0,oe=G.destructiveCommandRuleOverrides[j.id],de=j.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...oe?{override:oe}:{}}:G.destructiveCommandProtectionEnabled?oe?{enabled:oe==="on",inheritedEnabled:re,changesInherited:oe==="on"!==re,source:"rule_override",...j.activationCapability?{activationCapability:j.activationCapability}:{},override:oe}:{enabled:re,inheritedEnabled:re,changesInherited:!1,source:K?.source??"built_in_default",...j.activationCapability?{activationCapability:j.activationCapability}:{}}:{enabled:!1,inheritedEnabled:re,changesInherited:!1,source:"master_disabled",...j.activationCapability?{activationCapability:j.activationCapability}:{},...oe?{override:oe}:{}};return[j.id,Object.freeze(de)]})))}function id(G,U){return Object.freeze({...G,effectiveDestructiveCommandRules:V(G,U)})}var sd={standard:0,strict:1,paranoid:2};function ee(G,U,j=!1,K=G.safety.level){let re=xb(G,U,K),oe=new Set(j?re.map((ft)=>ft.field):[]),de=(ft,pt)=>oe.has(ft)?void 0:pt,Se=(ft,pt)=>Object.fromEntries(Object.entries(pt??{}).filter(([mt])=>!oe.has(`${ft}.${mt}`))),we=(ft,pt)=>pt?.filter((mt)=>!oe.has(`${ft}.${mt}`));return{policy:{version:1,safety:{level:de("safety.level",U.safety?.level)??G.safety.level,overrides:{...G.safety.overrides,...Se("safety.overrides",U.safety?.overrides)}},workflow:{worktree_mode:de("workflow.worktree_mode",U.workflow?.worktree_mode)??G.workflow.worktree_mode},destructive_command_protection:{enabled:de("destructive_command_protection.enabled",U.destructive_command_protection?.enabled)??G.destructive_command_protection.enabled,overrides:{...G.destructive_command_protection.overrides,...Se("destructive_command_protection.overrides",U.destructive_command_protection?.overrides)},allow_paths:ja(G.destructive_command_protection.allow_paths,we("destructive_command_protection.allow_paths",U.destructive_command_protection?.allow_paths))},secret_protection:{enabled:de("secret_protection.enabled",U.secret_protection?.enabled)??G.secret_protection.enabled,overrides:{...G.secret_protection.overrides,...Se("secret_protection.overrides",U.secret_protection?.overrides)},deny_paths:ja(G.secret_protection.deny_paths,U.secret_protection?.deny_paths),allow_paths:ja(G.secret_protection.allow_paths,we("secret_protection.allow_paths",U.secret_protection?.allow_paths))},audit:G.audit},weakenings:re.map((ft)=>ft.message)}}function ja(G,U){return[...new Set([...G,...U??[]])]}function xb(G,U,j){let K=U.safety?.level,re=_i[j];return[...K&&sd[K]<sd[G.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${G.safety.level} -> ${K}`}]:[],...qr.flatMap((oe)=>U.safety?.overrides?.[oe]===!1&&(G.safety.overrides[oe]??re[oe])?[{field:`safety.overrides.${oe}`,message:`project policy disables ${oe}`}]:[]),...U.workflow?.worktree_mode===!0&&!G.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...U.destructive_command_protection?.enabled===!1&&G.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...U.secret_protection?.enabled===!1&&G.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...ad("destructive_command_protection.overrides",U.destructive_command_protection?.overrides,(oe)=>G.destructive_command_protection.enabled&&G.destructive_command_protection.overrides[oe]!=="off"),...ad("secret_protection.overrides",U.secret_protection?.overrides,(oe)=>G.secret_protection.enabled&&(G.secret_protection.overrides[oe]==="on"?!0:G.secret_protection.overrides[oe]!=="off"&&!Wi.has(oe))),...G.destructive_command_protection.enabled?ld(G.destructive_command_protection.allow_paths,U.destructive_command_protection?.allow_paths).map((oe)=>({field:`destructive_command_protection.allow_paths.${oe}`,message:`project policy adds destructive allow path: ${oe}`})):[],...G.secret_protection.enabled?ld(G.secret_protection.allow_paths,U.secret_protection?.allow_paths).map((oe)=>({field:`secret_protection.allow_paths.${oe}`,message:`project policy adds secret allow path: ${oe}`})):[]]}function ad(G,U,j){return Object.entries(U??{}).flatMap(([K,re])=>re==="off"&&j(K)?[{field:`${G}.${K}`,message:`project policy disables rule ${K}`}]:[])}function ld(G,U){return(U??[]).filter((j)=>!G.includes(j))}var qa=new Set(["standard","strict","paranoid"]),te={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:nd}};function fd(G,U){let j=kb(l(G,U),G.home),K=L(G,U)?{exists:!1,policy:M(),errors:[]}:Fe(h(U.cwd),G.home),re=ue(K.parsed,G.home),oe=x(n.projectTightenOnly,G.env),de=j.gui??te,Se=Object.keys(re.policy).length>0?ee(de,re.policy,oe,vu(de.safety.level,G.env)):void 0,we=[...j.errors,...K.errors,...re.diagnostics],We=(j.fallback==="defaults"&&Se?"salvaged":j.fallback)??(j.gui?void 0:K.fallback)??(we.length>0?"salvaged":void 0),ft=re.policy.safety?.level&&Se?.policy.safety.level===re.policy.safety.level?"project":j.levelPresent?"user":"default";return{...Se?Ka(Se.policy):j.policy,errors:we,...We?{fallback:We}:{},...K.exists?{policyScopes:{levelScope:ft,weakenings:Se?.weakenings??[],weakeningsIgnored:oe}}:{}}}var wb="project policy audit settings are ignored; audit is user scope only";function ue(G,U){if(!vn(G))return{policy:{},diagnostics:[]};let j=vn(G.safety)?G.safety:{},K=vn(G.workflow)?G.workflow:{},re=vn(G.destructive_command_protection)?G.destructive_command_protection:{},oe=vn(G.secret_protection)?G.secret_protection:{},de={...qa.has(j.level)?{level:j.level}:{},...vn(j.overrides)?cd({overrides:md(j.overrides,qr,["safety","overrides"],wr)}):{}},Se={...typeof re.enabled==="boolean"?{enabled:re.enabled}:{},...re.overrides!==void 0?{overrides:Ui(re.overrides,Oa,gd,wr)}:{},...re.allow_paths!==void 0?{allow_paths:Jr(re.allow_paths,$a,U,["destructive_command_protection","allow_paths"],wr)}:{}},we={...typeof oe.enabled==="boolean"?{enabled:oe.enabled}:{},...oe.overrides!==void 0?{overrides:Ui(oe.overrides,Fa,hd,wr)}:{},...oe.deny_paths!==void 0?{deny_paths:Jr(oe.deny_paths,Ua,U,["secret_protection","deny_paths"],wr)}:{},...oe.allow_paths!==void 0?{allow_paths:Jr(oe.allow_paths,Ha,U,["secret_protection","allow_paths"],wr)}:{}};return{policy:cd({safety:de,workflow:typeof K.worktree_mode==="boolean"?{worktree_mode:K.worktree_mode}:{},destructive_command_protection:Se,secret_protection:we}),diagnostics:G.audit===void 0?[]:[wb]}}function md(G,U,j,K){return Object.fromEntries(U.flatMap((re)=>{let oe=G[re];if(typeof oe==="boolean")return[[re,oe]];if(oe!==void 0)K(e([...j,re],Ya));return[]}))}function cd(G){return Object.fromEntries(Object.entries(G).flatMap((U)=>Object.keys(U[1]).length>0?[U]:[]))}var wr=()=>{return},Ya="must be a boolean",Za="must be an object if provided",pd=`must be an integer between ${Bi} and ${$i}`,gd={path:["destructive_command_protection","overrides"],label:"destructive command"},hd={path:["secret_protection","overrides"],label:"secret protection"},et=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function tt(G,U){let j=[];return{policy:yd(G,U,(re)=>{j.push(re)}),issues:j}}function C(G,U){return yd(G,U,wr)}function yd(G,U,j){if(!vn(G))return j(e([],"Config must be an object")),M();if(G.version!==1)j(e(["version"],"must be 1"));let K=Xr(G.safety,["safety"],["level","overrides"],j),re=Xr(K.overrides,["safety","overrides"],qr,j),oe=Xr(G.workflow,["workflow"],["worktree_mode"],j),de=Xr(G.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],j),Se=Xr(G.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],j),we=Xr(G.audit,["audit"],["retention_days"],j);return bd(G,et,[],j),{version:1,safety:{level:Pb(K.level,j),overrides:md(re,qr,["safety","overrides"],j)},workflow:{worktree_mode:Va(oe.worktree_mode,["workflow","worktree_mode"],!1,j)},destructive_command_protection:{enabled:Va(de.enabled,["destructive_command_protection","enabled"],!0,j),overrides:Ui(de.overrides,Oa,gd,j),allow_paths:Jr(de.allow_paths,$a,U,["destructive_command_protection","allow_paths"],j)},secret_protection:{enabled:Va(Se.enabled,["secret_protection","enabled"],!0,j),overrides:Ui(Se.overrides,Fa,hd,j),deny_paths:Jr(Se.deny_paths,Ua,U,["secret_protection","deny_paths"],j),allow_paths:Jr(Se.allow_paths,Ha,U,["secret_protection","allow_paths"],j)},audit:{retention_days:Ab(we.retention_days,j)}}}function Xr(G,U,j,K){if(G===void 0)return{};if(!vn(G))return K(e(U,Za)),{};return bd(G,j,U,K),G}function bd(G,U,j,K){for(let re of Object.keys(G).filter((oe)=>!U.includes(oe)))K({path:j,message:re,kind:"unknownKeys"})}function Pb(G,U){if(G===void 0)return"standard";if(qa.has(G))return G;return U(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Va(G,U,j,K){if(typeof G==="boolean")return G;if(G!==void 0)K(e(U,Ya));return j}function Ab(G,U){if(!(G===void 0||typeof G==="number"&&Number.isInteger(G)&&G>=Bi&&G<=$i))U(e(["audit","retention_days"],pd));return rd(G)}function Ui(G,U,j,K){if(G===void 0)return{};if(!vn(G))return K(e(j.path,Za)),{};return Object.fromEntries(Object.entries(G).flatMap(([re,oe])=>{if(!U.has(re))return K({path:[...j.path,re],message:`unknown ${j.label} rule id "${re}"`,kind:"key"}),[];if(oe==="on"||oe==="off")return[[re,oe]];return K(e([...j.path,re],'must be "on" or "off"')),[]}))}function Jr(G,U,j,K,re){if(G===void 0)return[];if(!Array.isArray(G))return re(e(K,"must be an array of paths")),[];return G.flatMap((oe,de)=>{let Se=U(oe,j);if(Se===null)return[oe];return re(typeof oe==="string"?en([...K,de],Se):e([...K,de],Se)),[]})}function vn(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function M(){return structuredClone(te)}function Le(G,U){let j=T({safety:$e(G.safety)},U),K=V({destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides},j.capabilities),re=Object.values(K),oe=re.filter((de)=>de.source!=="catastrophic");return{selectedPreset:G.safety.level,effectiveLevel:j.effectiveLevel,capabilities:j.capabilities,rules:K,counts:{enabled:oe.filter((de)=>de.enabled).length,disabled:oe.filter((de)=>!de.enabled).length,effectiveCustomizations:re.filter((de)=>de.changesInherited).length}}}function Fe(G,U){if(!Rb(G))return{exists:!1,policy:M(),errors:[]};try{let j=_b(G,"utf-8");if(!j.trim())return{exists:!0,policy:M(),errors:[`${G}: Config file is empty`],fallback:"defaults"};let K=JSON.parse(j),re=tt(K,U);if(re.issues.length===0)return{exists:!0,parsed:K,policy:re.policy,errors:[]};return{exists:!0,parsed:K,policy:re.policy,errors:re.issues.map((oe)=>`${G}: ${Ib(oe)}`),fallback:vn(K)?"salvaged":"defaults"}}catch(j){let K=j instanceof Error?j.message:String(j);return{exists:!0,policy:M(),errors:[`${G}: ${j instanceof SyntaxError?"Invalid JSON":K}`],fallback:"defaults"}}}var Tb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Za,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ya,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[pd,`not an integer between ${Bi} and ${$i}`]]);function Ib(G){let U=Ta(G.path);if(G.kind==="unknownKeys")return`${U===""?"":`${U}.`}${G.message}: unknown field`;if(G.kind==="key")return`${U}: unknown rule id`;let j=Tb.get(G.message)??G.message;return U===""?j:`${U}: ${j}`}function kb(G,U){let j=Fe(G,U);if(!j.exists){let K=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!vn(K))return{policy:dd(),errors:[]};let re=C(K,U);return{policy:Ka(re),gui:re,errors:[],levelPresent:ud(K)}}if(j.parsed===void 0)return{policy:dd(),errors:j.errors,...j.fallback?{fallback:j.fallback}:{}};return{policy:Ka(j.policy),gui:j.policy,errors:j.errors,...j.fallback?{fallback:j.fallback}:{},levelPresent:ud(j.parsed)}}function ud(G){let U=vn(G)&&vn(G.safety)?G.safety:{};return qa.has(U.level)}function Me(G){let U=Object.entries(G),j=new Set(U.flatMap(([K,re])=>re==="on"?[K]:[]));return[...new Set([...[...Wi].filter((K)=>!j.has(K)),...U.flatMap(([K,re])=>re==="off"?[K]:[])])]}function dd(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Me({}),denyPaths:[],allowPaths:[]}}}function Ka(G){return{safety:$e(G.safety),worktreeMode:G.workflow.worktree_mode,destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides,destructiveCommandAllowPaths:G.destructive_command_protection.allow_paths,secretProtection:{enabled:G.secret_protection.enabled,disabledRules:Me(G.secret_protection.overrides),denyPaths:G.secret_protection.deny_paths,allowPaths:G.secret_protection.allow_paths}}}function $e(G){let U={...G.overrides.fail_closed!==void 0?{failClosed:G.overrides.fail_closed}:{},...G.overrides.paranoid_rm!==void 0?{paranoidRm:G.overrides.paranoid_rm}:{},...G.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:G.overrides.paranoid_interpreters}:{}};return{level:G.level,...Object.keys(U).length>0?{overrides:U}:{}}}function E(G,U){let j=Q(G,U),K=fd(G,U),re={rules:j.rules,transparentWrappers:j.transparent_wrappers,safety:K.safety,worktreeMode:K.worktreeMode,destructiveCommandProtectionEnabled:K.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:K.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:K.destructiveCommandAllowPaths,secretProtection:{enabled:K.secretProtection.enabled??!0,disabledRules:K.secretProtection.disabledRules??[],denyPaths:K.secretProtection.denyPaths,allowPaths:K.secretProtection.allowPaths??[]}},oe={...j.userConfig?.overrides,...j.projectConfig?.overrides},de=Object.freeze(Object.fromEntries(re.rules.map((Se)=>{let we=j.rulebooks.find((ft)=>ft.rules.includes(Se.name)),We=oe[Se.name];return[Se.name,Object.freeze({id:Se.name,...we?{rulebook:Object.freeze({name:we.name,version:we.version}),...Nb(we.spec)?{source:we.spec}:{}}:{},...We&&typeof We==="object"?{override:Object.freeze({type:"reason",reason:We.reason})}:{}})]})));return _e(re,Ob(j,K),de,K.policyScopes)}function je(G){if(G.state==="ready")return{state:G.state};return{state:G.state,reason:G.reason}}function Ob(G,U){let j=Db(U);if(G.errors.length===0&&G.warnings.length===0&&!j)return;return{diagnostics:[...G.errors,...G.warnings,...U.errors],reason:Lb(G.errors.length>0?Mb(G.errors):void 0,G.warnings.length>0?Ja(G.warnings.join("; ")):void 0,j)}}function Mb(G){return`${Ja(G.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Db(G){if(G.errors.length===0)return;let U=G.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${G.errors.join("; ")}. Enforcing ${U}; the invalid values are not active. Fix the policy file manually`}function Nb(G){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(G)}function _e(G,U,j=Object.freeze({}),K){let re=Xa(structuredClone(G)),oe=K?{policyScopes:Xa(structuredClone(K))}:{};if(!U)return Object.freeze({state:"ready",policy:re,diagnostics:Object.freeze([]),ruleMetadata:j,...oe});return Object.freeze({state:"degraded",policy:re,diagnostics:Object.freeze([...U.diagnostics]),reason:U.reason,ruleMetadata:j,...oe})}function Xa(G){if(typeof G!=="object"||G===null)return G;for(let U of Object.values(G))Xa(U);return Object.freeze(G)}function Lb(...G){return Ja(G.filter((U)=>!!U).join("; "))}function Ja(G){return/[.!?]$/.test(G)?G:`${G}.`}function Ue(G){let U=G.effectiveCapabilities,j=G.strict??U.fail_closed.enabled,K=G.paranoidRm??U.paranoid_rm.enabled,re=G.paranoidInterpreters??U.paranoid_interpreters.enabled,oe={fail_closed:Qa(U.fail_closed,G.strict,"strict"),paranoid_rm:Qa(U.paranoid_rm,G.paranoidRm,"paranoidRm"),paranoid_interpreters:Qa(U.paranoid_interpreters,G.paranoidInterpreters,"paranoidInterpreters")};return{policy:id(G.policySnapshot.policy,oe),effectiveCapabilities:oe,effectiveLevel:ha({failClosed:j,paranoidRm:K,paranoidInterpreters:re}),strict:j,paranoidRm:K,paranoidInterpreters:re,worktreeMode:G.worktreeMode??!1}}function Qa(G,U,j){if(U===void 0||U===G.enabled)return G;return{enabled:U,source:"capability_override",sources:[...G.sources,`analysis options.${j}`]}}import{dirname as Y_,isAbsolute as Z_,join as X_,parse as J_,resolve as Q_,sep as ew}from"node:path";function Fo(G,U){if(G!=="powershell")return U[0]?.provenance==="command-substitution";let j=U[0]?.text==="&"||U[0]?.text==="."?1:0,K=U[j]?.provenance;return K!==void 0&&K!=="literal"}var Wb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hi(G,U){return G?.provenance==="literal"&&!G.quoted&&G.raw===U&&G.text===U}function zo(G){let U=Hi(G.words[0],"time")?1:0,j=U===1&&Hi(G.words[U],"-p")?U+1:U,K=U===1&&Hi(G.words[j],"--")?j+1:j,re=Hi(G.words[K],"!")?K+1:K,oe=G.words.slice(re).find((de)=>!Wb.test(de.text));return oe?.provenance==="literal"?oe.text:void 0}var lr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function ji(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Gb(G){return Object.freeze({...G,span:Object.freeze(G.span),words:Object.freeze(G.words),redirections:Object.freeze(G.redirections.map((U)=>Object.freeze({...U,span:Object.freeze(U.span),...U.heredoc?{heredoc:Object.freeze({...U.heredoc,bodySpan:Object.freeze(U.heredoc.bodySpan),terminatorSpan:Object.freeze(U.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(G.nested.map((U)=>un(U)))})}function Vi(G,U,j){G.push(j),U.reset()}function Ki(G){let U=[];return{parts:U,push:(j,K,re)=>{if(K<=j)return;U.push({raw:G.slice(j,K),span:{start:j,end:K},provenance:re})}}}function el(G){let U=G.parts??[{raw:G.raw,span:G.span,provenance:G.provenance}];return Object.freeze({kind:"word",...G,span:Object.freeze(G.span),parts:Object.freeze(U.map((j)=>Object.freeze({...j,span:Object.freeze(j.span)})))})}function Qr(G,U,j,K,re,oe,de){return el({text:K,raw:G.slice(U,j),span:{start:U,end:j},provenance:re,quoted:oe,...de?{parts:de}:{}})}function un(G){return Object.freeze({...G,span:Object.freeze(G.span),issues:Object.freeze(G.issues.map((U)=>Object.freeze({...U}))),nodes:Object.freeze(G.nodes.map((U)=>{if(U.kind==="command")return Gb(U);if(U.kind==="group"||U.kind==="function")return Object.freeze({...U,span:Object.freeze(U.span),body:un(U.body)});return Object.freeze({...U,span:Object.freeze(U.span)})}))})}function tl(G,U,j){if(U>=j||Sd(G[U]??""))return null;let K="",re=!1,oe=!1,de=U;while(de<j&&!Sd(G[de]??"")){let Se=G[de]??"";if(Se==="'"){re=!0;let we=Cd(G,de+1,j,"'");K+=we.text,oe||=!we.closed,de=we.next;continue}if(Se==='"'){re=!0;let we=Cd(G,de+1,j,'"');K+=we.text,oe||=!we.closed,de=we.next;continue}if(Se==="\\"){re=!0;let we=G[de+1];if(!we||we===`
-`||we==="\r"){oe=!0;break}K+=we,de+=2;continue}if(Se==="`"||G.startsWith("$(",de)||G.startsWith("${",de)||G.startsWith("<(",de)||G.startsWith(">(",de))oe=!0;K+=Se,de++}return{delimiter:K,quoted:re,next:de,ambiguous:oe}}function nl(G,U,j,K){let re=[],oe=U;for(let de of K){let Se=oe,we=!1;while(oe<j){let We=Fb(G,oe,j);if((de.stripTabs?We.text.replace(/^\t+/,""):We.text)===de.delimiter){de.attach({body:de.stripTabs?zb(G.slice(Se,oe)):G.slice(Se,oe),delimiter:de.delimiter,quotedDelimiter:de.quotedDelimiter,bodySpan:{start:Se,end:oe},terminatorSpan:{start:oe,end:We.contentEnd}}),oe=We.next,we=!0;break}if(We.next<=oe)break;oe=We.next}if(we)continue;return re.push({code:"unterminated-heredoc",message:`heredoc delimiter ${de.delimiter} was not found`}),{next:j,issues:re,terminated:!1}}return{next:oe,issues:re,terminated:!0}}function Cd(G,U,j,K){let re="",oe=U;while(oe<j&&G[oe]!==`
-`&&G[oe]!=="\r"){let de=G[oe]??"";if(de===K)return{text:re,next:oe+1,closed:!0};if(K==='"'&&de==="\\"&&G[oe+1]){let Se=G[oe+1]??"";re+=["$","`",'"',"\\"].includes(Se)?Se:`\\${Se}`,oe+=2;continue}re+=de,oe++}return{text:re,next:oe,closed:!1}}function Sd(G){return G!=="\r"&&(/[\s;&|<>)]/u.test(G)||G==="`")}function Fb(G,U,j){let K=U;while(K<j&&G[K]!==`
-`)K++;let re=K>=j?j:K+1;return{text:G.slice(U,K),contentEnd:K,next:re}}function zb(G){return G.replace(/(^|\r\n?|\n)\t+/g,"$1")}var _d=new Set(["&&","||","|","|&"]),Bb=new Set(["!","do","elif","else","if","then","until","while"]);function wd(G,U){let j={start:0,end:G.length};if(G.length>U.maxInputLength)return un({kind:"program",dialect:"posix",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${U.maxInputLength} UTF-16 code units`}],nodes:[]});let K={wordsUsed:0,maxWords:U.maxWords,quotedExpansionEnd:1/0},re=Zi(G,0,G.length,U,K,0),oe=Zb(G,K.quotedExpansionEnd,re.nodes)?[...re.issues,Td]:re.issues;return un({kind:"program",dialect:"posix",source:G,span:j,status:Ji(oe,re.limited),issues:oe,nodes:re.nodes})}function Zi(G,U,j,K,re,oe,de){let Se=[],we=[],We=ji(),ft=[],pt=()=>{if(We.words.length===0&&We.redirections.length===0)return;let gt={start:We.start,end:We.end},yt=We.words.map((ht)=>ht.text);Vi(Se,We,{kind:"command",dialect:"posix",source:G.slice(gt.start,gt.end),span:gt,words:We.words,redirections:We.redirections,nested:We.nested,displayText:we.length>0&&Se.length===0?G.slice(U,j):yt.join(" ")})},mt=U;while(mt<j){let gt=G[mt];if(!gt)break;if(de&&gt===de)return pt(),Rd(Se,we),{nodes:Se,issues:we,next:mt+1,closed:!0,limited:!1,pendingHeredocs:ft};if($o(gt)){if(gt===`
-`||gt==="\r"){pt();let Tt=gt==="\r"&&G[mt+1]===`
-`?mt+2:mt+1,It=Se.at(-1);if(It?.kind!=="connector"||!_d.has(It.operator))Se.push(Object.freeze({kind:"connector",operator:G.slice(mt,Tt),span:Object.freeze({start:mt,end:Tt})}));if(ft.length>0){let kt=nl(G,Tt,j,ft.splice(0));we.push(...kt.issues),mt=kt.next;continue}mt=Tt;continue}mt++;continue}if(gt==="#"){while(mt<j&&G[mt]!==`
-`&&G[mt]!=="\r")mt++;continue}let yt=We.start===-1?pC(G,mt,j):void 0;if(yt){if(ol(Se,we),oe>=K.maxDepth)return eo(Se,we,mt,"depth-limit",K.maxDepth);if(!rl(re))return eo(Se,we,mt,"word-limit",K.maxWords);let Tt=Zi(G,yt.braceIndex+1,j,K,re,oe+1,"}"),It=Tt.next,kt={start:yt.braceIndex+1,end:Tt.closed?It-1:It},Gt=vd(G,kt,Tt);if(Se.push({kind:"function",name:yt.name,span:{start:mt,end:It},body:Gt}),we.push(...Tt.issues),Tt.pendingHeredocs.length>0||Uo(Tt.nodes))we.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ft.push(...Tt.pendingHeredocs),Tt.limited)return Yi(Se,we,Tt.next);if(!Tt.closed)we.push({code:"unclosed-function-body",message:"function body is not closed"});mt=It;continue}let ht=Xi(G,mt);if(ht){if(pt(),!Ld(Se.at(-1)))we.push({code:"unexpected-connector",message:`connector ${ht} has no preceding command`});Se.push(Object.freeze({kind:"connector",operator:ht,span:Object.freeze({start:mt,end:mt+ht.length})})),mt+=ht.length;continue}if(gt===")"){pt(),we.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Se.push({kind:"unknown",source:gt,span:{start:mt,end:mt+1}}),mt++;continue}if((gt==="("||gt==="{"&&tC(G,mt,j))&&We.start===-1){if(ol(Se,we),oe>=K.maxDepth)return eo(Se,we,mt,"depth-limit",K.maxDepth);let Tt=gt==="("?")":"}",It=Zi(G,mt+1,j,K,re,oe+1,Tt),kt=It.next,Gt={start:mt+1,end:It.closed?kt-1:kt},an=vd(G,Gt,It);if(Se.push({kind:"group",style:gt==="("?"subshell":"brace",span:{start:mt,end:kt},body:an}),we.push(...It.issues),It.pendingHeredocs.length>0||Uo(It.nodes))we.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ft.push(...It.pendingHeredocs),It.limited)return Yi(Se,we,It.next);if(!It.closed)we.push({code:gt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${gt} group is not closed`});mt=kt;continue}let bt=(gt==="<"||gt===">")&&G[mt+1]!=="("?jb(G,mt):null;if(bt){let Tt=We.words.at(-1),It=Tt&&Tt.span.end===mt&&/^[0-9]+$/.test(Tt.raw)?Number(Tt.raw):void 0;if(It!==void 0)We.words.pop();let kt=It===void 0?mt:Tt?.span.start??mt;We.start=We.start===-1?mt:We.start;let Gt=mt+bt.length;while(Gt<j&&/[ \t]/.test(G[Gt]??""))Gt++;let an=G[Gt],Vn=Gt>mt+bt.length&&an==="#",hn=!an||$o(an)||!!Xi(G,Gt)||an===de||an===")"||Vn||(an==="<"||an===">")&&G[Gt+1]!=="(",Cr=bt==="<<"||bt==="<<-",Bt=Cr?tl(G,Gt,j):void 0,Lt=Bt?{word:Qr(G,Gt,Bt.next,Bt.delimiter,"literal",Bt.quoted),nested:[],issues:[],next:Bt.next,limited:!1}:!hn?il(G,Gt,j,K,re,oe):void 0;if(Lt){if(we.push(...Lt.issues),Lt.limited)return Yi(Se,we,Lt.next);if(!rl(re))return eo(Se,we,Lt.next,"word-limit",K.maxWords)}let on=Lt?.next??mt+bt.length,qt={kind:"redirection",operator:bt,span:{start:kt,end:on},...It===void 0?{}:{fd:It},...Lt?{target:Lt.word}:{}};if(We.redirections.push(qt),Cr&&!Bt)we.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Bt){if(Bt.ambiguous||Bt.delimiter.length===0)we.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Yt=We.nested;ft.push({delimiter:Bt.delimiter,quotedDelimiter:Bt.quoted,stripTabs:bt==="<<-",attach:(yn)=>{if(qt.heredoc=yn,yn.quotedDelimiter)return;let or=Ub(G,yn.bodySpan.start,yn.bodySpan.end,K,re,oe+1);Yt.push(...or.programs),we.push(...or.issues)}})}if(!Cr&&!Lt)we.push({code:"missing-redirection-target",message:`redirection ${bt} requires a target word`});if(Lt)We.nested.push(...Lt.nested);We.end=on,mt=on;continue}let Ct=We.start===-1;if(Ct)ol(Se,we);let vt=il(G,mt,j,K,re,oe);if(we.push(...vt.issues),vt.limited)return Yi(Se,we,vt.next);let St=oC(We.words)?cC(G,vt.word,re.maxWords-re.wordsUsed,K.maxDepth,K.maxInputLength):void 0;if(St?.limitCode)return eo(Se,we,vt.next,St.limitCode,St.limitCode==="word-limit"?K.maxWords:St.limitCode==="depth-limit"?K.maxDepth:K.maxInputLength);let Rt=St?.words??[vt.word];for(let Tt of Rt){if(!rl(re))return eo(Se,we,vt.next,"word-limit",K.maxWords);We.words.push(Tt)}if(We.start=We.start===-1?mt:We.start,We.end=vt.next,We.nested.push(...vt.nested),Ct&&Wd(vt.word))pt();mt=vt.next>mt?vt.next:mt+1}return pt(),Rd(Se,we),we.push(...gC(ft)),{nodes:Se,issues:we,next:mt,closed:de===void 0,limited:!1,pendingHeredocs:[]}}function vd(G,U,j){return{kind:"program",dialect:"posix",source:G.slice(U.start,U.end),span:U,status:Ji(j.issues,j.limited),issues:j.issues,nodes:j.nodes}}function il(G,U,j,K,re,oe){let de="",Se=U,we=!1,We="literal",ft=[],pt=[],mt=!1;while(Se<j){let gt=G[Se],yt=(gt==="<"||gt===">")&&G[Se+1]==="(";if(!gt||$o(gt)||(gt===";"||gt==="|"||gt==="&")&&Xi(G,Se)||(gt==="<"||gt===">")&&!yt)break;if(gt===")")break;if(gt==="'"){we=!0;let Ct=G.indexOf("'",Se+1);if(Ct===-1||Ct>=j){de+=G.slice(Se+1,j),pt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Se=j;break}de+=G.slice(Se+1,Ct),Se=Ct+1;continue}if(gt==='"'){we=!0;let Ct=$b(G,Se,j,K,re,oe);if(de+=Ct.text,ft.push(...Ct.nested),pt.push(...Ct.issues),mt||=Ct.limited,We=Bo(We,Ct.provenance),Se=Ct.next,mt)break;continue}if(G.startsWith("$'",Se)){we=!0;let Ct=Jb(G,Se+2,j);if(de+=Ct.text,pt.push(...Ct.issues),!Ct.closed)pt.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Se=Ct.next;continue}if(gt==="\\"){let Ct=G[Se+1];if(!Ct){pt.push({code:"trailing-escape",message:"escape has no following character"}),Se++;break}if(Ct===`
-`){Se+=2;continue}de+=Ct,Se+=2;continue}if(Ar(G,Se))pt.push(Pr);let ht=gt==="$"||gt==="<"||gt===">"||gt==="`"?Ho(G,Se,j,K,re,oe):null,bt=ht?al(ht,ft,pt):Id(G,Se,j,K,re,oe,ft,pt);if(bt){if(bt.provenance==="variable")de+=G.slice(Se,bt.next);if(mt||=bt.limited,We=Bo(We,bt.provenance),Se=bt.next,mt)break;continue}if(gt==="$"){let Ct=Od(G,Se,j,de,We);de=Ct.text,We=Ct.provenance,Se=Ct.next;continue}if(gt==="*"||gt==="?"||gt==="[")We=Bo(We,"glob");de+=gt,Se++}return{word:Qr(G,U,Se,de,We,we,We==="literal"?void 0:eC(G,U,Se)),nested:ft,issues:pt,next:Se,limited:mt}}function $b(G,U,j,K,re,oe){let de="",Se="literal",we=[],We=[],ft=!1,pt=U+1;while(pt<j){let mt=G[pt];if(mt==='"')return{text:de,provenance:Se,nested:we,issues:We,next:pt+1,limited:ft};if(mt==="\\"&&G[pt+1]){let ht=G[pt+1]??"";if(ht===`
-`){pt+=2;continue}if(ht==="\r"&&G[pt+2]===`
-`){pt+=3;continue}de+=["$","`",'"',"\\"].includes(ht)?ht:`\\${ht}`,pt+=2;continue}if(Ar(G,pt))We.push(Pr);let gt=Ho(G,pt,j,K,re,oe),yt=gt?al(gt,we,We):Id(G,pt,j,K,re,oe,we,We);if(yt){if(yt.provenance!=="command-substitution")de+=G.slice(pt,yt.next);if(pt=yt.next,ft||=yt.limited,Se=Bo(Se,yt.provenance),ft)return{text:de,provenance:Se,nested:we,issues:We,next:pt,limited:ft};continue}if(mt==="$"){let ht=Od(G,pt,j,de,Se);de=ht.text,Se=ht.provenance,pt=ht.next;continue}de+=mt??"",pt++}return We.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:de,provenance:Se,nested:we,issues:We,next:j,limited:ft}}function Ho(G,U,j,K,re,oe){let de=Ad(G,U);if(!de)return null;let{length:Se,closing:we}=de,We=we==="))",ft=we==="`",pt=G[U]==="<"||G[U]===">",mt=ll(G,U+Se,j,we),gt=mt===-1?j:mt,yt=mt===-1?j:mt+we.length;if(oe>=K.maxDepth)return{program:mC(G,U+Se,gt,"depth-limit"),next:yt,provenance:We?"arithmetic":"command-substitution"};if(We){let Rt=[],Tt=[],It=!1,kt=U+Se;while(kt<gt){let Gt=Ho(G,kt,gt,K,re,oe+1);if(!Gt){if(Ar(G,kt))Tt.push(Pr);kt++;continue}if(Rt.push(...Gt.program.nodes),Tt.push(...Gt.program.issues),It||=Gt.program.status==="limited",kt=Gt.next,It)break}if(mt===-1)Tt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:un({kind:"program",dialect:"posix",source:G.slice(U+Se,gt),span:{start:U+Se,end:gt},status:Ji(Tt,It),issues:Tt,nodes:Rt}),next:yt,provenance:"arithmetic"}}let ht=Zi(G,U+Se,gt,K,re,oe+1),bt=mt===-1?[{code:"unclosed-command-substitution",message:`${G.slice(U,U+Se)} substitution is not closed`}]:[],Ct=(ft||pt)&&Uo(ht.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],vt=ft&&/\\[\\$`\n]/.test(G.slice(U+Se,gt))?[Xb]:[],St=[...ht.issues,...bt,...Ct,...vt];return{program:un({kind:"program",dialect:"posix",source:G.slice(U+Se,gt),span:{start:U+Se,end:gt},status:Ji(St,ht.limited),issues:St,nodes:ht.nodes}),next:yt,provenance:"command-substitution"}}function Ub(G,U,j,K,re,oe){let de=[],Se=[],we=U;while(we<j){let We=G[we];if(We==="\\"){we+=2;continue}let ft=We==="$"||We==="`"?Ho(G,we,j,K,re,oe):null;if(!ft){if(Ar(G,we))Se.push(Pr);we++;continue}if(de.push(ft.program),Vb(G,we,ft.next)&&Kb(ft.program))Se.push(Pr);we=ft.next}return{programs:de,issues:Se}}function al(G,U,j){return U.push(G.program),j.push(...G.program.issues),{provenance:G.provenance,next:G.next,limited:G.program.status==="limited"}}function ll(G,U,j,K){if(K==="`"){for(let Se=U;Se<j;Se++){if(G[Se]==="\\"){Se++;continue}if(G[Se]==="`")return Se}return-1}let re={single:!1,double:!1},oe=[],de=[];for(let Se=U;Se<j;Se++){let we=G[Se];if((we===`
-`||we==="\r")&&de.length>0){let pt=we==="\r"&&G[Se+1]===`
-`?Se+2:Se+1,mt=nl(G,pt,j,de.splice(0));if(!mt.terminated)return-1;Se=mt.next-1;continue}let We=Pd(G,Se,U,j,re);if(We!==null){Se=We;continue}if(!re.double&&G.startsWith("$((",Se)){let pt=Hb(G,Se+3,j);if(pt===-1)return-1;Se=pt+1;continue}if(K===")"&&!re.double&&we==="<"&&G[Se+1]==="<"&&G[Se+2]!=="<"){let pt=G[Se+2]==="-",mt=Se+(pt?3:2);while(mt<j&&/[ \t]/.test(G[mt]??""))mt++;let gt=tl(G,mt,j);if(gt){de.push({delimiter:gt.delimiter,quotedDelimiter:gt.quoted,stripTabs:pt,attach:()=>{return}}),Se=gt.next-1;continue}}if(G.startsWith("$(",Se)&&!G.startsWith("$((",Se)){oe.push(re),re={single:!1,double:!1},Se++;continue}if(we==="("&&!re.double){oe.push(re),re={single:!1,double:!1};continue}if(we!==")"||re.double)continue;let ft=oe.pop();if(ft){re=ft;continue}return K==="))"&&G[Se+1]!==")"?-1:Se}return-1}function Hb(G,U,j){let K=1,re={single:!1,double:!1};for(let oe=U;oe<j;oe++){let de=G[oe],Se=Pd(G,oe,U,j,re);if(Se!==null){oe=Se;continue}if(G.startsWith("$(",oe)&&!G.startsWith("$((",oe)){K++,oe++;continue}if(de==="("&&!re.double)K++;if(de!==")"||re.double)continue;if(K--,K===0)return G[oe+1]===")"?oe:-1}return-1}function Pd(G,U,j,K,re){let oe=G[U];if(oe==="\\"&&!re.single)return U+1;if(!re.double&&oe==="'")re.single=!re.single;if(!re.single&&oe==='"')re.double=!re.double;if(re.single)return U;if(re.double||oe!=="#"||!hC(G,U,j))return null;let de=U;while(de+1<K&&G[de+1]!==`
-`&&G[de+1]!=="\r")de++;return de}function Xi(G,U){let j=G[U];if(j===";")return";";if(j==="&")return G[U+1]==="&"?"&&":"&";if(j==="|")return G[U+1]==="|"?"||":G[U+1]==="&"?"|&":"|";return null}function jb(G,U){let j=G[U];if(j===">"){if(G[U+1]===">")return">>";if(G[U+1]==="&")return">&";return G[U+1]==="|"?">|":">"}if(j!=="<")return null;if(G.startsWith("<<<",U))return"<<<";if(G.startsWith("<<-",U))return"<<-";if(G[U+1]==="<")return"<<";if(G[U+1]==="&")return"<&";if(G[U+1]===">")return"<>";return"<"}function $o(G){let U=G.charCodeAt(0);if(U===32||U>=9&&U<=13)return!0;if(U<128)return!1;return/\s/u.test(G)}var Pr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Ar(G,U){if(G[U]!=="$")return!1;let j=Ed(G,U+1);if(G[j]!=="{")return!1;let K=G[Ed(G,j+1)]??"";return K==="|"||$o(K)}function Vb(G,U,j){for(let K=G.indexOf("$",U);K!==-1&&K<j;K=G.indexOf("$",K+1))if(Ar(G,K))return!0;return!1}function Kb(G){return G?.status==="limited"||(G?.issues??[]).some((U)=>U.code===Pr.code)}function Ed(G,U){let j=U;while(G.startsWith("\\\n",j)||G.startsWith(`\\\r
-`,j))j+=G[j+1]==="\r"?3:2;return j}function Ad(G,U){if(G.startsWith("$((",U))return{length:3,closing:"))"};if(G.startsWith("$(",U)||G.startsWith("<(",U)||G.startsWith(">(",U))return{length:2,closing:")"};return G[U]==="`"?{length:1,closing:"`"}:null}var qb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Td=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),Yb=/\$\(|`|[<>]\(/g;function Zb(G,U,j){let K=sl(j);return[...G.slice(U).matchAll(Yb)].some((re)=>{let oe=U+re.index;return!K.some((de)=>oe>=de.start&&oe<de.end)})}function sl(G){return G.flatMap((U)=>{if(U.kind==="command")return[...U.redirections.flatMap((j)=>j.heredoc?[j.heredoc.bodySpan]:[]),...U.nested.flatMap((j)=>sl(j.nodes))];return U.kind==="group"||U.kind==="function"?sl(U.body.nodes):[]})}var Xb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Id(G,U,j,K,re,oe,de,Se){if(G[U]!=="$"||G[U+1]!=="{")return null;let we=Qi(G,U+2,j),We=we.close===-1?j:we.close+1;if(we.close===-1)Se.push(qb);if(we.quoted&&we.substitutions.length>0||we.continued)Se.push(Td);if(we.quoted)re.quotedExpansionEnd=Math.min(re.quotedExpansionEnd,We);let ft=we.substitutions.some((pt)=>{if(Ar(G,pt))return Se.push(Pr),!1;let mt=Ho(G,pt,We,K,re,oe);return mt!==null&&al(mt,de,Se).limited});return{provenance:"variable",next:We,limited:ft}}function Qi(G,U,j){let K=[],re=!1,oe=!1,de=1,Se=U;while(Se<j){let we=G[Se];if(we==="$"&&Ar(G,Se))K.push(Se);if(we==="\\"||we==="'"||we==='"'){re=!0,oe||=we==="\\"&&G[Se+1]===`
-`,Se+=we==="\\"?2:1;continue}let We=Ad(G,Se);if(We){K.push(Se);let ft=ll(G,Se+We.length,j,We.closing);if(ft===-1)break;Se=ft+We.closing.length;continue}if(we==="$"&&G[Se+1]==="{"){de++,Se+=2;continue}if(we==="}"&&--de===0)return{close:Se,substitutions:K,quoted:re,continued:oe};Se++}return{close:-1,substitutions:K,quoted:re,continued:oe}}function kd(G,U,j){if(G[U+1]==="{"){let re=Qi(G,U+2,j).close;return re===-1?j:re+1}if(G[U+1]==="$")return U+2;let K=U+1;while(K<j&&/[A-Za-z0-9_?@#!*-]/.test(G[K]??""))K++;return K===U+1?U+1:K}function Jb(G,U,j){let K="",re=[],oe=U;while(oe<j){let de=G[oe];if(de==="'")return{text:K,next:oe+1,closed:!0,issues:re};if(de!=="\\"){K+=de??"",oe++;continue}let Se=Qb(G,oe+1,j);if(K+=Se.text,Se.invalidCodePoint!==void 0)re.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Se.invalidCodePoint}`});oe=Se.next}return{text:K,next:j,closed:!1,issues:re}}function Qb(G,U,j){let K=G[U];if(!K||U>=j)return{text:"\\",next:U};let re=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(re.has(K))return{text:re.get(K)??K,next:U+1};if(K==="x")return qi(G,U+1,j,16,2,U+1);if(K==="u")return qi(G,U+1,j,16,4,U+1);if(K==="U")return qi(G,U+1,j,16,8,U+1);if(/[0-7]/.test(K))return qi(G,U,j,8,3,U+1);return{text:K,next:U+1}}function qi(G,U,j,K,re,oe){let de=K===16?/[0-9a-fA-F]/:/[0-7]/,Se="",we=U;while(we<j&&Se.length<re&&de.test(G[we]??""))Se+=G[we],we++;if(!Se)return{text:G[oe-1]??"",next:oe};let We=Number.parseInt(Se,K);return We>1114111||We>=55296&&We<=57343?{text:"�",next:we,invalidCodePoint:We}:{text:String.fromCodePoint(We),next:we}}function Ji(G,U=!1){if(U)return"limited";if(G.some((j)=>j.code==="invalid-ansi-c-code-point"||j.code==="missing-heredoc-delimiter"||j.code==="ambiguous-heredoc-delimiter"||j.code==="unterminated-heredoc"||j.code==="unsupported-heredoc-context"||j.code==="unsupported-function-substitution"||j.code==="unsupported-backtick-escape"||j.code==="unclosed-parameter-expansion"||j.code==="unsupported-parameter-expansion"))return"invalid";return G.length>0?"partial":"complete"}function Od(G,U,j,K,re){let oe=kd(G,U,j);return{text:K+G.slice(U,oe),provenance:Bo(re,"variable"),next:oe}}function eC(G,U,j){let K=Ki(G),re=U,oe=!1,de=!1,Se=U;while(Se<j){let we=G[Se];if(we==="\\"&&!oe){Se+=2;continue}if(!de&&we==="'"){oe=!oe,Se++;continue}if(!oe&&we==='"'){de=!de,Se++;continue}if(oe){Se++;continue}let We=G.startsWith("$((",Se),ft=G.startsWith("$(",Se)&&!We,pt=!de&&(G.startsWith("<(",Se)||G.startsWith(">(",Se)),mt=we==="`";if(We||ft||pt||mt){let gt=We?3:mt?1:2,yt=We?"))":mt?"`":")",ht=ll(G,Se+gt,j,yt),bt=ht===-1?j:ht+yt.length;K.push(re,Se,"literal"),K.push(Se,bt,We?"arithmetic":"command-substitution"),Se=bt,re=bt;continue}if(we==="$"){let gt=kd(G,Se,j);if(gt>Se+1){K.push(re,Se,"literal"),K.push(Se,gt,"variable"),Se=gt,re=gt;continue}}if(!de&&(we==="*"||we==="?"||we==="[")){K.push(re,Se,"literal"),K.push(Se,Se+1,"glob"),Se++,re=Se;continue}Se++}return K.push(re,j,"literal"),K.parts}function Bo(G,U){if(U==="command-substitution"||G==="command-substitution")return"command-substitution";if(U==="arithmetic"||G==="arithmetic")return"arithmetic";if(U==="variable"||G==="variable")return"variable";if(U==="glob"||G==="glob")return"glob";return G}function tC(G,U,j){return U+1>=j||$o(G[U+1]??"")||Xi(G,U+1)!==null}var nC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),rC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function oC(G){let U=0;while(U<=G.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(G[U]?.text??""))U++;if(U===G.length)return!0;let j=iC(G,U);if(j===void 0||j===null)return!1;U=j}return!1}function iC(G,U){let j=G[U]?.text.toLowerCase();if(j==="command")return sC(G,U);if(j==="env")return aC(G,U);if(j==="sudo")return lC(G,U);return}function sC(G,U){if(G[U+1]?.text==="-v")return null;for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(K==="-p"||K==="-v"||K==="-V"||/^-[pvV]+$/.test(K))continue;return j}return G.length}function aC(G,U){for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(nC.has(K)){if(G[j+1]===void 0)return null;j++;continue}if(K.startsWith("-u=")||K.startsWith("--unset=")||K.startsWith("-C")&&K.length>2||K.startsWith("--chdir=")||K.startsWith("-S")&&K.length>2||K.startsWith("--split-string=")||K.startsWith("-P"))continue;if(K.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(K))continue;return j}return G.length}function lC(G,U){for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(rC.has(K)){if(G[j+1]===void 0)return null;j++;continue}if(K.startsWith("-"))continue;return j}return G.length}function Md(G,U,j,K){if(G.provenance!=="literal"||!G.raw.includes("{"))return;let re=Dd(G.raw,U,j,K,!0);if(!re)return;if("limited"in re)return{limited:!0};let oe=re.values.map((de)=>Nd(de,j));if(oe.some((de)=>de===null))return{limited:!0};return{words:[...new Set(oe.filter((de)=>de!==null&&de!==""))]}}function cC(G,U,j,K,re){if(U.provenance!=="literal"||!U.raw.includes("{"))return;let oe=Dd(U.raw,j,K,re,!1);if(!oe)return;if("limited"in oe){if(oe.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:oe.limited==="length"?"brace-expansion-limit":"word-limit"}}let de=oe.values.map((Se)=>Nd(Se,K));if(de.some((Se)=>Se===null))return;return{words:de.filter((Se)=>Se!==null&&Se!=="").map((Se)=>Qr(G,U.span.start,U.span.end,Se,"literal",!1))}}function Dd(G,U,j,K,re){let oe=[G],de=G.length,Se=0;while(!0){let we=oe.findIndex((gt)=>xd(gt,re));if(we===-1)break;if(++Se>j)return{limited:"expansions"};let We=oe[we]??"",ft=xd(We,re);if(!ft||ft.kind==="range")return{limited:"expansions"};let pt=ft.start+We.length-ft.end,mt=ft.alternatives.reduce((gt,yt)=>gt+pt+yt.length,0);if(de-We.length+mt>K)return{limited:"length"};if(oe.length-1+ft.alternatives.length>U)return{limited:"words"};oe.splice(we,1,...uC(We,ft)),de+=mt-We.length}return Se===0?void 0:{values:oe}}function xd(G,U){let j=[],K,re=null,oe=!1;for(let de=0;de<G.length;de++){let Se=G[de];if(oe){oe=!1;continue}if(Se==="\\"&&re!=="'"){oe=!0;continue}if(Se===re){re=null;continue}if(re===null&&(Se==="'"||Se==='"')){re=Se;continue}if(re!==null)continue;if(Se==="{"){j.push({start:de,commas:[]});continue}if(Se===","&&j.length>0){j.at(-1)?.commas.push(de);continue}if(Se!=="}"||j.length===0)continue;let we=j.pop();if(!we)continue;let We=we.commas.length>0?{kind:"alternatives",start:we.start,end:de+1,commas:we.commas}:U&&fC(G.slice(we.start+1,de))?{kind:"range",start:we.start,end:de+1}:void 0;if(We&&(!K||We.start<K.start))K=We}if(!K||K.kind==="range")return K;return{kind:K.kind,start:K.start,end:K.end,alternatives:dC(G,K)}}function uC(G,U){return U.alternatives.map((j)=>`${G.slice(0,U.start)}${j}${G.slice(U.end)}`)}function dC(G,U){let j=[U.start,...U.commas,U.end-1];return j.slice(0,-1).map((K,re)=>G.slice(K+1,j[re+1]))}function fC(G){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(G)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(G)}function Nd(G,U){let j=`x${G}`,K=il(j,0,j.length,{maxInputLength:j.length,maxWords:1,maxDepth:U},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(K.limited||K.issues.length>0||K.next!==j.length||K.word.provenance!=="literal")return null;return K.word.text.slice(1)}function mC(G,U,j,K){return un({kind:"program",dialect:"posix",source:G.slice(U,j),span:{start:U,end:j},status:"limited",issues:[{code:K,message:"command structure exceeds parser limit"}],nodes:[]})}function eo(G,U,j,K,re){return{nodes:G,issues:[...U,{code:K,message:`command structure exceeds parser limit ${re}`}],next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function Yi(G,U,j){return{nodes:G,issues:U,next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function rl(G){return G.wordsUsed++,G.wordsUsed<=G.maxWords}function pC(G,U,j){let K=G.slice(U,j),re=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(K)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(K),oe=re?.[1];if(!re||!oe)return;return{name:oe,braceIndex:U+re[0].lastIndexOf("{")}}function Uo(G){return G.some((U)=>{if(U.kind==="command")return U.redirections.some((j)=>j.heredoc)||U.nested.some((j)=>Uo(j.nodes));return(U.kind==="group"||U.kind==="function")&&Uo(U.body.nodes)})}function gC(G){return G.map((U)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${U.delimiter} was not found`}))}function Ld(G){return G?.kind==="command"||G?.kind==="group"||G?.kind==="function"}function Rd(G,U){let j=G.at(-1);if(j?.kind!=="connector"||!_d.has(j.operator))return;U.push({code:"missing-command-after-connector",message:`connector ${j.operator} requires a following command`})}function Wd(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&Bb.has(G.text)}function ol(G,U){let j=G.at(-1);if(!Ld(j))return;if(j?.kind==="command"&&Wd(j.words[0]))return;U.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function hC(G,U,j){return U===j||/[\s;&|()]/u.test(G[U-1]??"")}var Fd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),yC=new Set(["gc","cat","type","cp","mv","rm"]),zd=["-rec","-for","-path","-literalpath","-whatif"],bC=/^\$env:\w/i,CC=/^(?:\$\{?\w+\}?|~)\\./;function Bd(G,U){let j=G.toLowerCase().replaceAll("`","");if(![...Fd].some((re)=>j.includes(re))&&!(j.includes("rm")&&zd.some((re)=>j.includes(re)))&&!j.includes("<#")&&!SC(j))return!1;let K=fl(G,U);if($d(K))return!1;return K.issues.some((re)=>re.code==="unclosed-block-comment"||re.code==="comment-depth-limit")||dl(K).some(vC)}function $d(G){return G.nodes.some((U)=>{if(U.kind==="group")return $d(U.body);if(U.kind!=="command")return!1;return U.redirections.some((j)=>j.operator==="<<")})}function SC(G){if(G.includes("$env:"))return!0;return G.includes("\\")&&(G.includes("$")||G.includes("~"))}function vC(G){let U=G[0]==="&"||G[0]==="."?1:0,j=G[U]?.toLowerCase();if(j&&Fd.has(j))return!0;let K=G.slice(U+1);if(j&&yC.has(j)&&K.some(EC))return!0;if(j!=="rm")return!1;return K.some((re)=>{let oe=re.toLowerCase().split(":",1)[0]??"";return zd.some((de)=>oe.startsWith(de))})}function EC(G){return bC.test(G)||CC.test(G)}function fl(G,U){let j={start:0,end:G.length};if(G.length>U.maxInputLength)return un({kind:"program",dialect:"powershell",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${U.maxInputLength} UTF-16 code units`}],nodes:[]});let K=ml(G,0,G.length,U,0);return un({kind:"program",dialect:"powershell",source:G,span:j,status:PC(K.issues,K.limited),issues:K.issues,nodes:K.nodes})}function ml(G,U,j,K,re,oe=!1){let de=[],Se=[],we=ji(),We=0,ft=!1,pt=()=>{if(we.words.length===0&&we.redirections.length===0)return;let gt={start:we.start,end:we.end};Vi(de,we,{kind:"command",dialect:"powershell",source:G.slice(gt.start,gt.end),span:gt,words:we.words,redirections:we.redirections,nested:we.nested,displayText:we.words.map((yt)=>yt.text).join(" ")})},mt=U;while(mt<j){let gt=G[mt];if(!gt)break;if(oe&&gt==="}")return pt(),{nodes:de,issues:Se,next:mt+1,closed:!0,words:We,limited:ft};let yt=wC(G,mt,j,K.maxDepth);if(yt){if(yt.issue)Se.push(yt.issue);if(yt.limited)return pt(),{nodes:de,issues:Se,next:yt.next,closed:!1,words:We,limited:!0};mt=yt.next;continue}if(/\s/.test(gt)){if(gt==="\r"||gt===`
-`){pt();let Ct=gt==="\r"&&G[mt+1]===`
-`?mt+2:mt+1;de.push(cl(G,mt,Ct)),mt=Ct;continue}mt++;continue}let ht=jd(G,mt);if(ht){pt(),de.push(cl(G,mt,mt+ht.length)),mt+=ht.length;continue}if(gt==="{"){if(pt(),re>=K.maxDepth)return Se.push(Hd(K.maxDepth)),{nodes:de,issues:Se,next:j,closed:!1,words:We,limited:!0};let Ct=ml(G,mt+1,j,K,re+1,!0),vt=Ct.closed?Ct.next-1:Ct.next,St=un({kind:"program",dialect:"powershell",source:G.slice(mt+1,vt),span:{start:mt+1,end:vt},status:Ct.limited?"limited":Ct.issues.length>0?"partial":"complete",issues:Ct.issues,nodes:Ct.nodes});if(de.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:mt,end:Ct.next}),body:St})),Se.push(...Ct.issues),!Ct.closed)Se.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});We+=Ct.words,ft||=Ct.limited,mt=Ct.next;continue}if(gt==="}"){pt(),de.push(cl(G,mt,mt+1)),mt++;continue}if(gt===">"||gt==="<"){we.start=we.start===-1?mt:we.start;let Ct=G[mt+1]===gt?mt+2:mt+1,vt=Ct;while(/[ \t]/.test(G[vt]??""))vt++;let St=vt<j?Gd(G,vt,j,K,re):void 0,Rt=St?.next??Ct;if(we.redirections.push(Object.freeze({kind:"redirection",operator:G.slice(mt,Ct),span:Object.freeze({start:mt,end:Rt}),...St?{target:St.word}:{}})),St)Se.push(...St.issues),we.nested.push(...St.nested),We+=St.words,ft||=St.limited;we.end=Rt,mt=Rt;continue}if(gt===","){we.start=we.start===-1?mt:we.start,we.words.push(el({text:",",raw:",",span:{start:mt,end:mt+1},provenance:"literal",quoted:!1})),we.end=++mt;continue}let bt=Gd(G,mt,j,K,re);if(we.start=we.start===-1?mt:we.start,we.end=bt.next,we.words.push(bt.word),Se.push(...bt.issues),we.nested.push(...bt.nested),We+=1+bt.words,ft||=bt.limited,We>K.maxWords)return Se.push({code:"word-limit",message:`command exceeds ${K.maxWords} words`}),pt(),{nodes:de,issues:Se,next:bt.next,closed:!1,words:We,limited:!0};mt=bt.next>mt?bt.next:mt+1}return pt(),{nodes:de,issues:Se,next:mt,closed:!oe,words:We,limited:ft}}function Gd(G,U,j,K,re){let oe="",de="literal",Se=!1,we=[],We=[],ft=0,pt=!1,mt=(yt)=>{let ht=xC(G,yt,j,K,re);return oe+=G.slice(yt,ht.next),We.push(ht.program),we.push(...ht.program.issues),ft+=ul(ht.program),pt||=ht.program.status==="limited",de="command-substitution",ht.next},gt=U;while(gt<j){let yt=G[gt];if(!yt||/\s/.test(yt)||jd(G,gt)||yt===">"||yt==="<"||yt==="#")break;if(yt===",")break;if(yt==="`"){let ht=G[gt+1];if(!ht){we.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),gt++;break}oe+=ht,gt+=2;continue}if(G.startsWith("$(",gt)){gt=mt(gt);continue}if(yt==="'"){Se=!0,gt++;let ht=!1;while(gt<G.length){if(G[gt]==="'"&&G[gt+1]==="'"){oe+="'",gt+=2;continue}if(G[gt]==="'"){ht=!0,gt++;break}oe+=G[gt]??"",gt++}if(!ht)we.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(yt==='"'){Se=!0,gt++;let ht=!1;while(gt<j){let bt=G[gt];if(bt==="`"&&G[gt+1]){oe+=G[gt+1],gt+=2;continue}if(bt==='"'){ht=!0,gt++;break}if(G.startsWith("$(",gt)){gt=mt(gt);continue}if(bt==="$")de=G[gt+1]==="("?"command-substitution":"variable";oe+=bt??"",gt++}if(!ht)we.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(yt==="$")de=G[gt+1]==="("?"command-substitution":"variable";if(yt==="@"&&gt===U)de="variable";oe+=yt,gt++}return{word:Qr(G,U,gt,oe,de,Se,de==="literal"?void 0:RC(G,U,gt)),next:gt,issues:we,nested:We,words:ft,limited:pt}}function xC(G,U,j,K,re){let oe=Ud(G,U+2,j),de=oe===-1?j:oe,Se=oe===-1?j:oe+1;if(re>=K.maxDepth)return{program:un({kind:"program",dialect:"powershell",source:G.slice(U+2,de),span:{start:U+2,end:de},status:"limited",issues:[Hd(K.maxDepth)],nodes:[]}),next:Se};let we=ml(G,U+2,de,K,re+1),We=oe===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:un({kind:"program",dialect:"powershell",source:G.slice(U+2,de),span:{start:U+2,end:de},status:we.limited?"limited":we.issues.length+We.length>0?"partial":"complete",issues:[...we.issues,...We],nodes:we.nodes}),next:Se}}function Ud(G,U,j){let K=1,re=!1,oe=!1;for(let de=U;de<j;de++){let Se=G[de];if(Se==="`"){de++;continue}if(!oe&&Se==="'"){if(re&&G[de+1]==="'"){de++;continue}re=!re;continue}if(!re&&Se==='"'){oe=!oe;continue}if(re)continue;if(G.startsWith("$(",de)){K++,de++;continue}if(!oe&&Se==="(")K++;if(Se!==")")continue;if(K--,K===0)return de}return-1}function ul(G){let U=0;for(let j of G.nodes){if(j.kind==="group")U+=ul(j.body);if(j.kind==="command"){U+=j.words.length;for(let K of j.nested)U+=ul(K)}}return U}function RC(G,U,j){let K=Ki(G),re=U,oe=!1,de=U;while(de<j){let Se=G[de];if(Se==="`"){de+=2;continue}if(Se==="'"){if(oe&&G[de+1]==="'"){de+=2;continue}oe=!oe,de++;continue}if(oe){de++;continue}if(G.startsWith("$(",de)){let we=Ud(G,de+2,j),We=we===-1?j:we+1;K.push(re,de,"literal"),K.push(de,We,"command-substitution"),de=We,re=We;continue}if(Se==="$"||Se==="@"&&de===U){let we=_C(G,de+1,j);K.push(re,de,"literal"),K.push(de,we,"variable"),de=we,re=we;continue}de++}return K.push(re,j,"literal"),K.parts}function _C(G,U,j){if(G[U]==="{"){let re=G.indexOf("}",U+1);return re===-1||re>=j?j:re+1}let K=U;while(K<j&&/[A-Za-z0-9_:?]/.test(G[K]??""))K++;return K}function Hd(G){return{code:"depth-limit",message:`command structure exceeds parser limit ${G}`}}function dl(G){return G.nodes.flatMap((U)=>{if(U.kind==="group")return dl(U.body);if(U.kind!=="command")return[];return[[...U.words,...U.redirections.flatMap((j)=>j.target?[j.target]:[])].sort((j,K)=>j.span.start-K.span.start).filter((j)=>j.text!==""&&j.raw!==",").map((j)=>j.text),...U.nested.flatMap(dl)]})}function jd(G,U){for(let j of["&&","||",";","|"])if(G.startsWith(j,U))return j;return null}function wC(G,U,j,K){if(G[U]==="#"&&G[U+1]!==">"){let de=U+1;while(de<j&&G[de]!=="\r"&&G[de]!==`
-`)de++;return{next:de,limited:!1}}if(!G.startsWith("<#",U))return null;let re=1,oe=U+2;while(oe<j){if(G.startsWith("<#",oe)){if(re++,re>K)return{next:j,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${K}`},limited:!0};oe+=2;continue}if(G.startsWith("#>",oe)){if(re--,oe+=2,re===0)return{next:oe,limited:!1};continue}oe++}return{next:j,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function PC(G,U){if(U)return"limited";if(G.some((j)=>j.code==="unclosed-block-comment"))return"invalid";return G.length>0?"partial":"complete"}function cl(G,U,j){return Object.freeze({kind:"connector",operator:G.slice(U,j),span:Object.freeze({start:U,end:j})})}function y(G,U="auto",j=lr){if(U==="powershell"||U==="auto"&&Bd(G.slice(0,j.maxInputLength),j))return fl(G,j);return wd(G,j)}function t(G){return G.provenance==="command-substitution"?G.raw:G.text}function ne(G,U){return G==="posix"?U:jt(U.map((j)=>j.text))}function es(G,U){return G&&G.provenance!=="unknown"?G.provenance==="literal":!/[$`*?[\]]/.test(U)}function jt(G){return G.map((U)=>({kind:"word",text:U,raw:U,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function pl(G,U){return{value:G,work:U}}function Et(G,U){if(G.work)G.work.units=Math.min(Number.MAX_SAFE_INTEGER,G.work.units+1);return G.value[U]}function Kt(G){return G.value.length}function jo(G,U,j=1){if(G)G.units=Math.min(Number.MAX_SAFE_INTEGER,G.units+U.length*j)}function En(G,U){jo(G,U)}function Tr(G){if(!G)return!1;let U=G.charCodeAt(0);return U>=48&&U<=57||U>=65&&U<=90||U===95||U>=97&&U<=122}function Ut(G){if(!G)return!1;let U=G.charCodeAt(0);return U===9||U===10||U===11||U===12||U===13||U===32||U===160||U===65279||U===5760||U>=8192&&U<=8202||U===8232||U===8233||U===8239||U===8287||U===12288}function gl(G){return G===`
-`||G==="\r"||G==="\u2028"||G==="\u2029"}function Ht(G,U,j){if(U+j.length>Kt(G))return!1;for(let K=0;K<j.length;K++)if(Et(G,U+K)!==j[K])return!1;return!0}function qn(G,U,j){return!Tr(Et(G,U-1))&&Ht(G,U,j)&&!Tr(Et(G,U+j.length))}function Yn(G,U){return Tr(Et(G,U-1))!==Tr(Et(G,U))}function tn(G){return G===`
-`||G===";"||G==="&"||G==="|"}function to(G){return G==="|"||G===";"}function ts(G,U,j){let K=pl(G,j);if(U==="rm")return AC(K);if(U==="dd")return IC(K);return Xd(K,!0)}function ns(G,U,j){let K=pl(G,j);if(U==="rm")return kC(K);if(U==="reset-hard")return Yd(K,"--ha","rd");if(U==="reset-merge")return Yd(K,"--me","rge");if(U==="clean")return NC(K);if(U==="checkout")return WC(K);if(U==="push-force")return GC(K);if(U==="push-refspec")return FC(K);if(U==="push-delete")return zC(K);if(U==="branch")return BC(K);if(U==="tag")return HC(K);if(U==="restore")return jC(K);return Xd(K,!1)}function AC(G){let U=!1,j=!1,K=!1,re=-1;for(let oe=0;oe<=Kt(G);oe++){let de=Et(G,oe);if(!U){let we=Et(G,oe+2);if(qn(G,oe,"rm")&&Ut(we)&&we!==`
-`)U=!0,oe++;continue}let Se=TC(G,oe);if(de===`
-`||Se!==-1){if(U=!1,j=!1,K=!1,re=-1,Se!==-1)oe=Se-1;continue}if(de===";"||de==="&"||de==="|"||oe===Kt(G)){if(re>=0){let we=Vd(G,re,oe);j||=we.recursive,K||=we.force}if(j&&K)return!0;U=!1,j=!1,K=!1,re=-1;continue}if(Ut(de)){if(re<0)continue;if(Ht(G,re,"--")&&oe-re===2){U=!1,j=!1,K=!1,re=-1;continue}let we=Vd(G,re,oe);if(j||=we.recursive,K||=we.force,j&&K)return!0;re=-1;continue}if(re<0)re=oe}return!1}function TC(G,U){if(Et(G,U)!=="\\"||Et(G,U-1)==="\\")return-1;if(Ht(G,U,String.raw`\n`))return U+2;if(Ht(G,U,String.raw`\x0a`)||Ht(G,U,String.raw`\x0A`))return U+5;if(Ht(G,U,String.raw`\u000a`)||Ht(G,U,String.raw`\u000A`))return U+7;return Ht(G,U,String.raw`\012`)?U+4:-1}function Vd(G,U,j){if(Kd(G,U,j,"recursive"))return{recursive:!0,force:!1};if(Kd(G,U,j,"force"))return{recursive:!1,force:!0};if(Et(G,U)!=="-"||Et(G,U+1)==="-")return{recursive:!1,force:!1};let K=!1,re=!1;for(let oe=U+1;oe<j;oe++){let de=Et(G,oe);K||=de==="r"||de==="R",re||=de==="f"||de==="F"}return{recursive:K,force:re}}function Kd(G,U,j,K){let re=j-U-2;if(re<1||re>K.length||!Ht(G,U,"--"))return!1;for(let oe=0;oe<re;oe++)if(Et(G,U+oe+2)!==K[oe])return!1;return!0}function IC(G){let U=!1;for(let j=0;j<Kt(G);j++){if(tn(Et(G,j))){U=!1;continue}if(qn(G,j,"dd")){U=!0,j++;continue}if(!U||!qn(G,j,"of")||!Ht(G,j,"of=/dev/"))continue;let K=j+8;if(K<Kt(G)&&!Ut(Et(G,K))&&Et(G,K)!=="'"&&Et(G,K)!=='"')return!0}return!1}function kC(G){let U=!1,j=!1,K=!1;for(let re=0;re<=Kt(G);){let oe=Et(G,re);if(re===Kt(G)||tn(oe)){U=!1,j=!1,K=!1,re++;continue}let de=MC(G,re);if(de>=0){if(OC(G,de))return!0;let Se=de,we=!1;while(Ut(Et(G,Se)))we||=Et(G,Se)===`
-`,Se++;if(we)j=!1,K=!1;U=!0,re=Se;continue}if(!U){re++;continue}if(Ht(G,re,"--")&&(re===0||Ut(Et(G,re-1)))&&(!Et(G,re+2)||Ut(Et(G,re+2))||tn(Et(G,re+2)))){U=!1,j=!1,K=!1,re+=2;continue}if(j||=Ht(G,re,"--recursive")&&Yn(G,re+11)||hl(G,re,"recursive"),K||=Ht(G,re,"--force")&&Yn(G,re+7)||hl(G,re,"force"),j&&K)return!0;re++}return!1}function hl(G,U,j){if(!Ht(G,U,"--"))return!1;let K=0;while(K<=j.length){let re=Et(G,U+K+2);if(!re||Ut(re)||tn(re))break;if(re!==j[K])return!1;K++}return K>0&&Yn(G,U+K+2)}function OC(G,U){let j=U,K=!1,re=!1;while(j<Kt(G)){while(Ut(Et(G,j)))j++;let oe=j;while(j<Kt(G)&&!Ut(Et(G,j)))j++;if(Et(G,oe)!=="-"||j-oe===2&&Ht(G,oe,"--"))return!1;let de=qd(G,oe,"recursive"),Se=qd(G,oe,"force");if(K&&Se||re&&de)return!0;if(K||=de,re||=Se,Et(G,oe+1)==="-")continue;let we=DC(G,oe,j);if(we.combined||K&&we.forceAtBoundary||re&&we.recursiveAtBoundary)return!0;K||=we.recursive,re||=we.force}return!1}function qd(G,U,j){return Ht(G,U,`--${j}`)&&Yn(G,U+j.length+2)||hl(G,U,j)}function MC(G,U){if(U>0&&Tr(Et(G,U-1)))return-1;let j=U;if(Et(G,j)==="\\")j++;if(Et(G,j)!=="r")return-1;if(j++,Et(G,j)==="\\")j++;if(Et(G,j)!=="m"||!Ut(Et(G,j+1)))return-1;return j+1}function DC(G,U,j){let K=!1,re=!1,oe=!1,de=!1,Se=!1;if(Et(G,U)!=="-")return{recursive:K,force:re,recursiveAtBoundary:oe,forceAtBoundary:de,combined:Se};let we="";for(let We=U+1;We<j;We++){let ft=Et(G,We)??"",pt=(ft==="r"||ft==="f")&&Yn(G,We+1);K||=ft==="r",re||=ft==="f",oe||=ft==="r"&&pt,de||=ft==="f"&&pt,Se||=(we==="r"&&ft==="f"||we==="f"&&ft==="r")&&pt,we=ft}return{recursive:K,force:re,recursiveAtBoundary:oe,forceAtBoundary:de,combined:Se}}function Yd(G,U,j){return Ko(G,"reset",to,!0,(K)=>Et(G,K)==="-"&&no(G,K,U,j)?!0:K)}function NC(G){return Ko(G,"clean",to,!0,(U)=>{if(Et(G,U)!=="-")return U;if(no(G,U,"--fo","rce"))return!0;let j=Vo(G,U,to);for(let K=U+1;K<j;K++)if(Et(G,K)==="f")return!0;return j-1})}function rs(G,U,j){if(!qn(G,U,"git"))return null;let K=U+3;if(!Ut(Et(G,K)))return{commandEnd:-1,next:K};while(Ut(Et(G,K)))K++;while(K<Kt(G)){if(tn(Et(G,K)))return{commandEnd:-1,next:K};let re=Vo(G,K,tn);if(qn(G,K,j))return{commandEnd:K+j.length,next:re};if(Et(G,K)!=="-")return{commandEnd:-1,next:re};let oe=re-K===2&&Ht(G,K,"--"),de=LC(G,K,re);K=re;while(Ut(Et(G,K)))K++;if(oe)return{commandEnd:qn(G,K,j)?K+j.length:-1,next:Vo(G,K,tn)};if(!de)continue;if(K>=Kt(G)||tn(Et(G,K)))return{commandEnd:-1,next:K};K=Vo(G,K,tn);while(Ut(Et(G,K)))K++}return{commandEnd:-1,next:K}}function LC(G,U,j){for(let K of Cn)if(j-U===K.length&&Ht(G,U,K))return!0;return!1}function WC(G){return Zd(G,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function GC(G){return Ko(G,"push",to,!0,(U)=>{if(Et(G,U)!=="-")return U;if(Et(G,U+1)==="f"&&!Tr(Et(G,U+2))&&!Ht(G,U+2,"-with-lease"))return!0;let j=Jd(G,U,"--fo","rce");if(j>=0&&!Ht(G,j,"-with-lease"))return!0;return U})}function FC(G){return Ko(G,"push",tn,!1,(U)=>{if(Ut(Et(G,U))&&Et(G,U+1)==="+"&&U+2<Kt(G)&&!tn(Et(G,U+2))&&!Ut(Et(G,U+2)))return!0;if(Et(G,U)===":"&&Et(G,U+1)==="+")return!0;return U})}function zC(G){return Ko(G,"push",tn,!1,(U)=>{if(Et(G,U)==="-"&&no(G,U,"--de","lete"))return!0;if(Ut(Et(G,U))&&Et(G,U+1)===":"&&U+2<Kt(G)&&!Ut(Et(G,U+2))&&!tn(Et(G,U+2)))return!0;return U})}function BC(G){let U=!1,j=!1,K=!1;for(let re=0;re<=Kt(G);re++){if(re===Kt(G)||tn(Et(G,re))){if(j&&K)return!0;U=!1,j=!1,K=!1;continue}if(!U){let Se=rs(G,re,"branch");if(Se){U=Se.commandEnd>=0,re=Math.max(re,(U?Se.commandEnd:Se.next)-1);continue}}if(!U||Et(G,re)!=="-")continue;let oe=Vo(G,re,tn),de=$C(G,re,oe);if(j||=de.deletion,K||=de.force,j&&K)return!0;re=oe-1}return!1}function $C(G,U,j){let K=!1,re=!1;for(let oe=U;oe<j;oe++){if(Et(G,oe)!=="-")continue;if(no(G,oe,"--de","lete"))K=!0;if(no(G,oe,"--fo","rce"))re=!0;if(Et(G,oe+1)==="-")continue;let de=oe+1,Se=!1,we=!1,We=!1;while(de<j&&UC(Et(G,de))){let ft=Et(G,de);Se||=ft==="d"||ft==="D",we||=ft==="f",We||=ft==="D",de++}if(!Yn(G,de))continue;K||=Se,re||=we||We}return{deletion:K,force:re}}function UC(G){if(!G)return!1;let U=G.charCodeAt(0);return U>=65&&U<=90||U>=97&&U<=122}function HC(G){return Zd(G,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Zd(G,U){let j=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let K=0;K<Kt(G);K++){let re=Et(G,K),oe=j[j.length-1];if(!oe)return!1;let de=oe.escaped;if(oe.escaped=!de&&oe.quote!=="'"&&re==="\\",!de&&re==="'"&&oe.quote!=='"')oe.quote=oe.quote==="'"?"":"'";if(!de&&re==='"'&&oe.quote!=="'")oe.quote=oe.quote==='"'?"":'"';if(re==="$"&&Et(G,K+1)==="("&&(j.length===1||!de&&oe.quote!=="'")){j.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),K++;continue}if(!de&&!oe.quote&&j.length>1&&re==="("){oe.depth++;continue}if(!de&&!oe.quote&&j.length>1&&re===")"){if(oe.depth--,oe.depth===0)j.pop();continue}if(Ut(re))oe.shortActive=!1,oe.hasShortFlag=!1;if(!oe.outerActive){let Se=rs(G,K,U.command);if(Se){oe.outerActive=Se.commandEnd>=0&&Ut(Et(G,Se.commandEnd)),oe.shortActive=!1,oe.hasShortFlag=!1,K=Math.max(K,(oe.outerActive?Se.commandEnd:Se.next)-1);continue}}if(oe.outerActive&&re==="-"){if(no(G,K,U.longPrefix,U.longOptional))return!0;oe.shortActive||=!U.excludedShortStarts.includes(Et(G,K+1)??"")}if(oe.hasShortFlag||=oe.shortActive&&re===U.shortFlag,oe.hasShortFlag&&Yn(G,K+1))return!0;if(to(re))oe.outerActive=!1}return!1}function Ko(G,U,j,K,re){let oe=!1;for(let de=0;de<Kt(G);de++){let Se=Et(G,de),we=j(Se);if(!oe&&!we){let We=rs(G,de,U);if(We){oe=We.commandEnd>=0&&(!K||Ut(Et(G,We.commandEnd))),de=Math.max(de,(oe?We.commandEnd:We.next)-1);continue}}if(oe){let We=re(de);if(We===!0)return!0;for(let ft=de;ft<=We;ft++)if(j(Et(G,ft)))oe=!1;de=We}if(we)oe=!1}return!1}function jC(G){let U=!1;for(let j=0;j<Kt(G);j++){if(gl(Et(G,j))){if(U)return!0;U=!1;continue}if(!U){let K=rs(G,j,"restore");if(K){U=K.commandEnd>=0,j=Math.max(j,(U?K.commandEnd:K.next)-1);continue}}if(U&&Et(G,j)==="-"&&Et(G,j+1)==="-"&&(Ht(G,j+2,"staged")||Ht(G,j+2,"help")))U=!1}return U}function Xd(G,U){let j=!1;for(let K=0;K<Kt(G);K++){let re=Et(G,K),oe=U?gl(re):tn(re);if(j&&Ut(re)&&Et(G,K+1)==="-"&&qn(G,K+2,"delete"))return!0;if(oe){j=!1;continue}if(qn(G,K,"find"))j=!0,K+=3}return!1}function Vo(G,U,j){let K=U;while(K<Kt(G)&&!Ut(Et(G,K))&&!j(Et(G,K)))K++;return K}function Jd(G,U,j,K){if(!Ht(G,U,j))return-1;let re=U+j.length;for(let oe=0;oe<K.length&&Et(G,re)===K[oe];oe++)re++;return Yn(G,re)?re:-1}function no(G,U,j,K){return Jd(G,U,j,K)>=0}function An(G,U){jo(U,G,2);let j=G.toLowerCase(),K=j.trimStart(),re=K.startsWith("echo ")||K.startsWith("rg "),oe=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let de of oe){if(de.skipForEchoRg&&re)continue;let Se=de.caseSensitive?G:j;if(de.regex)En(U,Se);if((de.regex?.test(Se)??!1)||de.scan&&ns(Se,de.scan,U))return xt("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${de.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var VC=/^[A-Za-z_][A-Za-z0-9_]*=/;function ef(G,U,j){let K=G.words[0];if(!U||!K||G.words.length!==1||G.dialect!=="posix")return!1;if(!K.quoted||K.provenance!=="literal")return!1;let re=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(K.text)?.[1];if(!re)return!1;jo(j,U.source,2);let oe={anchored:new RegExp(`^\\$\\{?${re}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${re}(?![A-Za-z0-9_])`)};return tf(U.nodes,K,oe)}function tf(G,U,j){return G.every((K)=>{if(K.kind==="connector")return!0;if(K.kind==="group"||K.kind==="function")return tf(K.body.nodes,U,j);if(K.kind==="unknown")return!j.loose.test(K.source);return KC(K,U,j)})}function KC(G,U,j){if(G.nested.some((re)=>j.loose.test(re.source)))return!1;let K=G.words.findIndex((re)=>!VC.test(re.text));return G.words.every((re,oe)=>re===U||Qd(re.raw,j.anchored,oe!==K))&&G.redirections.every((re)=>(!re.heredoc||re.heredoc.quotedDelimiter||!j.loose.test(re.heredoc.body))&&(!re.target||Qd(re.target.raw,j.anchored,!0)))}function Qd(G,U,j){let K=!1,re=!1;for(let oe=0;oe<G.length;oe++){let de=G[oe];if(de==="\\"&&!K){oe++;continue}if(!re&&de==="'"){K=!K;continue}if(!K&&de==='"'){re=!re;continue}if(K||de!=="$")continue;if(!U.test(G.slice(oe)))continue;if(!re||!j)return!1}return!0}import{isAbsolute as qC,resolve as nf}from"node:path";function qo(G,U,j,K){let re=qC(G)?nf(G):U?nf(U,G):void 0;if(!re)return;try{return Dt(re,j,K)}catch{return re}}function rf(G){return!["/dev","/proc","/sys"].some((U)=>G===U||G.startsWith(`${U}/`))}var ro="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yo="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",bl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),YC=new Set(["-p","--print"]),ZC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),XC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),JC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),QC=new Map([["python",new Set(["m"])]]),eS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),tS=new Set(["always","default","never"]),nS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),rS=/\\\r?\n/g,oS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function of(G){return is(G).code}function os(G){return is(G).sources}function sf(G){return oS.get(Sl(G))??[]}function is(G){let U=Sl(G[0]??"");if(!bl.has(U))return{code:null,sources:[],optionsOpen:!1};let j=[],K=[],re=!0;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(de===void 0)break;if(de==="--")return Mn(U,j,K,re,G[oe+1]===void 0?void 0:oe+1,G[oe+1]);if(de===""||de==="-"||!de.startsWith("-"))return Mn(U,j,K,re,oe,de);if(U==="node"&&YC.has(de)){let pt=G[oe+1];if(pt===void 0)return Mn(U,j,K,re);if(pt.startsWith("-"))continue;j.push({tokenIndex:oe+1,value:pt}),K.push({tokenIndex:oe+1,kind:"inline-code",value:pt}),oe++;continue}if(sS(U,de)){let pt=G[oe+1];if(pt===void 0)return Mn(U,j,K,re);if(j.push({tokenIndex:oe+1,value:pt}),K.push({tokenIndex:oe+1,kind:"inline-code",value:pt}),U==="python")return Mn(U,j,K,re);oe++;continue}let Se=/^--eval=(.*)$/s.exec(de);if(aS(U)&&Se){let pt=Se[1]??"";j.push({tokenIndex:oe,value:pt}),K.push({tokenIndex:oe,kind:"inline-code",value:pt});continue}if(U==="node"){let pt=iS(de);if(pt){if(pt.attached){if(re&&=pt.value!=="",pt.value!=="")K.push({tokenIndex:oe,kind:"module-file",value:pt.value});continue}let mt=G[oe+1];if(mt===void 0||mt.startsWith("-"))return re=!1,Mn(U,j,K,re);K.push({tokenIndex:oe+1,kind:"module-file",value:mt}),oe++;continue}}if(U==="python"&&de.startsWith("--check-hash-based-pycs=")||U==="node"&&(de==="--conditions="||de==="--diagnostic-dir="||de==="--title=")||U==="ruby"&&(de==="--disable="||de==="--enable="))return Mn(U,j,K,re);if(eS.get(U)?.has(de)){let pt=G[oe+1];if(pt===void 0||pt.startsWith("-")&&!(U==="ruby"&&nS.has(de))||U==="python"&&!tS.has(pt))return Mn(U,j,K,re);oe++;continue}if(de.startsWith("--"))continue;let we,We=!1;for(let pt=1;pt<de.length;pt++){let mt=de[pt];if(mt===void 0)break;if(QC.get(U)?.has(mt)){let gt=de.slice(pt+1),yt=gt||G[oe+1];if(yt!==void 0)K.push({tokenIndex:gt?oe:oe+1,kind:"module-file",value:yt});return Mn(U,j,K,re)}if(ZC.get(U)?.has(mt)){we=de.slice(pt+1)||G[oe+1],We=pt+1===de.length;break}if(U==="node"&&mt==="r"){if(re&&=de==="-r",de==="-r"){let gt=G[oe+1];if(re&&=gt!==void 0&&!gt.startsWith("-"),re&&gt!==void 0)K.push({tokenIndex:oe+1,kind:"module-file",value:gt});oe++}break}if(U==="ruby"&&mt==="r"){let gt=de.slice(pt+1),yt=gt||G[oe+1];if(re&&=yt!==void 0,yt!==void 0)K.push({tokenIndex:gt?oe:oe+1,kind:"module-file",value:yt});if(!gt)oe++;break}if(U==="perl"&&(mt==="M"||mt==="m")){let gt=de.slice(pt+1);if(!gt){if(re=!1,pt+1===de.length)oe++;break}K.push({tokenIndex:oe,kind:"module-file",value:gt});break}if(XC.get(U)?.has(mt)){if(pt+1===de.length)oe++;break}if(JC.get(U)?.has(mt)&&pt+1<de.length)break}if(we===void 0)continue;let ft=We?oe+1:oe;if(j.push({tokenIndex:ft,value:we}),K.push({tokenIndex:ft,kind:"inline-code",value:we}),U==="python")return Mn(U,j,K,re);if(We)oe++}return Mn(U,j,K,re,void 0,void 0,!0)}function Mn(G,U,j,K,re,oe,de=!1){let Se=G==="node"?U.slice(-1):U,we=new Set(Se.map((ft)=>ft.tokenIndex)),We=j.filter((ft)=>ft.kind!=="inline-code"||we.has(ft.tokenIndex));if(K&&U.length===0&&re!==void 0&&oe!==void 0)We.push({tokenIndex:re,kind:"main-script",value:oe});return{code:(G==="node"?Se[0]?.value:Se.map((ft)=>ft.value).join(`
-`))||null,sources:K?We:[],optionsOpen:K&&de}}function iS(G){for(let U of["--import","--loader","--experimental-loader","--require"]){if(G===U)return{attached:!1,value:""};if(G.startsWith(`${U}=`))return{attached:!0,value:G.slice(U.length+1)}}return}function Cl(G,U){return Sl(G)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(U)}function Sl(G){let U=Pt(G).toLowerCase();return ki.test(U)?"python":U}function sS(G,U){return bl.get(G)?.has(U)??!1}function aS(G){return bl.get(G)?.has("--eval")??!1}function Zo(G,U,j=!1){let K=uS(G,U);if(!yl(K,U))return!1;En(U,K);let re=cS(K);if(yl(re,U))return!0;if(En(U,re),!af.test(re))return!1;return!j||lS(K,U)}function lS(G,U){if(/`|%x|\bqx\b/.test(G))return!0;let K=G.split(""),re=[];for(let we=0;we<G.length;we++){let We=G[we];if(We!=="'"&&We!=='"')continue;let ft=G.startsWith(We.repeat(3),we)?We.repeat(3):We,pt=we+ft.length,mt=pt;while(mt<G.length&&!G.startsWith(ft,mt))mt+=G[mt]==="\\"?2:1;if(mt>=G.length)return!0;re.push({start:pt,text:G.slice(pt,mt)}),K.fill(" ",we,mt+ft.length),we=mt+ft.length-1}let oe=K.join(""),de=Array.from(oe.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((we)=>af.test(we[1]??"")).map((we)=>{let We=we.index+we[0].length;return{start:We,end:vl(oe,We)}});if(de.some((we)=>El(oe,we.start)))return!0;return re.some((we)=>{let We=/\b(?:system|exec|spawn|popen)\s*$/.test(oe.slice(0,we.start)),ft=de.some((pt)=>we.start>=pt.start&&we.start<pt.end);return(We||ft)&&yl(we.text,U)})}function vl(G,U){let j=1;for(let K=U;K<G.length;K++){if(G[K]==="(")j++;if(G[K]===")")j--;if(j===0)return K}return G.length}function El(G,U){let j=0;for(let K=U;K<G.length;K++){let re=G[K]??"";if("([{".includes(re))j++;if(")]}".includes(re)&&j--===0)return!1;if(re===","&&j===0)return!1;if(/[A-Za-z_$]/.test(re))return!0}return!1}var af=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function cS(G){let U=[],j=0,K=0;while(K<G.length){let re=G[K];if(re!=="'"&&re!=='"'){K++;continue}let oe=G.startsWith(re.repeat(3),K)?re.repeat(3):re,de=K+oe.length;while(de<G.length&&!G.startsWith(oe,de))de+=G[de]==="\\"?2:1;if(de>=G.length)break;U.push(G.slice(j,K)," "),K=de+oe.length,j=K}return U.push(G.slice(j)),U.join("")}function yl(G,U){if(ts(G,"rm",U))return!0;for(let K of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(En(U,G),K.test(G))return!0;if(ts(G,"dd",U))return!0;for(let K of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(En(U,G),K.test(G))return!0;if(ts(G,"find",U))return!0;let j=G.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((K)=>(En(U,G),j.some((re)=>ns(re,K))))}function uS(G,U){return En(U,G),G.replace(rS,"")}import{lstatSync as av,readdirSync as lv}from"node:fs";import{basename as cv,isAbsolute as Mf,join as uv,relative as Df}from"node:path";import{isAbsolute as pf,parse as SS}from"node:path";import{dirname as dS,isAbsolute as fS,parse as mS,sep as pS}from"node:path";function cr(G,U,j){if(ir(U))throw Error("Unsupported Windows namespace path");let K=fS(U)?mS(U).root:"",re=K||G;for(let oe of hS(K?U.slice(K.length):U)){if(oe===""||oe===".")continue;if(oe===".."){re=dS(re);continue}let de=gS(re,oe),Se=j.entryKind(de),we=Se==="symlink"?j.realpath(de):de;if(Se==="missing"||we===null)throw Error(`Cannot resolve path component: ${de}`);re=we}return re}function gS(G,U){return G.endsWith("/")||G.endsWith("\\")?`${G}${U}`:`${G}${pS}${U}`}function hS(G){let U=process.platform==="win32"?/[\\/]+/:/\/+/;return G.split(U)}var xl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],yS=new Set(xl),bS=1024,lf=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),cf=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),CS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ss(G){return yS.has(G)}function Rl(G){return ss(G)||lf.has(G)||cf.has(G)||To(G)}function Zn(G,U,j){return j?.has(G)?j.get(G):U.get(G)}function uf(G,U){let j=Zn("GIT_CONFIG_COUNT",G,U);if(j===void 0)return{state:"absent"};if(j==="")return{state:"valid",count:0};if(!/^\d+$/.test(j))return{state:"invalid"};let K=Number(j);return Number.isSafeInteger(K)&&K<=bS?{state:"valid",count:K}:{state:"invalid"}}function as(G,U,j){let re=G.match(CS)?.[1];if(!re||!Rl(re))return null;let oe=G.indexOf("=");return{name:re,value:`${Zn(re,U,j)??""}${G.slice(oe+1)}`}}function df(G){return mf(G,cf)}function ff(G){return mf(G,lf)}function mf(G,U){if(!G)return!1;for(let j of G.keys())if(U.has(j))return!0;return!1}var hf=/^[A-Za-z_][A-Za-z0-9_]*=/;function Tn(G){if(!hf.test(G))return null;let U=G.indexOf("=");return{name:G.slice(0,U),value:G.slice(U+1)}}function ve(G){let U=new Map,j=0;while(j<G.length){let K=G[j];if(!K)break;let re=Tn(t(K));if(!re)break;U.set(re.name,re.value),j++}return{words:G.slice(j),envAssignments:U}}function yf(G){let U=Ot(G);return G.includes("=")||U==="sudo"||U==="env"||U==="command"||U==="builtin"}function Ir(G,U,j,K){if(!yf(oo(G)))return{words:G,envAssignments:new Map,cwd:j,rewritten:!1};let re=new Set(G),oe=G,de=new Map,Se=new Map(K??[]),we=[],We=j;for(let pt=0;pt<a.wrapperPeelIterations.cap;pt++){let mt=gf(oe),gt=ve(oe);for(let[ht,bt]of gt.envAssignments)de.set(ht,bt),Se.set(ht,bt);if(oe=gt.words,oe.length===0)break;while(oe.length>0&&oo(oe).includes("=")&&!ES(oe)){let ht=xS(oo(oe),Se,U.env)??as(oo(oe),U.env,Se);if(ht)de.set(ht.name,ht.value),Se.set(ht.name,ht.value);oe=oe.slice(1)}if(oe.length===0)break;let yt=Ot(oo(oe));if(yt!=="sudo"&&yt!=="env"&&yt!=="command"&&yt!=="builtin")break;if(yt==="sudo"){let ht=_S(oe,U.paths,We);if(oe=ht.words,ht.cwd!==void 0)We=ht.cwd}if(yt==="env"){let ht=AS(oe,We,Se,U);if(we.push(...ht.envSplitValues??[]),oe=ht.words,ht.cwd!==void 0)We=ht.cwd;for(let[bt,Ct]of ht.envAssignments)de.set(bt,Ct),Se.set(bt,Ct)}if(yt==="command")oe=TS(oe);if(yt==="builtin")oe=oe.slice(Dn(oe,1)==="--"?2:1);if(gf(oe)===mt)break}let ft=ve(oe);for(let[pt,mt]of ft.envAssignments)de.set(pt,mt),Se.set(pt,mt);return{words:ft.words,envAssignments:de,cwd:We,envSplitValues:we.length>0?we:void 0,rewritten:vS(ft.words,re)}}function vS(G,U){return G.some((j)=>!U.has(j))}function gf(G){return G.map(t).join(" ")}function oo(G){let U=G[0];return U?t(U):""}function Dn(G,U){let j=G[U];return j?t(j):void 0}function ES(G){return hf.test(oo(G))}function xS(G,U,j){if(!G.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${U.get("TMPDIR")??j.get("TMPDIR")??""}${G.slice(8)}`}}var RS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function _S(G,U,j){let K=1,re=j;while(K<G.length){let oe=Dn(G,K);if(!oe)break;if(oe==="--")return{words:G.slice(K+1),cwd:re};if(!oe.startsWith("-"))break;if(oe==="-D"||oe==="--chdir"){let de=Dn(G,K+1);re=de?Xo(re,de,U):null,K+=2;continue}if(oe.startsWith("--chdir=")){re=Xo(re,oe.slice(8),U),K++;continue}if(oe.startsWith("-D")&&oe.length>2){re=Xo(re,oe.slice(2),U),K++;continue}if(oe==="-i"||oe==="--login"){re=null,K++;continue}if(RS.has(oe)){K+=2;continue}K++}return{words:G.slice(K),cwd:re}}var wS=new Set(["-i","-0","--null"]),PS=new Set(["-u","--unset","-C","--chdir","-P"]);function AS(G,U,j,K){let re=new Map,oe=[],de=U,Se=1,we=(We)=>({words:G.slice(We),envAssignments:re,cwd:de,envSplitValues:oe.length>0?oe:void 0});while(Se<G.length){let We=Dn(G,Se);if(!We)break;if(We==="--")return we(Se+1);if(We==="-i"||We==="--ignore-environment"||We==="-"){re.clear();for(let pt of j.keys())re.set(pt,"");re.set("TMPDIR",""),Se++;continue}if(wS.has(We)){Se++;continue}if(We==="-u"||We==="--unset"){let pt=Dn(G,Se+1);if(pt!==void 0)re.set(pt,"");Se+=2;continue}if(We.startsWith("-u")&&We.length>2&&!We.startsWith("-u=")){re.set(We.slice(2),""),Se++;continue}if(We.startsWith("--unset=")){re.set(We.slice(8),""),Se++;continue}let ft=We==="-S"||We==="--split-string"?{value:Dn(G,Se+1),consumed:2}:We.startsWith("-S")&&We.length>2?{value:We.slice(2),consumed:1}:We.startsWith("--split-string=")?{value:We.slice(15),consumed:1}:null;if(ft){if(ft.value!==void 0)oe.push(ft.value);return de=null,we(Se+ft.consumed)}if(PS.has(We)){if(We==="-C"||We==="--chdir"){let pt=Dn(G,Se+1);de=pt?Xo(de,pt,K.paths):null}Se+=2;continue}if(We.startsWith("-u=")){Se++;continue}if(We.startsWith("-C")&&We.length>2||We.startsWith("--chdir=")){let pt=We.startsWith("--chdir=")?We.slice(8):We.startsWith("-C=")?We.slice(3):We.slice(2);de=Xo(de,pt,K.paths),Se++;continue}if(We.startsWith("-P")){Se++;continue}if(We.startsWith("-")){Se++;continue}if(!Tn(We))break;while(Se<G.length){let pt=Tn(Dn(G,Se)??"");if(!pt)break;re.set(pt.name,pt.value),Se++}if(Dn(G,Se)==="--")Se++;return we(Se)}return we(Se)}function Xo(G,U,j){if(U==="")return null;if(!G&&!pf(U))return null;let K=pf(U)?SS(U).root:j.realpath(G??"/");if(K===null)return null;try{return cr(K,U,j)}catch{return null}}function TS(G){if(Dn(G,1)==="-v")return[...jt(["type"]),...G.slice(2)];let U=1;while(U<G.length){let j=Dn(G,U);if(!j)break;if(j==="-p"||j==="-v"||j==="-V"){U++;continue}if(j==="--")return G.slice(U+1);if(j.startsWith("-")&&!j.startsWith("--")&&j.length>1){if(!/^[pvV]+$/.test(j.slice(1)))break;U++;continue}break}return G.slice(U)}var IS=/['"\\$`{}#]/;function ls(G,U){if(G.some((K)=>IS.test(K)))return null;let j=[...G.flatMap((K)=>K.split(/\s+/).filter((re)=>re.length>0)),...U];return j.length<=64?j:null}function ur(G,U,j){return cs(G,U,j).tokens}function kS(G){let U=[],j="",K=0;while(K<G.length){let re=G.charAt(K);if(re==='"'||re==="'"){let oe=G.indexOf(re,K+1);if(oe===-1)return G.split(/\s+/).map((de)=>de.replace(/["']/g,"")).filter((de)=>de.length>0);j+=G.slice(K+1,oe),K=oe+1;continue}if(/\s/.test(re)){if(j.length>0)U.push(j);j="",K++;continue}j+=re,K++}if(j.length>0)U.push(j);return U}function dr(G,U,j,K=0){let re=cs(G,U,j),oe=(re.envSplitValues??[]).flatMap(kS);if(oe.length===0)return re.tokens;let de=[...oe,...re.tokens];if(K>=8)return de;return dr(de,U,j,K+1)}function cs(G,U,j,K){if(!yf(G[0]??""))return{tokens:[...G],envAssignments:new Map,cwd:j};let re=Ir(jt(G),U,j,K);return{tokens:re.words.map(t),envAssignments:re.envAssignments,cwd:re.cwd,envSplitValues:re.envSplitValues}}var Al=Symbol("adopt-as-operand"),OS=new Set(["env","sudo","command","builtin"]),MS=new Set(["&&","||","|&","|","&",";"]),DS=new Set(["<<","<<<",">|"]),NS=new Set(["|","|&"]),LS=/[*@#?$!_-]/,WS=/^\w+(?::\w+)*/,GS=Object.freeze([]),Jo=Object.freeze({kind:"scope",edge:"enter"}),Qo=Object.freeze({kind:"scope",edge:"exit"}),FS=Object.freeze([]),zS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ei=new Set(["bash","sh","zsh","dash","ksh"]),BS=256,Ef=new WeakMap;function xf(G,U){let j=U.status==="complete"?new Set(Pl(U)):new Set,K=HS(G,j);if(Mi(K))return us("unclosed-quote",K,U);let re={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},oe=kr(U,{source:K,suppressed:j,flags:re,depth:0,functions:new Map,powershell:U.dialect==="powershell"});if(re.limited)return us("structural-limit",K,U);if(re.invalid)return us("invalid",K,U);let de=us("complete",K,U,re.assignmentFallbacks);return Ef.set(de,Object.freeze(oe)),de}function fs(G,U,j,K,re){let oe=re.word??((pt)=>pt),de={cwd:U,variables:new Map,previous:null},Se=[],we=new Set,We=null,ft=[];for(let pt of Rf(G)){if(pt.kind==="scope"){if(pt.edge==="enter"){ft.push({state:de,segment:[...Se],shellWords:new Set(we),pipeProducer:We});continue}let mt=re.segment(Se,de,We,null,we);if(mt)return mt;let gt=ft.pop();if(gt===void 0)throw Error("scope exit without a matching enter");de=gt.state,Se=gt.segment,we=gt.shellWords,We=gt.pipeProducer;continue}if(pt.kind==="operator"){if(!pt.boundary)continue;let mt=re.segment(Se,de,We,pt.operator,we);if(mt)return mt;de=$S(Se,de,j,K),We=Se.length>0&&NS.has(pt.operator)?Se:null,Se=[],we=new Set;continue}if(pt.kind==="redirection"){if(pt.fd!==void 0)we.add(Se.length-1);if(pt.target===void 0)continue;let mt=re.redirection({operator:pt.operator,role:pt.role,targetOrder:pt.targetOrder,target:pt.target,...pt.body===void 0?{}:{body:pt.body,consumer:pt.consumer}},de);if(mt===Al){we.add(Se.length),Se.push(oe(pt.target));continue}if(mt)return mt;continue}Se.push(oe(pt.text))}return re.segment(Se,de,We,null,we)}function ms(G){return Rf(G).flatMap((U)=>{if(U.kind==="word")return[{kind:"word",text:U.text}];if(U.kind==="operator")return[{kind:"operator",boundary:U.boundary}];if(U.kind==="redirection")return[{kind:"redirection",target:U.target}];return[]})}function dn(G,U){return G.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(j,K,re,oe)=>{let de=U.get(K);if(de===void 0)return j;let Se=re.startsWith(":")?de!=="":!0;if(re.endsWith("-"))return Se?de:dn(oe,U);return Se?dn(oe,U):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(j,K)=>U.get(K)??j).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(j,K)=>U.get(K)??j)}function ti(G){return G.length>0&&G.every((U)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(U))}function $S(G,U,j,K){let re=ti(G)?new Map([...U.variables,...US(G,U.variables)]):U.variables,oe=ur([...G],j),de=Pt(oe[0]??"").toLowerCase()==="cd"?oe[1]:void 0;if(!de)return{...U,variables:re};if(de==="-"){if(U.previous===null)return{...U,variables:re};return{cwd:U.previous,variables:re,previous:U.cwd}}return{cwd:sn(dn(de,re),U.cwd,j,K),variables:re,previous:U.cwd}}function US(G,U){return G.flatMap((j)=>{let K=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(j),re=K?.[2]?.startsWith("=")?K[2].slice(1):void 0;return K?.[1]!==void 0&&re!==void 0?[[K[1],dn(re,U)]]:[]})}function Rf(G){return Ef.get(G)??GS}function HS(G,U){return[...U].reduce((j,K)=>j.slice(0,K.start)+" ".repeat(K.end-K.start)+j.slice(K.end),G)}function us(G,U,j,K=FS){return Object.freeze({status:G,source:U,program:j,assignmentFallbacks:Object.freeze(K)})}function kr(G,U){return G.nodes.flatMap((j,K)=>jS(j,G,K,U)).sort((j,K)=>j.start-K.start).flatMap((j)=>[...j.events])}function jS(G,U,j,K){if(G.kind==="connector")return[{start:G.span.start,events:[Nn(ZS(G.operator))]}];if(G.kind==="unknown")return[{start:G.span.start,events:[Nn(G.source)]}];if(G.kind==="function")return K.functions.set(G.name,G.body),[];if(G.kind==="group"){let oe=G.style!=="subshell",de=K.source[G.span.end-1]===(oe?"}":")"),Se=oe?K:{...K,functions:new Map(K.functions)};return[{start:G.span.start,events:oe?[ds("{"),...kr(G.body,Se),...de?[ds("}")]:[]]:[Jo,Nn("("),...kr(G.body,Se),...de?[Nn(")")]:[],Qo]}]}let re=ev(G,K.functions);if(re){if(K.depth>=lr.maxDepth||++K.flags.expansions>BS)return K.flags.limited=!0,[];return[{start:G.span.start,events:[...bf(G,K),ds(";"),...kr(re,{...K,depth:K.depth+1}),ds(";")]},...Cf(G,U,j,K)]}return[{start:G.span.start,events:bf(G,K)},...Cf(G,U,j,K)]}function bf(G,U){return[...G.words.map((j)=>({start:j.span.start,events:wf(j,G,U,!1)})),...G.redirections.map((j)=>({start:j.span.start,events:VS(j,G,U)}))].sort((j,K)=>j.start-K.start).flatMap((j)=>j.events)}function VS(G,U,j){let K=G.operator==="<<-"?"<<":G.operator,re=G.target?wf(G.target,U,j,!0):[],oe=re[0],de=oe?.kind==="word"?oe.text:void 0;return[...G.fd===void 0?[]:[Tl(String(G.fd))],Object.freeze({kind:"redirection",operator:K,...G.fd===void 0?{}:{fd:G.fd},role:XS(K),targetOrder:DS.has(K)?"legacy-segment":"immediate",...de===void 0?{}:{target:de},...G.heredoc&&j.suppressed.has(G.heredoc.bodySpan)?{body:G.heredoc.body,consumer:Af(U)}:{}}),...de===void 0?re:re.slice(1)]}function Cf(G,U,j,K){let re=G.redirections.filter((oe)=>oe.operator==="<<"||oe.operator==="<<-");return[...re.flatMap((oe)=>{let de=oe.heredoc;if(!de)return[];let Se=[Tl(de.delimiter),.../[\r\n]/.test(K.source[de.terminatorSpan.end]??"")?[Nn(";")]:[]];if(K.suppressed.has(de.bodySpan))return[{start:de.bodySpan.start,events:Se}];return[{start:de.bodySpan.start,events:[..._f(K.source.slice(de.bodySpan.start,de.bodySpan.end),K),...Se]}]}),...re.some((oe)=>!oe.heredoc&&oe.target)?KS(U,j,K):[]]}function KS(G,U,j){let K=G.nodes.slice(U+1).find((re)=>re.kind==="connector");if(!K||K.span.end>=G.span.end)return[];return[{start:K.span.end,events:_f(j.source.slice(K.span.end,G.span.end),j)}]}function _f(G,U){if(U.depth>=lr.maxDepth)return U.flags.limited=!0,[];let j=y(G,"posix");if(j.status==="limited")return U.flags.limited=!0,[];let K={invalid:!1,limited:!1,expansions:U.flags.expansions,assignmentFallbacks:U.flags.assignmentFallbacks},re=kr(j,{source:G,suppressed:new Set,flags:K,depth:U.depth+1,functions:new Map,powershell:!1});return U.flags.limited||=K.limited,U.flags.expansions=K.expansions,re}function wf(G,U,j,K){let re=[],oe={single:!1,double:!1},de="",Se=!1,we=()=>{let We=Se&&!K?Nn("glob"):de!==""||G.quoted&&re.length===0?Tl(de):void 0;if(We)re.push(We);de="",Se=!1};for(let We of G.parts){if(We.provenance!=="command-substitution"&&We.provenance!=="arithmetic"){for(let gt of _l(We.raw,oe,j.flags,j.powershell)){if(typeof gt==="string"){we(),re.push(Nn(gt));continue}de+=gt.text,Se||=gt.glob}continue}let ft=U.nested.find((gt)=>gt.span.start>=We.span.start&&gt.span.end<=We.span.end);if(oe.double){let gt=j.source.slice(We.span.start,We.span.end);de+=_l(gt,{single:!1,double:!0},j.flags,j.powershell).map((ht)=>typeof ht==="string"?ht:ht.text).join("");let yt=ft?kr(ft,j).filter((ht)=>ht.kind==="redirection"&&ht.body!==void 0):[];if(yt.length>0)re.push(Jo,...yt,Qo);continue}let pt=ft?kr(ft,j):[];if(We.raw.startsWith("`")){de+="${}",we(),re.push(Jo,...pt,Qo);continue}if(We.raw.startsWith("<(")||We.raw.startsWith(">(")){we(),re.push(We.raw.startsWith("<(")?Nn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jo,...pt,...We.raw.endsWith(")")?[Nn(")")]:[],Qo);continue}let mt=We.raw.startsWith("$((")?2:1;de+="${}",we(),re.push(...Array.from({length:mt},()=>Nn("(")),...mt===1?[Jo]:[],...pt,...We.raw.endsWith(")".repeat(mt))?Array.from({length:mt},()=>Nn(")")):[],...mt===1?[Qo]:[])}return we(),re}function _l(G,U,j,K){let re=[],oe="",de=!1,Se=0;while(Se<G.length){let we=G[Se]??"";if(!U.single&&!U.double&&(we==="("||we===")")){re.push({text:oe,glob:de},we),oe="",de=!1,Se++;continue}if(K&&we==="`"&&!U.single){oe+=G[Se+1]??"",Se+=2;continue}if(U.single&&we==="'"){U.single=!1,Se++;continue}if(U.single){oe+=we,Se++;continue}if(U.double){if(we==='"'){U.double=!1,Se++;continue}if(!K&&we==="\\"){let We=G[Se+1]??"";oe+=['"',"\\","$"].includes(We)?We:`\\${We}`,Se+=2;continue}if(we==="$"){let We=Sf(G,Se,U,j,K);oe+=We.text,Se=We.next;continue}oe+=we,Se++;continue}if(we==="'"||we==='"'){U.single=we==="'",U.double=we==='"',Se++;continue}if(!K&&we==="\\"){let We=G[Se+1]??"";de||=We==="*"||We==="?",oe+=We,Se+=2;continue}if(we==="$"){let We=Sf(G,Se,U,j,K);oe+=We.text,Se=We.next;continue}de||=we==="*"||we==="?",oe+=we,Se++}return[...re,{text:oe,glob:de}]}function Sf(G,U,j,K,re){let oe=G[U+1];if(oe==="{"){let Se=re?YS(G,U+2):Qi(G,U+2,G.length).close;if(Se===-1)return K.invalid=!0,{text:"",next:G.length};let we=G.slice(U,Se+1);return qS(we,j,K,re),{text:we,next:Se+1}}if(oe!==void 0&&LS.test(oe))return{text:`\${${oe}}`,next:U+2};let de=(re?WS:/^\w*/).exec(G.slice(U+1))?.[0]??"";return{text:`\${${de}}`,next:U+1+de.length}}function qS(G,U,j,K){let re=G.slice(2,-1),oe=/^[A-Za-z_][A-Za-z0-9_]*/.exec(re)?.[0];if(!oe)return;let de=re.slice(oe.length),Se=[":=","="].find((We)=>de.startsWith(We));if(!Se)return;let we=_l(de.slice(Se.length),{...U},j,K);j.assignmentFallbacks.push(...we.flatMap((We)=>typeof We==="string"||!We.text?[]:[We.text]))}function YS(G,U){let j=1,K=U;while(j>0&&K<G.length){if(G[K]==="{"&&G[K-1]==="$")j++;if(G[K]==="}")j--;K++}return j===0?K-1:-1}function ZS(G){return/^[\r\n]+$/.test(G)?";":G}function Nn(G){return Object.freeze({kind:"operator",operator:G,boundary:MS.has(G)})}function ds(G){return Object.freeze({kind:"operator",operator:G,boundary:!0})}function Tl(G){return Object.freeze({kind:"word",text:G})}function XS(G){if(G==="<<"||G==="<<<")return"here-data";if(G==="<"||G==="<&")return"file-read";return"file-write"}function ni(G){return zS.has(G)||/^python\d/.test(G)}var JS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Pf(G,U){let j=U[0];if(j===void 0||!j.startsWith("-"))return U;let K=JS.get(G)?.has(j)??!1;return Pf(G,U.slice(K?2:1))}function wl(G){let U=G[0];if(U===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(U))return wl(G.slice(1));if(!OS.has(U))return[...G];return wl(Pf(U,G.slice(1)))}function Af(G){let U=zo(G),j=G.words.findIndex((K)=>K.provenance==="literal"&&K.text===U);return wl(j<0?[]:G.words.slice(j).map((K)=>K.text))}function QS(G){let U=Af(G)[0];if(U===void 0)return!1;let j=Pt(U).toLowerCase();return ni(j)&&!ei.has(j)}function Pl(G){return G.nodes.flatMap((U,j)=>{if(U.kind==="group"||U.kind==="function")return Pl(U.body);if(U.kind!=="command")return[];let K=U.nested.flatMap((Se)=>Pl(Se)),re=U.redirections.flatMap((Se)=>Se.heredoc?.quotedDelimiter?[Se.heredoc.bodySpan]:[]);if(QS(U))return[...K,...re];let oe=G.nodes[j+1];if(oe?.kind==="connector"&&(oe.operator==="|"||oe.operator==="|&")||!nv(U))return K;return[...K,...re]})}function ev(G,U){let j=zo(G);return j===void 0?void 0:U.get(j)}function fr(G,U){return G!==void 0&&G.provenance==="literal"&&!G.quoted&&G.raw===G.text&&G.text===U}function tv(G){if(fr(G.words[0],"git"))return fr(G.words[1],"commit");if(!fr(G.words[0],"gh")||!fr(G.words[2],"create"))return!1;return fr(G.words[1],"pr")||fr(G.words[1],"issue")}function nv(G){return(fr(G.words[0],"cat")||fr(G.words[0],"tee")||tv(G))&&!G.words.some(vf)&&!G.redirections.some((j)=>vf(j.target))}function vf(G){return G?.parts.some((U)=>U.provenance==="command-substitution"&&U.raw.startsWith(">("))??!1}var Tf=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),If=new Set([...Tf,"glob"]),rv=new Set([...If,"folder","pattern","patterns"]);class b extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function kf(G){let U=ov(),j=ie(G.input),K=[];if((G.route.kind==="command"||G.route.kind==="unknown")&&j)K.push({usage:"input-candidate",source:j});if(G.route.kind==="command"&&"command"in G&&G.command)K.push({usage:"declared-command",source:G.command});let re=K.reduce((oe,de)=>{let Se=oe.findIndex((ft)=>ft.source===de.source);if(Se!==-1){let ft=oe[Se];if(!ft)return oe;return oe[Se]={...ft,usages:[...ft.usages,de.usage]},oe}let we=G.route.kind==="command"?G.route.shell:process.platform==="win32"?"powershell":"posix",We=U.getCommandProgram(de.source,we);return oe.push({usages:[de.usage],source:de.source,program:We,shell:U.getShellSyntax(de.source,We)}),oe},[]);return{invocation:{toolName:G.toolName,route:G.route,context:G.context},commands:re,paths:iv(G),store:U}}function fn(G,U){return G.commands.find((j)=>j.usages.includes(U))}function Xn(G,U){if(!G.includes("$"))return G;return aa(G,U)}function ov(){let G=new Map,U=new Map,j=new WeakMap,K=(oe,de)=>{let Se=`${de}\x00${oe}`,we=U.get(Se);if(we)return we;let We=y(oe,de);return U.set(Se,We),We};return{getShellSyntax:(oe,de)=>{if(de&&de.source!==oe)throw TypeError("Shell syntax source does not match command program source.");let Se=de??K(oe,"posix");if(Se.status==="limited"){let ft=j.get(Se);if(ft)return ft;let pt={status:"structural-limit",source:oe,program:Se,assignmentFallbacks:[]};return j.set(Se,pt),pt}let we=G.get(oe);if(we)return we;let We=xf(oe,Se);return G.set(oe,We),We},getCommandProgram:K}}function iv(G){let U=G.route.kind==="grep"?If:G.route.kind==="glob"?rv:Tf;return[...lu(G.input,U),...G.route.kind==="patch"||typeof G.input==="string"?du(G.input):[]]}var sv=new Set(["-S","--suffix"]);function io(G,U,j,K,re){if(G.status==="structural-limit")throw new b;if(G.status!=="complete")return re.findMalformedTarget(G.source);return fs(G,U,j,K,{segment:(oe,de)=>re.findSegmentTarget(oe,de),redirection:(oe,de)=>oe.role==="file-write"&&re.isRedirectionTarget(dn(oe.target,de.variables),de)?oe.target:null})}function ps(G){let U=[],j=null,K=!1;for(let re=0;re<G.length;re++){let oe=G[re];if(oe===void 0)break;if(!K&&oe==="--"){K=!0;continue}if(!K&&(oe==="-t"||oe==="--target-directory")){j=G[++re]??null;continue}if(!K&&oe.startsWith("--target-directory=")){j=oe.slice(19);continue}if(!K&&oe.startsWith("-t")&&oe.length>2){j=oe.slice(2);continue}if(!K&&sv.has(oe)){re++;continue}if(!K&&(oe.startsWith("--suffix=")||oe.startsWith("--backup=")))continue;if(!K&&oe.startsWith("-"))continue;U.push(oe)}return j?{sources:U,destination:j}:{sources:U.slice(0,-1),destination:U.at(-1)??null}}var k="Git metadata and hooks are protected. Ask the user before modifying them.";function Nf(G,U,j,K){let re=G.invocation.context.executionCwd;if(!U)return null;if(G.invocation.route.kind==="patch"||G.invocation.route.kind==="path"||G.invocation.route.kind==="unknown"){if(Ri(G.invocation.toolName))return null;let Se=G.paths.find((we)=>Of(we,re,U,j,K,U.entries));return Se?{target:Se}:null}if(G.invocation.route.kind!=="command")return null;let oe=fn(G,"input-candidate");if(!oe)return null;let de=io(oe.shell,re,j,K,{findSegmentTarget:(Se,we)=>hv(Se,we,U,j,K),isRedirectionTarget:(Se,we)=>Of(Se,we.cwd,U,j,K,U.markerFiles),findMalformedTarget:()=>null});return de?{target:de}:null}function Or(G,U,j,K,re,oe,de=!1){if(!j)return!1;let Se=hs(sn(G,U,re,oe)),we=Se.replace(/(\/\.?\*+)+$/,"");if(we!==Se&&we!==""){if(Il(we,j))return!0;let We=de||Se.slice(we.length).includes("/."),ft=(pt)=>We?gs(pt,we):dv(pt,we);if(j.markerFiles.some(ft))return!0;return K&&kl(j).some(ft)}if(Il(Se,j))return!0;return K&&kl(j).some((We)=>gs(We,Se))}function dv(G,U){let j=Df(U,G);if(j===""||j.startsWith("..")||Mf(j))return!1;return!j.split(/[\\/]/)[0]?.startsWith(".")}function fv(G,U,j,K,re){return Or(G,U,j,!0,K,re)}function mv(G,U,j,K,re){if(!j)return!1;return Il(hs(sn(G,U,K,re)),j)}function Of(G,U,j,K,re,oe){let de=hs(sn(G,U,K,re));return oe.includes(de)||Wf(de,j)}function Lf(G,U,j,K,re){if(!j)return!1;return j.hooksDirectories.some((oe)=>G.some((de)=>gs(oe,hs(sn(de,U,K,re)))))}function Il(G,U){return U.entries.includes(G)||U.directories.includes(G)||Wf(G,U)}function Wf(G,U){return U.hooksDirectories.some((j)=>gs(G,j))}var pv=50000;function Gf(G,U){let j=[...new Set(kl(G))];if(j.some((re)=>U(cv(re))))return!0;let K=0;while(j.length>0){let re=j.pop()??"",oe=gv(re);if(!oe)return!0;if(K+=oe.length,K>pv)return!0;if(oe.some((de)=>U(de.name)))return!0;j.push(...oe.filter((de)=>de.isDirectory()).map((de)=>uv(re,de.name)))}return!1}function gv(G){try{let U=av(G,{throwIfNoEntry:!1});if(!U)return[];if(!U.isDirectory())return U.isSymbolicLink()?null:[];return lv(G,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function kl(G){return[...G.entries,...G.directories,...G.hooksDirectories]}function gs(G,U){let j=Df(U,G);return j===""||!/^\.\.(?:[\\/]|$)/.test(j)&&!Mf(j)}function hs(G){return process.platform==="win32"?G.toLowerCase():G}function hv(G,U,j,K,re){if(ti(G))return null;let oe=dr([...G],K);if(Pt(oe[0]??"").toLowerCase()!=="mv")return null;let de=ps(oe.slice(1)),Se=de.sources.find((we)=>fv(dn(we,U.variables),U.cwd,j,K,re));if(Se)return Se;return de.destination&&mv(dn(de.destination,U.variables),U.cwd,j,K,re)?de.destination:null}import{isAbsolute as Ss,normalize as Rv,parse as _v,posix as Vf,resolve as Dr,sep as Nl}from"node:path";import{isAbsolute as yv,join as Ff,normalize as $f,parse as bv,sep as zf}from"node:path";var Cv=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Sv=` 	
-`;function ri(G,U){if(Mr(G,U))return!0;if(!G.has("TMPDIR"))return!1;return!Ol(G.get("TMPDIR")??"",U)}function so(G,U){if(G.has("TMPDIR"))return Ol(G.get("TMPDIR")??"",U);let j=Ml(G,U);if(j===void 0)return!0;return Ol(j,U)}function Ml(G,U){return Hf(G,U,"TMPDIR")}function Ol(G,U){if(!G)return!1;if(Ev(G))return!1;return ao(G,U)}function Mr(G,U){let j=Hf(G,U,"IFS");return j!==void 0&&j!==""&&j!==Sv}function ao(G,U){let j=ys(G,U.paths);if(j===null)return!1;return Uf(U).some((K)=>lo(j,K))}function Cs(G,U){let j=ys(G,U.paths);if(j===null)return!1;return Uf(U).some((K)=>bs(K)===bs(j))}var Bf=new WeakMap;function Uf(G){let U=Bf.get(G);if(U)return U;let j=vv(G);return Bf.set(G,j),j}function vv(G){let U=Cv.map((K)=>ys(K,G.paths)??$f(K)),j=ys(G.tmpdir,G.paths);if(!j)return U;if(process.platform==="win32")return[...U,j];if(process.platform==="darwin"&&xv(j))return[...U,j];return U}function Ev(G){return/[\s$`*?[]/.test(G)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(G)||/[+@!]\([^)]*\)/.test(G)}function Hf(G,U,j){return G.has(j)?G.get(j):U.env.get(j)}function xv(G){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(G)}function ys(G,U){try{let j=$f(G);if(!yv(j))return j;let K=bv(j).root,re=j.slice(K.length).split(/[\\/]+/).filter(Boolean),oe=K;for(let de=0;de<re.length;de++){let Se=Ff(oe,re[de]??"");if(U.entryKind(Se)==="missing")return Ff(Se,...re.slice(de+1));let we=U.realpath(Se);if(we===null)return null;oe=we}return oe}catch{return null}}function lo(G,U){let j=bs(G),K=bs(U);if(j===K)return!0;let re=K.endsWith(zf)?K:`${K}${zf}`;return j.startsWith(re)}function bs(G){return process.platform==="win32"?G.toLowerCase():G}var wv=process.platform==="win32",jf=64,Pv=16384;function oi(G,U,j,K){if(G.kind==="temp_target")return null;let re=K[G.kind];if(G.kind==="dynamic_target"&&!Zt(j,re.id,U.strict))return null;if(G.kind==="within_anchored_cwd"&&!Zt(j,re.id,U.paranoid))return null;return xt(re.id,re.reason)}function ii(G){let U=Md(G,jf,jf,Pv);return{expandedTargets:U&&"words"in U?U.words:void 0,unsafeBraceExpansion:U!==void 0&&"limited"in U,targetIsLiteral:U===void 0&&G.provenance==="literal"&&(G.quoted||G.raw!==G.text),tmpdirWordSplittingProtected:Av(G)}}function Av(G){let U=G.parts.filter((j)=>j.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(j.raw));return U.length>0&&U.every((j)=>Tv(G.raw,j.span.start-G.span.start))}function Tv(G,U){let j=null,K=!1;for(let re=0;re<U;re++){let oe=G[re];if(K){K=!1;continue}if(oe==="\\"&&j!=="'"){K=!0;continue}if(j===oe){j=null;continue}if(j===null&&(oe==="'"||oe==='"'))j=oe}return j==='"'}function mr(G){let U=G.environment.home,j=G.environment.paths,K=G.budget??_n();return{anchoredCwd:G.originalCwd??G.cwd??null,resolvedCwd:G.cwd??null,strict:G.strict??!1,paranoid:G.paranoid??!1,trustTmpdirVar:G.allowTmpdirVar??!0,posixShell:G.posixShell??!1,tmpdirWordSplittingUnsafe:G.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:G.trustedTmpdirValue??G.allowTmpdirVar??!0,environment:G.environment,allowRoots:Nv(G.allowPaths,U,j,K),protectedGitMetadata:G.protectedGitMetadata,budget:K}}function Ln(G,U,j={}){let K=j.targetIsLiteral??!1;if(!K&&U.tmpdirWordSplittingUnsafe&&!j.tmpdirWordSplittingProtected&&Wv(G))return{kind:"outside_anchored_cwd"};let re=!K&&qf(G,U.posixShell);if(ir(G))return{kind:"outside_anchored_cwd"};if(Ll(G,K))return{kind:"root_or_home_target"};if(kv(G,U,K))return{kind:"root_or_home_target"};if(U.resolvedCwd&&Or(G,U.resolvedCwd,U.protectedGitMetadata,!0,U.environment,U.budget,!U.posixShell))return{kind:"git_metadata_target"};if(Ov(G,U.trustTmpdirVar,U.posixShell,re,K,j.tmpdirWordSplittingProtected??!1,U.trustedTmpdirValue,U.environment))return{kind:"temp_target"};if(re)return{kind:"dynamic_target"};if(Lv(G,U,K))return{kind:"temp_target"};let oe=U.anchoredCwd;if(oe){if(!j.skipHomeCwd&&Bv(oe,U.environment.home,U.environment.paths,U.budget))return{kind:"home_cwd_target"};if(!j.skipCwdSelf&&[U.resolvedCwd??oe,oe].some((de)=>$v(G,U.resolvedCwd??oe,U.environment.paths,U.budget,de)))return{kind:"cwd_self_target"};if(Uv(G,oe,U.resolvedCwd??oe,re,K,U.environment.paths,U.budget))return{kind:"within_anchored_cwd"}}if(Iv(G,U,re))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function Iv(G,U,j){let K=G.trim();if(j||!U.resolvedCwd||!U.anchoredCwd||!K)return!1;if(Ss(K)||K.startsWith("~"))return!1;if(Wl(K))return!1;if(Yf(U.resolvedCwd,U.anchoredCwd,U.environment.paths,U.budget))return!1;return ao(Dr(U.resolvedCwd,K),U.environment)}function Kf(G,U,j={}){let{containmentTarget:K,...re}=j;if(Ln(G,U,re).kind!=="temp_target")return!1;let oe=G.trim();if(Dv(oe))return!1;if(Cs(oe,U.environment))return!1;return![U.anchoredCwd,U.resolvedCwd].some((de)=>Yf(K??oe,de,U.environment.paths,U.budget))}function Ll(G,U=!1){let j=G.trim(),K=Vf.normalize(j),re=j.replace(/\\/g,"/"),oe=K==="/"?K:K.replace(/\/+$/,"");if(oe==="/"||oe.startsWith("/")&&oe.slice(1).split("/").every((de)=>/^\*+$/.test(de)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(re)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(re))return!0;if(!U&&(K==="~"||K==="~/"||K==="~/*"))return!0;if(!U&&(K==="$HOME"||K==="$HOME/"||K==="$HOME/*"))return!0;if(!U&&(K==="${HOME}"||K==="${HOME}/"||K==="${HOME}/*"))return!0;return!1}function kv(G,U,j){let K=G.trim(),re=j?K:K==="*"?".":K.endsWith("/*")?K.slice(0,-2):K;if(!re)return!1;try{let oe=Ss(re)?re:U.resolvedCwd?Dr(U.resolvedCwd,re):null;if(!oe)return!1;let de=mn(Dt(oe,U.environment.paths,U.budget));if(de===_v(de).root)return!0;return de===mn(Dt(U.environment.home,U.environment.paths,U.budget))}catch{return!1}}function mn(G){let U=Rv(G);if(wv){if(U=U.replace(/\//g,"\\").toLowerCase(),U.length>3&&U.endsWith("\\"))U=U.slice(0,-1);return U}if(U.length>1&&U.endsWith("/"))U=U.slice(0,-1);return U}function Ov(G,U,j,K,re,oe,de,Se){let we=G.trim();if(Wl(we))return!1;if(!K&&ao(we,Se))return!0;return(U||oe&&de)&&j&&!re&&Mv(we,j)}function Mv(G,U){return["$TMPDIR","${TMPDIR}"].some((j)=>{if(G===j)return!0;if(!G.startsWith(`${j}/`))return!1;return!qf(G.slice(j.length+1),U)})}function Dv(G){let U=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(G);if(!U)return!1;return Vf.normalize(`/${U[1]??""}`)==="/"}function Wl(G){return G.split(/[\\/]+/).includes("..")}function Nv(G,U,j,K){if(!G?.length)return[];return G.flatMap((re)=>{let oe=Wo(re.trim(),U);if(!Ss(oe))return[];try{let de=Dt(oe,j,K);if(Go(de,Dt(U,j,K)))return[];return[mn(de)]}catch{return[]}})}function Lv(G,U,j){if(U.allowRoots.length===0)return!1;let K=G.trim();if(Wl(K))return!1;let re=j?K:Wo(K,U.environment.home),oe=U.resolvedCwd??U.anchoredCwd,de=Ss(re)?re:oe?Dr(oe,re):null;if(!de)return!1;try{let Se=mn(Dt(de,U.environment.paths,U.budget));return U.allowRoots.some((we)=>Se===we||Se.startsWith(we.endsWith(Nl)?we:`${we}${Nl}`))}catch{return!1}}function Wv(G){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(G)}function qf(G,U=!1){return G.includes("$")||G.includes("`")||Gv(G)||U&&Fv(G)}function Gv(G){let U=!1;for(let j of G){if(U){U=!1;continue}if(j==="\\"){U=!0;continue}if(j==="*"||j==="?"||j==="[")return!0}return!1}function Fv(G){let U=!1;for(let j=0;j<G.length;j++){let K=G[j];if(U){U=!1;continue}if(K==="\\"){U=!0;continue}if(K==="{"&&zv(G,j)||(K==="+"||K==="@"||K==="!")&&G[j+1]==="(")return!0}return!1}function zv(G,U){let j=G.indexOf("}",U+1);if(j===-1)return!1;let K=G.slice(U+1,j);return K.includes(",")||K.includes("..")}function Bv(G,U,j,K){try{return mn(Dt(G,j,K))===mn(Dt(U,j,K))}catch{try{return mn(G)===mn(U)}catch{return!1}}}function $v(G,U,j,K,re=U){if(re===U&&(G==="."||G==="./"||G===".\\"))return!0;try{return mn(Dt(Dr(U,G),j,K))===mn(Dt(re,j,K))}catch{try{return mn(Dr(U,G))===mn(re)}catch{return!1}}}function Uv(G,U,j,K,re,oe,de){let Se=j??U;if(!re&&(G.startsWith("~")||G.startsWith("$HOME")||G.startsWith("${HOME}")))return!1;if(K)return!1;if(G.startsWith("/")||/^[A-Za-z]:[\\/]/.test(G))try{return Dl(G,U,oe,de)}catch{return!1}if(G.startsWith("./")||G.startsWith(".\\")||!G.includes("/")&&!G.includes("\\"))try{return Dl(Dr(Se,G),U,oe,de)}catch{return!1}if(G.startsWith("../"))return!1;try{return Dl(Dr(Se,G),U,oe,de)}catch{return!1}}function Dl(G,U,j,K){try{return Zf(Dt(G,j,K),Dt(U,j,K))}catch{return!1}}function Yf(G,U,j,K){if(!U)return!1;try{return Zf(Dt(U,j,K),Dt(G,j,K))}catch{return!0}}function Zf(G,U){let j=mn(G),K=mn(U);return j.startsWith(`${K}${Nl}`)||j===K}var Hv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Xf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",jv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Jf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Qf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Vv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Kv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",qv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Qf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:k},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Jf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Vv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Xf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:jv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Xf}};function em(G,U,j){return Yv(G.words.map((K)=>({kind:"word",text:K.text,dynamic:K.provenance!=="literal"})),U,mr({...j,allowPaths:j.policy?.destructiveCommandAllowPaths}),j.policy)}function Yv(G,U,j,K){let re=G.filter((we)=>we.kind==="word"),oe=Xv(re),de=re[oe];if(!de||!Hv.has(sE(de.text)))return null;let Se=Zv(re.slice(oe+1));if(Se.whatIfProtected)return null;if(Zt(K,"powershell.remove-item-pipeline-dynamic-target",j.strict)&&U&&(Se.targets.length===0||Se.recursive))return xt("powershell.remove-item-pipeline-dynamic-target",Kv);for(let we of Se.targets)if(!ir(we.text)&&Ll(Fl(we.text)))return xt(Se.recursive&&Se.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Qf);for(let we of Se.targets)if(j.resolvedCwd&&Or(Fl(we.text),j.resolvedCwd,j.protectedGitMetadata,Se.recursive,j.environment,j.budget,!0))return xt("powershell.remove-item-git-metadata",k);if(!Se.recursive||!Se.force)return null;if(Zt(K,"powershell.remove-item-recursive-force-dynamic-target",j.strict)&&(Se.hasDynamicTarget||Se.targets.length===0))return xt("powershell.remove-item-recursive-force-dynamic-target",Jf);for(let we of Se.targets){let We=oi(Ln(Fl(we.text),j),j,K,qv);if(We)return We}return null}function Zv(G){let U=[],j=!1,K=!1,re=!1,oe=!1,de=!1;for(let Se=0;Se<G.length;Se++){let we=G[Se];if(!we||we.kind!=="word")continue;if(Jv(we))continue;if(de){U.push(Gl(we)),oe=oe||we.dynamic;continue}if(we.text==="--"){de=!0;continue}let We=eE(we.text);if(!We){U.push(Gl(we)),oe=oe||we.dynamic;continue}if(tE(We.name)){let ft=We.value?Qv(We.value,we):G[++Se];if(ft?.kind==="word"){U.push(Gl(ft)),oe=oe||ft.dynamic;continue}oe=!0;continue}if(nE(We.name)){j=!0;continue}if(rE(We.name)){K=!0;continue}if(oE(We.name))re=iE(We.value)}return{targets:U,recursive:j,force:K,whatIfProtected:re,hasDynamicTarget:oe}}function Xv(G){let U=G[0];if(U?.kind==="word"&&U.text==="&"||U?.text===".")return G.length>1?1:0;return 0}function Gl(G){return{text:G.kind==="word"?G.text:"",dynamic:G.kind==="word"&&G.dynamic}}function Jv(G){return G.kind==="word"&&G.text===","}function Fl(G){let U=G.replace(/\\/g,"/"),j=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(U);return j?`$HOME${U.slice(j[0].length)}`:U}function Qv(G,U){return{kind:"word",text:G,dynamic:U.kind==="word"&&(U.dynamic||G.includes("$"))}}function eE(G){if(!G.startsWith("-")||G==="-")return null;let U=G.slice(1),j=U.indexOf(":");if(j===-1)return{name:U.toLowerCase()};return{name:U.slice(0,j).toLowerCase(),value:U.slice(j+1)}}function tE(G){return"path".startsWith(G)||"literalpath".startsWith(G)}function nE(G){return"recurse".startsWith(G)}function rE(G){return G.length>=2&&"force".startsWith(G)}function oE(G){return G==="wi"||"whatif".startsWith(G)}function iE(G){if(G===void 0||G==="")return!0;let U=G.toLowerCase();return U==="$true"||U==="true"}function sE(G){return G.toLowerCase()}var co="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",vs="Unsupported heredoc syntax",si="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",tm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var aE=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),lE=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),cE=new Set(["-o","--output","--query","--subscription"]),uE=new Set;function nm(G){if(G==="aws")return aE;if(G==="gcloud")return lE;if(G==="az")return cE;return uE}var dE=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),fE=new Set;function rm(G){if(G==="git")return Cn;if(G==="docker")return dE;return fE}function A(G,U){if(G.length===0||U.length===0)return null;let j=Ot(G[0]??""),K=cn(G);for(let re of U){if(!gE(j,re.command))continue;if(re.match){if(mE(j,G,re.match))return om(re);continue}if(!hE(j,G,re.subcommand))continue;if(bE(G,new Set(re.block_args),K))return om(re)}return null}function om(G){return{id:`custom.${G.name}`,reason:`[${G.name}] ${G.reason}`,intent:G.intent??"manual_only"}}function mE(G,U,j){let K=U.slice(1);if(j.exclude_args?.some((re)=>K.includes(re)))return!1;if(j.any_args&&!j.any_args.some((re)=>K.includes(re)))return!1;return pE(K,j.command_path,nm(G))}function pE(G,U,j){let K=0,re=!1;for(let oe of G){if(K>=U.length)return!0;if(re){re=!1;continue}if(oe.startsWith("-")){re=!oe.includes("=")&&j.has(oe);continue}if(oe!==U[K])return!1;K++}return K>=U.length}function gE(G,U){return G===Ot(U)}function hE(G,U,j){if(!j)return!0;return im(U,1,j,rm(G))}function im(G,U,j,K){let re=!1;for(let oe=U;oe<G.length;oe++){let de=G[oe];if(!de)continue;if(re){re=!1;continue}if(de==="--"){let Se=G[oe+1];if(Se&&!Se.startsWith("-"))return Se===j;return!1}if(K.has(de)){re=!0;continue}if(de.startsWith("-")){if(!de.includes("=")&&yE(G,oe,j,K))return!0;continue}return de===j}return!1}function yE(G,U,j,K){let re=G[U+1];if(!re||re.startsWith("-"))return!1;return im(G,U+2,j,K)}function bE(G,U,j){return G.some((K)=>U.has(K))||[...j].some((K)=>U.has(K))}var CE=new Set(["-e","--source"]),SE=new Set(["-F","-v","--assign","--field-separator"]),sm=new Set(["-f","--file"]),vE=new Set(["print","printf","return"]),am=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],EE="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function lm(G,U,j){let K=!1;for(let re of xE(G)){let oe=RE(re,j);if(!oe)continue;for(let de of oe.commands){let Se=U(de);if(Se)return Se;if(de.includes("{}")||/[$`]/.test(de))K=!0}K||=oe.dynamic}return K?xt("awk.system-dynamic",EE):null}function Bl(G){let U=[],j=!1,K=!1,re=!0,oe=!0;for(let de=1;de<G.length;de++){let Se=G[de];if(Se===void 0)break;if(re&&Se==="--"){re=!1;continue}if(re&&CE.has(Se)){j=!0;let we=G[de+1];if(oe&&=we!==void 0,we!==void 0)U.push({tokenIndex:de+1,kind:"inline-code",value:we});de++;continue}if(re&&Se.startsWith("--source=")){j=!0,U.push({tokenIndex:de,kind:"inline-code",value:Se.slice(9)});continue}if(re&&Se.startsWith("-e")&&Se.length>2){j=!0,U.push({tokenIndex:de,kind:"inline-code",value:Se.slice(2)});continue}if(re&&(SE.has(Se)||sm.has(Se))){let we=G[de+1];if(oe&&=we!==void 0,sm.has(Se)){if(K=!0,we!==void 0)U.push({tokenIndex:de+1,kind:"program-file",value:we})}de++;continue}if(re&&(Se.startsWith("-F")||Se.startsWith("-v")&&Se.slice(2).includes("=")))continue;if(re&&Se.startsWith("-f")&&Se.length>2){K=!0,U.push({tokenIndex:de,kind:"program-file",value:Se.slice(2)});continue}if(re&&(Se.startsWith("--assign=")||Se.startsWith("--field-separator=")))continue;if(re&&Se.startsWith("--file=")){K=!0,U.push({tokenIndex:de,kind:"program-file",value:Se.slice(7)});continue}if(re&&Se.startsWith("-")&&Se!=="-")continue;if(!j&&!K)U.push({tokenIndex:de,kind:"main-program",value:Se});return{sources:U,optionsOpen:!1}}return{sources:oe?U:[],optionsOpen:re&&oe}}function li(G){return Bl(G).sources}function xE(G){return li(G).filter((U)=>U.kind!=="program-file").map((U)=>U.value)}function RE(G,U){En(U,G);let j=G.includes("system")?$l(G,U):null,K=_E(G,U);if(!j&&!K)return null;return{dynamic:!!j?.dynamic||!!K?.dynamic,commands:[...j?.commands??[],...K?.commands??[]]}}function $l(G,U){En(U,G);let j=[],K=!1,re=!1,oe=0;while(oe<G.length){let de=G[oe];if(de==='"'||de==="'"){oe=xs(G,oe,de)?.endIndex??oe+1;continue}if(de==="#"){oe=cm(G,oe+1);continue}if(de==="/"&&um(G,oe)){oe=dm(G,oe+1)??oe+1;continue}if(!G.startsWith("system",oe)){oe++;continue}let Se=oe;if(oe+=6,ai(G[Se-1])||ai(G[oe]))continue;let we=Es(G,oe);if(G[we]!=="(")continue;we=Es(G,we+1);let We=G[we];if(We!=='"'&&We!=="'"){K=!0,re=!0;continue}let ft=xs(G,we,We);if(!ft){K=!0,re=!0;continue}if(we=Es(G,ft.endIndex),K=!0,G[we]!==")"){re=!0,oe=ft.endIndex;continue}j.push(ft.value),oe=we+1}if(!K)return null;return{dynamic:re,commands:j}}function _E(G,U){En(U,G);let j=[],K=!1,re=!1,oe=0,de=0,Se=null,we=null,We=0;while(oe<G.length){let ft=G[oe];if(!ft)break;if(ft==='"'||ft==="'"){let gt=xs(G,oe,ft);if(gt&&We===de)we={...gt,startIndex:oe};We=gt?.endIndex??oe+1,oe=gt?.endIndex??oe+1;continue}if(ft==="#"){oe=cm(G,oe+1),de=oe,Se=null,we=null,We=oe;continue}if(ft==="/"&&um(G,oe)){let gt=dm(G,oe+1);We=gt??oe+1,oe=gt??oe+1;continue}if(`;
-{}`.includes(ft)){oe++,de=oe,Se=null,we=null,We=oe;continue}if(Se===null&&(zl(G,oe,"print")||zl(G,oe,"printf")))Se=oe;if(ft!=="|"||G[oe-1]==="|"||G[oe+1]==="|"){if(!/\s/.test(ft))We=oe+1;oe++;continue}let pt=G[oe+1]==="&"?oe+2:oe+1,mt=Es(G,pt);if(zl(G,mt,"getline")){re=!0;let gt=AE(de,we,We);if(K||=gt===null,gt!==null)j.push(gt);We=pt,oe=pt;continue}if(IE(de,Se)){re=!0;let gt=PE(G,mt);if(!gt){K=!0,We=pt,oe=pt;continue}if(!wE(G,gt.endIndex)){K=!0,We=gt.endIndex,oe=gt.endIndex;continue}j.push(gt.value),We=gt.endIndex,oe=gt.endIndex;continue}We=pt,oe++}if(!re)return null;return{dynamic:K,commands:j}}function ai(G){return!!G&&/[A-Za-z0-9_]/.test(G)}function Es(G,U){let j=U;while(/\s/.test(G[j]??""))j++;return j}function wE(G,U){let j=U;while(/[\t\f\v\r ]/.test(G[j]??""))j++;let K=G[j];return!K||`;
-}#`.includes(K)}function xs(G,U,j){let K="",re=!1;for(let oe=U+1;oe<G.length;oe++){let de=G[oe];if(!de)break;if(re){let Se=TE(G,oe);if(!Se)return null;K+=Se.value,oe=Se.endIndex,re=!1;continue}if(de==="\\"){re=!0;continue}if(de===j)return{value:K,endIndex:oe+1};K+=de}return null}function PE(G,U){let j=G[U];if(j!=='"'&&j!=="'")return null;return xs(G,U,j)}function AE(G,U,j){if(!U)return null;return U.startIndex>=G&&U.endIndex===j?U.value:null}function TE(G,U){let j=G[U];if(!j)return null;if(j==="x"){let re=G.slice(U+1,U+3);if(!/^[0-9A-Fa-f]{2}$/.test(re))return null;return{value:String.fromCharCode(Number.parseInt(re,16)),endIndex:U+2}}if(/[0-7]/.test(j)){let re=/^[0-7]{1,3}/.exec(G.slice(U));if(!re)return null;return{value:String.fromCharCode(Number.parseInt(re[0],8)),endIndex:U+re[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[j]??j,endIndex:U}}function zl(G,U,j){return G.startsWith(j,U)&&!ai(G[U-1])&&!ai(G[U+j.length])}function IE(G,U){return U!==null&&U>=G}function cm(G,U){let j=G.indexOf(`
-`,U);return j===-1?G.length:j+1}function um(G,U){let j=kE(G,U);if(j===-1)return!0;if("{([,;!~=".includes(G[j]??""))return!0;let K=j;while(ai(G[K-1]))K--;return vE.has(G.slice(K,j+1))}function kE(G,U){for(let j=U-1;j>=0;j--)if(!/\s/.test(G[j]??""))return j;return-1}function dm(G,U){let j=!1;for(let K=U;K<G.length;K++){let re=G[K];if(!re)break;if(j){j=!1;continue}if(re==="\\"){j=!0;continue}if(re==="/")return K+1}return null}var OE="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",ME="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",DE="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function fm(G){return G==="dd"||G==="shred"||G==="mkfs"||G.startsWith("mkfs.")}function mm(G,U){let j=U.slice(1);if(G==="dd"&&j.some((K)=>/^of=\/dev\/.+/.test(K)))return xt("dd.device-write",OE);if((G==="mkfs"||G.startsWith("mkfs."))&&j.some((K)=>K.startsWith("/dev/")))return xt("mkfs.device",ME);if(G==="shred"&&j.length>0)return xt("shred.target",DE);return null}var NE=new Set(["sudo","env","command","builtin"]),LE=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Rs(G,U){let j=G[0];if(!j||!pm(Pt(j),U))return null;let K=Pt(j),re=G[1]==="--"?2:1,oe=WE(G,re,K,U),de=oe[0];if(de===void 0)return null;return{wrapper:K,tokens:G.slice(de),childIndex:de,alternativeChildIndices:oe.slice(1)}}function WE(G,U,j,K){let re=G[1]==="--",oe=[];for(let de=U;de<G.length;de++){let Se=G[de];if(!Se)continue;let we=Pt(Se)!==j&&GE(Se,K);if(we)oe.push(de);if(!we&&Oi.has(Ot(Se)))break;if(re)break}return oe}function GE(G,U){let j=Pt(G),K=Ot(G);return K==="git"||j==="busybox"||Nr(G)||Aa.has(j)||fm(K)||pm(j,U)||Vt.has(K)||G==="$SHELL"||On(K)||Pn.has(K)||U.rules.some((re)=>re.command===j)}function pm(G,U){return LE.has(G)||U.transparentWrappers.includes(G)}function Nr(G){return NE.has(G.toLowerCase())}function Lr(G,U){return{embedded:!1,cwd:G.cwd,originalCwd:U.originalCwd,effectiveCwd:G.cwd,envAssignments:G.envAssignments,allowTmpdirVar:U.allowTmpdirVar,worktreeMode:U.worktreeMode,wrappedByTransparent:!1}}function Wn(G,U){let j=U.policy??{rules:[],transparentWrappers:[]};return _s([...G],U.environment,U.cwd,U.cwd,new Map,new Map(U.envAssignments??[]),j,{iterations:0},!1)}function*_s(G,U,j,K,re,oe,de,Se,we){let We=cs(G,U,j,oe);for(let[gt,yt]of We.envAssignments)oe.set(gt,yt),re.set(gt,yt);let{tokens:ft,cwd:pt}=We;if(We.envSplitValues){let gt=ls(We.envSplitValues,ft);if(!gt)throw new s("derivedCommandShape");Ul(Se),yield*_s(gt,U,pt,K,re,oe,de,Se,we);return}if(Nr(ft[0]??""))throw new s("wrapperPeelIterations");let mt=Rs(ft,de);if(mt){for(let gt of[mt.childIndex,...mt.alternativeChildIndices])Ul(Se),yield*_s(gt===mt.childIndex?mt.tokens:ft.slice(gt),U,pt,K,new Map(re),new Map(oe),de,Se,!0);return}if(zE(ft)){Ul(Se),yield*_s(ft.slice(1),U,pt,K,re,oe,de,Se,we);return}yield FE(ft,pt,K,re,oe,we)}function FE(G,U,j,K,re,oe){return{tokens:G,cwd:U===null?void 0:U??j,wrapperCwd:U,wrapperEnvAssignments:K,envAssignments:re,head:Pt(G[0]??"").toLowerCase(),wrappedByTransparent:oe}}function Ul(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function zE(G){return Pt(G[0]??"").toLowerCase()==="busybox"&&G.length>1}function Hl(G,U){let j=[],K=U;while(K<G.length){let re=G[K];if(re===void 0||re===":::")break;j.push(re),K++}return{markerIndex:K<G.length&&G[K]===":::"?K:-1,templateTokens:j}}function Jn(G){let U=!1,j=!1;for(let K of G){if(K==="--")break;if(K==="-r"||K==="-R"||jl(K,"recursive")){U=!0;continue}if(K==="-f"||jl(K,"force")){j=!0;continue}if(K.startsWith("-")&&!K.startsWith("--")){if(K.includes("r")||K.includes("R"))U=!0;if(K.includes("f"))j=!0}}return U&&j}function ws(G){let U=G.indexOf("--");return G.slice(1,U===-1?void 0:U).some((j)=>jl(j,"recursive")||/^-[A-Za-z]+$/.test(j)&&/[rR]/.test(j.slice(1)))}function jl(G,U){return G.length>2&&G.startsWith("--")&&U.startsWith(G.slice(2))}var BE=["--init-file","--rcfile"],$E=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Gn(G){for(let U=1;U<G.length;U++){let j=G[U];if(!j)continue;if(j==="-c")return gm(G,U,!0);if(j.startsWith("-")&&j.includes("c")&&!j.startsWith("--")){let K=gm(G,U,!1);if(K!==null)return K}}return null}function Qn(G){let U=Pt(G[0]??"").toLowerCase();if(U==="zsh"||U==="ksh")return Sn(G).syntaxCheck;let j=!1;for(let K of G.slice(1)){if(K==="--")return j;if(K.startsWith("+")&&!K.startsWith("++")){if(K.slice(1).includes("n"))j=!1;continue}if(!K.startsWith("-")||K.startsWith("--"))return j;let re=K.slice(1);if(re.includes("n"))j=!0;if(re.includes("c"))return j}return j}function gm(G,U,j){if(G[U+1]==="--")return G[U+2]||null;let K=G[U+1];if(!K||!j&&K.startsWith("-"))return null;return K}function hm(G){let U=Pt(G[0]??"").toLowerCase(),j=UE(G,U),K=$E.get(U)??null,re=j.argvSource?.kind!=="absent";return{argvSource:U==="bash"?j.argvSource:null,argvSourceApplies:U==="bash"&&j.interactive&&j.argvSource?.kind==="literal",envName:K,envSourceApplies:re&&(K==="BASH_ENV"?!j.interactive:K==="ENV"&&j.interactive)}}function UE(G,U){let j=Sn(G),K=j.commandIndex??j.scriptIndex??G.length,re=[],oe=!1,de=!0;for(let Se=1;Se<K;Se++){let we=G[Se];if(we===void 0||we==="--"||we==="-"||we[0]!=="-"&&we[0]!=="+")break;if(we.startsWith("--")){if(U==="bash"&&de?BE.find((mt)=>we===mt):void 0){let mt=G[Se+1];re.push(mt===void 0?{kind:"absent"}:{kind:"literal",value:mt}),Se++;continue}let pt=we.split("=",1)[0]??we;if(U==="bash"&&wa.has(pt)&&!we.includes("="))Se++;continue}if(U==="bash")de=!1;let We=Pa(U,we,G[Se+1],"startup");if(We.interactive)oe=we[0]==="-";Se+=We.followingValues}return{argvSource:re.at(-1)??null,interactive:oe}}var HE="find -delete permanently removes files. Use -print first to preview.",jE="find -exec rm -rf is dangerous. Use explicit file list instead.",VE=new Set(["-exec","-execdir","-ok","-okdir"]),KE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((G)=>[G,1]),["-fprintf",2]]);function ym(G,U){let j=G.map(t),K=qE(G,j,U);if(K)return K;if(Ps(j,1)&&!ex(G,j,U)){let de=wt(xt("find.delete",HE),U.policy);if(de)return de}let re=U.budget??_n(),oe=0;while(oe<j.length){let de=j[oe],Se=er(de??"");if(Se>0){oe+=Se+1;continue}if(!Un(de)){oe++;continue}re.charge("derivedTokens",j.length-oe-1);let we=uo(j,oe);oe=we.nextIndex;let We=nx(we.tokens,U.environment);if(We){let gt=wt(We,U.policy);if(gt)return gt}let ft=de==="-execdir"||de==="-okdir",pt=U.analyzeTokens?.(we.tokens,ft?null:U.cwd)??null,mt=pt?.id.startsWith("custom.")?pt:wt(pt,U.policy);if(mt)return mt}return null}function qE(G,U,j){if(!Ps(U,1)&&!Vl(U,j.environment))return null;let re=ci(G)??jt(["."]),oe=mr({...j,allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let de of re){let Se=ii(de);for(let we of Se.expandedTargets??[t(de)]){let We=Ln(we,oe,{targetIsLiteral:Se.expandedTargets!==void 0||Se.targetIsLiteral,tmpdirWordSplittingProtected:Se.tmpdirWordSplittingProtected});if(We.kind==="root_or_home_target")return xt("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(We.kind==="git_metadata_target"&&!YE(G,oe.protectedGitMetadata,j.environment))return xt("find.delete-git-metadata",k)}}if(QE(U)&&oe.resolvedCwd&&Lf(re.map(t),oe.resolvedCwd,oe.protectedGitMetadata,oe.environment,oe.budget))return xt("find.delete-git-metadata",k);return null}function YE(G,U,j){if(!U)return!1;let K=G.map(t),re=[],oe=!1,de=ci(G)?.at(-1),Se=de?G.indexOf(de)+1:1;while(Se<K.length){let we=K[Se]??"";if(Un(we)){let We=uo(K,Se),ft=dr([...We.tokens],j),pt=ws(ft),mt=Vt.has(Pt(ft[0]??"").toLowerCase()),gt=We.tokens.some((ht)=>ht!=="{}"&&ht.includes("{}")),yt=(we==="-execdir"||we==="-okdir")&&ft.slice(1).some((ht)=>ht!=="{}"&&!ht.startsWith("-"));if(pt||mt||gt||yt)return!1;oe=!0,Se=We.nextIndex;continue}if(we==="-delete"){oe=!0,Se++;continue}if(we==="-name"||we==="-iname"){let We=G[Se+1];if(!(We?.provenance==="literal"&&!/[[\\]/.test(We.text)))return!1;if(!oe)re.push(XE(We.text,we==="-iname"));Se+=2;continue}if(!ZE.has(we))return!1;Se+=1+er(we)}return re.length>0&&!Gf(U,(we)=>re.every((We)=>We.test(we)))}var ZE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function XE(G,U){let j=G.replace(/[*?]|[.+^${}()|\]/]/g,(K)=>K==="*"?".*":K==="?"?".":`\\${K}`);return new RegExp(`^${j}$`,U?"isu":"su")}var JE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Vl(G,U){let j=0;while(j<G.length){if(!Un(G[j])){j++;continue}let K=uo(G,j),re=dr([...K.tokens],U),oe=Pt(re[0]??"").toLowerCase(),de=Vt.has(oe)&&JE.test((Gn(re)??"").replace(/["'\\]/g,""));if((oe==="rm"||oe==="rmdir"||de)&&re.some((we)=>we.includes("{}")))return!0;j=K.nextIndex}return!1}function QE(G){return G.some((U,j)=>{if(!["-name","-iname"].includes(U))return!1;return G[j+1]?.toLowerCase()==="hooks"})}function ex(G,U,j){if(U.includes("-L")||U.includes("-f")||U.includes("-follow"))return!1;let K=ci(G);if(!K)return!1;let re=j.envAssignments??new Map,oe=Ml(re,j.environment),de=j.trustedTmpdirValue??so(re,j.environment),Se=j.allowTmpdirVar??!ri(re,j.environment),we={environment:j.environment,protectedGitMetadata:j.protectedGitMetadata,cwd:j.cwd,originalCwd:j.originalCwd,strict:j.strict,allowTmpdirVar:Se&&de&&Boolean(oe),allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:j.tmpdirWordSplittingUnsafe??Mr(re,j.environment),trustedTmpdirValue:de,budget:j.budget},We=mr(we),ft=mr({...we,cwd:j.originalCwd??j.cwd}),pt=j.originalCwd&&j.environment.paths.realpath(j.originalCwd),mt=j.cwd&&j.environment.paths.realpath(j.cwd),gt=pt&&mt&&!lo(mt,pt)?j.cwd:void 0;return K.every((yt)=>{let ht=ii(yt);if(ht.unsafeBraceExpansion)return!1;return(ht.expandedTargets??[t(yt)]).every((bt)=>{let Ct=/^\.\/*$/.test(bt)?gt:void 0,vt=Ct??bt,St={targetIsLiteral:ht.expandedTargets!==void 0||ht.targetIsLiteral,tmpdirWordSplittingProtected:ht.tmpdirWordSplittingProtected};if(!Zt(j.policy,"rm.recursive-force-paranoid",j.paranoid??!1)&&!Ct&&Ln(vt,We,St).kind==="within_anchored_cwd")return!0;return Kf(vt,Ct?ft:We,{...St,containmentTarget:tx(vt,oe)})})})}function tx(G,U){if(!U)return G;return G.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>U)}function ci(G){let U=(re)=>{let oe=G[re];return oe?t(oe):void 0},j=1;while(U(j)==="-H"||U(j)==="-P")j++;if(U(j)==="--")j++;let K=[];while(j<G.length){let re=U(j),oe=G[j];if(!re||!oe||re.startsWith("-")||["!","(",")"].includes(re))break;K.push(oe),j++}return K.length>0?K:null}function nx(G,U){let j=ur([...G],U);if(j.length===0)return null;let K=Pt(j[0]??"");if(K==="busybox"&&j.length>1)j=j.slice(1),K=Pt(j[0]??"");if(K==="rm"&&Jn(j))return xt("find.exec-rm-recursive-force",jE);return null}function uo(G,U){let j=U+1;while(j<G.length&&G[j]!==";"&&!(G[j]==="+"&&G[j-1]==="{}"))j++;return{tokens:G.slice(U+1,j),nextIndex:Math.min(j+1,G.length)}}function Ps(G,U){let j=U;while(j<G.length){let K=G[j];if(!K){j++;continue}if(Un(K)){j=uo(G,j).nextIndex;continue}let re=er(K);if(re>0){j+=re+1;continue}if(K==="-delete")return!0;j++}return!1}function er(G){return KE.get(G)??(/^-newer[A-Za-z]{2}$/.test(G)?1:0)}function Un(G){return G!==void 0&&VE.has(G)}import{resolve as kR}from"node:path";function*Kl(G){for(let U of G.nodes)yield*ox(U)}function rx(G){return Object.freeze([...Kl(G)])}function dt(G){return Object.freeze(rx(G).map((U)=>Object.freeze(U.words.map((j)=>j.text))))}function ui(G){let U=y(G,"posix");if(U.status!=="complete"||U.nodes.length!==1)return null;let j=U.nodes[0];if(j?.kind!=="command")return null;if(j.redirections.length>0||j.nested.length>0)return null;if(j.words.some((K)=>K.provenance==="command-substitution"))return null;return j.words.map((K)=>K.text)}function*ox(G){if(G.kind==="command"){yield G;for(let U of G.nested)yield*Kl(U);return}if(G.kind==="group")yield*Kl(G.body)}var ix=5,ql="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function nn(G){let U=G.indexOf("--");if(U===-1)return{index:-1,before:G,after:[]};return{index:U,before:G.slice(0,U),after:G.slice(U+1)}}function Cm(G,U,j){let K=As(G,U,j),re=sx(K.entries);if(re.size===0)return{blockedReason:K.blockedReason,expanded:!1,tokens:G};let oe=G,de=!1;for(let Se=0;Se<ix;Se++){let{subcommand:we,rest:We}=xn(oe),ft=we?.toLowerCase();if(!ft||!re.has(ft))return{blockedReason:K.blockedReason,expanded:de,tokens:oe};let pt=re.get(ft),mt=dx(pt);if(mt===null||mt.length===0)return{blockedReason:ql,expanded:!0,tokens:oe};oe=["git",...mt,...We],de=!0}return{blockedReason:ql,expanded:!0,tokens:oe}}function Sm(G,U,j){return As(G,U,j).entries.some((K)=>K.key.toLowerCase()==="core.sshcommand")}function xn(G){if(G.length===0)return{subcommand:null,rest:[]};let U=G[0];if((U?Pt(U).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let K=1;while(K<G.length){let re=G[K];if(!re)break;if(re==="--"){let oe=G[K+1];if(oe&&!oe.startsWith("-"))return{subcommand:oe,rest:G.slice(K+2)};return{subcommand:null,rest:G.slice(K+1)}}if(!re.startsWith("-"))return{subcommand:re,rest:G.slice(K+1)};K+=Cn.has(re)?2:1}return{subcommand:null,rest:[]}}function sx(G){let U=new Map;for(let j of G){let K=j.key.toLowerCase();if(!K.startsWith("alias."))continue;let re=K.slice(6);if(re!=="")U.set(re,j.value)}return U}function As(G,U,j){if(G.length===0)return{blockedReason:null,entries:[]};let K=G[0];if((K?Pt(K).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let oe=lx(U,j);return{blockedReason:oe.blockedReason,entries:[...oe.entries,...ax(G,U,j)]}}function ax(G,U,j){let K=[],re=1;while(re<G.length){let oe=G[re];if(!oe||oe==="--"||!oe.startsWith("-"))return K;if(oe==="-c"){let de=Yl(G[re+1]);if(de)K.push(de);re+=2;continue}if(oe.startsWith("-c")&&oe.length>2){let de=Yl(oe.slice(2));if(de)K.push(de);re++;continue}if(oe==="--config-env"){let de=bm(G[re+1],U,j);if(de)K.push(de);re+=2;continue}if(oe.startsWith("--config-env=")){let de=bm(oe.slice(13),U,j);if(de)K.push(de);re++;continue}if(Cn.has(oe)){re+=2;continue}re++}return K}function lx(G,U){let j=cx(G,U),K=ux(G,U);return{blockedReason:j===null||K===null?ql:null,entries:[...j??[],...K??[]]}}function cx(G,U){let j=Zn("GIT_CONFIG_PARAMETERS",G,U);if(j===void 0)return[];let K=[],re=ui(j);if(!re)return null;for(let oe of re){let de=Yl(oe);if(!de)return null;K.push(de)}return K}function ux(G,U){let j=uf(G,U);if(j.state==="absent")return[];if(j.state==="invalid")return null;let K=[];for(let re=0;re<j.count;re++){let oe=Zn(`GIT_CONFIG_KEY_${re}`,G,U)?.trim(),de=Zn(`GIT_CONFIG_VALUE_${re}`,G,U);if(!oe||de===void 0)return null;K.push({key:oe,value:de})}return K}function Yl(G){if(!G)return null;let U=G.indexOf("=");return{key:(U===-1?G:G.slice(0,U)).trim(),value:U===-1?void 0:G.slice(U+1)}}function bm(G,U,j){let K=G?.indexOf("=")??-1;if(!G||K===-1)return null;return{key:G.slice(0,K).trim(),value:Zn(G.slice(K+1),U,j)}}function dx(G){let U=G?.trimStart();if(!U||U.startsWith("!"))return null;return ui(U)}var fx="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mx="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",px="git checkout --force discards uncommitted changes. Use 'git stash' first.",gx="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",hx="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",yx="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",bx="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Cx="git switch --force discards uncommitted changes. Use 'git stash' first.",Sx="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",vx="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Ex="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",xx="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Rx="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",_x="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",wx="git push --force destroys remote history. Use --force-with-lease for safer force push.",Px="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Ax="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Tx="git branch -D force-deletes without merge check. Use -d for safe delete.",Ix="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",kx="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Ox="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Mx="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Dx="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Nx="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Lx="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Wx=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Gx=new Set(["--recurse-submodules","--track","-t"]),Zl=new Set(["-b","-B","-U"]),Xl=new Set(["-c","-C"]),Fx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Mt(G,U){let j=G.split("=",1)[0]??G;return j.length>=4&&U.startsWith(j)&&j.startsWith("--")&&j.slice(2).length>=2}var fo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Em(G,U){let{subcommand:j,rest:K}=xn(G);if(!j)return null;switch(j.toLowerCase()){case"checkout":return pr(zx(K,U));case"switch":return pr($x(K));case"restore":return pr(Hx(K));case"reset":return Vx(K);case"clean":return pr(qx(K));case"rm":return pr(Yx(K));case"push":return Wr(Zx(K));case"branch":return Wr(Qx(K));case"stash":return Wr(oR(K));case"worktree":return Wr(iR(K));case"rebase":return pr(eR(K));case"merge":return pr(tR(K));case"tag":return Wr(nR(K));case"reflog":return Wr(rR(K));default:return null}}function pr(G){return G?{...G,localDiscard:!0}:null}function Wr(G){return G?{...G,localDiscard:!1}:null}function zx(G,U){let{index:j,before:K}=nn(G),re=cn(K,{shortOptsWithValue:Zl});if(K.some((Se)=>Mt(Se,"--force"))||re.has("-f"))return xt("git.checkout-force",px);for(let Se of G){if(Se==="-b"||Se==="-B"||Se==="--orphan")return null;if(Mt(Se,"--pathspec-from-file"))return xt("git.checkout-pathspec-from-file",hx)}if(j!==-1){if(K.some((we)=>!we.startsWith("-")))return xt("git.checkout-ref-path",gx);return xt("git.checkout-double-dash",fx)}let oe=Ux(G);if(oe.length>=2)return xt("git.checkout-ambiguous",yx);let de=oe[0];if(de===void 0||re.has("-d")||re.has("-t")||G.some((Se)=>Mt(Se,"--detach")||Mt(Se,"--track")))return null;if(Bx(de)||U(de))return xt("git.checkout-double-dash",mx);return null}function Bx(G){return G==="."||G===".."||/^\.\.?[/\\]/.test(G)||/^([/\\]|[A-Za-z]:[/\\])/.test(G)||G.endsWith("/")||G.startsWith(":")||/[*?[]/.test(G)}function $x(G){let{before:U}=nn(G);if(U.some((K)=>Mt(K,"--discard-changes")))return xt("git.switch-discard-changes",bx);let j=cn(U,{shortOptsWithValue:Xl});if(U.some((K)=>Mt(K,"--force"))||j.has("-f"))return xt("git.switch-force",Cx);return null}function Ux(G){let U=[],j=0;while(j<G.length){let K=G[j];if(!K)break;if(K==="--")break;if(!K.startsWith("-")){U.push(K),j++;continue}if(Wx.has(K)){j+=2;continue}if(Gx.has(K)){let re=G[j+1],oe=K==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];j+=re&&!re.startsWith("-")&&oe.includes(re)?2:1;continue}j++}return U}function Hx(G){let U=jx(G);if(U.isTerminal||!U.hasPathspec&&!U.hasPatch||!U.hasWorktree)return null;return U.hasExplicitLocation?xt("git.restore-worktree",vx):xt("git.restore-unstaged",Sx)}function jx(G){let U=!1,j=!1,K=!0,re=!1,oe=(de)=>{if(!re)K=!1,re=!0;if(de!==void 0)K=de};for(let de=0;de<G.length;de++){let Se=G[de];if(Se===void 0)break;if(Se==="--"){U||=de+1<G.length;break}if(Se==="--pathspec-from-file"){U=!0,de++;continue}if(Se.startsWith("--pathspec-from-file=")){U=!0;continue}if(Se==="-h"||Se==="--help"||Se==="--version")return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!0};if(Se==="--staged"){oe();continue}if(Se==="--no-staged"){oe();continue}if(Se==="--worktree"){oe(!0);continue}if(Se==="--no-worktree"){oe(!1);continue}if(Se==="--patch"){j=!0;continue}if(Se==="--no-patch"){j=!1;continue}if(Fx.has(Se)){de++;continue}if(Se.startsWith("--"))continue;if(Se==="-"){U=!0;continue}if(!Se.startsWith("-")){U=!0;continue}for(let we=1;we<Se.length;we++){let We=Se.charAt(we);if(We==="h")return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!0};if(We==="S"){oe();continue}if(We==="W"){oe(!0);continue}if(We==="p"){j=!0;continue}if(We==="s"||We==="U"){if(we===Se.length-1)de++;break}}}return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!1}}function Vx(G){let U=null;for(let j of G){if(Mt(j,"--hard")){U=xt("git.reset-hard",Ex);break}if(Mt(j,"--merge")){U=xt("git.reset-merge",xx);break}}if(!U)return null;return Kx(G)?Wr(U):pr(U)}function Kx(G){for(let U of G){if(U==="--")return!1;if(!U.startsWith("-"))return!0}return!1}function qx(G){for(let j of G)if(j==="-n"||Mt(j,"--dry-run"))return null;let U=cn(G.filter((j)=>j!=="--"));if(G.some((j)=>Mt(j,"--force"))||U.has("-f"))return xt("git.clean-force",Rx);return null}function Yx(G){let U=!1,j=!1,K=!1;for(let re of nn(G).before){if(Mt(re,"--no-force")){U=!1;continue}if(Mt(re,"--force")){U=!0;continue}if(Mt(re,"--no-cached")){j=!1;continue}if(Mt(re,"--cached")){j=!0;continue}if(Mt(re,"--no-dry-run")){K=!1;continue}if(Mt(re,"--dry-run")){K=!0;continue}let oe=cn([re]);U||=oe.has("-f"),K||=oe.has("-n")}return U&&!j&&!K?xt("git.rm-force",_x):null}function Zx(G){let{before:U,after:j}=nn(G),K=cn(U);if(U.some((de)=>Mt(de,"--mirror")))return xt("git.push-mirror",Ax);if(U.some((de)=>Mt(de,"--force"))||K.has("-f")||vm(U,j).some(Xx))return xt("git.push-force",wx);if(U.some((de)=>Mt(de,"--delete"))||K.has("-d")||vm(U,j).some(Jx))return xt("git.push-delete",Px);return null}function vm(G,U){return[...G.filter((j)=>j!==""&&!j.startsWith("-")),...U]}function Xx(G){return G.startsWith("+")||G.includes(":+")}function Jx(G){return G.length>1&&G.startsWith(":")}function Qx(G){let{before:U}=nn(G),j=cn(U),K=j.has("-D")||j.has("-d")||U.some((oe)=>Mt(oe,"--delete")),re=j.has("-D")||j.has("-f")||U.some((oe)=>Mt(oe,"--force"));if(K&&re)return xt("git.branch-force-delete",Tx);return null}function eR(G){let{before:U}=nn(G);return U.some((j)=>Mt(j,"--abort"))?xt("git.rebase-abort",Ix):null}function tR(G){let{before:U}=nn(G);return U.some((j)=>Mt(j,"--abort"))?xt("git.merge-abort",kx):null}function nR(G){let{before:U}=nn(G);return cn(U).has("-d")||U.some((K)=>Mt(K,"--delete"))?xt("git.tag-delete",Ox):null}function rR(G){return G[0]==="delete"?xt("git.reflog-delete",Mx):null}function oR(G){for(let U of G){if(U==="drop")return xt("git.stash-drop",Dx);if(U==="clear")return xt("git.stash-clear",Nx)}return null}function iR(G){let{before:U}=nn(G);if(!U.includes("remove"))return null;let K=cn(U);if(U.some((re)=>Mt(re,"--force"))||K.has("-f"))return xt("git.worktree-remove-force",Lx);return null}import{dirname as wR,isAbsolute as PR,join as Wm,resolve as AR}from"node:path";var Ql="TMPDIR",ec="IFS",Rm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,_m=/^[A-Za-z_][A-Za-z0-9_]*$/,wm=new Set(["export","typeset","declare","readonly"]),sR=new Set(["builtin","command","time"]),aR=new Set(["do","then","else"]),lR=new Set(["do","then","case"]),xm=new Set(["done","fi","esac"]),cR=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Pm(G,U){return G.map((j)=>j.provenance==="variable"&&Dm(j.text)?Am(j.text,U.shellAssignments):t(j))}function Am(G,U){return G.replace(cR,(j,K,re)=>U.get(K??re??"")??j)}function Hn(G,U){let j=G.parts.every((re)=>re.provenance!=="literal"||!/[$`]/.test(re.raw));if(G.provenance!=="variable"||!j)return null;let K=Am(G.text,U);return/^[~-]/.test(K)||/[\s$`*?[]/.test(K)?null:K}function Tm(G,U){return{env:G,effectiveEnvAssignments:mR(G,U),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Im(G){return{env:G.env,effectiveEnvAssignments:G.effectiveEnvAssignments?new Map(G.effectiveEnvAssignments):void 0,shellAssignments:new Map(G.shellAssignments),bodyDepth:G.bodyDepth,bodyAssignments:new Set(G.bodyAssignments)}}function tc(G,U){let j=Om(G,U),K=G[0]??"";if(lR.has(K))U.bodyDepth+=1;if(K==="elif"||xm.has(K))U.bodyDepth=Math.max(0,U.bodyDepth-1);if(xm.has(K)&&U.bodyDepth===0)U.bodyAssignments.forEach((Se)=>{U.shellAssignments.delete(Se)}),U.bodyAssignments.clear();j.assignments.filter((Se)=>Se.persists).forEach((Se)=>{if(U.shellAssignments.set(Se.name,Se.value),U.bodyDepth>0)U.bodyAssignments.add(Se.name);nc(U,Se)});let re=j.commandIndex;if(re!==-1&&wm.has(G[re]??""))G.filter((Se)=>_m.test(Se)&&Jl(Se)).forEach((Se)=>{pR(U,Se)});let oe=re===-1?-1:Mm(G,re);if(oe===-1||G[oe]!=="unset")return;let de=hR(G,oe);if(de===null)return;G.slice(de).forEach((Se)=>{if(U.bodyDepth>0){U.shellAssignments.set(Se,"");return}gR(U,Se)})}function km(G,U){let j=Om(G,U).assignments;if(j.length===0)return U.effectiveEnvAssignments;let K=new Map(U.effectiveEnvAssignments??[]);return j.forEach((re)=>{K.set(re.name,re.value)}),K}function Om(G,U){let j=aR.has(G[0]??"")?1:0,K=G.findIndex((Se,we)=>we>=j&&!Dm(Se)),re=K!==-1&&wm.has(G[Mm(G,K)]??""),oe=fR(U);return{assignments:G.flatMap((Se,we)=>{let We=uR(Se,oe,U.env);if(!We)return[];if(K!==-1&&we>K&&!re&&!ss(We.name))return[];return oe.set(We.name,We.value),[{...We,persists:K===-1||re}]}),commandIndex:K}}function Mm(G,U){let j=U;while(sR.has(G[j]??"")){j+=1;while(G[j]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(G[j]??""))return U;j+=1}}return j}function Dm(G){return Tn(G)!==null||Rm.test(G)}function uR(G,U,j){return Tn(G)??dR(G,U,j)}function dR(G,U,j){let K=as(G,j,U);if(K)return K;let re=G.match(Rm)?.[1];if(!re)return null;let oe=G.indexOf("=");return{name:re,value:`${U.has(re)?U.get(re):j.get(re)??""}${G.slice(oe+1)}`}}function Jl(G){return G===Ql||G===ec||Rl(G)}function fR(G){return new Map([...G.effectiveEnvAssignments??[],...G.shellAssignments])}function mR(G,U){let j=[Ql,ec].map((K)=>{let re=G.get(K);return re===void 0?null:[K,re]}).filter((K)=>K!==null);if(j.length===0)return U;return new Map([...j,...U??[]])}function nc(G,U){let j=new Map(G.effectiveEnvAssignments??[]);j.set(U.name,U.value),G.effectiveEnvAssignments=j}function pR(G,U){nc(G,{name:U,value:G.shellAssignments.get(U)??G.effectiveEnvAssignments?.get(U)??G.env.get(U)??""})}function gR(G,U){if(!Jl(U)&&!_m.test(U))return;if(G.shellAssignments.set(U,""),ss(U)&&G.env.has(U)){let K=new Map(G.env);K.delete(U),G.env=K}if(!Jl(U)||U===Ql||U===ec||To(U)){nc(G,{name:U,value:""});return}if(!G.effectiveEnvAssignments?.has(U))return;let j=new Map(G.effectiveEnvAssignments);j.delete(U),G.effectiveEnvAssignments=j.size===0?void 0:j}function hR(G,U){let j=U+1;while(j<G.length){let K=G[j];if(!K)return null;if(K==="--")return j+1;if(K==="-v"){j++;continue}if(K.startsWith("-"))return null;return j}return j}import{resolve as yR}from"node:path";function Ts(G,U){return xl.some((j)=>U?.has(j)||G.has(j))}function mo(G,U,j){if(!U)return{gitCwd:null,hasExplicitGitContext:!1};let K=j.realpath(yR(U));if(K===null||!j.isDirectory(K))return{gitCwd:null,hasExplicitGitContext:!1};let re=K,oe=!1,de=1;while(de<G.length){let Se=G[de];if(!Se)break;if(Se==="--")break;if(!Se.startsWith("-"))break;if(Se==="-C"){let we=G[de+1];if(!we)return{gitCwd:null,hasExplicitGitContext:oe};let We=Nm(re,we,j);if(!We)return{gitCwd:null,hasExplicitGitContext:oe};re=We,de+=2;continue}if(Se.startsWith("-C")&&Se.length>2){let we=Nm(re,Se.slice(2),j);if(!we)return{gitCwd:null,hasExplicitGitContext:oe};re=we,de++;continue}if(Se==="--git-dir"||Se==="--work-tree"){oe=!0,de+=2;continue}if(Se.startsWith("--git-dir=")||Se.startsWith("--work-tree=")){oe=!0,de++;continue}de+=Cn.has(Se)?2:1}return{gitCwd:re,hasExplicitGitContext:oe}}function Nm(G,U,j){try{let K=cr(G,U,j);return j.isDirectory(K)?K:null}catch{return null}}function Lm(G,U,j){if(!U.localDiscard||!j.worktreeMode||Ts(j.environment.env,j.envAssignments))return null;let K=mo(G,j.cwd,j.environment.paths);if(!K.gitCwd||K.hasExplicitGitContext)return null;let re=j.environment.worktreeFacts(K.gitCwd);if(!re)return null;if(rc(G,j,re))return null;return{kind:"worktree",originalReason:U.reason,gitCwd:K.gitCwd}}function rc(G,U,j){let{subcommand:K,rest:re}=xn(G),oe=K?.toLowerCase();if(U.dynamicArguments||bR(re)||xR(G,U.environment.env,U.envAssignments,j)||vR(re)||CR(oe,re))return!0;return oe==="clean"&&ER(re)>1}function bR(G){return G.some((U)=>/[$*?[]/.test(U))}function CR(G,U){if(G==="checkout"){let{before:j}=nn(U),K=cn(j,{shortOptsWithValue:Zl}),re=j.some((de)=>Mt(de,"--force"))||K.has("-f"),oe=K.has("-B")||j.some((de)=>de==="-B"||de.startsWith("-B"));return re&&oe}if(G==="switch"){let{before:j}=nn(U),K=cn(j,{shortOptsWithValue:Xl}),re=j.some((de)=>Mt(de,"--force"))||j.some((de)=>Mt(de,"--discard-changes"))||K.has("-f"),oe=j.some((de)=>de==="-C"||de.startsWith("-C")||SR(de))||K.has("-C");return re&&oe}return!1}function SR(G){let U=G.split("=",1)[0]??G;return U==="--force-create"||U.length>=9&&"--force-create".startsWith(U)}function vR(G){return G.some((U)=>U.startsWith("--recurse-sub"))}function ER(G){let U=0;for(let j of G){if(j==="--force"){U++;continue}if(j.startsWith("-")&&!j.startsWith("--")){for(let K of j.slice(1))if(K==="f")U++}}return U}function xR(G,U,j,K){if(Zn("GIT_CONFIG_PARAMETERS",U,j)!==void 0)return!0;let re=As(G,U,j);if(re.blockedReason!==null)return!0;let oe=re.entries.map((Se)=>({key:Se.key.toLowerCase(),value:Se.value}));if(oe.some((Se)=>_R(Se.key)))return!0;let de=oe.filter((Se)=>Se.key==="submodule.recurse").at(-1);if(de)return de.value===void 0||RR(de.value);if(ff(j))return!0;return K.recursiveSubmodules}function RR(G){let U=G.toLowerCase();return U!=="false"&&U!=="no"&&U!=="off"&&U!=="0"}function _R(G){return G==="include.path"||G.startsWith("includeif.")&&G.endsWith(".path")}function Gm(G,U,j){let K=G.map((we)=>Hn(we,j.shellAssignments??new Map)??t(we)),re=j.environment.paths,oe=mo(K,j.cwd,re),de=j.originalCwd?re.realpath(AR(j.originalCwd)):null;if(U.id.startsWith("git.push-")||de===null||oe.gitCwd===null||oe.hasExplicitGitContext||Ts(j.environment.env,j.envAssignments))return null;let Se=U.id==="git.worktree-remove-force"?IR(G,j.shellAssignments,re):Fm(oe.gitCwd,re);if(Se===null||U.id!=="git.worktree-remove-force"&&!TR(Se,K,U,j)||!ao(Se,j.environment)||Cs(Se,j.environment)||lo(de,Se)||lo(Se,de))return null;return{kind:"temp-root",originalReason:U.reason,gitCwd:oe.gitCwd}}function TR(G,U,j,K){let re=K.environment.paths,oe=Wm(G,".git");if(re.entryKind(oe)!=="present")return!1;if(re.isDirectory(oe))return!0;if(!j.localDiscard)return!1;let Se=K.environment.worktreeFacts(G);return Se!==null&&!rc(U,K,Se)}function IR(G,U,j){let K=xn(G.map(t)).rest,{before:re,after:oe}=nn(K.slice(K.indexOf("remove")+1)),de=[...re.filter((ft)=>!ft.startsWith("-")),...oe],Se=de.length===1?de[0]??"":"",we=G.find((ft)=>ft.text===Se),We=(we&&Hn(we,U??new Map))??Se;if(!PR(We)||/[\s$`*?[]/.test(We)||j.entryKind(We)!=="present"||!j.isDirectory(We))return null;return j.realpath(We)}function Fm(G,U){if(U.entryKind(Wm(G,".git"))!=="missing")return G;let j=wR(G);return j===G?null:Fm(j,U)}var OR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",MR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Is(G,U){return zm(G,U)}function zm(G,U,j){let K=G.map(t),re=Cm(K,U.environment.env,U.envAssignments),oe=re.blockedReason?wt(xt("git.alias-config",re.blockedReason),U.policy):null;if(oe)return oe;let de=re.tokens;if((df(U.envAssignments)||Sm(K,U.environment.env,U.envAssignments))&&DR(de))return xt("git.ssh-env",OR);let Se=Em(de,(We)=>{let ft=mo(K,U.cwd,U.environment.paths).gitCwd;return ft!==null&&U.environment.paths.entryKind(kR(ft,We))!=="missing"});if(!Se)return null;if(re.expanded||re.blockedReason)return Se;let we=Lm(K,Se,U)??Gm(G,Se,U);if(!we)return Se;return j?.(we),null}function Bm(G,U){let j=null;return{match:zm(G,U,(re)=>{j=re}),relaxation:j}}function DR(G){let{subcommand:U,rest:j}=xn(G),K=U?.toLowerCase();if(!K)return!1;if(MR.has(K))return!0;if(K==="archive")return nn(j).before.some((re)=>Mt(re,"--remote"));return K==="remote"&&NR(j)}function NR(G){return G.find((U)=>!LR(U))?.toLowerCase()==="update"}function LR(G){return G==="-v"||Mt(G,"--verbose")||Mt(G,"--no-verbose")}import{isAbsolute as f_}from"node:path";function $m(G,U,j,K){let re=G.slice(0,U),oe=G.slice(U+j);return K.startsWith(re)&&K.endsWith(oe)?K.slice(re.length,K.length-oe.length):null}function ks(G,U,j){let K=(oe)=>`${oe.tokenIndex}\x00${oe.kind}\x00${oe.value}`,re=new Set(G.map(K));return Array.from(U).some((oe)=>j(oe).some((de)=>!re.has(K(de))))}var Um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",WR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",GR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",FR="rm -rf targeting root or home directory is extremely dangerous and always blocked.",zR="rm -rf in home directory is dangerous. Change to a project directory first.",Hm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:FR},git_metadata_target:{id:"rm.git-metadata",reason:k},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:GR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:zR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:WR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Um}};function Os(G,U){let j=mr({...U,allowPaths:U.policy?.destructiveCommandAllowPaths,posixShell:!0}),K=G.map(t),re=ws(K),oe=$R(G);for(let de of oe){let Se=ii(de.word);if(re&&Se.unsafeBraceExpansion){let we=wt(oi({kind:"outside_anchored_cwd"},j,U.policy,Hm),U.policy);if(we)return we;continue}for(let we of Se.expandedTargets??[de.text]){let We=bn(we),ft={targetIsLiteral:Se.expandedTargets!==void 0||Se.targetIsLiteral,tmpdirWordSplittingProtected:Se.tmpdirWordSplittingProtected};if(!re&&j.resolvedCwd&&Or(We,j.resolvedCwd,j.protectedGitMetadata,re,j.environment,j.budget))return xt("rm.git-metadata",k);if(!re)continue;for(let pt of BR(We,j,ft)){let mt=oi(pt,j,U.policy,Hm),gt=wt(mt,U.policy);if(gt)return gt}}}return null}function BR(G,U,j){let K=Ln(G,U,j);if(K.kind==="cwd_self_target")return[K,Ln(G,U,{...j,skipCwdSelf:!0})];if(K.kind!=="home_cwd_target")return[K];let re=Ln(G,U,{...j,skipHomeCwd:!0});if(re.kind!=="cwd_self_target")return[K,re];return[K,re,Ln(G,U,{...j,skipHomeCwd:!0,skipCwdSelf:!0})]}function $R(G){let U=[],j=!1;for(let K of G.slice(1)){let re=t(K);if(!re)continue;if(re==="--"){j=!0;continue}if(j){U.push({text:re,word:K});continue}if(!re.startsWith("-"))U.push({text:re,word:K})}return U}var gr={kind:"none"},Gr={kind:"dynamic"},UR=new Set(["<","<<","<<-","<<<","<&","<>"]),Vm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,HR=/^(?:[0-9]+|[@*])$/,jR=lr.maxWords,Km=lr.maxInputLength;function qm(G){if(!G||Pt(Ot(G.words[0]?.text??""))!=="printf")return;if(G.words.some((re)=>re.provenance!=="literal"))return;let U=G.words.slice(G.words[1]?.text==="--"?2:1),j=U[0]?.text;if(j===void 0)return"";let K=U.slice(1).map((re)=>re.text);if(j==="%s")return K.join("");if(j==="%s\\n"||j===`%s
-`)return`${K.join(`
-`)}
-`;if(j.includes("%")||/\\(?![\\nrt])/.test(j))return;return j.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ms(G){let U=po(G[1])==="--"?2:1;if(G.length<=U)return gr;let j=G.slice(U);if(!j.every(fi))return Gr;return{kind:"literal",source:j.map(t).join(" ")}}function Ym(G){let U=po(G[1])==="--"?2:1,j=G[U],K=po(j);if(j===void 0||G.length<=U+1||K==="-"||K===""||K==="-l"||K==="-p")return gr;if(!fi(j))return Gr;return{kind:"literal",source:K}}function Ds(G,U){let j=Jm(G);if(j===-1)return gr;let K=KR(U);if(!K)return gr;let re=[],oe=K.command?.length??0;for(let de of K.references){let Se=YR(de,G,j,K.ifs);if(!Se)return Gr;if(oe+=Se.reduce((we,We)=>we+We.length+3,0),re.length+Se.length>jR||oe>Km)return Gr;re.push(...Se)}if(K.command==="eval")return{kind:"literal",source:re.join(" ")};if(re.length===0||/\s/.test(re[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[K.command,K.command&&K.optionTerminator?"--":null,...re.map(Ns)].filter((de)=>de!==null).join(" ")}}function Zm(G,U){let j=Jm(G),K=G.slice(j+1),re=/\bIFS\b/.test(U);if(j===-1||!K.every(fi)||re)return U;let oe=K.map(po),de="",Se=null,we=0;while(we<U.length){let We=U[we]??"",ft=Se==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(U.slice(we));if(ft){let pt=ft[1]??ft[2],mt=pt==="@"||pt==="*"?oe.slice(1):[oe[Number(pt)]??""];if(Se!=='"'&&mt.some((yt)=>/[*?[]/.test(yt)))return U;if(de+=Se==='"'?mt.map((yt)=>yt.replace(/["$`\\]/g,"\\$&")).join(pt==="@"?'" "':" "):mt.map((yt)=>yt.split(/[ \t\n]+/).map((ht)=>ht?Ns(ht):"").join(" ")).join(" "),de.length>Km)return U;we+=ft[0].length;continue}if(We==="\\"&&Se!=="'"){de+=U.slice(we,we+2),we+=2;continue}if(We==="'"&&Se!=='"'||We==='"'&&Se!=="'")Se=Se?null:We;de+=We,we++}return de}function Xm(G,U,j,K){if(!Sn(G.map(t)).readsStdinAsCommands)return gr;let re=U.filter((oe)=>(oe.fd===void 0||oe.fd===0)&&UR.has(oe.operator)).at(-1);if(re){if(re.operator==="<<"||re.operator==="<<-")return gr;if(re.operator!=="<<<"||re.target?.provenance!=="literal")return Gr;return{kind:"literal",source:re.target.text}}if(!j)return gr;return K===void 0?Gr:{kind:"literal",source:K}}function tr(G,U=new Map){let j=Sn(G.map(t)).scriptIndex;if(j===null)return gr;let K=G[j],re=po(K);if(es(K,re))return{kind:"literal",source:re};let oe=K?Hn(K,U):null;return oe===null?Gr:{kind:"literal",source:oe}}var VR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ac(G){if(G.words.length!==2||G.redirections.length!==0||G.nested.length!==1)return!1;let U=G.words[0],j=G.words[1];if(!U||U.provenance!=="literal"||U.quoted||U.raw!==U.text||!j)return!1;if(!(U.text==="eval"&&j.quoted&&j.parts.length===3&&j.parts[0]?.raw==='"'&&j.parts[1]?.provenance==="command-substitution"&&j.parts[1].raw.startsWith("$(")&&j.parts[2]?.raw==='"'||U.text==="eval"&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("$(")||(U.text==="source"||U.text===".")&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("<(")))return!1;let re=G.nested[0];if(re?.status!=="complete"||re.nodes.length!==1)return!1;let oe=re.nodes[0];if(oe?.kind!=="command"||oe.redirections.length!==0||oe.nested.length!==0||oe.words.some((we)=>we.provenance!=="literal"||we.parts.some((We)=>We.provenance!=="literal")))return!1;let de=oe.words[0]?.text;if(de===void 0||Tn(de)!==null)return!1;let Se=Pt(Ot(de));return!VR.has(Se)&&!Vt.has(Se)&&!Nr(Se)}function Jm(G){return Sn(G.map(t)).commandIndex??-1}function KR(G){let U=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(G.trim()),j=U?.[4]??G.trim(),K=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(j),re=(K?.[3]??j).split(/\s+/).map(qR);if(re.length===0||re.some((oe)=>oe===null))return null;return{command:K?.[1]??null,optionTerminator:K?.[2]!==void 0,references:re.filter((oe)=>!!oe),ifs:U?U[1]??U[2]??U[3]??"":` 	
-`}}function qR(G){let U=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(G),j=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(G),K=U??j;if(!K)return null;let re=K[1]??K[2];return{parameter:re==="@"||re==="*"?re:Number(re),quoted:U!==null}}function YR(G,U,j,K){let re=U.slice(j+2);if(G.parameter==="@")return G.quoted?oc(re):ZR(re,K);if(G.parameter==="*"){let Se=oc(re);if(!Se)return;let we=Se.join(K[0]??"");return G.quoted?[we]:ic(we,K)}let oe=U[j+1+G.parameter];if(oe&&!fi(oe))return;let de=po(oe);return G.quoted?[de]:ic(de,K)}function oc(G){return G.every(fi)?G.map(t):void 0}function ZR(G,U){let j=oc(G);if(!j)return;let K=j.map((re)=>ic(re,U));return K.some((re)=>re===void 0)?void 0:K.flatMap((re)=>re??[])}function ic(G,U){if(["*","?","[","]"].some((j)=>G.includes(j)))return;if(U==="")return G===""?[]:[G];if(U===` 	
-`)return G.trim().split(/\s+/).filter(Boolean);if(U.length!==1)return;return U===" "||U==="\t"||U===`
-`?G.trim().split(/\s+/).filter(Boolean):G.split(U).filter(Boolean)}function fi(G){if(!G)return!0;return G.provenance==="unknown"?!/[$`]/.test(t(G)):G.provenance==="literal"}function po(G){return G?t(G):""}function Ns(G){return`'${G.replaceAll("'",`'"'"'`)}'`}function lc(G,U){return sc(y(G,"posix"),U)}function mi(G){return lc(G,new Set(Array.from(G.matchAll(Vm)).flatMap((U)=>{let j=U[1]??U[2];return j===void 0?[]:[j]})))}function sc(G,U){if(G.status==="invalid"||G.status==="limited")return!1;let j=new Set(U);for(let K of G.nodes){if(K.kind==="group"){if(sc(K.body,j))return!0;continue}if(K.kind!=="command")continue;if(K.nested.some((re)=>sc(re,j))||Qm(K.words,j))return!0;t_(K,j)}return!1}function Qm(G,U){let j=G.findIndex((de)=>Tn(de.text)===null);if(j===-1)return!1;let K=G[j];if(!K)return!1;if(di(K,U))return!0;let re=Ot(K.text);if(re==="source"||re==="."){let de=G[j+1]?.text==="--"?j+2:j+1;return jm(G[de],U)}if(Vt.has(re)){let de=G.slice(j),Se=Sn(de.map((We)=>We.text)),we=Se.commandIndex??Se.scriptIndex;return!Se.syntaxCheck&&we!==null&&jm(de[we],U)}let oe=XR(G,j,U);if(oe===null)return!1;if(oe===-1)return!0;return Qm(G.slice(oe),U)}function XR(G,U,j){let K=Ot(G[U]?.text??"");if(K==="command")return JR(G,U+1);if(K==="exec")return QR(G,U+1);if(K==="env")return e_(G,U+1,j);return null}function JR(G,U){for(let j=U;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return G[j+1]?j+1:null;if(/^-[p]*[vV][pvV]*$/.test(K))return null;if(/^-p+$/.test(K))continue;return j}return null}function QR(G,U){for(let j=U;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return G[j+1]?j+1:null;if(K==="-a"){j++;continue}if(/^-a.+/.test(K)||/^-[cl]+$/.test(K))continue;return j}return null}function e_(G,U,j){for(let K=U;K<G.length;K++){let re=G[K],oe=re?.text??"";if(oe==="--")return G[K+1]?K+1:null;if(oe==="-S"||oe==="--split-string")return di(G[K+1],j)?-1:K+2;if(oe.startsWith("-S")||oe.startsWith("--split-string="))return di(re,j)?-1:K+1;if(oe==="-u"||oe==="--unset"||oe==="-C"||oe==="--chdir"||oe==="-P"){K++;continue}if(oe==="-i"||oe==="-0"||oe==="--null"||oe.startsWith("-u=")||oe.startsWith("--unset=")||oe.startsWith("-C")||oe.startsWith("--chdir=")||oe.startsWith("-P"))continue;if(oe.startsWith("-"))continue;if(Tn(oe))continue;return K}return null}function t_(G,U){if(!G.words.every((j)=>Tn(j.text)!==null))return;for(let j of G.words){let K=Tn(j.text);if(!K)continue;if(di(j,U))U.add(K.name)}}function di(G,U){if(!G)return!1;return G.parts.filter((j)=>j.provenance==="variable").some((j)=>Array.from(j.raw.matchAll(Vm)).some((K)=>{let re=K[1]??K[2];return re!==void 0&&(HR.test(re)||U.has(re))}))}function jm(G,U){return!!G&&(G.parts.some((j)=>j.provenance!=="literal"&&j.provenance!=="variable")||di(G,U))}var cc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",uc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",n_="__CC_SAFETY_NET_XARGS_INPUT__",Ls="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ws="rm",r_=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,o_=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,i_=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,s_=/^(?:[0-9]+|[@*])$/;function np(G,U){let j=G.map(t),{childStart:K,replacementToken:re}=Fr(j),oe=j.slice(K),de=xt("xargs.shell-dynamic",uc);if(l_(oe,re,U)&&wt(de,U.policy))return wt(de,U.policy);for(let Se of Wn(oe,U)){let we=Se.tokens,We=re!==null&&we[0]!==oe[0]&&(we[0]?.includes(re)??!1)?wt(de,U.policy):null;if(We)return We;let ft=lp(we,re,Se.wrapperEnvAssignments),pt=Se.head==="rm"&&re!==null&&sp(we,re),mt=U.analyzeChild(we,{...Lr(Se,U),dynamicInput:ft,dynamicSourceInput:pt||op(we,Se.head,re,Se.wrapperEnvAssignments,ft,U.environment,U.strict?void 0:U.analyzeNested),dynamicRmInput:pt,shellDynamicMatch:de,dynamicSourceMatch:de,rmDynamicMatch:xt("xargs.rm-recursive-force-dynamic",cc)});if(mt)return mt;let gt=a_(we,re,U.policy?.rules??[],wt(de,U.policy));if(gt)return gt;if(Se.head==="git"){let ht=re===null?[...we,n_]:we,bt=re!==null&&(we.some((vt)=>vt.includes(re))||Array.from(Se.envAssignments.values()).some((vt)=>vt.includes(re))),Ct=U.analyzeChild(ht,{...Lr(Se,U),worktreeMode:re===null||bt?!1:U.worktreeMode});if(Ct)return Ct}let yt=A(we,U.policy?.rules??[]);if(yt)return yt}return null}function a_(G,U,j,K){if(j.length===0)return null;if(U===null){for(let oe of j){let de=A([...G,...oe.subcommand?[oe.subcommand]:[],...oe.block_args],j);if(de)return de}return null}let re=Ot(G[0]??"");if(!j.some((oe)=>Ot(oe.command)===re))return null;return G.slice(1).some((oe)=>oe.includes(U))?K:null}function rp(G,U,j){let K=G.indexOf(U);if(K===-1||G.indexOf(U,K+U.length)!==-1)return[];let re=$m(G,K,U.length,j);return re===null?[]:[re]}function op(G,U,j,K,re,oe,de){if(Vt.has(U)){if(Qn(G))return!1;if(j!==null&&c_(G,j,de))return!0;let Se=Gn(G);if(!Se){let we=tr(jt(G));if(we.kind==="literal")return j!==null&&we.source.includes(j);return we.kind==="none"&&re}if(j!==null&&Se.includes(j)&&!ip(Se,j,de))return!0;if(An(Se))return!0;return u_(Se,j,K)}if(On(U))return ep(G,j,is,sf(U));if(Pn.has(U))return ep(G,j,Bl,am);if(U==="eval"){let Se=Ms(jt(G));if(Se.kind==="dynamic")return!0;if(j!==null)return Se.kind==="literal"&&Se.source.includes(j);return re}if(U==="find")return d_(G,j,oe);if(U==="git"){let Se=xn(G);return j===null?Se.subcommand===null:(Se.subcommand?.includes(j)??!1)||Se.subcommand!==null&&fo.has(Se.subcommand.toLowerCase())&&ap(Se.rest,j).some((we)=>we.includes(j))}return!1}function ip(G,U,j){if(j===void 0)return!1;let K=U.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${K}`).test(G)||/\bcase\b/.test(G))return!1;let oe=G.replaceAll(U,"/");return An(oe)===null&&j(oe)===null}function ep(G,U,j,K){let re=j(G);if(U===null)return re.optionsOpen||j([...G,Ls]).sources.some((Se)=>Se.value===Ls);if(re.sources.some((Se)=>Se.value.includes(U)))return!0;let oe=K.flatMap((Se)=>[Se.selector,...Se.valueForm==="attached-only"||Se.valueForm==="attached-or-separate"?[`${Se.selector}${Ls}`]:[],...Se.valueForm==="equals-or-separate"?[`${Se.selector}=${Ls}`]:[]]),de=new Set(oe.flatMap((Se)=>G.flatMap((we)=>rp(we,U,Se))));return ks(re.sources,de,(Se)=>j(G.map((we)=>we.replaceAll(U,Se))).sources)}function l_(G,U,j){if(G.length===0||(G[0]??"").toLowerCase()==="command")return!1;let K=new Set(Array.from(Wn(G,j),(oe)=>oe.head)),re=U===null?[...G,Ws]:G.map((oe,de)=>de===0?oe:oe.replaceAll(U,Ws));return Array.from(Wn(re,j)).some((oe)=>oe.head===Ws&&!K.has(Ws))}function sp(G,U){return ap(G.slice(1),U).some((j)=>j.includes(U)&&(j.startsWith("-")||j.startsWith(U)))}function ap(G,U){let j=G.findIndex((K)=>K==="--"&&!K.includes(U));return j===-1?G:G.slice(0,j)}function lp(G,U,j){if(U===null)return!0;return G.some((K)=>K.includes(U))||Array.from(j.values()).some((K)=>K.includes(U))}function c_(G,U,j){let K=Sn(G),re=K.commandIndex===null?"":G[K.commandIndex]??"";if(re.includes(U)&&!ip(re,U,j)||K.scriptIndex!==null&&(G[K.scriptIndex]??"").includes(U))return!0;return["-c","-nc","-cn",`--${U}`,U].some((de)=>G.some((Se,we)=>{if(we===0||!Se.includes(U))return!1;return rp(Se,U,de).some((ft)=>{let pt=G.map((gt,yt)=>yt===we?gt.replaceAll(U,ft):gt),mt=Sn(pt);if(mt.commandIndex===null&&mt.scriptIndex===null)return!1;if(K.commandIndex===null&&mt.commandIndex!==null)return!0;if(K.scriptIndex===null&&mt.scriptIndex!==null)return!0;if(mt.commandIndex!==null&&(pt[mt.commandIndex]??"").includes(ft))return!0;return mt.scriptIndex!==null&&(pt[mt.scriptIndex]??"").includes(ft)})}))}function u_(G,U,j){let K=new Set(U===null?[]:Array.from(j).filter(([,re])=>re.includes(U)).map(([re])=>re));for(let re of G.matchAll(r_))if(tp(re,K))return!0;for(let re of G.matchAll(o_))for(let oe of(re[1]??"").matchAll(i_))if(tp(oe,K))return!0;return lc(G,K)}function tp(G,U){let j=G[1]??G[2];return j!==void 0&&(s_.test(j)||U.has(j))}function d_(G,U,j){if(U===null)return!0;let K=!1,re=0;for(let oe=1;oe<G.length;oe++){let de=G[oe]??"";if(!K&&!de.startsWith("-")&&de!=="!"&&de!=="("){if(de.indexOf(U)===0)return!0;continue}if(K=!0,re>0){re--;continue}if(Un(de)){let we=uo(G,oe);oe=we.nextIndex-1;for(let We of Wn(we.tokens,{environment:j,cwd:void 0})){let ft=lp(We.tokens,U,We.wrapperEnvAssignments);if(We.head==="rm"&&sp(We.tokens,U)||op(We.tokens,We.head,U,We.wrapperEnvAssignments,ft,j))return!0}continue}let Se=er(de);if(Se>0){if(re=Se,de.includes(U))return!0;continue}if(de.includes(U))return!0}return!1}function Fr(G){let U=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),j=null,K=1;while(K<G.length){let re=G[K];if(!re)break;if(re==="--")return{childStart:K+1,replacementToken:j};if(!re.startsWith("-"))return{childStart:K,replacementToken:j};if(re==="-I"){j=G[K+1]??"{}",K+=2;continue}if(re.startsWith("-I")&&re.length>2){j=re.slice(2),K++;continue}if(re==="--replace"){j="{}",K++;continue}if(re.startsWith("--replace=")){let oe=re.slice(10);j=oe===""?"{}":oe,K++;continue}if(re==="-J"){j=G[K+1]??"{}",K+=2;continue}K+=U.has(re)?2:1}return{childStart:G.length,replacementToken:j}}var pi="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",gi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",m_="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",p_="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Fs=/\{[^{}\s]*\}/g,cp=/\{\}|\{-?\d+\}/g,up=/[\s;&|<>()$`\\"']/,g_=["e","f","source","file","-e","-f","--source","--file"],h_=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],y_=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),b_=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),dp=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),C_=new Set(["--workdir","--wd"]),fp="__CC_SAFETY_NET_PARALLEL_SOURCE__";function In(G,U){for(let j of G){let K=U(j);if(K)return K}return null}function gp(G){return In([...G],(U)=>An(U))}function hp(G,U){let j=G.map(t);if((U.envAssignments?.has("PARALLEL")?U.envAssignments.get("PARALLEL"):U.environment.env.get("PARALLEL"))?.trim()){let yt=go(U);if(yt)return yt}if(j.length===2&&(j[1]==="--version"||j[1]==="--help"))return null;let re=Ap(j),{template:oe,jobs:de,runsRemotely:Se,readsCommandsFromInput:we,unsupported:We,workdir:ft,dryRun:pt}=re;if(We){let yt=go(U);if(yt)return yt;let ht=gp(U.envAssignments?.values()??[]);if(ht)return ht}if(we){let yt=w_(U);if(yt)return yt}if(ft!==void 0&&Se){let yt=go(U);if(yt)return yt}let mt=P_(ft,U.cwd,U.environment.paths);if(mt===null){let yt=go(U);if(yt)return yt}let gt=Se?{...U,cwd:void 0,originalCwd:void 0}:mt===null||mt===void 0||mt===U.cwd?U:{...U,cwd:mt};if(pt){if([...Wn(oe,gt)].flatMap((ht)=>[...ht.envAssignments.values()]).some(mc)){let ht=go(U);if(ht)return ht}return null}if(oe.length===0){let yt=de.map((bt)=>bt[0]??"");U.budget.charge("derivedTokens",yt.length);let ht=Ep(gt.envAssignments,gt.cwd,Se);return In(yt,(bt)=>U.analyzeNested(bt,ht))}return In(Wn(oe,gt),(yt)=>S_(yt,re,U,gt))}function S_(G,U,j,K){let{templateHasPlaceholder:re,runsRemotely:oe,usesStdin:de}=U,Se=G.tokens,we=[...G.envAssignments.values()];if(we.some(wp)){let Rt=go(j);if(Rt)return Rt}let We=gp(we);if(We)return We;let ft=we.some(Wt),pt=re||ft,mt=de&&pt,gt=Ep(G.envAssignments,G.wrapperCwd,oe||mt),yt=pt?{...gt,worktreeMode:!1}:gt,ht=Se.join(" "),bt=Wt(ht.split(/[ \t\n=]/,1)[0]??""),Ct=!U.quotesCommand&&(bt||Se.some((Rt)=>up.test(Rt))),vt=bt||up.test(Se[0]??""),St=Ct&&vt&&U.jobs.length>0?null:v_(G,U,j,K,yt,ft);if(St||!Ct)return St;return yp(Wt(ht)?ht:`${ht} {}`,!bt,G,U,j,K,yt)}function v_(G,U,j,K,re,oe){let{jobs:de,templateHasPlaceholder:Se,runsRemotely:we,usesStdin:We}=U,ft=G.tokens,pt=Se||oe;if(Vt.has(G.head)){let gt=()=>{if(!Se||de.length===0)return null;return In(de,(bt)=>j.analyzeChild(Gs(ft,bt,j.budget),Lr(G,K)))};if(Qn(ft))return gt();let yt=Gn(ft);if(yt){if(Pp(yt)){let St=hr(j);if(St)return St;if(de.length===0)return null;return In(de,(Rt)=>j.analyzeNested(Rp(yt,Rt,j.budget),re))}if(Wt(yt))return yp(yt,!1,G,U,j,K,re);let bt=!oe&&(!Se||de.length>0)?(de.length>0?de:[void 0]).map((St)=>Ds(jt(St===void 0?ft:Se?ft.map((Rt)=>xp(Rt,St)):[...ft,...St]),yt)):[];if(bt.some((St)=>St.kind==="dynamic")){let St=hr(j);if(St)return St}let Ct=bt.flatMap((St)=>St.kind==="literal"?[St.source]:[]);if(Ct.length>0)return j.budget.charge("derivedTokens",Ct.length),In(Ct,(St)=>j.analyzeNested(St,re));if(mi(yt)){let St=hr(j);if(St)return St}let vt=j.analyzeNested(yt,re);if(vt)return vt;if(pt)return hr(j);return null}let ht=tr(jt(ft));if(ht.kind==="dynamic"||ht.kind==="literal"&&Wt(ht.source))return hr(j)??gt();if(ht.kind==="literal")return gt();if(de.length>0){let bt=hr(j);if(bt)return bt;let Ct=gt();if(Ct)return Ct;if(Se)return null;let vt=de.flatMap((St)=>St[0]===void 0?[]:[St[0]]);return j.budget.charge("derivedTokens",vt.length),In(vt,(St)=>j.analyzeNested(St,re))}if(pt||We)return hr(j)??gt();return null}if(G.head==="rm"&&Jn(ft)){if(Se&&de.length>0)return In(de,(yt)=>dc(Gs(ft,yt,j.budget,cp),G.cwd,K));if(de.length>0)return In(de,(yt)=>dc(pp(ft,yt,j.budget),G.cwd,K));let gt=dc(ft.flatMap((yt,ht)=>{if(ht===0||!Wt(yt))return[yt];return yt.startsWith("-")?[yt.replace(cp,"")]:[]}),G.cwd,K);if(gt)return gt;return vp(j)}let mt=de.length>0?de:[void 0];return In(mt,(gt)=>{let yt=gt===void 0?ft:Se?Gs(ft,gt,j.budget):pp(ft,gt,j.budget),ht=xt("parallel.shell-dynamic",gi),bt=We&&G.head==="find"?__(yt,K):null,Ct=Cp(yt,We,j)??bt?.customResult??null,vt=Ot(G.head),St=We&&(vt==="rm"&&fc(yt)||vt==="xargs"&&Sp(yt)||bt?.rmOptions===!0),Rt=We&&(St||bt?.executedSource===!0||bt===null&&bp(yt,vt)),Tt=j.analyzeChild(yt,{...Lr(G,K),worktreeMode:we||We||pt?!1:j.worktreeMode,dynamicInput:We||pt,dynamicRmInput:St,dynamicSourceInput:Ct!==null||Rt,shellDynamicMatch:ht,dynamicSourceMatch:ht,rmDynamicMatch:xt("parallel.rm-recursive-force-dynamic",pi)});if(Rt){let It=wt(ht,j.policy);if(It)return It}return Tt??Ct??A(yt,j.policy?.rules??[])})}function yp(G,U,j,K,re,oe,de){if(K.jobs.length>0)return In(K.jobs,(We)=>re.analyzeNested(Rp(G,U?We.map(Ns):We,re.budget),de));let Se=ui(G);if(Se?.[0]&&Ot(Se[0])==="rm"&&Jn(Se)){let We=vp(re);if(We)return We}return(Se?re.analyzeChild(Se,{...Lr(j,oe),dynamicInput:K.usesStdin,shellDynamicMatch:xt("parallel.shell-dynamic",gi),rmDynamicMatch:xt("parallel.rm-recursive-force-dynamic",pi)}):null)??re.analyzeNested(G,de)}function bp(G,U){if(Wt(G[0]??""))return!0;if(U==="eval"||U==="source"||U===".")return!0;if(U==="parallel"||U==="xargs")return!0;if(Vt.has(U))return R_(G);if(U==="git")return E_(G);if(U==="find")return!0;if(Pn.has(U))return mp(G,g_,li);if(On(U))return mp(G,h_,os);return!1}function fc(G){let U=G.indexOf("--"),j=G.slice(1,U===-1?void 0:U);if(!G.some(Wt))return U===-1;return j.some((re)=>Wt(re)&&(re.startsWith("-")||Pp(re)))}function E_(G){if(x_(G))return!0;let U=xn(G);if(U.subcommand===null||Wt(U.subcommand))return!0;if(!fo.has(U.subcommand.toLowerCase()))return!1;let j=U.rest.indexOf("--"),K=U.rest.slice(0,j===-1?void 0:j);if(!G.some(Wt))return j===-1;return K.some(Wt)}function x_(G){for(let U=1;U<G.length;U++){let j=G[U];if(!j||j==="--"||!j.startsWith("-"))return!1;if(j==="-c"||j==="--config-env"){if(Wt(G[U+1]??""))return!0;U++;continue}if(j.startsWith("-c")&&j.length>2||j.startsWith("--config-env=")){if(Wt(j))return!0;continue}if(Wt(j))return!0}return!1}function R_(G){if(Qn(G))return!1;let U=Gn(G);if(U!==null)return Wt(U);let j=tr(jt(G));if(j.kind==="literal")return Wt(j.source);if(j.kind==="dynamic")return!0;return!G.some(Wt)}function mp(G,U,j){let K=j(G);if(K.some((re)=>Wt(re.value)))return!0;if(!G.some(Wt))return j([...G,fp]).some((re)=>re.value===fp);return ks(K,U,(re)=>j(G.map((oe)=>xp(oe,[re]))))}function Cp(G,U,j){let K=j.policy?.rules??[];if(!U||K.length===0)return null;let re=K.filter((oe)=>Ot(oe.command)===Ot(G[0]??""));if(re.length===0)return null;if(G.slice(1).some(Wt))return hr(j);return In(re,(oe)=>A([...G,...oe.subcommand?[oe.subcommand]:[],...oe.block_args],[oe]))}function __(G,U){let j={customResult:null,executedSource:!G.some(Wt),rmOptions:!1},K=!1,re=0,oe=null,de=()=>{if(!oe?.some(Wt))return;for(let Se of Wn(oe,U))j.executedSource||=bp(Se.tokens,Se.head),j.rmOptions||=Se.head==="rm"&&fc(Se.tokens)||Se.head==="xargs"&&Sp(Se.tokens),j.customResult??=Cp(Se.tokens,!0,U)};for(let Se of G.slice(1)){if(!K&&!Se.startsWith("-")&&Se!=="!"&&Se!=="("){j.executedSource||=Wt(Se);continue}if(K=!0,oe){if(Se===";"||Se==="+"){de(),oe=null;continue}oe.push(Se);continue}if(re>0){re--;continue}if(Un(Se)){oe=[],j.executedSource||=Wt(Se);continue}let we=er(Se);if(we>0){re=we,j.executedSource||=Wt(Se);continue}j.executedSource||=Wt(Se)}return de(),j}function Sp(G){let U=G.slice(Fr(G).childStart);return Ot(U[0]??"")==="rm"&&fc(U)}function zs(G,U){return(j)=>wt(xt(G,U),j.policy)}var hr=zs("parallel.shell-dynamic",gi),w_=zs("parallel.command-stream-dynamic",m_),go=zs("parallel.command-stream-dynamic",p_),vp=zs("parallel.rm-recursive-force-dynamic",pi);function dc(G,U,j){return wt(Os(jt(G),{environment:j.environment,cwd:U,budget:j.budget,originalCwd:j.originalCwd,strict:j.strict,paranoid:j.paranoidRm,allowTmpdirVar:j.allowTmpdirVar,tmpdirWordSplittingUnsafe:Mr(j.envAssignments??new Map,j.environment),trustedTmpdirValue:so(j.envAssignments??new Map,j.environment),protectedGitMetadata:j.protectedGitMetadata,policy:j.policy}),j.policy)}function Ep(G,U,j){let K={};if(G)K.envAssignments=G;if(j)return K.effectiveCwd=null,K.worktreeMode=!1,K;if(U!==void 0)K.effectiveCwd=U;return Object.keys(K).length>0?K:void 0}function xp(G,U){return G.replace(Fs,(j)=>_p(j,U))}function Gs(G,U,j,K=Fs){return j.charge("derivedTokens",G.reduce((re,oe)=>re+1+Math.floor(oe.length/64),0)),G.map((re)=>re.replace(K,(oe)=>{let de=_p(oe,U);return j.charge("derivedTokens",Math.max(1,Math.ceil(de.length/64))),de}))}function Rp(G,U,j){return Gs([G],U,j)[0]??""}function pp(G,U,j){return j.charge("derivedTokens",G.length+U.length),[...G,...U]}function _p(G,U){let j=/^\{(-?\d+)[^{}\s]*\}$/.exec(G)?.[1];if(j===void 0)return U[0]??"";let K=Number(j);return U[K>0?K-1:U.length+K]??""}function Wt(G){return G.search(Fs)!==-1}function wp(G){if(mc(G))return!0;for(let U of G.matchAll(Fs))if(!/^(?:\{\}|\{\d+\})$/.test(U[0]))return!0;return!1}function mc(G){let U=G.indexOf("{=");return U!==-1&&G.indexOf("=}",U+2)!==-1}function Pp(G){return/^\{[^{}\s]*\}$/.test(G)}function P_(G,U,j){if(G===void 0)return;if(G==="..."||/^~|[{}$`*?[]/.test(G))return null;if(!U&&!f_(G))return null;try{return cr(U??G,G,j)}catch{return null}}function Ap(G){let U=1,j=[],K=G.length,re=-1,oe=!1,de=!1,Se=!1,we,We=!1,ft=G.some((ht)=>ht==="::::"||ht==="::::+"||ht===":::+");while(U<G.length){let ht=G[U];if(ht===void 0)break;if(ht===":::"){re=U;break}if(ht==="--"){let Rt=Hl(G,U+1);j.push(...Rt.templateTokens),K=U+1,re=Rt.markerIndex;break}if(!ht.startsWith("-")){let Rt=Hl(G,U);j.push(...Rt.templateTokens),K=U,re=Rt.markerIndex;break}let bt=G[U+1],Ct=ht.indexOf("="),vt=Ct===-1?ht:ht.slice(0,Ct),St=Ct===-1?void 0:ht.slice(Ct+1);if(ht==="--dry-run"){We=!0,U++;continue}if(ht==="-I"||ht.startsWith("-I")&&ht.length>2){ft||=(ht==="-I"?bt:ht.slice(2))!=="{}",U+=ht==="-I"?2:1;continue}if(ht==="--replace"||ht==="-i"){ft=!0,U+=2;continue}if(vt==="--replace"||ht.startsWith("-i")&&ht.length>2){let Rt=vt==="--replace"?St:ht.slice(2);ft||=Rt!==""&&Rt!=="{}",U++;continue}if(ht==="-a"||b_.has(vt)){ft=!0,U+=St===void 0?2:1;continue}if(ht==="-q"||ht==="--quote"){de=!0,U++;continue}if(ht==="--pipe"||ht==="--pipepart"){Se=!0,U++;continue}if(vt==="--env"){ft=!0,U+=St===void 0?2:1;continue}if(dp.has(vt)||ht.startsWith("-S")&&ht.length>2){oe=!0,U+=dp.has(ht)?2:1;continue}if(C_.has(vt)){ft=!0;let Rt=St??bt;if(Rt===void 0||Rt===":::"||Rt==="--"){U++;continue}we=Rt,U+=St===void 0?2:1;continue}if(ht.startsWith("-j")&&ht.length>2&&/^\d+$/.test(ht.slice(2))){U++;continue}if(ht.startsWith("--")&&St!==void 0){U++;continue}if(y_.has(ht)){if(bt===void 0||bt===":::"||bt==="--"){ft=!0,U++;continue}U+=2;continue}U+=ht==="-j"||ht==="--jobs"?2:1}ft||=j.some(We?mc:wp);let pt=[];if(re!==-1){let ht=[];for(let bt=re+1;bt<G.length;bt++){let Ct=G[bt];if(Ct===":::"){pt.push(ht),ht=[];continue}if(Ct!==void 0)ht.push(Ct)}pt.push(ht)}ft||=pt.length>1;let mt=A_(pt),gt=j.some(Wt),yt=j.length===0&&re===-1;return{template:j,jobs:mt,childStart:K,templateHasPlaceholder:gt,runsRemotely:oe,quotesCommand:de,usesStdin:Se||re===-1,readsCommandsFromInput:yt,unsupported:ft,workdir:we,dryRun:We}}function A_(G){if(G.length===0||G.some((j)=>j.length===0))return[];let U=[[]];for(let[j,K]of G.entries()){if(K.length===1){let oe=K[0];if(oe===void 0)return[];for(let de of U)de.push(oe);if(U.length*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let re=[];for(let oe of U)for(let de of K){if((re.length+1)*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");re.push([...oe,de])}U=re}return U}function Tp(G){return Ap(G).childStart}var T_="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Bs="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function gc(G){return G?.parts.some((U)=>U.provenance==="command-substitution")??!1}function pc(G){return G?.parts.some((U)=>U.provenance==="literal"&&U.raw.replace(/^["']/,"").startsWith("-"))??!1}function kp(G,U,j,K,re=!1,oe){let Se=(Fo(G,U)||K&&G!=="powershell"&&U[0]?.provenance==="variable")&&Zt(oe,"shell.dynamic-executable",re)?xt("shell.dynamic-executable",T_):null;return wt(Se,oe)??Op(G,U,j,re,oe)}function Op(G,U,j,K,re){if(U.length<2)return null;let oe=U.flatMap((Se,we)=>gc(Se)?[we]:[]);if(oe.length===0)return null;let de=Ot(U[0]?.text??"");if(de==="git"){let Se=ne(G,U),we=k_(Se);if(Zt(re,"shell.dynamic-structure",K)&&oe.some((pt)=>pt<=we))return wt(xt("shell.dynamic-structure",Bs),re);if(wt(Is(Se,{environment:j}),re))return null;let We=U[we]?.text.toLowerCase(),ft=Se.findIndex((pt,mt)=>mt>we&&t(pt)==="--");if(Zt(re,"shell.dynamic-structure",K)&&We&&fo.has(We)&&oe.some((pt)=>pt>we&&(ft===-1||pt<ft)))return wt(xt("shell.dynamic-structure",Bs),re);return null}if(de==="find")return Zt(re,"shell.dynamic-structure",K)&&O_(U)?wt(xt("shell.dynamic-structure",Bs),re):null;if(de==="rm"){let Se=U.findIndex((We,ft)=>ft>0&&t(We)==="--"),we=Jn(U.map(t));return Zt(re,"shell.dynamic-structure",K)&&oe.some((We)=>(Se===-1||We<Se)&&(We<U.length-1||!we))?wt(xt("shell.dynamic-structure",Bs),re):null}if(de==="xargs")return Ip(G,U.slice(Fr(U.map(t)).childStart),"xargs",j,K,re);if(de==="parallel")return Ip(G,U.slice(Tp(U.map(t))),"parallel",j,K,re);return null}function Ip(G,U,j,K,re,oe){if(U.length===0)return null;let de=I_(U,K);if(Fo(G,de)){let we=wt(xt(`${j}.shell-dynamic`,j==="xargs"?uc:gi),oe);if(we)return we}let Se=Op(G,de,K,re,oe);if(Se)return Se;if(de[0]?.text==="rm"&&de.slice(1).some((we)=>gc(we)&&pc(we)))return wt(xt(`${j}.rm-recursive-force-dynamic`,j==="xargs"?cc:pi),oe);return null}function I_(G,U){let j=Ir(G,U),K=j.rewritten?jt(j.words.map(t)):j.words,re=K[0];return re&&t(re)==="busybox"?K.slice(1):K}function k_(G){let U=1;while(U<G.length){let j=G[U],K=j?t(j):"";if(Cn.has(K)){U+=2;continue}if(K.startsWith("-")){U++;continue}return U}return U}function O_(G){let U=!1,j=0,K=!1,re=!1;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(!de)continue;let Se=gc(de);if(j>0){j--;continue}if(re){if(de.text===";"||de.text==="+"){re=!1,U=!0,K=!1;continue}if(Se&&(K||pc(de)))return!0;K=!1;continue}if(!U&&!de.text.startsWith("-")){if(Se&&(oe>1||pc(de)))return!0;continue}if(U=!0,Se)return!0;let we=er(de.text);if(we>0){j=we;continue}if(Un(de.text))re=!0,K=!0}return!1}function hc(G,U){return G.some((j)=>{if(j.value==="-"&&(j.kind==="main-script"||j.kind==="program-file"))return!0;return!es(U[j.tokenIndex],j.value)})}var Np=[{heads:new Set(["rm","rmdir"]),analyze:(G)=>Os(G.words,Dp(G))},{heads:new Set(["git"]),analyze:(G)=>Is(G.words,yc(G))},{heads:new Set(["find"]),analyze:(G)=>ym(G.words,{...Dp(G),envAssignments:G.envAssignments,analyzeTokens:G.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(G)=>np(G.words,{...Mp(G),analyzeChild:G.analyzeChild,analyzeNested:(U,j)=>ho(G.options.analyzeNested(U,j))})},{heads:new Set(["parallel"]),analyze:(G)=>hp(G.words,{...Mp(G),analyzeChild:G.analyzeChild,analyzeNested:(U,j)=>ho(G.options.analyzeNested(U,j))})}];function Mp(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoidRm:G.options.paranoidRm,paranoidInterpreters:G.options.paranoidInterpreters,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.options.protectedGitMetadata,budget:G.options.budget,envAssignments:G.envAssignments,worktreeMode:G.options.worktreeMode,policy:G.options.policy}}function ho(G){return G?{id:G.ruleId,reason:G.reason,intent:G.intent??"manual_only"}:null}function Dp(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoid:G.options.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,tmpdirWordSplittingUnsafe:Mr(G.envAssignments,G.options.environment),trustedTmpdirValue:so(G.envAssignments,G.options.environment),protectedGitMetadata:G.options.protectedGitMetadata,policy:G.options.policy,budget:G.options.budget}}function yc(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,dynamicArguments:G.dynamicArguments,envAssignments:G.envAssignments,shellAssignments:G.options.shellAssignments,policy:G.options.policy,worktreeMode:G.options.worktreeMode}}function Gp(G){return Np.find((U)=>U.heads.has(G))?.analyze}function bo(G,U,j){let K=j.trace;if(G.length===0)return null;let re=j.commandView?.dialect??"posix",oe=(_t)=>_t.map((At)=>re==="posix"?t(At):At.text),de=j.child,Se=de!==void 0&&!de.embedded,we=de?.embedded===!0,We=j.effectiveCwd===null,ft=de?de.cwd:We?void 0:j.effectiveCwd??j.cwd,pt=de?de.originalCwd:We?void 0:j.cwd,mt=ve(G);if(mt.envAssignments.size>0)K?.recordSegment({type:"env-strip",input:oe(G),envVars:[...mt.envAssignments.keys()],output:oe(mt.words)});let gt=Ir(mt.words,j.environment,ft,new Map([...j.envAssignments??[],...mt.envAssignments])),yt=gt.envSplitValues??[];if(yt.length>0){let _t=[...yt,...oe(gt.words)].join(" "),At=An(_t);if(At)return K?.recordSegment({type:"dangerous-text",token:_t,matched:!0,reason:At.reason}),ln(At);if(j.strict)return pn(K);let Ft=ls(yt,oe(gt.words));if(Ft){j.budget.charge("derivedTokens",Ft.length);let Jt=j.analyzeNested(Ft.join(" "),{effectiveCwd:gt.cwd===void 0?j.effectiveCwd:gt.cwd,envAssignments:new Map([...j.envAssignments??[],...mt.envAssignments,...gt.envAssignments])});if(Jt)return Jt}}let ht=gt.rewritten?jt(oe(gt.words)):ne(re,gt.words),bt=oe(ht),Ct={...j,wrapperNormalizationBudget:j.wrapperNormalizationBudget??{iterations:0}};if(K&&mt.words.length>ht.length){let _t=oe(mt.words);K.recordSegment({type:"leading-tokens-stripped",input:_t,removed:_t.slice(0,_t.length-ht.length),output:bt})}let vt=new Map([...j.envAssignments??[],...mt.envAssignments,...gt.envAssignments]),St=bt[0];if(!St)return null;if(Nr(St))throw new s("wrapperPeelIterations");let Rt=Ot(St),Tt=gt.cwd===null?void 0:gt.cwd??ft,It=gt.cwd===null?void 0:pt,kt=gt.cwd===void 0?j.effectiveCwd:gt.cwd,Gt=de?de.allowTmpdirVar:!ri(vt,j.environment),an=kp(re,gt.words,j.environment,U===0,j.strict,j.policy);if(an)return K?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:an.reason}),ln(an);let Vn=Rs(bt,j.policy);if(Vn){for(let _t of[Vn.childIndex,...Vn.alternativeChildIndices]){Lp(Ct.wrapperNormalizationBudget);let At=ht.slice(_t);K?.recordSegment({type:"transparent-wrapper",wrapper:Vn.wrapper,output:oe(At)});let Ft=bo(At,U,{...Ct,effectiveCwd:kt,envAssignments:vt});if(Ft)return Ft}return null}let hn=we?void 0:Rt==="eval"?Ms(ht):Rt==="trap"&&!Se?Ym(ht):void 0;if(Se&&de&&Rt==="eval"){if(hn?.kind==="dynamic")return yo(de,j.policy);if(hn?.kind==="literal"){let _t=j.analyzeNested(hn.source,{effectiveCwd:kt,envAssignments:vt});if(_t)return _t}return Co(de,j.policy)}if(hn?.kind==="dynamic"&&(j.strict||!j.commandView||!ac(j.commandView)))return pn(K);if(hn?.kind==="literal"){K?.recordSegment({type:"recurse",reason:Rt==="eval"?"shell-eval":"shell-trap",innerCommand:hn.source,depth:U+1});let _t=j.analyzeNested(hn.source,{effectiveCwd:kt,envAssignments:vt,functionDefinitions:j.functionDefinitions});if(_t)return _t}if(Se?Vt.has(Rt):zp(St,Rt)){if(Qn(bt))return null;if(Se&&de){let _t=Gn(bt);if(_t){if(de.dynamicSourceInput??de.dynamicInput){let Ft=yo(de,j.policy);if(Ft)return Ft}if(mi(_t)){let Ft=yo(de,j.policy);if(Ft)return Ft}return j.analyzeNested(_t,{effectiveCwd:kt,envAssignments:vt})}let At=tr(ht);if(At.kind==="dynamic")return yo(de,j.policy);if(At.kind==="literal")return de.dynamicSourceInput?yo(de,j.policy):null;return de.dynamicSourceInput??de.dynamicInput?yo(de,j.policy):null}if(we){let _t=Gn(bt),At=_t?j.analyzeNested(_t,{effectiveCwd:kt,envAssignments:vt}):tr(ht).kind==="dynamic"?pn(K):null;if(At)return At}if(de===void 0){let _t=L_(bt,vt,kt,j,K,U);if(_t)return _t;let At=Gn(bt);if(At){let Hr=Ds(ht,At);if(Hr.kind==="dynamic")return pn(K);let ta=Hr.kind==="literal"?Hr.source:Zm(ht,At),Bc=W_(ta);K?.recordSegment({type:"shell-wrapper",wrapper:Rt,innerCommand:Bc}),K?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Bc,depth:U+1});let $c=j.analyzeNested(ta,{effectiveCwd:kt,envAssignments:vt});if($c)return $c;return mi(ta)?pn(K):null}let Ft=tr(ht,j.strict?void 0:j.shellAssignments);if(Ft.kind==="dynamic")return pn(K);if(Ft.kind==="literal")return $s(Ft.source,kt,vt,j,K,U);let Jt=Xm(ht,j.commandView?.redirections??[],j.hasPipelineInput??!1,j.literalShellInput);if(Jt.kind==="dynamic")return pn(K);if(Jt.kind==="literal")return K?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Jt.source,depth:U+1}),j.analyzeNested(Jt.source,{effectiveCwd:kt,envAssignments:vt})}}if(!de&&(Rt==="source"||Rt===".")){let _t=bt[1]==="-p"?2:null;if(_t!==null){let Hr=j.commandView?ht[_t]:void 0;if(!Hr)return null;if(Hr.provenance!=="literal")return pn(K)}let At=_t===null?1:3,Ft=bt[At]==="--"?At+1:At,Jt=j.commandView?ht[Ft]:void 0;if(!Jt)return null;if(Jt.provenance==="literal")return $s(Jt.text,kt,vt,j,K,U);if(j.strict||!j.commandView||!ac(j.commandView))return pn(K)}if(Pn.has(Rt)&&!we){if(!de&&j.strict&&hc(li(bt),ht))return pn(K);let _t=lm(bt,(Ft)=>ho(j.analyzeNested(Ft,{effectiveCwd:kt,envAssignments:vt}))),At=wt(_t,j.policy);if(At)return K?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:At.reason}),ln(At)}if(On(Rt)&&!we){if(!de&&j.strict&&hc(os(bt),ht))return pn(K);let _t=of(bt);if(Se&&de)return D_(Rt,_t,kt,vt,j,de);if(_t){let At=Zt(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(K?.recordSegment({type:"interpreter",interpreter:Rt,codeArg:_t,paranoidBlocked:At}),At){let Jt=wt(xt("interpreter.one-liner-paranoid",Yo),j.policy);if(Jt)return ln(Jt)}if(Cl(Rt,_t))return null;K?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:_t,depth:U+1});let Ft=j.analyzeNested(_t,{effectiveCwd:kt,envAssignments:vt});if(Ft&&!Fp(Ft,_t))return Ft;if(Zo(_t,void 0,!j.strict)){let Jt=wt(xt("interpreter.dangerous-command",ro),j.policy);if(Jt)return K?.recordSegment({type:"dangerous-text",token:_t,matched:!0,reason:ro}),ln(Jt)}K=void 0}}if(Rt==="busybox"&&bt.length>1)return Lp(Ct.wrapperNormalizationBudget),K?.recordSegment({type:"busybox",subcommand:bt[1]??"unknown"}),K?.recordSegment({type:"recurse",reason:"busybox",innerCommand:bt.slice(1).join(" "),depth:U+1}),bo(ht.slice(1),U,{...Ct,effectiveCwd:kt,envAssignments:vt});let Bt=de?null:wt(mm(Rt,bt),j.policy);if(Bt)return K?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Bt.reason}),ln(Bt);let Lt=K===Ct.trace?Ct:{...Ct,trace:K},on={words:ht,head:Rt,cwd:Tt,originalCwd:It,envAssignments:vt,allowTmpdirVar:Gt,dynamicArguments:gt.words.some((_t)=>_t.provenance==="command-substitution"),depth:U,effectiveCwd:kt,options:Lt,analyzeChildTokens:(_t,At)=>Se&&de?Cc(_t,U,Lt,{...de,cwd:At??void 0,effectiveCwd:At??void 0}):ho(bo(jt(_t),U+1,{...Lt,child:void 0,commandView:void 0,effectiveCwd:At,envAssignments:vt}))??A(_t,Lt.policy.rules),analyzeChild:(_t,At)=>Cc(_t,U,Lt,At)},qt=de&&(Rt==="xargs"||Rt==="parallel")?void 0:Gp(Rt);if(Rt==="rm"||Rt==="xargs"||Rt==="parallel")K?.recordSegment({type:"tmpdir-check",tmpdirValue:vt.has("TMPDIR")||j.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Gt});let Yt=K&&Rt==="git"?Bm(on.words,yc(on)):void 0,yn=Wp(Yt?Yt.match:qt?.(on)??null,j.policy);if(K)G_(on,yn,Yt?.relaxation??null);if(yn)return ln(yn);if(Se&&de&&(Rt==="rm"||Rt==="rmdir")){if(!(Rt==="rm"&&(Jn(bt)||de.dynamicRmInput)))return null;return(de.dynamicRmInput?Co(de,j.policy):null)??N_(de,j.policy)}let Sr=!de&&qt===void 0&&!Oi.has(Rt),xo=K&&Sr?[]:void 0;if(Sr)for(let _t=1;_t<bt.length;_t++){let At=bt[_t];if(!At)continue;xo?.push(At);let Ft=Wp(M_(bt,_t,U,Lt,Tt,It,kt,vt),j.policy);if(Ft)return K?.recordSegment({type:"fallback-scan",tokensScanned:xo??[],embeddedCommandFound:Ot(At)}),ln(Ft)}if(K?.recordSegment({type:"fallback-scan",tokensScanned:xo??[]}),we&&de&&!de.wrappedByTransparent)return null;let Rn=A(bt,j.policy.rules);if(K?.recordSegment({type:"custom-rules-check",rulesChecked:j.policy.rules.length>0,matched:!!Rn,reason:Rn?.reason}),Rn)return ln(Rn);return Se&&de?Co(de,j.policy):null}function Cc(G,U,j,K){return ho(bo(jt(G),U+1,{...j,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:K.originalCwd,effectiveCwd:K.effectiveCwd,envAssignments:K.envAssignments,worktreeMode:K.dynamicInput?!1:K.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:K}))}function M_(G,U,j,K,re,oe,de,Se){for(let we of Wn(G.slice(U),{environment:K.environment,cwd:re,envAssignments:Se,policy:K.policy})){let We=we.tokens[0];if(!We)continue;let ft=Ot(We);if(zp(We,ft)||Gp(ft)!==void 0&&ft!=="xargs"&&ft!=="parallel"||we.wrappedByTransparent&&K.policy.rules.length>0)K.budget.charge("derivedTokens",G.length-U);let mt=Cc(we.tokens,j,K,{embedded:!0,cwd:we.cwd,originalCwd:we.wrapperCwd===null?void 0:oe,effectiveCwd:we.wrapperCwd===void 0?de:we.wrapperCwd,envAssignments:we.envAssignments,allowTmpdirVar:!ri(we.envAssignments,K.environment),worktreeMode:!1,wrappedByTransparent:we.wrappedByTransparent});if(mt)return mt}return null}function D_(G,U,j,K,re,oe){if(!U)return Co(oe,re.policy);if(Zt(re.policy,"interpreter.one-liner-paranoid",!!re.paranoidInterpreters)){let Se=wt(xt("interpreter.one-liner-paranoid",Yo),re.policy);if(Se)return ln(Se)}if(Cl(G,U))return Co(oe,re.policy);let de=re.analyzeNested(U,{effectiveCwd:j,envAssignments:K});if(de&&!Fp(de,U))return de;if(Zo(U,void 0,!re.strict)){let Se=wt(xt("interpreter.dangerous-command",ro),re.policy);if(Se)return ln(Se)}return Co(oe,re.policy)}function Fp(G,U){let j=G.ruleId==="raw-text.dangerous-command",K=(G.reason.startsWith(vs)||G.reason===co)&&!Mi(U);return j||K}function yo(G,U){let j=G.shellDynamicMatch?wt(G.shellDynamicMatch,U):null;return j?ln(j):null}function Co(G,U){let j=G.dynamicSourceInput&&G.dynamicSourceMatch?wt(G.dynamicSourceMatch,U):null;return j?ln(j):null}function N_(G,U){let j=G.dynamicInput&&G.rmDynamicMatch?wt(G.rmDynamicMatch,U):null;return j?ln(j):null}function L_(G,U,j,K,re,oe){let de=hm(G);if(de.argvSource?.kind==="absent")return pn(re);if(de.argvSourceApplies&&de.argvSource){let we=$s(de.argvSource.value,j,U,K,re,oe,!0);if(we)return we}if(!de.envSourceApplies||!de.envName)return null;let Se=U.get(de.envName);if(!Se)return null;return $s(Se,j,U,K,re,oe,!0)}function $s(G,U,j,K,re,oe,de=!1){if(de&&/[$`*?[\]]/.test(G))return pn(re);let Se=qo(G,U,K.environment.paths,K.budget),we=Se?K.literalHeredocFiles?.get(Se):void 0;if(we===void 0)return de?pn(re):null;return K.budget.charge("derivedTokens",1),re?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:we,depth:oe+1}),K.analyzeNested(we,{effectiveCwd:U,envAssignments:j})}function W_(G){let U=G[0];return G.length>=2&&(U==='"'||U==="'")&&G.at(-1)===U?G.slice(1,-1):G}function G_(G,U,j){let K={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[G.head];if(!K)return;if(G.options.trace?.recordSegment({type:"rule-check",rule:K,matched:!!U||!!j,reason:U?.reason??j?.originalReason}),j)G.options.trace?.recordSegment({type:j.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:j.originalReason,gitCwd:j.gitCwd})}function Lp(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function ln(G){return{reason:G.reason,ruleId:G.id,intent:G.intent}}function pn(G){return G?.recordSegment({type:"error",message:si}),ln(F_())}function F_(){return{id:"analysis.dynamic-shell-source",reason:si,intent:"stop_and_explain"}}function zp(G,U){return Vt.has(U)||G==="$SHELL"||G==="${SHELL}"||Vt.has(Pt(U))}function Wp(G,U){return G?.id.startsWith("custom.")||G?.id==="raw-text.dangerous-command"?G:wt(G,U)}var z_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,B_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function $_(G,U){let j=Up(G,U);if(j.length===0)return!1;let K=j[$p(j)];if(K==="cd"||K==="pushd"||K==="popd")return!0;return z_.test(G.join(" "))}function Bp(G,U,j,K,re){if(G.dialect==="powershell"){let St=U_(G.words,re);if(St.kind==="none")return;if(!U||St.kind==="unknown")return null;return bc(K_(St.target),U,j.paths)}let oe=G.words.map(t),de=oe.some((St)=>/^CDPATH\+?=/.test(St));if(!$_(oe,j))return de?null:void 0;if(!U)return null;let Se=Up(oe,j,U),we=$p(Se);if(we===-1||Se[we]!=="cd")return null;let We=Se.slice(we+1),ft=We.findIndex((St)=>St.length<=1||!St.startsWith("-")||St==="--");if((ft===-1?We:We.slice(0,ft)).some((St)=>!/^-[LP]+$/.test(St)))return null;let mt=ft===-1?[]:We.slice(ft),gt=mt[0]==="--"?mt.slice(1):mt;if(gt.length>1)return null;let yt=gt[0],ht=K.get("HOME")||j.home;if(yt===void 0)return bc(ht,U,j.paths);let bt=G.words.find((St)=>St.provenance==="variable"&&St.text===yt),Ct=G.words.find((St)=>St.text===yt&&/^~(?:\/|$)/.test(St.raw)),vt=bt?Hn(bt,new Map([...K,["HOME",ht]])):Ct?`${ht}${yt.slice(1)}`:yt;if(vt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(vt)&&(de||j.env.has("CDPATH")))return null;return bc(vt,U,j.paths)}function bc(G,U,j){if(!G||G==="-"||G.startsWith("~")||G.includes("$")||G.includes("`"))return null;try{let K=cr(U,G,j);return j.isDirectory(K)?K:null}catch{return null}}function U_(G,U){let j=H_(G[0])?1:0,K=G[j];if(!j_(K,j===1))return{kind:"none"};let re=K.text.toLowerCase(),oe=re.split(/[\\/]/).pop()??re;if(!B_.has(oe))return{kind:"none"};if(re!==oe||oe==="pop-location"||oe==="popd")return{kind:"unknown"};return V_(G.slice(j+1),U)}function H_(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&(G.text==="&"||G.text===".")}function j_(G,U){return G?.provenance==="literal"&&(U||!G.quoted&&G.raw===G.text)}function V_(G,U){let j;for(let K of G){if(K.provenance!=="literal"||j!==void 0)return{kind:"unknown"};j=K.text}if(j!==void 0)return{kind:"target",target:j};return U===void 0?{kind:"unknown"}:{kind:"target",target:U}}function K_(G){return G.includes("::")?void 0:G.replaceAll("\\","/")}function $p(G){let U=0;if(G[0]==="builtin"&&G.length>1)U=1;if(G[U]!=="time")return U;let j=U+1;while(G[j]?.startsWith("-"))j++;return j}function Up(G,U,j){let K=q_(G);return ur([...K],U,j)}function q_(G){let U=0;while(U<G.length){let j=G[U];if(j!=="{"&&j!=="("&&j!=="$(")break;U++}return G.slice(U)}var tw="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",zr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function _c(G,U,j,K){if(U>=a.recursionDepth.cap)return j.trace?.recordSegment({type:"error",message:Bn}),{reason:Bn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let re=K??j.factStore?.getCommandProgram(G,j.shell??"auto")??y(G,j.shell);if(re.status==="limited")return j.trace?.recordSegment({type:"error",message:Bn}),{reason:Bn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(re.status==="invalid"){let We=re.issues.find((ft)=>ft.code.includes("heredoc"));if(We){if(!j.strict)return Rc(G,j);let ft=`${vs}: ${We.message}`;return j.trace?.recordGlobal({type:"error",message:ft}),{reason:ft,segment:G,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Yp(G,j),{reason:co,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(j.strict&&re.status==="partial")return Yp(G,j),{reason:co,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(re.issues.some((We)=>We.code.includes("quote")))return Rc(G,j);let de=j.cwd,Se=j.effectiveCwd!==void 0?j.effectiveCwd:j.cwd,we=Tm(j.environment.env,j.envAssignments);return js(re,U,{...j,rootProgram:re},de,[{effectiveCwd:Se,shellGitContextState:we,literalHeredocFiles:new Map(j.literalHeredocFiles),functionDefinitions:new Map(j.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function js(G,U,j,K,re){let oe=[...re],de,Se,we;for(let[We,ft]of G.nodes.entries()){if(ft.kind==="connector"){Se=ft.operator;continue}let pt=G.nodes[We+1],mt=pt?.kind==="connector"?pt.operator:void 0,gt=nw(G,We,ft,Se,mt),ht=Se==="&&"||Se==="||"?de:void 0,bt=Se==="&&"?ht?.success??oe:Se==="||"?ht?.failure??oe:oe,Ct=Se==="||"?ht?.success??[]:[],vt=Se==="&&"?ht?.failure??[]:[],St={connector:Se,skippedSuccessStates:Ct,skippedFailureStates:vt};if(yr(mt)&&!yr(Se))we=St;let Rt=yr(mt)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:yr(Se)?we??St:St,Tt=Br(Rt.connector)||Br(mt);if(ft.kind==="function"){let Bt=bt.flatMap((on)=>{let qt=$r(on);return qt.functionDefinitions.set(ft.name,ft.body),Sc(on,[qt],gt,mt==="&",Br(mt))}),Lt=vc(Bt,[],Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,mt);oe=Lt.states,de=Lt.conditionalStates,Se=void 0;continue}if(ft.kind==="group"){let Bt=[],Lt=[];for(let qt of bt){let Yt=js(ft.body,U,j,K,[$r(qt)]);if(Yt.result)return Yt;if(Bt.push(...Sc(qt,Yt.states,gt,mt==="&",Br(mt))),Tt)Lt.push(qt,...gt?Yt.states.map((yn)=>Us(qt,yn)):Yt.states)}let on=vc(Bt,Lt,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,mt);oe=on.states,de=on.conditionalStates,Se=void 0;continue}if(ft.kind!=="command")continue;let It=_w(G.nodes[We-1]),kt=j.trace?.flattenNested?j.trace.currentSegmentIndex:j.trace?.allocateSegment(),Gt=G.nodes[We-2],an=yr(Se)&&Gt?.kind==="command"?qm(Gt)??ow(Gt):void 0,Vn=[],hn=[];for(let Bt of bt){let Lt=iw(ft,U,j,K,[$r(Bt)]);if(Lt.result)return{result:Lt.result,states:oe};let on=G.dialect==="powershell"?Lt.states:Lt.states.map((qt)=>Us(Bt,qt));for(let qt of on){let Yt=$r(qt),yn=lw(ft,U,j.trace?{...j,trace:Zp(j.trace,kt)}:j,K,Yt,yr(Se),an);if(yn)return{result:yn,states:oe};let or=Ow(ft,Yt.functionDefinitions);if(or)j.budget.charge("derivedTokens",Vs(or));let Sr=or?U+1>=a.recursionDepth.cap?Ec(ft.displayText,j,[Yt]):js(or,U+1,j,K,[Yt]):{result:null,states:Iw(ft,Yt).flatMap((Rn)=>ww(ft,qt,Rn,It))};if(Sr.result)return Sr;Vn.push(...Sc(Bt,Sr.states,gt,mt==="&",Br(mt)));let xo=typeof Yt.effectiveCwd==="string"&&Yt.effectiveCwd!==qt.effectiveCwd&&ft.redirections.every((Rn)=>["<",">",">>",">|"].includes(Rn.operator)&&Rn.target?.text==="/dev/null");if(Tt&&(It||!xo))hn.push(Bt),hn.push(...Sr.states.map((Rn)=>gt?Us(Bt,Rn):Rn))}}let Cr=vc(Vn,hn,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,mt);oe=Cr.states,de=Cr.conditionalStates,Se=void 0}return{result:null,states:oe}}function nw(G,U,j,K,re){if(j.kind==="group"&&j.style==="subshell")return!0;if(G.dialect==="posix"&&(yr(K)||yr(re)))return!0;if(re==="&")return!0;return G.dialect==="powershell"&&j.kind==="group"&&j.style==="brace"&&rw(G,U)}function Sc(G,U,j,K,re){let oe=j?U.map((Se)=>Us(G,Se)):[...U],de=re?oe.flatMap((Se)=>So(G.literalHeredocFiles,Se.literalHeredocFiles)?[Se]:[{...Se,literalHeredocFiles:new Map(G.literalHeredocFiles)},Se]):oe;return K?[G,...de]:de}function Us(G,U){return{...G,literalHeredocFiles:new Map(U.literalHeredocFiles),createdDirectories:new Set(U.createdDirectories)}}function rw(G,U){let j=G.nodes.slice(0,U).reverse().find((re)=>re.kind==="command"||re.kind==="connector");if(!j||j.kind!=="command")return!0;let K=j.words[0]?.text.toLowerCase();if(K==="&"||K===".")return!1;if(K==="write-output"||K==="function"||K==="start-job")return!0;if(sw(j))return!0;return j.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function yr(G){return G==="|"||G==="|&"}function ow(G){if(G?.dialect!=="powershell")return;if(G.words.length===1&&G.words[0]?.quoted&&G.words[0].provenance==="literal")return G.words[0].text;if(G.words[0]?.text.toLowerCase()==="write-output"&&G.words.length===2&&G.words[1]?.provenance==="literal")return G.words[1].text;return}function Br(G){return G==="&&"||G==="||"}function vc(G,U,j,K,re,oe){let de={success:Hs([...j,...G]),failure:Hs([...K,...U])},Se=Br(oe)?de:void 0;return{states:Br(re)||Se?Hs([...de.success,...de.failure]):de.success,conditionalStates:Se}}function Zp(G,U,j=G.flattenNested){return{currentSegmentIndex:U,flattenNested:j,allocateSegment:G.allocateSegment,getNextSegmentIndex:G.getNextSegmentIndex,recordGlobal:G.recordGlobal,recordSegment:(K,re=U)=>G.recordSegment(K,re)}}function iw(G,U,j,K,re){let oe=G.nested.map((de)=>({program:de,depth:U}));if(G.dialect==="powershell"){let de=aw(G);if(de){if(U+1>=a.recursionDepth.cap)return Ec(de,j,re);let Se=y(de,"powershell");if(Se.status==="limited")return Ec(de,j,re);if(Se.status!=="complete")return Hp(oe,j,K,re);j.budget.charge("derivedTokens",Vs(Se)),oe.push({program:Se,depth:U+1})}}return Hp(oe,j,K,re)}function sw(G){let U=G.words[0];return U?.provenance==="variable"&&G.words.at(-1)?.text==="="?U.text.toLowerCase():void 0}function Hp(G,U,j,K){let re=[...K];for(let oe of G){let de=[];for(let Se of re){let we=js(oe.program,oe.depth,U,j,[$r(Se)]);if(we.result)return we;de.push(...we.states)}re=Hs(de)}return{result:null,states:re}}function aw(G){let U=G.words[0]?.provenance==="literal"&&!G.words[0].quoted&&G.words[0].raw===G.words[0].text&&(G.words[0].text==="&"||G.words[0].text==="."),j=U?1:0,K=G.words[j];if(K?.provenance!=="literal"||!U&&(K.quoted||K.raw!==K.text)||!["iex","invoke-expression"].includes(K.text.toLowerCase()))return;let re=G.words.slice(j+1),oe=re[0]&&!re[0].quoted&&re[0].raw===re[0].text&&["-c","-command"].includes(re[0].text.toLowerCase())?1:0,de=re[oe];return re.length===oe+1&&de?.quoted&&de.provenance==="literal"?de.text:void 0}function Vs(G){return G.nodes.reduce((U,j)=>U+(j.kind==="command"?j.words.length+j.nested.reduce((K,re)=>K+Vs(re),0):j.kind==="group"||j.kind==="function"?Vs(j.body):0),0)}function Ec(G,U,j){return U.trace?.recordSegment({type:"error",message:Bn}),{result:{reason:Bn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...j]}}function lw(G,U,j,K,re,oe,de){let Se={...j,environment:{...j.environment,env:re.shellGitContextState.env,paths:mw(j.environment.paths,re.createdDirectories,j.budget)}},we=Cw(G,!Se.strict);if(we&&Se.strict)return Se.trace?.recordSegment({type:"error",message:we}),{reason:we,segment:G.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Xp(G,re,"before-consumer",Se.environment.paths,Se.budget);let We=ne(G.dialect,G.words),ft=We.map(t),pt=G.displayText,mt=Pm(We,re.shellGitContextState),gt=km(mt,re.shellGitContextState);if(G.dialect==="powershell"){let bt=wt(em(G,oe,Dw(Se,re.effectiveCwd)),Se.policy);if(Se.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!bt,reason:bt?.reason}),bt)return Mw(pt,bt)}if(ft.length===1&&ft[0]?.includes(" ")&&!Fo(G.dialect,G.words)){let bt=wt(An(ft[0]),Se.policy),Ct=bt!==null&&!Se.strict&&ef(G,Se.rootProgram);if(bt&&!Ct)return Se.trace?.recordSegment({type:"dangerous-text",token:ft[0],matched:!0,reason:bt.reason}),{reason:bt.reason,segment:pt,ruleId:bt.id,intent:bt.intent};Se.trace?.recordSegment({type:"dangerous-text",token:ft[0],matched:!1});let vt=jp(G,we,re,gt,de,Se);if(vt)return vt;return tc(mt,re.shellGitContextState),null}let yt=bo(G.words,U,{...Se,commandView:G,cwd:K,effectiveCwd:re.effectiveCwd,envAssignments:gt,shellAssignments:re.shellGitContextState.shellAssignments,literalHeredocFiles:re.literalHeredocFiles,functionDefinitions:re.functionDefinitions,hasPipelineInput:oe,literalShellInput:de,analyzeNested:(bt,Ct)=>{let vt=Ct&&Object.hasOwn(Ct,"effectiveCwd")?Ct.effectiveCwd:re.effectiveCwd,St=_c(bt,U+1,{...Se,effectiveCwd:vt,envAssignments:Ct?.envAssignments??gt,literalHeredocFiles:re.literalHeredocFiles,functionDefinitions:Ct?.functionDefinitions,worktreeMode:Ct?.worktreeMode??Se.worktreeMode,trace:Se.trace?Zp(Se.trace,Se.trace.currentSegmentIndex,!0):void 0});return St?{reason:St.reason,ruleId:St.ruleId,intent:St.intent}:null}});if(yt)return{...yt,segment:pt};let ht=jp(G,we,re,gt,de,Se);if(ht)return ht;return tc(mt,re.shellGitContextState),null}function jp(G,U,j,K,re,oe){let de=Sw(G,U,j,K??new Map,oe);if(de)return de;return Xp(G,j,"after-consumer",oe.environment.paths,oe.budget),j.literalHeredocFiles.clear(),dw(G,U,j,oe.environment.paths,oe.budget),pw(G,j,oe.environment.paths,oe.budget),xw(G,j,re,oe.environment,oe.trace),null}var cw=new Set([">>","<>"]);function Xp(G,U,j,K,re){for(let de of G.redirections){if(!(j==="before-consumer"?uw(de):cw.has(de.operator)))continue;Vp(de.target,U,K,re)}if(j!=="before-consumer"||!rn(G.words[0],"tee"))return;let oe=Qp(G.words.slice(1));if(!oe)return;for(let de of oe.operands)Vp(de,U,K,re)}function uw(G){if(G.operator===">"||G.operator===">|")return!0;return G.operator===">&"&&G.fd===void 0&&G.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(G.target.text)}function Vp(G,U,j,K){let re=G?.provenance==="literal"?qo(G.text,U.effectiveCwd,j,K):void 0;if(!re)return;U.literalHeredocFiles.delete(re)}function dw(G,U,j,K,re){if(U)return;let oe=G.redirections.find((de)=>de.operator==="<<"||de.operator==="<<-")?.heredoc;if(!oe)return;for(let de of fw(G,j.shellGitContextState.shellAssignments)){let Se=qo(de,j.effectiveCwd,K,re);if(!Se||!rf(Se))continue;if(!j.literalHeredocFiles.has(Se)&&j.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");j.literalHeredocFiles.set(Se,oe.body)}}function fw(G,U){let j=xc(yw(G.redirections)?.target,U),K=j===void 0?[]:[j];if(rn(G.words[0],"cat"))return hw(G.words)?K:[];if(!rn(G.words[0],"tee"))return[];let re=Qp(G.words.slice(1),U);if(!re||re.append||re.hasUnsupportedOptions)return[];let oe=re.operands.map((de)=>xc(de,U));if(!oe.every((de)=>de!==void 0))return[];return[...oe,...K]}function xc(G,U){if(bw(G))return G.text;return(G&&Hn(G,U))??void 0}function mw(G,U,j){if(U.size===0)return G;let K=(re)=>{let oe=Dt(re,G,j);return[...U].some((de)=>de===oe||de.startsWith(`${oe}${ew}`))};return{realpath:(re)=>G.realpath(re)??(K(re)?Dt(re,G,j):null),entryKind:(re)=>{let oe=G.entryKind(re);return oe==="missing"&&K(re)?"present":oe},isDirectory:(re)=>G.isDirectory(re)||K(re)}}function pw(G,U,j,K){if(U.shellGitContextState.bodyDepth>0||!rn(G.words[0],"mkdir"))return;let re=G.words.slice(1).map((We)=>xc(We,U.shellGitContextState.shellAssignments));if(!re.every((We)=>We!==void 0))return;let oe=re.findIndex((We)=>We==="--"||We==="-"||!We.startsWith("-")),de=re.slice(0,oe);if(oe===-1||!de.every((We)=>/^(?:-[pv]+|--parents|--verbose)$/.test(We)))return;let Se=de.some((We)=>We==="--parents"||/^-v*p/.test(We)),we=U.effectiveCwd;for(let We of re.slice(re[oe]==="--"?oe+1:oe)){if(We.split(/[\\/]/).includes("..")||!Z_(We)&&!we)continue;let ft=Dt(Q_(we??"",We),j,K);if(Se?gw(ft,j):j.isDirectory(Y_(ft))&&Jp(ft,j))U.createdDirectories.add(ft)}}function gw(G,U){let j=J_(G).root,K=G.slice(j.length).split(/[\\/]+/).filter(Boolean),re=(de)=>X_(j,...K.slice(0,de+1)),oe=K.findIndex((de,Se)=>!U.isDirectory(re(Se)));return oe===-1||Jp(re(oe),U)}function Jp(G,U){try{return U.entryKind(G)==="missing"}catch{return!1}}function hw(G){let U=!1;for(let j of G.slice(1)){if(U||j.provenance!=="literal")return!1;if(j.text==="--"){U=!0;continue}if(!/^-u+$/.test(j.text))return!1}return!0}function yw(G){let U=G.findLast((j)=>(j.fd??([">",">|",">>",">&"].includes(j.operator)?1:0))===1);return U?.operator===">"||U?.operator===">|"?U:void 0}function Qp(G,U=new Map){let j=[],K=!0,re=!1,oe=!1;for(let de of G){if(de.provenance!=="literal"&&Hn(de,U)===null)return;if(K&&rn(de,"--")){K=!1;continue}if(K&&!de.quoted&&de.raw===de.text&&/^-[^-]/.test(de.text)){re||=de.text.slice(1).includes("a"),oe||=Array.from(de.text.slice(1)).some((Se)=>Se!=="a"&&Se!=="i");continue}if(K&&!de.quoted&&de.raw===de.text&&de.text.startsWith("--")){re||=de.text==="--append",oe||=de.text!=="--append"&&de.text!=="--ignore-interrupts";continue}j.push(de)}return{operands:j,append:re,hasUnsupportedOptions:oe}}function bw(G){if(!G||G.provenance!=="literal"||G.text.length===0)return!1;if(G.quoted||G.raw!==G.text)return!0;return!G.raw.startsWith("~")&&!/[{}]/.test(G.raw)}function rn(G,U){return G?.text===U&&G.raw===U&&G.provenance==="literal"&&!G.quoted}function wc(G){return G.quotedDelimiter||!/[$`\\]/.test(G.body)}function Cw(G,U){let j=G.redirections.filter((we)=>we.operator==="<<"||we.operator==="<<-");if(j.length===0)return;if(j.length!==1)return zr;let K=j[0];if(!K?.heredoc)return zr;let re=/\$\(|`/.test(K.heredoc.body);if(!wc(K.heredoc)&&(!U||re))return tw;if(K.fd!==void 0&&K.fd!==0)return zr;if(G.redirections.some((we)=>we!==K&&["<","<<","<<-","<<<","<&","<>"].includes(we.operator)))return zr;let oe=G.redirections.some((we)=>we!==K&&Kp(we.target));if(rn(G.words[0],"cat"))return oe?zr:void 0;if(rn(G.words[0],"tee"))return oe||G.words.slice(1).some(Kp)?zr:void 0;let de=G.words[0],Se=G.words[1];if(rn(de,"git")&&(rn(Se,"apply")||rn(Se,"commit")))return;if(rn(de,"gh")&&(rn(Se,"pr")||rn(Se,"issue"))&&rn(G.words[2],"create"))return;return zr}function Kp(G){return G?.parts.some((U)=>U.provenance==="command-substitution"&&U.raw.startsWith(">("))??!1}function Sw(G,U,j,K,re){if(!U)return null;let oe=G.redirections.filter((We)=>We.operator==="<<"||We.operator==="<<-"),de=oe.flatMap((We)=>We.heredoc?[We.heredoc.body]:[]);if(Ew(G,oe,j,K,re))return null;let Se=vw(G,oe,re);if(Se!==void 0)return Se?{reason:Se.reason,segment:G.displayText,ruleId:Se.id,intent:Se.intent}:null;let we=Rc(de.length===oe.length?de.join(`
-`):G.source,re);return we?{...we,segment:G.displayText}:null}function vw(G,U,j){let K=U.length===1?U[0]:void 0;if(!K?.heredoc||!wc(K.heredoc)||K.fd!==void 0&&K.fd!==0)return;let re=rn(G.words[0],"uv")&&rn(G.words[1],"run")?G.words.slice(2):G.words,oe=re[0];if(oe?.provenance!=="literal"||!On(oe.text))return;let de=re.findIndex((pt)=>rn(pt,"-"));if(!re.slice(1,de===-1?void 0:de).every((pt)=>pt.provenance==="literal"&&pt.text.startsWith("-")))return;let we=K.heredoc.body,We=Zt(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(j.trace?.recordSegment({type:"interpreter",interpreter:oe.text,codeArg:we,paranoidBlocked:We}),We){let pt=wt(xt("interpreter.one-liner-paranoid",Yo),j.policy);if(pt)return pt}if(!Zo(we,void 0,!j.strict))return null;let ft=wt(xt("interpreter.dangerous-command",ro),j.policy);if(!ft)return null;return j.trace?.recordSegment({type:"dangerous-text",token:we,matched:!0,reason:ft.reason}),ft}function Ew(G,U,j,K,re){let oe=U.length===1?U[0]:void 0;if(!oe?.heredoc||!wc(oe.heredoc)||oe.fd!==void 0&&oe.fd!==0)return!1;let de=Ir(G.words,re.environment,j.effectiveCwd,K),Se=de.words.map(t),we=Ot(Se[0]??"");if((de.envSplitValues?.length??0)>0||!Vt.has(we)&&!Vt.has(Pt(we)))return!1;return Qn(Se)}function xw(G,U,j,K,re){let oe=Bp(G,U.effectiveCwd,K,U.shellGitContextState.shellAssignments,j);if(oe===null)re?.recordSegment({type:"cwd-change",segment:G.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(oe!==void 0)U.effectiveCwd=oe}var Rw=new Set(["fi","done","esac"]);function _w(G){return G?.kind==="command"&&G.words.length===1&&G.words[0]?.raw==="!"}function ww(G,U,j,K){let re=G.words[0]?.text??"",oe=U.shellGitContextState.bodyDepth,de=j.shellGitContextState.bodyDepth,Se=j.compoundBodies;if(de>oe)return j.compoundBodies=[...Se.slice(0,oe),{entryCwd:U.effectiveCwd,branchCwds:Se[oe]?.branchCwds??[],hasElse:!1}],[j];let we=oe>0?Se[oe-1]:void 0;if(we&&(re==="else"||re==="elif"))return j.compoundBodies=[...Se.slice(0,oe-1),{entryCwd:we.entryCwd,branchCwds:[...we.branchCwds,j.effectiveCwd],hasElse:re==="else"}],j.effectiveCwd=we.entryCwd,[j];let We=we!==void 0&&Rw.has(re);if(We)j.compoundBodies=Se.slice(0,de);return[...new Set([j.effectiveCwd,...We?we.branchCwds:[],...We&&!we.hasElse?[we.entryCwd]:[],...K?[U.effectiveCwd]:[]])].map((pt)=>{if(pt===j.effectiveCwd)return j;let mt=$r(j);return mt.effectiveCwd=pt,mt})}function Pw(G,U){return G.length===U.length&&G.every((j,K)=>{let re=U[K];return re!==void 0&&j.entryCwd===re.entryCwd&&j.hasElse===re.hasElse&&j.branchCwds.length===re.branchCwds.length&&j.branchCwds.every((oe,de)=>oe===re.branchCwds[de])})}var Aw=/^[A-Za-z_][A-Za-z0-9_]*$/,Tw=8;function Iw(G,U){let j=G.words[1]?.text;if(G.dialect!=="posix"||G.words[0]?.text!=="for"||j===void 0||!Aw.test(j))return[U];let K=G.words.slice(3);if(!(G.words[2]?.text==="in"&&K.length>=1&&K.length<=Tw&&K.every((oe)=>oe.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(oe.text))))return U.shellGitContextState.shellAssignments.delete(j),[U];return K.map((oe)=>{let de=$r(U);return de.shellGitContextState.shellAssignments.set(j,oe.text),de})}function $r(G){return{effectiveCwd:G.effectiveCwd,shellGitContextState:Im(G.shellGitContextState),literalHeredocFiles:new Map(G.literalHeredocFiles),functionDefinitions:new Map(G.functionDefinitions),createdDirectories:new Set(G.createdDirectories),compoundBodies:G.compoundBodies}}function Hs(G){let U=[];for(let j of G){if(!U.some((K)=>kw(K,j)))U.push(j);if(U.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return U}function kw(G,U){return G.effectiveCwd===U.effectiveCwd&&Pw(G.compoundBodies,U.compoundBodies)&&So(G.shellGitContextState.env,U.shellGitContextState.env)&&So(G.literalHeredocFiles,U.literalHeredocFiles)&&So(G.functionDefinitions,U.functionDefinitions)&&So(G.shellGitContextState.effectiveEnvAssignments,U.shellGitContextState.effectiveEnvAssignments)&&So(G.shellGitContextState.shellAssignments,U.shellGitContextState.shellAssignments)&&G.shellGitContextState.bodyDepth===U.shellGitContextState.bodyDepth&&qp(G.shellGitContextState.bodyAssignments,U.shellGitContextState.bodyAssignments)&&qp(G.createdDirectories,U.createdDirectories)}function qp(G,U){return G.size===U.size&&[...G].every((j)=>U.has(j))}function So(G,U){if(G===U)return!0;if(!G||!U||G.size!==U.size)return!1;return[...G].every(([j,K])=>U.get(j)===K&&U.has(j))}function Ow(G,U){let j=zo(G);return j===void 0?void 0:U.get(j)}function Mw(G,U){if(!U)return null;return{reason:U.reason,segment:G,ruleId:U.id,intent:U.intent}}function Dw(G,U=G.effectiveCwd){let j=U===null;return{environment:G.environment,cwd:j?void 0:U??G.cwd,originalCwd:j?void 0:G.cwd,strict:G.strict,paranoid:G.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.protectedGitMetadata,policy:G.policy,budget:G.budget}}function Rc(G,U){let j=wt(An(G),U.policy),K=U.trace?.currentSegmentIndex??U.trace?.allocateSegment(),re={type:"dangerous-text",token:G,matched:!!j,reason:j?.reason};if(U.trace?.recordSegment(re,K),!j&&/^(?:cd|pushd)\s/.test(G))U.trace?.recordSegment({type:"cwd-change",segment:G,effectiveCwdNowUnknown:!0},K);return j?{reason:j.reason,segment:G,ruleId:j.id,intent:j.intent}:null}function Yp(G,U){let j={type:"strict-unparseable",rawCommand:G,reason:co},K=U.trace?.currentSegmentIndex;if(K===void 0)U.trace?.recordGlobal(j);if(K!==void 0)U.trace?.recordSegment(j)}var Nw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function eg(G,U,j,K){let re=_c(G,0,{...U,...Ue(U),budget:U.budget??_n(),factStore:K},j);if(!re)return null;return{kind:"deny",reason:re.reason,intent:re.intent??"manual_only",ruleId:re.ruleId,evidence:{command:G,segment:re.segment}}}function tg(G,U,j){try{return{decision:G()}}catch(K){let re=Lw(K,U,j);if(!re)throw K;return re}}function Lw(G,U,j){if(!(G instanceof s)||!Nw.has(G.kind))return null;let K=a[G.kind];if(j?.currentSegmentIndex!==void 0)j.recordSegment({type:"error",message:K.reason});if(j?.currentSegmentIndex===void 0)j?.recordGlobal({type:"error",message:K.reason});return{decision:{kind:"deny",reason:K.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:U,segment:U}},errorCode:K.errorCode}}var Ww=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Ac=new Set(["cc-safety-net","ccsn"]),Gw=new Set(["bunx","npx","pnpx"]),Fw=new Set(["pnpm","yarn"]),zw=new Set(["npm","pnpm","yarn"]),Bw=new Set(["bun","node"]);function qs(G,U,j={}){if(Ac.has(G))return 0;if(Gw.has(G)){if(j.broad)return Pc(U);let re=U[0]==="-y"||U[0]==="--yes"?1:0;return Ks(U[re])?re+1:null}let K=j.broad?U.findIndex((re)=>!re.startsWith("-")):0;if(K!==-1&&zw.has(G)&&j.broad&&U[K]==="exec"){let re=Pc(U.slice(K+1));return re===null?null:K+1+re}if(Fw.has(G)){if(G==="yarn"&&!j.broad)return null;if(!j.broad)return U[0]==="dlx"&&Ks(U[1])?2:null;if(K===-1||U[K]!=="dlx")return null;let re=Pc(U.slice(K+1));return re===null?null:K+1+re}if(Bw.has(G)){let re=j.broad&&K!==-1?K:0;if(ng(U[re]))return re+1;if(G==="bun"&&U[re]==="run"&&ng(U[re+1]))return re+2}return null}function Pc(G){let U=G.findIndex((K)=>Ks(K));if(U===-1)return null;let j=U;while(j<G.length){let K=G[j]??"";if(!K.startsWith("-")&&!Ks(K))break;j++}return j}function Ks(G){if(!G)return!1;let U=G.indexOf("@");if(U===-1)return Ac.has(G);if(U===0)return!1;let j=G.slice(U+1);if(j===""||j.includes("/")||j.includes(":"))return!1;return Ac.has(G.slice(0,U))}function ng(G){let U=G?.replaceAll("\\","/");return[...Ww].some((j)=>U===j||U?.endsWith(`/${j}`))}var Ge="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function rg(G,U,j){let K=fn(G,"input-candidate");if(!K)return null;let re=io(K.shell,G.invocation.context.executionCwd,U,j,{findSegmentTarget:(oe)=>$w(oe,U),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return re?{target:re}:null}function $w(G,U){let j=ur([...G],U),K=j.slice(1),re=qs(Pt(j[0]??"").toLowerCase(),K,{broad:!0});if(re===null)return null;let oe=K.slice(re).filter((de)=>de!=="-g"&&de!=="--global");return oe[0]==="policy"&&oe[1]==="apply"?j.join(" "):null}import{dirname as Ys}from"node:path";var He="This path contains the protected policy config and you must not modify or delete it.",Uw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function ag(G,U,j){let K=Yw(G.invocation.context,U,j);if(G.invocation.route.kind==="patch")return og(G.paths,!1,G.invocation.context.executionCwd,K,U,j);let re=fn(G,"input-candidate");if(G.invocation.route.kind==="command")return re?ig(re.shell,G.invocation.context.executionCwd,K,U,j):null;if(G.invocation.route.kind==="unknown"&&re){let oe=ig(re.shell,G.invocation.context.executionCwd,K,U,j);if(oe)return oe}return og(G.paths,G.invocation.route.kind==="grep"||G.invocation.route.kind==="glob"||Ri(G.invocation.toolName),G.invocation.context.executionCwd,K,U,j)}function og(G,U,j,K,re,oe){if(U)return null;let de=G.find((Se)=>hi(Se,j,K,re,oe));return de?{target:de}:null}function ig(G,U,j,K,re){let oe=io(G,U,K,re,{findSegmentTarget:(de,Se)=>Hw(de,Se,j,K,re)?.target??null,isRedirectionTarget:(de,Se)=>hi(de,Se.cwd,j,K,re),findMalformedTarget:(de)=>qw(de,U,j,K,re)?.target??null});return oe?{target:oe}:null}function Hw(G,U,j,K,re){if(ti(G))return null;let oe=dr([...G],K),de=Pt(oe[0]??"").toLowerCase(),Se=oe.slice(1);if(de==="rm"&&jw(Se)){let we=Vw(Se).find((We)=>sg(dn(We,U.variables),U.cwd,j,K,re));if(we)return{target:we}}if(de==="find"){if(Ps(oe,1)||Vl(oe,K)){let We=(ci(jt(oe))??jt(["."])).find((ft)=>{let pt=dn(ft.text,U.variables);return hi(pt,U.cwd,j,K,re)||sg(pt,U.cwd,j,K,re)})?.text;if(We)return{target:We}}}if(de==="mv"){let we=ps(Se).sources.find((We)=>Zw(dn(We,U.variables),U.cwd,j,K,re));if(we)return{target:we}}if(Kw(oe,de))return null;for(let we of[...G,...oe])for(let We of lg(we))if(hi(dn(We,U.variables),U.cwd,j,K,re))return{target:We};return null}function jw(G){return G.some((U)=>U==="--recursive"||U.startsWith("-")&&!U.startsWith("--")&&/[rR]/.test(U.slice(1)))}function Vw(G){let U=G.indexOf("--");if(U!==-1)return[...G.slice(0,U).filter((j)=>!j.startsWith("-")),...G.slice(U+1)];return G.filter((j)=>!j.startsWith("-"))}function Kw(G,U){if(!Uw.has(U))return!1;if(U!=="sed")return!0;return!G.slice(1).some((j)=>j.startsWith("-i")||j==="--in-place"||j.startsWith("--in-place="))}function qw(G,U,j,K,re){for(let oe of G.split(/\s+/))for(let de of lg(oe))if(hi(de,U,j,K,re))return{target:de};return null}function lg(G){let U=G.trim().replace(/^['"]|['"]$/g,""),j=U.indexOf("=");return j===-1||j===U.length-1?[U]:[U,U.slice(j+1)]}function Yw(G,U,j){let K=(Se)=>yi(sn(Se,G.executionCwd,U,j)),re=K(l(U)),oe=[K(h(G.executionCwd)),K(h(G.configCwd))],de=new Set(oe.map((Se)=>Ys(Se)));for(let Se=Ys(re);;Se=Ys(Se))if(de.add(Se),Ys(Se)===Se)break;return{files:new Set([re,...oe]),directoriesAndAncestors:de}}function hi(G,U,j,K,re){let oe=qc(G,U,K,re,(de)=>yi(de)===Ii);return oe!==null&&j.files.has(yi(oe))}function sg(G,U,j,K,re){return j.directoriesAndAncestors.has(yi(sn(G,U,K,re)))}function Zw(G,U,j,K,re){let oe=yi(sn(G,U,K,re));return j.files.has(oe)||j.directoriesAndAncestors.has(oe)}function yi(G){return process.platform==="win32"?G.toLowerCase():G}import{isAbsolute as Zs,posix as Sg,resolve as Qs,win32 as Xw}from"node:path";import{fileURLToPath as Jw}from"node:url";var vg="Access to a sensitive path is not allowed.",Eg=new Set(["echo","printf"]),Qw=new Set(["find"]),eP=new Set(["!","do","elif","else","if","then","until","while"]),tP=new Set(["-exec","-execdir"]),nP=new Set([";","+"]),rP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),oP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),xg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),iP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),sP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Rg=new Set(["-c","-e","-r","-E","--eval","--exec"]),aP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),lP=new Set(["grep","rg"]),cP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),uP=new Set(["commit","merge","notes","stash","tag"]),dP=new Set(["-m","--message"]),fP=new Set(["--grep"]),cg=new Set(["jq","gojq","jaq"]),ug="f",dg="file",mP="files",pP=new Set(["e","f"]),gP=new Set(["regexp","file"]),hP=new Set(["e","f","A","B","C","m"]),yP=new Set(["regexp","file","after-context","before-context","context","max-count"]),Tc="__CC_SAFETY_NET_PIPE_INPUT__",kc=/[\w./~@+-]*[./~][\w./~@+-]*/g,bP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,CP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,SP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,fg=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,mg=/\b(?:system|exec|spawn|popen)\s*$/,vP=/\b(?:eval|exec)\s*\(/g,EP=/\b(?:eval|exec)\s*$/,xP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function pg(G,U,j,K,re,oe){for(let de of G){let Se=de.target;if(CA(Se,de.cwd,U?.denyPaths??[],j,K,re))return{target:Se,ruleId:"secret.deny-path"};if(oe&&!oe.has(Se))continue;let we=yA(Se,de.cwd,U,K,re);if(we){let We=oe!==void 0&&!we.startsWith("secret.home.")&&!we.startsWith("secret.cli.");if(We&&K.paths.isDirectory(Mg(Se,de.cwd,K,re)))continue;if(We&&de.isRedirectionWriteTarget===!0&&!Se.includes("$")&&!Js(Se,de.cwd,K,re))continue;if(We&&/\s/.test(Se)&&!Se.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Se)&&!Js(Se,de.cwd,K,re))continue;if(!we.startsWith("secret.cli.")&&SA(Se,de.cwd,U?.allowPaths??[],j,K,re))continue;return{target:Se,ruleId:we}}}return null}function _g(G,U,j,K,re={}){let oe=gg(G,j,K),de=pg(oe,U,G.invocation.context.configCwd,j,K);if(de===null||de.ruleId==="secret.deny-path"||re.strict!==!1)return de;let Se=pg(oe,U,G.invocation.context.configCwd,j,K,new Set(gg(G,j,K,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((we)=>we.target)));return Se?.ruleId!=="secret.deny-path"&&RP(G,j)?null:Se}function RP(G,U){let j=fn(G,"input-candidate")??fn(G,"declared-command");if(!j)return!1;if(j.program.nodes.some((de)=>de.kind==="command"&&de.nested.length>0))return!1;let K=[];for(let de of ms(j.shell)){if(de.kind==="operator"&&de.boundary)return!1;if(de.kind==="redirection")return!1;if(de.kind==="operator")continue;K.push(Xn(de.text,U))}let re=rr(K);if(re.length===0)return!1;let oe=zn(re[0]??"").toLowerCase();if(G.invocation.route.kind==="unknown")return j.program.dialect==="powershell"&&(oe==="ls"||oe==="stat");return Mc(oe,re.slice(1))}function Mc(G,U){if(G==="ls"||G==="stat")return!0;if(G==="test")return U.length===2&&(U[0]==="-e"||U[0]==="-f");if(G==="[")return U.length===3&&(U[0]==="-e"||U[0]==="-f")&&U[2]==="]";if(G==="git")return U[0]==="check-ignore";if(G!=="find")return!1;return!U.some((j)=>rP.has(j))}function gg(G,U,j,K={}){let re=G.invocation.context.executionCwd,oe=G.invocation.route.kind;if(oe!=="command"&&oe!=="unknown")return G.paths.map((Se)=>({target:Se,cwd:re}));let de=fn(G,"input-candidate");return[...de?Eo(de.shell,G.store,K,U,re,j,_P(de)):[],...oe==="unknown"?G.paths.map((Se)=>({target:Se,cwd:re})):[]]}function _P(G){return G.program.dialect==="powershell"}function Eo(G,U,j,K,re,oe,de=!1){if(G.status==="structural-limit")throw new b;if(G.status==="unclosed-quote")return[];if(G.status==="invalid")throw Error("Unable to parse command for secret protection");let Se=[...G.assignmentFallbacks.map((We)=>({target:We,cwd:re})),...QP(Xn(G.source,K),U,j,K,re,oe)],we=(We)=>Xn(LP(We,de),K);return fs(G,re,K,oe,{word:we,segment:(We,ft,pt,mt,gt)=>{if(We.length===0)return null;if(Se.push(...ea(We,U,j,K,ft.cwd,oe,gt)),pt!==null)Se.push(...PP(pt,We,U,j,K,ft.cwd,oe));return null},redirection:(We,ft)=>{if(We.body!==void 0&&We.consumer!==void 0)Se.push(...wg(We.consumer,[We.body],U,j,K,ft.cwd,oe,(pt)=>AP(We.consumer??[],pt,U,j,K,ft.cwd,oe)));if(We.targetOrder==="legacy-segment")return Al;return Se.push({target:we(We.target),cwd:ft.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),Se}function Dc(G,U,j,K,re,oe){let de=U.getShellSyntax(G);if(de.status==="structural-limit")throw new b;return de.status==="complete"?Eo(de,U,j,K,re,oe):null}function ea(G,U,j,K,re,oe,de){let Se=(ht)=>({target:ht,cwd:re});if(de?.size){let ht=G.filter((bt,Ct)=>!de.has(Ct));if(cg.has(zn(rr(ht)[0]??"").toLowerCase()))return[...G.filter((bt,Ct)=>de.has(Ct)).map(Se),...ea(ht,U,j,K,re,oe)]}let we=NP(G).map(Se),We=rr(G);if(We.length===0)return we;let ft=We[0]??"",pt=zn(ft).toLowerCase(),mt=We.slice(1),gt=We.findIndex((ht)=>!eP.has(ht));if(j.skipMetadataOnlySegments===!0&&gt!==-1&&Mc(zn(We[gt]??"").toLowerCase(),We.slice(gt+1)))return we;let yt=wP(ft,pt,mt);if(yt)return[...we,...yt.map(Se)];if(Eg.has(pt))return j.displayOperandsAreCapturedOutput===!0?[...we,...Pg(G).map(Se)]:we;if(pt==="eval")return[...we,...Dc(mt.join(" "),U,j,K,re,oe)??mt.map(Se)];if(pt==="export")return[...we,...mt.flatMap((ht)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ht)?[ht.slice(ht.indexOf("=")+1)]:jn(pt,ht)).map(Se)];if(pt==="git")return[...we,...GP(mt).map(Se)];if(pt==="gh")return[...we,...Oc(pt,mt,cP).map(Se)];if(cg.has(pt))return[...we,...WP(mt).map(Se)];if(lP.has(pt))return[...we,...aA(mt).map(Se)];if(Qw.has(pt))return[...we,...zP(mt,U,j,K,re,oe).map(Se)];if(Pn.has(pt))return[...we,...mt.flatMap((ht)=>jn("awk",ht)).map(Se),...mt.flatMap((ht)=>$P(ht,U,j,K,re,oe)),...mt.flatMap(UP).map(Se)];if(pt==="curl")return[...we,...mt.filter((ht,bt)=>Tg(ht)===null&&Ag(mt[bt-1])===null).flatMap((ht)=>jn(pt,ht)).map(Se),...FP(mt).map(Se)];if(ni(pt)){let ht=ei.has(pt)?Sn([pt,...mt]):null;if(ht!==null&&ht.command!==null&&ht.commandIndex!==null){let bt=U.getShellSyntax(ht.command);if(bt.status==="structural-limit")throw new b;if(bt.status==="complete")return[...we,...Eo(bt,U,j,K,re,oe),...mt.slice(ht.commandIndex).filter((Ct)=>!Ct.startsWith("-")).map(Se)]}return[...we,...BP(pt,mt,U,j,K,re,oe)]}return[...we,...mt.flatMap((ht)=>jn(pt,ht)).map(Se)]}function wP(G,U,j){let K=qs(U,j);if(K===null||j[K]!=="explain")return null;let re=[G,...j.slice(0,K)],oe=j.slice(K+1);for(let de=0;de<oe.length;de++){let Se=oe[de];if(Se==="--json"||Se==="--help"||Se==="-h")continue;if(Se==="--cwd"){let we=oe[de+1];if(we&&!we.startsWith("--"))re.push(we);de++;continue}return re}return re}function PP(G,U,j,K,re,oe,de){if(OP(U,j,K,re,oe,de)){let Se=rr(G),we=Mc(zn(Se[0]??"").toLowerCase(),Se.slice(1))?Se.slice(1).filter((We)=>!We.startsWith("-")):[];return[...Pg(G),...we].map((We)=>({target:We,cwd:oe}))}return wg(U,TP(G),j,K,re,oe,de,()=>[])}function AP(G,U,j,K,re,oe,de){let Se=rr(G);if(!ni(zn(Se[0]??"").toLowerCase()))return[];return Dc(U,j,K,re,oe,de)??[{target:U,cwd:oe}]}function wg(G,U,j,K,re,oe,de,Se){let we=MP(G);if(we===null)return U.flatMap(Se);return U.flatMap((We)=>ei.has(we)?Eo(j.getShellSyntax(We),j,K,re,oe,de):Xs(we,We,j,K,re,oe,de))}function Pg(G){let U=rr(G);if(U.length===0)return[];let j=zn(U[0]??"").toLowerCase();if(!Eg.has(j))return[];let K=U[U[1]==="--"?2:1];if(j==="printf"&&K!==void 0&&!K.startsWith("-")&&!K.replaceAll("%%","").includes("%"))return[Nc(K.replaceAll("%%","%"))];return U.slice(1)}function TP(G){let U=rr(G);if(U.length===0)return[];let j=zn(U[0]??"").toLowerCase(),K=U.slice(1);if(j==="echo"){let re=K.findIndex((oe)=>!/^-[neE]+$/.test(oe));return[(re===-1?[]:K.slice(re)).join(" ")]}if(j==="printf")return IP(K);return[]}function IP(G){let U=G[0];if(U===void 0)return[];let j=(U.match(/%%|%[bqs]/g)??[]).filter((re)=>re!=="%%").length;if(j===0||G.length===1)return[Nc(U)];let K=G.slice(1);return Array.from({length:Math.ceil(K.length/j)},(re,oe)=>kP(U,K.slice(oe*j,(oe+1)*j)))}function kP(G,U){let j=0;return Nc(G.replace(/%%|%[bqs]/g,(K)=>{if(K==="%%")return"%";let re=U[j]??"";return j++,re}))}function Nc(G){return G.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function OP(G,U,j,K,re,oe){let de=rr(G);if(de.length===0||zn(de[0]??"").toLowerCase()!=="xargs")return!1;let Se=Fr(de),we=de.slice(Se.childStart);if(we.length===0)return!1;if(Se.replacementToken==="")return!1;let We=Se.replacementToken,ft=We===null?[...we,Tc]:we.map((pt)=>pt.split(We).join(Tc));return ea(ft,U,j,K,re,oe).some((pt)=>pt.target.includes(Tc))}function MP(G){let U=rr(G);if(U.length===0)return null;let j=zn(U[0]??"").toLowerCase();if(!ni(j))return null;return DP(j,U.slice(1))?j:null}function DP(G,U){let j=Lc(G);for(let K=0;K<U.length;K++){let re=U[K];if(re===void 0)break;if(Rg.has(re)||Ig(G,re)||/^--(?:eval|exec)=/.test(re))return!1;if(re==="-")return!0;if(re.startsWith("-")){if(j==="python"&&re==="-m")return!1;if(xP.get(j)?.has(re))K++;continue}return!1}return!0}function Lc(G){return/^python\d/.test(G)?"python":G}function NP(G){let U=[];for(let j of G){if(Og(j))continue;let K=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(j);if(K===null)break;if(K[1]!==void 0&&K[1]!=="")U.push(K[1])}return U}var hg=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function LP(G,U){if(!U||!hg.test(G))return G;return`~${G.replace(hg,"").replace(/\\/g,"/")}`}function jn(G,U){if(U==="--")return[];let j=[],K=U.indexOf("=");if(K>0&&K<U.length-1&&!U.slice(0,K).includes("?"))j.push(U.slice(K+1));if(U.startsWith("-"))return j;if(G==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(U))return j;if(G==="zip"&&/\.zip$/i.test(U))return j;return j.push(U),j}function WP(G){let U=-1,j=!1;for(let K=0;K<G.length;K++){let re=G[K]??"";if(!j&&re==="--"){j=!0;continue}if(j||!/^-(?:[A-Za-z]|-)/.test(re)){if(U===-1)U=K;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(re)){K+=2;continue}if(re==="--indent"||re==="-L"){K++;continue}if(re.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(re)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(re))continue;return G.flatMap((oe)=>jn("jq",oe))}return G.flatMap((K,re)=>re===U?[]:jn("jq",K))}function GP(G){let U=[];for(let j=0;j<G.length;j++){let K=G[j]??"";if(K==="--"||!K.startsWith("-"))return[...U,...uP.has(K)?Oc("git",G.slice(j).map((oe)=>/^-[aeinopqsv]+m$/.test(oe)?"-m":oe),dP):Oc("git",G.slice(j),fP)];if(U.push(...jn("git",K)),!Cn.has(K))continue;let re=G[j+1];if(re===void 0)break;U.push(...K==="-c"&&re.includes("=")?[re.slice(re.indexOf("=")+1)]:jn("git",re)),j++}return U}function Oc(G,U,j){let K=[];for(let re=0;re<U.length;re++){let oe=U[re]??"";if(oe==="--")return[...K,...U.slice(re).flatMap((de)=>jn(G,de))];if(j.has(oe)){re++;continue}if(oe.includes("=")&&j.has(oe.slice(0,oe.indexOf("="))))continue;K.push(...jn(G,oe))}return K}function FP(G){return G.flatMap((U,j)=>{let K=Tg(U);if(K!==null)return yg(K.flag,K.value);let re=Ag(G[j-1]);return re===null?[]:yg(re,U)})}function yg(G,U){if(G==="-F"||G==="--form"){let j=U.indexOf("="),K=j===-1?U:U.slice(j+1);if(!K.startsWith("@")&&!K.startsWith("<"))return[];return Ic(K.slice(1).split(";")[0]??"")}if(G==="--data-urlencode"){let j=U.indexOf("@"),K=U.indexOf("=");if(j===-1||K!==-1&&K<j)return[];return Ic(U.slice(j+1))}return U.startsWith("@")?Ic(U.slice(1)):[]}function Ag(G){if(G===void 0)return null;if(xg.has(G))return G;return/^-[A-Za-z]+[dF]$/.test(G)?`-${G.slice(-1)}`:null}function Tg(G){let U=G.slice(0,2);if(G.length>2&&(U==="-d"||U==="-F"))return{flag:U,value:G.slice(2)};let j=G.indexOf("=");if(j===-1)return null;let K=G.slice(0,j);return xg.has(K)?{flag:K,value:G.slice(j+1)}:null}function Ic(G){return G===""||G==="-"?[]:[G]}function zP(G,U,j,K,re,oe){let de=G.findIndex((we)=>we.startsWith("-")||we==="("||we==="!"||we===";"),Se=[...G.slice(0,de===-1?G.length:de),...G.flatMap((we,We)=>we==="-files0-from"&&G[We+1]!==void 0?[G[We+1]??""]:[])];for(let we=0;we<G.length;we++){if(!tP.has(G[we]??""))continue;let We=G.slice(we+1),ft=We.findIndex((gt)=>nP.has(gt)),pt=ft===-1?We:We.slice(0,ft),mt=ea(pt,U,j,K,re,oe).map((gt)=>gt.target);if(Se.push(...mt.filter((gt)=>gt!=="{}")),!mt.includes("{}"))continue;Se.push(...G.slice(0,we).flatMap((gt,yt,ht)=>{if(!oP.has(gt))return[];let bt=ht[yt+1];return bt===void 0?[]:[bt,bt.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Se}function BP(G,U,j,K,re,oe,de){let Se=[];for(let we=0;we<U.length;we++){let We=U[we];if(We===void 0)break;if(Rg.has(We)||Ig(G,We)){let pt=U[we+1];if(pt!==void 0)Se.push(...Xs(G,pt,j,K,re,oe,de)),we++;continue}let ft=/^--(?:eval|exec)=(.*)$/.exec(We);if(ft!==null&&ft[1]!==void 0){Se.push(...Xs(G,ft[1],j,K,re,oe,de));continue}if(!We.startsWith("-"))Se.push({target:We,cwd:oe})}return Se}function Ig(G,U){if(!U.startsWith("-")||U.startsWith("--")||U.length<=2)return!1;return aP.get(U[U.length-1]??"")?.has(Lc(G))??!1}function $P(G,U,j,K,re,oe){if(!G.includes("system"))return[];return $l(G)?.commands.flatMap((de)=>Eo(U.getShellSyntax(de),U,j,K,re,oe))??[]}function UP(G){return Array.from(G.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((U)=>U[1]).filter((U)=>U!==void 0&&U!=="")}function HP(G){let U=Array.from(G.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((j)=>j[2]).filter((j)=>j!==void 0&&j!=="");return[...U,...U.flatMap(Wc),...G.match(kc)??[]]}function Xs(G,U,j,K,re,oe,de){let Se=(ht)=>({target:ht,cwd:oe}),we=VP(U,jP(G));if(we.kind==="unmaskable")return HP(U).map(Se);let We=we.masked.match(fg)!==null||we.literals.some((ht)=>mg.test(we.masked.slice(0,ht.start))),ft=we.masked.match(vP)!==null||we.literals.some((ht)=>EP.test(we.masked.slice(0,ht.start))),pt=K.inlineLiteralsPresumedData===!0&&!ei.has(G),mt=pt&&!(ZP(we.masked)||We||ft)?[]:we.literals,gt=pt?Array.from(we.masked.matchAll(fg),(ht)=>{let bt=ht.index+ht[0].length;return{start:bt,end:vl(we.masked,bt)}}):[],yt=!pt||gt.some((ht)=>El(we.masked,ht.start))?we.literals:we.literals.filter((ht)=>mg.test(we.masked.slice(0,ht.start))||gt.some((bt)=>ht.start>=bt.start&&ht.start<bt.end));return[...mt.map((ht)=>ht.text).filter((ht)=>ht!=="").map(Se),...mt.flatMap((ht)=>Wc(ht.text)).map(Se),...pt?[]:we.literals.flatMap((ht)=>ht.text.match(kc)??[]).map(Se),...We?yt.flatMap((ht)=>Dc(ht.text,j,K,re,oe,de)??[Se(ht.text)]):[],...ft?we.literals.flatMap((ht)=>Xs(G,ht.text.replace(/\\(.)/g,(bt,Ct)=>Ct==="n"?`
-`:Ct),j,K,re,oe,de)):[],...(we.masked.match(kc)??[]).map(Se)]}function jP(G){let U=Lc(G);if(U==="python")return"python";if(U==="osascript")return"opaque";return U==="node"||U==="bun"||U==="deno"?"javascript":"simple"}function VP(G,U){if(U==="opaque")return{kind:"unmaskable"};let j=G.split(""),K=[];for(let re=0;re<G.length;re++){let oe=G[re]??"";if(U==="simple"&&(oe==="`"||oe==="%"||oe==="<")){if(CP.test(G.slice(re)))return{kind:"unmaskable"}}let de=oe==="'"||oe==='"'||U==="javascript"&&oe==="`"?oe:null;if(de===null)continue;if(de==="`"&&YP(G,re))return{kind:"unmaskable"};let Se=U==="python"?KP(G,re):"",we=U==="python"&&G.startsWith(de.repeat(3),re)?de.repeat(3):de,We=re+we.length,ft=qP(G,We,we);if(ft===null)return{kind:"unmaskable"};let pt=G.slice(We,ft);if(/[fF]/.test(Se)&&pt.includes("{"))return{kind:"unmaskable"};if(U==="simple"&&de==='"'&&SP.test(pt))return{kind:"unmaskable"};K.push({start:We,text:pt});for(let mt=re;mt<ft+we.length;mt++)j[mt]=" ";re=ft+we.length-1}return{kind:"masked",masked:j.join(""),literals:K}}function KP(G,U){return bP.exec(G.slice(Math.max(0,U-3),U))?.[1]??""}function qP(G,U,j){let K=j==="`",re=K||j.length===3;for(let oe=U;oe<G.length;oe++){let de=G[oe];if(de==="\\"){oe++;continue}if(K&&de==="$"&&G[oe+1]==="{")return null;if(!re&&(de===`
-`||de==="\r"))return null;if(G.startsWith(j,oe))return oe}return null}function YP(G,U){for(let j=U-1;j>=0;j--){let K=G[j];if(!K||/\s/.test(K))continue;return/[\w$\])]/.test(K)}return!1}function ZP(G){for(let U of G.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let j=U[0],K=U.index;if(iP.has(j.toLowerCase()))return!0;let re=j.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((oe)=>oe.toLowerCase());if(!re.some((oe)=>sP.has(oe)))continue;if(re.length>1)return!0;if(XP(G,K)===".")return!0;if(JP(G,K+j.length)==="(")return!0}return!1}function XP(G,U){for(let j=U-1;j>=0;j--)if(!/\s/.test(G[j]??""))return G[j];return}function JP(G,U){for(let j=U;j<G.length;j++)if(!/\s/.test(G[j]??""))return G[j];return}function QP(G,U,j,K,re,oe){return oA(G).flatMap((de)=>{let Se=U.getShellSyntax(de);if(Se.status==="invalid")return[];return[...Eo(Se,U,{...j,displayOperandsAreCapturedOutput:!0},K,re,oe),...eA(Se,K)?tA(Se,K).map((we)=>({target:we,cwd:re})):[]]})}function eA(G,U){let j=ms(G);for(let K=0;K<j.length;K++){let re=j[K];if(re?.kind!=="word"||zn(Xn(re.text,U)).toLowerCase()!=="base64")continue;for(let oe=K+1;oe<j.length;oe++){let de=j[oe];if(de?.kind==="operator")break;if(de?.kind!=="word")continue;let Se=Xn(de.text,U);if(Se==="--decode"||!Se.startsWith("--")&&Se.startsWith("-")&&/[dD]/.test(Se))return!0}}return!1}function tA(G,U){return ms(G).flatMap((j)=>j.kind==="word"?[Xn(j.text,U)]:j.kind==="redirection"&&j.target?[Xn(j.target,U)]:[]).flatMap(Wc)}function Wc(G){let U=rA(G);if(U===null)return[];let j=Buffer.from(U,"base64").toString("utf8");if(j===""||nA(j))return[];return Buffer.from(j,"utf8").toString("base64").replace(/=+$/g,"")===U.replace(/=+$/g,"")?[j]:[]}function nA(G){return Array.from(G).some((U)=>{let j=U.charCodeAt(0);return j<32||j===127})}function rA(G){if(G.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(G))return null;if(/=/.test(G.replace(/=+$/g,"")))return null;let U=G.replace(/=+$/g,"");if(U.length%4===1)return null;return`${U.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-U.length%4)%4)}`}function oA(G){let U=[],j={inSingle:!1,inDouble:!1,escaped:!1};for(let K=0;K<G.length;K++){let re=G[K];if(!re)break;if(No(re,j))continue;if(kg(G,K,j)){let oe=iA(G,K+1);if(oe!==null)U.push(oe.body),K=oe.endIndex;continue}if(!j.inSingle&&re==="`"){let oe=sA(G,K);if(oe!==null)U.push(oe.body),K=oe.endIndex}}return U}function iA(G,U){let j={inSingle:!1,inDouble:!1,escaped:!1},K=1;for(let re=U+1;re<G.length;re++){let oe=G[re];if(!oe)break;if(No(oe,j))continue;if(kg(G,re,j)){K++,re++;continue}if(!j.inSingle&&!j.inDouble&&oe===")"){if(K--,K===0)return{body:G.slice(U+1,re),endIndex:re}}}return null}function sA(G,U){let j=!1;for(let K=U+1;K<G.length;K++){let re=G[K];if(!re)break;if(j){j=!1;continue}if(re==="\\"){j=!0;continue}if(re==="`")return{body:G.slice(U+1,K),endIndex:K}}return null}function kg(G,U,j){return!j.inSingle&&G[U]==="$"&&G[U+1]==="("&&G[U+2]!=="("}function aA(G){let U=[],j=[],K=!1,re=!1,oe=!1;for(let we=0;we<G.length;we++){let We=G[we];if(We===void 0)break;if(!oe&&We==="--"){oe=!0;continue}if(oe){j.push(We);continue}let ft=/^--([^=]+)(?:=(.*))?$/.exec(We);if(ft!==null){let pt=ft[1]??"",mt=ft[2];if(pt===mP)re=!0;if(gP.has(pt))K=!0;if(mt!==void 0){if(pt===dg)U.push(mt);continue}if(yP.has(pt)){let gt=G[we+1];if(pt===dg&&gt!==void 0)U.push(gt);we++}continue}if(We.startsWith("-")&&We.length>1){let pt=We.slice(1),mt="",gt="";for(let ht=0;ht<pt.length;ht++){let bt=pt[ht]??"";if(pP.has(bt))K=!0;if(hP.has(bt)){mt=bt,gt=pt.slice(ht+1);break}}if(mt==="")continue;if(gt.length>0){if(mt===ug)U.push(gt);continue}let yt=G[we+1];if(mt===ug&&yt!==void 0)U.push(yt);we++;continue}j.push(We)}let Se=!K&&!re?j.slice(1):j;return[...U,...Se]}function rr(G){let U=G.findIndex((j)=>!Og(j)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(j));return U===-1?[]:G.slice(U)}function Og(G){return G==="env"||G==="command"||G==="builtin"||G==="sudo"}var lA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),cA=".env.",uA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),dA=[".env.example.",".env.sample."];function fA(G){let U;try{U=new URL(G.trim())}catch{return!1}return U.protocol!=="file:"&&U.host!==""}function mA(G){return G.length>0&&!/\s/.test(G)}function Js(G,U,j,K){let re=Mg(G,U,j,K);return re!==""&&j.paths.entryKind(re)!=="missing"}function Mg(G,U,j,K){try{return Ci(G,U,j,K)}catch(re){if(re instanceof s)throw re;return""}}var pA=/[?&][^?&=/]+=/,gA=new Set(["node_modules","__pycache__"]),hA=[["vendor","bundle"],["vendor","cache"]];function yA(G,U,j,K,re){if(fA(G))return null;let oe=gn(G,U,K,re);if(!oe)return null;let de=zt(oe.split("/").pop()??""),Se=zt(oe),we=()=>mA(de)||Js(G,U,K,re);if(uA.has(de)||dA.some((mt)=>de.startsWith(mt)))return null;let We=zt(xA(G,U,K,re));for(let mt of Da){let gt=`~/${mt.suffixParts.join("/")}`;if((Cg(Se,gt)||Cg(We,gt))&&nr(mt.id,j))return mt.id}let ft=bA(oe,U,j,K,re);if(ft)return ft;if(lA.has(de))return null;for(let mt of Ma)if(de===mt.basename&&nr(mt.id,j))return mt.id;if(de.startsWith(cA)&&nr(Ni.id,j)&&we())return Ni.id;for(let mt of Na)if(de.length>mt.prefix.length&&de.startsWith(mt.prefix)){let gt=de.slice(mt.prefix.length)[0];if((gt==="-"||gt==="_")&&nr(mt.id,j)&&we())return mt.id}for(let mt of La)if(de.length>mt.prefix.length&&de.startsWith(mt.prefix)){if(de.slice(mt.prefix.length)===mt.suffix&&nr(mt.id,j))return mt.id}if(vA(Se))return null;if(!de.includes(".")&&Lo.pattern.test(de)&&nr(Lo.id,j))return Lo.id;if(pA.test(G)&&!Js(G,U,K,re))return null;let pt=EA(de,j);if(pt)return pt;return null}function bA(G,U,j,K,re){return Li.find((oe)=>{if(!nr(oe.id,j))return!1;switch(oe.id){case"secret.cli.claude-code":return Nt(G,$t(K.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",U,K,re),[".credentials.json"]);case"secret.cli.claude-code.config":{let de=zt(G).split("/");return Nt(G,$t(K.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",U,K,re),["settings.json","settings.local.json"])||bi(G,"~/.claude.json",U,K,re)||de.at(-1)==="settings.local.json"&&de.at(-2)===".claude"||de.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Nt(G,gn("~/.gemini/config",U,K,re),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let de=$t(K.env.get("CODEX_HOME"),"~/.codex",U,K,re);return Nt(G,de,["auth.json",".credentials.json"])||vo(G,de,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let de=$t(K.env.get("CODEX_HOME"),"~/.codex",U,K,re),Se=zt(G).split("/").at(-1)??"";return Nt(G,de,["config.toml"])||Se.endsWith(".config.toml")&&Nt(G,de,[Se])}case"secret.cli.gemini":return Nt(G,Xt($t(K.env.get("GEMINI_CLI_HOME"),"~",U,K,re),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let de=zt(G).split("/"),Se=K.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),we=K.env.get("ProgramData")?[Xt($t(K.env.get("ProgramData"),"",U,K,re),"gemini-cli")]:[];return Nt(G,Xt($t(K.env.get("GEMINI_CLI_HOME"),"~",U,K,re),".gemini"),["settings.json","google_accounts.json"])||de.at(-1)==="settings.json"&&de.at(-2)===".gemini"||(Se?.trim()?bi(G,Se,U,K,re):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...we].some((We)=>Nt(G,gn(We,U,K,re),["settings.json"]))}case"secret.cli.copilot-cli":{let de=$t(K.env.get("COPILOT_HOME"),"~/.copilot",U,K,re);return Nt(G,de,["config.json"])||vo(G,de,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Nt(G,$t(K.env.get("COPILOT_HOME"),"~/.copilot",U,K,re),["mcp-config.json"]);case"secret.cli.kimi-code":{let de=$t(K.env.get("KIMI_CODE_HOME"),"~/.kimi-code",U,K,re),Se=$t(K.env.get("KIMI_SHARE_DIR"),"~/.kimi",U,K,re);return Nt(G,de,["server.token"])||vo(G,de,["credentials"])||vo(G,Se,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let de=["config.toml","mcp.json"],Se=zt(G).split("/");return Se.at(-1)==="mcp.json"&&Se.at(-2)===".kimi-code"||Nt(G,$t(K.env.get("KIMI_CODE_HOME"),"~/.kimi-code",U,K,re),de)||Nt(G,$t(K.env.get("KIMI_SHARE_DIR"),"~/.kimi",U,K,re),[...de,"config.json","config.json.bak"])}case"secret.cli.opencode":{let de=Xt($t(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),"opencode"),Se=zt(G).split("/").at(-1)??"",we=K.env.get("OPENCODE_DB")?.trim(),We=we&&we!==":memory:"?[we,`${we}-wal`,`${we}-shm`]:[];return Nt(G,de,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Se)&&Nt(G,de,[Se])||We.some((ft)=>bi(G,ft,U,K,re))}case"secret.cli.opencode.config":{let de=Xt($t(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"opencode"),Se=K.env.get("ProgramData")?[Xt($t(K.env.get("ProgramData"),"",U,K,re),"opencode")]:[],we=["opencode.json","opencode.jsonc"],We=K.env.get("OPENCODE_CONFIG");return we.includes(zt(G).split("/").at(-1)??"")||Nt(G,de,["config.json"])||(We?.trim()?bi(G,We,U,K,re):!1)||["/Library/Application Support/opencode","/etc/opencode",...Se].some((ft)=>Nt(G,gn(ft,U,K,re),we))}case"secret.cli.pi":return Nt(G,$t(K.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",U,K,re),["auth.json"]);case"secret.cli.pi.config":return Nt(G,$t(K.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",U,K,re),["models.json"]);case"secret.cli.amp":{let de=gn("~",U,K,re);return[Xt($t(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),"amp"),Xt(de,".local","share","amp")].some((we)=>Nt(G,we,["secrets.json"]))||vo(G,Xt(de,".amp"),["oauth"])}case"secret.cli.amp.config":{let de=["settings.json","settings.jsonc"],Se=[Xt($t(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"amp"),Xt(gn("~",U,K,re),".config","amp")],we=zt(G).split("/"),We=K.env.get("AMP_SETTINGS_FILE");return Se.some((ft)=>Nt(G,ft,de))||we.at(-2)===".amp"&&de.includes(we.at(-1)??"")||(We?.trim()?bi(G,We,U,K,re):!1)}case"secret.cli.cursor":{let de=Xt($t(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"cursor"),Se=Xt($t(K.env.get("CURSOR_DATA_DIR"),"~/.cursor",U,K,re),"projects");return Nt(G,gn("~/.cursor",U,K,re),["auth.json"])||Nt(G,de,["auth.json"])||zt(G).split("/").at(-1)==="mcp-auth.json"&&Ur(zt(G),zt(Se))}case"secret.cli.cursor.config":{let de=zt(G).split("/");return de.at(-1)==="mcp.json"&&de.at(-2)===".cursor"}case"secret.cli.grok-build":return Nt(G,$t(K.env.get("GROK_HOME"),"~/.grok",U,K,re),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let de=zt(G).split("/");return de.at(-1)==="config.toml"&&de.at(-2)===".grok"||Nt(G,$t(K.env.get("GROK_HOME"),"~/.grok",U,K,re),["config.toml","managed_config.toml","requirements.toml"])||Nt(G,gn("/etc/grok",U,K,re),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Nt(G,gn("~/.factory",U,K,re),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let de=zt(G).split("/");return de.at(-1)==="mcp.json"&&de.at(-2)===".factory"||Nt(G,gn("~/.factory",U,K,re),["settings.json","hooks.json"])}case"secret.cli.devin":return[$t(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),gn("~/.local/share",U,K,re)].some((de)=>Nt(G,Xt(de,"devin"),["credentials.toml"])||vo(G,Xt(de,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[$t(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),gn("~/.config",U,K,re)].some((de)=>Nt(G,Xt(de,"devin"),["config.json"]));default:return!1}})?.id??null}var bg=new WeakMap;function $t(G,U,j,K,re){let oe=bg.get(re)??new Map;bg.set(re,oe);let de=`${j}\x00${G??""}\x00${U}`,Se=oe.get(de);if(Se!==void 0)return Se;let we=gn(G?.trim()?G:U,j,K,re);return oe.set(de,we),we}function Nt(G,U,j){return j.some((K)=>Dg(G,Xt(U,K)))}function vo(G,U,j){return j.some((K)=>Ur(zt(G),zt(Xt(U,K))))}function bi(G,U,j,K,re){return Dg(G,gn(U,j,K,re))}function Dg(G,U){return zt(G)===zt(U)}function Xt(G,...U){return Fn([G,...U].filter(Boolean).join("/"))}function CA(G,U,j,K,re,oe){if(j.length===0)return!1;let de=zt(Ci(G,U,re,oe));return j.some((Se)=>Ur(de,zt(Ci(Se,K,re,oe))))}function SA(G,U,j,K,re,oe){if(j.length===0)return!1;let de=zt(Ci(G,U,re,oe));if(!de)return!1;let Se=re.env.get("HOME")??re.home,we=Se?Fn(Dt(bn(Se),re.paths,oe)):"",We=zt(we),ft=re.env.get("CC_SAFETY_NET_HOME"),pt=zt(ft?Fn(Dt(Qs(bn(ft)),re.paths,oe)):we&&Fn(Dt(`${we}/.cc-safety-net`,re.paths,oe)));if(pt&&Ur(de,pt))return!1;return j.some((mt)=>{let gt=Ba(mt);if(gt&&Sg.basename(de)!==zt(gt.name))return!1;let yt=zt(Ci(gt?.root??mt,K,re,oe));if(!yt)return!1;if(We&&(We===yt||We.startsWith(yt.endsWith("/")?yt:`${yt}/`)))return!1;return Ur(de,yt)&&!(gt&&de===yt)})}function vA(G){let U=G.split("/");return U.some((j)=>gA.has(j))||hA.some(([j,K])=>U.some((re,oe)=>re===j&&U[oe+1]===K))}function EA(G,U){let j=G.lastIndexOf("."),K=j>0&&j<G.length-1?G.slice(j+1):"";if(K==="")return null;for(let re of Wa)if(K===re.extension&&nr(re.id,U))return re.id;for(let re of Ga)if(re.pattern.test(K)&&nr(re.id,U))return re.id;return null}function zt(G){return G.toLowerCase()}function nr(G,U){return!U?.disabledRules?.includes(G)}function gn(G,U,j,K){let{home:re,normalized:oe}=Gc(G,j,K);if(!oe)return"";if(!re)return oe;let de=Fc(oe,re),Se=Zs(de)?de:Fn(Qs(U,de)),we=Fn(Dt(Se,j.paths,K));if(!Ur(we,re)){if(Zs(de))return we;return we===Se?oe:we}let We=we.slice(re.length);return We?`~${We}`:"~"}function Cg(G,U){return G===U||G.startsWith(`${U}/`)}function xA(G,U,j,K){let{home:re,normalized:oe}=Gc(G,j,K);if(!oe||!re)return"";let de=Fc(oe,re),Se=Sg.normalize(Zs(de)?de:Fn(Qs(U,de))),we=Fn(bn(j.env.get("HOME")??j.home)),We=(mt)=>process.platform==="win32"?mt.toLowerCase():mt,ft=[re,we].find((mt)=>mt!==""&&Ur(We(Se),We(mt)));if(ft===void 0)return"";let pt=Se.slice(ft.length);return pt?`~${pt}`:"~"}function Ci(G,U,j,K){let{home:re,normalized:oe}=Gc(G,j,K);if(!oe)return"";let de=re?Fc(oe,re):oe;return Fn(Dt(Zs(de)?de:Qs(U,de),j.paths,K))}function Gc(G,U,j){let K=U.env.get("HOME")??U.home,re=K?Fn(Dt(bn(K),U.paths,j)):"",oe=Fn(bn(RA(Xn(G,U))));return{home:re,normalized:oe}}function RA(G){if(!G.trim().toLowerCase().startsWith("file:"))return G;try{return Jw(G)}catch{return G}}function Fc(G,U){if(G==="~")return U;if(G.startsWith("~/"))return Xt(U,G.slice(2));return G}function _A(G){if(process.platform==="win32")return!0;return Xw.parse(G).root.length>1}function Fn(G){let U=G.trim(),j=(U.includes("\\")&&_A(U)?U.replace(/\\/g,"/"):U).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(j==="/")return j;return j.replace(/\/+$/g,"")}function Ur(G,U){return G===U||G.startsWith(U.endsWith("/")?U:`${U}/`)}function zn(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(G,U,j){super(`CC Safety Net ${G} dependency failed`,{cause:j});this.stage=G;this.evaluation=U}}var wA={findPolicyMutation:ag,findGitMetadataMutation:Nf,resolveGitMetadata:AA,loadPolicySnapshot:E,findSensitiveTarget:_g,analyzeCommand:eg,getModes:T},PA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function q(G,U){let j={...wA,...U.dependencies},K=kA(G),re=Si(G)?G.command:K,oe=br("policy-protection",re,()=>kf(G)),de=fn(oe,"input-candidate"),Se=fn(oe,"declared-command");if(Si(G)&&G.command?.trim()&&Se?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Bn,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:G.command,segment:G.command}}};if(de?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:tm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let we=_n(),We=br("policy-protection",re,()=>j.resolveGitMetadata([G.context.executionCwd,G.context.configCwd],U.environment)),ft=br("policy-protection",re,()=>j.findPolicyMutation(oe,U.environment,we));if(ft){let St=re??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:He,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:St,segment:ft.target}}}}let pt=br("policy-protection",re,()=>rg(oe,U.environment,we));if(pt){let St=re??pt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ge,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:St,segment:pt.target}}}}let mt=br("policy-protection",re,()=>j.findGitMetadataMutation(oe,We,U.environment,we));if(mt){let St=re??mt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:k,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:St,segment:mt.target}}}}let gt=br("config-load",re,()=>j.loadPolicySnapshot(U.environment,{...U.policyOptions,cwd:G.context.configCwd})),yt=gt.policy,ht=j.getModes(yt,U.environment.env),bt={level:ht.effectiveLevel,...TA(gt)},Ct=yt.secretProtection.enabled===!1?null:br("secret-protection",re,()=>j.findSensitiveTarget(oe,yt.secretProtection,U.environment,we,{strict:Si(G)||de?.program.dialect==="powershell"?ht.strict:void 0}));if(Ct){let St=re??Ct.target;return{stage:"secret-protection",...bt,decision:{kind:"deny",reason:vg,intent:"hard_stop",ruleId:Ct.ruleId,evidence:{command:St,segment:Ct.target}}}}if(!Si(G))return{stage:"non-command",...bt,decision:{kind:"allow"}};if(!G.command||G.command.trim()==="")return{...zc("command-validation",re),...bt};let vt=br("command-analysis",re,()=>tg(()=>j.analyzeCommand(G.command,{cwd:G.context.executionCwd,shell:G.route.shell,policySnapshot:gt,environment:U.environment,protectedGitMetadata:We,effectiveCapabilities:ht.capabilities,strict:ht.strict,paranoidRm:ht.paranoidRm,paranoidInterpreters:ht.paranoidInterpreters,worktreeMode:ht.worktreeMode,budget:we,...U.trace?{trace:U.trace}:{}},IA(oe),oe.store),G.command,U.trace));if(vt.decision){let St=!ht.strict&&(vt.decision.ruleId==="raw-text.dangerous-command"||vt.decision.reason===si&&!PA.test(vt.decision.evidence?.segment??"")&&An(G.command)===null);return{stage:"command-analysis",...bt,..."errorCode"in vt?{errorCode:vt.errorCode}:{},decision:St?{...vt.decision,unverifiedByStandardMode:!0}:vt.decision}}return{stage:"command-analysis",...bt,decision:{kind:"allow"}}}function AA(G,U){let j=[...new Set(G.filter((K)=>typeof K==="string"&&K!==""))].flatMap((K)=>U.gitMetadata(K)??[]);if(j.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(j.flatMap((K)=>K.entries))]),markerFiles:Object.freeze([...new Set(j.flatMap((K)=>K.markerFiles))]),directories:Object.freeze([...new Set(j.flatMap((K)=>K.directories))]),hooksDirectories:Object.freeze([...new Set(j.flatMap((K)=>K.hooksDirectories))])})}function TA(G){if(G.state==="ready")return{};return{configFallback:{reason:G.reason}}}function IA(G){return fn(G,"declared-command")?.program}function kA(G){try{return ie(G.input)}catch(U){let j=Si(G)?G.command:void 0;throw new p("policy-protection",zc("policy-protection",U instanceof f?void 0:j,U),U)}}function br(G,U,j){try{return j()}catch(K){throw new p(G,zc(G,K instanceof f?void 0:U,K),K)}}function zc(G,U,j){let K=j instanceof s||j instanceof b;return{stage:G,decision:{kind:"deny",reason:K?ra:_o,ruleId:K?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...U?{evidence:{command:U,segment:U}}:{}}}}function Si(G){return G.route.kind==="command"}
-export{a,s,J,Pe,Be,R,nt,ze,Ce,O,D,Y,rt,c,n,Ve,Ee,T,x,pe,ot,f,P,ie,fe,it,qe,Ke,u,Ie,o,v,i,se,r,g,me,H,st,at,d,ge,he,ct,N,Z,ae,S,lt,_,h,ke,W,l,L,X,Je,Ye,F,w,I,ye,be,Ae,ut,m,e,Oe,Re,Ze,Xe,ce,Te,le,De,Q,B,Ne,xe,z,Qe,V,ee,te,ue,et,tt,C,M,Le,Fe,Me,$e,E,je,_e,Ue,y,t,ne,ve,b,k,A,dt,Ge,He,p,q};