cc-safety-net 2.6.11 → 2.6.13

package/dist/chunks/index-babcfevy.js

@@ -1,50 +0,0 @@
-var ga="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Kn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",No="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var pa={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Do={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...pa},processedCandidateBytes:{cap:4194304,...pa},pathEnvironmentExpansion:{cap:64,...pa},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Do},trackedHeredocFiles:{cap:64,...Do},controlFlowStates:{cap:64,...Do},wrapperPeelIterations:{cap:20,...Do},derivedCommandShape:Do});class s extends Error{kind;name="AnalysisLimit";constructor(G){super(a[G].reason);this.kind=G}}function On(){let G=new Map;return{counters:G,resolvedPaths:new Map,charge(U,j=1){let K=(G.get(U)??0)+j;if(G.set(U,K),K>a[U].cap)throw new s(U)}}}var lh=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function J(G){return Ne(G.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ne(G){return lh.reduce((U,j)=>U.replace(j,"<redacted>"),G.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function tt(G){return od(G).reduceRight((U,j)=>`${U.slice(0,j.valueStart)}<redacted>${U.slice(j.valueEnd)}`,G)}function T(G){return Ne(tt(G))}function ht(G){return od(G).map((U)=>G.slice(U.valueStart,U.valueEnd))}function nt(G){return/[A-Za-z_][A-Za-z0-9_]*=/.test(G)}function od(G){return[...G.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((U)=>{let j=G[U.index-1];if(U.index>0&&j&&!/[\s"'([{]/.test(j))return[];let K=U.index+U[0].length;if(K>=G.length)return[];return[{valueStart:K,valueEnd:ch(G,K)}]})}function ch(G,U){if(G.startsWith("$(",U))return dh(G,U);let j=G[U];if(j==='"'||j==="'"){for(let re=U+1;re<G.length;re++){if(j==='"'&&G[re]==="\\"){re++;continue}if(G[re]===j)return re+1}return G.length}let K=U;while(K<G.length&&!/\s/.test(G[K]??""))K++;return K}function dh(G,U){let j=0,K;for(let re=U;re<G.length;re++){let oe=G[re];if(K){if(K==='"'&&oe==="\\"){re++;continue}if(oe===K)K=void 0;continue}if(oe==='"'||oe==="'"){K=oe;continue}if(oe==="$"&&G[re+1]==="("){j++,re++;continue}if(oe!==")")continue;if(j--,j===0)return re+1}return G.length}var uh={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function mh(G){let U=G.maxLen??200,j=G.redact??((re)=>re),K=(re)=>re.length>U?`${re.slice(0,U)}...`:re;return[G.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${j(G.reason)}`,G.ruleId?`Rule: ${G.ruleId}`:void 0,G.toolName?`Tool: ${G.toolName}`:void 0,G.command?`Command: ${K(j(G.command))}`:void 0,G.segment&&G.segment!==G.command?`Segment: ${K(j(G.segment))}`:void 0,G.cwd?`Working directory: ${K(j(G.cwd))}`:void 0,G.configWarning?`Config warning: ${j(G.configWarning)}`:void 0,G.askUser?"Approve only if you expected this command.":uh[G.intent??"manual_only"]].filter((re)=>re!==void 0).join(`
-
-`)}function Re(G,U){if(G.decision.kind!=="deny")return;let j=U.includeEvidence?G.decision.evidence:void 0;return{reason:G.decision.reason,ruleId:G.decision.ruleId,intent:G.decision.intent,command:j?.command,segment:j?.segment,toolName:U.toolName,...G.configFallback?{configWarning:G.configFallback.reason}:{},...G.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function N(G={}){return{reason:No,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:G.command,segment:G.segment??G.command,toolName:G.toolName}}var fh={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function _(G,U={}){return{...fh[G.directory][G.problem],command:U.command,toolName:U.toolName,cwd:G.cwd}}function Y(G){return mh({...G,redact:J})}function yt(G){return J(G instanceof Error?G.message:String(G))}import{lstatSync as Yh,realpathSync as Zh,statSync as Xh}from"node:fs";import{homedir as Jh,tmpdir as Qh}from"node:os";import{statSync as Vh}from"node:fs";import{join as Kh}from"node:path";import{basename as ad,dirname as ph,isAbsolute as gh,join as hh,normalize as yh,resolve as id}from"node:path";var bh=256,ki=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function fn(G,U=process.platform){if(U!=="win32")return G;return G.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function er(G,U=process.platform){if(U!=="win32")return!1;return(G[0]==="/"||G[0]==="\\")&&(G[1]==="/"||G[1]==="\\")}function Ca(G,U){return ha(G,0,U)}function ha(G,U,j){let K="",re=0,oe=0;while(re<G.length){if(G[re]!=="$"){K+=G[re],re++;continue}if(G[re+1]==="{"){let Ce=ya(G,re+2),Ee=Ch(G,re,U);if(Ee===null){if(ki.has(Ce))throw new s("pathEnvironmentExpansion");if(oe++,oe>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");K+="${",re+=2;continue}let ke=G.slice(re,Ee+1);K+=Sh(ke,U,j),re=Ee+1;continue}let de=ya(G,re+1);if(!de){K+="$",re++;continue}K+=ba(de,j)??`$${de}`,re+=de.length+1}return K}function Ch(G,U,j){let K=1;for(let re=U+2;re<G.length;re++){if(G[re]==="\\"){re++;continue}if(G[re]==="$"&&G[re+1]==="{"){if(K++,j+K>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");re++;continue}if(G[re]!=="}")continue;if(K--,K===0)return re}return null}function Sh(G,U,j){let K=G.slice(2,-1),re=ya(K,0);if(!re)return G;let oe=K.slice(re.length);if(!oe)return ba(re,j)??G;let de=[":-",":+",":=",":?","-","+","=","?"].find((ke)=>oe.startsWith(ke));if(!de){if(ki.has(re))throw new s("pathEnvironmentExpansion");return G}if(!ki.has(re))return G;if(de.endsWith("="))throw new s("pathEnvironmentExpansion");let Ce=ba(re,j),Ee=de.startsWith(":")?Ce!==null&&Ce!=="":Ce!==null;if(de.endsWith("?")&&!Ee)throw new s("pathEnvironmentExpansion");if(de.endsWith("-")||de.endsWith("?"))return Ee?Ce??"":ha(oe.slice(de.length),U+1,j);return Ee?ha(oe.slice(de.length),U+1,j):""}function ya(G,U){if(!/[A-Za-z_]/.test(G[U]??""))return"";let j=U+1;while(/[A-Za-z0-9_]/.test(G[j]??""))j++;return G.slice(U,j)}function ba(G,U){if(!ki.has(G))return null;if(G==="HOME")return U.env.get("HOME")??U.home;return U.env.get(G)??null}function $t(G,U,j){if(!G)return G;let K=j.resolvedPaths.get(G);if(K!==void 0)return K;let re=[],oe=G;while(!0){ld(j,oe);let de=U.realpath(oe);if(de!==null)return sd(j,G,de,re);let Ce=ph(oe);if(Ce===oe||re.length>=bh)return sd(j,G,oe,re);re.push(ad(oe)),oe=Ce}}function sd(G,U,j,K){let re=K.length===0?j:hh(j,...K.reverse());return G.resolvedPaths.set(U,re),re}function vh(G,U,j){let K=j.resolvedPaths.get(G);if(K!==void 0)return K;ld(j,G);let re=U.realpath(G);if(re!==null)j.resolvedPaths.set(G,re);return re}function ld(G,U){G.charge("realpathAttempts"),G.charge("processedCandidateBytes",Buffer.byteLength(U))}function pn(G,U,j,K){let re=dd(G,U,j);if(!re)return"";return $t(re,j.paths,K).replace(/\\/g,"/")}function cd(G,U,j,K,re){let oe=dd(G,U,j);if(!oe)return null;if(re(ad(oe)))return $t(oe,j.paths,K).replace(/\\/g,"/");let de=vh(oe,j.paths,K);return de===null?null:de.replace(/\\/g,"/")}function dd(G,U,j){let K=j.home,re=Ca(G.trim(),j).replace(/\\/g,"/");if(!re)return"";let oe=re==="~"?K:re.startsWith("~/")?id(K,re.slice(2)):re,de=fn(oe);return yh(gh(de)?de:id(U,de))}import{spawnSync as Eh}from"node:child_process";import{existsSync as Wo,lstatSync as Rh,readFileSync as Go,realpathSync as Qr,statSync as Lo}from"node:fs";import{dirname as Sa,isAbsolute as va,join as eo,resolve as Oi}from"node:path";var _h=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],xh=5000;function md(G,U=Bh(),j=xh){let K=wh(G),re=K===null?null:Ah(K);if(K===null||re===null)return null;let oe=zh(K,re,U,j);return oe===null?null:{recursiveSubmodules:oe}}function wh(G){try{let U=Qr(Oi(G));return Lo(U).isDirectory()?U:null}catch{return null}}function Ah(G){let U=Fh(G);if(!U)return null;try{let j=Rh(U);if(j.isSymbolicLink()||!j.isFile())return null;let K=Ea(U);if(!K?.commonDir)return null;if(!Ih(K.gitDir,U))return null;return kh(K.gitDir,Sa(U))?{gitDir:K.gitDir,commonDir:K.commonDir}:null}catch{return null}}function Ea(G){try{let U=Ph(G);if(!U)return null;let j=Qr(va(U)?U:Oi(Sa(G),U));if(!Lo(j).isDirectory())return null;return{gitDir:j,commonDir:Th(j)}}catch{return null}}function Ph(G){let U=Go(G,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!U.startsWith("gitdir:"))return null;return U.slice(7).trim()||null}function Th(G){try{let U=Go(eo(G,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!U)return null;let j=Qr(va(U)?U:Oi(G,U));return Lo(j).isDirectory()?j:null}catch{return null}}function Ih(G,U){let j=Oh(G);return j===null?!1:fd(G,j,U)}function kh(G,U){let j=Mh(G);return j===null?!0:fd(G,j,U)}function Oh(G){let U=eo(G,"gitdir");if(!Wo(U))return null;let j=Go(U,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return j===""?null:j}function Mh(G){let U=eo(G,"config.worktree");return Wo(U)?Nh(U):null}function fd(G,U,j){try{return Dh(va(U)?U:Oi(G,U),j)}catch{return!1}}function Dh(G,U){try{let j=Lo(G),K=Lo(U);if(j.ino!==0&&K.ino!==0&&j.dev===K.dev&&j.ino===K.ino)return!0}catch{}return ud(Qr.native(G))===ud(Qr.native(U))}function ud(G){let U=G.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),j=U.length>1&&U.endsWith("/")?U.slice(0,-1):U;return process.platform==="win32"?j.toLowerCase():j}function Nh(G){let U=Go(G,"utf-8"),j=!1,K=null;for(let re of U.split(/\r?\n/)){let oe=re.trim();if(oe===""||oe.startsWith("#")||oe.startsWith(";"))continue;if(oe.startsWith("[")){j=/^\[core\]$/i.test(oe);continue}if(!j)continue;let de=oe.match(/^worktree\s*=\s*(.*)$/i);if(de)K=Lh(de[1]??"")}return K}function Lh(G){let U=G.trim();if(!U.startsWith('"')||!U.endsWith('"'))return U;return Gh(U.slice(1,-1))}var Wh={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Gh(G){return G.replace(/\\(.?)/gs,(U,j)=>j===""?U:Wh[j]??U)}function Fh(G){try{return Ra(Qr(G))}catch{return null}}function Ra(G){let U=G;while(!0){let j=eo(U,".git");if(Wo(j))return j;let K=Sa(U);if(K===U)return null;U=K}}function zh(G,U,j,K){if($h(U))return!0;if(j===null)return!0;let re=Eh(j,["config","--get","submodule.recurse"],{cwd:G,encoding:"utf8",env:Uh(process.env),stdio:["ignore","pipe","ignore"],timeout:K});if(re.error!==void 0||re.status!==0&&re.status!==1)return null;return re.status===0&&pd(re.stdout.trim())}function $h(G){return[eo(G.commonDir,"config"),eo(G.gitDir,"config.worktree")].filter((U)=>Wo(U)).some((U)=>Hh(U))}function Bh(){return _h.find((G)=>Wo(G))??null}function Fo(G){return G==="GIT_CONFIG_COUNT"||G==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(G)}function Uh(G){return Object.fromEntries(Object.entries(G).filter(([U])=>!Fo(U)))}function Hh(G){let U;try{U=Go(G,"utf-8")}catch{return!0}let j="",K=!1;for(let re of U.split(/\r?\n/)){let oe=re.trim();if(oe===""||oe.startsWith("#")||oe.startsWith(";"))continue;let de=oe.match(/^\[([^\]]+)\]$/);if(de){j=de[1]?.trim().toLowerCase()??"";continue}let Ce=oe.indexOf("="),Ee=(Ce===-1?oe:oe.slice(0,Ce)).trim().toLowerCase(),ke=Ce===-1?"true":oe.slice(Ce+1).trim();if(jh(j)&&Ee==="path")return!0;if(j==="submodule"&&Ee==="recurse")K=pd(ke)}return K}function jh(G){return G==="include"||G.startsWith("includeif ")}function pd(G){let U=G.toLowerCase();return U!=="false"&&U!=="no"&&U!=="off"&&U!=="0"}function gd(G,U){if(G==="")return null;let j=On(),K=Ra(pn(G,G,U,j)),re=K?qh(K,G,U,j):null;if(!re)return null;return Object.freeze({entries:Object.freeze([re.entry]),markerFiles:Object.freeze(re.markerFile?[re.markerFile]:[]),directories:Object.freeze(re.directories),hooksDirectories:Object.freeze(re.hooksDirectories)})}function qh(G,U,j,K){try{let re=pn(G,U,j,K),oe=Vh(G),de=oe.isFile()?re:null,Ce=oe.isFile()?Ea(G):null,Ee=(oe.isDirectory()?[re]:[Ce?.gitDir,Ce?.commonDir]).flatMap((De)=>De?[to(pn(De,U,j,K))]:[]),ke=[...new Set(oe.isDirectory()?[to(G.replace(/\\/g,"/")),...Ee]:Ee)];return{entry:to(re),markerFile:de?to(de):null,directories:ke,hooksDirectories:[...new Set(ke.flatMap((De)=>{let Xe=to(Kh(De,"hooks").replace(/\\/g,"/"));return[Xe,to(pn(Xe,U,j,K))]}))]}}catch{return null}}function to(G){return process.platform==="win32"?G.toLowerCase():G}var ey={realpath:(G)=>{try{return Zh(G)}catch{return null}},entryKind:(G)=>{try{let U=Yh(G,{throwIfNoEntry:!1});if(!U)return"missing";return U.isSymbolicLink()?"symlink":"present"}catch(U){if(U.code==="ENAMETOOLONG")return"missing";throw U}},isDirectory:(G)=>{try{return Xh(G).isDirectory()}catch{return!1}}};function c(){return ty({env:new Map(Object.entries(process.env).flatMap(([G,U])=>U===void 0?[]:[[G,U]])),home:fn(process.env.HOME||Jh()),tmpdir:Qh(),paths:ey})}function ty(G,U={}){let j=new Map,K=new Map,re={...G,gitMetadata:(oe)=>hd(j,oe,()=>gd(oe,re)),worktreeFacts:(oe)=>hd(K,oe,()=>md(oe)),...U};return re}function hd(G,U,j){let K=G.get(U);if(K!==void 0)return K;let re=j();return G.set(U,re),re}import{accessSync as _y,constants as kd,statSync as xy}from"node:fs";import{isAbsolute as Aa,relative as wy,resolve as Od,sep as Ay}from"node:path";import{types as ny}from"node:util";var ry=new Set(["applypatch","patch"]),oy=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),iy=new Set(["grep","grepsearch","rg"]),sy=new Set(["find","findbyname","glob"]),ay=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ly=new Set(["command","diff","input","patch","patchtext"]),yd=new TextEncoder,cy=new TextDecoder,dy=/\s/,uy=64;class m extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var zo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function _e(G){return G.replace(/[-_\s]/g,"").toLowerCase()}function Di(G){return ay.has(_e(G))}function x(G){let U=_e(G);if(ry.has(U))return"patch";if(iy.has(U))return"grep";if(sy.has(U))return"glob";if(oy.has(U))return"path";return"unknown"}function ie(G){if(!G||typeof G!=="object")return;Pd(G);let U=Object.getOwnPropertyDescriptor(G,"command");if(!U){if("command"in G)qn();return}if(U.get||U.set)qn();let j=U.value;return typeof j==="string"&&j!==""?j:void 0}function Ed(G,U){return Rd(G,U,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Rd(G,U,j,K,re){let oe=Ad(G,K,re);if(typeof G==="string")return j?[G]:[];if(!oe)return[];let de=oe.entries.flatMap(([Ce,Ee])=>Rd(Ee,U,oe.array?j:U.has(_d(Ce)),K,re+1));return K.ancestors.delete(oe.object),de}function _d(G){return G.replace(/-/g,"_").toLowerCase()}function xd(G){return wd(G,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(fy)}function wd(G,U,j,K){let re=Ad(G,j,K);if(typeof G==="string")return U?[G]:[];if(!re)return[];let oe=re.entries.flatMap(([de,Ce])=>wd(Ce,re.array?U:ly.has(_d(de)),j,K+1));return j.ancestors.delete(re.object),oe}function my(G,U,j){if(U.nodes++,G!==null&&typeof G==="object"&&j>zo.maxDepth||U.nodes>zo.maxNodes)qn();if(typeof G!=="string")return;let K=Buffer.byteLength(G);if(U.stringBytes+=K,K>zo.maxStringBytes||U.stringBytes>zo.maxAggregateStringBytes)qn()}function Ad(G,U,j){if(my(G,U,j),!G||typeof G!=="object")return null;let K=Pd(G);if(U.ancestors.has(G))qn();let re=Reflect.ownKeys(G);if(U.keys+=re.length,U.keys>zo.maxKeys)qn();let oe=re.flatMap((de)=>{let Ce=Object.getOwnPropertyDescriptor(G,de);if(!Ce||Ce.get||Ce.set)qn();return typeof de==="string"&&Ce.enumerable?[[de,Ce.value]]:[]});return U.ancestors.add(G),{object:G,array:K,entries:oe}}function Pd(G){if(ny.isProxy(G))qn();let U=Array.isArray(G),j=Object.getPrototypeOf(G);if(U&&j!==Array.prototype||!U&&j!==Object.prototype&&j!==null)qn();return U}function qn(){throw new m}function fy(G){let U=[],j=G.split(/\r?\n/),K=!1,re=!1,oe=null,de=null,Ce=()=>{re=!1,oe=null,de=null};for(let Ee=0;Ee<j.length;Ee++){let ke=j[Ee]??"";if(ke==="*** Begin Patch"){K=!0,Ce();continue}if(ke==="*** End Patch"){K=!1,Ce();continue}if(ke.startsWith("@@")){let De=py(ke);if(re=!0,oe=De?.oldLines??null,de=De?.newLines??null,oe===0&&de===0)Ce();continue}if(re&&oe!==null&&de!==null){let De=ke.startsWith(" ")||ke.startsWith("-")?1:0,Xe=ke.startsWith(" ")||ke.startsWith("+")?1:0;if(oe=Math.max(0,oe-De),de=Math.max(0,de-Xe),oe===0&&de===0)Ce();continue}if(ke.startsWith("*** ")){Ce(),U.push(..._a(ke));continue}if(re)continue;if(ke.startsWith("diff --git ")){U.push(..._a(ke));continue}if(ke.startsWith("--- ")){let De=j[Ee+1]??"";if(!De.startsWith("+++ "))continue;U.push(...wa(Mi(ke.slice(4),!0),Mi(De.slice(4),!0))),Ee++;continue}if(!K)U.push(..._a(ke))}return U}function py(G){let U=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(G);if(!U)return null;return{oldLines:Number(U[1]??1),newLines:Number(U[2]??1)}}function _a(G){let U=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(G);if(U?.[1])return vd(U[1]);let j=/^\*\*\* Move to: (.+)$/.exec(G);if(j?.[1])return vd(j[1]);if(G.startsWith("diff --git "))return gy(G.slice(11));let K=/^--- (.+)$/.exec(G);if(K?.[1])return Sd(K[1]);let re=/^\+\+\+ (.+)$/.exec(G);if(re?.[1])return Sd(re[1]);let oe=/^(?:rename|copy) (?:from|to) (.+)$/.exec(G);if(oe?.[1])return Ey(oe[1]);return[]}function gy(G){let U=hy(G);if(U.length===2&&U[0]&&U[1])return wa(U[0],U[1]);let j=yy(G);return j?wa(G.slice(j.oldStart,j.oldEnd),G.slice(j.newStart,j.newEnd)):[]}function hy(G){let U=[],j=0;while(j<G.length&&U.length<2){while(wr(G[j]))j++;if(j>=G.length)break;let K=G[j]==='"'||G[j]==="'"?G[j]:void 0;if(!K){let oe=j;while(j<G.length&&!wr(G[j]))j++;U.push(G.slice(oe,j));continue}let re=Td(G,j,K);if(!re)return[];U.push(re.value),j=re.end}while(wr(G[j]))j++;return j===G.length?U:[]}function yy(G){let U=0;while(U<G.length&&wr(G[U]))U++;let j=G.length;while(j>U&&wr(G[j-1]))j--;let K=0,re=U;while(re<j){if(!wr(G[re])){re++;continue}let oe=re;while(re<j&&wr(G[re]))re++;if(oe===U||re===j)continue;if(K++,K>uy)qn();if(by(G,U,oe,re,j))return{oldStart:U,oldEnd:oe,newStart:re,newEnd:j}}return null}function by(G,U,j,K,re){if(xa(G,U,j,K,re))return!0;let oe=bd(G,"/",U,j),de=bd(G,"/",K,re);if(oe<=U||de<=K)return!1;if(xa(G,U,oe,K,de))return!1;return xa(G,oe+1,j,de+1,re)}function xa(G,U,j,K,re){if(j-U!==re-K)return!1;for(let oe=0;oe<j-U;oe++)if(G[U+oe]!==G[K+oe])return!1;return!0}function bd(G,U,j,K){for(let re=j;re<K;re++)if(G[re]===U)return re;return-1}function wr(G){return G!==void 0&&dy.test(G)}function Td(G,U,j){let K=[],re=U+1;while(re<G.length){let oe=String.fromCodePoint(G.codePointAt(re)??0);if(oe===j)return{value:cy.decode(Uint8Array.from(K)),end:re+1};if(oe!=="\\"||j==="'"){K.push(...yd.encode(oe)),re+=oe.length;continue}let de=G.slice(re+1),Ce=/^[0-7]{1,3}/.exec(de)?.[0];if(Ce){K.push(Number.parseInt(Ce,8)),re+=Ce.length+1;continue}K.push(...yd.encode(Cy(de[0]??""))),re+=2}return null}function Cy(G){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[G]??G}function Sy(G){return $o(Ry(G))}function wa(G,U){if(G==="/dev/null")return Cd(U);if(U==="/dev/null")return Cd(G);if(G.startsWith("a/")&&U.startsWith("b/"))return[G.slice(2),U.slice(2)].flatMap($o);let j=vy(G,U)??(G===U?Id(G):null);return[G,U,...j?[j]:[]].flatMap($o)}function Cd(G){let U=Id(G);return[G,...U?[U]:[]].flatMap($o)}function Id(G){let U=G.indexOf("/");return U>0&&U<G.length-1?G.slice(U+1):null}function vy(G,U){let j=G.indexOf("/"),K=U.indexOf("/");if(j<1||K<1)return null;if(G.slice(0,j)===U.slice(0,K))return null;let re=G.slice(j+1);return re===U.slice(K+1)?re:null}function Sd(G){return Sy(Mi(G,!0))}function Ey(G){return $o(Mi(G,!1))}function Mi(G,U){let j=G.trim(),K=j[0]==='"'||j[0]==="'"?j[0]:void 0;if(K){let re=Td(j,0,K);if(re&&(U||j.slice(re.end).trim()===""))return re.value}return U?j.split("\t",1)[0]?.trim()??"":j}function Ry(G){return G.startsWith("a/")||G.startsWith("b/")?G.slice(2):G}function $o(G){return G===""||G==="/dev/null"?[]:[G]}function vd(G){let U=G.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return U===""||U==="/dev/null"?[]:[U]}function fe(G){try{if(!xy(G).isDirectory())return!1;return _y(G,kd.R_OK|kd.X_OK),!0}catch{return!1}}function xt(G,U,j){if(er(G))return;let K=U.flatMap((oe)=>Ni(oe,j));if(!K[0])return;let re=Ni(Aa(G)?G:Od(K[0],G),j)[0];if(!re)return;return K.some((oe)=>Py(re,oe))?re:void 0}function Md(G,U,j){if(er(G))return;return Ni(Aa(G)?G:Od(U,G),j)[0]}function ot(G,U){return G.flatMap((j)=>Ni(j,U))[0]}function Ni(G,U){let j=U.realpath(G);if(j===null)return[];return U.isDirectory(j)?[j]:[]}function Py(G,U){let j=wy(U,G);return j===""||j!==".."&&!j.startsWith(`..${Ay}`)&&!Aa(j)}var Ty=8388608;async function it(G){let U=[],j=0;for await(let K of G){let re=typeof K==="string"?Buffer.from(K,"utf-8"):Buffer.from(K.buffer,K.byteOffset,K.byteLength);if(j+=re.byteLength,j>Ty)throw Iy(G),Error("hook input byte limit exceeded");U.push(re)}return Buffer.concat(U,j).toString("utf-8")}function Iy(G){let U=G.destroy??G.cancel;if(!U)return;try{Promise.resolve(U.call(G)).catch(()=>{})}catch{}}function l(G,U,j,K,re){if(j.kind!=="command")return{toolName:G,input:U,route:j,context:K};return{toolName:G,input:U,route:j,context:K,command:re}}var no=["fail_closed","paranoid_rm","paranoid_interpreters"],Li={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var n={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},Wi=["standard","strict","paranoid"];function Dd(G,U){if(!U)return G;return Wi.indexOf(U)>Wi.indexOf(G)?U:G}function Nd(G){let U=pe(n.level,G);return Wi.find((j)=>j===U)}function Ld(G,U){return Dd(G,Nd(U))}function ky(G){let U=pe(n.level,G);if(!U)return;let j=Nd(G);if(j)return j;console.error(`CC Safety Net: ignored invalid ${n.level.name}=${JSON.stringify(U.slice(0,40))}. Use ${Wi.join(", ")}.`);return}function rt(G){if(G===void 0||G==="all")return"all";if(G==="blocked")return"blocked";return"invalid"}function Te(G){return rt(pe(n.auditScope,G))==="all"}function Pa(G){if(G.failClosed&&G.paranoidRm&&G.paranoidInterpreters)return"paranoid";if(G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"strict";if(!G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"standard";return"custom"}function P(G={},U){let j=G.safety?.level??"standard",K=ky(U),re=Dd(j,K),oe=Li[re],de={failClosed:oe.fail_closed,paranoidRm:oe.paranoid_rm,paranoidInterpreters:oe.paranoid_interpreters},Ce={failClosed:re===j?"preset":"environment",paranoidRm:re===j?"preset":"environment",paranoidInterpreters:re===j?"preset":"environment"},Ee={failClosed:[`policy safety.level=${j}`],paranoidRm:[`policy safety.level=${j}`],paranoidInterpreters:[`policy safety.level=${j}`]};if(re!==j)Ee.failClosed.push(`env ${n.level.name}=${K}`),Ee.paranoidRm.push(`env ${n.level.name}=${K}`),Ee.paranoidInterpreters.push(`env ${n.level.name}=${K}`);if(G.safety?.overrides?.failClosed!==void 0)de.failClosed=G.safety.overrides.failClosed,Ce.failClosed="capability_override",Ee.failClosed.push("policy safety.overrides.fail_closed");if(G.safety?.overrides?.paranoidRm!==void 0)de.paranoidRm=G.safety.overrides.paranoidRm,Ce.paranoidRm="capability_override",Ee.paranoidRm.push("policy safety.overrides.paranoid_rm");if(G.safety?.overrides?.paranoidInterpreters!==void 0)de.paranoidInterpreters=G.safety.overrides.paranoidInterpreters,Ce.paranoidInterpreters="capability_override",Ee.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(S(n.strict,U))de.failClosed=!0,Ce.failClosed="environment",Ee.failClosed.push(`env ${n.strict.name}`);if(S(n.paranoid,U))de.paranoidRm=!0,de.paranoidInterpreters=!0,Ce.paranoidRm="environment",Ce.paranoidInterpreters="environment",Ee.paranoidRm.push(`env ${n.paranoid.name}`),Ee.paranoidInterpreters.push(`env ${n.paranoid.name}`);if(S(n.paranoidRm,U))de.paranoidRm=!0,Ce.paranoidRm="environment",Ee.paranoidRm.push(`env ${n.paranoidRm.name}`);if(S(n.paranoidInterpreters,U))de.paranoidInterpreters=!0,Ce.paranoidInterpreters="environment",Ee.paranoidInterpreters.push(`env ${n.paranoidInterpreters.name}`);let ke=!!G.worktreeMode||S(n.worktree,U);return{strict:de.failClosed,paranoidRm:de.paranoidRm,paranoidInterpreters:de.paranoidInterpreters,worktreeMode:ke,effectiveLevel:Pa(de),capabilities:{fail_closed:{enabled:de.failClosed,source:Ce.failClosed,sources:Ee.failClosed},paranoid_rm:{enabled:de.paranoidRm,source:Ce.paranoidRm,sources:Ee.paranoidRm},paranoid_interpreters:{enabled:de.paranoidInterpreters,source:Ce.paranoidInterpreters,sources:Ee.paranoidInterpreters}}}}function S(G,U){let j=typeof G==="string"?Bo(G,U):pe(G,U);return j==="1"||j?.toLowerCase()==="true"}function Bo(G,U){return U.get(G)}function pe(G,U){let j=Bo(G.name,U);if(j!==void 0)return j;if(G.legacyName)return Bo(G.legacyName,U);return}function bt(G,U){return Bo(G.name,U)!==void 0||!!G.legacyName&&Bo(G.legacyName,U)!==void 0}import{dirname as kr}from"node:path";import{closeSync as Oy,constants as Uo,fstatSync as Ta,fsyncSync as My,lstatSync as Mn,mkdirSync as Wd,openSync as Gd,readdirSync as ka,readFileSync as Dy,realpathSync as ro,renameSync as Ny,rmdirSync as Fd,statSync as Ia,unlinkSync as Oa,writeFileSync as Ly}from"node:fs";import{isAbsolute as zd,join as Ar,normalize as Wy,parse as Gi,relative as Ma,resolve as Da,sep as Fi}from"node:path";function Le(){let G=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${G()}${G()}`}var Gy=Symbol("PolicyFilesystemScope"),Fy=Symbol("PolicyFilesystemTarget"),$d=Uo.O_NOFOLLOW??0;class o extends Error{name="PolicyFilesystemError";constructor(G){super(`Unable to access ${G} filesystem safely.`)}}function w(G,U){return{[Gy]:!0,root:Da(G),label:U}}function Ho(G,U){let j=Wy(U);if(U===""||zd(U)||j===".."||j.startsWith(`..${Fi}`))throw new o(G.label);return{[Fy]:!0,scope:G,relativePath:j,path:Ar(G.root,j)}}function i(G,U){return Ho(G,Ma(G.root,Da(U)))}function se(G,U="rules policy"){let j=Da(G),K=Gi(j).dir;return Ho(w(K,U),Ma(K,j))}function r(G){return tr(G.scope.label,()=>{if(!ln(G))return null;let U=Gd(G.path,Uo.O_RDONLY|$d);return Ud(U,()=>{let j=Ta(U);if(!j.isFile())throw new o(G.scope.label);let K=Dy(U,"utf-8"),re=Mn(G.path);if(!re.isFile()||re.isSymbolicLink()||j.dev!==re.dev||j.ino!==re.ino)throw new o(G.scope.label);return ln(G),K})})}function g(G,U,j=384,K){let re=`${G.path}.${Le()}.tmp`;tr(G.scope.label,()=>{$y(G),ln(G);let oe=Gd(re,Uo.O_CREAT|Uo.O_EXCL|Uo.O_WRONLY|$d,j),de=Ud(oe,()=>{let Ce=Ta(oe);if(!Ce.isFile())throw new o(G.scope.label);Ly(oe,U,"utf-8"),My(oe);let Ee=Ta(oe);if(!Ee.isFile()||Ee.dev!==Ce.dev||Ee.ino!==Ce.ino)throw new o(G.scope.label);return Ee});ln(G),Uy(G,re,de.dev,de.ino),Ny(re,G.path),K?.(G.path),ln(G)},()=>Hy(re))}function Bd(G,U){if(G.path===U.path)return!0;return tr(G.scope.label,()=>{if(!ln(G)||!ln(U))return!1;let j=(K)=>Ar(ro(Gi(K).dir),Gi(K).base);return j(G.path)===j(U.path)})}function me(G){let U=tr(G.scope.label,()=>{if(!ln(G,"directory"))return null;let j=ka(G.path);return ln(G,"directory"),j});if(!U)return null;return tr(G.scope.label,()=>{let j=U.map((K)=>{let re=Ho(G.scope,Ar(G.relativePath,K)),oe=Mn(re.path);if(oe.isSymbolicLink()||!oe.isFile()&&!oe.isDirectory())throw new o(G.scope.label);return zi(Na(G.scope),ro(re.path),G.scope.label),{name:K,kind:oe.isDirectory()?"directory":"file"}});return ln(G,"directory"),j})}function H(G){tr(G.scope.label,()=>{if(!ln(G))return;Oa(G.path),ln(G)})}function vt(G){tr(G.scope.label,()=>{if(!zy(G))return;jd(G),ln(G,"directory")})}function St(G){tr(G.scope.label,()=>{if(!ln(G,"directory"))return;Fd(G.path),ln(G,"directory")})}function zy(G){return tr(G.scope.label,()=>{if(!ln(G,"directory"))return!1;return Hd(G),!0})}function tr(G,U,j){try{return U()}catch(K){if(j?.(),K instanceof o)throw K;throw new o(G)}}function Ud(G,U){try{return U()}finally{Oy(G)}}function ln(G,U="file"){let j=Vd(G.scope);if(!j)return!1;let K=G.relativePath.split(Fi);for(let re of K.keys()){let oe=Ar(G.scope.root,...K.slice(0,re+1)),de=Mn(oe,{throwIfNoEntry:!1});if(!de)return!1;if(de.isSymbolicLink())throw new o(G.scope.label);if(re<K.length-1&&!de.isDirectory())throw new o(G.scope.label);if(re===K.length-1&&(U==="file"?!de.isFile():!de.isDirectory()))throw new o(G.scope.label);zi(j,ro(oe),G.scope.label)}return!0}function Hd(G){for(let U of ka(G.path)){let j=Ho(G.scope,Ar(G.relativePath,U)),K=Mn(j.path);if(K.isSymbolicLink()||!K.isDirectory()&&!K.isFile())throw new o(G.scope.label);if(K.isDirectory())Hd(j)}ln(G,"directory")}function jd(G){for(let U of ka(G.path)){let j=Ho(G.scope,Ar(G.relativePath,U)),K=Mn(j.path);if(K.isSymbolicLink())throw new o(G.scope.label);if(K.isDirectory()){jd(j);continue}if(!K.isFile())throw new o(G.scope.label);Oa(j.path)}Fd(G.path)}function $y(G){By(G.scope);let U=Na(G.scope),j=G.relativePath.split(Fi).slice(0,-1);for(let K of j.keys()){let re=Ar(G.scope.root,...j.slice(0,K+1));if(!Mn(re,{throwIfNoEntry:!1}))Wd(re,{mode:448});let oe=Mn(re);if(!oe.isDirectory()||oe.isSymbolicLink())throw new o(G.scope.label);zi(U,ro(re),G.scope.label)}}function By(G){if(Mn(G.root,{throwIfNoEntry:!1})){if(!Ia(G.root).isDirectory())throw new o(G.label);return}let U=[],j=G.root;while(!Mn(j,{throwIfNoEntry:!1})){U.unshift(j);let K=Gi(j).dir;if(K===j)throw new o(G.label);j=K}if(!Ia(j).isDirectory())throw new o(G.label);for(let K of U){Wd(K,{mode:448});let re=Mn(K);if(!re.isDirectory()||re.isSymbolicLink())throw new o(G.label)}}function Vd(G){if(!Mn(G.root,{throwIfNoEntry:!1}))return null;if(!Ia(G.root).isDirectory())throw new o(G.label);return ro(G.root)}function Na(G){let U=Vd(G);if(!U)throw new o(G.label);return U}function Uy(G,U,j,K){let re=Mn(U);if(!re.isFile()||re.isSymbolicLink()||re.dev!==j||re.ino!==K)throw new o(G.scope.label);zi(Na(G.scope),ro(U),G.scope.label)}function zi(G,U,j){let K=Ma(G,U);if(K===".."||K.startsWith(`..${Fi}`)||zd(K))throw new o(j)}function Hy(G){try{Oa(G)}catch{}}import{dirname as Pr,isAbsolute as Yy,join as Tr,relative as Zy,resolve as ur,sep as Xy}from"node:path";var p=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ge="rulebook.json",he=".cc-safety-net/rules";var Kd=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,jy=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,qd=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Vy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Ky="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),wt=new RegExp(`^${Vy}/(${p.source.slice(1,-1)})/${Ky}$`);function qy(G){return`.cc-safety-net/rules/${G}/rulebook.json`}function Yd(G){if(C(G))try{return L(G),null}catch(U){return U instanceof Error?U.message:String(U)}return p.test(G)?null:`Local rulebook sources must be bare names matching ${p}: ${G}`}function L(G){if(G.startsWith("github:"))throw Error(`Invalid rulebook source: ${G}`);let U=G.match(Kd);if(!U?.[1]||!U[2]||!U[3])throw Error(`Invalid GitHub rulebook source: ${G}`);let j=U[3].lastIndexOf("/");if(j<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);let K=U[3].slice(0,j),re=U[3].slice(j+1);if(!K||!qd.test(K))throw Error(`GitHub rulebook refs must use valid path segments: ${G}`);if(!re||!p.test(re))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);return{owner:U[1],repo:U[2],ref:K,path:qy(re),name:re}}function Z(G){return jy.test(G)}function ae(G){return qd.test(G)}function C(G){return Kd.test(G)}function Ct(G){if(!p.test(G))throw Error(`Local rulebook sources must be bare names matching ${p}: ${G}`)}var Zd="rule.json",$i="policy.json",Xd=".cc-safety-net",Jy="rules",Qy="CC_SAFETY_NET_HOME",Jd="`cc-safety-net rule update`";function eb(G){return ur(G,he)}function I(G){return Tr(eb(G),Zd)}function h(G){return Tr(ur(G),Xd,$i)}function Pe(G,U={}){return U.userConfigDir??(U.userConfigPath?Pr(U.userConfigPath):Tr(tb(G),Jy))}function tb(G){let U=G.env.get(Qy);return U?ur(fn(U)):Tr(G.home,Xd)}function W(G,U={}){return Tr(Pe(G,U),Zd)}function u(G,U={}){return Tr(Pr(Pe(G,U)),$i)}function A(G,U){let j=On();return $t(h(U.cwd),G.paths,j)===$t(ur(u(G,U)),G.paths,j)}function X(G,U){let j=U.userConfigPath??W(G,U),K=U.projectConfigPath??I(U.cwd),re=st(G,U),oe=at(K,U.cwd);return{userConfigPath:j,projectConfigPath:K,userScope:re,projectScope:oe,userConfigTarget:i(re,j),projectConfigTarget:i(oe,K)}}function st(G,U){let j=U.userConfigPath?Pr(Pr(ur(U.userConfigPath))):Pr(ur(U.userConfigDir??Pe(G,U)));return w(j,"user policy")}function at(G,U){let j=ur(U),K=ur(G),re=Zy(j,K);if(re!==".."&&!re.startsWith(`..${Xy}`)&&!Yy(re))return w(j,"project policy");return w(Pr(Pr(K)),"project policy")}function M(G,U){return Tr(G,U,ge)}var xn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),E=/^[a-zA-Z][a-zA-Z0-9_-]*$/,O=256,Jt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Qd=new Set(["python","python3","python2","node","ruby","perl"]),Bi=/^python(?:[23](?:\.\d+)*)?$/,Dn=new Set(["awk","gawk","nawk","mawk"]),Ui=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var eu="Rulebook exceeds CC Safety Net's safe validation limits.",tu="Additional rulebook validation errors were omitted.",Fn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function nu(G){if(La(G.allowed_commands,Fn.maxAllowedCommands)||La(G.rules,Fn.maxRules)||La(G.tests,Fn.maxTests))return!1;let{maxAggregateStringCodeUnits:U,maxTotalBlockArgs:j}=Fn,K=(re,oe=!1)=>{if(typeof re!=="string")return!0;if(re.length>Fn.maxStringCodeUnits||oe&&re.length>Fn.maxFixtureCommandCodeUnits||re.length>U)return!1;return U-=re.length,!0};if(!K(G.name)||!K(G.version)||!K(G.description)||!K(G.author)||!K(G.migrated_from))return!1;if(Array.isArray(G.allowed_commands)){for(let re of G.allowed_commands)if(!K(re))return!1}if(Array.isArray(G.rules))for(let re of G.rules){if(!re||typeof re!=="object")continue;let oe=re;if(!K(oe.name)||!K(oe.command)||!K(oe.subcommand)||!K(oe.reason)||!K(oe.intent))return!1;let de=oe.match&&typeof oe.match==="object"?oe.match:{};for(let Ce of[oe.block_args,de.command_path,de.any_args,de.exclude_args]){if(!Array.isArray(Ce))continue;if(Ce.length>Fn.maxBlockArgsPerRule||Ce.length>j)return!1;j-=Ce.length;for(let Ee of Ce)if(!K(Ee))return!1}}if(Array.isArray(G.tests))for(let re of G.tests){if(!re||typeof re!=="object")continue;let oe=re;if(!K(oe.command,!0)||!K(oe.expect)||!K(oe.rule))return!1}return!0}function La(G,U){return Array.isArray(G)&&G.length>U}var Wa=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ye=64,be="Rule config exceeds CC Safety Net's safe source limit.";function Gt(G){return Lt(G).toLowerCase()}function Lt(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}function yn(G,U){let j=new Set,K=!1;for(let re of G){if(re==="--"){K=!0;continue}if(K)continue;if(re.startsWith("-")&&!re.startsWith("--")&&re.length>1)for(let oe=1;oe<re.length;oe++){let de=re[oe];if(!de||!/[a-zA-Z]/.test(de))break;let Ce=`-${de}`;if(j.add(Ce),U?.shortOptsWithValue?.has(Ce))break}}return j}var nb={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ga=new Set(["--init-file","--rcfile"]);function Fa(G,U,j,K){let re=!1,oe=0,de=!1,Ce=!1,Ee=!1;for(let ke=1;ke<U.length;ke++){let De=U[ke];if(De===void 0)break;if(G==="ksh"&&De==="o"&&ke+1<U.length){if(K==="argv"){let Xe=U.slice(ke+1);if(U[0]==="-"&&(Xe==="c"||Xe[0]==="-"&&Xe.endsWith("c")))de=!0}break}if(G==="ksh"&&De==="o"&&ke+1===U.length&&(j?.startsWith("-")||j?.startsWith("+")))break;if(G==="zsh"&&De==="o"&&ke+1<U.length)break;if(K==="startup"&&De==="i")re=U[0]==="-";if(K==="argv"&&U[0]==="-"&&De==="c")de=!0;if(K==="argv"&&De==="n")Ee=U[0]==="-";if(K==="argv"&&De==="s")Ce=U[0]==="-";if(!nb[G]?.includes(De))continue;if(ke+1===U.length)oe++;break}return{interactive:re,followingValues:oe,commandSelected:de,stdinMode:Ce,syntaxCheck:Ee}}function wn(G){let U=Lt(G[0]??"").toLowerCase(),j=!1,K=!1,re=!1;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(de===void 0)break;if(de==="--"){let Ee=j&&G[oe+1]!==void 0?oe+1:null;return{command:Ee===null?null:G[Ee]??null,commandIndex:Ee,scriptIndex:!j&&!K&&G[oe+1]!==void 0?oe+1:null,readsStdinAsCommands:!j&&(K||G[oe+1]===void 0),syntaxCheck:re}}if(de==="-"||de[0]!=="-"&&de[0]!=="+")return{command:j?de:null,commandIndex:j?oe:null,scriptIndex:!j&&!K&&de!=="-"?oe:null,readsStdinAsCommands:!j&&(K||de==="-"),syntaxCheck:re};if(de.startsWith("--")){let Ee=de.split("=",1)[0]??de;if(U==="bash"&&Ga.has(Ee)&&!de.includes("="))oe++;continue}let Ce=Fa(U,de,G[oe+1],"argv");if(Ce.commandSelected)j=!0;if(Ce.syntaxCheck)re=!0;if(Ce.stdinMode)K=!0;oe+=Ce.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!j,syntaxCheck:re}}function jo(G,U){if(U.escaped)return U.escaped=!1,!0;if(G==="\\"&&!U.inSingle)return U.escaped=!0,!0;if(G==="'"&&!U.inDouble)return U.inSingle=!U.inSingle,!0;if(G==='"'&&!U.inSingle)return U.inDouble=!U.inDouble,!0;return!1}function Hi(G){let U={inSingle:!1,inDouble:!1,escaped:!1};for(let j of rb(G))jo(j,U);return U.inSingle||U.inDouble}function rb(G){let U="",j={inSingle:!1,inDouble:!1,escaped:!1},K=!1,re=!0;for(let oe=0;oe<G.length;oe++){let de=G[oe];if(!de)break;if(K){if(de===`
-`||de==="\r")U+=de,K=!1,j.escaped=!1;continue}if(de==="#"&&!j.inSingle&&!j.inDouble&&re){K=!0;continue}if(U+=de,!j.inSingle&&!j.inDouble&&!j.escaped)re=/[\s;&|()<>]/.test(de);jo(de,j)}return U}var za=new Set(["rm","find","xargs","parallel"]),ob=new Set(["git","busybox",...za,...Jt,...Qd,...Dn]),ib=new Set(["python","node","ruby","perl"]);function Me(G){let U=Gt(G);return ob.has(U)||zn(U)}function zn(G){return ib.has(sb(G))}function sb(G){let U=Lt(G).toLowerCase();return Bi.test(U)?"python":U}var Et={version:1,rules:[],overrides:{},transparent_wrappers:[]};function d(G){try{let U=r(ab(G));if(U===null)return{config:null,errors:[]};if(!U.trim())return{config:null,errors:["Config file is empty"]};let j=JSON.parse(U),K=ct(j);if(K.errors.length>0)return{config:null,errors:K.errors};return{config:{version:1,rules:j.rules??[],overrides:j.overrides??{},transparent_wrappers:j.transparent_wrappers??[],...j.command_tools?{command_tools:j.command_tools}:{}},errors:[]}}catch(U){if(U instanceof o)return{config:null,errors:[U.message]};let j=U instanceof Error?U.message:String(U);return{config:null,errors:[U instanceof SyntaxError?"Invalid JSON":j]}}}function ab(G){return typeof G==="string"?se(G):G}var e=(G,U)=>({path:G,message:U,kind:"typed"}),sn=(G,U)=>({path:G,message:U,kind:"custom"});function Fe(G){let U=new Set;return G.flatMap((j,K)=>{let re=Ir(j)?j.name:void 0;if(typeof re!=="string")return[];if(U.has(re.toLowerCase()))return[sn(["rules",K,"name"],`duplicate rule name "${re}"`)];return U.add(re.toLowerCase()),[]})}var Ie=`must be one of ${Wa.join(", ")}`,lb=/^[^/]+\/[^/]+$/,cb=["version","rules","overrides","transparent_wrappers","command_tools"],$e=/^[^\s\p{Cc}]{1,256}$/u,xe="non-empty, at most 256 characters, no whitespace or control characters";function ct(G){let U=db(G);return{errors:ce(lt(U,cb,(j)=>j.kind==="custom"),": "," "),sources:Cb(G,U)}}function db(G){if(!Ir(G))return[e([],"Config must be an object")];let U=Array.isArray(G.rules)&&G.rules.length>ye;return[...G.version===1?[]:[e(["version"],"must be 1")],...ub(G.rules,U),...pb(G.overrides),...hb(G.transparent_wrappers),...U?[]:fb(G.rules),...Ir(G.overrides)?Object.keys(G.overrides).filter((j)=>!lb.test(j)).map((j)=>sn(["overrides",j],"must use <rulebook-name>/<rule-name>")):[],...yb(G.transparent_wrappers),...bb(G.command_tools)]}function ub(G,U){if(G===void 0)return[];if(!Array.isArray(G))return[e(["rules"],"must be an array of rulebook source strings"),...ru(G,ye)?[e(["rules"],be)]:[]];if(U)return[{path:["rules"],message:be,kind:"limit"}];return G.flatMap((j,K)=>{if(typeof j!=="string")return[e(["rules",K],"must be a rulebook source string"),...mb(j,1)?[e(["rules",K],"must be a non-empty rulebook source string")]:[]];return j===""?[e(["rules",K],"must be a non-empty rulebook source string")]:[]})}function ru(G,U){let j=ou(G);return j!==void 0&&!(j<=U)}function mb(G,U){let j=ou(G);return j!==void 0&&!(j>=U)}function ou(G){if(G===null||G===void 0)return;let U=G.length;return U===void 0?void 0:Number(U)}function fb(G){if(!Array.isArray(G))return[];let U=new Set;return G.flatMap((j,K)=>{if(typeof j!=="string"||j==="")return[];if(j.trim()==="")return[sn(["rules",K],"must be a non-empty rulebook source string")];let re=Yd(j);if(re)return[sn(["rules",K],re)];if(U.has(j))return[sn(["rules",K],`duplicate rulebook source "${j}"`)];return U.add(j),[]})}function pb(G){if(G===void 0)return[];if(!Ir(G))return[e(["overrides"],"must be an object if provided")];return Object.keys(G).flatMap((U)=>{let j=G[U];if(j==="off")return[];if(!Ir(j))return[e(["overrides",U],'must be "off" or an object')];return[...gb(j.reason,["overrides",U,"reason"]),...j.intent===void 0||Ae(j.intent)?[]:[e(["overrides",U,"intent"],Ie)]]})}function gb(G,U){if(typeof G!=="string")return[e(U,"required non-empty string"),...ru(G,O)?[e(U,`must be at most ${O} characters`)]:[]];if(G==="")return[e(U,"required non-empty string")];return G.length>O?[e(U,`must be at most ${O} characters`)]:[]}function hb(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["transparent_wrappers"],"must be an array of command strings")];return G.flatMap((U,j)=>{if(typeof U!=="string")return[e(["transparent_wrappers",j],"must be a command string")];return E.test(U)?[]:[e(["transparent_wrappers",j],"must match command pattern")]})}function yb(G){if(!Array.isArray(G))return[];let U=new Set;return G.flatMap((j,K)=>{if(typeof j!=="string"||!E.test(j))return[];if(U.has(j))return[sn(["transparent_wrappers",K],`duplicate command "${j}"`)];if(Me(j))return[sn(["transparent_wrappers",K],`reserved command "${j}" cannot be a wrapper`)];return U.add(j),[]})}function bb(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let U=new Set,j=(K,re)=>{if(U.has(K))return[sn(["command_tools",re],`duplicate tool "${K}"`)];return U.add(K),[]};return G.flatMap((K,re)=>{if(typeof K==="string")return $a(K)?j(K,re):[e(["command_tools",re],`must be a tool name: ${xe}`)];if(!Ir(K))return[e(["command_tools",re],"must be a tool name or a {name, cwd} object")];let oe=[...$a(K.name)?[]:[e(["command_tools",re,"name"],`must be a tool name: ${xe}`)],...K.cwd===void 0||$a(K.cwd)?[]:[e(["command_tools",re,"cwd"],`must be an argument name: ${xe}`)]];return oe.length>0?oe:j(K.name,re)})}function $a(G){return typeof G==="string"&&$e.test(G)}function Cb(G,U){let j=Ir(G)?G.rules:void 0;if(!Array.isArray(j))return new Set;if(U.some((re)=>re.path.length===1&&re.path[0]==="rules"))return new Set;let K=new Set(U.filter((re)=>re.path[0]==="rules"&&typeof re.path[1]==="number").map((re)=>re.path[1]));return new Set(j.filter((re,oe)=>typeof re==="string"&&!K.has(oe)))}function lt(G,U,j){let K=G.map((de)=>de.path[1]),re=[...new Set(K.filter((de)=>typeof de==="string"))],oe=(de,Ce)=>[de.path.length===0?-1:U.indexOf(String(de.path[0])),typeof Ce==="number"?Ce:re.indexOf(String(Ce)),j(de)?0:1];return G.map((de,Ce)=>({issue:de,rank:oe(de,K[Ce])})).sort((de,Ce)=>de.rank[0]-Ce.rank[0]||de.rank[1]-Ce.rank[1]||de.rank[2]-Ce.rank[2]).map((de)=>de.issue)}function ce(G,U,j){return[...new Set(G.map((K)=>{let re=Ba(K.path);if(K.kind==="unknownKeys")return`${re?`${re}.`:""}unknown field "${K.message}"`;if(K.kind==="key"||K.kind==="limit"||K.path.length===0)return K.message;return`${re}${K.path.length===1?j:U}${K.message}`}))]}function Ba(G){return G.map((U,j)=>{if(typeof U==="number")return`[${U}]`;return j===0?String(U):`.${String(U)}`}).join("")}function Ae(G){return Wa.includes(G)}function Ir(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function le(G){let U=Eb(G);if(U.errors.length>0)throw Error(U.errors.join("; "));return G}var Sb=`required non-empty string up to ${O} characters`,iu="must be a non-empty array of unique non-empty strings",vb="required non-empty array of non-empty strings";function Eb(G){if(!mr(G))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!nu(G))return{errors:[eu],ruleNames:new Set};let U=[...G.rulebook_version===1||G.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ce(Rb(G,G.rulebook_version===2),": ",": ")];return{errors:U.length>Fn.maxValidationErrors?[...U.slice(0,Fn.maxValidationErrors),tu]:U,ruleNames:new Set(je(G).map((j)=>j.toLowerCase()))}}function je(G){let U=mr(G)?G.rules:void 0;return(Array.isArray(U)?U:[]).flatMap((j)=>{let K=mr(j)?j.name:void 0;return typeof K==="string"?[K]:[]})}function Rb(G,U){return[...typeof G.name==="string"&&p.test(G.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof G.version==="string"&&G.version!==""?[]:[e(["version"],"required non-empty string")],..._b(G.allowed_commands),...xb(G.rules,U),...Tb(G.tests),...Ib(G),...kb(G)]}function _b(G){if(!Array.isArray(G))return[e(["allowed_commands"],"required array")];let U=new Set;return[...G.flatMap((j,K)=>typeof j==="string"&&E.test(j)?[]:[e(["allowed_commands",K],"must match command pattern")]),...G.flatMap((j,K)=>{if(typeof j!=="string"||!E.test(j))return[];if(U.has(j))return[sn(["allowed_commands",K],`duplicate command "${j}"`)];return U.add(j),[]})]}function xb(G,U){if(!Array.isArray(G))return[e(["rules"],"required array")];return[...G.flatMap((j,K)=>{if(!mr(j))return[e(["rules",K],"must be an object")];return U?Ab(j,["rules",K]):wb(j,["rules",K])}),...Fe(G)]}function wb(G,U){return[...su(G.name,U),...au(G.command,U),...G.subcommand===void 0||typeof G.subcommand==="string"&&E.test(G.subcommand)?[]:[e([...U,"subcommand"],"must match command pattern")],...ji(G.block_args,[...U,"block_args"],"required non-empty array",!1),...lu(G.reason,U),...cu(G.intent,U)]}function Ab(G,U){return[...su(G.name,U),...au(G.command,U),...lu(G.reason,U),...cu(G.intent,U),...Pb(G.match,[...U,"match"]),...G.subcommand===void 0?[]:[e([...U,"subcommand"],"not supported in rulebook_version 2")],...G.block_args===void 0?[]:[e([...U,"block_args"],"not supported in rulebook_version 2")]]}function su(G,U){if(typeof G!=="string")return[e([...U,"name"],"required string")];return p.test(G)?[]:[e([...U,"name"],"must match rule name pattern")]}function au(G,U){return typeof G==="string"&&E.test(G)?[]:[e([...U,"command"],"required string matching command pattern")]}function lu(G,U){return typeof G==="string"&&G!==""&&G.length<=O?[]:[e([...U,"reason"],Sb)]}function cu(G,U){return G===void 0||Ae(G)?[]:[e([...U,"intent"],Ie)]}function Pb(G,U){if(!mr(G))return[e(U,"required object")];return[...ji(G.command_path,[...U,"command_path"],vb,!1),...G.any_args===void 0?[]:ji(G.any_args,[...U,"any_args"],iu,!0),...G.exclude_args===void 0?[]:ji(G.exclude_args,[...U,"exclude_args"],iu,!0)]}function ji(G,U,j,K){if(!Array.isArray(G))return[e(U,j)];let re=G.flatMap((oe,de)=>{if(typeof oe!=="string")return[e([...U,de],"must be a non-empty string")];return oe===""?[sn([...U,de],"must be a non-empty string")]:[]});if(G.some((oe)=>typeof oe!=="string"))return re;return[...re,...G.length===0?[sn(U,j)]:[],...K&&new Set(G).size!==G.length?[sn(U,"must not contain duplicate values")]:[]]}function Tb(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["tests"],"must be an array if provided")];return G.flatMap((U,j)=>{if(!mr(U))return[e(["tests",j],"must be an object")];return[...typeof U.command==="string"&&U.command.trim()!==""?[]:[e(["tests",j,"command"],"required non-empty string")],...U.expect==="blocked"||U.expect==="allowed"?[]:[e(["tests",j,"expect"],'must be "blocked" or "allowed"')],...U.rule===void 0||typeof U.rule==="string"?[]:[e(["tests",j,"rule"],"must be a string if provided")],...U.expect==="blocked"&&typeof U.rule!=="string"?[sn(["tests",j,"rule"],"required string for blocked fixtures")]:[]]})}function Ib(G){if(!Array.isArray(G.tests))return[];let U=new Set(je(G));return[...new Set(G.tests.flatMap((j)=>mr(j)&&j.expect==="blocked"&&typeof j.rule==="string"?[j.rule]:[]))].filter((j)=>!U.has(j)).map((j)=>sn(["tests"],`blocked fixture references unknown rule "${j}"`))}function kb(G){if(!Array.isArray(G.allowed_commands)||!Array.isArray(G.rules))return[];let U=new Set(G.allowed_commands.filter((j)=>typeof j==="string"));return G.rules.flatMap((j,K)=>{let re=mr(j)?j.command:void 0;if(typeof re!=="string"||U.has(re))return[];return[sn(["rules",K,"command"],`"${re}" must be listed in allowed_commands`)]})}function mr(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function Q(G,U){let j=X(G,U),K;try{K=Bd(j.userConfigTarget,j.projectConfigTarget)}catch(Ze){if(Ze instanceof o)return $b(j,Ze.message);throw Ze}let re=d(j.userConfigTarget),oe=K?{config:null,errors:[]}:d(j.projectConfigTarget),de=mu(j.userConfigPath,re.errors),Ce=mu(j.projectConfigPath,oe.errors),Ee=new Set,ke=re.config?Ua(re.config,kr(j.userConfigPath),"user",j.userScope,Ee):fu(),De=oe.config?Ua(oe.config,kr(j.projectConfigPath),"project",j.projectScope,Ee):fu(),Xe=re.config?.overrides??{},Ye=oe.config?.overrides??{};return{rules:[...uu(ke.rules,Xe),...uu(De.rules,Ye)],transparent_wrappers:Gb(re.config,oe.config),command_tools:Fb(re.config,oe.config),rulebooks:[...ke.rulebooks,...De.rulebooks],errors:[...de,...Ce,...ke.errors,...De.errors],warnings:[...ke.warnings,...De.warnings,...ke.canValidateOverrides?Ha(Xe,ke.knownRuleIds,j.userConfigPath):[],...ke.canValidateOverrides?zb(Ye,ke.knownRuleIds,j.projectConfigPath):[],...De.canValidateOverrides?Ha(Ye,De.knownRuleIds,j.projectConfigPath):[]],userConfig:re.config??void 0,projectConfig:oe.config??void 0,...j}}function B(G,U){let j=Ob(G,U);if(!j)return[];return[...j.scope.errors,...j.scope.warnings,...Mb(j.config,j.scope,G)]}function Ob(G,U){let j=U??w(kr(kr(G)),"rules policy"),K=d(i(j,G)).config;if(!K)return null;return{config:K,scope:Ua(K,kr(G),"project",j)}}function Mb(G,U,j){return U.canValidateOverrides?Ha(G.overrides??{},U.knownRuleIds,j):[]}function Ua(G,U,j,K=w(kr(kr(U)),j==="user"?"user policy":"project policy"),re=new Set){let oe=[],de=[],Ce=G.rules.flatMap((ke)=>{let De=Nb(ke,U,K);if(De.errors.length>0||!De.rulebook)return oe.push(...De.errors),[];let Xe=De.rulebook;if(re.has(Xe.name))return de.push(`duplicate active rulebook name "${Xe.name}" for ${ke}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return re.add(Xe.name),[{rules:Db(Xe),rulebook:{source:j,spec:ke,name:Xe.name,version:Xe.version,rules:Xe.rules.map((Ye)=>`${Xe.name}/${Ye.name}`)}}]}),Ee=Ce.flatMap((ke)=>ke.rules);return{rules:Ee,rulebooks:Ce.map((ke)=>ke.rulebook),knownRuleIds:new Set(Ee.map((ke)=>ke.name)),errors:oe,warnings:de,canValidateOverrides:oe.length===0}}function Db(G){if(G.rulebook_version===2)return G.rules.map((U)=>({name:`${G.name}/${U.name}`,command:U.command,block_args:[],match:U.match,reason:U.reason,intent:U.intent}));return G.rules.map((U)=>({...U,name:`${G.name}/${U.name}`,match:void 0}))}function Nb(G,U,j){let K=Ue(G),re=M(U,K),oe=Wb(re,j);if("error"in oe)return{rulebook:null,errors:[oe.error]};if(oe.content===null)return{rulebook:null,errors:[`missing rulebook file ${re} for ${G}; ${Lb(G)}`]};let de=ve(oe.content);if("problem"in de)return{rulebook:null,errors:[`invalid rulebook ${re}: ${de.problem}; fix that file`]};if(de.rulebook.name!==K)return{rulebook:null,errors:[`rulebook name "${de.rulebook.name}" in ${re} must match source "${G}"; fix that file`]};return{rulebook:de.rulebook,errors:[]}}function Ue(G){return C(G)?L(G).name:G}function Lb(G){return C(G)?`run ${Jd} to vendor ${G}`:"create that file or remove that source from the rules config"}function Wb(G,U){try{return{content:r(i(U,G))}}catch(j){if(j instanceof o)return{error:j.message};throw j}}function ve(G){let U;try{U=JSON.parse(G)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:le(U)}}catch(j){return{problem:j instanceof Error?j.message:"invalid rulebook"}}}function Gb(G,U){return[...new Set([...G?.transparent_wrappers??[],...U?.transparent_wrappers??[]])]}function Fb(G,U){let j=(G?.command_tools??[]).map(du),K=(U?.command_tools??[]).map(du);return[...j,...K.filter((re)=>!j.some((oe)=>oe.name===re.name))]}function du(G){if(typeof G==="string")return{name:G};return G.cwd===void 0?{name:G.name}:{name:G.name,cwd:G.cwd}}function uu(G,U){return G.flatMap((j)=>{let K=U[j.name];if(K==="off")return[];if(K&&typeof K==="object")return[{...j,intent:K.intent??j.intent,reason:K.reason}];return[j]})}function Ha(G,U,j){return Object.keys(G).filter((K)=>!U.has(K)).map((K)=>`unknown override key "${K}" in ${j}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function zb(G,U,j){return Object.keys(G).filter((K)=>U.has(K)).map((K)=>`project override cannot target user-scoped rule "${K}" in ${j}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function mu(G,U){return U.map((j)=>j.startsWith("Unable to access ")?j:`${G}: ${j}`)}function $b(G,U){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[U],warnings:[],userConfigPath:G.userConfigPath,projectConfigPath:G.projectConfigPath}}function fu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Jb,readFileSync as Qb}from"node:fs";var pu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ja=new Set(pu.map((G)=>G.id)),z=pu,Bb=new Map(z.map((G)=>[G.id,G.intent]));function At(G,U){return{id:G,reason:U,intent:Bb.get(G)??"manual_only"}}var Va=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Vi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Ub=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Hb=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ka=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Hb.flatMap((G)=>Ub.map((U)=>({id:["secret.home",G.idSlug,U.slice(1)].join("."),category:"Home path",label:[G.label,U].join(""),description:["Blocks home ",G.label,U," credential backup files."].join(""),suffixParts:[...G.directoryParts,[G.basename,U].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ki=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],gu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],jb=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],qa=gu.map((G)=>({id:`secret.variant.${G.slug}.separator`,category:"Variant",label:`${G.label}-* / ${G.label}_*`,description:`Blocks ${G.label} variants with dash or underscore suffixes.`,prefix:G.prefix})),Ya=gu.flatMap((G)=>jb.map((U)=>({id:`secret.variant.${G.slug}.${U.slice(1)}`,category:"Variant",label:`${G.label}${U}`,description:`Blocks ${G.label}${U} private credential variants.`,prefix:G.prefix,suffix:U}))),Vo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Za=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((G)=>({id:`secret.ext.${G}`,category:"Extension",label:`.${G}`,description:`Blocks files with the .${G} extension.`,extension:G})),Xa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],ut=[...Va,Vi,...Ka,...qa,...Ya,Vo,...Za,...Xa,...Ki].map((G)=>({id:G.id,category:G.category,label:G.label,...G.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in G?{paths:G.paths}:{description:G.description}})),qi=new Set(Ki.flatMap((G)=>G.category==="Coding CLI config"?[G.id]:[])),Ja=new Set(ut.map((G)=>G.id));import{isAbsolute as Qa,join as Vb,normalize as Kb,sep as Yi}from"node:path";var Zi=process.platform==="win32",hu=/[*?]/;function el(G){let U=G.trim(),j=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Zi?U.replaceAll("\\","/"):U);if(!j)return null;let K=j[1]??"",re=j[2]??"";if(hu.test(K)||re==="."||re==="..")return null;return{root:K||"/",name:re}}function Ko(G,U){if(G==="~")return U;if(G.startsWith("~/"))return`${U}${G.slice(1)}`;return G}function tl(G,U){if(typeof G!=="string"||G.trim()==="")return"must be a non-empty path string";let j=Ko(G.trim(),U);if(!Qa(j))return"must be an absolute path or start with ~/";return qo(j,U)}function nl(G,U){let j=yu(G,U);if(j===null)return"must be a non-empty path string";if(!Qa(j))return null;if(qo(j,U)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var qb="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Yb="cannot cover the guard's own configuration";function yu(G,U){if(typeof G!=="string"||G.trim()==="")return null;let j=G.trim(),K=Zi?j.replaceAll("\\","/"):j;return Ko(K.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),U)}function rl(G,U){let j=yu(G,U);if(j===null)return"must be a non-empty path string";let K=el(j)?.root??j;if(hu.test(K))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Qa(K))return null;if(qo(K,U)!==null)return qb;return Zb(K,U)?Yb:null}function Zb(G,U){let j=Xi(G),K=Xi(Vb(U,".cc-safety-net"));return j===K||j.startsWith(`${K}${Yi}`)}function qo(G,U){let j=Xi(G),K=Xi(U);if(j===K)return"cannot be the home directory";let re=j.endsWith(Yi)?j:`${j}${Yi}`;if(K.startsWith(re))return"cannot contain the home directory";return null}function Xi(G){let U=Kb(G);if(Zi)U=U.replace(/\//g,"\\").toLowerCase();if(U.length>(Zi?3:1)&&U.endsWith(Yi))U=U.slice(0,-1);return U}var bu=30,Ji=1,Qi=365;function Cu(G){if(typeof G!=="number"||!Number.isInteger(G))return 30;if(G<1)return 1;return G>365?365:G}var Su=new Set(z.filter((G)=>G.catastrophic).map((G)=>G.id));function Dt(G,U){if(!G)return null;if(Su.has(G.id))return G;if(U?.destructiveCommandProtectionEnabled===!1)return null;let j=U?.effectiveDestructiveCommandRules[G.id];return j&&!j.enabled?null:G}function nn(G,U,j){if(Su.has(U))return!0;if(G?.destructiveCommandProtectionEnabled===!1)return!1;return G?.effectiveDestructiveCommandRules[U]?.enabled??j}function V(G,U){return Object.freeze(Object.fromEntries(z.map((j)=>{let K=j.activationCapability?U[j.activationCapability]:void 0,re=K?.enabled??!0,oe=G.destructiveCommandRuleOverrides[j.id],de=j.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...oe?{override:oe}:{}}:G.destructiveCommandProtectionEnabled?oe?{enabled:oe==="on",inheritedEnabled:re,changesInherited:oe==="on"!==re,source:"rule_override",...j.activationCapability?{activationCapability:j.activationCapability}:{},override:oe}:{enabled:re,inheritedEnabled:re,changesInherited:!1,source:K?.source??"built_in_default",...j.activationCapability?{activationCapability:j.activationCapability}:{}}:{enabled:!1,inheritedEnabled:re,changesInherited:!1,source:"master_disabled",...j.activationCapability?{activationCapability:j.activationCapability}:{},...oe?{override:oe}:{}};return[j.id,Object.freeze(de)]})))}function vu(G,U){return Object.freeze({...G,effectiveDestructiveCommandRules:V(G,U)})}var Eu={standard:0,strict:1,paranoid:2};function ee(G,U,j=!1,K=G.safety.level){let re=Xb(G,U,K),oe=new Set(j?re.map((De)=>De.field):[]),de=(De,Xe)=>oe.has(De)?void 0:Xe,Ce=(De,Xe)=>Object.fromEntries(Object.entries(Xe??{}).filter(([Ye])=>!oe.has(`${De}.${Ye}`))),Ee=(De,Xe)=>Xe?.filter((Ye)=>!oe.has(`${De}.${Ye}`));return{policy:{version:1,safety:{level:de("safety.level",U.safety?.level)??G.safety.level,overrides:{...G.safety.overrides,...Ce("safety.overrides",U.safety?.overrides)}},workflow:{worktree_mode:de("workflow.worktree_mode",U.workflow?.worktree_mode)??G.workflow.worktree_mode},destructive_command_protection:{enabled:de("destructive_command_protection.enabled",U.destructive_command_protection?.enabled)??G.destructive_command_protection.enabled,overrides:{...G.destructive_command_protection.overrides,...Ce("destructive_command_protection.overrides",U.destructive_command_protection?.overrides)},allow_paths:ol(G.destructive_command_protection.allow_paths,Ee("destructive_command_protection.allow_paths",U.destructive_command_protection?.allow_paths))},secret_protection:{enabled:de("secret_protection.enabled",U.secret_protection?.enabled)??G.secret_protection.enabled,overrides:{...G.secret_protection.overrides,...Ce("secret_protection.overrides",U.secret_protection?.overrides)},deny_paths:ol(G.secret_protection.deny_paths,U.secret_protection?.deny_paths),allow_paths:ol(G.secret_protection.allow_paths,Ee("secret_protection.allow_paths",U.secret_protection?.allow_paths))},audit:G.audit},weakenings:re.map((De)=>De.message)}}function ol(G,U){return[...new Set([...G,...U??[]])]}function Xb(G,U,j){let K=U.safety?.level,re=Li[j];return[...K&&Eu[K]<Eu[G.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${G.safety.level} -> ${K}`}]:[],...no.flatMap((oe)=>U.safety?.overrides?.[oe]===!1&&(G.safety.overrides[oe]??re[oe])?[{field:`safety.overrides.${oe}`,message:`project policy disables ${oe}`}]:[]),...U.workflow?.worktree_mode===!0&&!G.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...U.destructive_command_protection?.enabled===!1&&G.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...U.secret_protection?.enabled===!1&&G.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Ru("destructive_command_protection.overrides",U.destructive_command_protection?.overrides,(oe)=>G.destructive_command_protection.enabled&&G.destructive_command_protection.overrides[oe]!=="off"),...Ru("secret_protection.overrides",U.secret_protection?.overrides,(oe)=>G.secret_protection.enabled&&(G.secret_protection.overrides[oe]==="on"?!0:G.secret_protection.overrides[oe]!=="off"&&!qi.has(oe))),...G.destructive_command_protection.enabled?_u(G.destructive_command_protection.allow_paths,U.destructive_command_protection?.allow_paths).map((oe)=>({field:`destructive_command_protection.allow_paths.${oe}`,message:`project policy adds destructive allow path: ${oe}`})):[],...G.secret_protection.enabled?_u(G.secret_protection.allow_paths,U.secret_protection?.allow_paths).map((oe)=>({field:`secret_protection.allow_paths.${oe}`,message:`project policy adds secret allow path: ${oe}`})):[]]}function Ru(G,U,j){return Object.entries(U??{}).flatMap(([K,re])=>re==="off"&&j(K)?[{field:`${G}.${K}`,message:`project policy disables rule ${K}`}]:[])}function _u(G,U){return(U??[]).filter((j)=>!G.includes(j))}var al=new Set(["standard","strict","paranoid"]),te={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:bu}};function Pu(G,U){let j=iC(u(G,U),G.home),K=A(G,U)?{exists:!1,policy:F(),errors:[]}:He(h(U.cwd),G.home),re=ue(K.parsed,G.home),oe=S(n.projectTightenOnly,G.env),de=j.gui??te,Ce=Object.keys(re.policy).length>0?ee(de,re.policy,oe,Ld(de.safety.level,G.env)):void 0,Ee=[...j.errors,...K.errors,...re.diagnostics],ke=(j.fallback==="defaults"&&Ce?"salvaged":j.fallback)??(j.gui?void 0:K.fallback)??(Ee.length>0?"salvaged":void 0),De=re.policy.safety?.level&&Ce?.policy.safety.level===re.policy.safety.level?"project":j.levelPresent?"user":"default";return{...Ce?sl(Ce.policy):j.policy,errors:Ee,...ke?{fallback:ke}:{},...K.exists?{policyScopes:{levelScope:De,weakenings:Ce?.weakenings??[],weakeningsIgnored:oe}}:{}}}var eC="project policy audit settings are ignored; audit is user scope only";function ue(G,U){if(!An(G))return{policy:{},diagnostics:[]};let j=An(G.safety)?G.safety:{},K=An(G.workflow)?G.workflow:{},re=An(G.destructive_command_protection)?G.destructive_command_protection:{},oe=An(G.secret_protection)?G.secret_protection:{},de={...al.has(j.level)?{level:j.level}:{},...An(j.overrides)?xu({overrides:Tu(j.overrides,no,["safety","overrides"],Or)}):{}},Ce={...typeof re.enabled==="boolean"?{enabled:re.enabled}:{},...re.overrides!==void 0?{overrides:es(re.overrides,ja,ku,Or)}:{},...re.allow_paths!==void 0?{allow_paths:io(re.allow_paths,tl,U,["destructive_command_protection","allow_paths"],Or)}:{}},Ee={...typeof oe.enabled==="boolean"?{enabled:oe.enabled}:{},...oe.overrides!==void 0?{overrides:es(oe.overrides,Ja,Ou,Or)}:{},...oe.deny_paths!==void 0?{deny_paths:io(oe.deny_paths,nl,U,["secret_protection","deny_paths"],Or)}:{},...oe.allow_paths!==void 0?{allow_paths:io(oe.allow_paths,rl,U,["secret_protection","allow_paths"],Or)}:{}};return{policy:xu({safety:de,workflow:typeof K.worktree_mode==="boolean"?{worktree_mode:K.worktree_mode}:{},destructive_command_protection:Ce,secret_protection:Ee}),diagnostics:G.audit===void 0?[]:[eC]}}function Tu(G,U,j,K){return Object.fromEntries(U.flatMap((re)=>{let oe=G[re];if(typeof oe==="boolean")return[[re,oe]];if(oe!==void 0)K(e([...j,re],ll));return[]}))}function xu(G){return Object.fromEntries(Object.entries(G).flatMap((U)=>Object.keys(U[1]).length>0?[U]:[]))}var Or=()=>{return},ll="must be a boolean",cl="must be an object if provided",Iu=`must be an integer between ${Ji} and ${Qi}`,ku={path:["destructive_command_protection","overrides"],label:"destructive command"},Ou={path:["secret_protection","overrides"],label:"secret protection"},dt=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function pt(G,U){let j=[];return{policy:Mu(G,U,(re)=>{j.push(re)}),issues:j}}function k(G,U){return Mu(G,U,Or)}function Mu(G,U,j){if(!An(G))return j(e([],"Config must be an object")),F();if(G.version!==1)j(e(["version"],"must be 1"));let K=oo(G.safety,["safety"],["level","overrides"],j),re=oo(K.overrides,["safety","overrides"],no,j),oe=oo(G.workflow,["workflow"],["worktree_mode"],j),de=oo(G.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],j),Ce=oo(G.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],j),Ee=oo(G.audit,["audit"],["retention_days"],j);return Du(G,dt,[],j),{version:1,safety:{level:tC(K.level,j),overrides:Tu(re,no,["safety","overrides"],j)},workflow:{worktree_mode:il(oe.worktree_mode,["workflow","worktree_mode"],!1,j)},destructive_command_protection:{enabled:il(de.enabled,["destructive_command_protection","enabled"],!0,j),overrides:es(de.overrides,ja,ku,j),allow_paths:io(de.allow_paths,tl,U,["destructive_command_protection","allow_paths"],j)},secret_protection:{enabled:il(Ce.enabled,["secret_protection","enabled"],!0,j),overrides:es(Ce.overrides,Ja,Ou,j),deny_paths:io(Ce.deny_paths,nl,U,["secret_protection","deny_paths"],j),allow_paths:io(Ce.allow_paths,rl,U,["secret_protection","allow_paths"],j)},audit:{retention_days:nC(Ee.retention_days,j)}}}function oo(G,U,j,K){if(G===void 0)return{};if(!An(G))return K(e(U,cl)),{};return Du(G,j,U,K),G}function Du(G,U,j,K){for(let re of Object.keys(G).filter((oe)=>!U.includes(oe)))K({path:j,message:re,kind:"unknownKeys"})}function tC(G,U){if(G===void 0)return"standard";if(al.has(G))return G;return U(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function il(G,U,j,K){if(typeof G==="boolean")return G;if(G!==void 0)K(e(U,ll));return j}function nC(G,U){if(!(G===void 0||typeof G==="number"&&Number.isInteger(G)&&G>=Ji&&G<=Qi))U(e(["audit","retention_days"],Iu));return Cu(G)}function es(G,U,j,K){if(G===void 0)return{};if(!An(G))return K(e(j.path,cl)),{};return Object.fromEntries(Object.entries(G).flatMap(([re,oe])=>{if(!U.has(re))return K({path:[...j.path,re],message:`unknown ${j.label} rule id "${re}"`,kind:"key"}),[];if(oe==="on"||oe==="off")return[[re,oe]];return K(e([...j.path,re],'must be "on" or "off"')),[]}))}function io(G,U,j,K,re){if(G===void 0)return[];if(!Array.isArray(G))return re(e(K,"must be an array of paths")),[];return G.flatMap((oe,de)=>{let Ce=U(oe,j);if(Ce===null)return[oe];return re(typeof oe==="string"?sn([...K,de],Ce):e([...K,de],Ce)),[]})}function An(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function F(){return structuredClone(te)}function Ge(G,U){let j=P({safety:Be(G.safety)},U),K=V({destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides},j.capabilities),re=Object.values(K),oe=re.filter((de)=>de.source!=="catastrophic");return{selectedPreset:G.safety.level,effectiveLevel:j.effectiveLevel,capabilities:j.capabilities,rules:K,counts:{enabled:oe.filter((de)=>de.enabled).length,disabled:oe.filter((de)=>!de.enabled).length,effectiveCustomizations:re.filter((de)=>de.changesInherited).length}}}function He(G,U){if(!Jb(G))return{exists:!1,policy:F(),errors:[]};try{let j=Qb(G,"utf-8");if(!j.trim())return{exists:!0,policy:F(),errors:[`${G}: Config file is empty`],fallback:"defaults"};let K=JSON.parse(j),re=pt(K,U);if(re.issues.length===0)return{exists:!0,parsed:K,policy:re.policy,errors:[]};return{exists:!0,parsed:K,policy:re.policy,errors:re.issues.map((oe)=>`${G}: ${oC(oe)}`),fallback:An(K)?"salvaged":"defaults"}}catch(j){let K=j instanceof Error?j.message:String(j);return{exists:!0,policy:F(),errors:[`${G}: ${j instanceof SyntaxError?"Invalid JSON":K}`],fallback:"defaults"}}}var rC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[cl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ll,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Iu,`not an integer between ${Ji} and ${Qi}`]]);function oC(G){let U=Ba(G.path);if(G.kind==="unknownKeys")return`${U===""?"":`${U}.`}${G.message}: unknown field`;if(G.kind==="key")return`${U}: unknown rule id`;let j=rC.get(G.message)??G.message;return U===""?j:`${U}: ${j}`}function iC(G,U){let j=He(G,U);if(!j.exists){let K=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!An(K))return{policy:Au(),errors:[]};let re=k(K,U);return{policy:sl(re),gui:re,errors:[],levelPresent:wu(K)}}if(j.parsed===void 0)return{policy:Au(),errors:j.errors,...j.fallback?{fallback:j.fallback}:{}};return{policy:sl(j.policy),gui:j.policy,errors:j.errors,...j.fallback?{fallback:j.fallback}:{},levelPresent:wu(j.parsed)}}function wu(G){let U=An(G)&&An(G.safety)?G.safety:{};return al.has(U.level)}function We(G){let U=Object.entries(G),j=new Set(U.flatMap(([K,re])=>re==="on"?[K]:[]));return[...new Set([...[...qi].filter((K)=>!j.has(K)),...U.flatMap(([K,re])=>re==="off"?[K]:[])])]}function Au(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:We({}),denyPaths:[],allowPaths:[]}}}function sl(G){return{safety:Be(G.safety),worktreeMode:G.workflow.worktree_mode,destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides,destructiveCommandAllowPaths:G.destructive_command_protection.allow_paths,secretProtection:{enabled:G.secret_protection.enabled,disabledRules:We(G.secret_protection.overrides),denyPaths:G.secret_protection.deny_paths,allowPaths:G.secret_protection.allow_paths}}}function Be(G){let U={...G.overrides.fail_closed!==void 0?{failClosed:G.overrides.fail_closed}:{},...G.overrides.paranoid_rm!==void 0?{paranoidRm:G.overrides.paranoid_rm}:{},...G.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:G.overrides.paranoid_interpreters}:{}};return{level:G.level,...Object.keys(U).length>0?{overrides:U}:{}}}function R(G,U){let j=Q(G,U),K=Pu(G,U),re={rules:j.rules,transparentWrappers:j.transparent_wrappers,commandTools:j.command_tools,safety:K.safety,worktreeMode:K.worktreeMode,destructiveCommandProtectionEnabled:K.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:K.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:K.destructiveCommandAllowPaths,secretProtection:{enabled:K.secretProtection.enabled??!0,disabledRules:K.secretProtection.disabledRules??[],denyPaths:K.secretProtection.denyPaths,allowPaths:K.secretProtection.allowPaths??[]}},oe={...j.userConfig?.overrides,...j.projectConfig?.overrides},de=Object.freeze(Object.fromEntries(re.rules.map((Ce)=>{let Ee=j.rulebooks.find((De)=>De.rules.includes(Ce.name)),ke=oe[Ce.name];return[Ce.name,Object.freeze({id:Ce.name,...Ee?{rulebook:Object.freeze({name:Ee.name,version:Ee.version}),...cC(Ee.spec)?{source:Ee.spec}:{}}:{},...ke&&typeof ke==="object"?{override:Object.freeze({type:"reason",reason:ke.reason})}:{}})]})));return Oe(re,sC(j,K),de,K.policyScopes)}function ze(G){if(G.state==="ready")return{state:G.state};return{state:G.state,reason:G.reason}}function sC(G,U){let j=lC(U);if(G.errors.length===0&&G.warnings.length===0&&!j)return;return{diagnostics:[...G.errors,...G.warnings,...U.errors],reason:dC(G.errors.length>0?aC(G.errors):void 0,G.warnings.length>0?ul(G.warnings.join("; ")):void 0,j)}}function aC(G){return`${ul(G.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function lC(G){if(G.errors.length===0)return;let U=G.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${G.errors.join("; ")}. Enforcing ${U}; the invalid values are not active. Fix the policy file manually`}function cC(G){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(G)}function Oe(G,U,j=Object.freeze({}),K){let re=dl(structuredClone(G)),oe=K?{policyScopes:dl(structuredClone(K))}:{};if(!U)return Object.freeze({state:"ready",policy:re,diagnostics:Object.freeze([]),ruleMetadata:j,...oe});return Object.freeze({state:"degraded",policy:re,diagnostics:Object.freeze([...U.diagnostics]),reason:U.reason,ruleMetadata:j,...oe})}function dl(G){if(typeof G!=="object"||G===null)return G;for(let U of Object.values(G))dl(U);return Object.freeze(G)}function dC(...G){return ul(G.filter((U)=>!!U).join("; "))}function ul(G){return/[.!?]$/.test(G)?G:`${G}.`}function Ve(G){let U=G.effectiveCapabilities,j=G.strict??U.fail_closed.enabled,K=G.paranoidRm??U.paranoid_rm.enabled,re=G.paranoidInterpreters??U.paranoid_interpreters.enabled,oe={fail_closed:ml(U.fail_closed,G.strict,"strict"),paranoid_rm:ml(U.paranoid_rm,G.paranoidRm,"paranoidRm"),paranoid_interpreters:ml(U.paranoid_interpreters,G.paranoidInterpreters,"paranoidInterpreters")};return{policy:vu(G.policySnapshot.policy,oe),effectiveCapabilities:oe,effectiveLevel:Pa({failClosed:j,paranoidRm:K,paranoidInterpreters:re}),strict:j,paranoidRm:K,paranoidInterpreters:re,worktreeMode:G.worktreeMode??!1}}function ml(G,U,j){if(U===void 0||U===G.enabled)return G;return{enabled:U,source:"capability_override",sources:[...G.sources,`analysis options.${j}`]}}import{dirname as mA,isAbsolute as fA,join as pA,parse as gA,resolve as hA,sep as yA}from"node:path";function Yo(G,U){if(G!=="powershell")return U[0]?.provenance==="command-substitution";let j=U[0]?.text==="&"||U[0]?.text==="."?1:0,K=U[j]?.provenance;return K!==void 0&&K!=="literal"}var uC=/^[A-Za-z_][A-Za-z0-9_]*=/;function ts(G,U){return G?.provenance==="literal"&&!G.quoted&&G.raw===U&&G.text===U}function Zo(G){let U=ts(G.words[0],"time")?1:0,j=U===1&&ts(G.words[U],"-p")?U+1:U,K=U===1&&ts(G.words[j],"--")?j+1:j,re=ts(G.words[K],"!")?K+1:K,oe=G.words.slice(re).find((de)=>!uC.test(de.text));return oe?.provenance==="literal"?oe.text:void 0}var fr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function ns(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function mC(G){return Object.freeze({...G,span:Object.freeze(G.span),words:Object.freeze(G.words),redirections:Object.freeze(G.redirections.map((U)=>Object.freeze({...U,span:Object.freeze(U.span),...U.heredoc?{heredoc:Object.freeze({...U.heredoc,bodySpan:Object.freeze(U.heredoc.bodySpan),terminatorSpan:Object.freeze(U.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(G.nested.map((U)=>bn(U)))})}function rs(G,U,j){G.push(j),U.reset()}function os(G){let U=[];return{parts:U,push:(j,K,re)=>{if(K<=j)return;U.push({raw:G.slice(j,K),span:{start:j,end:K},provenance:re})}}}function fl(G){let U=G.parts??[{raw:G.raw,span:G.span,provenance:G.provenance}];return Object.freeze({kind:"word",...G,span:Object.freeze(G.span),parts:Object.freeze(U.map((j)=>Object.freeze({...j,span:Object.freeze(j.span)})))})}function so(G,U,j,K,re,oe,de){return fl({text:K,raw:G.slice(U,j),span:{start:U,end:j},provenance:re,quoted:oe,...de?{parts:de}:{}})}function bn(G){return Object.freeze({...G,span:Object.freeze(G.span),issues:Object.freeze(G.issues.map((U)=>Object.freeze({...U}))),nodes:Object.freeze(G.nodes.map((U)=>{if(U.kind==="command")return mC(U);if(U.kind==="group"||U.kind==="function")return Object.freeze({...U,span:Object.freeze(U.span),body:bn(U.body)});return Object.freeze({...U,span:Object.freeze(U.span)})}))})}function pl(G,U,j){if(U>=j||Lu(G[U]??""))return null;let K="",re=!1,oe=!1,de=U;while(de<j&&!Lu(G[de]??"")){let Ce=G[de]??"";if(Ce==="'"){re=!0;let Ee=Nu(G,de+1,j,"'");K+=Ee.text,oe||=!Ee.closed,de=Ee.next;continue}if(Ce==='"'){re=!0;let Ee=Nu(G,de+1,j,'"');K+=Ee.text,oe||=!Ee.closed,de=Ee.next;continue}if(Ce==="\\"){re=!0;let Ee=G[de+1];if(!Ee||Ee===`
-`||Ee==="\r"){oe=!0;break}K+=Ee,de+=2;continue}if(Ce==="`"||G.startsWith("$(",de)||G.startsWith("${",de)||G.startsWith("<(",de)||G.startsWith(">(",de))oe=!0;K+=Ce,de++}return{delimiter:K,quoted:re,next:de,ambiguous:oe}}function gl(G,U,j,K){let re=[],oe=U;for(let de of K){let Ce=oe,Ee=!1;while(oe<j){let ke=fC(G,oe,j);if((de.stripTabs?ke.text.replace(/^\t+/,""):ke.text)===de.delimiter){de.attach({body:de.stripTabs?pC(G.slice(Ce,oe)):G.slice(Ce,oe),delimiter:de.delimiter,quotedDelimiter:de.quotedDelimiter,bodySpan:{start:Ce,end:oe},terminatorSpan:{start:oe,end:ke.contentEnd}}),oe=ke.next,Ee=!0;break}if(ke.next<=oe)break;oe=ke.next}if(Ee)continue;return re.push({code:"unterminated-heredoc",message:`heredoc delimiter ${de.delimiter} was not found`}),{next:j,issues:re,terminated:!1}}return{next:oe,issues:re,terminated:!0}}function Nu(G,U,j,K){let re="",oe=U;while(oe<j&&G[oe]!==`
-`&&G[oe]!=="\r"){let de=G[oe]??"";if(de===K)return{text:re,next:oe+1,closed:!0};if(K==='"'&&de==="\\"&&G[oe+1]){let Ce=G[oe+1]??"";re+=["$","`",'"',"\\"].includes(Ce)?Ce:`\\${Ce}`,oe+=2;continue}re+=de,oe++}return{text:re,next:oe,closed:!1}}function Lu(G){return G!=="\r"&&(/[\s;&|<>)]/u.test(G)||G==="`")}function fC(G,U,j){let K=U;while(K<j&&G[K]!==`
-`)K++;let re=K>=j?j:K+1;return{text:G.slice(U,K),contentEnd:K,next:re}}function pC(G){return G.replace(/(^|\r\n?|\n)\t+/g,"$1")}var $u=new Set(["&&","||","|","|&"]),gC=new Set(["!","do","elif","else","if","then","until","while"]);function Bu(G,U){let j={start:0,end:G.length};if(G.length>U.maxInputLength)return bn({kind:"program",dialect:"posix",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${U.maxInputLength} UTF-16 code units`}],nodes:[]});let K={wordsUsed:0,maxWords:U.maxWords,quotedExpansionEnd:1/0},re=as(G,0,G.length,U,K,0),oe=_C(G,K.quotedExpansionEnd,re.nodes)?[...re.issues,ju]:re.issues;return bn({kind:"program",dialect:"posix",source:G,span:j,status:cs(oe,re.limited),issues:oe,nodes:re.nodes})}function as(G,U,j,K,re,oe,de){let Ce=[],Ee=[],ke=ns(),De=[],Xe=()=>{if(ke.words.length===0&&ke.redirections.length===0)return;let Ze={start:ke.start,end:ke.end},Je=ke.words.map((Qe)=>Qe.text);rs(Ce,ke,{kind:"command",dialect:"posix",source:G.slice(Ze.start,Ze.end),span:Ze,words:ke.words,redirections:ke.redirections,nested:ke.nested,displayText:Ee.length>0&&Ce.length===0?G.slice(U,j):Je.join(" ")})},Ye=U;while(Ye<j){let Ze=G[Ye];if(!Ze)break;if(de&&Ze===de)return Xe(),zu(Ce,Ee),{nodes:Ce,issues:Ee,next:Ye+1,closed:!0,limited:!1,pendingHeredocs:De};if(Jo(Ze)){if(Ze===`
-`||Ze==="\r"){Xe();let It=Ze==="\r"&&G[Ye+1]===`
-`?Ye+2:Ye+1,Mt=Ce.at(-1);if(Mt?.kind!=="connector"||!$u.has(Mt.operator))Ce.push(Object.freeze({kind:"connector",operator:G.slice(Ye,It),span:Object.freeze({start:Ye,end:It})}));if(De.length>0){let Nt=gl(G,It,j,De.splice(0));Ee.push(...Nt.issues),Ye=Nt.next;continue}Ye=It;continue}Ye++;continue}if(Ze==="#"){while(Ye<j&&G[Ye]!==`
-`&&G[Ye]!=="\r")Ye++;continue}let Je=ke.start===-1?BC(G,Ye,j):void 0;if(Je){if(yl(Ce,Ee),oe>=K.maxDepth)return ao(Ce,Ee,Ye,"depth-limit",K.maxDepth);if(!hl(re))return ao(Ce,Ee,Ye,"word-limit",K.maxWords);let It=as(G,Je.braceIndex+1,j,K,re,oe+1,"}"),Mt=It.next,Nt={start:Je.braceIndex+1,end:It.closed?Mt-1:Mt},ft=Wu(G,Nt,It);if(Ce.push({kind:"function",name:Je.name,span:{start:Ye,end:Mt},body:ft}),Ee.push(...It.issues),It.pendingHeredocs.length>0||Qo(It.nodes))Ee.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(De.push(...It.pendingHeredocs),It.limited)return ss(Ce,Ee,It.next);if(!It.closed)Ee.push({code:"unclosed-function-body",message:"function body is not closed"});Ye=Mt;continue}let Qe=ls(G,Ye);if(Qe){if(Xe(),!Ju(Ce.at(-1)))Ee.push({code:"unexpected-connector",message:`connector ${Qe} has no preceding command`});Ce.push(Object.freeze({kind:"connector",operator:Qe,span:Object.freeze({start:Ye,end:Ye+Qe.length})})),Ye+=Qe.length;continue}if(Ze===")"){Xe(),Ee.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Ce.push({kind:"unknown",source:Ze,span:{start:Ye,end:Ye+1}}),Ye++;continue}if((Ze==="("||Ze==="{"&&TC(G,Ye,j))&&ke.start===-1){if(yl(Ce,Ee),oe>=K.maxDepth)return ao(Ce,Ee,Ye,"depth-limit",K.maxDepth);let It=Ze==="("?")":"}",Mt=as(G,Ye+1,j,K,re,oe+1,It),Nt=Mt.next,ft={start:Ye+1,end:Mt.closed?Nt-1:Nt},Ot=Wu(G,ft,Mt);if(Ce.push({kind:"group",style:Ze==="("?"subshell":"brace",span:{start:Ye,end:Nt},body:Ot}),Ee.push(...Mt.issues),Mt.pendingHeredocs.length>0||Qo(Mt.nodes))Ee.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(De.push(...Mt.pendingHeredocs),Mt.limited)return ss(Ce,Ee,Mt.next);if(!Mt.closed)Ee.push({code:Ze==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Ze} group is not closed`});Ye=Nt;continue}let et=(Ze==="<"||Ze===">")&&G[Ye+1]!=="("?CC(G,Ye):null;if(et){let It=ke.words.at(-1),Mt=It&&It.span.end===Ye&&/^[0-9]+$/.test(It.raw)?Number(It.raw):void 0;if(Mt!==void 0)ke.words.pop();let Nt=Mt===void 0?Ye:It?.span.start??Ye;ke.start=ke.start===-1?Ye:ke.start;let ft=Ye+et.length;while(ft<j&&/[ \t]/.test(G[ft]??""))ft++;let Ot=G[ft],zt=ft>Ye+et.length&&Ot==="#",on=!Ot||Jo(Ot)||!!ls(G,ft)||Ot===de||Ot===")"||zt||(Ot==="<"||Ot===">")&&G[ft+1]!=="(",_r=et==="<<"||et==="<<-",Kt=_r?pl(G,ft,j):void 0,Ut=Kt?{word:so(G,ft,Kt.next,Kt.delimiter,"literal",Kt.quoted),nested:[],issues:[],next:Kt.next,limited:!1}:!on?bl(G,ft,j,K,re,oe):void 0;if(Ut){if(Ee.push(...Ut.issues),Ut.limited)return ss(Ce,Ee,Ut.next);if(!hl(re))return ao(Ce,Ee,Ut.next,"word-limit",K.maxWords)}let mn=Ut?.next??Ye+et.length,en={kind:"redirection",operator:et,span:{start:Nt,end:mn},...Mt===void 0?{}:{fd:Mt},...Ut?{target:Ut.word}:{}};if(ke.redirections.push(en),_r&&!Kt)Ee.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Kt){if(Kt.ambiguous||Kt.delimiter.length===0)Ee.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let tn=ke.nested;De.push({delimiter:Kt.delimiter,quotedDelimiter:Kt.quoted,stripTabs:et==="<<-",attach:(_n)=>{if(en.heredoc=_n,_n.quotedDelimiter)return;let Qn=yC(G,_n.bodySpan.start,_n.bodySpan.end,K,re,oe+1);tn.push(...Qn.programs),Ee.push(...Qn.issues)}})}if(!_r&&!Ut)Ee.push({code:"missing-redirection-target",message:`redirection ${et} requires a target word`});if(Ut)ke.nested.push(...Ut.nested);ke.end=mn,Ye=mn;continue}let mt=ke.start===-1;if(mt)yl(Ce,Ee);let Rt=bl(G,Ye,j,K,re,oe);if(Ee.push(...Rt.issues),Rt.limited)return ss(Ce,Ee,Rt.next);let gt=OC(ke.words)?WC(G,Rt.word,re.maxWords-re.wordsUsed,K.maxDepth,K.maxInputLength):void 0;if(gt?.limitCode)return ao(Ce,Ee,Rt.next,gt.limitCode,gt.limitCode==="word-limit"?K.maxWords:gt.limitCode==="depth-limit"?K.maxDepth:K.maxInputLength);let _t=gt?.words??[Rt.word];for(let It of _t){if(!hl(re))return ao(Ce,Ee,Rt.next,"word-limit",K.maxWords);ke.words.push(It)}if(ke.start=ke.start===-1?Ye:ke.start,ke.end=Rt.next,ke.nested.push(...Rt.nested),mt&&Qu(Rt.word))Xe();Ye=Rt.next>Ye?Rt.next:Ye+1}return Xe(),zu(Ce,Ee),Ee.push(...UC(De)),{nodes:Ce,issues:Ee,next:Ye,closed:de===void 0,limited:!1,pendingHeredocs:[]}}function Wu(G,U,j){return{kind:"program",dialect:"posix",source:G.slice(U.start,U.end),span:U,status:cs(j.issues,j.limited),issues:j.issues,nodes:j.nodes}}function bl(G,U,j,K,re,oe){let de="",Ce=U,Ee=!1,ke="literal",De=[],Xe=[],Ye=!1;while(Ce<j){let Ze=G[Ce],Je=(Ze==="<"||Ze===">")&&G[Ce+1]==="(";if(!Ze||Jo(Ze)||(Ze===";"||Ze==="|"||Ze==="&")&&ls(G,Ce)||(Ze==="<"||Ze===">")&&!Je)break;if(Ze===")")break;if(Ze==="'"){Ee=!0;let mt=G.indexOf("'",Ce+1);if(mt===-1||mt>=j){de+=G.slice(Ce+1,j),Xe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Ce=j;break}de+=G.slice(Ce+1,mt),Ce=mt+1;continue}if(Ze==='"'){Ee=!0;let mt=hC(G,Ce,j,K,re,oe);if(de+=mt.text,De.push(...mt.nested),Xe.push(...mt.issues),Ye||=mt.limited,ke=Xo(ke,mt.provenance),Ce=mt.next,Ye)break;continue}if(G.startsWith("$'",Ce)){Ee=!0;let mt=wC(G,Ce+2,j);if(de+=mt.text,Xe.push(...mt.issues),!mt.closed)Xe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Ce=mt.next;continue}if(Ze==="\\"){let mt=G[Ce+1];if(!mt){Xe.push({code:"trailing-escape",message:"escape has no following character"}),Ce++;break}if(mt===`
-`){Ce+=2;continue}de+=mt,Ce+=2;continue}if(Dr(G,Ce))Xe.push(Mr);let Qe=Ze==="$"||Ze==="<"||Ze===">"||Ze==="`"?ei(G,Ce,j,K,re,oe):null,et=Qe?Sl(Qe,De,Xe):Vu(G,Ce,j,K,re,oe,De,Xe);if(et){if(et.provenance==="variable")de+=G.slice(Ce,et.next);if(Ye||=et.limited,ke=Xo(ke,et.provenance),Ce=et.next,Ye)break;continue}if(Ze==="$"){let mt=qu(G,Ce,j,de,ke);de=mt.text,ke=mt.provenance,Ce=mt.next;continue}if(Ze==="*"||Ze==="?"||Ze==="[")ke=Xo(ke,"glob");de+=Ze,Ce++}return{word:so(G,U,Ce,de,ke,Ee,ke==="literal"?void 0:PC(G,U,Ce)),nested:De,issues:Xe,next:Ce,limited:Ye}}function hC(G,U,j,K,re,oe){let de="",Ce="literal",Ee=[],ke=[],De=!1,Xe=U+1;while(Xe<j){let Ye=G[Xe];if(Ye==='"')return{text:de,provenance:Ce,nested:Ee,issues:ke,next:Xe+1,limited:De};if(Ye==="\\"&&G[Xe+1]){let Qe=G[Xe+1]??"";if(Qe===`
-`){Xe+=2;continue}if(Qe==="\r"&&G[Xe+2]===`
-`){Xe+=3;continue}de+=["$","`",'"',"\\"].includes(Qe)?Qe:`\\${Qe}`,Xe+=2;continue}if(Dr(G,Xe))ke.push(Mr);let Ze=ei(G,Xe,j,K,re,oe),Je=Ze?Sl(Ze,Ee,ke):Vu(G,Xe,j,K,re,oe,Ee,ke);if(Je){if(Je.provenance!=="command-substitution")de+=G.slice(Xe,Je.next);if(Xe=Je.next,De||=Je.limited,Ce=Xo(Ce,Je.provenance),De)return{text:de,provenance:Ce,nested:Ee,issues:ke,next:Xe,limited:De};continue}if(Ye==="$"){let Qe=qu(G,Xe,j,de,Ce);de=Qe.text,Ce=Qe.provenance,Xe=Qe.next;continue}de+=Ye??"",Xe++}return ke.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:de,provenance:Ce,nested:Ee,issues:ke,next:j,limited:De}}function ei(G,U,j,K,re,oe){let de=Hu(G,U);if(!de)return null;let{length:Ce,closing:Ee}=de,ke=Ee==="))",De=Ee==="`",Xe=G[U]==="<"||G[U]===">",Ye=vl(G,U+Ce,j,Ee),Ze=Ye===-1?j:Ye,Je=Ye===-1?j:Ye+Ee.length;if(oe>=K.maxDepth)return{program:$C(G,U+Ce,Ze,"depth-limit"),next:Je,provenance:ke?"arithmetic":"command-substitution"};if(ke){let _t=[],It=[],Mt=!1,Nt=U+Ce;while(Nt<Ze){let ft=ei(G,Nt,Ze,K,re,oe+1);if(!ft){if(Dr(G,Nt))It.push(Mr);Nt++;continue}if(_t.push(...ft.program.nodes),It.push(...ft.program.issues),Mt||=ft.program.status==="limited",Nt=ft.next,Mt)break}if(Ye===-1)It.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:bn({kind:"program",dialect:"posix",source:G.slice(U+Ce,Ze),span:{start:U+Ce,end:Ze},status:cs(It,Mt),issues:It,nodes:_t}),next:Je,provenance:"arithmetic"}}let Qe=as(G,U+Ce,Ze,K,re,oe+1),et=Ye===-1?[{code:"unclosed-command-substitution",message:`${G.slice(U,U+Ce)} substitution is not closed`}]:[],mt=(De||Xe)&&Qo(Qe.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],Rt=De&&/\\[\\$`\n]/.test(G.slice(U+Ce,Ze))?[xC]:[],gt=[...Qe.issues,...et,...mt,...Rt];return{program:bn({kind:"program",dialect:"posix",source:G.slice(U+Ce,Ze),span:{start:U+Ce,end:Ze},status:cs(gt,Qe.limited),issues:gt,nodes:Qe.nodes}),next:Je,provenance:"command-substitution"}}function yC(G,U,j,K,re,oe){let de=[],Ce=[],Ee=U;while(Ee<j){let ke=G[Ee];if(ke==="\\"){Ee+=2;continue}let De=ke==="$"||ke==="`"?ei(G,Ee,j,K,re,oe):null;if(!De){if(Dr(G,Ee))Ce.push(Mr);Ee++;continue}if(de.push(De.program),SC(G,Ee,De.next)&&vC(De.program))Ce.push(Mr);Ee=De.next}return{programs:de,issues:Ce}}function Sl(G,U,j){return U.push(G.program),j.push(...G.program.issues),{provenance:G.provenance,next:G.next,limited:G.program.status==="limited"}}function vl(G,U,j,K){if(K==="`"){for(let Ce=U;Ce<j;Ce++){if(G[Ce]==="\\"){Ce++;continue}if(G[Ce]==="`")return Ce}return-1}let re={single:!1,double:!1},oe=[],de=[];for(let Ce=U;Ce<j;Ce++){let Ee=G[Ce];if((Ee===`
-`||Ee==="\r")&&de.length>0){let Xe=Ee==="\r"&&G[Ce+1]===`
-`?Ce+2:Ce+1,Ye=gl(G,Xe,j,de.splice(0));if(!Ye.terminated)return-1;Ce=Ye.next-1;continue}let ke=Uu(G,Ce,U,j,re);if(ke!==null){Ce=ke;continue}if(!re.double&&G.startsWith("$((",Ce)){let Xe=bC(G,Ce+3,j);if(Xe===-1)return-1;Ce=Xe+1;continue}if(K===")"&&!re.double&&Ee==="<"&&G[Ce+1]==="<"&&G[Ce+2]!=="<"){let Xe=G[Ce+2]==="-",Ye=Ce+(Xe?3:2);while(Ye<j&&/[ \t]/.test(G[Ye]??""))Ye++;let Ze=pl(G,Ye,j);if(Ze){de.push({delimiter:Ze.delimiter,quotedDelimiter:Ze.quoted,stripTabs:Xe,attach:()=>{return}}),Ce=Ze.next-1;continue}}if(G.startsWith("$(",Ce)&&!G.startsWith("$((",Ce)){oe.push(re),re={single:!1,double:!1},Ce++;continue}if(Ee==="("&&!re.double){oe.push(re),re={single:!1,double:!1};continue}if(Ee!==")"||re.double)continue;let De=oe.pop();if(De){re=De;continue}return K==="))"&&G[Ce+1]!==")"?-1:Ce}return-1}function bC(G,U,j){let K=1,re={single:!1,double:!1};for(let oe=U;oe<j;oe++){let de=G[oe],Ce=Uu(G,oe,U,j,re);if(Ce!==null){oe=Ce;continue}if(G.startsWith("$(",oe)&&!G.startsWith("$((",oe)){K++,oe++;continue}if(de==="("&&!re.double)K++;if(de!==")"||re.double)continue;if(K--,K===0)return G[oe+1]===")"?oe:-1}return-1}function Uu(G,U,j,K,re){let oe=G[U];if(oe==="\\"&&!re.single)return U+1;if(!re.double&&oe==="'")re.single=!re.single;if(!re.single&&oe==='"')re.double=!re.double;if(re.single)return U;if(re.double||oe!=="#"||!HC(G,U,j))return null;let de=U;while(de+1<K&&G[de+1]!==`
-`&&G[de+1]!=="\r")de++;return de}function ls(G,U){let j=G[U];if(j===";")return";";if(j==="&")return G[U+1]==="&"?"&&":"&";if(j==="|")return G[U+1]==="|"?"||":G[U+1]==="&"?"|&":"|";return null}function CC(G,U){let j=G[U];if(j===">"){if(G[U+1]===">")return">>";if(G[U+1]==="&")return">&";return G[U+1]==="|"?">|":">"}if(j!=="<")return null;if(G.startsWith("<<<",U))return"<<<";if(G.startsWith("<<-",U))return"<<-";if(G[U+1]==="<")return"<<";if(G[U+1]==="&")return"<&";if(G[U+1]===">")return"<>";return"<"}function Jo(G){let U=G.charCodeAt(0);if(U===32||U>=9&&U<=13)return!0;if(U<128)return!1;return/\s/u.test(G)}var Mr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Dr(G,U){if(G[U]!=="$")return!1;let j=Gu(G,U+1);if(G[j]!=="{")return!1;let K=G[Gu(G,j+1)]??"";return K==="|"||Jo(K)}function SC(G,U,j){for(let K=G.indexOf("$",U);K!==-1&&K<j;K=G.indexOf("$",K+1))if(Dr(G,K))return!0;return!1}function vC(G){return G?.status==="limited"||(G?.issues??[]).some((U)=>U.code===Mr.code)}function Gu(G,U){let j=U;while(G.startsWith("\\\n",j)||G.startsWith(`\\\r
-`,j))j+=G[j+1]==="\r"?3:2;return j}function Hu(G,U){if(G.startsWith("$((",U))return{length:3,closing:"))"};if(G.startsWith("$(",U)||G.startsWith("<(",U)||G.startsWith(">(",U))return{length:2,closing:")"};return G[U]==="`"?{length:1,closing:"`"}:null}var EC=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),ju=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),RC=/\$\(|`|[<>]\(/g;function _C(G,U,j){let K=Cl(j);return[...G.slice(U).matchAll(RC)].some((re)=>{let oe=U+re.index;return!K.some((de)=>oe>=de.start&&oe<de.end)})}function Cl(G){return G.flatMap((U)=>{if(U.kind==="command")return[...U.redirections.flatMap((j)=>j.heredoc?[j.heredoc.bodySpan]:[]),...U.nested.flatMap((j)=>Cl(j.nodes))];return U.kind==="group"||U.kind==="function"?Cl(U.body.nodes):[]})}var xC=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Vu(G,U,j,K,re,oe,de,Ce){if(G[U]!=="$"||G[U+1]!=="{")return null;let Ee=ds(G,U+2,j),ke=Ee.close===-1?j:Ee.close+1;if(Ee.close===-1)Ce.push(EC);if(Ee.quoted&&Ee.substitutions.length>0||Ee.continued)Ce.push(ju);if(Ee.quoted)re.quotedExpansionEnd=Math.min(re.quotedExpansionEnd,ke);let De=Ee.substitutions.some((Xe)=>{if(Dr(G,Xe))return Ce.push(Mr),!1;let Ye=ei(G,Xe,ke,K,re,oe);return Ye!==null&&Sl(Ye,de,Ce).limited});return{provenance:"variable",next:ke,limited:De}}function ds(G,U,j){let K=[],re=!1,oe=!1,de=1,Ce=U;while(Ce<j){let Ee=G[Ce];if(Ee==="$"&&Dr(G,Ce))K.push(Ce);if(Ee==="\\"||Ee==="'"||Ee==='"'){re=!0,oe||=Ee==="\\"&&G[Ce+1]===`
-`,Ce+=Ee==="\\"?2:1;continue}let ke=Hu(G,Ce);if(ke){K.push(Ce);let De=vl(G,Ce+ke.length,j,ke.closing);if(De===-1)break;Ce=De+ke.closing.length;continue}if(Ee==="$"&&G[Ce+1]==="{"){de++,Ce+=2;continue}if(Ee==="}"&&--de===0)return{close:Ce,substitutions:K,quoted:re,continued:oe};Ce++}return{close:-1,substitutions:K,quoted:re,continued:oe}}function Ku(G,U,j){if(G[U+1]==="{"){let re=ds(G,U+2,j).close;return re===-1?j:re+1}if(G[U+1]==="$")return U+2;let K=U+1;while(K<j&&/[A-Za-z0-9_?@#!*-]/.test(G[K]??""))K++;return K===U+1?U+1:K}function wC(G,U,j){let K="",re=[],oe=U;while(oe<j){let de=G[oe];if(de==="'")return{text:K,next:oe+1,closed:!0,issues:re};if(de!=="\\"){K+=de??"",oe++;continue}let Ce=AC(G,oe+1,j);if(K+=Ce.text,Ce.invalidCodePoint!==void 0)re.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Ce.invalidCodePoint}`});oe=Ce.next}return{text:K,next:j,closed:!1,issues:re}}function AC(G,U,j){let K=G[U];if(!K||U>=j)return{text:"\\",next:U};let re=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(re.has(K))return{text:re.get(K)??K,next:U+1};if(K==="x")return is(G,U+1,j,16,2,U+1);if(K==="u")return is(G,U+1,j,16,4,U+1);if(K==="U")return is(G,U+1,j,16,8,U+1);if(/[0-7]/.test(K))return is(G,U,j,8,3,U+1);return{text:K,next:U+1}}function is(G,U,j,K,re,oe){let de=K===16?/[0-9a-fA-F]/:/[0-7]/,Ce="",Ee=U;while(Ee<j&&Ce.length<re&&de.test(G[Ee]??""))Ce+=G[Ee],Ee++;if(!Ce)return{text:G[oe-1]??"",next:oe};let ke=Number.parseInt(Ce,K);return ke>1114111||ke>=55296&&ke<=57343?{text:"�",next:Ee,invalidCodePoint:ke}:{text:String.fromCodePoint(ke),next:Ee}}function cs(G,U=!1){if(U)return"limited";if(G.some((j)=>j.code==="invalid-ansi-c-code-point"||j.code==="missing-heredoc-delimiter"||j.code==="ambiguous-heredoc-delimiter"||j.code==="unterminated-heredoc"||j.code==="unsupported-heredoc-context"||j.code==="unsupported-function-substitution"||j.code==="unsupported-backtick-escape"||j.code==="unclosed-parameter-expansion"||j.code==="unsupported-parameter-expansion"))return"invalid";return G.length>0?"partial":"complete"}function qu(G,U,j,K,re){let oe=Ku(G,U,j);return{text:K+G.slice(U,oe),provenance:Xo(re,"variable"),next:oe}}function PC(G,U,j){let K=os(G),re=U,oe=!1,de=!1,Ce=U;while(Ce<j){let Ee=G[Ce];if(Ee==="\\"&&!oe){Ce+=2;continue}if(!de&&Ee==="'"){oe=!oe,Ce++;continue}if(!oe&&Ee==='"'){de=!de,Ce++;continue}if(oe){Ce++;continue}let ke=G.startsWith("$((",Ce),De=G.startsWith("$(",Ce)&&!ke,Xe=!de&&(G.startsWith("<(",Ce)||G.startsWith(">(",Ce)),Ye=Ee==="`";if(ke||De||Xe||Ye){let Ze=ke?3:Ye?1:2,Je=ke?"))":Ye?"`":")",Qe=vl(G,Ce+Ze,j,Je),et=Qe===-1?j:Qe+Je.length;K.push(re,Ce,"literal"),K.push(Ce,et,ke?"arithmetic":"command-substitution"),Ce=et,re=et;continue}if(Ee==="$"){let Ze=Ku(G,Ce,j);if(Ze>Ce+1){K.push(re,Ce,"literal"),K.push(Ce,Ze,"variable"),Ce=Ze,re=Ze;continue}}if(!de&&(Ee==="*"||Ee==="?"||Ee==="[")){K.push(re,Ce,"literal"),K.push(Ce,Ce+1,"glob"),Ce++,re=Ce;continue}Ce++}return K.push(re,j,"literal"),K.parts}function Xo(G,U){if(U==="command-substitution"||G==="command-substitution")return"command-substitution";if(U==="arithmetic"||G==="arithmetic")return"arithmetic";if(U==="variable"||G==="variable")return"variable";if(U==="glob"||G==="glob")return"glob";return G}function TC(G,U,j){return U+1>=j||Jo(G[U+1]??"")||ls(G,U+1)!==null}var IC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),kC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function OC(G){let U=0;while(U<=G.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(G[U]?.text??""))U++;if(U===G.length)return!0;let j=MC(G,U);if(j===void 0||j===null)return!1;U=j}return!1}function MC(G,U){let j=G[U]?.text.toLowerCase();if(j==="command")return DC(G,U);if(j==="env")return NC(G,U);if(j==="sudo")return LC(G,U);return}function DC(G,U){if(G[U+1]?.text==="-v")return null;for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(K==="-p"||K==="-v"||K==="-V"||/^-[pvV]+$/.test(K))continue;return j}return G.length}function NC(G,U){for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(IC.has(K)){if(G[j+1]===void 0)return null;j++;continue}if(K.startsWith("-u=")||K.startsWith("--unset=")||K.startsWith("-C")&&K.length>2||K.startsWith("--chdir=")||K.startsWith("-S")&&K.length>2||K.startsWith("--split-string=")||K.startsWith("-P"))continue;if(K.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(K))continue;return j}return G.length}function LC(G,U){for(let j=U+1;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return j+1;if(kC.has(K)){if(G[j+1]===void 0)return null;j++;continue}if(K.startsWith("-"))continue;return j}return G.length}function Yu(G,U,j,K){if(G.provenance!=="literal"||!G.raw.includes("{"))return;let re=Zu(G.raw,U,j,K,!0);if(!re)return;if("limited"in re)return{limited:!0};let oe=re.values.map((de)=>Xu(de,j));if(oe.some((de)=>de===null))return{limited:!0};return{words:[...new Set(oe.filter((de)=>de!==null&&de!==""))]}}function WC(G,U,j,K,re){if(U.provenance!=="literal"||!U.raw.includes("{"))return;let oe=Zu(U.raw,j,K,re,!1);if(!oe)return;if("limited"in oe){if(oe.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:oe.limited==="length"?"brace-expansion-limit":"word-limit"}}let de=oe.values.map((Ce)=>Xu(Ce,K));if(de.some((Ce)=>Ce===null))return;return{words:de.filter((Ce)=>Ce!==null&&Ce!=="").map((Ce)=>so(G,U.span.start,U.span.end,Ce,"literal",!1))}}function Zu(G,U,j,K,re){let oe=[G],de=G.length,Ce=0;while(!0){let Ee=oe.findIndex((Ze)=>Fu(Ze,re));if(Ee===-1)break;if(++Ce>j)return{limited:"expansions"};let ke=oe[Ee]??"",De=Fu(ke,re);if(!De||De.kind==="range")return{limited:"expansions"};let Xe=De.start+ke.length-De.end,Ye=De.alternatives.reduce((Ze,Je)=>Ze+Xe+Je.length,0);if(de-ke.length+Ye>K)return{limited:"length"};if(oe.length-1+De.alternatives.length>U)return{limited:"words"};oe.splice(Ee,1,...GC(ke,De)),de+=Ye-ke.length}return Ce===0?void 0:{values:oe}}function Fu(G,U){let j=[],K,re=null,oe=!1;for(let de=0;de<G.length;de++){let Ce=G[de];if(oe){oe=!1;continue}if(Ce==="\\"&&re!=="'"){oe=!0;continue}if(Ce===re){re=null;continue}if(re===null&&(Ce==="'"||Ce==='"')){re=Ce;continue}if(re!==null)continue;if(Ce==="{"){j.push({start:de,commas:[]});continue}if(Ce===","&&j.length>0){j.at(-1)?.commas.push(de);continue}if(Ce!=="}"||j.length===0)continue;let Ee=j.pop();if(!Ee)continue;let ke=Ee.commas.length>0?{kind:"alternatives",start:Ee.start,end:de+1,commas:Ee.commas}:U&&zC(G.slice(Ee.start+1,de))?{kind:"range",start:Ee.start,end:de+1}:void 0;if(ke&&(!K||ke.start<K.start))K=ke}if(!K||K.kind==="range")return K;return{kind:K.kind,start:K.start,end:K.end,alternatives:FC(G,K)}}function GC(G,U){return U.alternatives.map((j)=>`${G.slice(0,U.start)}${j}${G.slice(U.end)}`)}function FC(G,U){let j=[U.start,...U.commas,U.end-1];return j.slice(0,-1).map((K,re)=>G.slice(K+1,j[re+1]))}function zC(G){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(G)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(G)}function Xu(G,U){let j=`x${G}`,K=bl(j,0,j.length,{maxInputLength:j.length,maxWords:1,maxDepth:U},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(K.limited||K.issues.length>0||K.next!==j.length||K.word.provenance!=="literal")return null;return K.word.text.slice(1)}function $C(G,U,j,K){return bn({kind:"program",dialect:"posix",source:G.slice(U,j),span:{start:U,end:j},status:"limited",issues:[{code:K,message:"command structure exceeds parser limit"}],nodes:[]})}function ao(G,U,j,K,re){return{nodes:G,issues:[...U,{code:K,message:`command structure exceeds parser limit ${re}`}],next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function ss(G,U,j){return{nodes:G,issues:U,next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function hl(G){return G.wordsUsed++,G.wordsUsed<=G.maxWords}function BC(G,U,j){let K=G.slice(U,j),re=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(K)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(K),oe=re?.[1];if(!re||!oe)return;return{name:oe,braceIndex:U+re[0].lastIndexOf("{")}}function Qo(G){return G.some((U)=>{if(U.kind==="command")return U.redirections.some((j)=>j.heredoc)||U.nested.some((j)=>Qo(j.nodes));return(U.kind==="group"||U.kind==="function")&&Qo(U.body.nodes)})}function UC(G){return G.map((U)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${U.delimiter} was not found`}))}function Ju(G){return G?.kind==="command"||G?.kind==="group"||G?.kind==="function"}function zu(G,U){let j=G.at(-1);if(j?.kind!=="connector"||!$u.has(j.operator))return;U.push({code:"missing-command-after-connector",message:`connector ${j.operator} requires a following command`})}function Qu(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&gC.has(G.text)}function yl(G,U){let j=G.at(-1);if(!Ju(j))return;if(j?.kind==="command"&&Qu(j.words[0]))return;U.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function HC(G,U,j){return U===j||/[\s;&|()]/u.test(G[U-1]??"")}var tm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),jC=new Set(["gc","cat","type","cp","mv","rm"]),nm=["-rec","-for","-path","-literalpath","-whatif"],VC=/^\$env:\w/i,KC=/^(?:\$\{?\w+\}?|~)\\./;function rm(G,U){let j=G.toLowerCase().replaceAll("`","");if(![...tm].some((re)=>j.includes(re))&&!(j.includes("rm")&&nm.some((re)=>j.includes(re)))&&!j.includes("<#")&&!qC(j))return!1;let K=xl(G,U);if(om(K))return!1;return K.issues.some((re)=>re.code==="unclosed-block-comment"||re.code==="comment-depth-limit")||_l(K).some(YC)}function om(G){return G.nodes.some((U)=>{if(U.kind==="group")return om(U.body);if(U.kind!=="command")return!1;return U.redirections.some((j)=>j.operator==="<<")})}function qC(G){if(G.includes("$env:"))return!0;return G.includes("\\")&&(G.includes("$")||G.includes("~"))}function YC(G){let U=G[0]==="&"||G[0]==="."?1:0,j=G[U]?.toLowerCase();if(j&&tm.has(j))return!0;let K=G.slice(U+1);if(j&&jC.has(j)&&K.some(ZC))return!0;if(j!=="rm")return!1;return K.some((re)=>{let oe=re.toLowerCase().split(":",1)[0]??"";return nm.some((de)=>oe.startsWith(de))})}function ZC(G){return VC.test(G)||KC.test(G)}function xl(G,U){let j={start:0,end:G.length};if(G.length>U.maxInputLength)return bn({kind:"program",dialect:"powershell",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${U.maxInputLength} UTF-16 code units`}],nodes:[]});let K=wl(G,0,G.length,U,0);return bn({kind:"program",dialect:"powershell",source:G,span:j,status:tS(K.issues,K.limited),issues:K.issues,nodes:K.nodes})}function wl(G,U,j,K,re,oe=!1){let de=[],Ce=[],Ee=ns(),ke=0,De=!1,Xe=()=>{if(Ee.words.length===0&&Ee.redirections.length===0)return;let Ze={start:Ee.start,end:Ee.end};rs(de,Ee,{kind:"command",dialect:"powershell",source:G.slice(Ze.start,Ze.end),span:Ze,words:Ee.words,redirections:Ee.redirections,nested:Ee.nested,displayText:Ee.words.map((Je)=>Je.text).join(" ")})},Ye=U;while(Ye<j){let Ze=G[Ye];if(!Ze)break;if(oe&&Ze==="}")return Xe(),{nodes:de,issues:Ce,next:Ye+1,closed:!0,words:ke,limited:De};let Je=eS(G,Ye,j,K.maxDepth);if(Je){if(Je.issue)Ce.push(Je.issue);if(Je.limited)return Xe(),{nodes:de,issues:Ce,next:Je.next,closed:!1,words:ke,limited:!0};Ye=Je.next;continue}if(/\s/.test(Ze)){if(Ze==="\r"||Ze===`
-`){Xe();let mt=Ze==="\r"&&G[Ye+1]===`
-`?Ye+2:Ye+1;de.push(El(G,Ye,mt)),Ye=mt;continue}Ye++;continue}let Qe=am(G,Ye);if(Qe){Xe(),de.push(El(G,Ye,Ye+Qe.length)),Ye+=Qe.length;continue}if(Ze==="{"){if(Xe(),re>=K.maxDepth)return Ce.push(sm(K.maxDepth)),{nodes:de,issues:Ce,next:j,closed:!1,words:ke,limited:!0};let mt=wl(G,Ye+1,j,K,re+1,!0),Rt=mt.closed?mt.next-1:mt.next,gt=bn({kind:"program",dialect:"powershell",source:G.slice(Ye+1,Rt),span:{start:Ye+1,end:Rt},status:mt.limited?"limited":mt.issues.length>0?"partial":"complete",issues:mt.issues,nodes:mt.nodes});if(de.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:Ye,end:mt.next}),body:gt})),Ce.push(...mt.issues),!mt.closed)Ce.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ke+=mt.words,De||=mt.limited,Ye=mt.next;continue}if(Ze==="}"){Xe(),de.push(El(G,Ye,Ye+1)),Ye++;continue}if(Ze===">"||Ze==="<"){Ee.start=Ee.start===-1?Ye:Ee.start;let mt=G[Ye+1]===Ze?Ye+2:Ye+1,Rt=mt;while(/[ \t]/.test(G[Rt]??""))Rt++;let gt=Rt<j?em(G,Rt,j,K,re):void 0,_t=gt?.next??mt;if(Ee.redirections.push(Object.freeze({kind:"redirection",operator:G.slice(Ye,mt),span:Object.freeze({start:Ye,end:_t}),...gt?{target:gt.word}:{}})),gt)Ce.push(...gt.issues),Ee.nested.push(...gt.nested),ke+=gt.words,De||=gt.limited;Ee.end=_t,Ye=_t;continue}if(Ze===","){Ee.start=Ee.start===-1?Ye:Ee.start,Ee.words.push(fl({text:",",raw:",",span:{start:Ye,end:Ye+1},provenance:"literal",quoted:!1})),Ee.end=++Ye;continue}let et=em(G,Ye,j,K,re);if(Ee.start=Ee.start===-1?Ye:Ee.start,Ee.end=et.next,Ee.words.push(et.word),Ce.push(...et.issues),Ee.nested.push(...et.nested),ke+=1+et.words,De||=et.limited,ke>K.maxWords)return Ce.push({code:"word-limit",message:`command exceeds ${K.maxWords} words`}),Xe(),{nodes:de,issues:Ce,next:et.next,closed:!1,words:ke,limited:!0};Ye=et.next>Ye?et.next:Ye+1}return Xe(),{nodes:de,issues:Ce,next:Ye,closed:!oe,words:ke,limited:De}}function em(G,U,j,K,re){let oe="",de="literal",Ce=!1,Ee=[],ke=[],De=0,Xe=!1,Ye=(Je)=>{let Qe=XC(G,Je,j,K,re);return oe+=G.slice(Je,Qe.next),ke.push(Qe.program),Ee.push(...Qe.program.issues),De+=Rl(Qe.program),Xe||=Qe.program.status==="limited",de="command-substitution",Qe.next},Ze=U;while(Ze<j){let Je=G[Ze];if(!Je||/\s/.test(Je)||am(G,Ze)||Je===">"||Je==="<"||Je==="#")break;if(Je===",")break;if(Je==="`"){let Qe=G[Ze+1];if(!Qe){Ee.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Ze++;break}oe+=Qe,Ze+=2;continue}if(G.startsWith("$(",Ze)){Ze=Ye(Ze);continue}if(Je==="'"){Ce=!0,Ze++;let Qe=!1;while(Ze<G.length){if(G[Ze]==="'"&&G[Ze+1]==="'"){oe+="'",Ze+=2;continue}if(G[Ze]==="'"){Qe=!0,Ze++;break}oe+=G[Ze]??"",Ze++}if(!Qe)Ee.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Je==='"'){Ce=!0,Ze++;let Qe=!1;while(Ze<j){let et=G[Ze];if(et==="`"&&G[Ze+1]){oe+=G[Ze+1],Ze+=2;continue}if(et==='"'){Qe=!0,Ze++;break}if(G.startsWith("$(",Ze)){Ze=Ye(Ze);continue}if(et==="$")de=G[Ze+1]==="("?"command-substitution":"variable";oe+=et??"",Ze++}if(!Qe)Ee.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Je==="$")de=G[Ze+1]==="("?"command-substitution":"variable";if(Je==="@"&&Ze===U)de="variable";oe+=Je,Ze++}return{word:so(G,U,Ze,oe,de,Ce,de==="literal"?void 0:JC(G,U,Ze)),next:Ze,issues:Ee,nested:ke,words:De,limited:Xe}}function XC(G,U,j,K,re){let oe=im(G,U+2,j),de=oe===-1?j:oe,Ce=oe===-1?j:oe+1;if(re>=K.maxDepth)return{program:bn({kind:"program",dialect:"powershell",source:G.slice(U+2,de),span:{start:U+2,end:de},status:"limited",issues:[sm(K.maxDepth)],nodes:[]}),next:Ce};let Ee=wl(G,U+2,de,K,re+1),ke=oe===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:bn({kind:"program",dialect:"powershell",source:G.slice(U+2,de),span:{start:U+2,end:de},status:Ee.limited?"limited":Ee.issues.length+ke.length>0?"partial":"complete",issues:[...Ee.issues,...ke],nodes:Ee.nodes}),next:Ce}}function im(G,U,j){let K=1,re=!1,oe=!1;for(let de=U;de<j;de++){let Ce=G[de];if(Ce==="`"){de++;continue}if(!oe&&Ce==="'"){if(re&&G[de+1]==="'"){de++;continue}re=!re;continue}if(!re&&Ce==='"'){oe=!oe;continue}if(re)continue;if(G.startsWith("$(",de)){K++,de++;continue}if(!oe&&Ce==="(")K++;if(Ce!==")")continue;if(K--,K===0)return de}return-1}function Rl(G){let U=0;for(let j of G.nodes){if(j.kind==="group")U+=Rl(j.body);if(j.kind==="command"){U+=j.words.length;for(let K of j.nested)U+=Rl(K)}}return U}function JC(G,U,j){let K=os(G),re=U,oe=!1,de=U;while(de<j){let Ce=G[de];if(Ce==="`"){de+=2;continue}if(Ce==="'"){if(oe&&G[de+1]==="'"){de+=2;continue}oe=!oe,de++;continue}if(oe){de++;continue}if(G.startsWith("$(",de)){let Ee=im(G,de+2,j),ke=Ee===-1?j:Ee+1;K.push(re,de,"literal"),K.push(de,ke,"command-substitution"),de=ke,re=ke;continue}if(Ce==="$"||Ce==="@"&&de===U){let Ee=QC(G,de+1,j);K.push(re,de,"literal"),K.push(de,Ee,"variable"),de=Ee,re=Ee;continue}de++}return K.push(re,j,"literal"),K.parts}function QC(G,U,j){if(G[U]==="{"){let re=G.indexOf("}",U+1);return re===-1||re>=j?j:re+1}let K=U;while(K<j&&/[A-Za-z0-9_:?]/.test(G[K]??""))K++;return K}function sm(G){return{code:"depth-limit",message:`command structure exceeds parser limit ${G}`}}function _l(G){return G.nodes.flatMap((U)=>{if(U.kind==="group")return _l(U.body);if(U.kind!=="command")return[];return[[...U.words,...U.redirections.flatMap((j)=>j.target?[j.target]:[])].sort((j,K)=>j.span.start-K.span.start).filter((j)=>j.text!==""&&j.raw!==",").map((j)=>j.text),...U.nested.flatMap(_l)]})}function am(G,U){for(let j of["&&","||",";","|"])if(G.startsWith(j,U))return j;return null}function eS(G,U,j,K){if(G[U]==="#"&&G[U+1]!==">"){let de=U+1;while(de<j&&G[de]!=="\r"&&G[de]!==`
-`)de++;return{next:de,limited:!1}}if(!G.startsWith("<#",U))return null;let re=1,oe=U+2;while(oe<j){if(G.startsWith("<#",oe)){if(re++,re>K)return{next:j,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${K}`},limited:!0};oe+=2;continue}if(G.startsWith("#>",oe)){if(re--,oe+=2,re===0)return{next:oe,limited:!1};continue}oe++}return{next:j,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function tS(G,U){if(U)return"limited";if(G.some((j)=>j.code==="unclosed-block-comment"))return"invalid";return G.length>0?"partial":"complete"}function El(G,U,j){return Object.freeze({kind:"connector",operator:G.slice(U,j),span:Object.freeze({start:U,end:j})})}function y(G,U="auto",j=fr){if(U==="powershell"||U==="auto"&&rm(G.slice(0,j.maxInputLength),j))return xl(G,j);return Bu(G,j)}function t(G){return G.provenance==="command-substitution"?G.raw:G.text}function ne(G,U){return G==="posix"?U:Xt(U.map((j)=>j.text))}function lo(G,U){return G&&G.provenance!=="unknown"?G.provenance==="literal":!/[$`*?[\]]/.test(U)}function Xt(G){return G.map((U)=>({kind:"word",text:U,raw:U,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Al(G,U){return{value:G,work:U}}function Pt(G,U){if(G.work)G.work.units=Math.min(Number.MAX_SAFE_INTEGER,G.work.units+1);return G.value[U]}function Qt(G){return G.value.length}function ti(G,U,j=1){if(G)G.units=Math.min(Number.MAX_SAFE_INTEGER,G.units+U.length*j)}function Pn(G,U){ti(G,U)}function Nr(G){if(!G)return!1;let U=G.charCodeAt(0);return U>=48&&U<=57||U>=65&&U<=90||U===95||U>=97&&U<=122}function Yt(G){if(!G)return!1;let U=G.charCodeAt(0);return U===9||U===10||U===11||U===12||U===13||U===32||U===160||U===65279||U===5760||U>=8192&&U<=8202||U===8232||U===8233||U===8239||U===8287||U===12288}function Pl(G){return G===`
-`||G==="\r"||G==="\u2028"||G==="\u2029"}function Zt(G,U,j){if(U+j.length>Qt(G))return!1;for(let K=0;K<j.length;K++)if(Pt(G,U+K)!==j[K])return!1;return!0}function nr(G,U,j){return!Nr(Pt(G,U-1))&&Zt(G,U,j)&&!Nr(Pt(G,U+j.length))}function rr(G,U){return Nr(Pt(G,U-1))!==Nr(Pt(G,U))}function cn(G){return G===`
-`||G===";"||G==="&"||G==="|"}function co(G){return G==="|"||G===";"}function us(G,U,j){let K=Al(G,j);if(U==="rm")return nS(K);if(U==="dd")return oS(K);return fm(K,!0)}function ms(G,U,j){let K=Al(G,j);if(U==="rm")return iS(K);if(U==="reset-hard")return um(K,"--ha","rd");if(U==="reset-merge")return um(K,"--me","rge");if(U==="clean")return cS(K);if(U==="checkout")return uS(K);if(U==="push-force")return mS(K);if(U==="push-refspec")return fS(K);if(U==="push-delete")return pS(K);if(U==="branch")return gS(K);if(U==="tag")return bS(K);if(U==="restore")return CS(K);return fm(K,!1)}function nS(G){let U=!1,j=!1,K=!1,re=-1;for(let oe=0;oe<=Qt(G);oe++){let de=Pt(G,oe);if(!U){let Ee=Pt(G,oe+2);if(nr(G,oe,"rm")&&Yt(Ee)&&Ee!==`
-`)U=!0,oe++;continue}let Ce=rS(G,oe);if(de===`
-`||Ce!==-1){if(U=!1,j=!1,K=!1,re=-1,Ce!==-1)oe=Ce-1;continue}if(de===";"||de==="&"||de==="|"||oe===Qt(G)){if(re>=0){let Ee=lm(G,re,oe);j||=Ee.recursive,K||=Ee.force}if(j&&K)return!0;U=!1,j=!1,K=!1,re=-1;continue}if(Yt(de)){if(re<0)continue;if(Zt(G,re,"--")&&oe-re===2){U=!1,j=!1,K=!1,re=-1;continue}let Ee=lm(G,re,oe);if(j||=Ee.recursive,K||=Ee.force,j&&K)return!0;re=-1;continue}if(re<0)re=oe}return!1}function rS(G,U){if(Pt(G,U)!=="\\"||Pt(G,U-1)==="\\")return-1;if(Zt(G,U,String.raw`\n`))return U+2;if(Zt(G,U,String.raw`\x0a`)||Zt(G,U,String.raw`\x0A`))return U+5;if(Zt(G,U,String.raw`\u000a`)||Zt(G,U,String.raw`\u000A`))return U+7;return Zt(G,U,String.raw`\012`)?U+4:-1}function lm(G,U,j){if(cm(G,U,j,"recursive"))return{recursive:!0,force:!1};if(cm(G,U,j,"force"))return{recursive:!1,force:!0};if(Pt(G,U)!=="-"||Pt(G,U+1)==="-")return{recursive:!1,force:!1};let K=!1,re=!1;for(let oe=U+1;oe<j;oe++){let de=Pt(G,oe);K||=de==="r"||de==="R",re||=de==="f"||de==="F"}return{recursive:K,force:re}}function cm(G,U,j,K){let re=j-U-2;if(re<1||re>K.length||!Zt(G,U,"--"))return!1;for(let oe=0;oe<re;oe++)if(Pt(G,U+oe+2)!==K[oe])return!1;return!0}function oS(G){let U=!1;for(let j=0;j<Qt(G);j++){if(cn(Pt(G,j))){U=!1;continue}if(nr(G,j,"dd")){U=!0,j++;continue}if(!U||!nr(G,j,"of")||!Zt(G,j,"of=/dev/"))continue;let K=j+8;if(K<Qt(G)&&!Yt(Pt(G,K))&&Pt(G,K)!=="'"&&Pt(G,K)!=='"')return!0}return!1}function iS(G){let U=!1,j=!1,K=!1;for(let re=0;re<=Qt(G);){let oe=Pt(G,re);if(re===Qt(G)||cn(oe)){U=!1,j=!1,K=!1,re++;continue}let de=aS(G,re);if(de>=0){if(sS(G,de))return!0;let Ce=de,Ee=!1;while(Yt(Pt(G,Ce)))Ee||=Pt(G,Ce)===`
-`,Ce++;if(Ee)j=!1,K=!1;U=!0,re=Ce;continue}if(!U){re++;continue}if(Zt(G,re,"--")&&(re===0||Yt(Pt(G,re-1)))&&(!Pt(G,re+2)||Yt(Pt(G,re+2))||cn(Pt(G,re+2)))){U=!1,j=!1,K=!1,re+=2;continue}if(j||=Zt(G,re,"--recursive")&&rr(G,re+11)||Tl(G,re,"recursive"),K||=Zt(G,re,"--force")&&rr(G,re+7)||Tl(G,re,"force"),j&&K)return!0;re++}return!1}function Tl(G,U,j){if(!Zt(G,U,"--"))return!1;let K=0;while(K<=j.length){let re=Pt(G,U+K+2);if(!re||Yt(re)||cn(re))break;if(re!==j[K])return!1;K++}return K>0&&rr(G,U+K+2)}function sS(G,U){let j=U,K=!1,re=!1;while(j<Qt(G)){while(Yt(Pt(G,j)))j++;let oe=j;while(j<Qt(G)&&!Yt(Pt(G,j)))j++;if(Pt(G,oe)!=="-"||j-oe===2&&Zt(G,oe,"--"))return!1;let de=dm(G,oe,"recursive"),Ce=dm(G,oe,"force");if(K&&Ce||re&&de)return!0;if(K||=de,re||=Ce,Pt(G,oe+1)==="-")continue;let Ee=lS(G,oe,j);if(Ee.combined||K&&Ee.forceAtBoundary||re&&Ee.recursiveAtBoundary)return!0;K||=Ee.recursive,re||=Ee.force}return!1}function dm(G,U,j){return Zt(G,U,`--${j}`)&&rr(G,U+j.length+2)||Tl(G,U,j)}function aS(G,U){if(U>0&&Nr(Pt(G,U-1)))return-1;let j=U;if(Pt(G,j)==="\\")j++;if(Pt(G,j)!=="r")return-1;if(j++,Pt(G,j)==="\\")j++;if(Pt(G,j)!=="m"||!Yt(Pt(G,j+1)))return-1;return j+1}function lS(G,U,j){let K=!1,re=!1,oe=!1,de=!1,Ce=!1;if(Pt(G,U)!=="-")return{recursive:K,force:re,recursiveAtBoundary:oe,forceAtBoundary:de,combined:Ce};let Ee="";for(let ke=U+1;ke<j;ke++){let De=Pt(G,ke)??"",Xe=(De==="r"||De==="f")&&rr(G,ke+1);K||=De==="r",re||=De==="f",oe||=De==="r"&&Xe,de||=De==="f"&&Xe,Ce||=(Ee==="r"&&De==="f"||Ee==="f"&&De==="r")&&Xe,Ee=De}return{recursive:K,force:re,recursiveAtBoundary:oe,forceAtBoundary:de,combined:Ce}}function um(G,U,j){return ri(G,"reset",co,!0,(K)=>Pt(G,K)==="-"&&uo(G,K,U,j)?!0:K)}function cS(G){return ri(G,"clean",co,!0,(U)=>{if(Pt(G,U)!=="-")return U;if(uo(G,U,"--fo","rce"))return!0;let j=ni(G,U,co);for(let K=U+1;K<j;K++)if(Pt(G,K)==="f")return!0;return j-1})}function fs(G,U,j){if(!nr(G,U,"git"))return null;let K=U+3;if(!Yt(Pt(G,K)))return{commandEnd:-1,next:K};while(Yt(Pt(G,K)))K++;while(K<Qt(G)){if(cn(Pt(G,K)))return{commandEnd:-1,next:K};let re=ni(G,K,cn);if(nr(G,K,j))return{commandEnd:K+j.length,next:re};if(Pt(G,K)!=="-")return{commandEnd:-1,next:re};let oe=re-K===2&&Zt(G,K,"--"),de=dS(G,K,re);K=re;while(Yt(Pt(G,K)))K++;if(oe)return{commandEnd:nr(G,K,j)?K+j.length:-1,next:ni(G,K,cn)};if(!de)continue;if(K>=Qt(G)||cn(Pt(G,K)))return{commandEnd:-1,next:K};K=ni(G,K,cn);while(Yt(Pt(G,K)))K++}return{commandEnd:-1,next:K}}function dS(G,U,j){for(let K of xn)if(j-U===K.length&&Zt(G,U,K))return!0;return!1}function uS(G){return mm(G,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function mS(G){return ri(G,"push",co,!0,(U)=>{if(Pt(G,U)!=="-")return U;if(Pt(G,U+1)==="f"&&!Nr(Pt(G,U+2))&&!Zt(G,U+2,"-with-lease"))return!0;let j=pm(G,U,"--fo","rce");if(j>=0&&!Zt(G,j,"-with-lease"))return!0;return U})}function fS(G){return ri(G,"push",cn,!1,(U)=>{if(Yt(Pt(G,U))&&Pt(G,U+1)==="+"&&U+2<Qt(G)&&!cn(Pt(G,U+2))&&!Yt(Pt(G,U+2)))return!0;if(Pt(G,U)===":"&&Pt(G,U+1)==="+")return!0;return U})}function pS(G){return ri(G,"push",cn,!1,(U)=>{if(Pt(G,U)==="-"&&uo(G,U,"--de","lete"))return!0;if(Yt(Pt(G,U))&&Pt(G,U+1)===":"&&U+2<Qt(G)&&!Yt(Pt(G,U+2))&&!cn(Pt(G,U+2)))return!0;return U})}function gS(G){let U=!1,j=!1,K=!1;for(let re=0;re<=Qt(G);re++){if(re===Qt(G)||cn(Pt(G,re))){if(j&&K)return!0;U=!1,j=!1,K=!1;continue}if(!U){let Ce=fs(G,re,"branch");if(Ce){U=Ce.commandEnd>=0,re=Math.max(re,(U?Ce.commandEnd:Ce.next)-1);continue}}if(!U||Pt(G,re)!=="-")continue;let oe=ni(G,re,cn),de=hS(G,re,oe);if(j||=de.deletion,K||=de.force,j&&K)return!0;re=oe-1}return!1}function hS(G,U,j){let K=!1,re=!1;for(let oe=U;oe<j;oe++){if(Pt(G,oe)!=="-")continue;if(uo(G,oe,"--de","lete"))K=!0;if(uo(G,oe,"--fo","rce"))re=!0;if(Pt(G,oe+1)==="-")continue;let de=oe+1,Ce=!1,Ee=!1,ke=!1;while(de<j&&yS(Pt(G,de))){let De=Pt(G,de);Ce||=De==="d"||De==="D",Ee||=De==="f",ke||=De==="D",de++}if(!rr(G,de))continue;K||=Ce,re||=Ee||ke}return{deletion:K,force:re}}function yS(G){if(!G)return!1;let U=G.charCodeAt(0);return U>=65&&U<=90||U>=97&&U<=122}function bS(G){return mm(G,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function mm(G,U){let j=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let K=0;K<Qt(G);K++){let re=Pt(G,K),oe=j[j.length-1];if(!oe)return!1;let de=oe.escaped;if(oe.escaped=!de&&oe.quote!=="'"&&re==="\\",!de&&re==="'"&&oe.quote!=='"')oe.quote=oe.quote==="'"?"":"'";if(!de&&re==='"'&&oe.quote!=="'")oe.quote=oe.quote==='"'?"":'"';if(re==="$"&&Pt(G,K+1)==="("&&(j.length===1||!de&&oe.quote!=="'")){j.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),K++;continue}if(!de&&!oe.quote&&j.length>1&&re==="("){oe.depth++;continue}if(!de&&!oe.quote&&j.length>1&&re===")"){if(oe.depth--,oe.depth===0)j.pop();continue}if(Yt(re))oe.shortActive=!1,oe.hasShortFlag=!1;if(!oe.outerActive){let Ce=fs(G,K,U.command);if(Ce){oe.outerActive=Ce.commandEnd>=0&&Yt(Pt(G,Ce.commandEnd)),oe.shortActive=!1,oe.hasShortFlag=!1,K=Math.max(K,(oe.outerActive?Ce.commandEnd:Ce.next)-1);continue}}if(oe.outerActive&&re==="-"){if(uo(G,K,U.longPrefix,U.longOptional))return!0;oe.shortActive||=!U.excludedShortStarts.includes(Pt(G,K+1)??"")}if(oe.hasShortFlag||=oe.shortActive&&re===U.shortFlag,oe.hasShortFlag&&rr(G,K+1))return!0;if(co(re))oe.outerActive=!1}return!1}function ri(G,U,j,K,re){let oe=!1;for(let de=0;de<Qt(G);de++){let Ce=Pt(G,de),Ee=j(Ce);if(!oe&&!Ee){let ke=fs(G,de,U);if(ke){oe=ke.commandEnd>=0&&(!K||Yt(Pt(G,ke.commandEnd))),de=Math.max(de,(oe?ke.commandEnd:ke.next)-1);continue}}if(oe){let ke=re(de);if(ke===!0)return!0;for(let De=de;De<=ke;De++)if(j(Pt(G,De)))oe=!1;de=ke}if(Ee)oe=!1}return!1}function CS(G){let U=!1;for(let j=0;j<Qt(G);j++){if(Pl(Pt(G,j))){if(U)return!0;U=!1;continue}if(!U){let K=fs(G,j,"restore");if(K){U=K.commandEnd>=0,j=Math.max(j,(U?K.commandEnd:K.next)-1);continue}}if(U&&Pt(G,j)==="-"&&Pt(G,j+1)==="-"&&(Zt(G,j+2,"staged")||Zt(G,j+2,"help")))U=!1}return U}function fm(G,U){let j=!1;for(let K=0;K<Qt(G);K++){let re=Pt(G,K),oe=U?Pl(re):cn(re);if(j&&Yt(re)&&Pt(G,K+1)==="-"&&nr(G,K+2,"delete"))return!0;if(oe){j=!1;continue}if(nr(G,K,"find"))j=!0,K+=3}return!1}function ni(G,U,j){let K=U;while(K<Qt(G)&&!Yt(Pt(G,K))&&!j(Pt(G,K)))K++;return K}function pm(G,U,j,K){if(!Zt(G,U,j))return-1;let re=U+j.length;for(let oe=0;oe<K.length&&Pt(G,re)===K[oe];oe++)re++;return rr(G,re)?re:-1}function uo(G,U,j,K){return pm(G,U,j,K)>=0}function Nn(G,U){ti(U,G,2);let j=G.toLowerCase(),K=j.trimStart(),re=K.startsWith("echo ")||K.startsWith("rg "),oe=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let de of oe){if(de.skipForEchoRg&&re)continue;let Ce=de.caseSensitive?G:j;if(de.regex)Pn(U,Ce);if((de.regex?.test(Ce)??!1)||de.scan&&ms(Ce,de.scan,U))return At("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${de.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var SS=/^[A-Za-z_][A-Za-z0-9_]*=/;function hm(G,U,j){let K=G.words[0];if(!U||!K||G.words.length!==1||G.dialect!=="posix")return!1;if(!K.quoted||K.provenance!=="literal")return!1;let re=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(K.text)?.[1];if(!re)return!1;ti(j,U.source,2);let oe={anchored:new RegExp(`^\\$\\{?${re}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${re}(?![A-Za-z0-9_])`)};return ym(U.nodes,K,oe)}function ym(G,U,j){return G.every((K)=>{if(K.kind==="connector")return!0;if(K.kind==="group"||K.kind==="function")return ym(K.body.nodes,U,j);if(K.kind==="unknown")return!j.loose.test(K.source);return vS(K,U,j)})}function vS(G,U,j){if(G.nested.some((re)=>j.loose.test(re.source)))return!1;let K=G.words.findIndex((re)=>!SS.test(re.text));return G.words.every((re,oe)=>re===U||gm(re.raw,j.anchored,oe!==K))&&G.redirections.every((re)=>(!re.heredoc||re.heredoc.quotedDelimiter||!j.loose.test(re.heredoc.body))&&(!re.target||gm(re.target.raw,j.anchored,!0)))}function gm(G,U,j){let K=!1,re=!1;for(let oe=0;oe<G.length;oe++){let de=G[oe];if(de==="\\"&&!K){oe++;continue}if(!re&&de==="'"){K=!K;continue}if(!K&&de==='"'){re=!re;continue}if(K||de!=="$")continue;if(!U.test(G.slice(oe)))continue;if(!re||!j)return!1}return!0}var ES="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",RS="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",_S="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",xS="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",wS="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",AS=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),bm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,PS=new Set(["diskutil","wipefs","sgdisk","parted"]),TS=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),IS=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,kS=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),OS=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),MS=new Set(["i","b"]),DS=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,NS=new Set([">",">|",">>","<>",">&"]),LS=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Cm(G){return G==="dd"||G==="shred"||bm.test(G)||PS.has(G)}function WS(G,U){let j=U.some((K)=>K.startsWith("/dev/"));if(G==="diskutil"){let K=U.find((re)=>!re.startsWith("-"));return K!==void 0&&TS.has(K.toLowerCase())}if(G==="wipefs")return j&&U.some((K)=>IS.test(K));if(G==="sgdisk")return j&&U.some((K)=>K.startsWith("-")&&!GS(K));return G==="parted"&&j&&U.some((K)=>LS.has(K.toLowerCase()))}function GS(G){if(kS.has(G.split("=",1)[0]??G))return!0;if(G.startsWith("--"))return!1;let U=G.slice(1).split("");return MS.has(U[0]??"")||U.every((j)=>OS.has(j))}function Sm(G,U){let j=U.slice(1);if(G==="dd"&&j.some((K)=>/^of=\/dev\/.+/.test(K)&&!AS.has(K)))return At("dd.device-write",ES);if(bm.test(G)&&j.some((K)=>K.startsWith("/dev/")))return At("mkfs.device",RS);if(WS(G,j))return At("disk.erase",_S);if(G==="shred"&&j.length>0)return At("shred.target",wS);return null}function vm(G){return G.some((U)=>NS.has(U.operator)&&U.target?.provenance==="literal"&&DS.test(U.target.text))?At("redirect.block-device",xS):null}import{isAbsolute as FS,resolve as Em}from"node:path";function oi(G,U,j,K){let re=FS(G)?Em(G):U?Em(U,G):void 0;if(!re)return;try{return $t(re,j,K)}catch{return re}}function Rm(G){return!["/dev","/proc","/sys"].some((U)=>G===U||G.startsWith(`${U}/`))}var mo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ii="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",kl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),zS=new Set(["-p","--print"]),$S=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),BS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),US=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),HS=new Map([["python",new Set(["m"])]]),jS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),VS=new Set(["always","default","never"]),KS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),qS=/\\\r?\n/g,YS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function _m(G){return gs(G).code}function ps(G){return gs(G).sources}function xm(G){return YS.get(Ml(G))??[]}function gs(G){let U=Ml(G[0]??"");if(!kl.has(U))return{code:null,sources:[],optionsOpen:!1};let j=[],K=[],re=!0;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(de===void 0)break;if(de==="--")return $n(U,j,K,re,G[oe+1]===void 0?void 0:oe+1,G[oe+1]);if(de===""||de==="-"||!de.startsWith("-"))return $n(U,j,K,re,oe,de);if(U==="node"&&zS.has(de)){let Xe=G[oe+1];if(Xe===void 0)return $n(U,j,K,re);if(Xe.startsWith("-"))continue;j.push({tokenIndex:oe+1,value:Xe}),K.push({tokenIndex:oe+1,kind:"inline-code",value:Xe}),oe++;continue}if(XS(U,de)){let Xe=G[oe+1];if(Xe===void 0)return $n(U,j,K,re);if(j.push({tokenIndex:oe+1,value:Xe}),K.push({tokenIndex:oe+1,kind:"inline-code",value:Xe}),U==="python")return $n(U,j,K,re);oe++;continue}let Ce=/^--eval=(.*)$/s.exec(de);if(JS(U)&&Ce){let Xe=Ce[1]??"";j.push({tokenIndex:oe,value:Xe}),K.push({tokenIndex:oe,kind:"inline-code",value:Xe});continue}if(U==="node"){let Xe=ZS(de);if(Xe){if(Xe.attached){if(re&&=Xe.value!=="",Xe.value!=="")K.push({tokenIndex:oe,kind:"module-file",value:Xe.value});continue}let Ye=G[oe+1];if(Ye===void 0||Ye.startsWith("-"))return re=!1,$n(U,j,K,re);K.push({tokenIndex:oe+1,kind:"module-file",value:Ye}),oe++;continue}}if(U==="python"&&de.startsWith("--check-hash-based-pycs=")||U==="node"&&(de==="--conditions="||de==="--diagnostic-dir="||de==="--title=")||U==="ruby"&&(de==="--disable="||de==="--enable="))return $n(U,j,K,re);if(jS.get(U)?.has(de)){let Xe=G[oe+1];if(Xe===void 0||Xe.startsWith("-")&&!(U==="ruby"&&KS.has(de))||U==="python"&&!VS.has(Xe))return $n(U,j,K,re);oe++;continue}if(de.startsWith("--"))continue;let Ee,ke=!1;for(let Xe=1;Xe<de.length;Xe++){let Ye=de[Xe];if(Ye===void 0)break;if(HS.get(U)?.has(Ye)){let Ze=de.slice(Xe+1),Je=Ze||G[oe+1];if(Je!==void 0)K.push({tokenIndex:Ze?oe:oe+1,kind:"module-file",value:Je});return $n(U,j,K,re)}if($S.get(U)?.has(Ye)){Ee=de.slice(Xe+1)||G[oe+1],ke=Xe+1===de.length;break}if(U==="node"&&Ye==="r"){if(re&&=de==="-r",de==="-r"){let Ze=G[oe+1];if(re&&=Ze!==void 0&&!Ze.startsWith("-"),re&&Ze!==void 0)K.push({tokenIndex:oe+1,kind:"module-file",value:Ze});oe++}break}if(U==="ruby"&&Ye==="r"){let Ze=de.slice(Xe+1),Je=Ze||G[oe+1];if(re&&=Je!==void 0,Je!==void 0)K.push({tokenIndex:Ze?oe:oe+1,kind:"module-file",value:Je});if(!Ze)oe++;break}if(U==="perl"&&(Ye==="M"||Ye==="m")){let Ze=de.slice(Xe+1);if(!Ze){if(re=!1,Xe+1===de.length)oe++;break}K.push({tokenIndex:oe,kind:"module-file",value:Ze});break}if(BS.get(U)?.has(Ye)){if(Xe+1===de.length)oe++;break}if(US.get(U)?.has(Ye)&&Xe+1<de.length)break}if(Ee===void 0)continue;let De=ke?oe+1:oe;if(j.push({tokenIndex:De,value:Ee}),K.push({tokenIndex:De,kind:"inline-code",value:Ee}),U==="python")return $n(U,j,K,re);if(ke)oe++}return $n(U,j,K,re,void 0,void 0,!0)}function $n(G,U,j,K,re,oe,de=!1){let Ce=G==="node"?U.slice(-1):U,Ee=new Set(Ce.map((De)=>De.tokenIndex)),ke=j.filter((De)=>De.kind!=="inline-code"||Ee.has(De.tokenIndex));if(K&&U.length===0&&re!==void 0&&oe!==void 0)ke.push({tokenIndex:re,kind:"main-script",value:oe});return{code:(G==="node"?Ce[0]?.value:Ce.map((De)=>De.value).join(`
-`))||null,sources:K?ke:[],optionsOpen:K&&de}}function ZS(G){for(let U of["--import","--loader","--experimental-loader","--require"]){if(G===U)return{attached:!1,value:""};if(G.startsWith(`${U}=`))return{attached:!0,value:G.slice(U.length+1)}}return}function Ol(G,U){return Ml(G)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(U)}function Ml(G){let U=Lt(G).toLowerCase();return Bi.test(U)?"python":U}function XS(G,U){return kl.get(G)?.has(U)??!1}function JS(G){return kl.get(G)?.has("--eval")??!1}function si(G,U,j=!1){let K=tv(G,U);if(!Il(K,U))return!1;Pn(U,K);let re=ev(K);if(Il(re,U))return!0;if(Pn(U,re),!wm.test(re))return!1;return!j||QS(K,U)}function QS(G,U){if(/`|%x|\bqx\b/.test(G))return!0;let K=G.split(""),re=[];for(let Ee=0;Ee<G.length;Ee++){let ke=G[Ee];if(ke!=="'"&&ke!=='"')continue;let De=G.startsWith(ke.repeat(3),Ee)?ke.repeat(3):ke,Xe=Ee+De.length,Ye=Xe;while(Ye<G.length&&!G.startsWith(De,Ye))Ye+=G[Ye]==="\\"?2:1;if(Ye>=G.length)return!0;re.push({start:Xe,text:G.slice(Xe,Ye)}),K.fill(" ",Ee,Ye+De.length),Ee=Ye+De.length-1}let oe=K.join(""),de=Array.from(oe.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((Ee)=>wm.test(Ee[1]??"")).map((Ee)=>{let ke=Ee.index+Ee[0].length;return{start:ke,end:hs(oe,ke)}});if(de.some((Ee)=>Dl(oe,Ee.start)))return!0;return re.some((Ee)=>{let ke=/\b(?:system|exec|spawn|popen)\s*$/.test(oe.slice(0,Ee.start)),De=de.some((Xe)=>Ee.start>=Xe.start&&Ee.start<Xe.end);return(ke||De)&&Il(Ee.text,U)})}function hs(G,U){let j=1;for(let K=U;K<G.length;K++){if(G[K]==="(")j++;if(G[K]===")")j--;if(j===0)return K}return G.length}function Dl(G,U){let j=0;for(let K=U;K<G.length;K++){let re=G[K]??"";if("([{".includes(re))j++;if(")]}".includes(re)&&j--===0)return!1;if(re===","&&j===0)return!1;if(/[A-Za-z_$]/.test(re))return!0}return!1}var wm=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function ev(G){let U=[],j=0,K=0;while(K<G.length){let re=G[K];if(re!=="'"&&re!=='"'){K++;continue}let oe=G.startsWith(re.repeat(3),K)?re.repeat(3):re,de=K+oe.length;while(de<G.length&&!G.startsWith(oe,de))de+=G[de]==="\\"?2:1;if(de>=G.length)break;U.push(G.slice(j,K)," "),K=de+oe.length,j=K}return U.push(G.slice(j)),U.join("")}function Il(G,U){if(us(G,"rm",U))return!0;for(let K of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Pn(U,G),K.test(G))return!0;if(us(G,"dd",U))return!0;for(let K of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Pn(U,G),K.test(G))return!0;if(us(G,"find",U))return!0;let j=G.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((K)=>(Pn(U,G),j.some((re)=>ms(re,K))))}function tv(G,U){return Pn(U,G),G.replace(qS,"")}import{lstatSync as Jv,readdirSync as Qv}from"node:fs";import{basename as eE,isAbsolute as Xm,join as tE,relative as Jm}from"node:path";import{isAbsolute as Mm,parse as uv}from"node:path";import{dirname as nv,isAbsolute as rv,parse as ov,sep as iv}from"node:path";function pr(G,U,j){if(er(U))throw Error("Unsupported Windows namespace path");let K=rv(U)?ov(U).root:"",re=K||G;for(let oe of av(K?U.slice(K.length):U)){if(oe===""||oe===".")continue;if(oe===".."){re=nv(re);continue}let de=sv(re,oe),Ce=j.entryKind(de),Ee=Ce==="symlink"?j.realpath(de):de;if(Ce==="missing"||Ee===null)throw Error(`Cannot resolve path component: ${de}`);re=Ee}return re}function sv(G,U){return G.endsWith("/")||G.endsWith("\\")?`${G}${U}`:`${G}${iv}${U}`}function av(G){let U=process.platform==="win32"?/[\\/]+/:/\/+/;return G.split(U)}var Nl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],lv=new Set(Nl),cv=1024,Am=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Pm=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),dv=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ys(G){return lv.has(G)}function Ll(G){return ys(G)||Am.has(G)||Pm.has(G)||Fo(G)}function or(G,U,j){return j?.has(G)?j.get(G):U.get(G)}function Tm(G,U){let j=or("GIT_CONFIG_COUNT",G,U);if(j===void 0)return{state:"absent"};if(j==="")return{state:"valid",count:0};if(!/^\d+$/.test(j))return{state:"invalid"};let K=Number(j);return Number.isSafeInteger(K)&&K<=cv?{state:"valid",count:K}:{state:"invalid"}}function bs(G,U,j){let re=G.match(dv)?.[1];if(!re||!Ll(re))return null;let oe=G.indexOf("=");return{name:re,value:`${or(re,U,j)??""}${G.slice(oe+1)}`}}function Im(G){return Om(G,Pm)}function km(G){return Om(G,Am)}function Om(G,U){if(!G)return!1;for(let j of G.keys())if(U.has(j))return!0;return!1}var Nm=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ln(G){if(!Nm.test(G))return null;let U=G.indexOf("=");return{name:G.slice(0,U),value:G.slice(U+1)}}function Se(G){let U=new Map,j=0;while(j<G.length){let K=G[j];if(!K)break;let re=Ln(t(K));if(!re)break;U.set(re.name,re.value),j++}return{words:G.slice(j),envAssignments:U}}function Lm(G){let U=Gt(G);return G.includes("=")||U==="sudo"||U==="env"||U==="command"||U==="builtin"}function Lr(G,U,j,K){if(!Lm(fo(G)))return{words:G,envAssignments:new Map,cwd:j,rewritten:!1};let re=new Set(G),oe=G,de=new Map,Ce=new Map(K??[]),Ee=[],ke=j;for(let Xe=0;Xe<a.wrapperPeelIterations.cap;Xe++){let Ye=Dm(oe),Ze=Se(oe);for(let[Qe,et]of Ze.envAssignments)de.set(Qe,et),Ce.set(Qe,et);if(oe=Ze.words,oe.length===0)break;while(oe.length>0&&fo(oe).includes("=")&&!fv(oe)){let Qe=pv(fo(oe),Ce,U.env)??bs(fo(oe),U.env,Ce);if(Qe)de.set(Qe.name,Qe.value),Ce.set(Qe.name,Qe.value);oe=oe.slice(1)}if(oe.length===0)break;let Je=Gt(fo(oe));if(Je!=="sudo"&&Je!=="env"&&Je!=="command"&&Je!=="builtin")break;if(Je==="sudo"){let Qe=hv(oe,U.paths,ke);if(oe=Qe.words,Qe.cwd!==void 0)ke=Qe.cwd}if(Je==="env"){let Qe=Cv(oe,ke,Ce,U);if(Ee.push(...Qe.envSplitValues??[]),oe=Qe.words,Qe.cwd!==void 0)ke=Qe.cwd;for(let[et,mt]of Qe.envAssignments)de.set(et,mt),Ce.set(et,mt)}if(Je==="command")oe=Sv(oe);if(Je==="builtin")oe=oe.slice(Bn(oe,1)==="--"?2:1);if(Dm(oe)===Ye)break}let De=Se(oe);for(let[Xe,Ye]of De.envAssignments)de.set(Xe,Ye),Ce.set(Xe,Ye);return{words:De.words,envAssignments:de,cwd:ke,envSplitValues:Ee.length>0?Ee:void 0,rewritten:mv(De.words,re)}}function mv(G,U){return G.some((j)=>!U.has(j))}function Dm(G){return G.map(t).join(" ")}function fo(G){let U=G[0];return U?t(U):""}function Bn(G,U){let j=G[U];return j?t(j):void 0}function fv(G){return Nm.test(fo(G))}function pv(G,U,j){if(!G.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${U.get("TMPDIR")??j.get("TMPDIR")??""}${G.slice(8)}`}}var gv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function hv(G,U,j){let K=1,re=j;while(K<G.length){let oe=Bn(G,K);if(!oe)break;if(oe==="--")return{words:G.slice(K+1),cwd:re};if(!oe.startsWith("-"))break;if(oe==="-D"||oe==="--chdir"){let de=Bn(G,K+1);re=de?ai(re,de,U):null,K+=2;continue}if(oe.startsWith("--chdir=")){re=ai(re,oe.slice(8),U),K++;continue}if(oe.startsWith("-D")&&oe.length>2){re=ai(re,oe.slice(2),U),K++;continue}if(oe==="-i"||oe==="--login"){re=null,K++;continue}if(gv.has(oe)){K+=2;continue}K++}return{words:G.slice(K),cwd:re}}var yv=new Set(["-i","-0","--null"]),bv=new Set(["-u","--unset","-C","--chdir","-P"]);function Cv(G,U,j,K){let re=new Map,oe=[],de=U,Ce=1,Ee=(ke)=>({words:G.slice(ke),envAssignments:re,cwd:de,envSplitValues:oe.length>0?oe:void 0});while(Ce<G.length){let ke=Bn(G,Ce);if(!ke)break;if(ke==="--")return Ee(Ce+1);if(ke==="-i"||ke==="--ignore-environment"||ke==="-"){re.clear();for(let Xe of j.keys())re.set(Xe,"");re.set("TMPDIR",""),Ce++;continue}if(yv.has(ke)){Ce++;continue}if(ke==="-u"||ke==="--unset"){let Xe=Bn(G,Ce+1);if(Xe!==void 0)re.set(Xe,"");Ce+=2;continue}if(ke.startsWith("-u")&&ke.length>2&&!ke.startsWith("-u=")){re.set(ke.slice(2),""),Ce++;continue}if(ke.startsWith("--unset=")){re.set(ke.slice(8),""),Ce++;continue}let De=ke==="-S"||ke==="--split-string"?{value:Bn(G,Ce+1),consumed:2}:ke.startsWith("-S")&&ke.length>2?{value:ke.slice(2),consumed:1}:ke.startsWith("--split-string=")?{value:ke.slice(15),consumed:1}:null;if(De){if(De.value!==void 0)oe.push(De.value);return de=null,Ee(Ce+De.consumed)}if(bv.has(ke)){if(ke==="-C"||ke==="--chdir"){let Xe=Bn(G,Ce+1);de=Xe?ai(de,Xe,K.paths):null}Ce+=2;continue}if(ke.startsWith("-u=")){Ce++;continue}if(ke.startsWith("-C")&&ke.length>2||ke.startsWith("--chdir=")){let Xe=ke.startsWith("--chdir=")?ke.slice(8):ke.startsWith("-C=")?ke.slice(3):ke.slice(2);de=ai(de,Xe,K.paths),Ce++;continue}if(ke.startsWith("-P")){Ce++;continue}if(ke.startsWith("-")){Ce++;continue}if(!Ln(ke))break;while(Ce<G.length){let Xe=Ln(Bn(G,Ce)??"");if(!Xe)break;re.set(Xe.name,Xe.value),Ce++}if(Bn(G,Ce)==="--")Ce++;return Ee(Ce)}return Ee(Ce)}function ai(G,U,j){if(U==="")return null;if(!G&&!Mm(U))return null;let K=Mm(U)?uv(U).root:j.realpath(G??"/");if(K===null)return null;try{return pr(K,U,j)}catch{return null}}function Sv(G){if(Bn(G,1)==="-v")return[...Xt(["type"]),...G.slice(2)];let U=1;while(U<G.length){let j=Bn(G,U);if(!j)break;if(j==="-p"||j==="-v"||j==="-V"){U++;continue}if(j==="--")return G.slice(U+1);if(j.startsWith("-")&&!j.startsWith("--")&&j.length>1){if(!/^[pvV]+$/.test(j.slice(1)))break;U++;continue}break}return G.slice(U)}var vv=/['"\\$`{}#]/;function Cs(G,U){if(G.some((K)=>vv.test(K)))return null;let j=[...G.flatMap((K)=>K.split(/\s+/).filter((re)=>re.length>0)),...U];return j.length<=64?j:null}function gr(G,U,j){return Ss(G,U,j).tokens}function Ev(G){let U=[],j="",K=0;while(K<G.length){let re=G.charAt(K);if(re==='"'||re==="'"){let oe=G.indexOf(re,K+1);if(oe===-1)return G.split(/\s+/).map((de)=>de.replace(/["']/g,"")).filter((de)=>de.length>0);j+=G.slice(K+1,oe),K=oe+1;continue}if(/\s/.test(re)){if(j.length>0)U.push(j);j="",K++;continue}j+=re,K++}if(j.length>0)U.push(j);return U}function hr(G,U,j,K=0){let re=Ss(G,U,j),oe=(re.envSplitValues??[]).flatMap(Ev);if(oe.length===0)return re.tokens;let de=[...oe,...re.tokens];if(K>=8)return de;return hr(de,U,j,K+1)}function Ss(G,U,j,K){if(!Lm(G[0]??""))return{tokens:[...G],envAssignments:new Map,cwd:j};let re=Lr(Xt(G),U,j,K);return{tokens:re.words.map(t),envAssignments:re.envAssignments,cwd:re.cwd,envSplitValues:re.envSplitValues}}var Fl=Symbol("adopt-as-operand"),Rv=new Set(["env","sudo","command","builtin"]),_v=new Set(["&&","||","|&","|","&",";"]),xv=new Set(["<<","<<<",">|"]),Wm=new Set(["|","|&"]),wv=/[*@#?$!_-]/,Av=/^\w+(?::\w+)*/,Pv=Object.freeze([]),li=Object.freeze({kind:"scope",edge:"enter"}),ci=Object.freeze({kind:"scope",edge:"exit"}),Tv=Object.freeze([]),Iv=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),di=new Set(["bash","sh","zsh","dash","ksh"]),kv=256,Bm=new WeakMap;function Um(G,U){let j=U.status==="complete"?new Set(Gl(U)):new Set,K=Dv(G,j);if(Hi(K))return vs("unclosed-quote",K,U);let re={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},oe=Wr(U,{source:K,suppressed:j,flags:re,depth:0,functions:new Map,powershell:U.dialect==="powershell"});if(re.limited)return vs("structural-limit",K,U);if(re.invalid)return vs("invalid",K,U);let de=vs("complete",K,U,re.assignmentFallbacks);return Bm.set(de,Object.freeze(oe)),de}function _s(G,U,j,K,re){let oe=re.word??((Je)=>Je),de={cwd:U,variables:new Map,previous:null},Ce=[],Ee=new Set,ke=null,De=[],Xe=Hm(G),Ye=Xe.findLastIndex((Je)=>Je.kind==="operator"&&Wm.has(Je.operator)),Ze=Ye!==-1&&Xe.some((Je)=>Je.kind==="redirection"&&Je.operator==="<<"&&Je.body===void 0);for(let[Je,Qe]of Xe.entries()){let et=Ze||Je<=Ye;if(Qe.kind==="scope"){if(Qe.edge==="enter"){De.push({state:de,segment:[...Ce],shellWords:new Set(Ee),pipeProducer:ke});continue}let mt=re.segment(Ce,de,ke,null,Ee,et);if(mt)return mt;let Rt=De.pop();if(Rt===void 0)throw Error("scope exit without a matching enter");de=Rt.state,Ce=Rt.segment,Ee=Rt.shellWords,ke=Rt.pipeProducer;continue}if(Qe.kind==="operator"){if(!Qe.boundary)continue;let mt=re.segment(Ce,de,ke,Qe.operator,Ee,et);if(mt)return mt;de=Ov(Ce,de,j,K),ke=Ce.length>0&&Wm.has(Qe.operator)?Ce:null,Ce=[],Ee=new Set;continue}if(Qe.kind==="redirection"){if(Qe.fd!==void 0)Ee.add(Ce.length-1);if(Qe.target===void 0)continue;let mt=re.redirection({operator:Qe.operator,role:Qe.role,targetOrder:Qe.targetOrder,target:Qe.target,...Qe.body===void 0?{}:{body:Qe.body,consumer:Qe.consumer}},de,et);if(mt===Fl){Ee.add(Ce.length),Ce.push(oe(Qe.target));continue}if(mt)return mt;continue}Ce.push(oe(Qe.text))}return re.segment(Ce,de,ke,null,Ee,Ze)}function xs(G){return Hm(G).flatMap((U)=>{if(U.kind==="word")return[{kind:"word",text:U.text}];if(U.kind==="operator")return[{kind:"operator",boundary:U.boundary}];if(U.kind==="redirection")return[{kind:"redirection",target:U.target}];return[]})}function Cn(G,U){return G.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(j,K,re,oe)=>{let de=U.get(K);if(de===void 0)return j;let Ce=re.startsWith(":")?de!=="":!0;if(re.endsWith("-"))return Ce?de:Cn(oe,U);return Ce?Cn(oe,U):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(j,K)=>U.get(K)??j).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(j,K)=>U.get(K)??j)}function ui(G){return G.length>0&&G.every((U)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(U))}function Ov(G,U,j,K){let re=ui(G)?new Map([...U.variables,...Mv(G,U.variables)]):U.variables,oe=gr([...G],j),de=Lt(oe[0]??"").toLowerCase()==="cd"?oe[1]:void 0;if(!de)return{...U,variables:re};if(de==="-"){if(U.previous===null)return{...U,variables:re};return{cwd:U.previous,variables:re,previous:U.cwd}}return{cwd:pn(Cn(de,re),U.cwd,j,K),variables:re,previous:U.cwd}}function Mv(G,U){return G.flatMap((j)=>{let K=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(j),re=K?.[2]?.startsWith("=")?K[2].slice(1):void 0;return K?.[1]!==void 0&&re!==void 0?[[K[1],Cn(re,U)]]:[]})}function Hm(G){return Bm.get(G)??Pv}function Dv(G,U){return[...U].reduce((j,K)=>j.slice(0,K.start)+" ".repeat(K.end-K.start)+j.slice(K.end),G)}function vs(G,U,j,K=Tv){return Object.freeze({status:G,source:U,program:j,assignmentFallbacks:Object.freeze(K)})}function Wr(G,U){return G.nodes.flatMap((j,K)=>Nv(j,G,K,U)).sort((j,K)=>j.start-K.start).flatMap((j)=>[...j.events])}function Nv(G,U,j,K){if(G.kind==="connector")return[{start:G.span.start,events:[Un(zv(G.operator))]}];if(G.kind==="unknown")return[{start:G.span.start,events:[Un(G.source)]}];if(G.kind==="function")return K.functions.set(G.name,G.body),[];if(G.kind==="group"){let oe=G.style!=="subshell",de=K.source[G.span.end-1]===(oe?"}":")"),Ce=oe?K:{...K,functions:new Map(K.functions)};return[{start:G.span.start,events:oe?[Es("{"),...Wr(G.body,Ce),...de?[Es("}")]:[]]:[li,Un("("),...Wr(G.body,Ce),...de?[Un(")")]:[],ci]}]}let re=Hv(G,K.functions);if(re){if(K.depth>=fr.maxDepth||++K.flags.expansions>kv)return K.flags.limited=!0,[];return[{start:G.span.start,events:[...Gm(G,K),Es(";"),...Wr(re,{...K,depth:K.depth+1}),Es(";")]},...Fm(G,U,j,K)]}return[{start:G.span.start,events:Gm(G,K)},...Fm(G,U,j,K)]}function Gm(G,U){return[...G.words.map((j)=>({start:j.span.start,events:Vm(j,G,U,!1)})),...G.redirections.map((j)=>({start:j.span.start,events:Lv(j,G,U)}))].sort((j,K)=>j.start-K.start).flatMap((j)=>j.events)}function Lv(G,U,j){let K=G.operator==="<<-"?"<<":G.operator,re=G.target?Vm(G.target,U,j,!0):[],oe=re[0],de=oe?.kind==="word"?oe.text:void 0;return[...G.fd===void 0?[]:[zl(String(G.fd))],Object.freeze({kind:"redirection",operator:K,...G.fd===void 0?{}:{fd:G.fd},role:$v(K),targetOrder:xv.has(K)?"legacy-segment":"immediate",...de===void 0?{}:{target:de},...G.heredoc&&j.suppressed.has(G.heredoc.bodySpan)?{body:G.heredoc.body,consumer:qm(U)}:{}}),...de===void 0?re:re.slice(1)]}function Fm(G,U,j,K){let re=G.redirections.filter((oe)=>oe.operator==="<<"||oe.operator==="<<-");return[...re.flatMap((oe)=>{let de=oe.heredoc;if(!de)return[];let Ce=[zl(de.delimiter),.../[\r\n]/.test(K.source[de.terminatorSpan.end]??"")?[Un(";")]:[]];if(K.suppressed.has(de.bodySpan))return[{start:de.bodySpan.start,events:Ce}];return[{start:de.bodySpan.start,events:[...jm(K.source.slice(de.bodySpan.start,de.bodySpan.end),K),...Ce]}]}),...re.some((oe)=>!oe.heredoc&&oe.target)?Wv(U,j,K):[]]}function Wv(G,U,j){let K=G.nodes.slice(U+1).find((re)=>re.kind==="connector");if(!K||K.span.end>=G.span.end)return[];return[{start:K.span.end,events:jm(j.source.slice(K.span.end,G.span.end),j)}]}function jm(G,U){if(U.depth>=fr.maxDepth)return U.flags.limited=!0,[];let j=y(G,"posix");if(j.status==="limited")return U.flags.limited=!0,[];let K={invalid:!1,limited:!1,expansions:U.flags.expansions,assignmentFallbacks:U.flags.assignmentFallbacks},re=Wr(j,{source:G,suppressed:new Set,flags:K,depth:U.depth+1,functions:new Map,powershell:!1});return U.flags.limited||=K.limited,U.flags.expansions=K.expansions,re}function Vm(G,U,j,K){let re=[],oe={single:!1,double:!1},de="",Ce=!1,Ee=()=>{let ke=Ce&&!K?Un("glob"):de!==""||G.quoted&&re.length===0?zl(de):void 0;if(ke)re.push(ke);de="",Ce=!1};for(let ke of G.parts){if(ke.provenance!=="command-substitution"&&ke.provenance!=="arithmetic"){for(let Ze of Wl(ke.raw,oe,j.flags,j.powershell)){if(typeof Ze==="string"){Ee(),re.push(Un(Ze));continue}de+=Ze.text,Ce||=Ze.glob}continue}let De=U.nested.find((Ze)=>Ze.span.start>=ke.span.start&&Ze.span.end<=ke.span.end);if(oe.double){let Ze=j.source.slice(ke.span.start,ke.span.end);de+=Wl(Ze,{single:!1,double:!0},j.flags,j.powershell).map((Qe)=>typeof Qe==="string"?Qe:Qe.text).join("");let Je=De?Wr(De,j).filter((Qe)=>Qe.kind==="redirection"&&Qe.body!==void 0):[];if(Je.length>0)re.push(li,...Je,ci);continue}let Xe=De?Wr(De,j):[];if(ke.raw.startsWith("`")){de+="${}",Ee(),re.push(li,...Xe,ci);continue}if(ke.raw.startsWith("<(")||ke.raw.startsWith(">(")){Ee(),re.push(ke.raw.startsWith("<(")?Un("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),li,...Xe,...ke.raw.endsWith(")")?[Un(")")]:[],ci);continue}let Ye=ke.raw.startsWith("$((")?2:1;de+="${}",Ee(),re.push(...Array.from({length:Ye},()=>Un("(")),...Ye===1?[li]:[],...Xe,...ke.raw.endsWith(")".repeat(Ye))?Array.from({length:Ye},()=>Un(")")):[],...Ye===1?[ci]:[])}return Ee(),re}function Wl(G,U,j,K){let re=[],oe="",de=!1,Ce=0;while(Ce<G.length){let Ee=G[Ce]??"";if(!U.single&&!U.double&&(Ee==="("||Ee===")")){re.push({text:oe,glob:de},Ee),oe="",de=!1,Ce++;continue}if(K&&Ee==="`"&&!U.single){oe+=G[Ce+1]??"",Ce+=2;continue}if(U.single&&Ee==="'"){U.single=!1,Ce++;continue}if(U.single){oe+=Ee,Ce++;continue}if(U.double){if(Ee==='"'){U.double=!1,Ce++;continue}if(!K&&Ee==="\\"){let ke=G[Ce+1]??"";oe+=['"',"\\","$"].includes(ke)?ke:`\\${ke}`,Ce+=2;continue}if(Ee==="$"){let ke=zm(G,Ce,U,j,K);oe+=ke.text,Ce=ke.next;continue}oe+=Ee,Ce++;continue}if(Ee==="'"||Ee==='"'){U.single=Ee==="'",U.double=Ee==='"',Ce++;continue}if(!K&&Ee==="\\"){let ke=G[Ce+1]??"";de||=ke==="*"||ke==="?",oe+=ke,Ce+=2;continue}if(Ee==="$"){let ke=zm(G,Ce,U,j,K);oe+=ke.text,Ce=ke.next;continue}de||=Ee==="*"||Ee==="?",oe+=Ee,Ce++}return[...re,{text:oe,glob:de}]}function zm(G,U,j,K,re){let oe=G[U+1];if(oe==="{"){let Ce=re?Fv(G,U+2):ds(G,U+2,G.length).close;if(Ce===-1)return K.invalid=!0,{text:"",next:G.length};let Ee=G.slice(U,Ce+1);return Gv(Ee,j,K,re),{text:Ee,next:Ce+1}}if(oe!==void 0&&wv.test(oe))return{text:`\${${oe}}`,next:U+2};let de=(re?Av:/^\w*/).exec(G.slice(U+1))?.[0]??"";return{text:`\${${de}}`,next:U+1+de.length}}function Gv(G,U,j,K){let re=G.slice(2,-1),oe=/^[A-Za-z_][A-Za-z0-9_]*/.exec(re)?.[0];if(!oe)return;let de=re.slice(oe.length),Ce=[":=","="].find((ke)=>de.startsWith(ke));if(!Ce)return;let Ee=Wl(de.slice(Ce.length),{...U},j,K);j.assignmentFallbacks.push(...Ee.flatMap((ke)=>typeof ke==="string"||!ke.text?[]:[ke.text]))}function Fv(G,U){let j=1,K=U;while(j>0&&K<G.length){if(G[K]==="{"&&G[K-1]==="$")j++;if(G[K]==="}")j--;K++}return j===0?K-1:-1}function zv(G){return/^[\r\n]+$/.test(G)?";":G}function Un(G){return Object.freeze({kind:"operator",operator:G,boundary:_v.has(G)})}function Es(G){return Object.freeze({kind:"operator",operator:G,boundary:!0})}function zl(G){return Object.freeze({kind:"word",text:G})}function $v(G){if(G==="<<"||G==="<<<")return"here-data";if(G==="<"||G==="<&")return"file-read";return"file-write"}function po(G){return Iv.has(G)||/^python\d/.test(G)}var Bv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Km(G,U){let j=U[0];if(j===void 0||!j.startsWith("-"))return U;let K=Bv.get(G)?.has(j)??!1;return Km(G,U.slice(K?2:1))}function Rs(G){let U=G[0];if(U===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(U))return Rs(G.slice(1));if(U==="uv"&&G[1]==="run")return Rs(G.slice(2));if(!Rv.has(U))return[...G];return Rs(Km(U,G.slice(1)))}function qm(G){let U=Zo(G),j=G.words.findIndex((K)=>K.provenance==="literal"&&K.text===U);return Rs(j<0?[]:G.words.slice(j).map((K)=>K.text))}function Uv(G){let U=qm(G)[0];if(U===void 0)return!1;let j=Lt(U).toLowerCase();return po(j)&&!di.has(j)}function Gl(G){return G.nodes.flatMap((U,j)=>{if(U.kind==="group"||U.kind==="function")return Gl(U.body);if(U.kind!=="command")return[];let K=U.nested.flatMap((Ce)=>Gl(Ce)),re=U.redirections.flatMap((Ce)=>Ce.heredoc?.quotedDelimiter?[Ce.heredoc.bodySpan]:[]);if(Uv(U))return[...K,...re];let oe=G.nodes[j+1];if(oe?.kind==="connector"&&(oe.operator==="|"||oe.operator==="|&")||!Vv(U))return K;return[...K,...re]})}function Hv(G,U){let j=Zo(G);return j===void 0?void 0:U.get(j)}function yr(G,U){return G!==void 0&&G.provenance==="literal"&&!G.quoted&&G.raw===G.text&&G.text===U}function jv(G){if(yr(G.words[0],"git"))return yr(G.words[1],"commit");if(!yr(G.words[0],"gh")||!yr(G.words[2],"create"))return!1;return yr(G.words[1],"pr")||yr(G.words[1],"issue")}function Vv(G){return(yr(G.words[0],"cat")||yr(G.words[0],"tee")||jv(G))&&!G.words.some($m)&&!G.redirections.some((j)=>$m(j.target))}function $m(G){return G?.parts.some((U)=>U.provenance==="command-substitution"&&U.raw.startsWith(">("))??!1}var $l=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Kv=new Set([...$l,"dir_path","glob","glob_pattern","include_pattern"]),qv=new Set([...$l,"folder","glob","pattern","patterns"]);class b extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Ym(G){let U=Yv(),j=ie(G.input),K=[];if((G.route.kind==="command"||G.route.kind==="unknown")&&j)K.push({usage:"input-candidate",source:j});if(G.route.kind==="command"&&"command"in G&&G.command)K.push({usage:"declared-command",source:G.command});let re=K.reduce((oe,de)=>{let Ce=oe.findIndex((De)=>De.source===de.source);if(Ce!==-1){let De=oe[Ce];if(!De)return oe;return oe[Ce]={...De,usages:[...De.usages,de.usage]},oe}let Ee=G.route.kind==="command"?G.route.shell:process.platform==="win32"?"powershell":"posix",ke=U.getCommandProgram(de.source,Ee);return oe.push({usages:[de.usage],source:de.source,program:ke,shell:U.getShellSyntax(de.source,ke)}),oe},[]);return{invocation:{toolName:G.toolName,route:G.route,context:G.context},commands:re,paths:Zv(G),store:U}}function Sn(G,U){return G.commands.find((j)=>j.usages.includes(U))}function ir(G,U){if(!G.includes("$"))return G;return Ca(G,U)}function Yv(){let G=new Map,U=new WeakMap,j=(re,oe)=>{let de=`${oe}\x00${re}`,Ce=G.get(de);if(Ce)return Ce;let Ee=y(re,oe);return G.set(de,Ee),Ee};return{getShellSyntax:(re,oe)=>{if(oe&&oe.source!==re)throw TypeError("Shell syntax source does not match command program source.");let de=oe??j(re,"posix"),Ce=U.get(de);if(Ce)return Ce;let Ee=de.status==="limited"?{status:"structural-limit",source:re,program:de,assignmentFallbacks:[]}:Um(re,de);return U.set(de,Ee),Ee},getCommandProgram:j}}function Zv(G){let U=G.route.kind==="grep"?Kv:G.route.kind==="glob"?qv:$l;return[...Ed(G.input,U),...G.route.kind==="patch"||typeof G.input==="string"?xd(G.input):[]]}var Xv=new Set(["-S","--suffix"]);function go(G,U,j,K,re){if(G.status==="structural-limit")throw new b;if(G.status!=="complete")return re.findMalformedTarget(G.source);return _s(G,U,j,K,{segment:(oe,de)=>re.findSegmentTarget(oe,de),redirection:(oe,de)=>oe.role==="file-write"&&re.isRedirectionTarget(Cn(oe.target,de.variables),de)?oe.target:null})}function ws(G){let U=[],j=null,K=!1;for(let re=0;re<G.length;re++){let oe=G[re];if(oe===void 0)break;if(!K&&oe==="--"){K=!0;continue}if(!K&&(oe==="-t"||oe==="--target-directory")){j=G[++re]??null;continue}if(!K&&oe.startsWith("--target-directory=")){j=oe.slice(19);continue}if(!K&&oe.startsWith("-t")&&oe.length>2){j=oe.slice(2);continue}if(!K&&Xv.has(oe)){re++;continue}if(!K&&(oe.startsWith("--suffix=")||oe.startsWith("--backup=")))continue;if(!K&&oe.startsWith("-"))continue;U.push(oe)}return j?{sources:U,destination:j}:{sources:U.slice(0,-1),destination:U.at(-1)??null}}var v="Git metadata and hooks are protected. Ask the user before modifying them.";function Qm(G,U,j,K){let re=G.invocation.context.executionCwd;if(!U)return null;if(G.invocation.route.kind==="patch"||G.invocation.route.kind==="path"||G.invocation.route.kind==="unknown"){if(Di(G.invocation.toolName))return null;let Ce=G.paths.find((Ee)=>Zm(Ee,re,U,j,K,U.entries));return Ce?{target:Ce}:null}if(G.invocation.route.kind!=="command")return null;let oe=Sn(G,"input-candidate");if(!oe)return null;let de=go(oe.shell,re,j,K,{findSegmentTarget:(Ce,Ee)=>aE(Ce,Ee,U,j,K),isRedirectionTarget:(Ce,Ee)=>Zm(Ce,Ee.cwd,U,j,K,U.markerFiles),findMalformedTarget:()=>null});return de?{target:de}:null}function Gr(G,U,j,K,re,oe,de=!1){if(!j)return!1;let Ce=Ps(pn(G,U,re,oe)),Ee=Ce.replace(/(\/\.?\*+)+$/,"");if(Ee!==Ce&&Ee!==""){if(Bl(Ee,j))return!0;let ke=de||Ce.slice(Ee.length).includes("/."),De=(Xe)=>ke?As(Xe,Ee):nE(Xe,Ee);if(j.markerFiles.some(De))return!0;return K&&Ul(j).some(De)}if(Bl(Ce,j))return!0;return K&&Ul(j).some((ke)=>As(ke,Ce))}function nE(G,U){let j=Jm(U,G);if(j===""||j.startsWith("..")||Xm(j))return!1;return!j.split(/[\\/]/)[0]?.startsWith(".")}function rE(G,U,j,K,re){return Gr(G,U,j,!0,K,re)}function oE(G,U,j,K,re){if(!j)return!1;return Bl(Ps(pn(G,U,K,re)),j)}function Zm(G,U,j,K,re,oe){let de=Ps(pn(G,U,K,re));return oe.includes(de)||tf(de,j)}function ef(G,U,j,K,re){if(!j)return!1;return j.hooksDirectories.some((oe)=>G.some((de)=>As(oe,Ps(pn(de,U,K,re)))))}function Bl(G,U){return U.entries.includes(G)||U.directories.includes(G)||tf(G,U)}function tf(G,U){return U.hooksDirectories.some((j)=>As(G,j))}var iE=50000;function nf(G,U){let j=[...new Set(Ul(G))];if(j.some((re)=>U(eE(re))))return!0;let K=0;while(j.length>0){let re=j.pop()??"",oe=sE(re);if(!oe)return!0;if(K+=oe.length,K>iE)return!0;if(oe.some((de)=>U(de.name)))return!0;j.push(...oe.filter((de)=>de.isDirectory()).map((de)=>tE(re,de.name)))}return!1}function sE(G){try{let U=Jv(G,{throwIfNoEntry:!1});if(!U)return[];if(!U.isDirectory())return U.isSymbolicLink()?null:[];return Qv(G,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Ul(G){return[...G.entries,...G.directories,...G.hooksDirectories]}function As(G,U){let j=Jm(U,G);return j===""||!/^\.\.(?:[\\/]|$)/.test(j)&&!Xm(j)}function Ps(G){return process.platform==="win32"?G.toLowerCase():G}function aE(G,U,j,K,re){if(ui(G))return null;let oe=hr([...G],K);if(Lt(oe[0]??"").toLowerCase()!=="mv")return null;let de=ws(oe.slice(1)),Ce=de.sources.find((Ee)=>rE(Cn(Ee,U.variables),U.cwd,j,K,re));if(Ce)return Ce;return de.destination&&oE(Cn(de.destination,U.variables),U.cwd,j,K,re)?de.destination:null}import{isAbsolute as Os,normalize as gE,parse as hE,posix as uf,resolve as zr,sep as Kl}from"node:path";import{isAbsolute as lE,join as rf,normalize as af,parse as cE,sep as of}from"node:path";var dE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],uE=` 	
-`;function mi(G,U){if(Fr(G,U))return!0;if(!G.has("TMPDIR"))return!1;return!Hl(G.get("TMPDIR")??"",U)}function ho(G,U){if(G.has("TMPDIR"))return Hl(G.get("TMPDIR")??"",U);let j=jl(G,U);if(j===void 0)return!0;return Hl(j,U)}function jl(G,U){return cf(G,U,"TMPDIR")}function Hl(G,U){if(!G)return!1;if(fE(G))return!1;return yo(G,U)}function Fr(G,U){let j=cf(G,U,"IFS");return j!==void 0&&j!==""&&j!==uE}function yo(G,U){let j=Ts(G,U.paths);if(j===null)return!1;return lf(U).some((K)=>bo(j,K))}function ks(G,U){let j=Ts(G,U.paths);if(j===null)return!1;return lf(U).some((K)=>Is(K)===Is(j))}var sf=new WeakMap;function lf(G){let U=sf.get(G);if(U)return U;let j=mE(G);return sf.set(G,j),j}function mE(G){let U=dE.map((K)=>Ts(K,G.paths)??af(K)),j=Ts(G.tmpdir,G.paths);if(!j)return U;if(process.platform==="win32")return[...U,j];if(process.platform==="darwin"&&pE(j))return[...U,j];return U}function fE(G){return/[\s$`*?[]/.test(G)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(G)||/[+@!]\([^)]*\)/.test(G)}function cf(G,U,j){return G.has(j)?G.get(j):U.env.get(j)}function pE(G){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(G)}function Ts(G,U){try{let j=af(G);if(!lE(j))return j;let K=cE(j).root,re=j.slice(K.length).split(/[\\/]+/).filter(Boolean),oe=K;for(let de=0;de<re.length;de++){let Ce=rf(oe,re[de]??"");if(U.entryKind(Ce)==="missing")return rf(Ce,...re.slice(de+1));let Ee=U.realpath(Ce);if(Ee===null)return null;oe=Ee}return oe}catch{return null}}function bo(G,U){let j=Is(G),K=Is(U);if(j===K)return!0;let re=K.endsWith(of)?K:`${K}${of}`;return j.startsWith(re)}function Is(G){return process.platform==="win32"?G.toLowerCase():G}var yE=process.platform==="win32",df=64,bE=16384;function $r(G,U,j,K){if(G.kind==="temp_target")return null;let re=K[G.kind];if(G.kind==="dynamic_target"&&!nn(j,re.id,U.strict))return null;if(G.kind==="within_anchored_cwd"&&!nn(j,re.id,U.paranoid))return null;return At(re.id,re.reason)}function fi(G){let U=Yu(G,df,df,bE);return{expandedTargets:U&&"words"in U?U.words:void 0,unsafeBraceExpansion:U!==void 0&&"limited"in U,targetIsLiteral:U===void 0&&G.provenance==="literal"&&(G.quoted||G.raw!==G.text),tmpdirWordSplittingProtected:CE(G)}}function CE(G){let U=G.parts.filter((j)=>j.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(j.raw));return U.length>0&&U.every((j)=>SE(G.raw,j.span.start-G.span.start))}function SE(G,U){let j=null,K=!1;for(let re=0;re<U;re++){let oe=G[re];if(K){K=!1;continue}if(oe==="\\"&&j!=="'"){K=!0;continue}if(j===oe){j=null;continue}if(j===null&&(oe==="'"||oe==='"'))j=oe}return j==='"'}function Yn(G){let U=G.environment.home,j=G.environment.paths,K=G.budget??On();return{anchoredCwd:G.originalCwd??G.cwd??null,resolvedCwd:G.cwd??null,strict:G.strict??!1,paranoid:G.paranoid??!1,trustTmpdirVar:G.allowTmpdirVar??!0,posixShell:G.posixShell??!1,tmpdirWordSplittingUnsafe:G.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:G.trustedTmpdirValue??G.allowTmpdirVar??!0,environment:G.environment,allowRoots:wE(G.allowPaths,U,j,K),protectedGitMetadata:G.protectedGitMetadata,budget:K}}function Tn(G,U,j={}){let K=j.targetIsLiteral??!1;if(!K&&U.tmpdirWordSplittingUnsafe&&!j.tmpdirWordSplittingProtected&&PE(G))return{kind:"outside_anchored_cwd"};let re=!K&&ff(G,U.posixShell);if(er(G))return{kind:"outside_anchored_cwd"};if(ql(G,K))return{kind:"root_or_home_target"};if(EE(G,U,K))return{kind:"root_or_home_target"};if(U.resolvedCwd&&Gr(G,U.resolvedCwd,U.protectedGitMetadata,!0,U.environment,U.budget,!U.posixShell))return{kind:"git_metadata_target"};if(RE(G,U.trustTmpdirVar,U.posixShell,re,K,j.tmpdirWordSplittingProtected??!1,U.trustedTmpdirValue,U.environment))return{kind:"temp_target"};if(re)return{kind:"dynamic_target"};if(AE(G,U,K))return{kind:"temp_target"};let oe=U.anchoredCwd;if(oe){if(!j.skipHomeCwd&&OE(oe,U.environment.home,U.environment.paths,U.budget))return{kind:"home_cwd_target"};if(!j.skipCwdSelf&&[U.resolvedCwd??oe,oe].some((de)=>ME(G,U.resolvedCwd??oe,U.environment.paths,U.budget,de)))return{kind:"cwd_self_target"};if(DE(G,oe,U.resolvedCwd??oe,re,K,U.environment.paths,U.budget))return{kind:"within_anchored_cwd"}}if(vE(G,U,re))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function vE(G,U,j){let K=G.trim();if(j||!U.resolvedCwd||!U.anchoredCwd||!K)return!1;if(Os(K)||K.startsWith("~"))return!1;if(Yl(K))return!1;if(pf(U.resolvedCwd,U.anchoredCwd,U.environment.paths,U.budget))return!1;return yo(zr(U.resolvedCwd,K),U.environment)}function mf(G,U,j={}){let{containmentTarget:K,...re}=j;if(Tn(G,U,re).kind!=="temp_target")return!1;let oe=G.trim();if(xE(oe))return!1;if(ks(oe,U.environment))return!1;return![U.anchoredCwd,U.resolvedCwd].some((de)=>pf(K??oe,de,U.environment.paths,U.budget))}function ql(G,U=!1){let j=G.trim(),K=uf.normalize(j),re=j.replace(/\\/g,"/"),oe=K==="/"?K:K.replace(/\/+$/,"");if(oe==="/"||oe.startsWith("/")&&oe.slice(1).split("/").every((de)=>/^\*+$/.test(de)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(re)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(re))return!0;if(!U&&(K==="~"||K==="~/"||K==="~/*"))return!0;if(!U&&(K==="$HOME"||K==="$HOME/"||K==="$HOME/*"))return!0;if(!U&&(K==="${HOME}"||K==="${HOME}/"||K==="${HOME}/*"))return!0;return!1}function EE(G,U,j){let K=G.trim(),re=j?K:K==="*"?".":K.endsWith("/*")?K.slice(0,-2):K;if(!re)return!1;try{let oe=Os(re)?re:U.resolvedCwd?zr(U.resolvedCwd,re):null;if(!oe)return!1;let de=vn($t(oe,U.environment.paths,U.budget));if(de===hE(de).root)return!0;return de===vn($t(U.environment.home,U.environment.paths,U.budget))}catch{return!1}}function vn(G){let U=gE(G);if(yE){if(U=U.replace(/\//g,"\\").toLowerCase(),U.length>3&&U.endsWith("\\"))U=U.slice(0,-1);return U}if(U.length>1&&U.endsWith("/"))U=U.slice(0,-1);return U}function RE(G,U,j,K,re,oe,de,Ce){let Ee=G.trim();if(Yl(Ee))return!1;if(!K&&yo(Ee,Ce))return!0;return(U||oe&&de)&&j&&!re&&_E(Ee,j)}function _E(G,U){return["$TMPDIR","${TMPDIR}"].some((j)=>{if(G===j)return!0;if(!G.startsWith(`${j}/`))return!1;return!ff(G.slice(j.length+1),U)})}function xE(G){let U=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(G);if(!U)return!1;return uf.normalize(`/${U[1]??""}`)==="/"}function Yl(G){return G.split(/[\\/]+/).includes("..")}function wE(G,U,j,K){if(!G?.length)return[];return G.flatMap((re)=>{let oe=Ko(re.trim(),U);if(!Os(oe))return[];try{let de=$t(oe,j,K);if(qo(de,$t(U,j,K)))return[];return[vn(de)]}catch{return[]}})}function AE(G,U,j){if(U.allowRoots.length===0)return!1;let K=G.trim();if(Yl(K))return!1;let re=j?K:Ko(K,U.environment.home),oe=U.resolvedCwd??U.anchoredCwd,de=Os(re)?re:oe?zr(oe,re):null;if(!de)return!1;try{let Ce=vn($t(de,U.environment.paths,U.budget));return U.allowRoots.some((Ee)=>Ce===Ee||Ce.startsWith(Ee.endsWith(Kl)?Ee:`${Ee}${Kl}`))}catch{return!1}}function PE(G){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(G)}function ff(G,U=!1){return G.includes("$")||G.includes("`")||TE(G)||U&&IE(G)}function TE(G){let U=!1;for(let j of G){if(U){U=!1;continue}if(j==="\\"){U=!0;continue}if(j==="*"||j==="?"||j==="[")return!0}return!1}function IE(G){let U=!1;for(let j=0;j<G.length;j++){let K=G[j];if(U){U=!1;continue}if(K==="\\"){U=!0;continue}if(K==="{"&&kE(G,j)||(K==="+"||K==="@"||K==="!")&&G[j+1]==="(")return!0}return!1}function kE(G,U){let j=G.indexOf("}",U+1);if(j===-1)return!1;let K=G.slice(U+1,j);return K.includes(",")||K.includes("..")}function OE(G,U,j,K){try{return vn($t(G,j,K))===vn($t(U,j,K))}catch{try{return vn(G)===vn(U)}catch{return!1}}}function ME(G,U,j,K,re=U){if(re===U&&(G==="."||G==="./"||G===".\\"))return!0;try{return vn($t(zr(U,G),j,K))===vn($t(re,j,K))}catch{try{return vn(zr(U,G))===vn(re)}catch{return!1}}}function DE(G,U,j,K,re,oe,de){let Ce=j??U;if(!re&&(G.startsWith("~")||G.startsWith("$HOME")||G.startsWith("${HOME}")))return!1;if(K)return!1;if(G.startsWith("/")||/^[A-Za-z]:[\\/]/.test(G))try{return Vl(G,U,oe,de)}catch{return!1}if(G.startsWith("./")||G.startsWith(".\\")||!G.includes("/")&&!G.includes("\\"))try{return Vl(zr(Ce,G),U,oe,de)}catch{return!1}if(G.startsWith("../"))return!1;try{return Vl(zr(Ce,G),U,oe,de)}catch{return!1}}function Vl(G,U,j,K){try{return gf($t(G,j,K),$t(U,j,K))}catch{return!1}}function pf(G,U,j,K){if(!U)return!1;try{return gf($t(U,j,K),$t(G,j,K))}catch{return!0}}function gf(G,U){let j=vn(G),K=vn(U);return j.startsWith(`${K}${Kl}`)||j===K}var NE=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),hf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",LE="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",bf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",WE="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",GE="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",FE={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:bf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:v},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:yf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:WE},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:hf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:LE},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:hf}};function Cf(G,U,j){return zE(G.words.map((K)=>({kind:"word",text:K.text,dynamic:K.provenance!=="literal"})),U,Yn({...j,allowPaths:j.policy?.destructiveCommandAllowPaths}),j.policy)}function zE(G,U,j,K){let re=G.filter((Ee)=>Ee.kind==="word"),oe=BE(re),de=re[oe];if(!de||!NE.has(XE(de.text)))return null;let Ce=$E(re.slice(oe+1));if(Ce.whatIfProtected)return null;if(nn(K,"powershell.remove-item-pipeline-dynamic-target",j.strict)&&U&&(Ce.targets.length===0||Ce.recursive))return At("powershell.remove-item-pipeline-dynamic-target",GE);for(let Ee of Ce.targets)if(!er(Ee.text)&&ql(pi(Ee.text)))return At(Ce.recursive&&Ce.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",bf);for(let Ee of Ce.targets)if(j.resolvedCwd&&Gr(pi(Ee.text),j.resolvedCwd,j.protectedGitMetadata,Ce.recursive,j.environment,j.budget,!0))return At("powershell.remove-item-git-metadata",v);if(!Ce.recursive||!Ce.force)return null;if(nn(K,"powershell.remove-item-recursive-force-dynamic-target",j.strict)&&(Ce.hasDynamicTarget||Ce.targets.length===0))return At("powershell.remove-item-recursive-force-dynamic-target",yf);for(let Ee of Ce.targets){let ke=$r(Tn(pi(Ee.text),j),j,K,FE);if(ke)return ke}return null}function $E(G){let U=[],j=!1,K=!1,re=!1,oe=!1,de=!1;for(let Ce=0;Ce<G.length;Ce++){let Ee=G[Ce];if(!Ee||Ee.kind!=="word")continue;if(UE(Ee))continue;if(de){U.push(Zl(Ee)),oe=oe||Ee.dynamic;continue}if(Ee.text==="--"){de=!0;continue}let ke=jE(Ee.text);if(!ke){U.push(Zl(Ee)),oe=oe||Ee.dynamic;continue}if(VE(ke.name)){let De=ke.value?HE(ke.value,Ee):G[++Ce];if(De?.kind==="word"){U.push(Zl(De)),oe=oe||De.dynamic;continue}oe=!0;continue}if(KE(ke.name)){j=!0;continue}if(qE(ke.name)){K=!0;continue}if(YE(ke.name))re=ZE(ke.value)}return{targets:U,recursive:j,force:K,whatIfProtected:re,hasDynamicTarget:oe}}function BE(G){let U=G[0];if(U?.kind==="word"&&U.text==="&"||U?.text===".")return G.length>1?1:0;return 0}function Zl(G){return{text:G.kind==="word"?G.text:"",dynamic:G.kind==="word"&&G.dynamic}}function UE(G){return G.kind==="word"&&G.text===","}function pi(G){let U=G.replace(/\\/g,"/"),j=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(U);return j?`$HOME${U.slice(j[0].length)}`:U}function HE(G,U){return{kind:"word",text:G,dynamic:U.kind==="word"&&(U.dynamic||G.includes("$"))}}function jE(G){if(!G.startsWith("-")||G==="-")return null;let U=G.slice(1),j=U.indexOf(":");if(j===-1)return{name:U.toLowerCase()};return{name:U.slice(0,j).toLowerCase(),value:U.slice(j+1)}}function VE(G){return"path".startsWith(G)||"literalpath".startsWith(G)}function KE(G){return"recurse".startsWith(G)}function qE(G){return G.length>=2&&"force".startsWith(G)}function YE(G){return G==="wi"||"whatif".startsWith(G)}function ZE(G){if(G===void 0||G==="")return!0;let U=G.toLowerCase();return U==="$true"||U==="true"}function XE(G){return G.toLowerCase()}var Co="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Ms="Unsupported heredoc syntax",gi="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function So(){return{id:"analysis.dynamic-shell-source",reason:gi,intent:"stop_and_explain"}}var Sf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var JE=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),QE=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),eR=new Set(["-o","--output","--query","--subscription"]),tR=new Set;function vf(G){if(G==="aws")return JE;if(G==="gcloud")return QE;if(G==="az")return eR;return tR}var nR=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),rR=new Set;function Ef(G){if(G==="git")return xn;if(G==="docker")return nR;return rR}function D(G,U){if(G.length===0||U.length===0)return null;let j=Gt(G[0]??""),K=yn(G);for(let re of U){if(!sR(j,re.command))continue;if(re.match){if(oR(j,G,re.match))return Rf(re);continue}if(!aR(j,G,re.subcommand))continue;if(cR(G,new Set(re.block_args),K))return Rf(re)}return null}function Rf(G){return{id:`custom.${G.name}`,reason:`[${G.name}] ${G.reason}`,intent:G.intent??"manual_only"}}function oR(G,U,j){let K=U.slice(1);if(j.exclude_args?.some((re)=>K.includes(re)))return!1;if(j.any_args&&!j.any_args.some((re)=>K.includes(re)))return!1;return iR(K,j.command_path,vf(G))}function iR(G,U,j){let K=0,re=!1;for(let oe of G){if(K>=U.length)return!0;if(re){re=!1;continue}if(oe.startsWith("-")){re=!oe.includes("=")&&j.has(oe);continue}if(oe!==U[K])return!1;K++}return K>=U.length}function sR(G,U){return G===Gt(U)}function aR(G,U,j){if(!j)return!0;return _f(U,1,j,Ef(G))}function _f(G,U,j,K){let re=!1;for(let oe=U;oe<G.length;oe++){let de=G[oe];if(!de)continue;if(re){re=!1;continue}if(de==="--"){let Ce=G[oe+1];if(Ce&&!Ce.startsWith("-"))return Ce===j;return!1}if(K.has(de)){re=!0;continue}if(de.startsWith("-")){if(!de.includes("=")&&lR(G,oe,j,K))return!0;continue}return de===j}return!1}function lR(G,U,j,K){let re=G[U+1];if(!re||re.startsWith("-"))return!1;return _f(G,U+2,j,K)}function cR(G,U,j){return G.some((K)=>U.has(K))||[...j].some((K)=>U.has(K))}var dR=new Set(["-e","--source"]),uR=new Set(["-F","-v","--assign","--field-separator"]),xf=new Set(["-f","--file"]),mR=new Set(["print","printf","return"]),wf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],fR="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Af(G,U,j){let K=!1;for(let re of pR(G)){let oe=gR(re,j);if(!oe)continue;for(let de of oe.commands){let Ce=U(de);if(Ce)return Ce;if(de.includes("{}")||/[$`]/.test(de))K=!0}K||=oe.dynamic}return K?At("awk.system-dynamic",fR):null}function Jl(G){let U=[],j=!1,K=!1,re=!0,oe=!0;for(let de=1;de<G.length;de++){let Ce=G[de];if(Ce===void 0)break;if(re&&Ce==="--"){re=!1;continue}if(re&&dR.has(Ce)){j=!0;let Ee=G[de+1];if(oe&&=Ee!==void 0,Ee!==void 0)U.push({tokenIndex:de+1,kind:"inline-code",value:Ee});de++;continue}if(re&&Ce.startsWith("--source=")){j=!0,U.push({tokenIndex:de,kind:"inline-code",value:Ce.slice(9)});continue}if(re&&Ce.startsWith("-e")&&Ce.length>2){j=!0,U.push({tokenIndex:de,kind:"inline-code",value:Ce.slice(2)});continue}if(re&&(uR.has(Ce)||xf.has(Ce))){let Ee=G[de+1];if(oe&&=Ee!==void 0,xf.has(Ce)){if(K=!0,Ee!==void 0)U.push({tokenIndex:de+1,kind:"program-file",value:Ee})}de++;continue}if(re&&(Ce.startsWith("-F")||Ce.startsWith("-v")&&Ce.slice(2).includes("=")))continue;if(re&&Ce.startsWith("-f")&&Ce.length>2){K=!0,U.push({tokenIndex:de,kind:"program-file",value:Ce.slice(2)});continue}if(re&&(Ce.startsWith("--assign=")||Ce.startsWith("--field-separator=")))continue;if(re&&Ce.startsWith("--file=")){K=!0,U.push({tokenIndex:de,kind:"program-file",value:Ce.slice(7)});continue}if(re&&Ce.startsWith("-")&&Ce!=="-")continue;if(!j&&!K)U.push({tokenIndex:de,kind:"main-program",value:Ce});return{sources:U,optionsOpen:!1}}return{sources:oe?U:[],optionsOpen:re&&oe}}function yi(G){return Jl(G).sources}function pR(G){return yi(G).filter((U)=>U.kind!=="program-file").map((U)=>U.value)}function gR(G,U){Pn(U,G);let j=G.includes("system")?Ql(G,U):null,K=hR(G,U);if(!j&&!K)return null;return{dynamic:!!j?.dynamic||!!K?.dynamic,commands:[...j?.commands??[],...K?.commands??[]]}}function Ql(G,U){Pn(U,G);let j=[],K=!1,re=!1,oe=0;while(oe<G.length){let de=G[oe];if(de==='"'||de==="'"){oe=Ns(G,oe,de)?.endIndex??oe+1;continue}if(de==="#"){oe=Pf(G,oe+1);continue}if(de==="/"&&Tf(G,oe)){oe=If(G,oe+1)??oe+1;continue}if(!G.startsWith("system",oe)){oe++;continue}let Ce=oe;if(oe+=6,hi(G[Ce-1])||hi(G[oe]))continue;let Ee=Ds(G,oe);if(G[Ee]!=="(")continue;Ee=Ds(G,Ee+1);let ke=G[Ee];if(ke!=='"'&&ke!=="'"){K=!0,re=!0;continue}let De=Ns(G,Ee,ke);if(!De){K=!0,re=!0;continue}if(Ee=Ds(G,De.endIndex),K=!0,G[Ee]!==")"){re=!0,oe=De.endIndex;continue}j.push(De.value),oe=Ee+1}if(!K)return null;return{dynamic:re,commands:j}}function hR(G,U){Pn(U,G);let j=[],K=!1,re=!1,oe=0,de=0,Ce=null,Ee=null,ke=0;while(oe<G.length){let De=G[oe];if(!De)break;if(De==='"'||De==="'"){let Ze=Ns(G,oe,De);if(Ze&&ke===de)Ee={...Ze,startIndex:oe};ke=Ze?.endIndex??oe+1,oe=Ze?.endIndex??oe+1;continue}if(De==="#"){oe=Pf(G,oe+1),de=oe,Ce=null,Ee=null,ke=oe;continue}if(De==="/"&&Tf(G,oe)){let Ze=If(G,oe+1);ke=Ze??oe+1,oe=Ze??oe+1;continue}if(`;
-{}`.includes(De)){oe++,de=oe,Ce=null,Ee=null,ke=oe;continue}if(Ce===null&&(Xl(G,oe,"print")||Xl(G,oe,"printf")))Ce=oe;if(De!=="|"||G[oe-1]==="|"||G[oe+1]==="|"){if(!/\s/.test(De))ke=oe+1;oe++;continue}let Xe=G[oe+1]==="&"?oe+2:oe+1,Ye=Ds(G,Xe);if(Xl(G,Ye,"getline")){re=!0;let Ze=CR(de,Ee,ke);if(K||=Ze===null,Ze!==null)j.push(Ze);ke=Xe,oe=Xe;continue}if(vR(de,Ce)){re=!0;let Ze=bR(G,Ye);if(!Ze){K=!0,ke=Xe,oe=Xe;continue}if(!yR(G,Ze.endIndex)){K=!0,ke=Ze.endIndex,oe=Ze.endIndex;continue}j.push(Ze.value),ke=Ze.endIndex,oe=Ze.endIndex;continue}ke=Xe,oe++}if(!re)return null;return{dynamic:K,commands:j}}function hi(G){return!!G&&/[A-Za-z0-9_]/.test(G)}function Ds(G,U){let j=U;while(/\s/.test(G[j]??""))j++;return j}function yR(G,U){let j=U;while(/[\t\f\v\r ]/.test(G[j]??""))j++;let K=G[j];return!K||`;
-}#`.includes(K)}function Ns(G,U,j){let K="",re=!1;for(let oe=U+1;oe<G.length;oe++){let de=G[oe];if(!de)break;if(re){let Ce=SR(G,oe);if(!Ce)return null;K+=Ce.value,oe=Ce.endIndex,re=!1;continue}if(de==="\\"){re=!0;continue}if(de===j)return{value:K,endIndex:oe+1};K+=de}return null}function bR(G,U){let j=G[U];if(j!=='"'&&j!=="'")return null;return Ns(G,U,j)}function CR(G,U,j){if(!U)return null;return U.startIndex>=G&&U.endIndex===j?U.value:null}function SR(G,U){let j=G[U];if(!j)return null;if(j==="x"){let re=G.slice(U+1,U+3);if(!/^[0-9A-Fa-f]{2}$/.test(re))return null;return{value:String.fromCharCode(Number.parseInt(re,16)),endIndex:U+2}}if(/[0-7]/.test(j)){let re=/^[0-7]{1,3}/.exec(G.slice(U));if(!re)return null;return{value:String.fromCharCode(Number.parseInt(re[0],8)),endIndex:U+re[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[j]??j,endIndex:U}}function Xl(G,U,j){return G.startsWith(j,U)&&!hi(G[U-1])&&!hi(G[U+j.length])}function vR(G,U){return U!==null&&U>=G}function Pf(G,U){let j=G.indexOf(`
-`,U);return j===-1?G.length:j+1}function Tf(G,U){let j=ER(G,U);if(j===-1)return!0;if("{([,;!~=".includes(G[j]??""))return!0;let K=j;while(hi(G[K-1]))K--;return mR.has(G.slice(K,j+1))}function ER(G,U){for(let j=U-1;j>=0;j--)if(!/\s/.test(G[j]??""))return j;return-1}function If(G,U){let j=!1;for(let K=U;K<G.length;K++){let re=G[K];if(!re)break;if(j){j=!1;continue}if(re==="\\"){j=!0;continue}if(re==="/")return K+1}return null}var RR=new Set(["sudo","env","command","builtin"]),_R=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Ls(G,U){let j=G[0];if(!j||!kf(Lt(j),U))return null;let K=Lt(j),re=G[1]==="--"?2:1,oe=xR(G,re,K,U),de=oe[0];if(de===void 0)return null;return{wrapper:K,tokens:G.slice(de),childIndex:de,alternativeChildIndices:oe.slice(1)}}function xR(G,U,j,K){let re=G[1]==="--",oe=[];for(let de=U;de<G.length;de++){let Ce=G[de];if(!Ce)continue;let Ee=Lt(Ce)!==j&&wR(Ce,K);if(Ee)oe.push(de);if(!Ee&&Ui.has(Gt(Ce)))break;if(re)break}return oe}function wR(G,U){let j=Lt(G),K=Gt(G);return K==="git"||j==="busybox"||Br(G)||za.has(j)||Cm(K)||kf(j,U)||Jt.has(K)||G==="$SHELL"||zn(K)||Dn.has(K)||U.rules.some((re)=>re.command===j)}function kf(G,U){return _R.has(G)||U.transparentWrappers.includes(G)}function Br(G){return RR.has(G.toLowerCase())}function Ur(G,U){return{embedded:!1,cwd:G.cwd,originalCwd:U.originalCwd,effectiveCwd:G.cwd,envAssignments:G.envAssignments,allowTmpdirVar:U.allowTmpdirVar,worktreeMode:U.worktreeMode,wrappedByTransparent:!1}}function Hn(G,U){let j=U.policy??{rules:[],transparentWrappers:[]};return Ws([...G],U.environment,U.cwd,U.cwd,new Map,new Map(U.envAssignments??[]),j,{iterations:0},!1)}function*Ws(G,U,j,K,re,oe,de,Ce,Ee){let ke=Ss(G,U,j,oe);for(let[Ze,Je]of ke.envAssignments)oe.set(Ze,Je),re.set(Ze,Je);let{tokens:De,cwd:Xe}=ke;if(ke.envSplitValues){let Ze=Cs(ke.envSplitValues,De);if(!Ze)throw new s("derivedCommandShape");ec(Ce),yield*Ws(Ze,U,Xe,K,re,oe,de,Ce,Ee);return}if(Br(De[0]??""))throw new s("wrapperPeelIterations");let Ye=Ls(De,de);if(Ye){for(let Ze of[Ye.childIndex,...Ye.alternativeChildIndices])ec(Ce),yield*Ws(Ze===Ye.childIndex?Ye.tokens:De.slice(Ze),U,Xe,K,new Map(re),new Map(oe),de,Ce,!0);return}if(PR(De)){ec(Ce),yield*Ws(De.slice(1),U,Xe,K,re,oe,de,Ce,Ee);return}yield AR(De,Xe,K,re,oe,Ee)}function AR(G,U,j,K,re,oe){return{tokens:G,cwd:U===null?void 0:U??j,wrapperCwd:U,wrapperEnvAssignments:K,envAssignments:re,head:Lt(G[0]??"").toLowerCase(),wrappedByTransparent:oe}}function ec(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function PR(G){return Lt(G[0]??"").toLowerCase()==="busybox"&&G.length>1}function tc(G,U){let j=[],K=U;while(K<G.length){let re=G[K];if(re===void 0||re===":::")break;j.push(re),K++}return{markerIndex:K<G.length&&G[K]===":::"?K:-1,templateTokens:j}}function sr(G){let U=!1,j=!1;for(let K of G){if(K==="--")break;if(K==="-r"||K==="-R"||nc(K,"recursive")){U=!0;continue}if(K==="-f"||nc(K,"force")){j=!0;continue}if(K.startsWith("-")&&!K.startsWith("--")){if(K.includes("r")||K.includes("R"))U=!0;if(K.includes("f"))j=!0}}return U&&j}function Gs(G){let U=G.indexOf("--");return G.slice(1,U===-1?void 0:U).some((j)=>nc(j,"recursive")||/^-[A-Za-z]+$/.test(j)&&/[rR]/.test(j.slice(1)))}function nc(G,U){return G.length>2&&G.startsWith("--")&&U.startsWith(G.slice(2))}var TR=["--init-file","--rcfile"],IR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function jn(G){for(let U=1;U<G.length;U++){let j=G[U];if(!j)continue;if(j==="-c")return Of(G,U,!0);if(j.startsWith("-")&&j.includes("c")&&!j.startsWith("--")){let K=Of(G,U,!1);if(K!==null)return K}}return null}function ar(G){let U=Lt(G[0]??"").toLowerCase();if(U==="zsh"||U==="ksh")return wn(G).syntaxCheck;let j=!1;for(let K of G.slice(1)){if(K==="--")return j;if(K.startsWith("+")&&!K.startsWith("++")){if(K.slice(1).includes("n"))j=!1;continue}if(!K.startsWith("-")||K.startsWith("--"))return j;let re=K.slice(1);if(re.includes("n"))j=!0;if(re.includes("c"))return j}return j}function Of(G,U,j){if(G[U+1]==="--")return G[U+2]||null;let K=G[U+1];if(!K||!j&&K.startsWith("-"))return null;return K}function Mf(G){let U=Lt(G[0]??"").toLowerCase(),j=kR(G,U),K=IR.get(U)??null,re=j.argvSource?.kind!=="absent";return{argvSource:U==="bash"?j.argvSource:null,argvSourceApplies:U==="bash"&&j.interactive&&j.argvSource?.kind==="literal",envName:K,envSourceApplies:re&&(K==="BASH_ENV"?!j.interactive:K==="ENV"&&j.interactive)}}function kR(G,U){let j=wn(G),K=j.commandIndex??j.scriptIndex??G.length,re=[],oe=!1,de=!0;for(let Ce=1;Ce<K;Ce++){let Ee=G[Ce];if(Ee===void 0||Ee==="--"||Ee==="-"||Ee[0]!=="-"&&Ee[0]!=="+")break;if(Ee.startsWith("--")){if(U==="bash"&&de?TR.find((Ye)=>Ee===Ye):void 0){let Ye=G[Ce+1];re.push(Ye===void 0?{kind:"absent"}:{kind:"literal",value:Ye}),Ce++;continue}let Xe=Ee.split("=",1)[0]??Ee;if(U==="bash"&&Ga.has(Xe)&&!Ee.includes("="))Ce++;continue}if(U==="bash")de=!1;let ke=Fa(U,Ee,G[Ce+1],"startup");if(ke.interactive)oe=Ee[0]==="-";Ce+=ke.followingValues}return{argvSource:re.at(-1)??null,interactive:oe}}var OR="find -delete permanently removes files. Use -print first to preview.",MR="find -exec rm -rf is dangerous. Use explicit file list instead.",DR=new Set(["-exec","-execdir","-ok","-okdir"]),NR=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((G)=>[G,1]),["-fprintf",2]]);function Df(G,U){let j=G.map(t),K=LR(G,j,U);if(K)return K;if(Fs(j,1)&&!BR(G,j,U)){let de=Dt(At("find.delete",OR),U.policy);if(de)return de}let re=U.budget??On(),oe=0;while(oe<j.length){let de=j[oe],Ce=lr(de??"");if(Ce>0){oe+=Ce+1;continue}if(!Zn(de)){oe++;continue}re.charge("derivedTokens",j.length-oe-1);let Ee=vo(j,oe);oe=Ee.nextIndex;let ke=HR(Ee.tokens,U.environment);if(ke){let Ze=Dt(ke,U.policy);if(Ze)return Ze}let De=de==="-execdir"||de==="-okdir",Xe=U.analyzeTokens?.(Ee.tokens,De?null:U.cwd)??null,Ye=Xe?.id.startsWith("custom.")?Xe:Dt(Xe,U.policy);if(Ye)return Ye}return null}function LR(G,U,j){if(!Fs(U,1)&&!rc(U,j.environment))return null;let re=bi(G)??Xt(["."]),oe=Yn({...j,allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let de of re){let Ce=fi(de);for(let Ee of Ce.expandedTargets??[t(de)]){let ke=Tn(Ee,oe,{targetIsLiteral:Ce.expandedTargets!==void 0||Ce.targetIsLiteral,tmpdirWordSplittingProtected:Ce.tmpdirWordSplittingProtected});if(ke.kind==="root_or_home_target")return At("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ke.kind==="git_metadata_target"&&!WR(G,oe.protectedGitMetadata,j.environment))return At("find.delete-git-metadata",v)}}if($R(U)&&oe.resolvedCwd&&ef(re.map(t),oe.resolvedCwd,oe.protectedGitMetadata,oe.environment,oe.budget))return At("find.delete-git-metadata",v);return null}function WR(G,U,j){if(!U)return!1;let K=G.map(t),re=[],oe=!1,de=bi(G)?.at(-1),Ce=de?G.indexOf(de)+1:1;while(Ce<K.length){let Ee=K[Ce]??"";if(Zn(Ee)){let ke=vo(K,Ce),De=hr([...ke.tokens],j),Xe=Gs(De),Ye=Jt.has(Lt(De[0]??"").toLowerCase()),Ze=ke.tokens.some((Qe)=>Qe!=="{}"&&Qe.includes("{}")),Je=(Ee==="-execdir"||Ee==="-okdir")&&De.slice(1).some((Qe)=>Qe!=="{}"&&!Qe.startsWith("-"));if(Xe||Ye||Ze||Je)return!1;oe=!0,Ce=ke.nextIndex;continue}if(Ee==="-delete"){oe=!0,Ce++;continue}if(Ee==="-name"||Ee==="-iname"){let ke=G[Ce+1];if(!(ke?.provenance==="literal"&&!/[[\\]/.test(ke.text)))return!1;if(!oe)re.push(FR(ke.text,Ee==="-iname"));Ce+=2;continue}if(!GR.has(Ee))return!1;Ce+=1+lr(Ee)}return re.length>0&&!nf(U,(Ee)=>re.every((ke)=>ke.test(Ee)))}var GR=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function FR(G,U){let j=G.replace(/[*?]|[.+^${}()|\]/]/g,(K)=>K==="*"?".*":K==="?"?".":`\\${K}`);return new RegExp(`^${j}$`,U?"isu":"su")}var zR=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function rc(G,U){let j=0;while(j<G.length){if(!Zn(G[j])){j++;continue}let K=vo(G,j),re=hr([...K.tokens],U),oe=Lt(re[0]??"").toLowerCase(),de=Jt.has(oe)&&zR.test((jn(re)??"").replace(/["'\\]/g,""));if((oe==="rm"||oe==="rmdir"||de)&&re.some((Ee)=>Ee.includes("{}")))return!0;j=K.nextIndex}return!1}function $R(G){return G.some((U,j)=>{if(!["-name","-iname"].includes(U))return!1;return G[j+1]?.toLowerCase()==="hooks"})}function BR(G,U,j){if(U.includes("-L")||U.includes("-f")||U.includes("-follow"))return!1;let K=bi(G);if(!K)return!1;let re=j.envAssignments??new Map,oe=jl(re,j.environment),de=j.trustedTmpdirValue??ho(re,j.environment),Ce=j.allowTmpdirVar??!mi(re,j.environment),Ee={environment:j.environment,protectedGitMetadata:j.protectedGitMetadata,cwd:j.cwd,originalCwd:j.originalCwd,strict:j.strict,allowTmpdirVar:Ce&&de&&Boolean(oe),allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:j.tmpdirWordSplittingUnsafe??Fr(re,j.environment),trustedTmpdirValue:de,budget:j.budget},ke=Yn(Ee),De=Yn({...Ee,cwd:j.originalCwd??j.cwd}),Xe=j.originalCwd&&j.environment.paths.realpath(j.originalCwd),Ye=j.cwd&&j.environment.paths.realpath(j.cwd),Ze=Xe&&Ye&&!bo(Ye,Xe)?j.cwd:void 0;return K.every((Je)=>{let Qe=fi(Je);if(Qe.unsafeBraceExpansion)return!1;return(Qe.expandedTargets??[t(Je)]).every((et)=>{let mt=/^\.\/*$/.test(et)?Ze:void 0,Rt=mt??et,gt={targetIsLiteral:Qe.expandedTargets!==void 0||Qe.targetIsLiteral,tmpdirWordSplittingProtected:Qe.tmpdirWordSplittingProtected};if(!nn(j.policy,"rm.recursive-force-paranoid",j.paranoid??!1)&&!mt&&Tn(Rt,ke,gt).kind==="within_anchored_cwd")return!0;return mf(Rt,mt?De:ke,{...gt,containmentTarget:UR(Rt,oe)})})})}function UR(G,U){if(!U)return G;return G.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>U)}function bi(G){let U=(re)=>{let oe=G[re];return oe?t(oe):void 0},j=1;while(U(j)==="-H"||U(j)==="-P")j++;if(U(j)==="--")j++;let K=[];while(j<G.length){let re=U(j),oe=G[j];if(!re||!oe||re.startsWith("-")||["!","(",")"].includes(re))break;K.push(oe),j++}return K.length>0?K:null}function HR(G,U){let j=gr([...G],U);if(j.length===0)return null;let K=Lt(j[0]??"");if(K==="busybox"&&j.length>1)j=j.slice(1),K=Lt(j[0]??"");if(K==="rm"&&sr(j))return At("find.exec-rm-recursive-force",MR);return null}function vo(G,U){let j=U+1;while(j<G.length&&G[j]!==";"&&!(G[j]==="+"&&G[j-1]==="{}"))j++;return{tokens:G.slice(U+1,j),nextIndex:Math.min(j+1,G.length)}}function Fs(G,U){let j=U;while(j<G.length){let K=G[j];if(!K){j++;continue}if(Zn(K)){j=vo(G,j).nextIndex;continue}let re=lr(K);if(re>0){j+=re+1;continue}if(K==="-delete")return!0;j++}return!1}function lr(G){return NR.get(G)??(/^-newer[A-Za-z]{2}$/.test(G)?1:0)}function Zn(G){return G!==void 0&&DR.has(G)}import{resolve as Cx}from"node:path";function*oc(G){for(let U of G.nodes)yield*VR(U)}function jR(G){return Object.freeze([...oc(G)])}function kt(G){return Object.freeze(jR(G).map((U)=>Object.freeze(U.words.map((j)=>j.text))))}function Ci(G){let U=y(G,"posix");if(U.status!=="complete"||U.nodes.length!==1)return null;let j=U.nodes[0];if(j?.kind!=="command")return null;if(j.redirections.length>0||j.nested.length>0)return null;if(j.words.some((K)=>K.provenance==="command-substitution"))return null;return j.words.map((K)=>K.text)}function*VR(G){if(G.kind==="command"){yield G;for(let U of G.nested)yield*oc(U);return}if(G.kind==="group")yield*oc(G.body)}var KR=5,ic="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function dn(G){let U=G.indexOf("--");if(U===-1)return{index:-1,before:G,after:[]};return{index:U,before:G.slice(0,U),after:G.slice(U+1)}}function Lf(G,U,j){let K=zs(G,U,j),re=qR(K.entries);if(re.size===0)return{blockedReason:K.blockedReason,expanded:!1,tokens:G};let oe=G,de=!1;for(let Ce=0;Ce<KR;Ce++){let{subcommand:Ee,rest:ke}=In(oe),De=Ee?.toLowerCase();if(!De||!re.has(De))return{blockedReason:K.blockedReason,expanded:de,tokens:oe};let Xe=re.get(De),Ye=QR(Xe);if(Ye===null||Ye.length===0)return{blockedReason:ic,expanded:!0,tokens:oe};oe=["git",...Ye,...ke],de=!0}return{blockedReason:ic,expanded:!0,tokens:oe}}function Wf(G,U,j){return zs(G,U,j).entries.some((K)=>K.key.toLowerCase()==="core.sshcommand")}function In(G){if(G.length===0)return{subcommand:null,rest:[]};let U=G[0];if((U?Lt(U).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let K=1;while(K<G.length){let re=G[K];if(!re)break;if(re==="--"){let oe=G[K+1];if(oe&&!oe.startsWith("-"))return{subcommand:oe,rest:G.slice(K+2)};return{subcommand:null,rest:G.slice(K+1)}}if(!re.startsWith("-"))return{subcommand:re,rest:G.slice(K+1)};K+=xn.has(re)?2:1}return{subcommand:null,rest:[]}}function qR(G){let U=new Map;for(let j of G){let K=j.key.toLowerCase();if(!K.startsWith("alias."))continue;let re=K.slice(6);if(re!=="")U.set(re,j.value)}return U}function zs(G,U,j){if(G.length===0)return{blockedReason:null,entries:[]};let K=G[0];if((K?Lt(K).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let oe=ZR(U,j);return{blockedReason:oe.blockedReason,entries:[...oe.entries,...YR(G,U,j)]}}function YR(G,U,j){let K=[],re=1;while(re<G.length){let oe=G[re];if(!oe||oe==="--"||!oe.startsWith("-"))return K;if(oe==="-c"){let de=sc(G[re+1]);if(de)K.push(de);re+=2;continue}if(oe.startsWith("-c")&&oe.length>2){let de=sc(oe.slice(2));if(de)K.push(de);re++;continue}if(oe==="--config-env"){let de=Nf(G[re+1],U,j);if(de)K.push(de);re+=2;continue}if(oe.startsWith("--config-env=")){let de=Nf(oe.slice(13),U,j);if(de)K.push(de);re++;continue}if(xn.has(oe)){re+=2;continue}re++}return K}function ZR(G,U){let j=XR(G,U),K=JR(G,U);return{blockedReason:j===null||K===null?ic:null,entries:[...j??[],...K??[]]}}function XR(G,U){let j=or("GIT_CONFIG_PARAMETERS",G,U);if(j===void 0)return[];let K=[],re=Ci(j);if(!re)return null;for(let oe of re){let de=sc(oe);if(!de)return null;K.push(de)}return K}function JR(G,U){let j=Tm(G,U);if(j.state==="absent")return[];if(j.state==="invalid")return null;let K=[];for(let re=0;re<j.count;re++){let oe=or(`GIT_CONFIG_KEY_${re}`,G,U)?.trim(),de=or(`GIT_CONFIG_VALUE_${re}`,G,U);if(!oe||de===void 0)return null;K.push({key:oe,value:de})}return K}function sc(G){if(!G)return null;let U=G.indexOf("=");return{key:(U===-1?G:G.slice(0,U)).trim(),value:U===-1?void 0:G.slice(U+1)}}function Nf(G,U,j){let K=G?.indexOf("=")??-1;if(!G||K===-1)return null;return{key:G.slice(0,K).trim(),value:or(G.slice(K+1),U,j)}}function QR(G){let U=G?.trimStart();if(!U||U.startsWith("!"))return null;return Ci(U)}var e_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",t_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",n_="git checkout --force discards uncommitted changes. Use 'git stash' first.",r_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",o_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",i_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",s_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",a_="git switch --force discards uncommitted changes. Use 'git stash' first.",l_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",c_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",d_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",u_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",m_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",f_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",p_="git push --force destroys remote history. Use --force-with-lease for safer force push.",g_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",h_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",y_="git branch -D force-deletes without merge check. Use -d for safe delete.",b_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",C_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",S_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",v_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",E_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",R_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",__="git worktree remove --force can delete uncommitted changes. Remove --force flag.",x_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),w_=new Set(["--recurse-submodules","--track","-t"]),ac=new Set(["-b","-B","-U"]),lc=new Set(["-c","-C"]),A_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ft(G,U){let j=G.split("=",1)[0]??G;return j.length>=4&&U.startsWith(j)&&j.startsWith("--")&&j.slice(2).length>=2}var Eo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ff(G,U){let{subcommand:j,rest:K}=In(G);if(!j)return null;switch(j.toLowerCase()){case"checkout":return br(P_(K,U));case"switch":return br(I_(K));case"restore":return br(O_(K));case"reset":return D_(K);case"clean":return br(L_(K));case"rm":return br(W_(K));case"push":return Hr(G_(K));case"branch":return Hr($_(K));case"stash":return Hr(V_(K));case"worktree":return Hr(K_(K));case"rebase":return br(B_(K));case"merge":return br(U_(K));case"tag":return Hr(H_(K));case"reflog":return Hr(j_(K));default:return null}}function br(G){return G?{...G,localDiscard:!0}:null}function Hr(G){return G?{...G,localDiscard:!1}:null}function P_(G,U){let{index:j,before:K}=dn(G),re=yn(K,{shortOptsWithValue:ac});if(K.some((Ce)=>Ft(Ce,"--force"))||re.has("-f"))return At("git.checkout-force",n_);for(let Ce of G){if(Ce==="-b"||Ce==="-B"||Ce==="--orphan")return null;if(Ft(Ce,"--pathspec-from-file"))return At("git.checkout-pathspec-from-file",o_)}if(j!==-1){if(K.some((Ee)=>!Ee.startsWith("-")))return At("git.checkout-ref-path",r_);return At("git.checkout-double-dash",e_)}let oe=k_(G);if(oe.length>=2)return At("git.checkout-ambiguous",i_);let de=oe[0];if(de===void 0||re.has("-d")||re.has("-t")||G.some((Ce)=>Ft(Ce,"--detach")||Ft(Ce,"--track")))return null;if(T_(de)||U(de))return At("git.checkout-double-dash",t_);return null}function T_(G){return G==="."||G===".."||/^\.\.?[/\\]/.test(G)||/^([/\\]|[A-Za-z]:[/\\])/.test(G)||G.endsWith("/")||G.startsWith(":")||/[*?[]/.test(G)}function I_(G){let{before:U}=dn(G);if(U.some((K)=>Ft(K,"--discard-changes")))return At("git.switch-discard-changes",s_);let j=yn(U,{shortOptsWithValue:lc});if(U.some((K)=>Ft(K,"--force"))||j.has("-f"))return At("git.switch-force",a_);return null}function k_(G){let U=[],j=0;while(j<G.length){let K=G[j];if(!K)break;if(K==="--")break;if(!K.startsWith("-")){U.push(K),j++;continue}if(x_.has(K)){j+=2;continue}if(w_.has(K)){let re=G[j+1],oe=K==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];j+=re&&!re.startsWith("-")&&oe.includes(re)?2:1;continue}j++}return U}function O_(G){let U=M_(G);if(U.isTerminal||!U.hasPathspec&&!U.hasPatch||!U.hasWorktree)return null;return U.hasExplicitLocation?At("git.restore-worktree",c_):At("git.restore-unstaged",l_)}function M_(G){let U=!1,j=!1,K=!0,re=!1,oe=(de)=>{if(!re)K=!1,re=!0;if(de!==void 0)K=de};for(let de=0;de<G.length;de++){let Ce=G[de];if(Ce===void 0)break;if(Ce==="--"){U||=de+1<G.length;break}if(Ce==="--pathspec-from-file"){U=!0,de++;continue}if(Ce.startsWith("--pathspec-from-file=")){U=!0;continue}if(Ce==="-h"||Ce==="--help"||Ce==="--version")return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!0};if(Ce==="--staged"){oe();continue}if(Ce==="--no-staged"){oe();continue}if(Ce==="--worktree"){oe(!0);continue}if(Ce==="--no-worktree"){oe(!1);continue}if(Ce==="--patch"){j=!0;continue}if(Ce==="--no-patch"){j=!1;continue}if(A_.has(Ce)){de++;continue}if(Ce.startsWith("--"))continue;if(Ce==="-"){U=!0;continue}if(!Ce.startsWith("-")){U=!0;continue}for(let Ee=1;Ee<Ce.length;Ee++){let ke=Ce.charAt(Ee);if(ke==="h")return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!0};if(ke==="S"){oe();continue}if(ke==="W"){oe(!0);continue}if(ke==="p"){j=!0;continue}if(ke==="s"||ke==="U"){if(Ee===Ce.length-1)de++;break}}}return{hasPathspec:U,hasPatch:j,hasWorktree:K,hasExplicitLocation:re,isTerminal:!1}}function D_(G){let U=null;for(let j of G){if(Ft(j,"--hard")){U=At("git.reset-hard",d_);break}if(Ft(j,"--merge")){U=At("git.reset-merge",u_);break}}if(!U)return null;return N_(G)?Hr(U):br(U)}function N_(G){for(let U of G){if(U==="--")return!1;if(!U.startsWith("-"))return!0}return!1}function L_(G){for(let j of G)if(j==="-n"||Ft(j,"--dry-run"))return null;let U=yn(G.filter((j)=>j!=="--"));if(G.some((j)=>Ft(j,"--force"))||U.has("-f"))return At("git.clean-force",m_);return null}function W_(G){let U=!1,j=!1,K=!1;for(let re of dn(G).before){if(Ft(re,"--no-force")){U=!1;continue}if(Ft(re,"--force")){U=!0;continue}if(Ft(re,"--no-cached")){j=!1;continue}if(Ft(re,"--cached")){j=!0;continue}if(Ft(re,"--no-dry-run")){K=!1;continue}if(Ft(re,"--dry-run")){K=!0;continue}let oe=yn([re]);U||=oe.has("-f"),K||=oe.has("-n")}return U&&!j&&!K?At("git.rm-force",f_):null}function G_(G){let{before:U,after:j}=dn(G),K=yn(U);if(U.some((de)=>Ft(de,"--mirror")))return At("git.push-mirror",h_);if(U.some((de)=>Ft(de,"--force"))||K.has("-f")||Gf(U,j).some(F_))return At("git.push-force",p_);if(U.some((de)=>Ft(de,"--delete"))||K.has("-d")||Gf(U,j).some(z_))return At("git.push-delete",g_);return null}function Gf(G,U){return[...G.filter((j)=>j!==""&&!j.startsWith("-")),...U]}function F_(G){return G.startsWith("+")||G.includes(":+")}function z_(G){return G.length>1&&G.startsWith(":")}function $_(G){let{before:U}=dn(G),j=yn(U),K=j.has("-D")||j.has("-d")||U.some((oe)=>Ft(oe,"--delete")),re=j.has("-D")||j.has("-f")||U.some((oe)=>Ft(oe,"--force"));if(K&&re)return At("git.branch-force-delete",y_);return null}function B_(G){let{before:U}=dn(G);return U.some((j)=>Ft(j,"--abort"))?At("git.rebase-abort",b_):null}function U_(G){let{before:U}=dn(G);return U.some((j)=>Ft(j,"--abort"))?At("git.merge-abort",C_):null}function H_(G){let{before:U}=dn(G);return yn(U).has("-d")||U.some((K)=>Ft(K,"--delete"))?At("git.tag-delete",S_):null}function j_(G){return G[0]==="delete"?At("git.reflog-delete",v_):null}function V_(G){for(let U of G){if(U==="drop")return At("git.stash-drop",E_);if(U==="clear")return At("git.stash-clear",R_)}return null}function K_(G){let{before:U}=dn(G);if(!U.includes("remove"))return null;let K=yn(U);if(U.some((re)=>Ft(re,"--force"))||K.has("-f"))return At("git.worktree-remove-force",__);return null}import{dirname as px,isAbsolute as gx,join as ep,resolve as hx}from"node:path";var dc="TMPDIR",uc="IFS",$f=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Bf=/^[A-Za-z_][A-Za-z0-9_]*$/,Uf=new Set(["export","typeset","declare","readonly"]),q_=new Set(["builtin","command","time"]),Y_=new Set(["do","then","else"]),Z_=new Set(["do","then","case"]),zf=new Set(["done","fi","esac"]),X_=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Hf(G,U){return G.map((j)=>j.provenance==="variable"&&Xf(j.text)?jf(j.text,U.shellAssignments):t(j))}function jf(G,U){return G.replace(X_,(j,K,re)=>U.get(K??re??"")??j)}function Xn(G,U){let j=G.parts.every((re)=>re.provenance!=="literal"||!/[$`]/.test(re.raw));if(G.provenance!=="variable"||!j)return null;let K=jf(G.text,U);return/^[~-]/.test(K)||/[\s$`*?[]/.test(K)?null:K}function Vf(G,U){return{env:G,effectiveEnvAssignments:tx(G,U),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Kf(G){return{env:G.env,effectiveEnvAssignments:G.effectiveEnvAssignments?new Map(G.effectiveEnvAssignments):void 0,shellAssignments:new Map(G.shellAssignments),bodyDepth:G.bodyDepth,bodyAssignments:new Set(G.bodyAssignments)}}function mc(G,U){let j=Yf(G,U),K=G[0]??"";if(Z_.has(K))U.bodyDepth+=1;if(K==="elif"||zf.has(K))U.bodyDepth=Math.max(0,U.bodyDepth-1);if(zf.has(K)&&U.bodyDepth===0)U.bodyAssignments.forEach((Ce)=>{U.shellAssignments.delete(Ce)}),U.bodyAssignments.clear();j.assignments.filter((Ce)=>Ce.persists).forEach((Ce)=>{if(U.shellAssignments.set(Ce.name,Ce.value),U.bodyDepth>0)U.bodyAssignments.add(Ce.name);fc(U,Ce)});let re=j.commandIndex;if(re!==-1&&Uf.has(G[re]??""))G.filter((Ce)=>Bf.test(Ce)&&cc(Ce)).forEach((Ce)=>{nx(U,Ce)});let oe=re===-1?-1:Zf(G,re);if(oe===-1||G[oe]!=="unset")return;let de=ox(G,oe);if(de===null)return;G.slice(de).forEach((Ce)=>{if(U.bodyDepth>0){U.shellAssignments.set(Ce,"");return}rx(U,Ce)})}function qf(G,U){let j=Yf(G,U).assignments;if(j.length===0)return U.effectiveEnvAssignments;let K=new Map(U.effectiveEnvAssignments??[]);return j.forEach((re)=>{K.set(re.name,re.value)}),K}function Yf(G,U){let j=Y_.has(G[0]??"")?1:0,K=G.findIndex((Ce,Ee)=>Ee>=j&&!Xf(Ce)),re=K!==-1&&Uf.has(G[Zf(G,K)]??""),oe=ex(U);return{assignments:G.flatMap((Ce,Ee)=>{let ke=J_(Ce,oe,U.env);if(!ke)return[];if(K!==-1&&Ee>K&&!re&&!ys(ke.name))return[];return oe.set(ke.name,ke.value),[{...ke,persists:K===-1||re}]}),commandIndex:K}}function Zf(G,U){let j=U;while(q_.has(G[j]??"")){j+=1;while(G[j]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(G[j]??""))return U;j+=1}}return j}function Xf(G){return Ln(G)!==null||$f.test(G)}function J_(G,U,j){return Ln(G)??Q_(G,U,j)}function Q_(G,U,j){let K=bs(G,j,U);if(K)return K;let re=G.match($f)?.[1];if(!re)return null;let oe=G.indexOf("=");return{name:re,value:`${U.has(re)?U.get(re):j.get(re)??""}${G.slice(oe+1)}`}}function cc(G){return G===dc||G===uc||Ll(G)}function ex(G){return new Map([...G.effectiveEnvAssignments??[],...G.shellAssignments])}function tx(G,U){let j=[dc,uc].map((K)=>{let re=G.get(K);return re===void 0?null:[K,re]}).filter((K)=>K!==null);if(j.length===0)return U;return new Map([...j,...U??[]])}function fc(G,U){let j=new Map(G.effectiveEnvAssignments??[]);j.set(U.name,U.value),G.effectiveEnvAssignments=j}function nx(G,U){fc(G,{name:U,value:G.shellAssignments.get(U)??G.effectiveEnvAssignments?.get(U)??G.env.get(U)??""})}function rx(G,U){if(!cc(U)&&!Bf.test(U))return;if(G.shellAssignments.set(U,""),ys(U)&&G.env.has(U)){let K=new Map(G.env);K.delete(U),G.env=K}if(!cc(U)||U===dc||U===uc||Fo(U)){fc(G,{name:U,value:""});return}if(!G.effectiveEnvAssignments?.has(U))return;let j=new Map(G.effectiveEnvAssignments);j.delete(U),G.effectiveEnvAssignments=j.size===0?void 0:j}function ox(G,U){let j=U+1;while(j<G.length){let K=G[j];if(!K)return null;if(K==="--")return j+1;if(K==="-v"){j++;continue}if(K.startsWith("-"))return null;return j}return j}import{resolve as ix}from"node:path";function $s(G,U){return Nl.some((j)=>U?.has(j)||G.has(j))}function Ro(G,U,j){if(!U)return{gitCwd:null,hasExplicitGitContext:!1};let K=j.realpath(ix(U));if(K===null||!j.isDirectory(K))return{gitCwd:null,hasExplicitGitContext:!1};let re=K,oe=!1,de=1;while(de<G.length){let Ce=G[de];if(!Ce)break;if(Ce==="--")break;if(!Ce.startsWith("-"))break;if(Ce==="-C"){let Ee=G[de+1];if(!Ee)return{gitCwd:null,hasExplicitGitContext:oe};let ke=Jf(re,Ee,j);if(!ke)return{gitCwd:null,hasExplicitGitContext:oe};re=ke,de+=2;continue}if(Ce.startsWith("-C")&&Ce.length>2){let Ee=Jf(re,Ce.slice(2),j);if(!Ee)return{gitCwd:null,hasExplicitGitContext:oe};re=Ee,de++;continue}if(Ce==="--git-dir"||Ce==="--work-tree"){oe=!0,de+=2;continue}if(Ce.startsWith("--git-dir=")||Ce.startsWith("--work-tree=")){oe=!0,de++;continue}de+=xn.has(Ce)?2:1}return{gitCwd:re,hasExplicitGitContext:oe}}function Jf(G,U,j){try{let K=pr(G,U,j);return j.isDirectory(K)?K:null}catch{return null}}function Qf(G,U,j){if(!U.localDiscard||!j.worktreeMode||$s(j.environment.env,j.envAssignments))return null;let K=Ro(G,j.cwd,j.environment.paths);if(!K.gitCwd||K.hasExplicitGitContext)return null;let re=j.environment.worktreeFacts(K.gitCwd);if(!re)return null;if(pc(G,j,re))return null;return{kind:"worktree",originalReason:U.reason,gitCwd:K.gitCwd}}function pc(G,U,j){let{subcommand:K,rest:re}=In(G),oe=K?.toLowerCase();if(U.dynamicArguments||sx(re)||ux(G,U.environment.env,U.envAssignments,j)||cx(re)||ax(oe,re))return!0;return oe==="clean"&&dx(re)>1}function sx(G){return G.some((U)=>/[$*?[]/.test(U))}function ax(G,U){if(G==="checkout"){let{before:j}=dn(U),K=yn(j,{shortOptsWithValue:ac}),re=j.some((de)=>Ft(de,"--force"))||K.has("-f"),oe=K.has("-B")||j.some((de)=>de==="-B"||de.startsWith("-B"));return re&&oe}if(G==="switch"){let{before:j}=dn(U),K=yn(j,{shortOptsWithValue:lc}),re=j.some((de)=>Ft(de,"--force"))||j.some((de)=>Ft(de,"--discard-changes"))||K.has("-f"),oe=j.some((de)=>de==="-C"||de.startsWith("-C")||lx(de))||K.has("-C");return re&&oe}return!1}function lx(G){let U=G.split("=",1)[0]??G;return U==="--force-create"||U.length>=9&&"--force-create".startsWith(U)}function cx(G){return G.some((U)=>U.startsWith("--recurse-sub"))}function dx(G){let U=0;for(let j of G){if(j==="--force"){U++;continue}if(j.startsWith("-")&&!j.startsWith("--")){for(let K of j.slice(1))if(K==="f")U++}}return U}function ux(G,U,j,K){if(or("GIT_CONFIG_PARAMETERS",U,j)!==void 0)return!0;let re=zs(G,U,j);if(re.blockedReason!==null)return!0;let oe=re.entries.map((Ce)=>({key:Ce.key.toLowerCase(),value:Ce.value}));if(oe.some((Ce)=>fx(Ce.key)))return!0;let de=oe.filter((Ce)=>Ce.key==="submodule.recurse").at(-1);if(de)return de.value===void 0||mx(de.value);if(km(j))return!0;return K.recursiveSubmodules}function mx(G){let U=G.toLowerCase();return U!=="false"&&U!=="no"&&U!=="off"&&U!=="0"}function fx(G){return G==="include.path"||G.startsWith("includeif.")&&G.endsWith(".path")}function tp(G,U,j){let K=G.map((Ee)=>Xn(Ee,j.shellAssignments??new Map)??t(Ee)),re=j.environment.paths,oe=Ro(K,j.cwd,re),de=j.originalCwd?re.realpath(hx(j.originalCwd)):null;if(U.id.startsWith("git.push-")||de===null||oe.gitCwd===null||oe.hasExplicitGitContext||$s(j.environment.env,j.envAssignments))return null;let Ce=U.id==="git.worktree-remove-force"?bx(G,j.shellAssignments,re):np(oe.gitCwd,re);if(Ce===null||U.id!=="git.worktree-remove-force"&&!yx(Ce,K,U,j)||!yo(Ce,j.environment)||ks(Ce,j.environment)||bo(de,Ce)||bo(Ce,de))return null;return{kind:"temp-root",originalReason:U.reason,gitCwd:oe.gitCwd}}function yx(G,U,j,K){let re=K.environment.paths,oe=ep(G,".git");if(re.entryKind(oe)!=="present")return!1;if(re.isDirectory(oe))return!0;if(!j.localDiscard)return!1;let Ce=K.environment.worktreeFacts(G);return Ce!==null&&!pc(U,K,Ce)}function bx(G,U,j){let K=In(G.map(t)).rest,{before:re,after:oe}=dn(K.slice(K.indexOf("remove")+1)),de=[...re.filter((De)=>!De.startsWith("-")),...oe],Ce=de.length===1?de[0]??"":"",Ee=G.find((De)=>De.text===Ce),ke=(Ee&&Xn(Ee,U??new Map))??Ce;if(!gx(ke)||/[\s$`*?[]/.test(ke)||j.entryKind(ke)!=="present"||!j.isDirectory(ke))return null;return j.realpath(ke)}function np(G,U){if(U.entryKind(ep(G,".git"))!=="missing")return G;let j=px(G);return j===G?null:np(j,U)}var Sx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",vx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bs(G,U){return rp(G,U)}function rp(G,U,j){let K=G.map(t),re=Lf(K,U.environment.env,U.envAssignments),oe=re.blockedReason?Dt(At("git.alias-config",re.blockedReason),U.policy):null;if(oe)return oe;let de=re.tokens;if((Im(U.envAssignments)||Wf(K,U.environment.env,U.envAssignments))&&Ex(de))return At("git.ssh-env",Sx);let Ce=Ff(de,(ke)=>{let De=Ro(K,U.cwd,U.environment.paths).gitCwd;return De!==null&&U.environment.paths.entryKind(Cx(De,ke))!=="missing"});if(!Ce)return null;if(re.expanded||re.blockedReason)return Ce;let Ee=Qf(K,Ce,U)??tp(G,Ce,U);if(!Ee)return Ce;return j?.(Ee),null}function op(G,U){let j=null;return{match:rp(G,U,(re)=>{j=re}),relaxation:j}}function Ex(G){let{subcommand:U,rest:j}=In(G),K=U?.toLowerCase();if(!K)return!1;if(vx.has(K))return!0;if(K==="archive")return dn(j).before.some((re)=>Ft(re,"--remote"));return K==="remote"&&Rx(j)}function Rx(G){return G.find((U)=>!_x(U))?.toLowerCase()==="update"}function _x(G){return G==="-v"||Ft(G,"--verbose")||Ft(G,"--no-verbose")}import{isAbsolute as ew}from"node:path";function ip(G,U,j,K){let re=G.slice(0,U),oe=G.slice(U+j);return K.startsWith(re)&&K.endsWith(oe)?K.slice(re.length,K.length-oe.length):null}function Us(G,U,j){let K=(oe)=>`${oe.tokenIndex}\x00${oe.kind}\x00${oe.value}`,re=new Set(G.map(K));return Array.from(U).some((oe)=>j(oe).some((de)=>!re.has(K(de))))}var sp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",wx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Ax="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Px="rm -rf in home directory is dangerous. Change to a project directory first.",ap={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Ax},git_metadata_target:{id:"rm.git-metadata",reason:v},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:wx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Px},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:sp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:xx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:sp}};function Hs(G,U){let j=Yn({...U,allowPaths:U.policy?.destructiveCommandAllowPaths,posixShell:!0}),K=G.map(t),re=Gs(K),oe=Ix(G);for(let de of oe){let Ce=fi(de.word);if(re&&Ce.unsafeBraceExpansion){let Ee=Dt($r({kind:"outside_anchored_cwd"},j,U.policy,ap),U.policy);if(Ee)return Ee;continue}for(let Ee of Ce.expandedTargets??[de.text]){let ke=fn(Ee),De={targetIsLiteral:Ce.expandedTargets!==void 0||Ce.targetIsLiteral,tmpdirWordSplittingProtected:Ce.tmpdirWordSplittingProtected};if(!re&&j.resolvedCwd&&Gr(ke,j.resolvedCwd,j.protectedGitMetadata,re,j.environment,j.budget))return At("rm.git-metadata",v);if(!re)continue;for(let Xe of Tx(ke,j,De)){let Ye=$r(Xe,j,U.policy,ap),Ze=Dt(Ye,U.policy);if(Ze)return Ze}}}return null}function Tx(G,U,j){let K=Tn(G,U,j);if(K.kind==="cwd_self_target")return[K,Tn(G,U,{...j,skipCwdSelf:!0})];if(K.kind!=="home_cwd_target")return[K];let re=Tn(G,U,{...j,skipHomeCwd:!0});if(re.kind!=="cwd_self_target")return[K,re];return[K,re,Tn(G,U,{...j,skipHomeCwd:!0,skipCwdSelf:!0})]}function Ix(G){let U=[],j=!1;for(let K of G.slice(1)){let re=t(K);if(!re)continue;if(re==="--"){j=!0;continue}if(j){U.push({text:re,word:K});continue}if(!re.startsWith("-"))U.push({text:re,word:K})}return U}var Cr={kind:"none"},jr={kind:"dynamic"},kx=new Set(["<","<<","<<-","<<<","<&","<>"]),cp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Ox=/^(?:[0-9]+|[@*])$/,Mx=fr.maxWords,dp=fr.maxInputLength;function up(G){if(!G||Lt(Gt(G.words[0]?.text??""))!=="printf")return;if(G.words.some((re)=>re.provenance!=="literal"))return;let U=G.words.slice(G.words[1]?.text==="--"?2:1),j=U[0]?.text;if(j===void 0)return"";let K=U.slice(1).map((re)=>re.text);if(j==="%s")return K.join("");if(j==="%s\\n"||j===`%s
-`)return`${K.join(`
-`)}
-`;if(j.includes("%")||/\\(?![\\nrt])/.test(j))return;return j.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function js(G){let U=_o(G[1])==="--"?2:1;if(G.length<=U)return Cr;let j=G.slice(U);if(!j.every(vi))return jr;return{kind:"literal",source:j.map(t).join(" ")}}function mp(G){let U=_o(G[1])==="--"?2:1,j=G[U],K=_o(j);if(j===void 0||G.length<=U+1||K==="-"||K===""||K==="-l"||K==="-p")return Cr;if(!vi(j))return jr;return{kind:"literal",source:K}}function Vs(G,U){let j=gp(G);if(j===-1)return Cr;let K=Nx(U);if(!K)return Cr;let re=[],oe=K.command?.length??0;for(let de of K.references){let Ce=Wx(de,G,j,K.ifs);if(!Ce)return jr;if(oe+=Ce.reduce((Ee,ke)=>Ee+ke.length+3,0),re.length+Ce.length>Mx||oe>dp)return jr;re.push(...Ce)}if(K.command==="eval")return{kind:"literal",source:re.join(" ")};if(re.length===0||/\s/.test(re[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[K.command,K.command&&K.optionTerminator?"--":null,...re.map(we)].filter((de)=>de!==null).join(" ")}}function fp(G,U){let j=gp(G),K=G.slice(j+1),re=/\bIFS\b/.test(U);if(j===-1||!K.every(vi)||re)return U;let oe=K.map(_o),de="",Ce=null,Ee=0;while(Ee<U.length){let ke=U[Ee]??"",De=Ce==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(U.slice(Ee));if(De){let Xe=De[1]??De[2],Ye=Xe==="@"||Xe==="*"?oe.slice(1):[oe[Number(Xe)]??""];if(Ce!=='"'&&Ye.some((Je)=>/[*?[]/.test(Je)))return U;if(de+=Ce==='"'?Ye.map((Je)=>Je.replace(/["$`\\]/g,"\\$&")).join(Xe==="@"?'" "':" "):Ye.map((Je)=>Je.split(/[ \t\n]+/).map((Qe)=>Qe?we(Qe):"").join(" ")).join(" "),de.length>dp)return U;Ee+=De[0].length;continue}if(ke==="\\"&&Ce!=="'"){de+=U.slice(Ee,Ee+2),Ee+=2;continue}if(ke==="'"&&Ce!=='"'||ke==='"'&&Ce!=="'")Ce=Ce?null:ke;de+=ke,Ee++}return de}function pp(G,U,j,K){if(!wn(G.map(t)).readsStdinAsCommands)return Cr;let re=U.filter((oe)=>(oe.fd===void 0||oe.fd===0)&&kx.has(oe.operator)).at(-1);if(re){if(re.operator==="<<"||re.operator==="<<-")return Cr;if(re.operator!=="<<<"||re.target?.provenance!=="literal")return jr;return{kind:"literal",source:re.target.text}}if(!j)return Cr;return K===void 0?jr:{kind:"literal",source:K}}function cr(G,U=new Map){let j=wn(G.map(t)).scriptIndex;if(j===null)return Cr;let K=G[j],re=_o(K);if(lo(K,re))return{kind:"literal",source:re};let oe=K?Xn(K,U):null;return oe===null?jr:{kind:"literal",source:oe}}var Dx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function bc(G){if(G.words.length!==2||G.redirections.length!==0||G.nested.length!==1)return!1;let U=G.words[0],j=G.words[1];if(!U||U.provenance!=="literal"||U.quoted||U.raw!==U.text||!j)return!1;if(!(U.text==="eval"&&j.quoted&&j.parts.length===3&&j.parts[0]?.raw==='"'&&j.parts[1]?.provenance==="command-substitution"&&j.parts[1].raw.startsWith("$(")&&j.parts[2]?.raw==='"'||U.text==="eval"&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("$(")||(U.text==="source"||U.text===".")&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("<(")))return!1;let re=G.nested[0];if(re?.status!=="complete"||re.nodes.length!==1)return!1;let oe=re.nodes[0];if(oe?.kind!=="command"||oe.redirections.length!==0||oe.nested.length!==0||oe.words.some((Ee)=>Ee.provenance!=="literal"||Ee.parts.some((ke)=>ke.provenance!=="literal")))return!1;let de=oe.words[0]?.text;if(de===void 0||Ln(de)!==null)return!1;let Ce=Lt(Gt(de));return!Dx.has(Ce)&&!Jt.has(Ce)&&!Br(Ce)}function gp(G){return wn(G.map(t)).commandIndex??-1}function Nx(G){let U=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(G.trim()),j=U?.[4]??G.trim(),K=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(j),re=(K?.[3]??j).split(/\s+/).map(Lx);if(re.length===0||re.some((oe)=>oe===null))return null;return{command:K?.[1]??null,optionTerminator:K?.[2]!==void 0,references:re.filter((oe)=>!!oe),ifs:U?U[1]??U[2]??U[3]??"":` 	
-`}}function Lx(G){let U=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(G),j=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(G),K=U??j;if(!K)return null;let re=K[1]??K[2];return{parameter:re==="@"||re==="*"?re:Number(re),quoted:U!==null}}function Wx(G,U,j,K){let re=U.slice(j+2);if(G.parameter==="@")return G.quoted?gc(re):Gx(re,K);if(G.parameter==="*"){let Ce=gc(re);if(!Ce)return;let Ee=Ce.join(K[0]??"");return G.quoted?[Ee]:hc(Ee,K)}let oe=U[j+1+G.parameter];if(oe&&!vi(oe))return;let de=_o(oe);return G.quoted?[de]:hc(de,K)}function gc(G){return G.every(vi)?G.map(t):void 0}function Gx(G,U){let j=gc(G);if(!j)return;let K=j.map((re)=>hc(re,U));return K.some((re)=>re===void 0)?void 0:K.flatMap((re)=>re??[])}function hc(G,U){if(["*","?","[","]"].some((j)=>G.includes(j)))return;if(U==="")return G===""?[]:[G];if(U===` 	
-`)return G.trim().split(/\s+/).filter(Boolean);if(U.length!==1)return;return U===" "||U==="\t"||U===`
-`?G.trim().split(/\s+/).filter(Boolean):G.split(U).filter(Boolean)}function vi(G){if(!G)return!0;return G.provenance==="unknown"?!/[$`]/.test(t(G)):G.provenance==="literal"}function _o(G){return G?t(G):""}function we(G){return`'${G.replaceAll("'",`'"'"'`)}'`}function Cc(G,U){return yc(y(G,"posix"),U)}function Ei(G){return Cc(G,new Set(Array.from(G.matchAll(cp)).flatMap((U)=>{let j=U[1]??U[2];return j===void 0?[]:[j]})))}function yc(G,U){if(G.status==="invalid"||G.status==="limited")return!1;let j=new Set(U);for(let K of G.nodes){if(K.kind==="group"){if(yc(K.body,j))return!0;continue}if(K.kind!=="command")continue;if(K.nested.some((re)=>yc(re,j))||hp(K.words,j))return!0;Ux(K,j)}return!1}function hp(G,U){let j=G.findIndex((de)=>Ln(de.text)===null);if(j===-1)return!1;let K=G[j];if(!K)return!1;if(Si(K,U))return!0;let re=Gt(K.text);if(re==="source"||re==="."){let de=G[j+1]?.text==="--"?j+2:j+1;return lp(G[de],U)}if(Jt.has(re)){let de=G.slice(j),Ce=wn(de.map((ke)=>ke.text)),Ee=Ce.commandIndex??Ce.scriptIndex;return!Ce.syntaxCheck&&Ee!==null&&lp(de[Ee],U)}let oe=Fx(G,j,U);if(oe===null)return!1;if(oe===-1)return!0;return hp(G.slice(oe),U)}function Fx(G,U,j){let K=Gt(G[U]?.text??"");if(K==="command")return zx(G,U+1);if(K==="exec")return $x(G,U+1);if(K==="env")return Bx(G,U+1,j);return null}function zx(G,U){for(let j=U;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return G[j+1]?j+1:null;if(/^-[p]*[vV][pvV]*$/.test(K))return null;if(/^-p+$/.test(K))continue;return j}return null}function $x(G,U){for(let j=U;j<G.length;j++){let K=G[j]?.text??"";if(K==="--")return G[j+1]?j+1:null;if(K==="-a"){j++;continue}if(/^-a.+/.test(K)||/^-[cl]+$/.test(K))continue;return j}return null}function Bx(G,U,j){for(let K=U;K<G.length;K++){let re=G[K],oe=re?.text??"";if(oe==="--")return G[K+1]?K+1:null;if(oe==="-S"||oe==="--split-string")return Si(G[K+1],j)?-1:K+2;if(oe.startsWith("-S")||oe.startsWith("--split-string="))return Si(re,j)?-1:K+1;if(oe==="-u"||oe==="--unset"||oe==="-C"||oe==="--chdir"||oe==="-P"){K++;continue}if(oe==="-i"||oe==="-0"||oe==="--null"||oe.startsWith("-u=")||oe.startsWith("--unset=")||oe.startsWith("-C")||oe.startsWith("--chdir=")||oe.startsWith("-P"))continue;if(oe.startsWith("-"))continue;if(Ln(oe))continue;return K}return null}function Ux(G,U){if(!G.words.every((j)=>Ln(j.text)!==null))return;for(let j of G.words){let K=Ln(j.text);if(!K)continue;if(Si(j,U))U.add(K.name)}}function Si(G,U){if(!G)return!1;return G.parts.filter((j)=>j.provenance==="variable").some((j)=>Array.from(j.raw.matchAll(cp)).some((K)=>{let re=K[1]??K[2];return re!==void 0&&(Ox.test(re)||U.has(re))}))}function lp(G,U){return!!G&&(G.parts.some((j)=>j.provenance!=="literal"&&j.provenance!=="variable")||Si(G,U))}var Sc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",vc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Hx="__CC_SAFETY_NET_XARGS_INPUT__",Ks="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qs="rm",jx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Vx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Kx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,qx=/^(?:[0-9]+|[@*])$/;function Cp(G,U){let j=G.map(t),{childStart:K,replacementToken:re}=Vr(j),oe=j.slice(K),de=At("xargs.shell-dynamic",vc);if(Zx(oe,re,U)&&Dt(de,U.policy))return Dt(de,U.policy);for(let Ce of Hn(oe,U)){let Ee=Ce.tokens,ke=re!==null&&Ee[0]!==oe[0]&&(Ee[0]?.includes(re)??!1)?Dt(de,U.policy):null;if(ke)return ke;let De=xp(Ee,re,Ce.wrapperEnvAssignments),Xe=Ce.head==="rm"&&re!==null&&Rp(Ee,re),Ye=U.analyzeChild(Ee,{...Ur(Ce,U),dynamicInput:De,dynamicSourceInput:Xe||vp(Ee,Ce.head,re,Ce.wrapperEnvAssignments,De,U.environment,U.strict?void 0:U.analyzeNested),dynamicRmInput:Xe,shellDynamicMatch:de,dynamicSourceMatch:de,rmDynamicMatch:At("xargs.rm-recursive-force-dynamic",Sc)});if(Ye)return Ye;let Ze=Yx(Ee,re,U.policy?.rules??[],Dt(de,U.policy));if(Ze)return Ze;if(Ce.head==="git"){let Qe=re===null?[...Ee,Hx]:Ee,et=re!==null&&(Ee.some((Rt)=>Rt.includes(re))||Array.from(Ce.envAssignments.values()).some((Rt)=>Rt.includes(re))),mt=U.analyzeChild(Qe,{...Ur(Ce,U),worktreeMode:re===null||et?!1:U.worktreeMode});if(mt)return mt}let Je=D(Ee,U.policy?.rules??[]);if(Je)return Je}return null}function Yx(G,U,j,K){if(j.length===0)return null;if(U===null){for(let oe of j){let de=D([...G,...oe.subcommand?[oe.subcommand]:[],...oe.block_args],j);if(de)return de}return null}let re=Gt(G[0]??"");if(!j.some((oe)=>Gt(oe.command)===re))return null;return G.slice(1).some((oe)=>oe.includes(U))?K:null}function Sp(G,U,j){let K=G.indexOf(U);if(K===-1||G.indexOf(U,K+U.length)!==-1)return[];let re=ip(G,K,U.length,j);return re===null?[]:[re]}function vp(G,U,j,K,re,oe,de){if(Jt.has(U)){if(ar(G))return!1;if(j!==null&&Xx(G,j,de))return!0;let Ce=jn(G);if(!Ce){let Ee=cr(Xt(G));if(Ee.kind==="literal")return j!==null&&Ee.source.includes(j);return Ee.kind==="none"&&re}if(j!==null&&Ce.includes(j)&&!Ep(Ce,j,de))return!0;if(Nn(Ce))return!0;return Jx(Ce,j,K)}if(zn(U))return yp(G,j,gs,xm(U));if(Dn.has(U))return yp(G,j,Jl,wf);if(U==="eval"){let Ce=js(Xt(G));if(Ce.kind==="dynamic")return!0;if(j!==null)return Ce.kind==="literal"&&Ce.source.includes(j);return re}if(U==="find")return Qx(G,j,oe);if(U==="git"){let Ce=In(G);return j===null?Ce.subcommand===null:(Ce.subcommand?.includes(j)??!1)||Ce.subcommand!==null&&Eo.has(Ce.subcommand.toLowerCase())&&_p(Ce.rest,j).some((Ee)=>Ee.includes(j))}return!1}function Ep(G,U,j){if(j===void 0)return!1;let K=U.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${K}`).test(G)||/\bcase\b/.test(G))return!1;let oe=G.replaceAll(U,"/");return Nn(oe)===null&&j(oe)===null}function yp(G,U,j,K){let re=j(G);if(U===null)return re.optionsOpen||j([...G,Ks]).sources.some((Ce)=>Ce.value===Ks);if(re.sources.some((Ce)=>Ce.value.includes(U)))return!0;let oe=K.flatMap((Ce)=>[Ce.selector,...Ce.valueForm==="attached-only"||Ce.valueForm==="attached-or-separate"?[`${Ce.selector}${Ks}`]:[],...Ce.valueForm==="equals-or-separate"?[`${Ce.selector}=${Ks}`]:[]]),de=new Set(oe.flatMap((Ce)=>G.flatMap((Ee)=>Sp(Ee,U,Ce))));return Us(re.sources,de,(Ce)=>j(G.map((Ee)=>Ee.replaceAll(U,Ce))).sources)}function Zx(G,U,j){if(G.length===0||(G[0]??"").toLowerCase()==="command")return!1;let K=new Set(Array.from(Hn(G,j),(oe)=>oe.head)),re=U===null?[...G,qs]:G.map((oe,de)=>de===0?oe:oe.replaceAll(U,qs));return Array.from(Hn(re,j)).some((oe)=>oe.head===qs&&!K.has(qs))}function Rp(G,U){return _p(G.slice(1),U).some((j)=>j.includes(U)&&(j.startsWith("-")||j.startsWith(U)))}function _p(G,U){let j=G.findIndex((K)=>K==="--"&&!K.includes(U));return j===-1?G:G.slice(0,j)}function xp(G,U,j){if(U===null)return!0;return G.some((K)=>K.includes(U))||Array.from(j.values()).some((K)=>K.includes(U))}function Xx(G,U,j){let K=wn(G),re=K.commandIndex===null?"":G[K.commandIndex]??"";if(re.includes(U)&&!Ep(re,U,j)||K.scriptIndex!==null&&(G[K.scriptIndex]??"").includes(U))return!0;return["-c","-nc","-cn",`--${U}`,U].some((de)=>G.some((Ce,Ee)=>{if(Ee===0||!Ce.includes(U))return!1;return Sp(Ce,U,de).some((De)=>{let Xe=G.map((Ze,Je)=>Je===Ee?Ze.replaceAll(U,De):Ze),Ye=wn(Xe);if(Ye.commandIndex===null&&Ye.scriptIndex===null)return!1;if(K.commandIndex===null&&Ye.commandIndex!==null)return!0;if(K.scriptIndex===null&&Ye.scriptIndex!==null)return!0;if(Ye.commandIndex!==null&&(Xe[Ye.commandIndex]??"").includes(De))return!0;return Ye.scriptIndex!==null&&(Xe[Ye.scriptIndex]??"").includes(De)})}))}function Jx(G,U,j){let K=new Set(U===null?[]:Array.from(j).filter(([,re])=>re.includes(U)).map(([re])=>re));for(let re of G.matchAll(jx))if(bp(re,K))return!0;for(let re of G.matchAll(Vx))for(let oe of(re[1]??"").matchAll(Kx))if(bp(oe,K))return!0;return Cc(G,K)}function bp(G,U){let j=G[1]??G[2];return j!==void 0&&(qx.test(j)||U.has(j))}function Qx(G,U,j){if(U===null)return!0;let K=!1,re=0;for(let oe=1;oe<G.length;oe++){let de=G[oe]??"";if(!K&&!de.startsWith("-")&&de!=="!"&&de!=="("){if(de.indexOf(U)===0)return!0;continue}if(K=!0,re>0){re--;continue}if(Zn(de)){let Ee=vo(G,oe);oe=Ee.nextIndex-1;for(let ke of Hn(Ee.tokens,{environment:j,cwd:void 0})){let De=xp(ke.tokens,U,ke.wrapperEnvAssignments);if(ke.head==="rm"&&Rp(ke.tokens,U)||vp(ke.tokens,ke.head,U,ke.wrapperEnvAssignments,De,j))return!0}continue}let Ce=lr(de);if(Ce>0){if(re=Ce,de.includes(U))return!0;continue}if(de.includes(U))return!0}return!1}function Vr(G){let U=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),j=null,K=1;while(K<G.length){let re=G[K];if(!re)break;if(re==="--")return{childStart:K+1,replacementToken:j};if(!re.startsWith("-"))return{childStart:K,replacementToken:j};if(re==="-I"){j=G[K+1]??"{}",K+=2;continue}if(re.startsWith("-I")&&re.length>2){j=re.slice(2),K++;continue}if(re==="--replace"){j="{}",K++;continue}if(re.startsWith("--replace=")){let oe=re.slice(10);j=oe===""?"{}":oe,K++;continue}if(re==="-J"){j=G[K+1]??"{}",K+=2;continue}K+=U.has(re)?2:1}return{childStart:G.length,replacementToken:j}}var Ri="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",_i="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",tw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",nw="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zs=/\{[^{}\s]*\}/g,wp=/\{\}|\{-?\d+\}/g,Ap=/[\s;&|<>()$`\\"']/,rw=["e","f","source","file","-e","-f","--source","--file"],ow=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],iw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),sw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Pp=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),aw=new Set(["--workdir","--wd"]),Tp="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Wn(G,U){for(let j of G){let K=U(j);if(K)return K}return null}function Op(G){return Wn([...G],(U)=>Nn(U))}function Mp(G,U){let j=G.map(t);if((U.envAssignments?.has("PARALLEL")?U.envAssignments.get("PARALLEL"):U.environment.env.get("PARALLEL"))?.trim()){let Je=xo(U);if(Je)return Je}if(j.length===2&&(j[1]==="--version"||j[1]==="--help"))return null;let re=jp(j),{template:oe,jobs:de,runsRemotely:Ce,readsCommandsFromInput:Ee,unsupported:ke,workdir:De,dryRun:Xe}=re;if(ke){let Je=xo(U);if(Je)return Je;let Qe=Op(U.envAssignments?.values()??[]);if(Qe)return Qe}if(Ee){let Je=pw(U);if(Je)return Je}if(De!==void 0&&Ce){let Je=xo(U);if(Je)return Je}let Ye=gw(De,U.cwd,U.environment.paths);if(Ye===null){let Je=xo(U);if(Je)return Je}let Ze=Ce?{...U,cwd:void 0,originalCwd:void 0}:Ye===null||Ye===void 0||Ye===U.cwd?U:{...U,cwd:Ye};if(Xe){if([...Hn(oe,Ze)].flatMap((Qe)=>[...Qe.envAssignments.values()]).some(_c)){let Qe=xo(U);if(Qe)return Qe}return null}if(oe.length===0){let Je=de.map((et)=>et[0]??"");U.budget.charge("derivedTokens",Je.length);let Qe=Fp(Ze.envAssignments,Ze.cwd,Ce);return Wn(Je,(et)=>U.analyzeNested(et,Qe))}return Wn(Hn(oe,Ze),(Je)=>lw(Je,re,U,Ze))}function lw(G,U,j,K){let{templateHasPlaceholder:re,runsRemotely:oe,usesStdin:de}=U,Ce=G.tokens,Ee=[...G.envAssignments.values()];if(Ee.some(Up)){let _t=xo(j);if(_t)return _t}let ke=Op(Ee);if(ke)return ke;let De=Ee.some(Ht),Xe=re||De,Ye=de&&Xe,Ze=Fp(G.envAssignments,G.wrapperCwd,oe||Ye),Je=Xe?{...Ze,worktreeMode:!1}:Ze,Qe=Ce.join(" "),et=Ht(Qe.split(/[ \t\n=]/,1)[0]??""),mt=!U.quotesCommand&&(et||Ce.some((_t)=>Ap.test(_t))),Rt=et||Ap.test(Ce[0]??""),gt=mt&&Rt&&U.jobs.length>0?null:cw(G,U,j,K,Je,De);if(gt||!mt)return gt;return Dp(Ht(Qe)?Qe:`${Qe} {}`,!et,G,U,j,K,Je)}function cw(G,U,j,K,re,oe){let{jobs:de,templateHasPlaceholder:Ce,runsRemotely:Ee,usesStdin:ke}=U,De=G.tokens,Xe=Ce||oe;if(Jt.has(G.head)){let Ze=()=>{if(!Ce||de.length===0)return null;return Wn(de,(et)=>j.analyzeChild(Ys(De,et,j.budget),Ur(G,K)))};if(ar(De))return Ze();let Je=jn(De);if(Je){if(Hp(Je)){let gt=Sr(j);if(gt)return gt;if(de.length===0)return null;return Wn(de,(_t)=>j.analyzeNested($p(Je,_t,j.budget),re))}if(Ht(Je))return Dp(Je,!1,G,U,j,K,re);let et=!oe&&(!Ce||de.length>0)?(de.length>0?de:[void 0]).map((gt)=>Vs(Xt(gt===void 0?De:Ce?De.map((_t)=>zp(_t,gt)):[...De,...gt]),Je)):[];if(et.some((gt)=>gt.kind==="dynamic")){let gt=Sr(j);if(gt)return gt}let mt=et.flatMap((gt)=>gt.kind==="literal"?[gt.source]:[]);if(mt.length>0)return j.budget.charge("derivedTokens",mt.length),Wn(mt,(gt)=>j.analyzeNested(gt,re));if(Ei(Je)){let gt=Sr(j);if(gt)return gt}let Rt=j.analyzeNested(Je,re);if(Rt)return Rt;if(Xe)return Sr(j);return null}let Qe=cr(Xt(De));if(Qe.kind==="dynamic"||Qe.kind==="literal"&&Ht(Qe.source))return Sr(j)??Ze();if(Qe.kind==="literal")return Ze();if(de.length>0){let et=Sr(j);if(et)return et;let mt=Ze();if(mt)return mt;if(Ce)return null;let Rt=de.flatMap((gt)=>gt[0]===void 0?[]:[gt[0]]);return j.budget.charge("derivedTokens",Rt.length),Wn(Rt,(gt)=>j.analyzeNested(gt,re))}if(Xe||ke)return Sr(j)??Ze();return null}if(G.head==="rm"&&sr(De)){if(Ce&&de.length>0)return Wn(de,(Je)=>Ec(Ys(De,Je,j.budget,wp),G.cwd,K));if(de.length>0)return Wn(de,(Je)=>Ec(kp(De,Je,j.budget),G.cwd,K));let Ze=Ec(De.flatMap((Je,Qe)=>{if(Qe===0||!Ht(Je))return[Je];return Je.startsWith("-")?[Je.replace(wp,"")]:[]}),G.cwd,K);if(Ze)return Ze;return Gp(j)}let Ye=de.length>0?de:[void 0];return Wn(Ye,(Ze)=>{let Je=Ze===void 0?De:Ce?Ys(De,Ze,j.budget):kp(De,Ze,j.budget),Qe=At("parallel.shell-dynamic",_i),et=ke&&G.head==="find"?fw(Je,K):null,mt=Lp(Je,ke,j)??et?.customResult??null,Rt=Gt(G.head),gt=ke&&(Rt==="rm"&&Rc(Je)||Rt==="xargs"&&Wp(Je)||et?.rmOptions===!0),_t=ke&&(gt||et?.executedSource===!0||et===null&&Np(Je,Rt)),It=j.analyzeChild(Je,{...Ur(G,K),worktreeMode:Ee||ke||Xe?!1:j.worktreeMode,dynamicInput:ke||Xe,dynamicRmInput:gt,dynamicSourceInput:mt!==null||_t,shellDynamicMatch:Qe,dynamicSourceMatch:Qe,rmDynamicMatch:At("parallel.rm-recursive-force-dynamic",Ri)});if(_t){let Mt=Dt(Qe,j.policy);if(Mt)return Mt}return It??mt??D(Je,j.policy?.rules??[])})}function Dp(G,U,j,K,re,oe,de){if(K.jobs.length>0)return Wn(K.jobs,(ke)=>re.analyzeNested($p(G,U?ke.map(we):ke,re.budget),de));let Ce=Ci(G);if(Ce?.[0]&&Gt(Ce[0])==="rm"&&sr(Ce)){let ke=Gp(re);if(ke)return ke}return(Ce?re.analyzeChild(Ce,{...Ur(j,oe),dynamicInput:K.usesStdin,shellDynamicMatch:At("parallel.shell-dynamic",_i),rmDynamicMatch:At("parallel.rm-recursive-force-dynamic",Ri)}):null)??re.analyzeNested(G,de)}function Np(G,U){if(Ht(G[0]??""))return!0;if(U==="eval"||U==="source"||U===".")return!0;if(U==="parallel"||U==="xargs")return!0;if(Jt.has(U))return mw(G);if(U==="git")return dw(G);if(U==="find")return!0;if(Dn.has(U))return Ip(G,rw,yi);if(zn(U))return Ip(G,ow,ps);return!1}function Rc(G){let U=G.indexOf("--"),j=G.slice(1,U===-1?void 0:U);if(!G.some(Ht))return U===-1;return j.some((re)=>Ht(re)&&(re.startsWith("-")||Hp(re)))}function dw(G){if(uw(G))return!0;let U=In(G);if(U.subcommand===null||Ht(U.subcommand))return!0;if(!Eo.has(U.subcommand.toLowerCase()))return!1;let j=U.rest.indexOf("--"),K=U.rest.slice(0,j===-1?void 0:j);if(!G.some(Ht))return j===-1;return K.some(Ht)}function uw(G){for(let U=1;U<G.length;U++){let j=G[U];if(!j||j==="--"||!j.startsWith("-"))return!1;if(j==="-c"||j==="--config-env"){if(Ht(G[U+1]??""))return!0;U++;continue}if(j.startsWith("-c")&&j.length>2||j.startsWith("--config-env=")){if(Ht(j))return!0;continue}if(Ht(j))return!0}return!1}function mw(G){if(ar(G))return!1;let U=jn(G);if(U!==null)return Ht(U);let j=cr(Xt(G));if(j.kind==="literal")return Ht(j.source);if(j.kind==="dynamic")return!0;return!G.some(Ht)}function Ip(G,U,j){let K=j(G);if(K.some((re)=>Ht(re.value)))return!0;if(!G.some(Ht))return j([...G,Tp]).some((re)=>re.value===Tp);return Us(K,U,(re)=>j(G.map((oe)=>zp(oe,[re]))))}function Lp(G,U,j){let K=j.policy?.rules??[];if(!U||K.length===0)return null;let re=K.filter((oe)=>Gt(oe.command)===Gt(G[0]??""));if(re.length===0)return null;if(G.slice(1).some(Ht))return Sr(j);return Wn(re,(oe)=>D([...G,...oe.subcommand?[oe.subcommand]:[],...oe.block_args],[oe]))}function fw(G,U){let j={customResult:null,executedSource:!G.some(Ht),rmOptions:!1},K=!1,re=0,oe=null,de=()=>{if(!oe?.some(Ht))return;for(let Ce of Hn(oe,U))j.executedSource||=Np(Ce.tokens,Ce.head),j.rmOptions||=Ce.head==="rm"&&Rc(Ce.tokens)||Ce.head==="xargs"&&Wp(Ce.tokens),j.customResult??=Lp(Ce.tokens,!0,U)};for(let Ce of G.slice(1)){if(!K&&!Ce.startsWith("-")&&Ce!=="!"&&Ce!=="("){j.executedSource||=Ht(Ce);continue}if(K=!0,oe){if(Ce===";"||Ce==="+"){de(),oe=null;continue}oe.push(Ce);continue}if(re>0){re--;continue}if(Zn(Ce)){oe=[],j.executedSource||=Ht(Ce);continue}let Ee=lr(Ce);if(Ee>0){re=Ee,j.executedSource||=Ht(Ce);continue}j.executedSource||=Ht(Ce)}return de(),j}function Wp(G){let U=G.slice(Vr(G).childStart);return Gt(U[0]??"")==="rm"&&Rc(U)}function Xs(G,U){return(j)=>Dt(At(G,U),j.policy)}var Sr=Xs("parallel.shell-dynamic",_i),pw=Xs("parallel.command-stream-dynamic",tw),xo=Xs("parallel.command-stream-dynamic",nw),Gp=Xs("parallel.rm-recursive-force-dynamic",Ri);function Ec(G,U,j){return Dt(Hs(Xt(G),{environment:j.environment,cwd:U,budget:j.budget,originalCwd:j.originalCwd,strict:j.strict,paranoid:j.paranoidRm,allowTmpdirVar:j.allowTmpdirVar,tmpdirWordSplittingUnsafe:Fr(j.envAssignments??new Map,j.environment),trustedTmpdirValue:ho(j.envAssignments??new Map,j.environment),protectedGitMetadata:j.protectedGitMetadata,policy:j.policy}),j.policy)}function Fp(G,U,j){let K={};if(G)K.envAssignments=G;if(j)return K.effectiveCwd=null,K.worktreeMode=!1,K;if(U!==void 0)K.effectiveCwd=U;return Object.keys(K).length>0?K:void 0}function zp(G,U){return G.replace(Zs,(j)=>Bp(j,U))}function Ys(G,U,j,K=Zs){return j.charge("derivedTokens",G.reduce((re,oe)=>re+1+Math.floor(oe.length/64),0)),G.map((re)=>re.replace(K,(oe)=>{let de=Bp(oe,U);return j.charge("derivedTokens",Math.max(1,Math.ceil(de.length/64))),de}))}function $p(G,U,j){return Ys([G],U,j)[0]??""}function kp(G,U,j){return j.charge("derivedTokens",G.length+U.length),[...G,...U]}function Bp(G,U){let j=/^\{(-?\d+)[^{}\s]*\}$/.exec(G)?.[1];if(j===void 0)return U[0]??"";let K=Number(j);return U[K>0?K-1:U.length+K]??""}function Ht(G){return G.search(Zs)!==-1}function Up(G){if(_c(G))return!0;for(let U of G.matchAll(Zs))if(!/^(?:\{\}|\{\d+\})$/.test(U[0]))return!0;return!1}function _c(G){let U=G.indexOf("{=");return U!==-1&&G.indexOf("=}",U+2)!==-1}function Hp(G){return/^\{[^{}\s]*\}$/.test(G)}function gw(G,U,j){if(G===void 0)return;if(G==="..."||/^~|[{}$`*?[]/.test(G))return null;if(!U&&!ew(G))return null;try{return pr(U??G,G,j)}catch{return null}}function jp(G){let U=1,j=[],K=G.length,re=-1,oe=!1,de=!1,Ce=!1,Ee,ke=!1,De=G.some((Qe)=>Qe==="::::"||Qe==="::::+"||Qe===":::+");while(U<G.length){let Qe=G[U];if(Qe===void 0)break;if(Qe===":::"){re=U;break}if(Qe==="--"){let _t=tc(G,U+1);j.push(..._t.templateTokens),K=U+1,re=_t.markerIndex;break}if(!Qe.startsWith("-")){let _t=tc(G,U);j.push(..._t.templateTokens),K=U,re=_t.markerIndex;break}let et=G[U+1],mt=Qe.indexOf("="),Rt=mt===-1?Qe:Qe.slice(0,mt),gt=mt===-1?void 0:Qe.slice(mt+1);if(Qe==="--dry-run"){ke=!0,U++;continue}if(Qe==="-I"||Qe.startsWith("-I")&&Qe.length>2){De||=(Qe==="-I"?et:Qe.slice(2))!=="{}",U+=Qe==="-I"?2:1;continue}if(Qe==="--replace"||Qe==="-i"){De=!0,U+=2;continue}if(Rt==="--replace"||Qe.startsWith("-i")&&Qe.length>2){let _t=Rt==="--replace"?gt:Qe.slice(2);De||=_t!==""&&_t!=="{}",U++;continue}if(Qe==="-a"||sw.has(Rt)){De=!0,U+=gt===void 0?2:1;continue}if(Qe==="-q"||Qe==="--quote"){de=!0,U++;continue}if(Qe==="--pipe"||Qe==="--pipepart"){Ce=!0,U++;continue}if(Rt==="--env"){De=!0,U+=gt===void 0?2:1;continue}if(Pp.has(Rt)||Qe.startsWith("-S")&&Qe.length>2){oe=!0,U+=Pp.has(Qe)?2:1;continue}if(aw.has(Rt)){De=!0;let _t=gt??et;if(_t===void 0||_t===":::"||_t==="--"){U++;continue}Ee=_t,U+=gt===void 0?2:1;continue}if(Qe.startsWith("-j")&&Qe.length>2&&/^\d+$/.test(Qe.slice(2))){U++;continue}if(Qe.startsWith("--")&&gt!==void 0){U++;continue}if(iw.has(Qe)){if(et===void 0||et===":::"||et==="--"){De=!0,U++;continue}U+=2;continue}U+=Qe==="-j"||Qe==="--jobs"?2:1}De||=j.some(ke?_c:Up);let Xe=[];if(re!==-1){let Qe=[];for(let et=re+1;et<G.length;et++){let mt=G[et];if(mt===":::"){Xe.push(Qe),Qe=[];continue}if(mt!==void 0)Qe.push(mt)}Xe.push(Qe)}De||=Xe.length>1;let Ye=hw(Xe),Ze=j.some(Ht),Je=j.length===0&&re===-1;return{template:j,jobs:Ye,childStart:K,templateHasPlaceholder:Ze,runsRemotely:oe,quotesCommand:de,usesStdin:Ce||re===-1,readsCommandsFromInput:Je,unsupported:De,workdir:Ee,dryRun:ke}}function hw(G){if(G.length===0||G.some((j)=>j.length===0))return[];let U=[[]];for(let[j,K]of G.entries()){if(K.length===1){let oe=K[0];if(oe===void 0)return[];for(let de of U)de.push(oe);if(U.length*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let re=[];for(let oe of U)for(let de of K){if((re.length+1)*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");re.push([...oe,de])}U=re}return U}function Vp(G){return jp(G).childStart}var yw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Js="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function wc(G){return G?.parts.some((U)=>U.provenance==="command-substitution")??!1}function xc(G){return G?.parts.some((U)=>U.provenance==="literal"&&U.raw.replace(/^["']/,"").startsWith("-"))??!1}function qp(G,U,j,K,re=!1,oe){let Ce=(Yo(G,U)||K&&G!=="powershell"&&U[0]?.provenance==="variable")&&nn(oe,"shell.dynamic-executable",re)?At("shell.dynamic-executable",yw):null;return Dt(Ce,oe)??Yp(G,U,j,re,oe)}function Yp(G,U,j,K,re){if(U.length<2)return null;let oe=U.flatMap((Ce,Ee)=>wc(Ce)?[Ee]:[]);if(oe.length===0)return null;let de=Gt(U[0]?.text??"");if(de==="git"){let Ce=ne(G,U),Ee=Cw(Ce);if(nn(re,"shell.dynamic-structure",K)&&oe.some((Xe)=>Xe<=Ee))return Dt(At("shell.dynamic-structure",Js),re);if(Dt(Bs(Ce,{environment:j}),re))return null;let ke=U[Ee]?.text.toLowerCase(),De=Ce.findIndex((Xe,Ye)=>Ye>Ee&&t(Xe)==="--");if(nn(re,"shell.dynamic-structure",K)&&ke&&Eo.has(ke)&&oe.some((Xe)=>Xe>Ee&&(De===-1||Xe<De)))return Dt(At("shell.dynamic-structure",Js),re);return null}if(de==="find")return nn(re,"shell.dynamic-structure",K)&&Sw(U)?Dt(At("shell.dynamic-structure",Js),re):null;if(de==="rm"){let Ce=U.findIndex((ke,De)=>De>0&&t(ke)==="--"),Ee=sr(U.map(t));return nn(re,"shell.dynamic-structure",K)&&oe.some((ke)=>(Ce===-1||ke<Ce)&&(ke<U.length-1||!Ee))?Dt(At("shell.dynamic-structure",Js),re):null}if(de==="xargs")return Kp(G,U.slice(Vr(U.map(t)).childStart),"xargs",j,K,re);if(de==="parallel")return Kp(G,U.slice(Vp(U.map(t))),"parallel",j,K,re);return null}function Kp(G,U,j,K,re,oe){if(U.length===0)return null;let de=bw(U,K);if(Yo(G,de)){let Ee=Dt(At(`${j}.shell-dynamic`,j==="xargs"?vc:_i),oe);if(Ee)return Ee}let Ce=Yp(G,de,K,re,oe);if(Ce)return Ce;if(de[0]?.text==="rm"&&de.slice(1).some((Ee)=>wc(Ee)&&xc(Ee)))return Dt(At(`${j}.rm-recursive-force-dynamic`,j==="xargs"?Sc:Ri),oe);return null}function bw(G,U){let j=Lr(G,U),K=j.rewritten?Xt(j.words.map(t)):j.words,re=K[0];return re&&t(re)==="busybox"?K.slice(1):K}function Cw(G){let U=1;while(U<G.length){let j=G[U],K=j?t(j):"";if(xn.has(K)){U+=2;continue}if(K.startsWith("-")){U++;continue}return U}return U}function Sw(G){let U=!1,j=0,K=!1,re=!1;for(let oe=1;oe<G.length;oe++){let de=G[oe];if(!de)continue;let Ce=wc(de);if(j>0){j--;continue}if(re){if(de.text===";"||de.text==="+"){re=!1,U=!0,K=!1;continue}if(Ce&&(K||xc(de)))return!0;K=!1;continue}if(!U&&!de.text.startsWith("-")){if(Ce&&(oe>1||xc(de)))return!0;continue}if(U=!0,Ce)return!0;let Ee=lr(de.text);if(Ee>0){j=Ee;continue}if(Zn(de.text))re=!0,K=!0}return!1}function Ac(G,U){return G.some((j)=>{if(j.value==="-"&&(j.kind==="main-script"||j.kind==="program-file"))return!0;return!lo(U[j.tokenIndex],j.value)})}var Zp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",vw="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ew="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",Rw="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",_w="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",xw="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",ww={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:Rw},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:v},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:Ew},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:xw},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Zp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:vw},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Zp}},Aw=/^\/\/?[ck]$/i,Xp=/[&|]+/,Pw=/(?:"[^"]*"|[^\s"])+/g,Tw=/[\^%!]/,Iw=/\\"./s,kw=/(^|\/)[*.]*\*[*.]*$/,Ow=/^"?[\\/]+[?.][\\/]/,Mw=new Set(["rmdir","rd","del","erase"]),Dw=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,Nw=/\/s(?!\w)/i,Lw=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Jp(G,U){let j=G.map(t),K=j.findIndex((Ye)=>Aw.test(Ye));if(K===-1)return null;let re=j.slice(K+1).join(" "),oe=/^".*"$/s.test(re)?re.slice(1,-1):re,de=oe.split(Xp).map((Ye)=>{let Ze=Ye.match(Pw)??[],Je=Ze.findIndex((et)=>Mw.has(et.replace(/^@/,"").toLowerCase())),Qe=Je===-1?[]:Ze.slice(Je);return{piece:Ye,tokens:Ze,deleteTokens:Qe,recursiveDelete:Qe.slice(1).some((et)=>et.startsWith("/")&&et.toLowerCase().split("/").includes("s"))}}),Ce=de.filter((Ye)=>Ye.recursiveDelete),Ee=Ce.length>0||Dw.test(oe)&&Nw.test(oe);if(Ee&&(oe.includes("\\\"")||U.gitBashEscapesBodyQuotes&&oe.includes('"')||U.powerShellRawWords.some((Ye)=>Iw.test(Ye))||Ce.some((Ye)=>Ye.tokens.some((Ze)=>Ow.test(Ze)))))return At("cmd.recursive-delete-escaped-quote",_w);let ke=Yn({...U,allowPaths:U.policy?.destructiveCommandAllowPaths}),De=de.reduce((Ye,Ze)=>Ye??(Ze.recursiveDelete?Ww(Ze.deleteTokens,ke,U.policy):U.analyzeNested(Ze.piece)),null),Xe=Ee&&(Ce.length===0||Tw.test(oe)||Lw.test(oe)||oe.includes('"')&&Xp.test(oe));return De??(Xe?So():null)}function Ww(G,U,j){return G.slice(1).filter((K)=>!K.startsWith("/")).reduce((K,re)=>K??Dt($r(Tn(pi(re.replaceAll('"',"")).replace(kw,"$1*"),U),U,j,ww),j),null)}var Gw="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",Fw=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,zw=/^-(?:executionpolicy|ep)$/i,$w=/^-(?:command|c)$/i,Bw=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,Uw="encodedcommand",Hw=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,jw=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Vw=/[$`]/,Kw="--%";function Qp(G,U){let j=G.map(t),K=j.every((oe,de)=>de===0||oe!==Kw&&qw(G[de],oe))?Tc(j):void 0;if(K!==void 0)return U(K);if(j.some(Yw))return So();let re=j.join(" ");return Hw.test(re)&&jw.test(re)?At("powershell.nested-recursive-delete-unread",Gw):null}function Tc(G){let U=Pc(G,1),j=U===void 0?[]:G.slice(U+1);return j.length>0?j.join(" "):void 0}function Pc(G,U){let j=G[U]??"";if($w.test(j))return U;if(Fw.test(j))return Pc(G,U+1);return zw.test(j)?Pc(G,U+2):void 0}function qw(G,U){return G?.provenance==="unknown"?!Vw.test(U):lo(G,U)}function Yw(G){let U=Bw.exec(G)?.[1]?.toLowerCase();return U!==void 0&&(U==="ec"||Uw.startsWith(U))}var tg=[{heads:new Set(["rm","rmdir"]),analyze:(G)=>Hs(G.words,Ic(G))},{heads:new Set(["cmd"]),analyze:(G)=>Jp(G.words,{...Ic(G),powerShellRawWords:G.options.commandView?.dialect==="powershell"?G.options.commandView.words.map((U)=>U.raw):[],gitBashEscapesBodyQuotes:G.options.commandView?.dialect!=="powershell",analyzeNested:(U)=>vr(G.options.analyzeNested(U,{effectiveCwd:G.effectiveCwd,envAssignments:G.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(G)=>Qp(G.parsedWords,(U)=>vr(G.options.analyzeNested(U,{effectiveCwd:G.effectiveCwd,envAssignments:G.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(G)=>Bs(G.words,kc(G))},{heads:new Set(["find"]),analyze:(G)=>Df(G.words,{...Ic(G),envAssignments:G.envAssignments,analyzeTokens:G.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(G)=>Cp(G.words,{...eg(G),analyzeChild:G.analyzeChild,analyzeNested:(U,j)=>vr(G.options.analyzeNested(U,j))})},{heads:new Set(["parallel"]),analyze:(G)=>Mp(G.words,{...eg(G),analyzeChild:G.analyzeChild,analyzeNested:(U,j)=>vr(G.options.analyzeNested(U,j))})}];function eg(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoidRm:G.options.paranoidRm,paranoidInterpreters:G.options.paranoidInterpreters,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.options.protectedGitMetadata,budget:G.options.budget,envAssignments:G.envAssignments,worktreeMode:G.options.worktreeMode,policy:G.options.policy}}function vr(G){return G?{id:G.ruleId,reason:G.reason,intent:G.intent??"manual_only"}:null}function Ic(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoid:G.options.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,tmpdirWordSplittingUnsafe:Fr(G.envAssignments,G.options.environment),trustedTmpdirValue:ho(G.envAssignments,G.options.environment),protectedGitMetadata:G.options.protectedGitMetadata,policy:G.options.policy,budget:G.options.budget}}function kc(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,dynamicArguments:G.dynamicArguments,envAssignments:G.envAssignments,shellAssignments:G.options.shellAssignments,policy:G.options.policy,worktreeMode:G.options.worktreeMode}}function og(G){return tg.find((U)=>U.heads.has(G))?.analyze}function Ao(G,U,j){let K=j.trace;if(G.length===0)return null;let re=j.commandView?.dialect??"posix",oe=(Tt)=>Tt.map((Wt)=>re==="posix"?t(Wt):Wt.text),de=j.child,Ce=de!==void 0&&!de.embedded,Ee=de?.embedded===!0,ke=j.effectiveCwd===null,De=de?de.cwd:ke?void 0:j.effectiveCwd??j.cwd,Xe=de?de.originalCwd:ke?void 0:j.cwd,Ye=Se(G);if(Ye.envAssignments.size>0)K?.recordSegment({type:"env-strip",input:oe(G),envVars:[...Ye.envAssignments.keys()],output:oe(Ye.words)});let Ze=Lr(Ye.words,j.environment,De,new Map([...j.envAssignments??[],...Ye.envAssignments])),Je=Ze.envSplitValues??[];if(Je.length>0){let Tt=[...Je,...oe(Ze.words)].join(" "),Wt=Nn(Tt);if(Wt)return K?.recordSegment({type:"dangerous-text",token:Tt,matched:!0,reason:Wt.reason}),gn(Wt);if(j.strict)return En(K);let jt=Cs(Je,oe(Ze.words));if(jt){j.budget.charge("derivedTokens",jt.length);let an=j.analyzeNested(jt.join(" "),{effectiveCwd:Ze.cwd===void 0?j.effectiveCwd:Ze.cwd,envAssignments:new Map([...j.envAssignments??[],...Ye.envAssignments,...Ze.envAssignments])});if(an)return an}}let Qe=Ze.rewritten?Xt(oe(Ze.words)):ne(re,Ze.words),et=oe(Qe),mt={...j,wrapperNormalizationBudget:j.wrapperNormalizationBudget??{iterations:0}};if(K&&Ye.words.length>Qe.length){let Tt=oe(Ye.words);K.recordSegment({type:"leading-tokens-stripped",input:Tt,removed:Tt.slice(0,Tt.length-Qe.length),output:et})}let Rt=new Map([...j.envAssignments??[],...Ye.envAssignments,...Ze.envAssignments]),gt=et[0];if(!gt)return null;if(Br(gt))throw new s("wrapperPeelIterations");let _t=Gt(gt),It=Ze.cwd===null?void 0:Ze.cwd??De,Mt=Ze.cwd===null?void 0:Xe,Nt=Ze.cwd===void 0?j.effectiveCwd:Ze.cwd,ft=de?de.allowTmpdirVar:!mi(Rt,j.environment),Ot=qp(re,Ze.words,j.environment,U===0,j.strict,j.policy);if(Ot)return K?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Ot.reason}),gn(Ot);let zt=Ls(et,j.policy);if(zt){for(let Tt of[zt.childIndex,...zt.alternativeChildIndices]){ng(mt.wrapperNormalizationBudget);let Wt=Qe.slice(Tt);K?.recordSegment({type:"transparent-wrapper",wrapper:zt.wrapper,output:oe(Wt)});let jt=Ao(Wt,U,{...mt,effectiveCwd:Nt,envAssignments:Rt});if(jt)return jt}return null}let on=Ee?void 0:_t==="eval"?js(Qe):_t==="trap"&&!Ce?mp(Qe):void 0;if(Ce&&de&&_t==="eval"){if(on?.kind==="dynamic")return wo(de,j.policy);if(on?.kind==="literal"){let Tt=j.analyzeNested(on.source,{effectiveCwd:Nt,envAssignments:Rt});if(Tt)return Tt}return Po(de,j.policy)}if(on?.kind==="dynamic"&&(j.strict||!j.commandView||!bc(j.commandView)))return En(K);if(on?.kind==="literal"){K?.recordSegment({type:"recurse",reason:_t==="eval"?"shell-eval":"shell-trap",innerCommand:on.source,depth:U+1});let Tt=j.analyzeNested(on.source,{effectiveCwd:Nt,envAssignments:Rt,functionDefinitions:j.functionDefinitions});if(Tt)return Tt}if(Ce?Jt.has(_t):sg(gt,_t)){if(ar(et))return null;if(Ce&&de){let Tt=jn(et);if(Tt){if(de.dynamicSourceInput??de.dynamicInput){let jt=wo(de,j.policy);if(jt)return jt}if(Ei(Tt)){let jt=wo(de,j.policy);if(jt)return jt}return j.analyzeNested(Tt,{effectiveCwd:Nt,envAssignments:Rt})}let Wt=cr(Qe);if(Wt.kind==="dynamic")return wo(de,j.policy);if(Wt.kind==="literal")return de.dynamicSourceInput?wo(de,j.policy):null;return de.dynamicSourceInput??de.dynamicInput?wo(de,j.policy):null}if(Ee){let Tt=jn(et),Wt=Tt?j.analyzeNested(Tt,{effectiveCwd:Nt,envAssignments:Rt}):cr(Qe).kind==="dynamic"?En(K):null;if(Wt)return Wt}if(de===void 0){let Tt=Qw(et,Rt,Nt,j,K,U);if(Tt)return Tt;let Wt=jn(et);if(Wt){let Jr=Vs(Qe,Wt);if(Jr.kind==="dynamic")return En(K);let fa=Jr.kind==="literal"?Jr.source:fp(Qe,Wt),nd=eA(fa);K?.recordSegment({type:"shell-wrapper",wrapper:_t,innerCommand:nd}),K?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:nd,depth:U+1});let rd=j.analyzeNested(fa,{effectiveCwd:Nt,envAssignments:Rt});if(rd)return rd;return Ei(fa)?En(K):null}let jt=cr(Qe,j.strict?void 0:j.shellAssignments);if(jt.kind==="dynamic")return En(K);if(jt.kind==="literal")return Qs(jt.source,Nt,Rt,j,K,U);let an=pp(Qe,j.commandView?.redirections??[],j.hasPipelineInput??!1,j.literalShellInput);if(an.kind==="dynamic")return En(K);if(an.kind==="literal")return K?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:an.source,depth:U+1}),j.analyzeNested(an.source,{effectiveCwd:Nt,envAssignments:Rt})}}if(!de&&(_t==="source"||_t===".")){let Tt=et[1]==="-p"?2:null;if(Tt!==null){let Jr=j.commandView?Qe[Tt]:void 0;if(!Jr)return null;if(Jr.provenance!=="literal")return En(K)}let Wt=Tt===null?1:3,jt=et[Wt]==="--"?Wt+1:Wt,an=j.commandView?Qe[jt]:void 0;if(!an)return null;if(an.provenance==="literal")return Qs(an.text,Nt,Rt,j,K,U);if(j.strict||!j.commandView||!bc(j.commandView))return En(K)}if(Dn.has(_t)&&!Ee){if(!de&&j.strict&&Ac(yi(et),Qe))return En(K);let Tt=Af(et,(jt)=>vr(j.analyzeNested(jt,{effectiveCwd:Nt,envAssignments:Rt}))),Wt=Dt(Tt,j.policy);if(Wt)return K?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Wt.reason}),gn(Wt)}if(zn(_t)&&!Ee){if(!de&&j.strict&&Ac(ps(et),Qe))return En(K);let Tt=_m(et);if(Ce&&de)return Xw(_t,Tt,Nt,Rt,j,de);if(Tt){let Wt=nn(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(K?.recordSegment({type:"interpreter",interpreter:_t,codeArg:Tt,paranoidBlocked:Wt}),Wt){let an=Dt(At("interpreter.one-liner-paranoid",ii),j.policy);if(an)return gn(an)}if(Ol(_t,Tt))return null;K?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Tt,depth:U+1});let jt=j.analyzeNested(Tt,{effectiveCwd:Nt,envAssignments:Rt});if(jt&&!ig(jt,Tt))return jt;if(si(Tt,void 0,!j.strict)){let an=Dt(At("interpreter.dangerous-command",mo),j.policy);if(an)return K?.recordSegment({type:"dangerous-text",token:Tt,matched:!0,reason:mo}),gn(an)}K=void 0}}if(_t==="busybox"&&et.length>1)return ng(mt.wrapperNormalizationBudget),K?.recordSegment({type:"busybox",subcommand:et[1]??"unknown"}),K?.recordSegment({type:"recurse",reason:"busybox",innerCommand:et.slice(1).join(" "),depth:U+1}),Ao(Qe.slice(1),U,{...mt,effectiveCwd:Nt,envAssignments:Rt});let Kt=de?null:Dt(Sm(_t,et),j.policy);if(Kt)return K?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Kt.reason}),gn(Kt);let Ut=K===mt.trace?mt:{...mt,trace:K},mn={words:Qe,parsedWords:Ze.words,head:_t,cwd:It,originalCwd:Mt,envAssignments:Rt,allowTmpdirVar:ft,dynamicArguments:Ze.words.some((Tt)=>Tt.provenance==="command-substitution"),depth:U,effectiveCwd:Nt,options:Ut,analyzeChildTokens:(Tt,Wt)=>Ce&&de?Mc(Tt,U,Ut,{...de,cwd:Wt??void 0,effectiveCwd:Wt??void 0}):vr(Ao(Xt(Tt),U+1,{...Ut,child:void 0,commandView:void 0,effectiveCwd:Wt,envAssignments:Rt}))??D(Tt,Ut.policy.rules),analyzeChild:(Tt,Wt)=>Mc(Tt,U,Ut,Wt)},en=de&&(_t==="xargs"||_t==="parallel")?void 0:og(_t);if(_t==="rm"||_t==="xargs"||_t==="parallel")K?.recordSegment({type:"tmpdir-check",tmpdirValue:Rt.has("TMPDIR")||j.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:ft});let tn=K&&_t==="git"?op(mn.words,kc(mn)):void 0,_n=rg(tn?tn.match:en?.(mn)??null,j.policy);if(K)tA(mn,_n,tn?.relaxation??null);if(_n)return gn(_n);if(Ce&&de&&(_t==="rm"||_t==="rmdir")){if(!(_t==="rm"&&(sr(et)||de.dynamicRmInput)))return null;return(de.dynamicRmInput?Po(de,j.policy):null)??Jw(de,j.policy)}let Qn=en!==void 0&&!rA.has(_t),xr=!de&&!Qn&&!Ui.has(_t),Mo=K&&xr?[]:void 0;if(xr)for(let Tt=1;Tt<et.length;Tt++){let Wt=et[Tt];if(!Wt)continue;Mo?.push(Wt);let jt=rg(Zw(et,Tt,U,Ut,It,Mt,Nt,Rt),j.policy);if(jt)return K?.recordSegment({type:"fallback-scan",tokensScanned:Mo??[],embeddedCommandFound:Gt(Wt)}),gn(jt)}if(K?.recordSegment({type:"fallback-scan",tokensScanned:Mo??[]}),Ee&&de&&!de.wrappedByTransparent)return null;let kn=D(et,j.policy.rules);if(K?.recordSegment({type:"custom-rules-check",rulesChecked:j.policy.rules.length>0,matched:!!kn,reason:kn?.reason}),kn)return gn(kn);return Ce&&de?Po(de,j.policy):null}function Mc(G,U,j,K){return vr(Ao(Xt(G),U+1,{...j,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:K.originalCwd,effectiveCwd:K.effectiveCwd,envAssignments:K.envAssignments,worktreeMode:K.dynamicInput?!1:K.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:K}))}function Zw(G,U,j,K,re,oe,de,Ce){for(let Ee of Hn(G.slice(U),{environment:K.environment,cwd:re,envAssignments:Ce,policy:K.policy})){let ke=Ee.tokens[0];if(!ke)continue;let De=Gt(ke);if(sg(ke,De)||og(De)!==void 0&&De!=="xargs"&&De!=="parallel"||Ee.wrappedByTransparent&&K.policy.rules.length>0)K.budget.charge("derivedTokens",G.length-U);let Ye=Mc(Ee.tokens,j,K,{embedded:!0,cwd:Ee.cwd,originalCwd:Ee.wrapperCwd===null?void 0:oe,effectiveCwd:Ee.wrapperCwd===void 0?de:Ee.wrapperCwd,envAssignments:Ee.envAssignments,allowTmpdirVar:!mi(Ee.envAssignments,K.environment),worktreeMode:!1,wrappedByTransparent:Ee.wrappedByTransparent});if(Ye)return Ye}return null}function Xw(G,U,j,K,re,oe){if(!U)return Po(oe,re.policy);if(nn(re.policy,"interpreter.one-liner-paranoid",!!re.paranoidInterpreters)){let Ce=Dt(At("interpreter.one-liner-paranoid",ii),re.policy);if(Ce)return gn(Ce)}if(Ol(G,U))return Po(oe,re.policy);let de=re.analyzeNested(U,{effectiveCwd:j,envAssignments:K});if(de&&!ig(de,U))return de;if(si(U,void 0,!re.strict)){let Ce=Dt(At("interpreter.dangerous-command",mo),re.policy);if(Ce)return gn(Ce)}return Po(oe,re.policy)}function ig(G,U){let j=G.ruleId==="raw-text.dangerous-command",K=(G.reason.startsWith(Ms)||G.reason===Co)&&!Hi(U);return j||K}function wo(G,U){let j=G.shellDynamicMatch?Dt(G.shellDynamicMatch,U):null;return j?gn(j):null}function Po(G,U){let j=G.dynamicSourceInput&&G.dynamicSourceMatch?Dt(G.dynamicSourceMatch,U):null;return j?gn(j):null}function Jw(G,U){let j=G.dynamicInput&&G.rmDynamicMatch?Dt(G.rmDynamicMatch,U):null;return j?gn(j):null}function Qw(G,U,j,K,re,oe){let de=Mf(G);if(de.argvSource?.kind==="absent")return En(re);if(de.argvSourceApplies&&de.argvSource){let Ee=Qs(de.argvSource.value,j,U,K,re,oe,!0);if(Ee)return Ee}if(!de.envSourceApplies||!de.envName)return null;let Ce=U.get(de.envName);if(!Ce)return null;return Qs(Ce,j,U,K,re,oe,!0)}function Qs(G,U,j,K,re,oe,de=!1){if(de&&/[$`*?[\]]/.test(G))return En(re);let Ce=oi(G,U,K.environment.paths,K.budget),Ee=Ce?K.literalHeredocFiles?.get(Ce):void 0;if(Ee===void 0)return de?En(re):null;return K.budget.charge("derivedTokens",1),re?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:Ee,depth:oe+1}),K.analyzeNested(Ee,{effectiveCwd:U,envAssignments:j})}function eA(G){let U=G[0];return G.length>=2&&(U==='"'||U==="'")&&G.at(-1)===U?G.slice(1,-1):G}function tA(G,U,j){let K={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[G.head];if(!K)return;if(G.options.trace?.recordSegment({type:"rule-check",rule:K,matched:!!U||!!j,reason:U?.reason??j?.originalReason}),j)G.options.trace?.recordSegment({type:j.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:j.originalReason,gitCwd:j.gitCwd})}function ng(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function gn(G){return{reason:G.reason,ruleId:G.id,intent:G.intent}}function En(G){return G?.recordSegment({type:"error",message:gi}),gn(So())}function sg(G,U){return Jt.has(U)||G==="$SHELL"||G==="${SHELL}"||Jt.has(Lt(U))}function rg(G,U){return G?.id.startsWith("custom.")||G?.id==="raw-text.dangerous-command"?G:Dt(G,U)}var nA=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,rA=new Set(["powershell","pwsh"]),oA=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function iA(G,U){let j=cg(G,U);if(j.length===0)return!1;let K=j[lg(j)];if(K==="cd"||K==="pushd"||K==="popd")return!0;return nA.test(G.join(" "))}function ag(G,U,j,K,re){if(G.dialect==="powershell"){let gt=sA(G.words,re);if(gt.kind==="none")return;if(!U||gt.kind==="unknown")return null;return Oc(dA(gt.target),U,j.paths)}let oe=G.words.map(t),de=oe.some((gt)=>/^CDPATH\+?=/.test(gt));if(!iA(oe,j))return de?null:void 0;if(!U)return null;let Ce=cg(oe,j,U),Ee=lg(Ce);if(Ee===-1||Ce[Ee]!=="cd")return null;let ke=Ce.slice(Ee+1),De=ke.findIndex((gt)=>gt.length<=1||!gt.startsWith("-")||gt==="--");if((De===-1?ke:ke.slice(0,De)).some((gt)=>!/^-[LP]+$/.test(gt)))return null;let Ye=De===-1?[]:ke.slice(De),Ze=Ye[0]==="--"?Ye.slice(1):Ye;if(Ze.length>1)return null;let Je=Ze[0],Qe=K.get("HOME")||j.home;if(Je===void 0)return Oc(fn(Qe),U,j.paths);let et=G.words.find((gt)=>gt.provenance==="variable"&&gt.text===Je),mt=G.words.find((gt)=>gt.text===Je&&/^~(?:\/|$)/.test(gt.raw)),Rt=et?Xn(et,new Map([...K,["HOME",Qe]])):mt?`${Qe}${Je.slice(1)}`:Je;if(Rt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(Rt)&&(de||j.env.has("CDPATH")))return null;return Oc(fn(Rt),U,j.paths)}function Oc(G,U,j){if(!G||G==="-"||G.startsWith("~")||G.includes("$")||G.includes("`"))return null;try{let K=pr(U,G,j);return j.isDirectory(K)?K:null}catch{return null}}function sA(G,U){let j=aA(G[0])?1:0,K=G[j];if(!lA(K,j===1))return{kind:"none"};let re=K.text.toLowerCase(),oe=re.split(/[\\/]/).pop()??re;if(!oA.has(oe))return{kind:"none"};if(re!==oe||oe==="pop-location"||oe==="popd")return{kind:"unknown"};return cA(G.slice(j+1),U)}function aA(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&(G.text==="&"||G.text===".")}function lA(G,U){return G?.provenance==="literal"&&(U||!G.quoted&&G.raw===G.text)}function cA(G,U){let j;for(let K of G){if(K.provenance!=="literal"||j!==void 0)return{kind:"unknown"};j=K.text}if(j!==void 0)return{kind:"target",target:j};return U===void 0?{kind:"unknown"}:{kind:"target",target:U}}function dA(G){return G.includes("::")?void 0:G.replaceAll("\\","/")}function lg(G){let U=0;if(G[0]==="builtin"&&G.length>1)U=1;if(G[U]!=="time")return U;let j=U+1;while(G[j]?.startsWith("-"))j++;return j}function cg(G,U,j){let K=uA(G);return gr([...K],U,j)}function uA(G){let U=0;while(U<G.length){let j=G[U];if(j!=="{"&&j!=="("&&j!=="$(")break;U++}return G.slice(U)}var bA="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Kr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Fc(G,U,j,K){if(U>=a.recursionDepth.cap)return j.trace?.recordSegment({type:"error",message:Kn}),{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let re=K??j.factStore?.getCommandProgram(G,j.shell??"auto")??y(G,j.shell);if(re.status==="limited")return j.trace?.recordSegment({type:"error",message:Kn}),{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(re.status==="invalid"){let ke=re.issues.find((De)=>De.code.includes("heredoc"));if(ke){if(!j.strict)return Gc(G,j);let De=`${Ms}: ${ke.message}`;return j.trace?.recordGlobal({type:"error",message:De}),{reason:De,segment:G,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return hg(G,j),{reason:Co,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(j.strict&&re.status==="partial")return hg(G,j),{reason:Co,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(re.issues.some((ke)=>ke.code.includes("quote")))return Gc(G,j);let de=j.cwd,Ce=j.effectiveCwd!==void 0?j.effectiveCwd:j.cwd,Ee=Vf(j.environment.env,j.envAssignments);return na(re,U,{...j,rootProgram:re},de,[{effectiveCwd:Ce,shellGitContextState:Ee,literalHeredocFiles:new Map(j.literalHeredocFiles),functionDefinitions:new Map(j.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function na(G,U,j,K,re){let oe=[...re],de,Ce,Ee;for(let[ke,De]of G.nodes.entries()){if(De.kind==="connector"){Ce=De.operator;continue}let Xe=G.nodes[ke+1],Ye=Xe?.kind==="connector"?Xe.operator:void 0,Ze=CA(G,ke,De,Ce,Ye),Qe=Ce==="&&"||Ce==="||"?de:void 0,et=Ce==="&&"?Qe?.success??oe:Ce==="||"?Qe?.failure??oe:oe,mt=Ce==="||"?Qe?.success??[]:[],Rt=Ce==="&&"?Qe?.failure??[]:[],gt={connector:Ce,skippedSuccessStates:mt,skippedFailureStates:Rt};if(Er(Ye)&&!Er(Ce))Ee=gt;let _t=Er(Ye)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Er(Ce)?Ee??gt:gt,It=qr(_t.connector)||qr(Ye);if(De.kind==="function"){let Kt=et.flatMap((mn)=>{let en=Yr(mn);return en.functionDefinitions.set(De.name,De.body),Dc(mn,[en],Ze,Ye==="&",qr(Ye))}),Ut=Nc(Kt,[],_t.skippedSuccessStates,_t.skippedFailureStates,_t.connector,Ye);oe=Ut.states,de=Ut.conditionalStates,Ce=void 0;continue}if(De.kind==="group"){let Kt=[],Ut=[];for(let en of et){let tn=na(De.body,U,j,K,[Yr(en)]);if(tn.result)return tn;if(Kt.push(...Dc(en,tn.states,Ze,Ye==="&",qr(Ye))),It)Ut.push(en,...Ze?tn.states.map((_n)=>ea(en,_n)):tn.states)}let mn=Nc(Kt,Ut,_t.skippedSuccessStates,_t.skippedFailureStates,_t.connector,Ye);oe=mn.states,de=mn.conditionalStates,Ce=void 0;continue}if(De.kind!=="command")continue;let Mt=BA(G.nodes[ke-1]),Nt=j.trace?.flattenNested?j.trace.currentSegmentIndex:j.trace?.allocateSegment(),ft=G.nodes[ke-2],Ot=Er(Ce)&&ft?.kind==="command"?up(ft)??vA(ft):void 0,zt=[],on=[];for(let Kt of et){let Ut=EA(De,U,j,K,[Yr(Kt)]);if(Ut.result)return{result:Ut.result,states:oe};let mn=G.dialect==="powershell"?Ut.states:Ut.states.map((en)=>ea(Kt,en));for(let en of mn){let tn=Yr(en),_n=xA(De,U,j.trace?{...j,trace:yg(j.trace,Nt)}:j,K,tn,Er(Ce),Ot);if(_n)return{result:_n,states:oe};let Qn=YA(De,tn.functionDefinitions);if(Qn)j.budget.charge("derivedTokens",ra(Qn));let xr=Qn?U+1>=a.recursionDepth.cap?Lc(De.displayText,j,[tn]):na(Qn,U+1,j,K,[tn]):{result:null,states:KA(De,tn).flatMap((kn)=>UA(De,en,kn,Mt))};if(xr.result)return xr;zt.push(...Dc(Kt,xr.states,Ze,Ye==="&",qr(Ye)));let Mo=typeof tn.effectiveCwd==="string"&&tn.effectiveCwd!==en.effectiveCwd&&De.redirections.every((kn)=>["<",">",">>",">|"].includes(kn.operator)&&kn.target?.text==="/dev/null");if(It&&(Mt||!Mo))on.push(Kt),on.push(...xr.states.map((kn)=>Ze?ea(Kt,kn):kn))}}let _r=Nc(zt,on,_t.skippedSuccessStates,_t.skippedFailureStates,_t.connector,Ye);oe=_r.states,de=_r.conditionalStates,Ce=void 0}return{result:null,states:oe}}function CA(G,U,j,K,re){if(j.kind==="group"&&j.style==="subshell")return!0;if(G.dialect==="posix"&&(Er(K)||Er(re)))return!0;if(re==="&")return!0;return G.dialect==="powershell"&&j.kind==="group"&&j.style==="brace"&&SA(G,U)}function Dc(G,U,j,K,re){let oe=j?U.map((Ce)=>ea(G,Ce)):[...U],de=re?oe.flatMap((Ce)=>To(G.literalHeredocFiles,Ce.literalHeredocFiles)?[Ce]:[{...Ce,literalHeredocFiles:new Map(G.literalHeredocFiles)},Ce]):oe;return K?[G,...de]:de}function ea(G,U){return{...G,literalHeredocFiles:new Map(U.literalHeredocFiles),createdDirectories:new Set(U.createdDirectories)}}function SA(G,U){let j=G.nodes.slice(0,U).reverse().find((re)=>re.kind==="command"||re.kind==="connector");if(!j||j.kind!=="command")return!0;let K=j.words[0]?.text.toLowerCase();if(K==="&"||K===".")return!1;if(K==="write-output"||K==="function"||K==="start-job")return!0;if(RA(j))return!0;return j.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Er(G){return G==="|"||G==="|&"}function vA(G){if(G?.dialect!=="powershell")return;if(G.words.length===1&&G.words[0]?.quoted&&G.words[0].provenance==="literal")return G.words[0].text;if(G.words[0]?.text.toLowerCase()==="write-output"&&G.words.length===2&&G.words[1]?.provenance==="literal")return G.words[1].text;return}function qr(G){return G==="&&"||G==="||"}function Nc(G,U,j,K,re,oe){let de={success:ta([...j,...G]),failure:ta([...K,...U])},Ce=qr(oe)?de:void 0;return{states:qr(re)||Ce?ta([...de.success,...de.failure]):de.success,conditionalStates:Ce}}function yg(G,U,j=G.flattenNested){return{currentSegmentIndex:U,flattenNested:j,allocateSegment:G.allocateSegment,getNextSegmentIndex:G.getNextSegmentIndex,recordGlobal:G.recordGlobal,recordSegment:(K,re=U)=>G.recordSegment(K,re)}}function EA(G,U,j,K,re){let oe=G.nested.map((de)=>({program:de,depth:U}));if(G.dialect==="powershell"){let de=_A(G);if(de){if(U+1>=a.recursionDepth.cap)return Lc(de,j,re);let Ce=y(de,"powershell");if(Ce.status==="limited")return Lc(de,j,re);if(Ce.status!=="complete")return dg(oe,j,K,re);j.budget.charge("derivedTokens",ra(Ce)),oe.push({program:Ce,depth:U+1})}}return dg(oe,j,K,re)}function RA(G){let U=G.words[0];return U?.provenance==="variable"&&G.words.at(-1)?.text==="="?U.text.toLowerCase():void 0}function dg(G,U,j,K){let re=[...K];for(let oe of G){let de=[];for(let Ce of re){let Ee=na(oe.program,oe.depth,U,j,[Yr(Ce)]);if(Ee.result)return Ee;de.push(...Ee.states)}re=ta(de)}return{result:null,states:re}}function _A(G){let U=G.words[0]?.provenance==="literal"&&!G.words[0].quoted&&G.words[0].raw===G.words[0].text&&(G.words[0].text==="&"||G.words[0].text==="."),j=U?1:0,K=G.words[j];if(K?.provenance!=="literal"||!U&&(K.quoted||K.raw!==K.text)||!["iex","invoke-expression"].includes(K.text.toLowerCase()))return;let re=G.words.slice(j+1),oe=re[0]&&!re[0].quoted&&re[0].raw===re[0].text&&["-c","-command"].includes(re[0].text.toLowerCase())?1:0,de=re[oe];return re.length===oe+1&&de?.quoted&&de.provenance==="literal"?de.text:void 0}function ra(G){return G.nodes.reduce((U,j)=>U+(j.kind==="command"?j.words.length+j.nested.reduce((K,re)=>K+ra(re),0):j.kind==="group"||j.kind==="function"?ra(j.body):0),0)}function Lc(G,U,j){return U.trace?.recordSegment({type:"error",message:Kn}),{result:{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...j]}}function xA(G,U,j,K,re,oe,de){let Ce={...j,environment:{...j.environment,env:re.shellGitContextState.env,paths:IA(j.environment.paths,re.createdDirectories,j.budget)}},Ee=LA(G,!Ce.strict);if(Ee&&Ce.strict)return Ce.trace?.recordSegment({type:"error",message:Ee}),{reason:Ee,segment:G.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};bg(G,re,"before-consumer",Ce.environment.paths,Ce.budget);let ke=ne(G.dialect,G.words),De=ke.map(t),Xe=G.displayText,Ye=Hf(ke,re.shellGitContextState),Ze=qf(Ye,re.shellGitContextState);if(G.dialect==="powershell"){let mt=Dt(Cf(G,oe,ZA(Ce,re.effectiveCwd)),Ce.policy);if(Ce.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!mt,reason:mt?.reason}),mt)return gg(Xe,mt)}let Je=Dt(vm(G.redirections),Ce.policy);if(Je)return Ce.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Je.reason}),gg(Xe,Je);if(De.length===1&&De[0]?.includes(" ")&&!Yo(G.dialect,G.words)){let mt=Dt(Nn(De[0]),Ce.policy),Rt=mt!==null&&!Ce.strict&&hm(G,Ce.rootProgram);if(mt&&!Rt)return Ce.trace?.recordSegment({type:"dangerous-text",token:De[0],matched:!0,reason:mt.reason}),{reason:mt.reason,segment:Xe,ruleId:mt.id,intent:mt.intent};Ce.trace?.recordSegment({type:"dangerous-text",token:De[0],matched:!1});let gt=ug(G,Ee,re,Ze,de,Ce);if(gt)return gt;return mc(Ye,re.shellGitContextState),null}let Qe=Ao(G.words,U,{...Ce,commandView:G,cwd:K,effectiveCwd:re.effectiveCwd,envAssignments:Ze,shellAssignments:re.shellGitContextState.shellAssignments,literalHeredocFiles:re.literalHeredocFiles,functionDefinitions:re.functionDefinitions,hasPipelineInput:oe,literalShellInput:de,analyzeNested:(mt,Rt)=>{let gt=Rt&&Object.hasOwn(Rt,"effectiveCwd")?Rt.effectiveCwd:re.effectiveCwd,_t=Fc(mt,U+1,{...Ce,effectiveCwd:gt,envAssignments:Rt?.envAssignments??Ze,literalHeredocFiles:re.literalHeredocFiles,functionDefinitions:Rt?.functionDefinitions,worktreeMode:Rt?.worktreeMode??Ce.worktreeMode,shell:Rt?.shell??Ce.shell,trace:Ce.trace?yg(Ce.trace,Ce.trace.currentSegmentIndex,!0):void 0});return _t?{reason:_t.reason,ruleId:_t.ruleId,intent:_t.intent}:null}});if(Qe)return{...Qe,segment:Xe};let et=ug(G,Ee,re,Ze,de,Ce);if(et)return et;return mc(Ye,re.shellGitContextState),null}function ug(G,U,j,K,re,oe){let de=WA(G,U,j,K??new Map,oe);if(de)return de;return bg(G,j,"after-consumer",oe.environment.paths,oe.budget),j.literalHeredocFiles.clear(),PA(G,U,j,oe.environment.paths,oe.budget),kA(G,j,oe.environment.paths,oe.budget),zA(G,j,re,oe.environment,oe.trace),null}var wA=new Set([">>","<>"]);function bg(G,U,j,K,re){for(let de of G.redirections){if(!(j==="before-consumer"?AA(de):wA.has(de.operator)))continue;mg(de.target,U,K,re)}if(j!=="before-consumer"||!un(G.words[0],"tee"))return;let oe=Sg(G.words.slice(1));if(!oe)return;for(let de of oe.operands)mg(de,U,K,re)}function AA(G){if(G.operator===">"||G.operator===">|")return!0;return G.operator===">&"&&G.fd===void 0&&G.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(G.target.text)}function mg(G,U,j,K){let re=G?.provenance==="literal"?oi(G.text,U.effectiveCwd,j,K):void 0;if(!re)return;U.literalHeredocFiles.delete(re)}function PA(G,U,j,K,re){if(U)return;let oe=G.redirections.find((de)=>de.operator==="<<"||de.operator==="<<-")?.heredoc;if(!oe)return;for(let de of TA(G,j.shellGitContextState.shellAssignments)){let Ce=oi(de,j.effectiveCwd,K,re);if(!Ce||!Rm(Ce))continue;if(!j.literalHeredocFiles.has(Ce)&&j.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");j.literalHeredocFiles.set(Ce,oe.body)}}function TA(G,U){let j=Wc(DA(G.redirections)?.target,U),K=j===void 0?[]:[j];if(un(G.words[0],"cat"))return MA(G.words)?K:[];if(!un(G.words[0],"tee"))return[];let re=Sg(G.words.slice(1),U);if(!re||re.append||re.hasUnsupportedOptions)return[];let oe=re.operands.map((de)=>Wc(de,U));if(!oe.every((de)=>de!==void 0))return[];return[...oe,...K]}function Wc(G,U){if(NA(G))return G.text;return(G&&Xn(G,U))??void 0}function IA(G,U,j){if(U.size===0)return G;let K=(re)=>{let oe=$t(re,G,j);return[...U].some((de)=>de===oe||de.startsWith(`${oe}${yA}`))};return{realpath:(re)=>G.realpath(re)??(K(re)?$t(re,G,j):null),entryKind:(re)=>{let oe=G.entryKind(re);return oe==="missing"&&K(re)?"present":oe},isDirectory:(re)=>G.isDirectory(re)||K(re)}}function kA(G,U,j,K){if(U.shellGitContextState.bodyDepth>0||!un(G.words[0],"mkdir"))return;let re=G.words.slice(1).map((ke)=>Wc(ke,U.shellGitContextState.shellAssignments));if(!re.every((ke)=>ke!==void 0))return;let oe=re.findIndex((ke)=>ke==="--"||ke==="-"||!ke.startsWith("-")),de=re.slice(0,oe);if(oe===-1||!de.every((ke)=>/^(?:-[pv]+|--parents|--verbose)$/.test(ke)))return;let Ce=de.some((ke)=>ke==="--parents"||/^-v*p/.test(ke)),Ee=U.effectiveCwd;for(let ke of re.slice(re[oe]==="--"?oe+1:oe)){if(ke.split(/[\\/]/).includes("..")||!fA(ke)&&!Ee)continue;let De=$t(hA(Ee??"",ke),j,K);if(Ce?OA(De,j):j.isDirectory(mA(De))&&Cg(De,j))U.createdDirectories.add(De)}}function OA(G,U){let j=gA(G).root,K=G.slice(j.length).split(/[\\/]+/).filter(Boolean),re=(de)=>pA(j,...K.slice(0,de+1)),oe=K.findIndex((de,Ce)=>!U.isDirectory(re(Ce)));return oe===-1||Cg(re(oe),U)}function Cg(G,U){try{return U.entryKind(G)==="missing"}catch{return!1}}function MA(G){let U=!1;for(let j of G.slice(1)){if(U||j.provenance!=="literal")return!1;if(j.text==="--"){U=!0;continue}if(!/^-u+$/.test(j.text))return!1}return!0}function DA(G){let U=G.findLast((j)=>(j.fd??([">",">|",">>",">&"].includes(j.operator)?1:0))===1);return U?.operator===">"||U?.operator===">|"?U:void 0}function Sg(G,U=new Map){let j=[],K=!0,re=!1,oe=!1;for(let de of G){if(de.provenance!=="literal"&&Xn(de,U)===null)return;if(K&&un(de,"--")){K=!1;continue}if(K&&!de.quoted&&de.raw===de.text&&/^-[^-]/.test(de.text)){re||=de.text.slice(1).includes("a"),oe||=Array.from(de.text.slice(1)).some((Ce)=>Ce!=="a"&&Ce!=="i");continue}if(K&&!de.quoted&&de.raw===de.text&&de.text.startsWith("--")){re||=de.text==="--append",oe||=de.text!=="--append"&&de.text!=="--ignore-interrupts";continue}j.push(de)}return{operands:j,append:re,hasUnsupportedOptions:oe}}function NA(G){if(!G||G.provenance!=="literal"||G.text.length===0)return!1;if(G.quoted||G.raw!==G.text)return!0;return!G.raw.startsWith("~")&&!/[{}]/.test(G.raw)}function un(G,U){return G?.text===U&&G.raw===U&&G.provenance==="literal"&&!G.quoted}function zc(G){return G.quotedDelimiter||!/[$`\\]/.test(G.body)}function LA(G,U){let j=G.redirections.filter((Ee)=>Ee.operator==="<<"||Ee.operator==="<<-");if(j.length===0)return;if(j.length!==1)return Kr;let K=j[0];if(!K?.heredoc)return Kr;let re=/\$\(|`/.test(K.heredoc.body);if(!zc(K.heredoc)&&(!U||re))return bA;if(K.fd!==void 0&&K.fd!==0)return Kr;if(G.redirections.some((Ee)=>Ee!==K&&["<","<<","<<-","<<<","<&","<>"].includes(Ee.operator)))return Kr;let oe=G.redirections.some((Ee)=>Ee!==K&&fg(Ee.target));if(un(G.words[0],"cat"))return oe?Kr:void 0;if(un(G.words[0],"tee"))return oe||G.words.slice(1).some(fg)?Kr:void 0;let de=G.words[0],Ce=G.words[1];if(un(de,"git")&&(un(Ce,"apply")||un(Ce,"commit")))return;if(un(de,"gh")&&(un(Ce,"pr")||un(Ce,"issue"))&&un(G.words[2],"create"))return;return Kr}function fg(G){return G?.parts.some((U)=>U.provenance==="command-substitution"&&U.raw.startsWith(">("))??!1}function WA(G,U,j,K,re){if(!U)return null;let oe=G.redirections.filter((ke)=>ke.operator==="<<"||ke.operator==="<<-"),de=oe.flatMap((ke)=>ke.heredoc?[ke.heredoc.body]:[]);if(FA(G,oe,j,K,re))return null;let Ce=GA(G,oe,re);if(Ce!==void 0)return Ce?{reason:Ce.reason,segment:G.displayText,ruleId:Ce.id,intent:Ce.intent}:null;let Ee=Gc(de.length===oe.length?de.join(`
-`):G.source,re);return Ee?{...Ee,segment:G.displayText}:null}function GA(G,U,j){let K=U.length===1?U[0]:void 0;if(!K?.heredoc||!zc(K.heredoc)||K.fd!==void 0&&K.fd!==0)return;let re=un(G.words[0],"uv")&&un(G.words[1],"run")?G.words.slice(2):G.words,oe=re[0];if(oe?.provenance!=="literal"||!zn(oe.text))return;let de=re.findIndex((Xe)=>un(Xe,"-"));if(!re.slice(1,de===-1?void 0:de).every((Xe)=>Xe.provenance==="literal"&&Xe.text.startsWith("-")))return;let Ee=K.heredoc.body,ke=nn(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(j.trace?.recordSegment({type:"interpreter",interpreter:oe.text,codeArg:Ee,paranoidBlocked:ke}),ke){let Xe=Dt(At("interpreter.one-liner-paranoid",ii),j.policy);if(Xe)return Xe}if(!si(Ee,void 0,!j.strict))return null;let De=Dt(At("interpreter.dangerous-command",mo),j.policy);if(!De)return null;return j.trace?.recordSegment({type:"dangerous-text",token:Ee,matched:!0,reason:De.reason}),De}function FA(G,U,j,K,re){let oe=U.length===1?U[0]:void 0;if(!oe?.heredoc||!zc(oe.heredoc)||oe.fd!==void 0&&oe.fd!==0)return!1;let de=Lr(G.words,re.environment,j.effectiveCwd,K),Ce=de.words.map(t),Ee=Gt(Ce[0]??"");if((de.envSplitValues?.length??0)>0||!Jt.has(Ee)&&!Jt.has(Lt(Ee)))return!1;return ar(Ce)}function zA(G,U,j,K,re){let oe=ag(G,U.effectiveCwd,K,U.shellGitContextState.shellAssignments,j);if(oe===null)re?.recordSegment({type:"cwd-change",segment:G.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(oe!==void 0)U.effectiveCwd=oe}var $A=new Set(["fi","done","esac"]);function BA(G){return G?.kind==="command"&&G.words.length===1&&G.words[0]?.raw==="!"}function UA(G,U,j,K){let re=G.words[0]?.text??"",oe=U.shellGitContextState.bodyDepth,de=j.shellGitContextState.bodyDepth,Ce=j.compoundBodies;if(de>oe)return j.compoundBodies=[...Ce.slice(0,oe),{entryCwd:U.effectiveCwd,branchCwds:Ce[oe]?.branchCwds??[],hasElse:!1}],[j];let Ee=oe>0?Ce[oe-1]:void 0;if(Ee&&(re==="else"||re==="elif"))return j.compoundBodies=[...Ce.slice(0,oe-1),{entryCwd:Ee.entryCwd,branchCwds:[...Ee.branchCwds,j.effectiveCwd],hasElse:re==="else"}],j.effectiveCwd=Ee.entryCwd,[j];let ke=Ee!==void 0&&$A.has(re);if(ke)j.compoundBodies=Ce.slice(0,de);return[...new Set([j.effectiveCwd,...ke?Ee.branchCwds:[],...ke&&!Ee.hasElse?[Ee.entryCwd]:[],...K?[U.effectiveCwd]:[]])].map((Xe)=>{if(Xe===j.effectiveCwd)return j;let Ye=Yr(j);return Ye.effectiveCwd=Xe,Ye})}function HA(G,U){return G.length===U.length&&G.every((j,K)=>{let re=U[K];return re!==void 0&&j.entryCwd===re.entryCwd&&j.hasElse===re.hasElse&&j.branchCwds.length===re.branchCwds.length&&j.branchCwds.every((oe,de)=>oe===re.branchCwds[de])})}var jA=/^[A-Za-z_][A-Za-z0-9_]*$/,VA=8;function KA(G,U){let j=G.words[1]?.text;if(G.dialect!=="posix"||G.words[0]?.text!=="for"||j===void 0||!jA.test(j))return[U];let K=G.words.slice(3);if(!(G.words[2]?.text==="in"&&K.length>=1&&K.length<=VA&&K.every((oe)=>oe.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(oe.text))))return U.shellGitContextState.shellAssignments.delete(j),[U];return K.map((oe)=>{let de=Yr(U);return de.shellGitContextState.shellAssignments.set(j,oe.text),de})}function Yr(G){return{effectiveCwd:G.effectiveCwd,shellGitContextState:Kf(G.shellGitContextState),literalHeredocFiles:new Map(G.literalHeredocFiles),functionDefinitions:new Map(G.functionDefinitions),createdDirectories:new Set(G.createdDirectories),compoundBodies:G.compoundBodies}}function ta(G){let U=[];for(let j of G){if(!U.some((K)=>qA(K,j)))U.push(j);if(U.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return U}function qA(G,U){return G.effectiveCwd===U.effectiveCwd&&HA(G.compoundBodies,U.compoundBodies)&&To(G.shellGitContextState.env,U.shellGitContextState.env)&&To(G.literalHeredocFiles,U.literalHeredocFiles)&&To(G.functionDefinitions,U.functionDefinitions)&&To(G.shellGitContextState.effectiveEnvAssignments,U.shellGitContextState.effectiveEnvAssignments)&&To(G.shellGitContextState.shellAssignments,U.shellGitContextState.shellAssignments)&&G.shellGitContextState.bodyDepth===U.shellGitContextState.bodyDepth&&pg(G.shellGitContextState.bodyAssignments,U.shellGitContextState.bodyAssignments)&&pg(G.createdDirectories,U.createdDirectories)}function pg(G,U){return G.size===U.size&&[...G].every((j)=>U.has(j))}function To(G,U){if(G===U)return!0;if(!G||!U||G.size!==U.size)return!1;return[...G].every(([j,K])=>U.get(j)===K&&U.has(j))}function YA(G,U){let j=Zo(G);return j===void 0?void 0:U.get(j)}function gg(G,U){if(!U)return null;return{reason:U.reason,segment:G,ruleId:U.id,intent:U.intent}}function ZA(G,U=G.effectiveCwd){let j=U===null;return{environment:G.environment,cwd:j?void 0:U??G.cwd,originalCwd:j?void 0:G.cwd,strict:G.strict,paranoid:G.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.protectedGitMetadata,policy:G.policy,budget:G.budget}}function Gc(G,U){let j=Dt(Nn(G),U.policy),K=U.trace?.currentSegmentIndex??U.trace?.allocateSegment(),re={type:"dangerous-text",token:G,matched:!!j,reason:j?.reason};if(U.trace?.recordSegment(re,K),!j&&/^(?:cd|pushd)\s/.test(G))U.trace?.recordSegment({type:"cwd-change",segment:G,effectiveCwdNowUnknown:!0},K);return j?{reason:j.reason,segment:G,ruleId:j.id,intent:j.intent}:null}function hg(G,U){let j={type:"strict-unparseable",rawCommand:G,reason:Co},K=U.trace?.currentSegmentIndex;if(K===void 0)U.trace?.recordGlobal(j);if(K!==void 0)U.trace?.recordSegment(j)}var XA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function vg(G,U,j,K){let re=Fc(G,0,{...U,...Ve(U),budget:U.budget??On(),factStore:K},j);if(!re)return null;return{kind:"deny",reason:re.reason,intent:re.intent??"manual_only",ruleId:re.ruleId,evidence:{command:G,segment:re.segment}}}function Eg(G,U,j){try{return{decision:G()}}catch(K){let re=JA(K,U,j);if(!re)throw K;return re}}function JA(G,U,j){if(!(G instanceof s)||!XA.has(G.kind))return null;let K=a[G.kind];if(j?.currentSegmentIndex!==void 0)j.recordSegment({type:"error",message:K.reason});if(j?.currentSegmentIndex===void 0)j?.recordGlobal({type:"error",message:K.reason});return{decision:{kind:"deny",reason:K.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:U,segment:U}},errorCode:K.errorCode}}var QA=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Bc=new Set(["cc-safety-net","ccsn"]),eP=new Set(["bunx","npx","pnpx"]),tP=new Set(["pnpm","yarn"]),nP=new Set(["npm","pnpm","yarn"]),rP=new Set(["bun","node"]);function ia(G,U,j={}){if(Bc.has(G))return 0;if(eP.has(G)){if(j.broad)return $c(U);let re=U[0]==="-y"||U[0]==="--yes"?1:0;return oa(U[re])?re+1:null}let K=j.broad?U.findIndex((re)=>!re.startsWith("-")):0;if(K!==-1&&nP.has(G)&&j.broad&&U[K]==="exec"){let re=$c(U.slice(K+1));return re===null?null:K+1+re}if(tP.has(G)){if(G==="yarn"&&!j.broad)return null;if(!j.broad)return U[0]==="dlx"&&oa(U[1])?2:null;if(K===-1||U[K]!=="dlx")return null;let re=$c(U.slice(K+1));return re===null?null:K+1+re}if(rP.has(G)){let re=j.broad&&K!==-1?K:0;if(Rg(U[re]))return re+1;if(G==="bun"&&U[re]==="run"&&Rg(U[re+1]))return re+2}return null}function $c(G){let U=G.findIndex((K)=>oa(K));if(U===-1)return null;let j=U;while(j<G.length){let K=G[j]??"";if(!K.startsWith("-")&&!oa(K))break;j++}return j}function oa(G){if(!G)return!1;let U=G.indexOf("@");if(U===-1)return Bc.has(G);if(U===0)return!1;let j=G.slice(U+1);if(j===""||j.includes("/")||j.includes(":"))return!1;return Bc.has(G.slice(0,U))}function Rg(G){let U=G?.replaceAll("\\","/");return[...QA].some((j)=>U===j||U?.endsWith(`/${j}`))}var qe="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function _g(G,U,j){let K=Sn(G,"input-candidate");if(!K)return null;let re=go(K.shell,G.invocation.context.executionCwd,U,j,{findSegmentTarget:(oe)=>oP(oe,U),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return re?{target:re}:null}function oP(G,U){let j=gr([...G],U),K=j.slice(1),re=ia(Lt(j[0]??"").toLowerCase(),K,{broad:!0});if(re===null)return null;let oe=K.slice(re).filter((de)=>de!=="-g"&&de!=="--global");return oe[0]==="policy"&&oe[1]==="apply"?j.join(" "):null}import{dirname as sa}from"node:path";var Ke="This path contains the protected policy config and you must not modify or delete it.",iP=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Pg(G,U,j){let K=uP(G.invocation.context,U,j);if(G.invocation.route.kind==="patch")return xg(G.paths,!1,G.invocation.context.executionCwd,K,U,j);let re=Sn(G,"input-candidate");if(G.invocation.route.kind==="command")return re?wg(re.shell,G.invocation.context.executionCwd,K,U,j):null;if(G.invocation.route.kind==="unknown"&&re){let oe=wg(re.shell,G.invocation.context.executionCwd,K,U,j);if(oe)return oe}return xg(G.paths,G.invocation.route.kind==="grep"||G.invocation.route.kind==="glob"||Di(G.invocation.toolName),G.invocation.context.executionCwd,K,U,j)}function xg(G,U,j,K,re,oe){if(U)return null;let de=G.find((Ce)=>xi(Ce,j,K,re,oe));return de?{target:de}:null}function wg(G,U,j,K,re){let oe=go(G,U,K,re,{findSegmentTarget:(de,Ce)=>sP(de,Ce,j,K,re)?.target??null,isRedirectionTarget:(de,Ce)=>xi(de,Ce.cwd,j,K,re),findMalformedTarget:(de)=>dP(de,U,j,K,re)?.target??null});return oe?{target:oe}:null}function sP(G,U,j,K,re){if(ui(G))return null;let oe=hr([...G],K),de=Lt(oe[0]??"").toLowerCase(),Ce=oe.slice(1);if(de==="rm"&&aP(Ce)){let Ee=lP(Ce).find((ke)=>Ag(Cn(ke,U.variables),U.cwd,j,K,re));if(Ee)return{target:Ee}}if(de==="find"){if(Fs(oe,1)||rc(oe,K)){let ke=(bi(Xt(oe))??Xt(["."])).find((De)=>{let Xe=Cn(De.text,U.variables);return xi(Xe,U.cwd,j,K,re)||Ag(Xe,U.cwd,j,K,re)})?.text;if(ke)return{target:ke}}}if(de==="mv"){let Ee=ws(Ce).sources.find((ke)=>mP(Cn(ke,U.variables),U.cwd,j,K,re));if(Ee)return{target:Ee}}if(cP(oe,de))return null;for(let Ee of[...G,...oe])for(let ke of Tg(Ee))if(xi(Cn(ke,U.variables),U.cwd,j,K,re))return{target:ke};return null}function aP(G){return G.some((U)=>U==="--recursive"||U.startsWith("-")&&!U.startsWith("--")&&/[rR]/.test(U.slice(1)))}function lP(G){let U=G.indexOf("--");if(U!==-1)return[...G.slice(0,U).filter((j)=>!j.startsWith("-")),...G.slice(U+1)];return G.filter((j)=>!j.startsWith("-"))}function cP(G,U){if(!iP.has(U))return!1;if(U!=="sed")return!0;return!G.slice(1).some((j)=>j.startsWith("-i")||j==="--in-place"||j.startsWith("--in-place="))}function dP(G,U,j,K,re){for(let oe of G.split(/\s+/))for(let de of Tg(oe))if(xi(de,U,j,K,re))return{target:de};return null}function Tg(G){let U=G.trim().replace(/^['"]|['"]$/g,""),j=U.indexOf("=");return j===-1||j===U.length-1?[U]:[U,U.slice(j+1)]}function uP(G,U,j){let K=(Ce)=>wi(pn(Ce,G.executionCwd,U,j)),re=K(u(U)),oe=[K(h(G.executionCwd)),K(h(G.configCwd))],de=new Set(oe.map((Ce)=>sa(Ce)));for(let Ce=sa(re);;Ce=sa(Ce))if(de.add(Ce),sa(Ce)===Ce)break;return{files:new Set([re,...oe]),directoriesAndAncestors:de}}function xi(G,U,j,K,re){let oe=cd(G,U,K,re,(de)=>wi(de)===$i);return oe!==null&&j.files.has(wi(oe))}function Ag(G,U,j,K,re){return j.directoriesAndAncestors.has(wi(pn(G,U,K,re)))}function mP(G,U,j,K,re){let oe=wi(pn(G,U,K,re));return j.files.has(oe)||j.directoriesAndAncestors.has(oe)}function wi(G){return process.platform==="win32"?G.toLowerCase():G}import{isAbsolute as aa,posix as Bg,resolve as ua,win32 as fP}from"node:path";import{fileURLToPath as pP}from"node:url";var Ug="Access to a sensitive path is not allowed.",Hg=new Set(["echo","printf"]),gP=new Set(["find"]),hP=new Set(["!","do","elif","else","if","then","until","while"]),yP=new Set(["-exec","-execdir"]),bP=new Set([";","+"]),CP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),SP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),jg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),vP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),EP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Kc=new Set(["-c","-e","-r","-E","--eval","--exec"]),RP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),qc=new Set(["grep","rg"]),Vg=new Set(["files-with-matches","files-without-match","count","quiet"]),_P=new Set([...Vg,"ignore-case","fixed-strings","hidden"]),xP=new Set(["wc",...qc]),wP=new Set(["cd","grep","head","openssl","tail","tailscale"]),AP=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,PP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),TP=new Set(["commit","merge","notes","stash","tag"]),IP=new Set(["-m","--message"]),kP=new Set(["--grep"]),OP=new Set(["powershell","pwsh"]),Ig=new Set(["jq","gojq","jaq"]),kg="f",Og="file",MP="files",DP=new Set(["e","f"]),NP=new Set(["regexp","file"]),LP=new Set(["e","f","A","B","C","m"]),WP=new Set(["regexp","file","after-context","before-context","context","max-count"]),Uc="__CC_SAFETY_NET_PIPE_INPUT__",jc=/[\w./~@+-]*[./~][\w./~@+-]*/g,GP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,FP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,zP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Mg=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Dg=/\b(?:system|exec|spawn|popen)\s*$/,$P=/\b(?:eval|exec)\s*\(/g,BP=/\b(?:eval|exec)\s*$/,UP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Ng(G,U,j,K,re,oe){for(let de of G){let Ce=de.target;if(cI(Ce,de.cwd,U?.denyPaths??[],j,K,re))return{target:Ce,ruleId:"secret.deny-path"};if(oe&&!oe.has(Ce))continue;let Ee=aI(Ce,de.cwd,U,K,re);if(Ee){let ke=oe!==void 0&&!Ee.startsWith("secret.home.")&&!Ee.startsWith("secret.cli.");if(ke&&K.paths.isDirectory(sh(Ce,de.cwd,K,re)))continue;if(ke&&oe?.get(Ce)==="data")continue;if(ke&&(de.isRedirectionWriteTarget===!0||oe?.get(Ce)==="write")&&!Ce.includes("$")&&!da(Ce,de.cwd,K,re))continue;if(ke&&(de.isCreatedPath===!0||de.isCertificateInput===!0))continue;if(ke&&/\s/.test(Ce)&&!Ce.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Ce)&&!da(Ce,de.cwd,K,re))continue;if(!Ee.startsWith("secret.cli.")&&dI(Ce,de.cwd,U?.allowPaths??[],j,K,re))continue;return{target:Ce,ruleId:Ee}}}return null}function Kg(G,U,j,K,re={}){let oe=Lg(G,j,K),de=Ng(oe,U,G.invocation.context.configCwd,j,K);if(de===null||de.ruleId==="secret.deny-path"||re.strict!==!1)return de;let Ce=Lg(G,j,K,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),Ee=new Map;Ce.forEach((Je)=>qg(Je.target).forEach((Qe)=>Ee.set(Qe,(Ee.get(Qe)??new Set).add(Je.loopVariable))));let ke=(Je,Qe)=>(Ee.get(Je)?.size??0)>(Ee.get(Je)?.has(Qe)?1:0),De=Ce.filter(({loopVariable:Je})=>Je===void 0||ke(Je,Je)||ke("!",Je)),Xe=new Set(De.filter((Je)=>Je.literalRole===void 0).map((Je)=>Je.target)),Ye=new Set(De.filter((Je)=>Je.literalRole==="write").map((Je)=>Je.target)),Ze=Ng(oe,U,G.invocation.context.configCwd,j,K,new Map(De.map((Je)=>[Je.target,Xe.has(Je.target)?"path":Ye.has(Je.target)?"write":"data"])));return Ze?.ruleId!=="secret.deny-path"&&HP(G,j)?null:Ze}function HP(G,U){let j=Sn(G,"input-candidate")??Sn(G,"declared-command");if(!j)return!1;if(j.program.nodes.some((de)=>de.kind==="command"&&de.nested.length>0))return!1;let K=[];for(let de of xs(j.shell)){if(de.kind==="operator"&&de.boundary)return!1;if(de.kind==="redirection")return!1;if(de.kind==="operator")continue;K.push(ir(de.text,U))}let re=Jn(K);if(re.length===0)return!1;let oe=hn(re[0]??"").toLowerCase();if(G.invocation.route.kind==="unknown")return j.program.dialect==="powershell"&&(oe==="ls"||oe==="stat");return Yc(oe,re.slice(1))}function Yc(G,U){if(G==="ls"||G==="stat")return!0;if(G==="test")return U.length===2&&(U[0]==="-e"||U[0]==="-f");if(G==="[")return U.length===3&&(U[0]==="-e"||U[0]==="-f")&&U[2]==="]";if(G==="git")return U[0]==="check-ignore";if(G==="wc")return U.every((j)=>!j.startsWith("-")||AP.test(j));if(qc.has(G))return jP(G,U);if(G!=="find")return!1;return!U.some((j)=>CP.has(j))}function jP(G,U){let j=U.includes("--")?U.slice(0,U.indexOf("--")):U;if(j.some((ke)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ke)||/^-[^-]*f/.test(ke)))return!1;let K=G==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,re=G==="rg"?/[clq]/:/[Lclq]/,oe=(ke)=>/^-[^-]/.test(ke),de=(ke)=>{let De=j[ke-1]??"";return/^--[^=]+$/.test(De)&&!_P.has(De.slice(2))||oe(De)&&De.slice(1).search(K)===De.length-2},Ce=j.findIndex((ke,De)=>!ke.startsWith("-")&&!de(De));return(G==="grep"&&Ce>=0?j.slice(0,Ce):j).some((ke,De)=>{if(de(De))return!1;if(ke.startsWith("--"))return Vg.has(ke.slice(2));return oe(ke)&&re.test(ke.slice(1).split(K)[0]??"")})}function Lg(G,U,j,K={}){let re=G.invocation.context.executionCwd,oe=G.invocation.route.kind;if(oe!=="command"&&oe!=="unknown")return G.paths.map((Ce)=>({target:Ce,cwd:re}));let de=Sn(G,"input-candidate");return[...de?Oo(de.shell,G.store,K,U,re,j,VP(de)):[],...oe==="unknown"?G.paths.map((Ce)=>({target:Ce,cwd:re})):[]]}function VP(G){return G.program.dialect==="powershell"}function Oo(G,U,j,K,re,oe,de=!1){if(G.status==="structural-limit")throw new b;if(G.status==="unclosed-quote")return[];if(G.status==="invalid")throw Error("Unable to parse command for secret protection");let Ce=[...G.assignmentFallbacks.map((et)=>({target:et,cwd:re})),...UT(ir(G.source,K),U,j,K,re,oe)],Ee=(et)=>ir(oT(et,de),K),ke=/[<>=]\(/.test(G.source),De=/\bcoproc\b|\|&/.test(G.source),Xe=[],Ye=[],Ze=(et)=>({...j,commandHoldsPipe:j.commandHoldsPipe===!0||et||De});_s(G,re,K,oe,{word:Ee,segment:(et,mt,Rt,gt,_t,It)=>{if(et.length===0)return null;let Mt=Ze(It);if(Mt.commandHoldsPipe)Xe.push(...et);if(Ye.push(hn(Yg(Jn(et))[0]??"").toLowerCase()),Ce.push(...Pi(et,U,ke||gt==="|"||gt==="|&"?{...Mt,segmentMayFeedReader:!0}:Mt,K,mt.cwd,oe,_t)),Rt!==null)Ce.push(...YP(Rt,et,U,Mt,K,mt.cwd,oe));return null},redirection:(et,mt,Rt)=>{if(et.body!==void 0&&et.consumer!==void 0){let gt=Ze(Rt);Ce.push(...Zg(et.consumer,[et.body],U,gt,K,mt.cwd,oe,(_t)=>ZP(et.consumer??[],_t,U,gt,K,mt.cwd,oe)))}if(et.targetOrder==="legacy-segment")return Fl;return Ce.push({target:Ee(et.target),cwd:mt.cwd,...et.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Je=new Set(Xe.flatMap(qg)),Qe=ke||/\$\(|`/.test(G.source)||!Ye.every((et)=>wP.has(et));return Ce.map(({loopVariable:et,...mt})=>{if(mt.certificateOutputMayFeedReader===!0&&Qe)return{target:mt.target,cwd:mt.cwd};return et===void 0||ke||Je.has(et)||Je.has("!")?mt:{...mt,loopVariable:et}})}function qg(G){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(G)?[G]:[],...Array.from(G.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(U)=>U[1]??U[2]??"")]}function la(G,U,j,K,re,oe,de=!1){let Ce=U.getShellSyntax(G,de?U.getCommandProgram(G,"powershell"):void 0);if(Ce.status==="structural-limit")throw new b;return Ce.status==="complete"?Oo(Ce,U,j,K,re,oe,de):null}function Pi(G,U,j,K,re,oe,de){let Ce=(ft)=>({target:ft,cwd:re}),Ee=G.findIndex((ft)=>!hP.has(ft));if(j.skipMetadataOnlySegments===!0&&Ee>0)return Pi(G.slice(Ee),U,j,K,re,oe,new Set([...de??[]].map((ft)=>ft-Ee)));let ke=G[1]??"";if(j.skipMetadataOnlySegments===!0&&G[0]==="for"&&G[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ke))return G.slice(3).flatMap((ft)=>Gn("for",ft)).map((ft)=>({...Ce(ft),loopVariable:ke}));if(de?.size){let ft=G.filter((Ot,zt)=>!de.has(zt));if(Ig.has(hn(Jn(ft)[0]??"").toLowerCase()))return[...G.filter((Ot,zt)=>de.has(zt)).map(Ce),...Pi(ft,U,j,K,re,oe)]}let De=rT(G).map(Ce),Xe=Jn(G);if(Xe.length===0)return De;let Ye=Xe[0]??"",Ze=hn(Ye).toLowerCase(),Je=Xe.slice(1),Qe=j.segmentMayFeedReader===!0||j.commandHoldsPipe===!0||j.displayOperandsAreCapturedOutput===!0,et=Qe&&xP.has(Ze);if(j.skipMetadataOnlySegments===!0&&!et&&Yc(Ze,Je))return De;let mt=qP(Ye,Ze,Je);if(mt)return[...De,...mt.map(Ce)];if(Hg.has(Ze))return j.displayOperandsAreCapturedOutput===!0?[...De,...Xg(G).map(Ce)]:De;if(Ze==="eval")return[...De,...la(Je.join(" "),U,j,K,re,oe)??Je.map(Ce)];let Rt=OP.has(Gt(Ye))?Tc(Xe):void 0;if(Rt!==void 0)oe.charge("derivedTokens",Xe.length);let gt=Rt===void 0?null:la(Rt,U,j,K,re,oe,!0);if(gt?.length)return[...De,...gt];if(Ze==="export")return[...De,...Je.flatMap((ft)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ft)?[ft.slice(ft.indexOf("=")+1)]:Gn(Ze,ft)).map(Ce)];if(Ze==="git")return[...De,...sT(Je).map(Ce)];if(Ze==="gh")return[...De,...Vc(Ze,Je,PP).map(Ce)];if(Ig.has(Ze))return[...De,...iT(Je).map(Ce)];if(qc.has(Ze))return[...De,...XT(Je).map(Ce)];if(gP.has(Ze))return[...De,...lT(Je,U,j,K,re,oe).map(Ce)];if(Ze==="mkdir"||Ze==="touch"){let ft=new Set(G.filter((zt,on)=>de?.has(on))),Ot=j.segmentMayFeedReader!==!0&&!(Ze==="touch"&&Je.some((zt)=>/^(?:--r|-[^-]*r)/.test(zt)));return[...De,...Je.flatMap((zt)=>Gn(Ze,zt).map((on)=>Ot&&!zt.startsWith("-")&&!ft.has(zt)?{...Ce(on),isCreatedPath:!0}:Ce(on)))]}if(Dn.has(Ze))return[...De,...Je.flatMap((ft)=>Gn("awk",ft)).map(Ce),...Je.flatMap((ft)=>dT(ft,U,j,K,re,oe)),...Je.flatMap(uT).map(Ce)];if(Ze==="curl")return[...De,...Je.filter((ft,Ot)=>Qg(ft)===null&&Jg(Je[Ot-1])===null).flatMap((ft)=>Gn(Ze,ft)).map(Ce),...aT(Je).map(Ce)];if(po(Ze)){let ft=di.has(Ze)?wn([Ze,...Je]):null;if(ft!==null&&ft.command!==null&&ft.commandIndex!==null){let Ot=U.getShellSyntax(ft.command);if(Ot.status==="structural-limit")throw new b;if(Ot.status==="complete")return[...De,...Oo(Ot,U,j,K,re,oe),...Je.slice(ft.commandIndex).filter((zt)=>!zt.startsWith("-")).map(Ce)]}return[...De,...cT(Ze,Je,U,j,K,re,oe)]}let _t=(ft,Ot)=>new RegExp(`^--?${ft}=`).test(Je[Ot]??"")||new RegExp(`^--?${ft}$`).test(Je[Ot-1]??""),It=KP(Xe),Mt=Ze==="openssl"&&Je[0]==="x509",Nt=Qe?{certificateOutputMayFeedReader:!0}:{};return[...De,...Je.flatMap((ft,Ot)=>Gn(Ze,ft).map((zt)=>It&&_t("(?:cert|key)-file",Ot)?{...Ce(zt),isCreatedPath:!0,...Nt}:Mt&&_t("in",Ot)?{...Ce(zt),isCertificateInput:!0,...Nt}:Ce(zt)))]}function Yg(G){return hn(G[0]??"").toLowerCase()==="timeout"?G.slice(2):G}function KP(G){let U=Yg(G);return hn(U[0]??"").toLowerCase()==="tailscale"&&U[1]==="cert"}function qP(G,U,j){let K=ia(U,j);if(K===null||j[K]!=="explain")return null;let re=[G,...j.slice(0,K)],oe=j.slice(K+1);for(let de=0;de<oe.length;de++){let Ce=oe[de];if(Ce==="--json"||Ce==="--help"||Ce==="-h")continue;if(Ce==="--cwd"){let Ee=oe[de+1];if(Ee&&!Ee.startsWith("--"))re.push(Ee);de++;continue}return re}return re}function YP(G,U,j,K,re,oe,de){if(eT(U,j,K,re,oe,de)){let Ce=Jn(G),Ee=Yc(hn(Ce[0]??"").toLowerCase(),Ce.slice(1))?Ce.slice(1).filter((ke)=>!ke.startsWith("-")):[];return[...Xg(G),...Ee].map((ke)=>({target:ke,cwd:oe}))}return Zg(U,XP(G),j,K,re,oe,de,()=>[])}function ZP(G,U,j,K,re,oe,de){let Ce=Jn(G);if(!po(hn(Ce[0]??"").toLowerCase()))return[];return la(U,j,K,re,oe,de)??[{target:U,cwd:oe}]}function Zg(G,U,j,K,re,oe,de,Ce){let Ee=tT(G);if(Ee===null)return U.flatMap(Ce);return U.flatMap((ke)=>di.has(Ee)?Oo(j.getShellSyntax(ke),j,K,re,oe,de):ca(Ee,ke,j,K,re,oe,de))}function Xg(G){let U=Jn(G);if(U.length===0)return[];let j=hn(U[0]??"").toLowerCase();if(!Hg.has(j))return[];let K=U[U[1]==="--"?2:1];if(j==="printf"&&K!==void 0&&!K.startsWith("-")&&!K.replaceAll("%%","").includes("%"))return[Zc(K.replaceAll("%%","%"))];return U.slice(1)}function XP(G){let U=Jn(G);if(U.length===0)return[];let j=hn(U[0]??"").toLowerCase(),K=U.slice(1);if(j==="echo"){let re=K.findIndex((oe)=>!/^-[neE]+$/.test(oe));return[(re===-1?[]:K.slice(re)).join(" ")]}if(j==="printf")return JP(K);return[]}function JP(G){let U=G[0];if(U===void 0)return[];let j=(U.match(/%%|%[bqs]/g)??[]).filter((re)=>re!=="%%").length;if(j===0||G.length===1)return[Zc(U)];let K=G.slice(1);return Array.from({length:Math.ceil(K.length/j)},(re,oe)=>QP(U,K.slice(oe*j,(oe+1)*j)))}function QP(G,U){let j=0;return Zc(G.replace(/%%|%[bqs]/g,(K)=>{if(K==="%%")return"%";let re=U[j]??"";return j++,re}))}function Zc(G){return G.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function eT(G,U,j,K,re,oe){let de=Jn(G);if(de.length===0||hn(de[0]??"").toLowerCase()!=="xargs")return!1;let Ce=Vr(de),Ee=de.slice(Ce.childStart);if(Ee.length===0)return!1;if(Ce.replacementToken==="")return!1;let ke=Ce.replacementToken,De=ke===null?[...Ee,Uc]:Ee.map((Xe)=>Xe.split(ke).join(Uc));return Pi(De,U,j,K,re,oe).some((Xe)=>Xe.target.includes(Uc))}function tT(G){let U=Jn(G);if(U.length===0)return null;let j=hn(U[0]??"").toLowerCase();if(!po(j))return null;return nT(j,U.slice(1))?j:null}function nT(G,U){let j=Xc(G);for(let K=0;K<U.length;K++){let re=U[K];if(re===void 0)break;if(Kc.has(re)||eh(G,re)||/^--(?:eval|exec)=/.test(re))return!1;if(re==="-")return!0;if(re.startsWith("-")){if(j==="python"&&re==="-m")return!1;if(UP.get(j)?.has(re))K++;continue}return!1}return!0}function Xc(G){return/^python\d/.test(G)?"python":G}function rT(G){let U=[];for(let j of G){if(ih(j))continue;let K=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(j);if(K===null)break;if(K[1]!==void 0&&K[1]!=="")U.push(K[1])}return U}var Wg=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function oT(G,U){if(!U||!Wg.test(G))return G;return`~${G.replace(Wg,"").replace(/\\/g,"/")}`}function Gn(G,U){if(U==="--")return[];let j=[],K=U.indexOf("=");if(K>0&&K<U.length-1&&!U.slice(0,K).includes("?"))j.push(U.slice(K+1));if(U.startsWith("-"))return j;if(G==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(U))return j;if(G==="zip"&&/\.zip$/i.test(U))return j;return j.push(U),j}function iT(G){let U=-1,j=!1;for(let K=0;K<G.length;K++){let re=G[K]??"";if(!j&&re==="--"){j=!0;continue}if(j||!/^-(?:[A-Za-z]|-)/.test(re)){if(U===-1)U=K;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(re)){K+=2;continue}if(re==="--indent"||re==="-L"){K++;continue}if(re.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(re)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(re))continue;return G.flatMap((oe)=>Gn("jq",oe))}return G.flatMap((K,re)=>re===U?[]:Gn("jq",K))}function sT(G){let U=[];for(let j=0;j<G.length;j++){let K=G[j]??"";if(K==="--"||!K.startsWith("-"))return[...U,...TP.has(K)?Vc("git",G.slice(j).map((oe)=>/^-[aeinopqsv]+m$/.test(oe)?"-m":oe),IP):Vc("git",G.slice(j),kP)];if(U.push(...Gn("git",K)),!xn.has(K))continue;let re=G[j+1];if(re===void 0)break;U.push(...K==="-c"&&re.includes("=")?[re.slice(re.indexOf("=")+1)]:Gn("git",re)),j++}return U}function Vc(G,U,j){let K=[];for(let re=0;re<U.length;re++){let oe=U[re]??"";if(oe==="--")return[...K,...U.slice(re).flatMap((de)=>Gn(G,de))];if(j.has(oe)){re++;continue}if(oe.includes("=")&&j.has(oe.slice(0,oe.indexOf("="))))continue;K.push(...Gn(G,oe))}return K}function aT(G){return G.flatMap((U,j)=>{let K=Qg(U);if(K!==null)return Gg(K.flag,K.value);let re=Jg(G[j-1]);return re===null?[]:Gg(re,U)})}function Gg(G,U){if(G==="-F"||G==="--form"){let j=U.indexOf("="),K=j===-1?U:U.slice(j+1);if(!K.startsWith("@")&&!K.startsWith("<"))return[];return Hc(K.slice(1).split(";")[0]??"")}if(G==="--data-urlencode"){let j=U.indexOf("@"),K=U.indexOf("=");if(j===-1||K!==-1&&K<j)return[];return Hc(U.slice(j+1))}return U.startsWith("@")?Hc(U.slice(1)):[]}function Jg(G){if(G===void 0)return null;if(jg.has(G))return G;return/^-[A-Za-z]+[dF]$/.test(G)?`-${G.slice(-1)}`:null}function Qg(G){let U=G.slice(0,2);if(G.length>2&&(U==="-d"||U==="-F"))return{flag:U,value:G.slice(2)};let j=G.indexOf("=");if(j===-1)return null;let K=G.slice(0,j);return jg.has(K)?{flag:K,value:G.slice(j+1)}:null}function Hc(G){return G===""||G==="-"?[]:[G]}function lT(G,U,j,K,re,oe){let de=G.findIndex((Ee)=>Ee.startsWith("-")||Ee==="("||Ee==="!"||Ee===";"),Ce=[...G.slice(0,de===-1?G.length:de),...G.flatMap((Ee,ke)=>Ee==="-files0-from"&&G[ke+1]!==void 0?[G[ke+1]??""]:[])];for(let Ee=0;Ee<G.length;Ee++){if(!yP.has(G[Ee]??""))continue;let ke=G.slice(Ee+1),De=ke.findIndex((Ze)=>bP.has(Ze)),Xe=De===-1?ke:ke.slice(0,De),Ye=Pi(Xe,U,j,K,re,oe).map((Ze)=>Ze.target);if(Ce.push(...Ye.filter((Ze)=>Ze!=="{}")),!Ye.includes("{}"))continue;Ce.push(...G.slice(0,Ee).flatMap((Ze,Je,Qe)=>{if(!SP.has(Ze))return[];let et=Qe[Je+1];return et===void 0?[]:[et,et.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Ce}function cT(G,U,j,K,re,oe,de){let Ce=[];for(let Ee=0;Ee<U.length;Ee++){let ke=U[Ee];if(ke===void 0)break;if(Kc.has(ke)||eh(G,ke)){let Xe=U[Ee+1];if(Xe!==void 0)Ce.push(...ca(G,Xe,j,K,re,oe,de)),Ee++;continue}let De=/^--(?:eval|exec)=(.*)$/.exec(ke);if(De!==null&&De[1]!==void 0){Ce.push(...ca(G,De[1],j,K,re,oe,de));continue}if(!ke.startsWith("-"))Ce.push({target:ke,cwd:oe})}return Ce}function eh(G,U){if(!U.startsWith("-")||U.startsWith("--")||U.length<=2)return!1;return RP.get(U[U.length-1]??"")?.has(Xc(G))??!1}function dT(G,U,j,K,re,oe){if(!G.includes("system"))return[];return Ql(G)?.commands.flatMap((de)=>Oo(U.getShellSyntax(de),U,j,K,re,oe))??[]}function uT(G){return Array.from(G.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((U)=>U[1]).filter((U)=>U!==void 0&&U!=="")}function mT(G){let U=Array.from(G.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((j)=>j[2]).filter((j)=>j!==void 0&&j!=="");return[...U,...U.flatMap(Qc),...G.match(jc)??[]]}function ca(G,U,j,K,re,oe,de){let Ce=(ft)=>({target:ft,cwd:oe}),Ee=NT(G),ke=WT(U,Ee);if(ke.kind==="unmaskable")return mT(U).map(Ce);let De=ke.masked.match(Mg)!==null||ke.literals.some((ft)=>Dg.test(ke.masked.slice(0,ft.start))),Xe=ke.masked.match($P)!==null||ke.literals.some((ft)=>BP.test(ke.masked.slice(0,ft.start))),Ye=K.inlineLiteralsPresumedData===!0&&!di.has(G),Ze=Ye&&(Ee==="python"||Ee==="javascript"),Je=Ye&&!(BT(ke.masked)||De||Xe)?[]:ke.literals,Qe=Ye?Array.from(ke.masked.matchAll(Mg),(ft)=>{let Ot=ft.index+ft[0].length;return{start:Ot,end:hs(ke.masked,Ot)}}):[],et=!Ye||Qe.some((ft)=>Dl(ke.masked,ft.start)&&!ST(ke,ft.start))?ke.literals:ke.literals.filter((ft)=>Dg.test(ke.masked.slice(0,ft.start))||Qe.some((Ot)=>ft.start>=Ot.start&&ft.start<Ot.end)),mt=new Set(De?et:[]),Rt=Ze&&Je.length>0&&!hT(ke.masked,Ee==="python"?"#":"//"),gt=Rt?vT(ke.masked):[],_t=Rt?Array.from(ke.masked.matchAll(/[A-Za-z_$][\w$]*/g),(ft)=>({name:ft[0],index:ft.index})):[],It=bT(_t),Mt=!yT(ke.masked,_t),Nt=_t.filter((ft)=>!Fg(ke.masked,{start:ft.index,text:ft.name,tokenStart:ft.index,tokenEnd:ft.index+ft.name.length},gt,It,Mt)).reduce((ft,Ot)=>{let zt=ft.get(Ot.name)??[];return zt.push(Ot.index),ft.set(Ot.name,zt)},new Map);return[...Je.filter((ft)=>ft.text!=="").map((ft)=>{if(!Rt||mt.has(ft))return Ce(ft.text);if(Fg(ke.masked,ft,gt,It,Mt)||ET(ke.masked,ft,gt,Nt))return{...Ce(ft.text),literalRole:"data"};return OT(ke,ft,gt)?{...Ce(ft.text),literalRole:"write"}:Ce(ft.text)}),...Je.flatMap((ft)=>Qc(ft.text)).map(Ce),...Ye?[]:ke.literals.flatMap((ft)=>ft.text.match(jc)??[]).map(Ce),...De?et.flatMap((ft)=>la(ft.text,j,{...K,commandHoldsPipe:!0},re,oe,de)??[Ce(ft.text)]):[],...Xe?ke.literals.flatMap((ft)=>ca(G,ft.text.replace(/\\(.)/g,(Ot,zt)=>zt==="n"?`
-`:zt),j,K,re,oe,de)):[],...Ze?[]:(ke.masked.match(jc)??[]).map(Ce),...Ye?(U.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Ce):[]]}var Jc={"(":")","[":"]","{":"}"},th="and|elif|else|if|in|is|not|of|or|return|while|yield",fT=new RegExp(`(?:^|[^\\w$])(?:${th})$`),pT=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${th})\\s*\\(|/\\*`),gT=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function hT(G,U){return pT.test(G)||G.split(`
-`).some((j)=>{let K=j.indexOf(U);return K>=0&&/[()[\]{}]/.test(j.slice(K))})}function yT(G,U){return xT.test(G)||U.some((j)=>{let K=_T.get(j.name),re=j.index+j.name.length;return K!==void 0&&!K.test(G.slice(re,re+40))})}function bT(G){return G.some((U)=>rh(U.name).some((j)=>gT.test(j)))}var CT=new Set(["cmd","powershell","pwsh"]);function ST(G,U){let j=Zr(G.masked,U),K=Jc[G.masked[j]??""];if(K===void 0||K==="}")return!1;let re=G.masked.indexOf(K,j+1),oe=G.masked.slice(j+1,re);return re!==-1&&/^\s*,[\w\s,]*$/.test(oe)&&/^[,)]/.test(G.masked.slice(Zr(G.masked,re+1)))&&!G.literals.some((de)=>de.tokenStart>j&&de.tokenStart<re&&(Kc.has(de.text)||po(hn(de.text).toLowerCase())||CT.has(hn(de.text).toLowerCase().replace(/\.exe$/,""))))}function vT(G){let U=[];return G.split("").map((j,K)=>{let re=U.at(-1)??-1;if(j in Jc)U.push(K);if(j===")"||j==="]"||j==="}")U.pop();return re})}function Fg(G,U,j,K,re){let oe=j[U.tokenStart]??-1,de=G[oe]??"",Ce=ko(G,U.tokenStart),Ee=Zr(G,U.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(G.slice(Math.max(0,Ce-3),Ce+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(G.slice(Ee,Ee+8)))return!0;if(K&&(de==="["||de==="("))return!1;let ke=G[Ce],De=G[Ee];if(de==="{"&&ke===":")return MT(G,Ce);let Xe=(ke===de||ke===",")&&(De===","||De===Jc[de]||de==="{"&&De===":");if(de!=="(")return Xe&&de!=="";return Xe&&(re&&RT.test(G.slice(Math.max(0,oe-20),oe))||(ke===","||De===",")&&DT(G,oe))}function ET(G,U,j,K){let re=Math.max(0,U.tokenStart-80),oe=`${re===0?`
-`:""}${G.slice(re,U.tokenStart)}`,de=wT.exec(oe)?.[1],Ce=G[j[U.tokenStart]??-1];if(de===void 0||Ce==="("||Ce==="[")return!1;let Ee=Zr(G,U.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(G.slice(U.tokenEnd,Ee)))return!1;let ke=U.tokenStart-oe.length+oe.lastIndexOf(de);return(K.get(de)??[]).every((De)=>De===ke)}var RT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,_T=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),xT=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,wT=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,AT=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,PT=/^\s*\.\s*write_(?:text|bytes)\s*\(/,TT=/(?:^|[^\w$.])open\s*$/,IT=/^[bt]*[awx][abtwx]*$/,kT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function OT(G,U,j){let K=j[U.tokenStart]??-1;if(G.masked[K]!=="(")return!1;let re=ko(G.masked,U.tokenStart),oe=Zr(G.masked,U.tokenEnd),de=G.masked[oe],Ce=G.masked.slice(Math.max(0,K-40),K);if(AT.test(Ce))return(re===K||G.masked[re]===",")&&(de===","||de===")")&&!G.literals.some((ke)=>ke.tokenStart>K&&ke.tokenStart<U.tokenStart)&&PT.test(G.masked.slice(hs(G.masked,K+1)+1));if(re!==K||de!==",")return!1;if(kT.test(Ce))return!0;if(!TT.test(Ce))return!1;let Ee=G.literals.find((ke)=>/^,\s*(?:mode\s*=\s*)?$/.test(G.masked.slice(oe,ke.tokenStart)));return Ee!==void 0&&IT.test(Ee.text)&&/^[,)]/.test(G.masked.slice(Zr(G.masked,Ee.tokenEnd)))}function MT(G,U){let j=ko(G,U),K=/[\w$]*$/.exec(G.slice(Math.max(0,j-63),j+1))?.[0]??"",re=G[ko(G,j+1-K.length)];return re==="{"||re===","}function DT(G,U){let j=ko(G,U),K=G.slice(Math.max(0,j-7),j+1);return!/[\w$)\]]$/.test(K)||fT.test(K)}function NT(G){let U=Xc(G);if(U==="python")return"python";if(U==="osascript")return"opaque";return U==="node"||U==="bun"||U==="deno"?"javascript":"simple"}var LT={python:"#",javascript:"/"};function WT(G,U){if(U==="opaque")return{kind:"unmaskable"};let j={masked:G.split(""),literals:[]};return nh(G,0,U,j,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:j.masked.join(""),literals:j.literals}}function nh(G,U,j,K,re){let oe=0;for(let de=U;de<G.length;de++){let Ce=G[de]??"";if(re&&Ce==="}"&&oe===0)return de;if(re&&Ce===LT[j])return null;if(Ce==="{")oe++;if(Ce==="}")oe--;if(j==="simple"&&(Ce==="`"||Ce==="%"||Ce==="<")){if(FP.test(G.slice(de)))return null}let Ee=Ce==="'"||Ce==='"'||j==="javascript"&&Ce==="`"?Ce:null;if(Ee===null)continue;if(Ee==="`"&&$T(G,de))return null;let ke=j==="python"?FT(G,de):"",De=j==="python"&&G.startsWith(Ee.repeat(3),de)?Ee.repeat(3):Ee,Xe=de+De.length,Ye=Ee==="`"||/[fF]/.test(ke),Ze=de-ke.length,Je=Ye?GT(G,Ze,Xe,De,j,K):zT(G,Xe,De);if(Je===null)return null;if(!Ye){let Qe=G.slice(Xe,Je);if(j==="simple"&&Ee==='"'&&zP.test(Qe))return null;K.literals.push({start:Xe,text:Qe,tokenStart:Ze,tokenEnd:Je+De.length}),K.masked.fill(" ",Xe,Je)}K.masked.fill(" ",de,Xe),K.masked.fill(" ",Je,Je+De.length),de=Je+De.length-1}return re?null:G.length}function GT(G,U,j,K,re,oe){let de=re==="python"?"{":"${",Ce=K==="`"||K.length===3,Ee="";for(let ke=j;ke<G.length;ke++){let De=G[ke]??"";if(G.startsWith(K,ke))return oe.literals.push({start:j,text:Ee,tokenStart:U,tokenEnd:ke+K.length}),ke;if(!Ce&&(De===`
-`||De==="\r"))return null;let Xe=re==="python"&&(De==="{"||De==="}")&&G[ke+1]===De;if(!Xe&&G.startsWith(de,ke)){let Je=nh(G,ke+de.length,re,oe,!0);if(Je===null)return null;Ee+=`${de}}`,oe.masked.fill(" ",ke,ke+de.length),oe.masked[Je]=" ",ke=Je;continue}let Ze=De==="\\"&&!(re==="python"&&G[ke+1]==="{")||Xe?2:1;Ee+=G.slice(ke,ke+Ze),oe.masked.fill(" ",ke,ke+Ze),ke+=Ze-1}return null}function FT(G,U){return GP.exec(G.slice(Math.max(0,U-3),U))?.[1]??""}function zT(G,U,j){let K=j.length===3;for(let re=U;re<G.length;re++){let oe=G[re];if(oe==="\\"){re++;continue}if(!K&&(oe===`
-`||oe==="\r"))return null;if(G.startsWith(j,re))return re}return null}function $T(G,U){for(let j=U-1;j>=0;j--){let K=G[j];if(!K||/\s/.test(K))continue;return/[\w$\])]/.test(K)}return!1}function BT(G){for(let U of G.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let j=U[0],K=U.index;if(vP.has(j.toLowerCase()))return!0;let re=rh(j);if(!re.some((oe)=>EP.has(oe)))continue;if(re.length>1)return!0;if(G[ko(G,K)]===".")return!0;if(G[Zr(G,K+j.length)]==="(")return!0}return!1}function rh(G){return G.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((U)=>U.toLowerCase())}function ko(G,U){for(let j=U-1;j>=0;j--)if(!/\s/.test(G[j]??""))return j;return-1}function Zr(G,U){for(let j=U;j<G.length;j++)if(!/\s/.test(G[j]??""))return j;return G.length}function UT(G,U,j,K,re,oe){return qT(G).flatMap((de)=>{let Ce=U.getShellSyntax(de);if(Ce.status==="invalid")return[];return[...Oo(Ce,U,{...j,displayOperandsAreCapturedOutput:!0},K,re,oe),...HT(Ce,K)?jT(Ce,K).map((Ee)=>({target:Ee,cwd:re})):[]]})}function HT(G,U){let j=xs(G);for(let K=0;K<j.length;K++){let re=j[K];if(re?.kind!=="word"||hn(ir(re.text,U)).toLowerCase()!=="base64")continue;for(let oe=K+1;oe<j.length;oe++){let de=j[oe];if(de?.kind==="operator")break;if(de?.kind!=="word")continue;let Ce=ir(de.text,U);if(Ce==="--decode"||!Ce.startsWith("--")&&Ce.startsWith("-")&&/[dD]/.test(Ce))return!0}}return!1}function jT(G,U){return xs(G).flatMap((j)=>j.kind==="word"?[ir(j.text,U)]:j.kind==="redirection"&&j.target?[ir(j.target,U)]:[]).flatMap(Qc)}function Qc(G){let U=KT(G);if(U===null)return[];let j=Buffer.from(U,"base64").toString("utf8");if(j===""||VT(j))return[];return Buffer.from(j,"utf8").toString("base64").replace(/=+$/g,"")===U.replace(/=+$/g,"")?[j]:[]}function VT(G){return Array.from(G).some((U)=>{let j=U.charCodeAt(0);return j<32||j===127})}function KT(G){if(G.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(G))return null;if(/=/.test(G.replace(/=+$/g,"")))return null;let U=G.replace(/=+$/g,"");if(U.length%4===1)return null;return`${U.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-U.length%4)%4)}`}function qT(G){let U=[],j={inSingle:!1,inDouble:!1,escaped:!1};for(let K=0;K<G.length;K++){let re=G[K];if(!re)break;if(jo(re,j))continue;if(oh(G,K,j)){let oe=YT(G,K+1);if(oe!==null)U.push(oe.body),K=oe.endIndex;continue}if(!j.inSingle&&re==="`"){let oe=ZT(G,K);if(oe!==null)U.push(oe.body),K=oe.endIndex}}return U}function YT(G,U){let j={inSingle:!1,inDouble:!1,escaped:!1},K=1;for(let re=U+1;re<G.length;re++){let oe=G[re];if(!oe)break;if(jo(oe,j))continue;if(oh(G,re,j)){K++,re++;continue}if(!j.inSingle&&!j.inDouble&&oe===")"){if(K--,K===0)return{body:G.slice(U+1,re),endIndex:re}}}return null}function ZT(G,U){let j=!1;for(let K=U+1;K<G.length;K++){let re=G[K];if(!re)break;if(j){j=!1;continue}if(re==="\\"){j=!0;continue}if(re==="`")return{body:G.slice(U+1,K),endIndex:K}}return null}function oh(G,U,j){return!j.inSingle&&G[U]==="$"&&G[U+1]==="("&&G[U+2]!=="("}function XT(G){let U=[],j=[],K=!1,re=!1,oe=!1;for(let Ee=0;Ee<G.length;Ee++){let ke=G[Ee];if(ke===void 0)break;if(!oe&&ke==="--"){oe=!0;continue}if(oe){j.push(ke);continue}let De=/^--([^=]+)(?:=(.*))?$/.exec(ke);if(De!==null){let Xe=De[1]??"",Ye=De[2];if(Xe===MP)re=!0;if(NP.has(Xe))K=!0;if(Ye!==void 0){if(Xe===Og)U.push(Ye);continue}if(WP.has(Xe)){let Ze=G[Ee+1];if(Xe===Og&&Ze!==void 0)U.push(Ze);Ee++}continue}if(ke.startsWith("-")&&ke.length>1){let Xe=ke.slice(1),Ye="",Ze="";for(let Qe=0;Qe<Xe.length;Qe++){let et=Xe[Qe]??"";if(DP.has(et))K=!0;if(LP.has(et)){Ye=et,Ze=Xe.slice(Qe+1);break}}if(Ye==="")continue;if(Ze.length>0){if(Ye===kg)U.push(Ze);continue}let Je=G[Ee+1];if(Ye===kg&&Je!==void 0)U.push(Je);Ee++;continue}j.push(ke)}let Ce=!K&&!re?j.slice(1):j;return[...U,...Ce]}function Jn(G){let U=G.findIndex((j)=>!ih(j)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(j));return U===-1?[]:G.slice(U)}function ih(G){return G==="env"||G==="command"||G==="builtin"||G==="sudo"}var JT=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),QT=".env.",eI=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),tI=[".env.example.",".env.sample."];function nI(G){let U;try{U=new URL(G.trim())}catch{return!1}return U.protocol!=="file:"&&U.host!==""}function rI(G){return G.length>0&&!/\s/.test(G)}function da(G,U,j,K){let re=sh(G,U,j,K);return re!==""&&j.paths.entryKind(re)!=="missing"}function sh(G,U,j,K){try{return Ti(G,U,j,K)}catch(re){if(re instanceof s)throw re;return""}}var oI=/[?&][^?&=/]+=/,iI=new Set(["node_modules","__pycache__"]),sI=[["vendor","bundle"],["vendor","cache"]];function aI(G,U,j,K,re){if(nI(G))return null;let oe=Rn(G,U,K,re);if(!oe)return null;let de=Vt(oe.split("/").pop()??""),Ce=Vt(oe),Ee=()=>rI(de)||da(G,U,K,re),ke=Vt(fI(G,U,K,re));for(let Ye of Ka){let Ze=`~/${Ye.suffixParts.join("/")}`;if(($g(Ce,Ze)||$g(ke,Ze))&&dr(Ye.id,j))return Ye.id}if(eI.has(de)||tI.some((Ye)=>de.startsWith(Ye)))return null;let De=lI(oe,U,j,K,re);if(De)return De;if(JT.has(de))return null;for(let Ye of Va)if(de===Ye.basename&&dr(Ye.id,j))return Ye.id;if(de.startsWith(QT)&&dr(Vi.id,j)&&Ee())return Vi.id;for(let Ye of qa)if(de.length>Ye.prefix.length&&de.startsWith(Ye.prefix)){let Ze=de.slice(Ye.prefix.length)[0];if((Ze==="-"||Ze==="_")&&dr(Ye.id,j)&&Ee())return Ye.id}for(let Ye of Ya)if(de.length>Ye.prefix.length&&de.startsWith(Ye.prefix)){if(de.slice(Ye.prefix.length)===Ye.suffix&&dr(Ye.id,j))return Ye.id}if(uI(Ce))return null;if(!de.includes(".")&&Vo.pattern.test(de)&&dr(Vo.id,j))return Vo.id;if(oI.test(G)&&!da(G,U,K,re))return null;let Xe=mI(de,j);if(Xe)return Xe;return null}function lI(G,U,j,K,re){return Ki.find((oe)=>{if(!dr(oe.id,j))return!1;switch(oe.id){case"secret.cli.claude-code":return Bt(G,qt(K.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",U,K,re),[".credentials.json"]);case"secret.cli.claude-code.config":{let de=Vt(G).split("/");return Bt(G,qt(K.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",U,K,re),["settings.json","settings.local.json"])||Ai(G,"~/.claude.json",U,K,re)||de.at(-1)==="settings.local.json"&&de.at(-2)===".claude"||de.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Bt(G,Rn("~/.gemini/config",U,K,re),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let de=qt(K.env.get("CODEX_HOME"),"~/.codex",U,K,re);return Bt(G,de,["auth.json",".credentials.json"])||Io(G,de,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let de=qt(K.env.get("CODEX_HOME"),"~/.codex",U,K,re),Ce=Vt(G).split("/").at(-1)??"";return Bt(G,de,["config.toml"])||Ce.endsWith(".config.toml")&&Bt(G,de,[Ce])}case"secret.cli.gemini":return Bt(G,rn(qt(K.env.get("GEMINI_CLI_HOME"),"~",U,K,re),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let de=Vt(G).split("/"),Ce=K.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),Ee=K.env.get("ProgramData")?[rn(qt(K.env.get("ProgramData"),"",U,K,re),"gemini-cli")]:[];return Bt(G,rn(qt(K.env.get("GEMINI_CLI_HOME"),"~",U,K,re),".gemini"),["settings.json","google_accounts.json"])||de.at(-1)==="settings.json"&&de.at(-2)===".gemini"||(Ce?.trim()?Ai(G,Ce,U,K,re):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...Ee].some((ke)=>Bt(G,Rn(ke,U,K,re),["settings.json"]))}case"secret.cli.copilot-cli":{let de=qt(K.env.get("COPILOT_HOME"),"~/.copilot",U,K,re);return Bt(G,de,["config.json"])||Io(G,de,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Bt(G,qt(K.env.get("COPILOT_HOME"),"~/.copilot",U,K,re),["mcp-config.json"]);case"secret.cli.kimi-code":{let de=qt(K.env.get("KIMI_CODE_HOME"),"~/.kimi-code",U,K,re),Ce=qt(K.env.get("KIMI_SHARE_DIR"),"~/.kimi",U,K,re);return Bt(G,de,["server.token"])||Io(G,de,["credentials"])||Io(G,Ce,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let de=["config.toml","mcp.json"],Ce=Vt(G).split("/");return Ce.at(-1)==="mcp.json"&&Ce.at(-2)===".kimi-code"||Bt(G,qt(K.env.get("KIMI_CODE_HOME"),"~/.kimi-code",U,K,re),de)||Bt(G,qt(K.env.get("KIMI_SHARE_DIR"),"~/.kimi",U,K,re),[...de,"config.json","config.json.bak"])}case"secret.cli.opencode":{let de=rn(qt(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),"opencode"),Ce=Vt(G).split("/").at(-1)??"",Ee=K.env.get("OPENCODE_DB")?.trim(),ke=Ee&&Ee!==":memory:"?[Ee,`${Ee}-wal`,`${Ee}-shm`]:[];return Bt(G,de,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Ce)&&Bt(G,de,[Ce])||ke.some((De)=>Ai(G,De,U,K,re))}case"secret.cli.opencode.config":{let de=rn(qt(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"opencode"),Ce=K.env.get("ProgramData")?[rn(qt(K.env.get("ProgramData"),"",U,K,re),"opencode")]:[],Ee=["opencode.json","opencode.jsonc"],ke=K.env.get("OPENCODE_CONFIG");return Ee.includes(Vt(G).split("/").at(-1)??"")||Bt(G,de,["config.json"])||(ke?.trim()?Ai(G,ke,U,K,re):!1)||["/Library/Application Support/opencode","/etc/opencode",...Ce].some((De)=>Bt(G,Rn(De,U,K,re),Ee))}case"secret.cli.pi":return Bt(G,qt(K.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",U,K,re),["auth.json"]);case"secret.cli.pi.config":return Bt(G,qt(K.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",U,K,re),["models.json"]);case"secret.cli.amp":{let de=Rn("~",U,K,re);return[rn(qt(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),"amp"),rn(de,".local","share","amp")].some((Ee)=>Bt(G,Ee,["secrets.json"]))||Io(G,rn(de,".amp"),["oauth"])}case"secret.cli.amp.config":{let de=["settings.json","settings.jsonc"],Ce=[rn(qt(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"amp"),rn(Rn("~",U,K,re),".config","amp")],Ee=Vt(G).split("/"),ke=K.env.get("AMP_SETTINGS_FILE");return Ce.some((De)=>Bt(G,De,de))||Ee.at(-2)===".amp"&&de.includes(Ee.at(-1)??"")||(ke?.trim()?Ai(G,ke,U,K,re):!1)}case"secret.cli.cursor":{let de=rn(qt(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),"cursor"),Ce=rn(qt(K.env.get("CURSOR_DATA_DIR"),"~/.cursor",U,K,re),"projects");return Bt(G,Rn("~/.cursor",U,K,re),["auth.json"])||Bt(G,de,["auth.json"])||Vt(G).split("/").at(-1)==="mcp-auth.json"&&Xr(Vt(G),Vt(Ce))}case"secret.cli.cursor.config":{let de=Vt(G).split("/");return de.at(-1)==="mcp.json"&&de.at(-2)===".cursor"}case"secret.cli.grok-build":return Bt(G,qt(K.env.get("GROK_HOME"),"~/.grok",U,K,re),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let de=Vt(G).split("/");return de.at(-1)==="config.toml"&&de.at(-2)===".grok"||Bt(G,qt(K.env.get("GROK_HOME"),"~/.grok",U,K,re),["config.toml","managed_config.toml","requirements.toml"])||Bt(G,Rn("/etc/grok",U,K,re),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Bt(G,Rn("~/.factory",U,K,re),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let de=Vt(G).split("/");return de.at(-1)==="mcp.json"&&de.at(-2)===".factory"||Bt(G,Rn("~/.factory",U,K,re),["settings.json","hooks.json"])}case"secret.cli.devin":return[qt(K.env.get("XDG_DATA_HOME"),"~/.local/share",U,K,re),Rn("~/.local/share",U,K,re)].some((de)=>Bt(G,rn(de,"devin"),["credentials.toml"])||Io(G,rn(de,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[qt(K.env.get("XDG_CONFIG_HOME"),"~/.config",U,K,re),Rn("~/.config",U,K,re)].some((de)=>Bt(G,rn(de,"devin"),["config.json"]));default:return!1}})?.id??null}var zg=new WeakMap;function qt(G,U,j,K,re){let oe=zg.get(re)??new Map;zg.set(re,oe);let de=`${j}\x00${G??""}\x00${U}`,Ce=oe.get(de);if(Ce!==void 0)return Ce;let Ee=Rn(G?.trim()?G:U,j,K,re);return oe.set(de,Ee),Ee}function Bt(G,U,j){return j.some((K)=>ah(G,rn(U,K)))}function Io(G,U,j){return j.some((K)=>Xr(Vt(G),Vt(rn(U,K))))}function Ai(G,U,j,K,re){return ah(G,Rn(U,j,K,re))}function ah(G,U){return Vt(G)===Vt(U)}function rn(G,...U){return Vn([G,...U].filter(Boolean).join("/"))}function cI(G,U,j,K,re,oe){if(j.length===0)return!1;let de=Vt(Ti(G,U,re,oe));return j.some((Ce)=>Xr(de,Vt(Ti(Ce,K,re,oe))))}function dI(G,U,j,K,re,oe){if(j.length===0)return!1;let de=Vt(Ti(G,U,re,oe));if(!de)return!1;let Ce=re.env.get("HOME")??re.home,Ee=Ce?Vn($t(fn(Ce),re.paths,oe)):"",ke=Vt(Ee),De=re.env.get("CC_SAFETY_NET_HOME"),Xe=Vt(De?Vn($t(ua(fn(De)),re.paths,oe)):Ee&&Vn($t(`${Ee}/.cc-safety-net`,re.paths,oe)));if(Xe&&Xr(de,Xe))return!1;return j.some((Ye)=>{let Ze=el(Ye);if(Ze&&Bg.basename(de)!==Vt(Ze.name))return!1;let Je=Vt(Ti(Ze?.root??Ye,K,re,oe));if(!Je)return!1;if(ke&&(ke===Je||ke.startsWith(Je.endsWith("/")?Je:`${Je}/`)))return!1;return Xr(de,Je)&&!(Ze&&de===Je)})}function uI(G){let U=G.split("/");return U.some((j)=>iI.has(j))||sI.some(([j,K])=>U.some((re,oe)=>re===j&&U[oe+1]===K))}function mI(G,U){let j=G.lastIndexOf("."),K=j>0&&j<G.length-1?G.slice(j+1):"";if(K==="")return null;for(let re of Za)if(K===re.extension&&dr(re.id,U))return re.id;for(let re of Xa)if(re.pattern.test(K)&&dr(re.id,U))return re.id;return null}function Vt(G){return G.toLowerCase()}function dr(G,U){return!U?.disabledRules?.includes(G)}function Rn(G,U,j,K){let{home:re,normalized:oe}=ed(G,j,K);if(!oe)return"";if(!re)return oe;let de=td(oe,re),Ce=aa(de)?de:Vn(ua(U,de)),Ee=Vn($t(Ce,j.paths,K));if(!Xr(Ee,re)){if(aa(de))return Ee;return Ee===Ce?oe:Ee}let ke=Ee.slice(re.length);return ke?`~${ke}`:"~"}function $g(G,U){return G===U||G.startsWith(`${U}/`)}function fI(G,U,j,K){let{home:re,normalized:oe}=ed(G,j,K);if(!oe||!re)return"";let de=td(oe,re),Ce=Bg.normalize(aa(de)?de:Vn(ua(U,de))),Ee=Vn(fn(j.env.get("HOME")??j.home)),ke=(Ye)=>process.platform==="win32"?Ye.toLowerCase():Ye,De=[re,Ee].find((Ye)=>Ye!==""&&Xr(ke(Ce),ke(Ye)));if(De===void 0)return"";let Xe=Ce.slice(De.length);return Xe?`~${Xe}`:"~"}function Ti(G,U,j,K){let{home:re,normalized:oe}=ed(G,j,K);if(!oe)return"";let de=re?td(oe,re):oe;return Vn($t(aa(de)?de:ua(U,de),j.paths,K))}function ed(G,U,j){let K=U.env.get("HOME")??U.home,re=K?Vn($t(fn(K),U.paths,j)):"",oe=Vn(fn(pI(ir(G,U))));return{home:re,normalized:oe}}function pI(G){if(!G.trim().toLowerCase().startsWith("file:"))return G;try{return pP(G)}catch{return G}}function td(G,U){if(G==="~")return U;if(G.startsWith("~/"))return rn(U,G.slice(2));return G}function gI(G){if(process.platform==="win32")return!0;return fP.parse(G).root.length>1}function Vn(G){let U=G.trim(),j=(U.includes("\\")&&gI(U)?U.replace(/\\/g,"/"):U).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(j==="/")return j;return j.replace(/\/+$/g,"")}function Xr(G,U){return G===U||G.startsWith(U.endsWith("/")?U:`${U}/`)}function hn(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}class f extends Error{stage;evaluation;name="GuardEvaluationError";constructor(G,U,j){super(`CC Safety Net ${G} dependency failed`,{cause:j});this.stage=G;this.evaluation=U}}var hI={findPolicyMutation:Pg,findGitMetadataMutation:Qm,resolveGitMetadata:SI,loadPolicySnapshot:R,findSensitiveTarget:Kg,analyzeCommand:vg,getModes:P},yI=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,bI=["workdir","cwd","working_directory"];function q(G,U){let j={...hI,...U.dependencies},K=RI(G),re=()=>Rr("config-load",K,()=>j.loadPolicySnapshot(U.environment,{...U.policyOptions,cwd:G.context.configCwd})),oe=G.route.kind==="unknown"&&K?re():void 0,de=oe?.policy.commandTools.find((Ot)=>Ot.name===G.toolName),Ce=de&&K?CI(G,K,de.cwd,U.environment.paths):G;if("decision"in Ce)return Ce;let Ee=Ce,ke=Ee===G?{}:{promotedInvocation:Ee},De=Ii(Ee)?Ee.command:K,Xe=Rr("policy-protection",De,()=>Ym(Ee)),Ye=Sn(Xe,"input-candidate"),Ze=Sn(Xe,"declared-command");if(Ii(Ee)&&Ee.command?.trim()&&Ze?.program.status==="limited")return{stage:"command-analysis",...ke,decision:{kind:"deny",reason:Kn,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:Ee.command,segment:Ee.command}}};if(Ye?.program.status==="limited")return{stage:"command-validation",...ke,decision:{kind:"deny",reason:Sf,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Je=On(),Qe=Rr("policy-protection",De,()=>j.resolveGitMetadata([Ee.context.executionCwd,Ee.context.configCwd],U.environment)),et=Rr("policy-protection",De,()=>j.findPolicyMutation(Xe,U.environment,Je));if(et){let Ot=De??et.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:Ke,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Ot,segment:et.target}}}}let mt=Rr("policy-protection",De,()=>_g(Xe,U.environment,Je));if(mt){let Ot=De??mt.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:qe,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Ot,segment:mt.target}}}}let Rt=Rr("policy-protection",De,()=>j.findGitMetadataMutation(Xe,Qe,U.environment,Je));if(Rt){let Ot=De??Rt.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:v,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Ot,segment:Rt.target}}}}let gt=oe??re(),_t=gt.policy,It=j.getModes(_t,U.environment.env),Mt={level:It.effectiveLevel,...vI(gt),...ke},Nt=_t.secretProtection.enabled===!1?null:Rr("secret-protection",De,()=>j.findSensitiveTarget(Xe,_t.secretProtection,U.environment,Je,{strict:Ii(Ee)||Ye?.program.dialect==="powershell"?It.strict:void 0}));if(Nt){let Ot=De??Nt.target;return{stage:"secret-protection",...Mt,decision:{kind:"deny",reason:Ug,intent:"hard_stop",ruleId:Nt.ruleId,evidence:{command:Ot,segment:Nt.target}}}}if(!Ii(Ee))return{stage:"non-command",...Mt,decision:{kind:"allow"}};if(!Ee.command||Ee.command.trim()==="")return{...ma("command-validation",De),...Mt};let ft=Rr("command-analysis",De,()=>Eg(()=>j.analyzeCommand(Ee.command,{cwd:Ee.context.executionCwd,shell:Ee.route.shell,policySnapshot:gt,environment:U.environment,protectedGitMetadata:Qe,effectiveCapabilities:It.capabilities,strict:It.strict,paranoidRm:It.paranoidRm,paranoidInterpreters:It.paranoidInterpreters,worktreeMode:It.worktreeMode,budget:Je,...U.trace?{trace:U.trace}:{}},EI(Xe),Xe.store),Ee.command,U.trace));if(ft.decision){let Ot=!It.strict&&(ft.decision.ruleId==="raw-text.dangerous-command"||ft.decision.reason===gi&&!yI.test(ft.decision.evidence?.segment??"")&&Nn(Ee.command)===null);return{stage:"command-analysis",...Mt,..."errorCode"in ft?{errorCode:ft.errorCode}:{},decision:Ot?{...ft.decision,unverifiedByStandardMode:!0}:ft.decision}}return{stage:"command-analysis",...Mt,decision:{kind:"allow"}}}function CI(G,U,j,K){let re=[...new Set((j?[j]:bI).flatMap((Ee)=>{let ke=Object.getOwnPropertyDescriptor(G.input,Ee);return ke?[ke.value]:[]}))],oe=re.filter((Ee)=>typeof Ee==="string"&&Ee.trim()!=="");if(re.length>1||oe.length!==re.length)return ma("command-validation",U);let de=oe[0],Ce=de===void 0?G.context.configCwd:Md(de,G.context.configCwd,K);if(!Ce){let Ee=_({directory:"requested",problem:"unusable",cwd:de??""});return{stage:"command-validation",decision:{kind:"deny",reason:Ee.reason,ruleId:Ee.ruleId,intent:Ee.intent,evidence:{command:U,segment:U}}}}return l(G.toolName,G.input,{kind:"command",shell:"auto"},{configCwd:G.context.configCwd,executionCwd:Ce},U)}function SI(G,U){let j=[...new Set(G.filter((K)=>typeof K==="string"&&K!==""))].flatMap((K)=>U.gitMetadata(K)??[]);if(j.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(j.flatMap((K)=>K.entries))]),markerFiles:Object.freeze([...new Set(j.flatMap((K)=>K.markerFiles))]),directories:Object.freeze([...new Set(j.flatMap((K)=>K.directories))]),hooksDirectories:Object.freeze([...new Set(j.flatMap((K)=>K.hooksDirectories))])})}function vI(G){if(G.state==="ready")return{};return{configFallback:{reason:G.reason}}}function EI(G){return Sn(G,"declared-command")?.program}function RI(G){try{return ie(G.input)}catch(U){let j=Ii(G)?G.command:void 0;throw new f("policy-protection",ma("policy-protection",U instanceof m?void 0:j,U),U)}}function Rr(G,U,j){try{return j()}catch(K){throw new f(G,ma(G,K instanceof m?void 0:U,K),K)}}function ma(G,U,j){let K=j instanceof s||j instanceof b;return{stage:G,decision:{kind:"deny",reason:K?ga:No,ruleId:K?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...U?{evidence:{command:U,segment:U}}:{}}}}function Ii(G){return G.route.kind==="command"}
-export{a,s,J,Ne,tt,T,ht,nt,Re,N,_,Y,yt,c,n,rt,Te,P,S,pe,bt,m,_e,x,ie,fe,xt,ot,it,l,Le,o,w,i,se,r,g,me,H,vt,St,p,ge,he,wt,L,Z,ae,C,Ct,I,h,Pe,W,u,A,X,st,at,M,E,O,ye,be,Me,Et,d,e,Fe,Ie,$e,xe,ct,lt,ce,Ae,le,je,Q,B,Ue,ve,z,ut,V,ee,te,ue,dt,pt,k,F,Ge,He,We,Be,R,ze,Oe,Ve,y,t,ne,Se,b,v,D,kt,we,qe,Ke,f,q};