cc-safety-net 2.6.12 → 2.6.13

package/dist/chunks/index-1wy9mq4k.js

@@ -1,50 +0,0 @@
-var ha="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Kn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",No="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var ga={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Do={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...ga},processedCandidateBytes:{cap:4194304,...ga},pathEnvironmentExpansion:{cap:64,...ga},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Do},trackedHeredocFiles:{cap:64,...Do},controlFlowStates:{cap:64,...Do},wrapperPeelIterations:{cap:20,...Do},derivedCommandShape:Do});class s extends Error{kind;name="AnalysisLimit";constructor(G){super(a[G].reason);this.kind=G}}function On(){let G=new Map;return{counters:G,resolvedPaths:new Map,charge(H,j=1){let J=(G.get(H)??0)+j;if(G.set(H,J),J>a[H].cap)throw new s(H)}}}var sh=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function Y(G){return Me(G.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Me(G){return sh.reduce((H,j)=>H.replace(j,"<redacted>"),G.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function nt(G){return rd(G).reduceRight((H,j)=>`${H.slice(0,j.valueStart)}<redacted>${H.slice(j.valueEnd)}`,G)}function T(G){return Me(nt(G))}function bt(G){return rd(G).map((H)=>G.slice(H.valueStart,H.valueEnd))}function rt(G){return/[A-Za-z_][A-Za-z0-9_]*=/.test(G)}function rd(G){return[...G.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((H)=>{let j=G[H.index-1];if(H.index>0&&j&&!/[\s"'([{]/.test(j))return[];let J=H.index+H[0].length;if(J>=G.length)return[];return[{valueStart:J,valueEnd:ah(G,J)}]})}function ah(G,H){if(G.startsWith("$(",H))return lh(G,H);let j=G[H];if(j==='"'||j==="'"){for(let oe=H+1;oe<G.length;oe++){if(j==='"'&&G[oe]==="\\"){oe++;continue}if(G[oe]===j)return oe+1}return G.length}let J=H;while(J<G.length&&!/\s/.test(G[J]??""))J++;return J}function lh(G,H){let j=0,J;for(let oe=H;oe<G.length;oe++){let ie=G[oe];if(J){if(J==='"'&&ie==="\\"){oe++;continue}if(ie===J)J=void 0;continue}if(ie==='"'||ie==="'"){J=ie;continue}if(ie==="$"&&G[oe+1]==="("){j++,oe++;continue}if(ie!==")")continue;if(j--,j===0)return oe+1}return G.length}var ch={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function dh(G){let H=G.maxLen??200,j=G.redact??((oe)=>oe),J=(oe)=>oe.length>H?`${oe.slice(0,H)}...`:oe;return[G.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${j(G.reason)}`,G.ruleId?`Rule: ${G.ruleId}`:void 0,G.toolName?`Tool: ${G.toolName}`:void 0,G.command?`Command: ${J(j(G.command))}`:void 0,G.segment&&G.segment!==G.command?`Segment: ${J(j(G.segment))}`:void 0,G.cwd?`Working directory: ${J(j(G.cwd))}`:void 0,G.configWarning?`Config warning: ${j(G.configWarning)}`:void 0,G.askUser?"Approve only if you expected this command.":ch[G.intent??"manual_only"]].filter((oe)=>oe!==void 0).join(`
-
-`)}function _e(G,H){if(G.decision.kind!=="deny")return;let j=H.includeEvidence?G.decision.evidence:void 0;return{reason:G.decision.reason,ruleId:G.decision.ruleId,intent:G.decision.intent,command:j?.command,segment:j?.segment,toolName:H.toolName,...G.configFallback?{configWarning:G.configFallback.reason}:{},...G.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function L(G={}){return{reason:No,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:G.command,segment:G.segment??G.command,toolName:G.toolName}}var uh={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function _(G,H={}){return{...uh[G.directory][G.problem],command:H.command,toolName:H.toolName,cwd:G.cwd}}function Z(G){return dh({...G,redact:Y})}function xt(G){return Y(G instanceof Error?G.message:String(G))}import{lstatSync as Kh,realpathSync as qh,statSync as Yh}from"node:fs";import{homedir as Zh,tmpdir as Xh}from"node:os";import{statSync as Hh}from"node:fs";import{join as jh}from"node:path";import{basename as sd,dirname as mh,isAbsolute as fh,join as ph,normalize as gh,resolve as od}from"node:path";var hh=256,Oi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(G,H=process.platform){if(H!=="win32")return G;return G.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function tr(G,H=process.platform){if(H!=="win32")return!1;return(G[0]==="/"||G[0]==="\\")&&(G[1]==="/"||G[1]==="\\")}function ba(G,H){return ya(G,0,H)}function ya(G,H,j){let J="",oe=0,ie=0;while(oe<G.length){if(G[oe]!=="$"){J+=G[oe],oe++;continue}if(G[oe+1]==="{"){let Re=Ca(G,oe+2),Te=yh(G,oe,H);if(Te===null){if(Oi.has(Re))throw new s("pathEnvironmentExpansion");if(ie++,ie>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");J+="${",oe+=2;continue}let ke=G.slice(oe,Te+1);J+=Ch(ke,H,j),oe=Te+1;continue}let fe=Ca(G,oe+1);if(!fe){J+="$",oe++;continue}J+=Sa(fe,j)??`$${fe}`,oe+=fe.length+1}return J}function yh(G,H,j){let J=1;for(let oe=H+2;oe<G.length;oe++){if(G[oe]==="\\"){oe++;continue}if(G[oe]==="$"&&G[oe+1]==="{"){if(J++,j+J>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");oe++;continue}if(G[oe]!=="}")continue;if(J--,J===0)return oe}return null}function Ch(G,H,j){let J=G.slice(2,-1),oe=Ca(J,0);if(!oe)return G;let ie=J.slice(oe.length);if(!ie)return Sa(oe,j)??G;let fe=[":-",":+",":=",":?","-","+","=","?"].find((ke)=>ie.startsWith(ke));if(!fe){if(Oi.has(oe))throw new s("pathEnvironmentExpansion");return G}if(!Oi.has(oe))return G;if(fe.endsWith("="))throw new s("pathEnvironmentExpansion");let Re=Sa(oe,j),Te=fe.startsWith(":")?Re!==null&&Re!=="":Re!==null;if(fe.endsWith("?")&&!Te)throw new s("pathEnvironmentExpansion");if(fe.endsWith("-")||fe.endsWith("?"))return Te?Re??"":ya(ie.slice(fe.length),H+1,j);return Te?ya(ie.slice(fe.length),H+1,j):""}function Ca(G,H){if(!/[A-Za-z_]/.test(G[H]??""))return"";let j=H+1;while(/[A-Za-z0-9_]/.test(G[j]??""))j++;return G.slice(H,j)}function Sa(G,H){if(!Oi.has(G))return null;if(G==="HOME")return H.env.get("HOME")??H.home;return H.env.get(G)??null}function Bt(G,H,j){if(!G)return G;let J=j.resolvedPaths.get(G);if(J!==void 0)return J;let oe=[],ie=G;while(!0){ad(j,ie);let fe=H.realpath(ie);if(fe!==null)return id(j,G,fe,oe);let Re=mh(ie);if(Re===ie||oe.length>=hh)return id(j,G,ie,oe);oe.push(sd(ie)),ie=Re}}function id(G,H,j,J){let oe=J.length===0?j:ph(j,...J.reverse());return G.resolvedPaths.set(H,oe),oe}function Sh(G,H,j){let J=j.resolvedPaths.get(G);if(J!==void 0)return J;ad(j,G);let oe=H.realpath(G);if(oe!==null)j.resolvedPaths.set(G,oe);return oe}function ad(G,H){G.charge("realpathAttempts"),G.charge("processedCandidateBytes",Buffer.byteLength(H))}function gn(G,H,j,J){let oe=cd(G,H,j);if(!oe)return"";return Bt(oe,j.paths,J).replace(/\\/g,"/")}function ld(G,H,j,J,oe){let ie=cd(G,H,j);if(!ie)return null;if(oe(sd(ie)))return Bt(ie,j.paths,J).replace(/\\/g,"/");let fe=Sh(ie,j.paths,J);return fe===null?null:fe.replace(/\\/g,"/")}function cd(G,H,j){let J=j.home,oe=ba(G.trim(),j).replace(/\\/g,"/");if(!oe)return"";let ie=oe==="~"?J:oe.startsWith("~/")?od(J,oe.slice(2)):oe,fe=pn(ie);return gh(fh(fe)?fe:od(H,fe))}import{spawnSync as bh}from"node:child_process";import{existsSync as Wo,lstatSync as vh,readFileSync as Fo,realpathSync as eo,statSync as Lo}from"node:fs";import{dirname as va,isAbsolute as Ea,join as to,resolve as Mi}from"node:path";var Eh=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Rh=5000;function ud(G,H=zh(),j=Rh){let J=_h(G),oe=J===null?null:xh(J);if(J===null||oe===null)return null;let ie=Fh(J,oe,H,j);return ie===null?null:{recursiveSubmodules:ie}}function _h(G){try{let H=eo(Mi(G));return Lo(H).isDirectory()?H:null}catch{return null}}function xh(G){let H=Wh(G);if(!H)return null;try{let j=vh(H);if(j.isSymbolicLink()||!j.isFile())return null;let J=Ra(H);if(!J?.commonDir)return null;if(!Ph(J.gitDir,H))return null;return Th(J.gitDir,va(H))?{gitDir:J.gitDir,commonDir:J.commonDir}:null}catch{return null}}function Ra(G){try{let H=wh(G);if(!H)return null;let j=eo(Ea(H)?H:Mi(va(G),H));if(!Lo(j).isDirectory())return null;return{gitDir:j,commonDir:Ah(j)}}catch{return null}}function wh(G){let H=Fo(G,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!H.startsWith("gitdir:"))return null;return H.slice(7).trim()||null}function Ah(G){try{let H=Fo(to(G,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!H)return null;let j=eo(Ea(H)?H:Mi(G,H));return Lo(j).isDirectory()?j:null}catch{return null}}function Ph(G,H){let j=Ih(G);return j===null?!1:md(G,j,H)}function Th(G,H){let j=kh(G);return j===null?!0:md(G,j,H)}function Ih(G){let H=to(G,"gitdir");if(!Wo(H))return null;let j=Fo(H,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return j===""?null:j}function kh(G){let H=to(G,"config.worktree");return Wo(H)?Mh(H):null}function md(G,H,j){try{return Oh(Ea(H)?H:Mi(G,H),j)}catch{return!1}}function Oh(G,H){try{let j=Lo(G),J=Lo(H);if(j.ino!==0&&J.ino!==0&&j.dev===J.dev&&j.ino===J.ino)return!0}catch{}return dd(eo.native(G))===dd(eo.native(H))}function dd(G){let H=G.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),j=H.length>1&&H.endsWith("/")?H.slice(0,-1):H;return process.platform==="win32"?j.toLowerCase():j}function Mh(G){let H=Fo(G,"utf-8"),j=!1,J=null;for(let oe of H.split(/\r?\n/)){let ie=oe.trim();if(ie===""||ie.startsWith("#")||ie.startsWith(";"))continue;if(ie.startsWith("[")){j=/^\[core\]$/i.test(ie);continue}if(!j)continue;let fe=ie.match(/^worktree\s*=\s*(.*)$/i);if(fe)J=Dh(fe[1]??"")}return J}function Dh(G){let H=G.trim();if(!H.startsWith('"')||!H.endsWith('"'))return H;return Lh(H.slice(1,-1))}var Nh={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Lh(G){return G.replace(/\\(.?)/gs,(H,j)=>j===""?H:Nh[j]??H)}function Wh(G){try{return _a(eo(G))}catch{return null}}function _a(G){let H=G;while(!0){let j=to(H,".git");if(Wo(j))return j;let J=va(H);if(J===H)return null;H=J}}function Fh(G,H,j,J){if(Gh(H))return!0;if(j===null)return!0;let oe=bh(j,["config","--get","submodule.recurse"],{cwd:G,encoding:"utf8",env:$h(process.env),stdio:["ignore","pipe","ignore"],timeout:J});if(oe.error!==void 0||oe.status!==0&&oe.status!==1)return null;return oe.status===0&&fd(oe.stdout.trim())}function Gh(G){return[to(G.commonDir,"config"),to(G.gitDir,"config.worktree")].filter((H)=>Wo(H)).some((H)=>Bh(H))}function zh(){return Eh.find((G)=>Wo(G))??null}function Go(G){return G==="GIT_CONFIG_COUNT"||G==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(G)}function $h(G){return Object.fromEntries(Object.entries(G).filter(([H])=>!Go(H)))}function Bh(G){let H;try{H=Fo(G,"utf-8")}catch{return!0}let j="",J=!1;for(let oe of H.split(/\r?\n/)){let ie=oe.trim();if(ie===""||ie.startsWith("#")||ie.startsWith(";"))continue;let fe=ie.match(/^\[([^\]]+)\]$/);if(fe){j=fe[1]?.trim().toLowerCase()??"";continue}let Re=ie.indexOf("="),Te=(Re===-1?ie:ie.slice(0,Re)).trim().toLowerCase(),ke=Re===-1?"true":ie.slice(Re+1).trim();if(Uh(j)&&Te==="path")return!0;if(j==="submodule"&&Te==="recurse")J=fd(ke)}return J}function Uh(G){return G==="include"||G.startsWith("includeif ")}function fd(G){let H=G.toLowerCase();return H!=="false"&&H!=="no"&&H!=="off"&&H!=="0"}function pd(G,H){if(G==="")return null;let j=On(),J=_a(gn(G,G,H,j)),oe=J?Vh(J,G,H,j):null;if(!oe)return null;return Object.freeze({entries:Object.freeze([oe.entry]),markerFiles:Object.freeze(oe.markerFile?[oe.markerFile]:[]),directories:Object.freeze(oe.directories),hooksDirectories:Object.freeze(oe.hooksDirectories)})}function Vh(G,H,j,J){try{let oe=gn(G,H,j,J),ie=Hh(G),fe=ie.isFile()?oe:null,Re=ie.isFile()?Ra(G):null,Te=(ie.isDirectory()?[oe]:[Re?.gitDir,Re?.commonDir]).flatMap((Le)=>Le?[no(gn(Le,H,j,J))]:[]),ke=[...new Set(ie.isDirectory()?[no(G.replace(/\\/g,"/")),...Te]:Te)];return{entry:no(oe),markerFile:fe?no(fe):null,directories:ke,hooksDirectories:[...new Set(ke.flatMap((Le)=>{let Xe=no(jh(Le,"hooks").replace(/\\/g,"/"));return[Xe,no(gn(Xe,H,j,J))]}))]}}catch{return null}}function no(G){return process.platform==="win32"?G.toLowerCase():G}var Jh={realpath:(G)=>{try{return qh(G)}catch{return null}},entryKind:(G)=>{try{let H=Kh(G,{throwIfNoEntry:!1});if(!H)return"missing";return H.isSymbolicLink()?"symlink":"present"}catch(H){if(H.code==="ENAMETOOLONG")return"missing";throw H}},isDirectory:(G)=>{try{return Yh(G).isDirectory()}catch{return!1}}};function c(){return Qh({env:new Map(Object.entries(process.env).flatMap(([G,H])=>H===void 0?[]:[[G,H]])),home:pn(process.env.HOME||Zh()),tmpdir:Xh(),paths:Jh})}function Qh(G,H={}){let j=new Map,J=new Map,oe={...G,gitMetadata:(ie)=>gd(j,ie,()=>pd(ie,oe)),worktreeFacts:(ie)=>gd(J,ie,()=>ud(ie)),...H};return oe}function gd(G,H,j){let J=G.get(H);if(J!==void 0)return J;let oe=j();return G.set(H,oe),oe}import{accessSync as Ey,constants as Id,statSync as Ry}from"node:fs";import{isAbsolute as Pa,relative as _y,resolve as kd,sep as xy}from"node:path";import{types as ey}from"node:util";var ty=new Set(["applypatch","patch"]),ny=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),ry=new Set(["grep","grepsearch","rg"]),oy=new Set(["find","findbyname","glob"]),iy=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),sy=new Set(["command","diff","input","patch","patchtext"]),hd=new TextEncoder,ay=new TextDecoder,ly=/\s/,cy=64;class m extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var zo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ie(G){return G.replace(/[-_\s]/g,"").toLowerCase()}function Ni(G){return iy.has(Ie(G))}function x(G){let H=Ie(G);if(ty.has(H))return"patch";if(ry.has(H))return"grep";if(oy.has(H))return"glob";if(ny.has(H))return"path";return"unknown"}function se(G){if(!G||typeof G!=="object")return;Ad(G);let H=Object.getOwnPropertyDescriptor(G,"command");if(!H){if("command"in G)qn();return}if(H.get||H.set)qn();let j=H.value;return typeof j==="string"&&j!==""?j:void 0}function vd(G,H){return Ed(G,H,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ed(G,H,j,J,oe){let ie=wd(G,J,oe);if(typeof G==="string")return j?[G]:[];if(!ie)return[];let fe=ie.entries.flatMap(([Re,Te])=>Ed(Te,H,ie.array?j:H.has(Rd(Re)),J,oe+1));return J.ancestors.delete(ie.object),fe}function Rd(G){return G.replace(/-/g,"_").toLowerCase()}function _d(G){return xd(G,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(uy)}function xd(G,H,j,J){let oe=wd(G,j,J);if(typeof G==="string")return H?[G]:[];if(!oe)return[];let ie=oe.entries.flatMap(([fe,Re])=>xd(Re,oe.array?H:sy.has(Rd(fe)),j,J+1));return j.ancestors.delete(oe.object),ie}function dy(G,H,j){if(H.nodes++,G!==null&&typeof G==="object"&&j>zo.maxDepth||H.nodes>zo.maxNodes)qn();if(typeof G!=="string")return;let J=Buffer.byteLength(G);if(H.stringBytes+=J,J>zo.maxStringBytes||H.stringBytes>zo.maxAggregateStringBytes)qn()}function wd(G,H,j){if(dy(G,H,j),!G||typeof G!=="object")return null;let J=Ad(G);if(H.ancestors.has(G))qn();let oe=Reflect.ownKeys(G);if(H.keys+=oe.length,H.keys>zo.maxKeys)qn();let ie=oe.flatMap((fe)=>{let Re=Object.getOwnPropertyDescriptor(G,fe);if(!Re||Re.get||Re.set)qn();return typeof fe==="string"&&Re.enumerable?[[fe,Re.value]]:[]});return H.ancestors.add(G),{object:G,array:J,entries:ie}}function Ad(G){if(ey.isProxy(G))qn();let H=Array.isArray(G),j=Object.getPrototypeOf(G);if(H&&j!==Array.prototype||!H&&j!==Object.prototype&&j!==null)qn();return H}function qn(){throw new m}function uy(G){let H=[],j=G.split(/\r?\n/),J=!1,oe=!1,ie=null,fe=null,Re=()=>{oe=!1,ie=null,fe=null};for(let Te=0;Te<j.length;Te++){let ke=j[Te]??"";if(ke==="*** Begin Patch"){J=!0,Re();continue}if(ke==="*** End Patch"){J=!1,Re();continue}if(ke.startsWith("@@")){let Le=my(ke);if(oe=!0,ie=Le?.oldLines??null,fe=Le?.newLines??null,ie===0&&fe===0)Re();continue}if(oe&&ie!==null&&fe!==null){let Le=ke.startsWith(" ")||ke.startsWith("-")?1:0,Xe=ke.startsWith(" ")||ke.startsWith("+")?1:0;if(ie=Math.max(0,ie-Le),fe=Math.max(0,fe-Xe),ie===0&&fe===0)Re();continue}if(ke.startsWith("*** ")){Re(),H.push(...xa(ke));continue}if(oe)continue;if(ke.startsWith("diff --git ")){H.push(...xa(ke));continue}if(ke.startsWith("--- ")){let Le=j[Te+1]??"";if(!Le.startsWith("+++ "))continue;H.push(...Aa(Di(ke.slice(4),!0),Di(Le.slice(4),!0))),Te++;continue}if(!J)H.push(...xa(ke))}return H}function my(G){let H=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(G);if(!H)return null;return{oldLines:Number(H[1]??1),newLines:Number(H[2]??1)}}function xa(G){let H=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(G);if(H?.[1])return bd(H[1]);let j=/^\*\*\* Move to: (.+)$/.exec(G);if(j?.[1])return bd(j[1]);if(G.startsWith("diff --git "))return fy(G.slice(11));let J=/^--- (.+)$/.exec(G);if(J?.[1])return Sd(J[1]);let oe=/^\+\+\+ (.+)$/.exec(G);if(oe?.[1])return Sd(oe[1]);let ie=/^(?:rename|copy) (?:from|to) (.+)$/.exec(G);if(ie?.[1])return by(ie[1]);return[]}function fy(G){let H=py(G);if(H.length===2&&H[0]&&H[1])return Aa(H[0],H[1]);let j=gy(G);return j?Aa(G.slice(j.oldStart,j.oldEnd),G.slice(j.newStart,j.newEnd)):[]}function py(G){let H=[],j=0;while(j<G.length&&H.length<2){while(Ar(G[j]))j++;if(j>=G.length)break;let J=G[j]==='"'||G[j]==="'"?G[j]:void 0;if(!J){let ie=j;while(j<G.length&&!Ar(G[j]))j++;H.push(G.slice(ie,j));continue}let oe=Pd(G,j,J);if(!oe)return[];H.push(oe.value),j=oe.end}while(Ar(G[j]))j++;return j===G.length?H:[]}function gy(G){let H=0;while(H<G.length&&Ar(G[H]))H++;let j=G.length;while(j>H&&Ar(G[j-1]))j--;let J=0,oe=H;while(oe<j){if(!Ar(G[oe])){oe++;continue}let ie=oe;while(oe<j&&Ar(G[oe]))oe++;if(ie===H||oe===j)continue;if(J++,J>cy)qn();if(hy(G,H,ie,oe,j))return{oldStart:H,oldEnd:ie,newStart:oe,newEnd:j}}return null}function hy(G,H,j,J,oe){if(wa(G,H,j,J,oe))return!0;let ie=yd(G,"/",H,j),fe=yd(G,"/",J,oe);if(ie<=H||fe<=J)return!1;if(wa(G,H,ie,J,fe))return!1;return wa(G,ie+1,j,fe+1,oe)}function wa(G,H,j,J,oe){if(j-H!==oe-J)return!1;for(let ie=0;ie<j-H;ie++)if(G[H+ie]!==G[J+ie])return!1;return!0}function yd(G,H,j,J){for(let oe=j;oe<J;oe++)if(G[oe]===H)return oe;return-1}function Ar(G){return G!==void 0&&ly.test(G)}function Pd(G,H,j){let J=[],oe=H+1;while(oe<G.length){let ie=String.fromCodePoint(G.codePointAt(oe)??0);if(ie===j)return{value:ay.decode(Uint8Array.from(J)),end:oe+1};if(ie!=="\\"||j==="'"){J.push(...hd.encode(ie)),oe+=ie.length;continue}let fe=G.slice(oe+1),Re=/^[0-7]{1,3}/.exec(fe)?.[0];if(Re){J.push(Number.parseInt(Re,8)),oe+=Re.length+1;continue}J.push(...hd.encode(yy(fe[0]??""))),oe+=2}return null}function yy(G){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[G]??G}function Cy(G){return $o(vy(G))}function Aa(G,H){if(G==="/dev/null")return Cd(H);if(H==="/dev/null")return Cd(G);if(G.startsWith("a/")&&H.startsWith("b/"))return[G.slice(2),H.slice(2)].flatMap($o);let j=Sy(G,H)??(G===H?Td(G):null);return[G,H,...j?[j]:[]].flatMap($o)}function Cd(G){let H=Td(G);return[G,...H?[H]:[]].flatMap($o)}function Td(G){let H=G.indexOf("/");return H>0&&H<G.length-1?G.slice(H+1):null}function Sy(G,H){let j=G.indexOf("/"),J=H.indexOf("/");if(j<1||J<1)return null;if(G.slice(0,j)===H.slice(0,J))return null;let oe=G.slice(j+1);return oe===H.slice(J+1)?oe:null}function Sd(G){return Cy(Di(G,!0))}function by(G){return $o(Di(G,!1))}function Di(G,H){let j=G.trim(),J=j[0]==='"'||j[0]==="'"?j[0]:void 0;if(J){let oe=Pd(j,0,J);if(oe&&(H||j.slice(oe.end).trim()===""))return oe.value}return H?j.split("\t",1)[0]?.trim()??"":j}function vy(G){return G.startsWith("a/")||G.startsWith("b/")?G.slice(2):G}function $o(G){return G===""||G==="/dev/null"?[]:[G]}function bd(G){let H=G.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return H===""||H==="/dev/null"?[]:[H]}function ge(G){try{if(!Ry(G).isDirectory())return!1;return Ey(G,Id.R_OK|Id.X_OK),!0}catch{return!1}}function St(G,H,j){if(tr(G))return;let J=H.flatMap((ie)=>Li(ie,j));if(!J[0])return;let oe=Li(Pa(G)?G:kd(J[0],G),j)[0];if(!oe)return;return J.some((ie)=>wy(oe,ie))?oe:void 0}function Od(G,H,j){if(tr(G))return;return Li(Pa(G)?G:kd(H,G),j)[0]}function it(G,H){return G.flatMap((j)=>Li(j,H))[0]}function Li(G,H){let j=H.realpath(G);if(j===null)return[];return H.isDirectory(j)?[j]:[]}function wy(G,H){let j=_y(H,G);return j===""||j!==".."&&!j.startsWith(`..${xy}`)&&!Pa(j)}var Ay=8388608;async function st(G){let H=[],j=0;for await(let J of G){let oe=typeof J==="string"?Buffer.from(J,"utf-8"):Buffer.from(J.buffer,J.byteOffset,J.byteLength);if(j+=oe.byteLength,j>Ay)throw Py(G),Error("hook input byte limit exceeded");H.push(oe)}return Buffer.concat(H,j).toString("utf-8")}function Py(G){let H=G.destroy??G.cancel;if(!H)return;try{Promise.resolve(H.call(G)).catch(()=>{})}catch{}}function l(G,H,j,J,oe){if(j.kind!=="command")return{toolName:G,input:H,route:j,context:J};return{toolName:G,input:H,route:j,context:J,command:oe}}var ro=["fail_closed","paranoid_rm","paranoid_interpreters"],Wi={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var n={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},Fi=["standard","strict","paranoid"];function Md(G,H){if(!H)return G;return Fi.indexOf(H)>Fi.indexOf(G)?H:G}function Dd(G){let H=me(n.level,G);return Fi.find((j)=>j===H)}function Nd(G,H){return Md(G,Dd(H))}function Ty(G){let H=me(n.level,G);if(!H)return;let j=Dd(G);if(j)return j;console.error(`CC Safety Net: ignored invalid ${n.level.name}=${JSON.stringify(H.slice(0,40))}. Use ${Fi.join(", ")}.`);return}function ot(G){if(G===void 0||G==="all")return"all";if(G==="blocked")return"blocked";return"invalid"}function Pe(G){return ot(me(n.auditScope,G))==="all"}function Ta(G){if(G.failClosed&&G.paranoidRm&&G.paranoidInterpreters)return"paranoid";if(G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"strict";if(!G.failClosed&&!G.paranoidRm&&!G.paranoidInterpreters)return"standard";return"custom"}function P(G={},H){let j=G.safety?.level??"standard",J=Ty(H),oe=Md(j,J),ie=Wi[oe],fe={failClosed:ie.fail_closed,paranoidRm:ie.paranoid_rm,paranoidInterpreters:ie.paranoid_interpreters},Re={failClosed:oe===j?"preset":"environment",paranoidRm:oe===j?"preset":"environment",paranoidInterpreters:oe===j?"preset":"environment"},Te={failClosed:[`policy safety.level=${j}`],paranoidRm:[`policy safety.level=${j}`],paranoidInterpreters:[`policy safety.level=${j}`]};if(oe!==j)Te.failClosed.push(`env ${n.level.name}=${J}`),Te.paranoidRm.push(`env ${n.level.name}=${J}`),Te.paranoidInterpreters.push(`env ${n.level.name}=${J}`);if(G.safety?.overrides?.failClosed!==void 0)fe.failClosed=G.safety.overrides.failClosed,Re.failClosed="capability_override",Te.failClosed.push("policy safety.overrides.fail_closed");if(G.safety?.overrides?.paranoidRm!==void 0)fe.paranoidRm=G.safety.overrides.paranoidRm,Re.paranoidRm="capability_override",Te.paranoidRm.push("policy safety.overrides.paranoid_rm");if(G.safety?.overrides?.paranoidInterpreters!==void 0)fe.paranoidInterpreters=G.safety.overrides.paranoidInterpreters,Re.paranoidInterpreters="capability_override",Te.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(S(n.strict,H))fe.failClosed=!0,Re.failClosed="environment",Te.failClosed.push(`env ${n.strict.name}`);if(S(n.paranoid,H))fe.paranoidRm=!0,fe.paranoidInterpreters=!0,Re.paranoidRm="environment",Re.paranoidInterpreters="environment",Te.paranoidRm.push(`env ${n.paranoid.name}`),Te.paranoidInterpreters.push(`env ${n.paranoid.name}`);if(S(n.paranoidRm,H))fe.paranoidRm=!0,Re.paranoidRm="environment",Te.paranoidRm.push(`env ${n.paranoidRm.name}`);if(S(n.paranoidInterpreters,H))fe.paranoidInterpreters=!0,Re.paranoidInterpreters="environment",Te.paranoidInterpreters.push(`env ${n.paranoidInterpreters.name}`);let ke=!!G.worktreeMode||S(n.worktree,H);return{strict:fe.failClosed,paranoidRm:fe.paranoidRm,paranoidInterpreters:fe.paranoidInterpreters,worktreeMode:ke,effectiveLevel:Ta(fe),capabilities:{fail_closed:{enabled:fe.failClosed,source:Re.failClosed,sources:Te.failClosed},paranoid_rm:{enabled:fe.paranoidRm,source:Re.paranoidRm,sources:Te.paranoidRm},paranoid_interpreters:{enabled:fe.paranoidInterpreters,source:Re.paranoidInterpreters,sources:Te.paranoidInterpreters}}}}function S(G,H){let j=typeof G==="string"?Bo(G,H):me(G,H);return j==="1"||j?.toLowerCase()==="true"}function Bo(G,H){return H.get(G)}function me(G,H){let j=Bo(G.name,H);if(j!==void 0)return j;if(G.legacyName)return Bo(G.legacyName,H);return}function vt(G,H){return Bo(G.name,H)!==void 0||!!G.legacyName&&Bo(G.legacyName,H)!==void 0}import{dirname as Or}from"node:path";import{closeSync as Iy,constants as Uo,fstatSync as Ia,fsyncSync as ky,lstatSync as Mn,mkdirSync as Ld,openSync as Wd,readdirSync as Oa,readFileSync as Oy,realpathSync as oo,renameSync as My,rmdirSync as Fd,statSync as ka,unlinkSync as Ma,writeFileSync as Dy}from"node:fs";import{isAbsolute as Gd,join as Pr,normalize as Ny,parse as Gi,relative as Da,resolve as Na,sep as zi}from"node:path";function Fe(){let G=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${G()}${G()}`}var Ly=Symbol("PolicyFilesystemScope"),Wy=Symbol("PolicyFilesystemTarget"),zd=Uo.O_NOFOLLOW??0;class o extends Error{name="PolicyFilesystemError";constructor(G){super(`Unable to access ${G} filesystem safely.`)}}function w(G,H){return{[Ly]:!0,root:Na(G),label:H}}function Ho(G,H){let j=Ny(H);if(H===""||Gd(H)||j===".."||j.startsWith(`..${zi}`))throw new o(G.label);return{[Wy]:!0,scope:G,relativePath:j,path:Pr(G.root,j)}}function i(G,H){return Ho(G,Da(G.root,Na(H)))}function ae(G,H="rules policy"){let j=Na(G),J=Gi(j).dir;return Ho(w(J,H),Da(J,j))}function r(G){return nr(G.scope.label,()=>{if(!cn(G))return null;let H=Wd(G.path,Uo.O_RDONLY|zd);return Bd(H,()=>{let j=Ia(H);if(!j.isFile())throw new o(G.scope.label);let J=Oy(H,"utf-8"),oe=Mn(G.path);if(!oe.isFile()||oe.isSymbolicLink()||j.dev!==oe.dev||j.ino!==oe.ino)throw new o(G.scope.label);return cn(G),J})})}function g(G,H,j=384,J){let oe=`${G.path}.${Fe()}.tmp`;nr(G.scope.label,()=>{Gy(G),cn(G);let ie=Wd(oe,Uo.O_CREAT|Uo.O_EXCL|Uo.O_WRONLY|zd,j),fe=Bd(ie,()=>{let Re=Ia(ie);if(!Re.isFile())throw new o(G.scope.label);Dy(ie,H,"utf-8"),ky(ie);let Te=Ia(ie);if(!Te.isFile()||Te.dev!==Re.dev||Te.ino!==Re.ino)throw new o(G.scope.label);return Te});cn(G),$y(G,oe,fe.dev,fe.ino),My(oe,G.path),J?.(G.path),cn(G)},()=>By(oe))}function $d(G,H){if(G.path===H.path)return!0;return nr(G.scope.label,()=>{if(!cn(G)||!cn(H))return!1;let j=(J)=>Pr(oo(Gi(J).dir),Gi(J).base);return j(G.path)===j(H.path)})}function he(G){let H=nr(G.scope.label,()=>{if(!cn(G,"directory"))return null;let j=Oa(G.path);return cn(G,"directory"),j});if(!H)return null;return nr(G.scope.label,()=>{let j=H.map((J)=>{let oe=Ho(G.scope,Pr(G.relativePath,J)),ie=Mn(oe.path);if(ie.isSymbolicLink()||!ie.isFile()&&!ie.isDirectory())throw new o(G.scope.label);return $i(La(G.scope),oo(oe.path),G.scope.label),{name:J,kind:ie.isDirectory()?"directory":"file"}});return cn(G,"directory"),j})}function W(G){nr(G.scope.label,()=>{if(!cn(G))return;Ma(G.path),cn(G)})}function wt(G){nr(G.scope.label,()=>{if(!Fy(G))return;Hd(G),cn(G,"directory")})}function Ct(G){nr(G.scope.label,()=>{if(!cn(G,"directory"))return;Fd(G.path),cn(G,"directory")})}function Fy(G){return nr(G.scope.label,()=>{if(!cn(G,"directory"))return!1;return Ud(G),!0})}function nr(G,H,j){try{return H()}catch(J){if(j?.(),J instanceof o)throw J;throw new o(G)}}function Bd(G,H){try{return H()}finally{Iy(G)}}function cn(G,H="file"){let j=jd(G.scope);if(!j)return!1;let J=G.relativePath.split(zi);for(let oe of J.keys()){let ie=Pr(G.scope.root,...J.slice(0,oe+1)),fe=Mn(ie,{throwIfNoEntry:!1});if(!fe)return!1;if(fe.isSymbolicLink())throw new o(G.scope.label);if(oe<J.length-1&&!fe.isDirectory())throw new o(G.scope.label);if(oe===J.length-1&&(H==="file"?!fe.isFile():!fe.isDirectory()))throw new o(G.scope.label);$i(j,oo(ie),G.scope.label)}return!0}function Ud(G){for(let H of Oa(G.path)){let j=Ho(G.scope,Pr(G.relativePath,H)),J=Mn(j.path);if(J.isSymbolicLink()||!J.isDirectory()&&!J.isFile())throw new o(G.scope.label);if(J.isDirectory())Ud(j)}cn(G,"directory")}function Hd(G){for(let H of Oa(G.path)){let j=Ho(G.scope,Pr(G.relativePath,H)),J=Mn(j.path);if(J.isSymbolicLink())throw new o(G.scope.label);if(J.isDirectory()){Hd(j);continue}if(!J.isFile())throw new o(G.scope.label);Ma(j.path)}Fd(G.path)}function Gy(G){zy(G.scope);let H=La(G.scope),j=G.relativePath.split(zi).slice(0,-1);for(let J of j.keys()){let oe=Pr(G.scope.root,...j.slice(0,J+1));if(!Mn(oe,{throwIfNoEntry:!1}))Ld(oe,{mode:448});let ie=Mn(oe);if(!ie.isDirectory()||ie.isSymbolicLink())throw new o(G.scope.label);$i(H,oo(oe),G.scope.label)}}function zy(G){if(Mn(G.root,{throwIfNoEntry:!1})){if(!ka(G.root).isDirectory())throw new o(G.label);return}let H=[],j=G.root;while(!Mn(j,{throwIfNoEntry:!1})){H.unshift(j);let J=Gi(j).dir;if(J===j)throw new o(G.label);j=J}if(!ka(j).isDirectory())throw new o(G.label);for(let J of H){Ld(J,{mode:448});let oe=Mn(J);if(!oe.isDirectory()||oe.isSymbolicLink())throw new o(G.label)}}function jd(G){if(!Mn(G.root,{throwIfNoEntry:!1}))return null;if(!ka(G.root).isDirectory())throw new o(G.label);return oo(G.root)}function La(G){let H=jd(G);if(!H)throw new o(G.label);return H}function $y(G,H,j,J){let oe=Mn(H);if(!oe.isFile()||oe.isSymbolicLink()||oe.dev!==j||oe.ino!==J)throw new o(G.scope.label);$i(La(G.scope),oo(H),G.scope.label)}function $i(G,H,j){let J=Da(G,H);if(J===".."||J.startsWith(`..${zi}`)||Gd(J))throw new o(j)}function By(G){try{Ma(G)}catch{}}import{dirname as Tr,isAbsolute as Ky,join as Ir,relative as qy,resolve as mr,sep as Yy}from"node:path";var p=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ye="rulebook.json",be=".cc-safety-net/rules";var Vd=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,Uy=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Kd=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Hy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),jy="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Et=new RegExp(`^${Hy}/(${p.source.slice(1,-1)})/${jy}$`);function Vy(G){return`.cc-safety-net/rules/${G}/rulebook.json`}function qd(G){if(C(G))try{return M(G),null}catch(H){return H instanceof Error?H.message:String(H)}return p.test(G)?null:`Local rulebook sources must be bare names matching ${p}: ${G}`}function M(G){if(G.startsWith("github:"))throw Error(`Invalid rulebook source: ${G}`);let H=G.match(Vd);if(!H?.[1]||!H[2]||!H[3])throw Error(`Invalid GitHub rulebook source: ${G}`);let j=H[3].lastIndexOf("/");if(j<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);let J=H[3].slice(0,j),oe=H[3].slice(j+1);if(!J||!Kd.test(J))throw Error(`GitHub rulebook refs must use valid path segments: ${G}`);if(!oe||!p.test(oe))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${G}`);return{owner:H[1],repo:H[2],ref:J,path:Vy(oe),name:oe}}function X(G){return Uy.test(G)}function ce(G){return Kd.test(G)}function C(G){return Vd.test(G)}function kt(G){if(!p.test(G))throw Error(`Local rulebook sources must be bare names matching ${p}: ${G}`)}var Yd="rule.json",Bi="policy.json",Zd=".cc-safety-net",Zy="rules",Xy="CC_SAFETY_NET_HOME",Xd="`cc-safety-net rule update`";function Jy(G){return mr(G,be)}function I(G){return Ir(Jy(G),Yd)}function h(G){return Ir(mr(G),Zd,Bi)}function Ae(G,H={}){return H.userConfigDir??(H.userConfigPath?Tr(H.userConfigPath):Ir(Qy(G),Zy))}function Qy(G){let H=G.env.get(Xy);return H?mr(pn(H)):Ir(G.home,Zd)}function B(G,H={}){return Ir(Ae(G,H),Yd)}function u(G,H={}){return Ir(Tr(Ae(G,H)),Bi)}function O(G,H){let j=On();return Bt(h(H.cwd),G.paths,j)===Bt(mr(u(G,H)),G.paths,j)}function Q(G,H){let j=H.userConfigPath??B(G,H),J=H.projectConfigPath??I(H.cwd),oe=at(G,H),ie=ct(J,H.cwd);return{userConfigPath:j,projectConfigPath:J,userScope:oe,projectScope:ie,userConfigTarget:i(oe,j),projectConfigTarget:i(ie,J)}}function at(G,H){let j=H.userConfigPath?Tr(Tr(mr(H.userConfigPath))):Tr(mr(H.userConfigDir??Ae(G,H)));return w(j,"user policy")}function ct(G,H){let j=mr(H),J=mr(G),oe=qy(j,J);if(oe!==".."&&!oe.startsWith(`..${Yy}`)&&!Ky(oe))return w(j,"project policy");return w(Tr(Tr(J)),"project policy")}function F(G,H){return Ir(G,H,ye)}var xn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),E=/^[a-zA-Z][a-zA-Z0-9_-]*$/,D=256,Qt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Jd=new Set(["python","python3","python2","node","ruby","perl"]),Ui=/^python(?:[23](?:\.\d+)*)?$/,Dn=new Set(["awk","gawk","nawk","mawk"]),Hi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Qd="Rulebook exceeds CC Safety Net's safe validation limits.",eu="Additional rulebook validation errors were omitted.",Gn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function tu(G){if(Wa(G.allowed_commands,Gn.maxAllowedCommands)||Wa(G.rules,Gn.maxRules)||Wa(G.tests,Gn.maxTests))return!1;let{maxAggregateStringCodeUnits:H,maxTotalBlockArgs:j}=Gn,J=(oe,ie=!1)=>{if(typeof oe!=="string")return!0;if(oe.length>Gn.maxStringCodeUnits||ie&&oe.length>Gn.maxFixtureCommandCodeUnits||oe.length>H)return!1;return H-=oe.length,!0};if(!J(G.name)||!J(G.version)||!J(G.description)||!J(G.author)||!J(G.migrated_from))return!1;if(Array.isArray(G.allowed_commands)){for(let oe of G.allowed_commands)if(!J(oe))return!1}if(Array.isArray(G.rules))for(let oe of G.rules){if(!oe||typeof oe!=="object")continue;let ie=oe;if(!J(ie.name)||!J(ie.command)||!J(ie.subcommand)||!J(ie.reason)||!J(ie.intent))return!1;let fe=ie.match&&typeof ie.match==="object"?ie.match:{};for(let Re of[ie.block_args,fe.command_path,fe.any_args,fe.exclude_args]){if(!Array.isArray(Re))continue;if(Re.length>Gn.maxBlockArgsPerRule||Re.length>j)return!1;j-=Re.length;for(let Te of Re)if(!J(Te))return!1}}if(Array.isArray(G.tests))for(let oe of G.tests){if(!oe||typeof oe!=="object")continue;let ie=oe;if(!J(ie.command,!0)||!J(ie.expect)||!J(ie.rule))return!1}return!0}function Wa(G,H){return Array.isArray(G)&&G.length>H}var Fa=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var xe=64,ve="Rule config exceeds CC Safety Net's safe source limit.";function Gt(G){return Wt(G).toLowerCase()}function Wt(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}function Cn(G,H){let j=new Set,J=!1;for(let oe of G){if(oe==="--"){J=!0;continue}if(J)continue;if(oe.startsWith("-")&&!oe.startsWith("--")&&oe.length>1)for(let ie=1;ie<oe.length;ie++){let fe=oe[ie];if(!fe||!/[a-zA-Z]/.test(fe))break;let Re=`-${fe}`;if(j.add(Re),H?.shortOptsWithValue?.has(Re))break}}return j}var eC={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ga=new Set(["--init-file","--rcfile"]);function za(G,H,j,J){let oe=!1,ie=0,fe=!1,Re=!1,Te=!1;for(let ke=1;ke<H.length;ke++){let Le=H[ke];if(Le===void 0)break;if(G==="ksh"&&Le==="o"&&ke+1<H.length){if(J==="argv"){let Xe=H.slice(ke+1);if(H[0]==="-"&&(Xe==="c"||Xe[0]==="-"&&Xe.endsWith("c")))fe=!0}break}if(G==="ksh"&&Le==="o"&&ke+1===H.length&&(j?.startsWith("-")||j?.startsWith("+")))break;if(G==="zsh"&&Le==="o"&&ke+1<H.length)break;if(J==="startup"&&Le==="i")oe=H[0]==="-";if(J==="argv"&&H[0]==="-"&&Le==="c")fe=!0;if(J==="argv"&&Le==="n")Te=H[0]==="-";if(J==="argv"&&Le==="s")Re=H[0]==="-";if(!eC[G]?.includes(Le))continue;if(ke+1===H.length)ie++;break}return{interactive:oe,followingValues:ie,commandSelected:fe,stdinMode:Re,syntaxCheck:Te}}function wn(G){let H=Wt(G[0]??"").toLowerCase(),j=!1,J=!1,oe=!1;for(let ie=1;ie<G.length;ie++){let fe=G[ie];if(fe===void 0)break;if(fe==="--"){let Te=j&&G[ie+1]!==void 0?ie+1:null;return{command:Te===null?null:G[Te]??null,commandIndex:Te,scriptIndex:!j&&!J&&G[ie+1]!==void 0?ie+1:null,readsStdinAsCommands:!j&&(J||G[ie+1]===void 0),syntaxCheck:oe}}if(fe==="-"||fe[0]!=="-"&&fe[0]!=="+")return{command:j?fe:null,commandIndex:j?ie:null,scriptIndex:!j&&!J&&fe!=="-"?ie:null,readsStdinAsCommands:!j&&(J||fe==="-"),syntaxCheck:oe};if(fe.startsWith("--")){let Te=fe.split("=",1)[0]??fe;if(H==="bash"&&Ga.has(Te)&&!fe.includes("="))ie++;continue}let Re=za(H,fe,G[ie+1],"argv");if(Re.commandSelected)j=!0;if(Re.syntaxCheck)oe=!0;if(Re.stdinMode)J=!0;ie+=Re.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!j,syntaxCheck:oe}}function jo(G,H){if(H.escaped)return H.escaped=!1,!0;if(G==="\\"&&!H.inSingle)return H.escaped=!0,!0;if(G==="'"&&!H.inDouble)return H.inSingle=!H.inSingle,!0;if(G==='"'&&!H.inSingle)return H.inDouble=!H.inDouble,!0;return!1}function ji(G){let H={inSingle:!1,inDouble:!1,escaped:!1};for(let j of tC(G))jo(j,H);return H.inSingle||H.inDouble}function tC(G){let H="",j={inSingle:!1,inDouble:!1,escaped:!1},J=!1,oe=!0;for(let ie=0;ie<G.length;ie++){let fe=G[ie];if(!fe)break;if(J){if(fe===`
-`||fe==="\r")H+=fe,J=!1,j.escaped=!1;continue}if(fe==="#"&&!j.inSingle&&!j.inDouble&&oe){J=!0;continue}if(H+=fe,!j.inSingle&&!j.inDouble&&!j.escaped)oe=/[\s;&|()<>]/.test(fe);jo(fe,j)}return H}var $a=new Set(["rm","find","xargs","parallel"]),nC=new Set(["git","busybox",...$a,...Qt,...Jd,...Dn]),rC=new Set(["python","node","ruby","perl"]);function $e(G){let H=Gt(G);return nC.has(H)||zn(H)}function zn(G){return rC.has(oC(G))}function oC(G){let H=Wt(G).toLowerCase();return Ui.test(H)?"python":H}var le={version:1,rules:[],overrides:{},transparent_wrappers:[]};function d(G){try{let H=r(iC(G));if(H===null)return{config:null,errors:[]};if(!H.trim())return{config:null,errors:["Config file is empty"]};let j=JSON.parse(H),J=lt(j);if(J.errors.length>0)return{config:null,errors:J.errors};return{config:{version:1,rules:j.rules??[],overrides:j.overrides??{},transparent_wrappers:j.transparent_wrappers??[],...j.command_tools?{command_tools:j.command_tools}:{}},errors:[]}}catch(H){if(H instanceof o)return{config:null,errors:[H.message]};let j=H instanceof Error?H.message:String(H);return{config:null,errors:[H instanceof SyntaxError?"Invalid JSON":j]}}}function iC(G){return typeof G==="string"?ae(G):G}var e=(G,H)=>({path:G,message:H,kind:"typed"}),an=(G,H)=>({path:G,message:H,kind:"custom"});function Ue(G){let H=new Set;return G.flatMap((j,J)=>{let oe=kr(j)?j.name:void 0;if(typeof oe!=="string")return[];if(H.has(oe.toLowerCase()))return[an(["rules",J,"name"],`duplicate rule name "${oe}"`)];return H.add(oe.toLowerCase()),[]})}var Oe=`must be one of ${Fa.join(", ")}`,sC=/^[^/]+\/[^/]+$/,aC=["version","rules","overrides","transparent_wrappers","command_tools"],je=/^[^\s\p{Cc}]{1,256}$/u,Se="non-empty, at most 256 characters, no whitespace or control characters";function lt(G){let H=lC(G);return{errors:ue(ut(H,aC,(j)=>j.kind==="custom"),": "," "),sources:yC(G,H)}}function lC(G){if(!kr(G))return[e([],"Config must be an object")];let H=Array.isArray(G.rules)&&G.rules.length>xe;return[...G.version===1?[]:[e(["version"],"must be 1")],...cC(G.rules,H),...mC(G.overrides),...pC(G.transparent_wrappers),...H?[]:uC(G.rules),...kr(G.overrides)?Object.keys(G.overrides).filter((j)=>!sC.test(j)).map((j)=>an(["overrides",j],"must use <rulebook-name>/<rule-name>")):[],...gC(G.transparent_wrappers),...hC(G.command_tools)]}function cC(G,H){if(G===void 0)return[];if(!Array.isArray(G))return[e(["rules"],"must be an array of rulebook source strings"),...nu(G,xe)?[e(["rules"],ve)]:[]];if(H)return[{path:["rules"],message:ve,kind:"limit"}];return G.flatMap((j,J)=>{if(typeof j!=="string")return[e(["rules",J],"must be a rulebook source string"),...dC(j,1)?[e(["rules",J],"must be a non-empty rulebook source string")]:[]];return j===""?[e(["rules",J],"must be a non-empty rulebook source string")]:[]})}function nu(G,H){let j=ru(G);return j!==void 0&&!(j<=H)}function dC(G,H){let j=ru(G);return j!==void 0&&!(j>=H)}function ru(G){if(G===null||G===void 0)return;let H=G.length;return H===void 0?void 0:Number(H)}function uC(G){if(!Array.isArray(G))return[];let H=new Set;return G.flatMap((j,J)=>{if(typeof j!=="string"||j==="")return[];if(j.trim()==="")return[an(["rules",J],"must be a non-empty rulebook source string")];let oe=qd(j);if(oe)return[an(["rules",J],oe)];if(H.has(j))return[an(["rules",J],`duplicate rulebook source "${j}"`)];return H.add(j),[]})}function mC(G){if(G===void 0)return[];if(!kr(G))return[e(["overrides"],"must be an object if provided")];return Object.keys(G).flatMap((H)=>{let j=G[H];if(j==="off")return[];if(!kr(j))return[e(["overrides",H],'must be "off" or an object')];return[...fC(j.reason,["overrides",H,"reason"]),...j.intent===void 0||De(j.intent)?[]:[e(["overrides",H,"intent"],Oe)]]})}function fC(G,H){if(typeof G!=="string")return[e(H,"required non-empty string"),...nu(G,D)?[e(H,`must be at most ${D} characters`)]:[]];if(G==="")return[e(H,"required non-empty string")];return G.length>D?[e(H,`must be at most ${D} characters`)]:[]}function pC(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["transparent_wrappers"],"must be an array of command strings")];return G.flatMap((H,j)=>{if(typeof H!=="string")return[e(["transparent_wrappers",j],"must be a command string")];return E.test(H)?[]:[e(["transparent_wrappers",j],"must match command pattern")]})}function gC(G){if(!Array.isArray(G))return[];let H=new Set;return G.flatMap((j,J)=>{if(typeof j!=="string"||!E.test(j))return[];if(H.has(j))return[an(["transparent_wrappers",J],`duplicate command "${j}"`)];if($e(j))return[an(["transparent_wrappers",J],`reserved command "${j}" cannot be a wrapper`)];return H.add(j),[]})}function hC(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let H=new Set,j=(J,oe)=>{if(H.has(J))return[an(["command_tools",oe],`duplicate tool "${J}"`)];return H.add(J),[]};return G.flatMap((J,oe)=>{if(typeof J==="string")return Ba(J)?j(J,oe):[e(["command_tools",oe],`must be a tool name: ${Se}`)];if(!kr(J))return[e(["command_tools",oe],"must be a tool name or a {name, cwd} object")];let ie=[...Ba(J.name)?[]:[e(["command_tools",oe,"name"],`must be a tool name: ${Se}`)],...J.cwd===void 0||Ba(J.cwd)?[]:[e(["command_tools",oe,"cwd"],`must be an argument name: ${Se}`)]];return ie.length>0?ie:j(J.name,oe)})}function Ba(G){return typeof G==="string"&&je.test(G)}function yC(G,H){let j=kr(G)?G.rules:void 0;if(!Array.isArray(j))return new Set;if(H.some((oe)=>oe.path.length===1&&oe.path[0]==="rules"))return new Set;let J=new Set(H.filter((oe)=>oe.path[0]==="rules"&&typeof oe.path[1]==="number").map((oe)=>oe.path[1]));return new Set(j.filter((oe,ie)=>typeof oe==="string"&&!J.has(ie)))}function ut(G,H,j){let J=G.map((fe)=>fe.path[1]),oe=[...new Set(J.filter((fe)=>typeof fe==="string"))],ie=(fe,Re)=>[fe.path.length===0?-1:H.indexOf(String(fe.path[0])),typeof Re==="number"?Re:oe.indexOf(String(Re)),j(fe)?0:1];return G.map((fe,Re)=>({issue:fe,rank:ie(fe,J[Re])})).sort((fe,Re)=>fe.rank[0]-Re.rank[0]||fe.rank[1]-Re.rank[1]||fe.rank[2]-Re.rank[2]).map((fe)=>fe.issue)}function ue(G,H,j){return[...new Set(G.map((J)=>{let oe=Ua(J.path);if(J.kind==="unknownKeys")return`${oe?`${oe}.`:""}unknown field "${J.message}"`;if(J.kind==="key"||J.kind==="limit"||J.path.length===0)return J.message;return`${oe}${J.path.length===1?j:H}${J.message}`}))]}function Ua(G){return G.map((H,j)=>{if(typeof H==="number")return`[${H}]`;return j===0?String(H):`.${String(H)}`}).join("")}function De(G){return Fa.includes(G)}function kr(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function de(G){let H=bC(G);if(H.errors.length>0)throw Error(H.errors.join("; "));return G}var CC=`required non-empty string up to ${D} characters`,ou="must be a non-empty array of unique non-empty strings",SC="required non-empty array of non-empty strings";function bC(G){if(!fr(G))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!tu(G))return{errors:[Qd],ruleNames:new Set};let H=[...G.rulebook_version===1||G.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ue(vC(G,G.rulebook_version===2),": ",": ")];return{errors:H.length>Gn.maxValidationErrors?[...H.slice(0,Gn.maxValidationErrors),eu]:H,ruleNames:new Set(Ge(G).map((j)=>j.toLowerCase()))}}function Ge(G){let H=fr(G)?G.rules:void 0;return(Array.isArray(H)?H:[]).flatMap((j)=>{let J=fr(j)?j.name:void 0;return typeof J==="string"?[J]:[]})}function vC(G,H){return[...typeof G.name==="string"&&p.test(G.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof G.version==="string"&&G.version!==""?[]:[e(["version"],"required non-empty string")],...EC(G.allowed_commands),...RC(G.rules,H),...AC(G.tests),...PC(G),...TC(G)]}function EC(G){if(!Array.isArray(G))return[e(["allowed_commands"],"required array")];let H=new Set;return[...G.flatMap((j,J)=>typeof j==="string"&&E.test(j)?[]:[e(["allowed_commands",J],"must match command pattern")]),...G.flatMap((j,J)=>{if(typeof j!=="string"||!E.test(j))return[];if(H.has(j))return[an(["allowed_commands",J],`duplicate command "${j}"`)];return H.add(j),[]})]}function RC(G,H){if(!Array.isArray(G))return[e(["rules"],"required array")];return[...G.flatMap((j,J)=>{if(!fr(j))return[e(["rules",J],"must be an object")];return H?xC(j,["rules",J]):_C(j,["rules",J])}),...Ue(G)]}function _C(G,H){return[...iu(G.name,H),...su(G.command,H),...G.subcommand===void 0||typeof G.subcommand==="string"&&E.test(G.subcommand)?[]:[e([...H,"subcommand"],"must match command pattern")],...Vi(G.block_args,[...H,"block_args"],"required non-empty array",!1),...au(G.reason,H),...lu(G.intent,H)]}function xC(G,H){return[...iu(G.name,H),...su(G.command,H),...au(G.reason,H),...lu(G.intent,H),...wC(G.match,[...H,"match"]),...G.subcommand===void 0?[]:[e([...H,"subcommand"],"not supported in rulebook_version 2")],...G.block_args===void 0?[]:[e([...H,"block_args"],"not supported in rulebook_version 2")]]}function iu(G,H){if(typeof G!=="string")return[e([...H,"name"],"required string")];return p.test(G)?[]:[e([...H,"name"],"must match rule name pattern")]}function su(G,H){return typeof G==="string"&&E.test(G)?[]:[e([...H,"command"],"required string matching command pattern")]}function au(G,H){return typeof G==="string"&&G!==""&&G.length<=D?[]:[e([...H,"reason"],CC)]}function lu(G,H){return G===void 0||De(G)?[]:[e([...H,"intent"],Oe)]}function wC(G,H){if(!fr(G))return[e(H,"required object")];return[...Vi(G.command_path,[...H,"command_path"],SC,!1),...G.any_args===void 0?[]:Vi(G.any_args,[...H,"any_args"],ou,!0),...G.exclude_args===void 0?[]:Vi(G.exclude_args,[...H,"exclude_args"],ou,!0)]}function Vi(G,H,j,J){if(!Array.isArray(G))return[e(H,j)];let oe=G.flatMap((ie,fe)=>{if(typeof ie!=="string")return[e([...H,fe],"must be a non-empty string")];return ie===""?[an([...H,fe],"must be a non-empty string")]:[]});if(G.some((ie)=>typeof ie!=="string"))return oe;return[...oe,...G.length===0?[an(H,j)]:[],...J&&new Set(G).size!==G.length?[an(H,"must not contain duplicate values")]:[]]}function AC(G){if(G===void 0)return[];if(!Array.isArray(G))return[e(["tests"],"must be an array if provided")];return G.flatMap((H,j)=>{if(!fr(H))return[e(["tests",j],"must be an object")];return[...typeof H.command==="string"&&H.command.trim()!==""?[]:[e(["tests",j,"command"],"required non-empty string")],...H.expect==="blocked"||H.expect==="allowed"?[]:[e(["tests",j,"expect"],'must be "blocked" or "allowed"')],...H.rule===void 0||typeof H.rule==="string"?[]:[e(["tests",j,"rule"],"must be a string if provided")],...H.expect==="blocked"&&typeof H.rule!=="string"?[an(["tests",j,"rule"],"required string for blocked fixtures")]:[]]})}function PC(G){if(!Array.isArray(G.tests))return[];let H=new Set(Ge(G));return[...new Set(G.tests.flatMap((j)=>fr(j)&&j.expect==="blocked"&&typeof j.rule==="string"?[j.rule]:[]))].filter((j)=>!H.has(j)).map((j)=>an(["tests"],`blocked fixture references unknown rule "${j}"`))}function TC(G){if(!Array.isArray(G.allowed_commands)||!Array.isArray(G.rules))return[];let H=new Set(G.allowed_commands.filter((j)=>typeof j==="string"));return G.rules.flatMap((j,J)=>{let oe=fr(j)?j.command:void 0;if(typeof oe!=="string"||H.has(oe))return[];return[an(["rules",J,"command"],`"${oe}" must be listed in allowed_commands`)]})}function fr(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function ee(G,H){let j=Q(G,H),J;try{J=$d(j.userConfigTarget,j.projectConfigTarget)}catch(Ze){if(Ze instanceof o)return GC(j,Ze.message);throw Ze}let oe=d(j.userConfigTarget),ie=J?{config:null,errors:[]}:d(j.projectConfigTarget),fe=uu(j.userConfigPath,oe.errors),Re=uu(j.projectConfigPath,ie.errors),Te=new Set,ke=oe.config?Ha(oe.config,Or(j.userConfigPath),"user",j.userScope,Te):mu(),Le=ie.config?Ha(ie.config,Or(j.projectConfigPath),"project",j.projectScope,Te):mu(),Xe=oe.config?.overrides??{},Ye=ie.config?.overrides??{};return{rules:[...du(ke.rules,Xe),...du(Le.rules,Ye)],transparent_wrappers:LC(oe.config,ie.config),command_tools:WC(oe.config,ie.config),rulebooks:[...ke.rulebooks,...Le.rulebooks],errors:[...fe,...Re,...ke.errors,...Le.errors],warnings:[...ke.warnings,...Le.warnings,...ke.canValidateOverrides?ja(Xe,ke.knownRuleIds,j.userConfigPath):[],...ke.canValidateOverrides?FC(Ye,ke.knownRuleIds,j.projectConfigPath):[],...Le.canValidateOverrides?ja(Ye,Le.knownRuleIds,j.projectConfigPath):[]],userConfig:oe.config??void 0,projectConfig:ie.config??void 0,...j}}function z(G,H){let j=IC(G,H);if(!j)return[];return[...j.scope.errors,...j.scope.warnings,...kC(j.config,j.scope,G)]}function IC(G,H){let j=H??w(Or(Or(G)),"rules policy"),J=d(i(j,G)).config;if(!J)return null;return{config:J,scope:Ha(J,Or(G),"project",j)}}function kC(G,H,j){return H.canValidateOverrides?ja(G.overrides??{},H.knownRuleIds,j):[]}function Ha(G,H,j,J=w(Or(Or(H)),j==="user"?"user policy":"project policy"),oe=new Set){let ie=[],fe=[],Re=G.rules.flatMap((ke)=>{let Le=MC(ke,H,J);if(Le.errors.length>0||!Le.rulebook)return ie.push(...Le.errors),[];let Xe=Le.rulebook;if(oe.has(Xe.name))return fe.push(`duplicate active rulebook name "${Xe.name}" for ${ke}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return oe.add(Xe.name),[{rules:OC(Xe),rulebook:{source:j,spec:ke,name:Xe.name,version:Xe.version,rules:Xe.rules.map((Ye)=>`${Xe.name}/${Ye.name}`)}}]}),Te=Re.flatMap((ke)=>ke.rules);return{rules:Te,rulebooks:Re.map((ke)=>ke.rulebook),knownRuleIds:new Set(Te.map((ke)=>ke.name)),errors:ie,warnings:fe,canValidateOverrides:ie.length===0}}function OC(G){if(G.rulebook_version===2)return G.rules.map((H)=>({name:`${G.name}/${H.name}`,command:H.command,block_args:[],match:H.match,reason:H.reason,intent:H.intent}));return G.rules.map((H)=>({...H,name:`${G.name}/${H.name}`,match:void 0}))}function MC(G,H,j){let J=He(G),oe=F(H,J),ie=NC(oe,j);if("error"in ie)return{rulebook:null,errors:[ie.error]};if(ie.content===null)return{rulebook:null,errors:[`missing rulebook file ${oe} for ${G}; ${DC(G)}`]};let fe=we(ie.content);if("problem"in fe)return{rulebook:null,errors:[`invalid rulebook ${oe}: ${fe.problem}; fix that file`]};if(fe.rulebook.name!==J)return{rulebook:null,errors:[`rulebook name "${fe.rulebook.name}" in ${oe} must match source "${G}"; fix that file`]};return{rulebook:fe.rulebook,errors:[]}}function He(G){return C(G)?M(G).name:G}function DC(G){return C(G)?`run ${Xd} to vendor ${G}`:"create that file or remove that source from the rules config"}function NC(G,H){try{return{content:r(i(H,G))}}catch(j){if(j instanceof o)return{error:j.message};throw j}}function we(G){let H;try{H=JSON.parse(G)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:de(H)}}catch(j){return{problem:j instanceof Error?j.message:"invalid rulebook"}}}function LC(G,H){return[...new Set([...G?.transparent_wrappers??[],...H?.transparent_wrappers??[]])]}function WC(G,H){let j=(G?.command_tools??[]).map(cu),J=(H?.command_tools??[]).map(cu);return[...j,...J.filter((oe)=>!j.some((ie)=>ie.name===oe.name))]}function cu(G){if(typeof G==="string")return{name:G};return G.cwd===void 0?{name:G.name}:{name:G.name,cwd:G.cwd}}function du(G,H){return G.flatMap((j)=>{let J=H[j.name];if(J==="off")return[];if(J&&typeof J==="object")return[{...j,intent:J.intent??j.intent,reason:J.reason}];return[j]})}function ja(G,H,j){return Object.keys(G).filter((J)=>!H.has(J)).map((J)=>`unknown override key "${J}" in ${j}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function FC(G,H,j){return Object.keys(G).filter((J)=>H.has(J)).map((J)=>`project override cannot target user-scoped rule "${J}" in ${j}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function uu(G,H){return H.map((j)=>j.startsWith("Unable to access ")?j:`${G}: ${j}`)}function GC(G,H){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[H],warnings:[],userConfigPath:G.userConfigPath,projectConfigPath:G.projectConfigPath}}function mu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ZC,readFileSync as XC}from"node:fs";var fu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Va=new Set(fu.map((G)=>G.id)),V=fu,zC=new Map(V.map((G)=>[G.id,G.intent]));function Pt(G,H){return{id:G,reason:H,intent:zC.get(G)??"manual_only"}}var Ka=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ki={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},$C=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],BC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],qa=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...BC.flatMap((G)=>$C.map((H)=>({id:["secret.home",G.idSlug,H.slice(1)].join("."),category:"Home path",label:[G.label,H].join(""),description:["Blocks home ",G.label,H," credential backup files."].join(""),suffixParts:[...G.directoryParts,[G.basename,H].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var qi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],pu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],UC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ya=pu.map((G)=>({id:`secret.variant.${G.slug}.separator`,category:"Variant",label:`${G.label}-* / ${G.label}_*`,description:`Blocks ${G.label} variants with dash or underscore suffixes.`,prefix:G.prefix})),Za=pu.flatMap((G)=>UC.map((H)=>({id:`secret.variant.${G.slug}.${H.slice(1)}`,category:"Variant",label:`${G.label}${H}`,description:`Blocks ${G.label}${H} private credential variants.`,prefix:G.prefix,suffix:H}))),Vo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Xa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((G)=>({id:`secret.ext.${G}`,category:"Extension",label:`.${G}`,description:`Blocks files with the .${G} extension.`,extension:G})),Ja=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],dt=[...Ka,Ki,...qa,...Ya,...Za,Vo,...Xa,...Ja,...qi].map((G)=>({id:G.id,category:G.category,label:G.label,...G.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in G?{paths:G.paths}:{description:G.description}})),Yi=new Set(qi.flatMap((G)=>G.category==="Coding CLI config"?[G.id]:[])),Qa=new Set(dt.map((G)=>G.id));import{isAbsolute as el,join as HC,normalize as jC,sep as Zi}from"node:path";var Xi=process.platform==="win32",gu=/[*?]/;function tl(G){let H=G.trim(),j=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Xi?H.replaceAll("\\","/"):H);if(!j)return null;let J=j[1]??"",oe=j[2]??"";if(gu.test(J)||oe==="."||oe==="..")return null;return{root:J||"/",name:oe}}function Ko(G,H){if(G==="~")return H;if(G.startsWith("~/"))return`${H}${G.slice(1)}`;return G}function nl(G,H){if(typeof G!=="string"||G.trim()==="")return"must be a non-empty path string";let j=Ko(G.trim(),H);if(!el(j))return"must be an absolute path or start with ~/";return qo(j,H)}function rl(G,H){let j=hu(G,H);if(j===null)return"must be a non-empty path string";if(!el(j))return null;if(qo(j,H)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var VC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",KC="cannot cover the guard's own configuration";function hu(G,H){if(typeof G!=="string"||G.trim()==="")return null;let j=G.trim(),J=Xi?j.replaceAll("\\","/"):j;return Ko(J.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),H)}function ol(G,H){let j=hu(G,H);if(j===null)return"must be a non-empty path string";let J=tl(j)?.root??j;if(gu.test(J))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!el(J))return null;if(qo(J,H)!==null)return VC;return qC(J,H)?KC:null}function qC(G,H){let j=Ji(G),J=Ji(HC(H,".cc-safety-net"));return j===J||j.startsWith(`${J}${Zi}`)}function qo(G,H){let j=Ji(G),J=Ji(H);if(j===J)return"cannot be the home directory";let oe=j.endsWith(Zi)?j:`${j}${Zi}`;if(J.startsWith(oe))return"cannot contain the home directory";return null}function Ji(G){let H=jC(G);if(Xi)H=H.replace(/\//g,"\\").toLowerCase();if(H.length>(Xi?3:1)&&H.endsWith(Zi))H=H.slice(0,-1);return H}var yu=30,Qi=1,es=365;function Cu(G){if(typeof G!=="number"||!Number.isInteger(G))return 30;if(G<1)return 1;return G>365?365:G}var Su=new Set(V.filter((G)=>G.catastrophic).map((G)=>G.id));function Nt(G,H){if(!G)return null;if(Su.has(G.id))return G;if(H?.destructiveCommandProtectionEnabled===!1)return null;let j=H?.effectiveDestructiveCommandRules[G.id];return j&&!j.enabled?null:G}function rn(G,H,j){if(Su.has(H))return!0;if(G?.destructiveCommandProtectionEnabled===!1)return!1;return G?.effectiveDestructiveCommandRules[H]?.enabled??j}function q(G,H){return Object.freeze(Object.fromEntries(V.map((j)=>{let J=j.activationCapability?H[j.activationCapability]:void 0,oe=J?.enabled??!0,ie=G.destructiveCommandRuleOverrides[j.id],fe=j.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...ie?{override:ie}:{}}:G.destructiveCommandProtectionEnabled?ie?{enabled:ie==="on",inheritedEnabled:oe,changesInherited:ie==="on"!==oe,source:"rule_override",...j.activationCapability?{activationCapability:j.activationCapability}:{},override:ie}:{enabled:oe,inheritedEnabled:oe,changesInherited:!1,source:J?.source??"built_in_default",...j.activationCapability?{activationCapability:j.activationCapability}:{}}:{enabled:!1,inheritedEnabled:oe,changesInherited:!1,source:"master_disabled",...j.activationCapability?{activationCapability:j.activationCapability}:{},...ie?{override:ie}:{}};return[j.id,Object.freeze(fe)]})))}function bu(G,H){return Object.freeze({...G,effectiveDestructiveCommandRules:q(G,H)})}var vu={standard:0,strict:1,paranoid:2};function te(G,H,j=!1,J=G.safety.level){let oe=YC(G,H,J),ie=new Set(j?oe.map((Le)=>Le.field):[]),fe=(Le,Xe)=>ie.has(Le)?void 0:Xe,Re=(Le,Xe)=>Object.fromEntries(Object.entries(Xe??{}).filter(([Ye])=>!ie.has(`${Le}.${Ye}`))),Te=(Le,Xe)=>Xe?.filter((Ye)=>!ie.has(`${Le}.${Ye}`));return{policy:{version:1,safety:{level:fe("safety.level",H.safety?.level)??G.safety.level,overrides:{...G.safety.overrides,...Re("safety.overrides",H.safety?.overrides)}},workflow:{worktree_mode:fe("workflow.worktree_mode",H.workflow?.worktree_mode)??G.workflow.worktree_mode},destructive_command_protection:{enabled:fe("destructive_command_protection.enabled",H.destructive_command_protection?.enabled)??G.destructive_command_protection.enabled,overrides:{...G.destructive_command_protection.overrides,...Re("destructive_command_protection.overrides",H.destructive_command_protection?.overrides)},allow_paths:il(G.destructive_command_protection.allow_paths,Te("destructive_command_protection.allow_paths",H.destructive_command_protection?.allow_paths))},secret_protection:{enabled:fe("secret_protection.enabled",H.secret_protection?.enabled)??G.secret_protection.enabled,overrides:{...G.secret_protection.overrides,...Re("secret_protection.overrides",H.secret_protection?.overrides)},deny_paths:il(G.secret_protection.deny_paths,H.secret_protection?.deny_paths),allow_paths:il(G.secret_protection.allow_paths,Te("secret_protection.allow_paths",H.secret_protection?.allow_paths))},audit:G.audit},weakenings:oe.map((Le)=>Le.message)}}function il(G,H){return[...new Set([...G,...H??[]])]}function YC(G,H,j){let J=H.safety?.level,oe=Wi[j];return[...J&&vu[J]<vu[G.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${G.safety.level} -> ${J}`}]:[],...ro.flatMap((ie)=>H.safety?.overrides?.[ie]===!1&&(G.safety.overrides[ie]??oe[ie])?[{field:`safety.overrides.${ie}`,message:`project policy disables ${ie}`}]:[]),...H.workflow?.worktree_mode===!0&&!G.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...H.destructive_command_protection?.enabled===!1&&G.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...H.secret_protection?.enabled===!1&&G.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Eu("destructive_command_protection.overrides",H.destructive_command_protection?.overrides,(ie)=>G.destructive_command_protection.enabled&&G.destructive_command_protection.overrides[ie]!=="off"),...Eu("secret_protection.overrides",H.secret_protection?.overrides,(ie)=>G.secret_protection.enabled&&(G.secret_protection.overrides[ie]==="on"?!0:G.secret_protection.overrides[ie]!=="off"&&!Yi.has(ie))),...G.destructive_command_protection.enabled?Ru(G.destructive_command_protection.allow_paths,H.destructive_command_protection?.allow_paths).map((ie)=>({field:`destructive_command_protection.allow_paths.${ie}`,message:`project policy adds destructive allow path: ${ie}`})):[],...G.secret_protection.enabled?Ru(G.secret_protection.allow_paths,H.secret_protection?.allow_paths).map((ie)=>({field:`secret_protection.allow_paths.${ie}`,message:`project policy adds secret allow path: ${ie}`})):[]]}function Eu(G,H,j){return Object.entries(H??{}).flatMap(([J,oe])=>oe==="off"&&j(J)?[{field:`${G}.${J}`,message:`project policy disables rule ${J}`}]:[])}function Ru(G,H){return(H??[]).filter((j)=>!G.includes(j))}var al=new Set(["standard","strict","paranoid"]),ne={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:yu}};function wu(G,H){let j=rS(u(G,H),G.home),J=O(G,H)?{exists:!1,policy:A(),errors:[]}:Be(h(H.cwd),G.home),oe=pe(J.parsed,G.home),ie=S(n.projectTightenOnly,G.env),fe=j.gui??ne,Re=Object.keys(oe.policy).length>0?te(fe,oe.policy,ie,Nd(fe.safety.level,G.env)):void 0,Te=[...j.errors,...J.errors,...oe.diagnostics],ke=(j.fallback==="defaults"&&Re?"salvaged":j.fallback)??(j.gui?void 0:J.fallback)??(Te.length>0?"salvaged":void 0),Le=oe.policy.safety?.level&&Re?.policy.safety.level===oe.policy.safety.level?"project":j.levelPresent?"user":"default";return{...Re?Yo(Re.policy):j.policy,errors:Te,...ke?{fallback:ke}:{},...J.exists?{policyScopes:{levelScope:Le,weakenings:Re?.weakenings??[],weakeningsIgnored:ie}}:{}}}var JC="project policy audit settings are ignored; audit is user scope only";function pe(G,H){if(!An(G))return{policy:{},diagnostics:[]};let j=An(G.safety)?G.safety:{},J=An(G.workflow)?G.workflow:{},oe=An(G.destructive_command_protection)?G.destructive_command_protection:{},ie=An(G.secret_protection)?G.secret_protection:{},fe={...al.has(j.level)?{level:j.level}:{},...An(j.overrides)?_u({overrides:Au(j.overrides,ro,["safety","overrides"],Mr)}):{}},Re={...typeof oe.enabled==="boolean"?{enabled:oe.enabled}:{},...oe.overrides!==void 0?{overrides:ts(oe.overrides,Va,Tu,Mr)}:{},...oe.allow_paths!==void 0?{allow_paths:so(oe.allow_paths,nl,H,["destructive_command_protection","allow_paths"],Mr)}:{}},Te={...typeof ie.enabled==="boolean"?{enabled:ie.enabled}:{},...ie.overrides!==void 0?{overrides:ts(ie.overrides,Qa,Iu,Mr)}:{},...ie.deny_paths!==void 0?{deny_paths:so(ie.deny_paths,rl,H,["secret_protection","deny_paths"],Mr)}:{},...ie.allow_paths!==void 0?{allow_paths:so(ie.allow_paths,ol,H,["secret_protection","allow_paths"],Mr)}:{}};return{policy:_u({safety:fe,workflow:typeof J.worktree_mode==="boolean"?{worktree_mode:J.worktree_mode}:{},destructive_command_protection:Re,secret_protection:Te}),diagnostics:G.audit===void 0?[]:[JC]}}function Au(G,H,j,J){return Object.fromEntries(H.flatMap((oe)=>{let ie=G[oe];if(typeof ie==="boolean")return[[oe,ie]];if(ie!==void 0)J(e([...j,oe],ll));return[]}))}function _u(G){return Object.fromEntries(Object.entries(G).flatMap((H)=>Object.keys(H[1]).length>0?[H]:[]))}var Mr=()=>{return},ll="must be a boolean",cl="must be an object if provided",Pu=`must be an integer between ${Qi} and ${es}`,Tu={path:["destructive_command_protection","overrides"],label:"destructive command"},Iu={path:["secret_protection","overrides"],label:"secret protection"},pt=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ft(G,H){let j=[];return{policy:ku(G,H,(oe)=>{j.push(oe)}),issues:j}}function k(G,H){return ku(G,H,Mr)}function ku(G,H,j){if(!An(G))return j(e([],"Config must be an object")),A();if(G.version!==1)j(e(["version"],"must be 1"));let J=io(G.safety,["safety"],["level","overrides"],j),oe=io(J.overrides,["safety","overrides"],ro,j),ie=io(G.workflow,["workflow"],["worktree_mode"],j),fe=io(G.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],j),Re=io(G.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],j),Te=io(G.audit,["audit"],["retention_days"],j);return Ou(G,pt,[],j),{version:1,safety:{level:QC(J.level,j),overrides:Au(oe,ro,["safety","overrides"],j)},workflow:{worktree_mode:sl(ie.worktree_mode,["workflow","worktree_mode"],!1,j)},destructive_command_protection:{enabled:sl(fe.enabled,["destructive_command_protection","enabled"],!0,j),overrides:ts(fe.overrides,Va,Tu,j),allow_paths:so(fe.allow_paths,nl,H,["destructive_command_protection","allow_paths"],j)},secret_protection:{enabled:sl(Re.enabled,["secret_protection","enabled"],!0,j),overrides:ts(Re.overrides,Qa,Iu,j),deny_paths:so(Re.deny_paths,rl,H,["secret_protection","deny_paths"],j),allow_paths:so(Re.allow_paths,ol,H,["secret_protection","allow_paths"],j)},audit:{retention_days:eS(Te.retention_days,j)}}}function io(G,H,j,J){if(G===void 0)return{};if(!An(G))return J(e(H,cl)),{};return Ou(G,j,H,J),G}function Ou(G,H,j,J){for(let oe of Object.keys(G).filter((ie)=>!H.includes(ie)))J({path:j,message:oe,kind:"unknownKeys"})}function QC(G,H){if(G===void 0)return"standard";if(al.has(G))return G;return H(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function sl(G,H,j,J){if(typeof G==="boolean")return G;if(G!==void 0)J(e(H,ll));return j}function eS(G,H){if(!(G===void 0||typeof G==="number"&&Number.isInteger(G)&&G>=Qi&&G<=es))H(e(["audit","retention_days"],Pu));return Cu(G)}function ts(G,H,j,J){if(G===void 0)return{};if(!An(G))return J(e(j.path,cl)),{};return Object.fromEntries(Object.entries(G).flatMap(([oe,ie])=>{if(!H.has(oe))return J({path:[...j.path,oe],message:`unknown ${j.label} rule id "${oe}"`,kind:"key"}),[];if(ie==="on"||ie==="off")return[[oe,ie]];return J(e([...j.path,oe],'must be "on" or "off"')),[]}))}function so(G,H,j,J,oe){if(G===void 0)return[];if(!Array.isArray(G))return oe(e(J,"must be an array of paths")),[];return G.flatMap((ie,fe)=>{let Re=H(ie,j);if(Re===null)return[ie];return oe(typeof ie==="string"?an([...J,fe],Re):e([...J,fe],Re)),[]})}function An(G){return!!G&&typeof G==="object"&&!Array.isArray(G)}function A(){return structuredClone(ne)}function We(G,H){let j=P({safety:ze(G.safety)},H),J=q({destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides},j.capabilities),oe=Object.values(J),ie=oe.filter((fe)=>fe.source!=="catastrophic");return{selectedPreset:G.safety.level,effectiveLevel:j.effectiveLevel,capabilities:j.capabilities,rules:J,counts:{enabled:ie.filter((fe)=>fe.enabled).length,disabled:ie.filter((fe)=>!fe.enabled).length,effectiveCustomizations:oe.filter((fe)=>fe.changesInherited).length}}}function Be(G,H){if(!ZC(G))return{exists:!1,policy:A(),errors:[]};try{let j=XC(G,"utf-8");if(!j.trim())return{exists:!0,policy:A(),errors:[`${G}: Config file is empty`],fallback:"defaults"};let J=JSON.parse(j),oe=ft(J,H);if(oe.issues.length===0)return{exists:!0,parsed:J,policy:oe.policy,errors:[]};return{exists:!0,parsed:J,policy:oe.policy,errors:oe.issues.map((ie)=>`${G}: ${nS(ie)}`),fallback:An(J)?"salvaged":"defaults"}}catch(j){let J=j instanceof Error?j.message:String(j);return{exists:!0,policy:A(),errors:[`${G}: ${j instanceof SyntaxError?"Invalid JSON":J}`],fallback:"defaults"}}}var tS=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[cl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ll,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Pu,`not an integer between ${Qi} and ${es}`]]);function nS(G){let H=Ua(G.path);if(G.kind==="unknownKeys")return`${H===""?"":`${H}.`}${G.message}: unknown field`;if(G.kind==="key")return`${H}: unknown rule id`;let j=tS.get(G.message)??G.message;return H===""?j:`${H}: ${j}`}function rS(G,H){let j=Be(G,H);if(!j.exists){let J=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!An(J))return{policy:Yo(A()),errors:[]};let oe=k(J,H);return{policy:Yo(oe),gui:oe,errors:[],levelPresent:xu(J)}}if(j.parsed===void 0)return{policy:Yo(A()),errors:j.errors,...j.fallback?{fallback:j.fallback}:{}};return{policy:Yo(j.policy),gui:j.policy,errors:j.errors,...j.fallback?{fallback:j.fallback}:{},levelPresent:xu(j.parsed)}}function xu(G){let H=An(G)&&An(G.safety)?G.safety:{};return al.has(H.level)}function mt(G){let H=Object.entries(G),j=new Set(H.flatMap(([J,oe])=>oe==="on"?[J]:[]));return[...new Set([...[...Yi].filter((J)=>!j.has(J)),...H.flatMap(([J,oe])=>oe==="off"?[J]:[])])]}function Yo(G){return{safety:ze(G.safety),worktreeMode:G.workflow.worktree_mode,destructiveCommandProtectionEnabled:G.destructive_command_protection.enabled,destructiveCommandRuleOverrides:G.destructive_command_protection.overrides,destructiveCommandAllowPaths:G.destructive_command_protection.allow_paths,secretProtection:{enabled:G.secret_protection.enabled,disabledRules:mt(G.secret_protection.overrides),denyPaths:G.secret_protection.deny_paths,allowPaths:G.secret_protection.allow_paths}}}function ze(G){let H={...G.overrides.fail_closed!==void 0?{failClosed:G.overrides.fail_closed}:{},...G.overrides.paranoid_rm!==void 0?{paranoidRm:G.overrides.paranoid_rm}:{},...G.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:G.overrides.paranoid_interpreters}:{}};return{level:G.level,...Object.keys(H).length>0?{overrides:H}:{}}}function R(G,H){let j=ee(G,H),J=wu(G,H),oe={rules:j.rules,transparentWrappers:j.transparent_wrappers,commandTools:j.command_tools,safety:J.safety,worktreeMode:J.worktreeMode,destructiveCommandProtectionEnabled:J.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:J.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:J.destructiveCommandAllowPaths,secretProtection:{enabled:J.secretProtection.enabled??!0,disabledRules:J.secretProtection.disabledRules??[],denyPaths:J.secretProtection.denyPaths,allowPaths:J.secretProtection.allowPaths??[]}},ie={...j.userConfig?.overrides,...j.projectConfig?.overrides},fe=Object.freeze(Object.fromEntries(oe.rules.map((Re)=>{let Te=j.rulebooks.find((Le)=>Le.rules.includes(Re.name)),ke=ie[Re.name];return[Re.name,Object.freeze({id:Re.name,...Te?{rulebook:Object.freeze({name:Te.name,version:Te.version}),...aS(Te.spec)?{source:Te.spec}:{}}:{},...ke&&typeof ke==="object"?{override:Object.freeze({type:"reason",reason:ke.reason})}:{}})]})));return Ne(oe,oS(j,J),fe,J.policyScopes)}function Ve(G){if(G.state==="ready")return{state:G.state};return{state:G.state,reason:G.reason}}function oS(G,H){let j=sS(H);if(G.errors.length===0&&G.warnings.length===0&&!j)return;return{diagnostics:[...G.errors,...G.warnings,...H.errors],reason:lS(G.errors.length>0?iS(G.errors):void 0,G.warnings.length>0?ul(G.warnings.join("; ")):void 0,j)}}function iS(G){return`${ul(G.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function sS(G){if(G.errors.length===0)return;let H=G.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${G.errors.join("; ")}. Enforcing ${H}; the invalid values are not active. Fix the policy file manually`}function aS(G){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(G)}function Ne(G,H,j=Object.freeze({}),J){let oe=dl(structuredClone(G)),ie=J?{policyScopes:dl(structuredClone(J))}:{};if(!H)return Object.freeze({state:"ready",policy:oe,diagnostics:Object.freeze([]),ruleMetadata:j,...ie});return Object.freeze({state:"degraded",policy:oe,diagnostics:Object.freeze([...H.diagnostics]),reason:H.reason,ruleMetadata:j,...ie})}function dl(G){if(typeof G!=="object"||G===null)return G;for(let H of Object.values(G))dl(H);return Object.freeze(G)}function lS(...G){return ul(G.filter((H)=>!!H).join("; "))}function ul(G){return/[.!?]$/.test(G)?G:`${G}.`}function qe(G){let H=G.effectiveCapabilities,j=H.fail_closed.enabled,J=H.paranoid_rm.enabled,oe=H.paranoid_interpreters.enabled;return{policy:bu(G.policySnapshot.policy,H),effectiveCapabilities:H,effectiveLevel:Ta({failClosed:j,paranoidRm:J,paranoidInterpreters:oe}),strict:j,paranoidRm:J,paranoidInterpreters:oe,worktreeMode:G.worktreeMode??!1}}import{dirname as cA,isAbsolute as dA,join as uA,parse as mA,resolve as fA,sep as pA}from"node:path";function Zo(G,H){if(G!=="powershell")return H[0]?.provenance==="command-substitution";let j=H[0]?.text==="&"||H[0]?.text==="."?1:0,J=H[j]?.provenance;return J!==void 0&&J!=="literal"}var cS=/^[A-Za-z_][A-Za-z0-9_]*=/;function ns(G,H){return G?.provenance==="literal"&&!G.quoted&&G.raw===H&&G.text===H}function Xo(G){let H=ns(G.words[0],"time")?1:0,j=H===1&&ns(G.words[H],"-p")?H+1:H,J=H===1&&ns(G.words[j],"--")?j+1:j,oe=ns(G.words[J],"!")?J+1:J,ie=G.words.slice(oe).find((fe)=>!cS.test(fe.text));return ie?.provenance==="literal"?ie.text:void 0}var pr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function rs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function os(G,H,j){G.push(j),H.reset()}function is(G){let H=[];return{parts:H,push:(j,J,oe)=>{if(J<=j)return;H.push({raw:G.slice(j,J),span:{start:j,end:J},provenance:oe})}}}function ml(G){let H=G.parts??[{raw:G.raw,span:G.span,provenance:G.provenance}];return{kind:"word",...G,parts:H}}function ao(G,H,j,J,oe,ie,fe){return ml({text:J,raw:G.slice(H,j),span:{start:H,end:j},provenance:oe,quoted:ie,...fe?{parts:fe}:{}})}function fl(G,H,j){if(H>=j||Du(G[H]??""))return null;let J="",oe=!1,ie=!1,fe=H;while(fe<j&&!Du(G[fe]??"")){let Re=G[fe]??"";if(Re==="'"){oe=!0;let Te=Mu(G,fe+1,j,"'");J+=Te.text,ie||=!Te.closed,fe=Te.next;continue}if(Re==='"'){oe=!0;let Te=Mu(G,fe+1,j,'"');J+=Te.text,ie||=!Te.closed,fe=Te.next;continue}if(Re==="\\"){oe=!0;let Te=G[fe+1];if(!Te||Te===`
-`||Te==="\r"){ie=!0;break}J+=Te,fe+=2;continue}if(Re==="`"||G.startsWith("$(",fe)||G.startsWith("${",fe)||G.startsWith("<(",fe)||G.startsWith(">(",fe))ie=!0;J+=Re,fe++}return{delimiter:J,quoted:oe,next:fe,ambiguous:ie}}function pl(G,H,j,J){let oe=[],ie=H;for(let fe of J){let Re=ie,Te=!1;while(ie<j){let ke=dS(G,ie,j);if((fe.stripTabs?ke.text.replace(/^\t+/,""):ke.text)===fe.delimiter){fe.attach({body:fe.stripTabs?uS(G.slice(Re,ie)):G.slice(Re,ie),delimiter:fe.delimiter,quotedDelimiter:fe.quotedDelimiter,bodySpan:{start:Re,end:ie},terminatorSpan:{start:ie,end:ke.contentEnd}}),ie=ke.next,Te=!0;break}if(ke.next<=ie)break;ie=ke.next}if(Te)continue;return oe.push({code:"unterminated-heredoc",message:`heredoc delimiter ${fe.delimiter} was not found`}),{next:j,issues:oe,terminated:!1}}return{next:ie,issues:oe,terminated:!0}}function Mu(G,H,j,J){let oe="",ie=H;while(ie<j&&G[ie]!==`
-`&&G[ie]!=="\r"){let fe=G[ie]??"";if(fe===J)return{text:oe,next:ie+1,closed:!0};if(J==='"'&&fe==="\\"&&G[ie+1]){let Re=G[ie+1]??"";oe+=["$","`",'"',"\\"].includes(Re)?Re:`\\${Re}`,ie+=2;continue}oe+=fe,ie++}return{text:oe,next:ie,closed:!1}}function Du(G){return G!=="\r"&&(/[\s;&|<>)]/u.test(G)||G==="`")}function dS(G,H,j){let J=H;while(J<j&&G[J]!==`
-`)J++;let oe=J>=j?j:J+1;return{text:G.slice(H,J),contentEnd:J,next:oe}}function uS(G){return G.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Gu=new Set(["&&","||","|","|&"]),mS=new Set(["!","do","elif","else","if","then","until","while"]);function zu(G,H){let j={start:0,end:G.length};if(G.length>H.maxInputLength)return{kind:"program",dialect:"posix",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${H.maxInputLength} UTF-16 code units`}],nodes:[]};let J={wordsUsed:0,maxWords:H.maxWords,quotedExpansionEnd:1/0},oe=ls(G,0,G.length,H,J,0),ie=vS(G,J.quotedExpansionEnd,oe.nodes)?[...oe.issues,Uu]:oe.issues;return{kind:"program",dialect:"posix",source:G,span:j,status:ds(ie,oe.limited),issues:ie,nodes:oe.nodes}}function ls(G,H,j,J,oe,ie,fe){let Re=[],Te=[],ke=rs(),Le=[],Xe=()=>{if(ke.words.length===0&&ke.redirections.length===0)return;let Ze={start:ke.start,end:ke.end},Qe=ke.words.map((et)=>et.text);os(Re,ke,{kind:"command",dialect:"posix",source:G.slice(Ze.start,Ze.end),span:Ze,words:ke.words,redirections:ke.redirections,nested:ke.nested,displayText:Te.length>0&&Re.length===0?G.slice(H,j):Qe.join(" ")})},Ye=H;while(Ye<j){let Ze=G[Ye];if(!Ze)break;if(fe&&Ze===fe)return Xe(),Fu(Re,Te),{nodes:Re,issues:Te,next:Ye+1,closed:!0,limited:!1,pendingHeredocs:Le};if(Qo(Ze)){if(Ze===`
-`||Ze==="\r"){Xe();let Mt=Ze==="\r"&&G[Ye+1]===`
-`?Ye+2:Ye+1,Dt=Re.at(-1);if(Dt?.kind!=="connector"||!Gu.has(Dt.operator))Re.push({kind:"connector",operator:G.slice(Ye,Mt),span:{start:Ye,end:Mt}});if(Le.length>0){let Lt=pl(G,Mt,j,Le.splice(0));Te.push(...Lt.issues),Ye=Lt.next;continue}Ye=Mt;continue}Ye++;continue}if(Ze==="#"){while(Ye<j&&G[Ye]!==`
-`&&G[Ye]!=="\r")Ye++;continue}let Qe=ke.start===-1?GS(G,Ye,j):void 0;if(Qe){if(hl(Re,Te),ie>=J.maxDepth)return lo(Re,Te,Ye,"depth-limit",J.maxDepth);if(!gl(oe))return lo(Re,Te,Ye,"word-limit",J.maxWords);let Mt=ls(G,Qe.braceIndex+1,j,J,oe,ie+1,"}"),Dt=Mt.next,Lt={start:Qe.braceIndex+1,end:Mt.closed?Dt-1:Dt},ht=Nu(G,Lt,Mt);if(Re.push({kind:"function",name:Qe.name,span:{start:Ye,end:Dt},body:ht}),Te.push(...Mt.issues),Mt.pendingHeredocs.length>0||ei(Mt.nodes))Te.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(Le.push(...Mt.pendingHeredocs),Mt.limited)return as(Re,Te,Mt.next);if(!Mt.closed)Te.push({code:"unclosed-function-body",message:"function body is not closed"});Ye=Dt;continue}let et=cs(G,Ye);if(et){if(Xe(),!Zu(Re.at(-1)))Te.push({code:"unexpected-connector",message:`connector ${et} has no preceding command`});Re.push({kind:"connector",operator:et,span:{start:Ye,end:Ye+et.length}}),Ye+=et.length;continue}if(Ze===")"){Xe(),Te.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Re.push({kind:"unknown",source:Ze,span:{start:Ye,end:Ye+1}}),Ye++;continue}if((Ze==="("||Ze==="{"&&wS(G,Ye,j))&&ke.start===-1){if(hl(Re,Te),ie>=J.maxDepth)return lo(Re,Te,Ye,"depth-limit",J.maxDepth);let Mt=Ze==="("?")":"}",Dt=ls(G,Ye+1,j,J,oe,ie+1,Mt),Lt=Dt.next,ht={start:Ye+1,end:Dt.closed?Lt-1:Lt},Ot=Nu(G,ht,Dt);if(Re.push({kind:"group",style:Ze==="("?"subshell":"brace",span:{start:Ye,end:Lt},body:Ot}),Te.push(...Dt.issues),Dt.pendingHeredocs.length>0||ei(Dt.nodes))Te.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(Le.push(...Dt.pendingHeredocs),Dt.limited)return as(Re,Te,Dt.next);if(!Dt.closed)Te.push({code:Ze==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Ze} group is not closed`});Ye=Lt;continue}let tt=(Ze==="<"||Ze===">")&&G[Ye+1]!=="("?hS(G,Ye):null;if(tt){let Mt=ke.words.at(-1),Dt=Mt&&Mt.span.end===Ye&&/^[0-9]+$/.test(Mt.raw)?Number(Mt.raw):void 0;if(Dt!==void 0)ke.words.pop();let Lt=Dt===void 0?Ye:Mt?.span.start??Ye;ke.start=ke.start===-1?Ye:ke.start;let ht=Ye+tt.length;while(ht<j&&/[ \t]/.test(G[ht]??""))ht++;let Ot=G[ht],$t=ht>Ye+tt.length&&Ot==="#",sn=!Ot||Qo(Ot)||!!cs(G,ht)||Ot===fe||Ot===")"||$t||(Ot==="<"||Ot===">")&&G[ht+1]!=="(",xr=tt==="<<"||tt==="<<-",qt=xr?fl(G,ht,j):void 0,Ht=qt?{word:ao(G,ht,qt.next,qt.delimiter,"literal",qt.quoted),nested:[],issues:[],next:qt.next,limited:!1}:!sn?yl(G,ht,j,J,oe,ie):void 0;if(Ht){if(Te.push(...Ht.issues),Ht.limited)return as(Re,Te,Ht.next);if(!gl(oe))return lo(Re,Te,Ht.next,"word-limit",J.maxWords)}let fn=Ht?.next??Ye+tt.length,tn={kind:"redirection",operator:tt,span:{start:Lt,end:fn},...Dt===void 0?{}:{fd:Dt},...Ht?{target:Ht.word}:{}};if(ke.redirections.push(tn),xr&&!qt)Te.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(qt){if(qt.ambiguous||qt.delimiter.length===0)Te.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let nn=ke.nested;Le.push({delimiter:qt.delimiter,quotedDelimiter:qt.quoted,stripTabs:tt==="<<-",attach:(_n)=>{if(tn.heredoc=_n,_n.quotedDelimiter)return;let er=pS(G,_n.bodySpan.start,_n.bodySpan.end,J,oe,ie+1);nn.push(...er.programs),Te.push(...er.issues)}})}if(!xr&&!Ht)Te.push({code:"missing-redirection-target",message:`redirection ${tt} requires a target word`});if(Ht)ke.nested.push(...Ht.nested);ke.end=fn,Ye=fn;continue}let gt=ke.start===-1;if(gt)hl(Re,Te);let _t=yl(G,Ye,j,J,oe,ie);if(Te.push(..._t.issues),_t.limited)return as(Re,Te,_t.next);let yt=TS(ke.words)?DS(G,_t.word,oe.maxWords-oe.wordsUsed,J.maxDepth,J.maxInputLength):void 0;if(yt?.limitCode)return lo(Re,Te,_t.next,yt.limitCode,yt.limitCode==="word-limit"?J.maxWords:yt.limitCode==="depth-limit"?J.maxDepth:J.maxInputLength);let At=yt?.words??[_t.word];for(let Mt of At){if(!gl(oe))return lo(Re,Te,_t.next,"word-limit",J.maxWords);ke.words.push(Mt)}if(ke.start=ke.start===-1?Ye:ke.start,ke.end=_t.next,ke.nested.push(..._t.nested),gt&&Xu(_t.word))Xe();Ye=_t.next>Ye?_t.next:Ye+1}return Xe(),Fu(Re,Te),Te.push(...zS(Le)),{nodes:Re,issues:Te,next:Ye,closed:fe===void 0,limited:!1,pendingHeredocs:[]}}function Nu(G,H,j){return{kind:"program",dialect:"posix",source:G.slice(H.start,H.end),span:H,status:ds(j.issues,j.limited),issues:j.issues,nodes:j.nodes}}function yl(G,H,j,J,oe,ie){let fe="",Re=H,Te=!1,ke="literal",Le=[],Xe=[],Ye=!1;while(Re<j){let Ze=G[Re],Qe=(Ze==="<"||Ze===">")&&G[Re+1]==="(";if(!Ze||Qo(Ze)||(Ze===";"||Ze==="|"||Ze==="&")&&cs(G,Re)||(Ze==="<"||Ze===">")&&!Qe)break;if(Ze===")")break;if(Ze==="'"){Te=!0;let gt=G.indexOf("'",Re+1);if(gt===-1||gt>=j){fe+=G.slice(Re+1,j),Xe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Re=j;break}fe+=G.slice(Re+1,gt),Re=gt+1;continue}if(Ze==='"'){Te=!0;let gt=fS(G,Re,j,J,oe,ie);if(fe+=gt.text,Le.push(...gt.nested),Xe.push(...gt.issues),Ye||=gt.limited,ke=Jo(ke,gt.provenance),Re=gt.next,Ye)break;continue}if(G.startsWith("$'",Re)){Te=!0;let gt=RS(G,Re+2,j);if(fe+=gt.text,Xe.push(...gt.issues),!gt.closed)Xe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Re=gt.next;continue}if(Ze==="\\"){let gt=G[Re+1];if(!gt){Xe.push({code:"trailing-escape",message:"escape has no following character"}),Re++;break}if(gt===`
-`){Re+=2;continue}fe+=gt,Re+=2;continue}if(Nr(G,Re))Xe.push(Dr);let et=Ze==="$"||Ze==="<"||Ze===">"||Ze==="`"?ti(G,Re,j,J,oe,ie):null,tt=et?Sl(et,Le,Xe):Hu(G,Re,j,J,oe,ie,Le,Xe);if(tt){if(tt.provenance==="variable")fe+=G.slice(Re,tt.next);if(Ye||=tt.limited,ke=Jo(ke,tt.provenance),Re=tt.next,Ye)break;continue}if(Ze==="$"){let gt=Vu(G,Re,j,fe,ke);fe=gt.text,ke=gt.provenance,Re=gt.next;continue}if(Ze==="*"||Ze==="?"||Ze==="[")ke=Jo(ke,"glob");fe+=Ze,Re++}return{word:ao(G,H,Re,fe,ke,Te,ke==="literal"?void 0:xS(G,H,Re)),nested:Le,issues:Xe,next:Re,limited:Ye}}function fS(G,H,j,J,oe,ie){let fe="",Re="literal",Te=[],ke=[],Le=!1,Xe=H+1;while(Xe<j){let Ye=G[Xe];if(Ye==='"')return{text:fe,provenance:Re,nested:Te,issues:ke,next:Xe+1,limited:Le};if(Ye==="\\"&&G[Xe+1]){let et=G[Xe+1]??"";if(et===`
-`){Xe+=2;continue}if(et==="\r"&&G[Xe+2]===`
-`){Xe+=3;continue}fe+=["$","`",'"',"\\"].includes(et)?et:`\\${et}`,Xe+=2;continue}if(Nr(G,Xe))ke.push(Dr);let Ze=ti(G,Xe,j,J,oe,ie),Qe=Ze?Sl(Ze,Te,ke):Hu(G,Xe,j,J,oe,ie,Te,ke);if(Qe){if(Qe.provenance!=="command-substitution")fe+=G.slice(Xe,Qe.next);if(Xe=Qe.next,Le||=Qe.limited,Re=Jo(Re,Qe.provenance),Le)return{text:fe,provenance:Re,nested:Te,issues:ke,next:Xe,limited:Le};continue}if(Ye==="$"){let et=Vu(G,Xe,j,fe,Re);fe=et.text,Re=et.provenance,Xe=et.next;continue}fe+=Ye??"",Xe++}return ke.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:fe,provenance:Re,nested:Te,issues:ke,next:j,limited:Le}}function ti(G,H,j,J,oe,ie){let fe=Bu(G,H);if(!fe)return null;let{length:Re,closing:Te}=fe,ke=Te==="))",Le=Te==="`",Xe=G[H]==="<"||G[H]===">",Ye=bl(G,H+Re,j,Te),Ze=Ye===-1?j:Ye,Qe=Ye===-1?j:Ye+Te.length;if(ie>=J.maxDepth)return{program:FS(G,H+Re,Ze,"depth-limit"),next:Qe,provenance:ke?"arithmetic":"command-substitution"};if(ke){let At=[],Mt=[],Dt=!1,Lt=H+Re;while(Lt<Ze){let ht=ti(G,Lt,Ze,J,oe,ie+1);if(!ht){if(Nr(G,Lt))Mt.push(Dr);Lt++;continue}if(At.push(...ht.program.nodes),Mt.push(...ht.program.issues),Dt||=ht.program.status==="limited",Lt=ht.next,Dt)break}if(Ye===-1)Mt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:G.slice(H+Re,Ze),span:{start:H+Re,end:Ze},status:ds(Mt,Dt),issues:Mt,nodes:At},next:Qe,provenance:"arithmetic"}}let et=ls(G,H+Re,Ze,J,oe,ie+1),tt=Ye===-1?[{code:"unclosed-command-substitution",message:`${G.slice(H,H+Re)} substitution is not closed`}]:[],gt=(Le||Xe)&&ei(et.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],_t=Le&&/\\[\\$`\n]/.test(G.slice(H+Re,Ze))?[ES]:[],yt=[...et.issues,...tt,...gt,..._t];return{program:{kind:"program",dialect:"posix",source:G.slice(H+Re,Ze),span:{start:H+Re,end:Ze},status:ds(yt,et.limited),issues:yt,nodes:et.nodes},next:Qe,provenance:"command-substitution"}}function pS(G,H,j,J,oe,ie){let fe=[],Re=[],Te=H;while(Te<j){let ke=G[Te];if(ke==="\\"){Te+=2;continue}let Le=ke==="$"||ke==="`"?ti(G,Te,j,J,oe,ie):null;if(!Le){if(Nr(G,Te))Re.push(Dr);Te++;continue}if(fe.push(Le.program),yS(G,Te,Le.next)&&CS(Le.program))Re.push(Dr);Te=Le.next}return{programs:fe,issues:Re}}function Sl(G,H,j){return H.push(G.program),j.push(...G.program.issues),{provenance:G.provenance,next:G.next,limited:G.program.status==="limited"}}function bl(G,H,j,J){if(J==="`"){for(let Re=H;Re<j;Re++){if(G[Re]==="\\"){Re++;continue}if(G[Re]==="`")return Re}return-1}let oe={single:!1,double:!1},ie=[],fe=[];for(let Re=H;Re<j;Re++){let Te=G[Re];if((Te===`
-`||Te==="\r")&&fe.length>0){let Xe=Te==="\r"&&G[Re+1]===`
-`?Re+2:Re+1,Ye=pl(G,Xe,j,fe.splice(0));if(!Ye.terminated)return-1;Re=Ye.next-1;continue}let ke=$u(G,Re,H,j,oe);if(ke!==null){Re=ke;continue}if(!oe.double&&G.startsWith("$((",Re)){let Xe=gS(G,Re+3,j);if(Xe===-1)return-1;Re=Xe+1;continue}if(J===")"&&!oe.double&&Te==="<"&&G[Re+1]==="<"&&G[Re+2]!=="<"){let Xe=G[Re+2]==="-",Ye=Re+(Xe?3:2);while(Ye<j&&/[ \t]/.test(G[Ye]??""))Ye++;let Ze=fl(G,Ye,j);if(Ze){fe.push({delimiter:Ze.delimiter,quotedDelimiter:Ze.quoted,stripTabs:Xe,attach:()=>{return}}),Re=Ze.next-1;continue}}if(G.startsWith("$(",Re)&&!G.startsWith("$((",Re)){ie.push(oe),oe={single:!1,double:!1},Re++;continue}if(Te==="("&&!oe.double){ie.push(oe),oe={single:!1,double:!1};continue}if(Te!==")"||oe.double)continue;let Le=ie.pop();if(Le){oe=Le;continue}return J==="))"&&G[Re+1]!==")"?-1:Re}return-1}function gS(G,H,j){let J=1,oe={single:!1,double:!1};for(let ie=H;ie<j;ie++){let fe=G[ie],Re=$u(G,ie,H,j,oe);if(Re!==null){ie=Re;continue}if(G.startsWith("$(",ie)&&!G.startsWith("$((",ie)){J++,ie++;continue}if(fe==="("&&!oe.double)J++;if(fe!==")"||oe.double)continue;if(J--,J===0)return G[ie+1]===")"?ie:-1}return-1}function $u(G,H,j,J,oe){let ie=G[H];if(ie==="\\"&&!oe.single)return H+1;if(!oe.double&&ie==="'")oe.single=!oe.single;if(!oe.single&&ie==='"')oe.double=!oe.double;if(oe.single)return H;if(oe.double||ie!=="#"||!$S(G,H,j))return null;let fe=H;while(fe+1<J&&G[fe+1]!==`
-`&&G[fe+1]!=="\r")fe++;return fe}function cs(G,H){let j=G[H];if(j===";")return";";if(j==="&")return G[H+1]==="&"?"&&":"&";if(j==="|")return G[H+1]==="|"?"||":G[H+1]==="&"?"|&":"|";return null}function hS(G,H){let j=G[H];if(j===">"){if(G[H+1]===">")return">>";if(G[H+1]==="&")return">&";return G[H+1]==="|"?">|":">"}if(j!=="<")return null;if(G.startsWith("<<<",H))return"<<<";if(G.startsWith("<<-",H))return"<<-";if(G[H+1]==="<")return"<<";if(G[H+1]==="&")return"<&";if(G[H+1]===">")return"<>";return"<"}function Qo(G){let H=G.charCodeAt(0);if(H===32||H>=9&&H<=13)return!0;if(H<128)return!1;return/\s/u.test(G)}var Dr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Nr(G,H){if(G[H]!=="$")return!1;let j=Lu(G,H+1);if(G[j]!=="{")return!1;let J=G[Lu(G,j+1)]??"";return J==="|"||Qo(J)}function yS(G,H,j){for(let J=G.indexOf("$",H);J!==-1&&J<j;J=G.indexOf("$",J+1))if(Nr(G,J))return!0;return!1}function CS(G){return G?.status==="limited"||(G?.issues??[]).some((H)=>H.code===Dr.code)}function Lu(G,H){let j=H;while(G.startsWith("\\\n",j)||G.startsWith(`\\\r
-`,j))j+=G[j+1]==="\r"?3:2;return j}function Bu(G,H){if(G.startsWith("$((",H))return{length:3,closing:"))"};if(G.startsWith("$(",H)||G.startsWith("<(",H)||G.startsWith(">(",H))return{length:2,closing:")"};return G[H]==="`"?{length:1,closing:"`"}:null}var SS=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Uu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),bS=/\$\(|`|[<>]\(/g;function vS(G,H,j){let J=Cl(j);return[...G.slice(H).matchAll(bS)].some((oe)=>{let ie=H+oe.index;return!J.some((fe)=>ie>=fe.start&&ie<fe.end)})}function Cl(G){return G.flatMap((H)=>{if(H.kind==="command")return[...H.redirections.flatMap((j)=>j.heredoc?[j.heredoc.bodySpan]:[]),...H.nested.flatMap((j)=>Cl(j.nodes))];return H.kind==="group"||H.kind==="function"?Cl(H.body.nodes):[]})}var ES=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Hu(G,H,j,J,oe,ie,fe,Re){if(G[H]!=="$"||G[H+1]!=="{")return null;let Te=us(G,H+2,j),ke=Te.close===-1?j:Te.close+1;if(Te.close===-1)Re.push(SS);if(Te.quoted&&Te.substitutions.length>0||Te.continued)Re.push(Uu);if(Te.quoted)oe.quotedExpansionEnd=Math.min(oe.quotedExpansionEnd,ke);let Le=Te.substitutions.some((Xe)=>{if(Nr(G,Xe))return Re.push(Dr),!1;let Ye=ti(G,Xe,ke,J,oe,ie);return Ye!==null&&Sl(Ye,fe,Re).limited});return{provenance:"variable",next:ke,limited:Le}}function us(G,H,j){let J=[],oe=!1,ie=!1,fe=1,Re=H;while(Re<j){let Te=G[Re];if(Te==="$"&&Nr(G,Re))J.push(Re);if(Te==="\\"||Te==="'"||Te==='"'){oe=!0,ie||=Te==="\\"&&G[Re+1]===`
-`,Re+=Te==="\\"?2:1;continue}let ke=Bu(G,Re);if(ke){J.push(Re);let Le=bl(G,Re+ke.length,j,ke.closing);if(Le===-1)break;Re=Le+ke.closing.length;continue}if(Te==="$"&&G[Re+1]==="{"){fe++,Re+=2;continue}if(Te==="}"&&--fe===0)return{close:Re,substitutions:J,quoted:oe,continued:ie};Re++}return{close:-1,substitutions:J,quoted:oe,continued:ie}}function ju(G,H,j){if(G[H+1]==="{"){let oe=us(G,H+2,j).close;return oe===-1?j:oe+1}if(G[H+1]==="$")return H+2;let J=H+1;while(J<j&&/[A-Za-z0-9_?@#!*-]/.test(G[J]??""))J++;return J===H+1?H+1:J}function RS(G,H,j){let J="",oe=[],ie=H;while(ie<j){let fe=G[ie];if(fe==="'")return{text:J,next:ie+1,closed:!0,issues:oe};if(fe!=="\\"){J+=fe??"",ie++;continue}let Re=_S(G,ie+1,j);if(J+=Re.text,Re.invalidCodePoint!==void 0)oe.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Re.invalidCodePoint}`});ie=Re.next}return{text:J,next:j,closed:!1,issues:oe}}function _S(G,H,j){let J=G[H];if(!J||H>=j)return{text:"\\",next:H};let oe=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(oe.has(J))return{text:oe.get(J)??J,next:H+1};if(J==="x")return ss(G,H+1,j,16,2,H+1);if(J==="u")return ss(G,H+1,j,16,4,H+1);if(J==="U")return ss(G,H+1,j,16,8,H+1);if(/[0-7]/.test(J))return ss(G,H,j,8,3,H+1);return{text:J,next:H+1}}function ss(G,H,j,J,oe,ie){let fe=J===16?/[0-9a-fA-F]/:/[0-7]/,Re="",Te=H;while(Te<j&&Re.length<oe&&fe.test(G[Te]??""))Re+=G[Te],Te++;if(!Re)return{text:G[ie-1]??"",next:ie};let ke=Number.parseInt(Re,J);return ke>1114111||ke>=55296&&ke<=57343?{text:"�",next:Te,invalidCodePoint:ke}:{text:String.fromCodePoint(ke),next:Te}}function ds(G,H=!1){if(H)return"limited";if(G.some((j)=>j.code==="invalid-ansi-c-code-point"||j.code==="missing-heredoc-delimiter"||j.code==="ambiguous-heredoc-delimiter"||j.code==="unterminated-heredoc"||j.code==="unsupported-heredoc-context"||j.code==="unsupported-function-substitution"||j.code==="unsupported-backtick-escape"||j.code==="unclosed-parameter-expansion"||j.code==="unsupported-parameter-expansion"))return"invalid";return G.length>0?"partial":"complete"}function Vu(G,H,j,J,oe){let ie=ju(G,H,j);return{text:J+G.slice(H,ie),provenance:Jo(oe,"variable"),next:ie}}function xS(G,H,j){let J=is(G),oe=H,ie=!1,fe=!1,Re=H;while(Re<j){let Te=G[Re];if(Te==="\\"&&!ie){Re+=2;continue}if(!fe&&Te==="'"){ie=!ie,Re++;continue}if(!ie&&Te==='"'){fe=!fe,Re++;continue}if(ie){Re++;continue}let ke=G.startsWith("$((",Re),Le=G.startsWith("$(",Re)&&!ke,Xe=!fe&&(G.startsWith("<(",Re)||G.startsWith(">(",Re)),Ye=Te==="`";if(ke||Le||Xe||Ye){let Ze=ke?3:Ye?1:2,Qe=ke?"))":Ye?"`":")",et=bl(G,Re+Ze,j,Qe),tt=et===-1?j:et+Qe.length;J.push(oe,Re,"literal"),J.push(Re,tt,ke?"arithmetic":"command-substitution"),Re=tt,oe=tt;continue}if(Te==="$"){let Ze=ju(G,Re,j);if(Ze>Re+1){J.push(oe,Re,"literal"),J.push(Re,Ze,"variable"),Re=Ze,oe=Ze;continue}}if(!fe&&(Te==="*"||Te==="?"||Te==="[")){J.push(oe,Re,"literal"),J.push(Re,Re+1,"glob"),Re++,oe=Re;continue}Re++}return J.push(oe,j,"literal"),J.parts}function Jo(G,H){if(H==="command-substitution"||G==="command-substitution")return"command-substitution";if(H==="arithmetic"||G==="arithmetic")return"arithmetic";if(H==="variable"||G==="variable")return"variable";if(H==="glob"||G==="glob")return"glob";return G}function wS(G,H,j){return H+1>=j||Qo(G[H+1]??"")||cs(G,H+1)!==null}var AS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),PS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function TS(G){let H=0;while(H<=G.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(G[H]?.text??""))H++;if(H===G.length)return!0;let j=IS(G,H);if(j===void 0||j===null)return!1;H=j}return!1}function IS(G,H){let j=G[H]?.text.toLowerCase();if(j==="command")return kS(G,H);if(j==="env")return OS(G,H);if(j==="sudo")return MS(G,H);return}function kS(G,H){if(G[H+1]?.text==="-v")return null;for(let j=H+1;j<G.length;j++){let J=G[j]?.text??"";if(J==="--")return j+1;if(J==="-p"||J==="-v"||J==="-V"||/^-[pvV]+$/.test(J))continue;return j}return G.length}function OS(G,H){for(let j=H+1;j<G.length;j++){let J=G[j]?.text??"";if(J==="--")return j+1;if(AS.has(J)){if(G[j+1]===void 0)return null;j++;continue}if(J.startsWith("-u=")||J.startsWith("--unset=")||J.startsWith("-C")&&J.length>2||J.startsWith("--chdir=")||J.startsWith("-S")&&J.length>2||J.startsWith("--split-string=")||J.startsWith("-P"))continue;if(J.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(J))continue;return j}return G.length}function MS(G,H){for(let j=H+1;j<G.length;j++){let J=G[j]?.text??"";if(J==="--")return j+1;if(PS.has(J)){if(G[j+1]===void 0)return null;j++;continue}if(J.startsWith("-"))continue;return j}return G.length}function Ku(G,H,j,J){if(G.provenance!=="literal"||!G.raw.includes("{"))return;let oe=qu(G.raw,H,j,J,!0);if(!oe)return;if("limited"in oe)return{limited:!0};let ie=oe.values.map((fe)=>Yu(fe,j));if(ie.some((fe)=>fe===null))return{limited:!0};return{words:[...new Set(ie.filter((fe)=>fe!==null&&fe!==""))]}}function DS(G,H,j,J,oe){if(H.provenance!=="literal"||!H.raw.includes("{"))return;let ie=qu(H.raw,j,J,oe,!1);if(!ie)return;if("limited"in ie){if(ie.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:ie.limited==="length"?"brace-expansion-limit":"word-limit"}}let fe=ie.values.map((Re)=>Yu(Re,J));if(fe.some((Re)=>Re===null))return;return{words:fe.filter((Re)=>Re!==null&&Re!=="").map((Re)=>ao(G,H.span.start,H.span.end,Re,"literal",!1))}}function qu(G,H,j,J,oe){let ie=[G],fe=G.length,Re=0;while(!0){let Te=ie.findIndex((Ze)=>Wu(Ze,oe));if(Te===-1)break;if(++Re>j)return{limited:"expansions"};let ke=ie[Te]??"",Le=Wu(ke,oe);if(!Le||Le.kind==="range")return{limited:"expansions"};let Xe=Le.start+ke.length-Le.end,Ye=Le.alternatives.reduce((Ze,Qe)=>Ze+Xe+Qe.length,0);if(fe-ke.length+Ye>J)return{limited:"length"};if(ie.length-1+Le.alternatives.length>H)return{limited:"words"};ie.splice(Te,1,...NS(ke,Le)),fe+=Ye-ke.length}return Re===0?void 0:{values:ie}}function Wu(G,H){let j=[],J,oe=null,ie=!1;for(let fe=0;fe<G.length;fe++){let Re=G[fe];if(ie){ie=!1;continue}if(Re==="\\"&&oe!=="'"){ie=!0;continue}if(Re===oe){oe=null;continue}if(oe===null&&(Re==="'"||Re==='"')){oe=Re;continue}if(oe!==null)continue;if(Re==="{"){j.push({start:fe,commas:[]});continue}if(Re===","&&j.length>0){j.at(-1)?.commas.push(fe);continue}if(Re!=="}"||j.length===0)continue;let Te=j.pop();if(!Te)continue;let ke=Te.commas.length>0?{kind:"alternatives",start:Te.start,end:fe+1,commas:Te.commas}:H&&WS(G.slice(Te.start+1,fe))?{kind:"range",start:Te.start,end:fe+1}:void 0;if(ke&&(!J||ke.start<J.start))J=ke}if(!J||J.kind==="range")return J;return{kind:J.kind,start:J.start,end:J.end,alternatives:LS(G,J)}}function NS(G,H){return H.alternatives.map((j)=>`${G.slice(0,H.start)}${j}${G.slice(H.end)}`)}function LS(G,H){let j=[H.start,...H.commas,H.end-1];return j.slice(0,-1).map((J,oe)=>G.slice(J+1,j[oe+1]))}function WS(G){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(G)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(G)}function Yu(G,H){let j=`x${G}`,J=yl(j,0,j.length,{maxInputLength:j.length,maxWords:1,maxDepth:H},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(J.limited||J.issues.length>0||J.next!==j.length||J.word.provenance!=="literal")return null;return J.word.text.slice(1)}function FS(G,H,j,J){return{kind:"program",dialect:"posix",source:G.slice(H,j),span:{start:H,end:j},status:"limited",issues:[{code:J,message:"command structure exceeds parser limit"}],nodes:[]}}function lo(G,H,j,J,oe){return{nodes:G,issues:[...H,{code:J,message:`command structure exceeds parser limit ${oe}`}],next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function as(G,H,j){return{nodes:G,issues:H,next:j,closed:!1,limited:!0,pendingHeredocs:[]}}function gl(G){return G.wordsUsed++,G.wordsUsed<=G.maxWords}function GS(G,H,j){let J=G.slice(H,j),oe=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(J)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(J),ie=oe?.[1];if(!oe||!ie)return;return{name:ie,braceIndex:H+oe[0].lastIndexOf("{")}}function ei(G){return G.some((H)=>{if(H.kind==="command")return H.redirections.some((j)=>j.heredoc)||H.nested.some((j)=>ei(j.nodes));return(H.kind==="group"||H.kind==="function")&&ei(H.body.nodes)})}function zS(G){return G.map((H)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${H.delimiter} was not found`}))}function Zu(G){return G?.kind==="command"||G?.kind==="group"||G?.kind==="function"}function Fu(G,H){let j=G.at(-1);if(j?.kind!=="connector"||!Gu.has(j.operator))return;H.push({code:"missing-command-after-connector",message:`connector ${j.operator} requires a following command`})}function Xu(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&mS.has(G.text)}function hl(G,H){let j=G.at(-1);if(!Zu(j))return;if(j?.kind==="command"&&Xu(j.words[0]))return;H.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function $S(G,H,j){return H===j||/[\s;&|()]/u.test(G[H-1]??"")}var Qu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),BS=new Set(["gc","cat","type","cp","mv","rm"]),em=["-rec","-for","-path","-literalpath","-whatif"],US=/^\$env:\w/i,HS=/^(?:\$\{?\w+\}?|~)\\./;function tm(G,H){let j=G.toLowerCase().replaceAll("`","");if(![...Qu].some((oe)=>j.includes(oe))&&!(j.includes("rm")&&em.some((oe)=>j.includes(oe)))&&!j.includes("<#")&&!jS(j))return!1;let J=_l(G,H);if(nm(J))return!1;return J.issues.some((oe)=>oe.code==="unclosed-block-comment"||oe.code==="comment-depth-limit")||Rl(J).some(VS)}function nm(G){return G.nodes.some((H)=>{if(H.kind==="group")return nm(H.body);if(H.kind!=="command")return!1;return H.redirections.some((j)=>j.operator==="<<")})}function jS(G){if(G.includes("$env:"))return!0;return G.includes("\\")&&(G.includes("$")||G.includes("~"))}function VS(G){let H=G[0]==="&"||G[0]==="."?1:0,j=G[H]?.toLowerCase();if(j&&Qu.has(j))return!0;let J=G.slice(H+1);if(j&&BS.has(j)&&J.some(KS))return!0;if(j!=="rm")return!1;return J.some((oe)=>{let ie=oe.toLowerCase().split(":",1)[0]??"";return em.some((fe)=>ie.startsWith(fe))})}function KS(G){return US.test(G)||HS.test(G)}function _l(G,H){let j={start:0,end:G.length};if(G.length>H.maxInputLength)return{kind:"program",dialect:"powershell",source:G,span:j,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${H.maxInputLength} UTF-16 code units`}],nodes:[]};let J=xl(G,0,G.length,H,0);return{kind:"program",dialect:"powershell",source:G,span:j,status:JS(J.issues,J.limited),issues:J.issues,nodes:J.nodes}}function xl(G,H,j,J,oe,ie=!1){let fe=[],Re=[],Te=rs(),ke=0,Le=!1,Xe=()=>{if(Te.words.length===0&&Te.redirections.length===0)return;let Ze={start:Te.start,end:Te.end};os(fe,Te,{kind:"command",dialect:"powershell",source:G.slice(Ze.start,Ze.end),span:Ze,words:Te.words,redirections:Te.redirections,nested:Te.nested,displayText:Te.words.map((Qe)=>Qe.text).join(" ")})},Ye=H;while(Ye<j){let Ze=G[Ye];if(!Ze)break;if(ie&&Ze==="}")return Xe(),{nodes:fe,issues:Re,next:Ye+1,closed:!0,words:ke,limited:Le};let Qe=XS(G,Ye,j,J.maxDepth);if(Qe){if(Qe.issue)Re.push(Qe.issue);if(Qe.limited)return Xe(),{nodes:fe,issues:Re,next:Qe.next,closed:!1,words:ke,limited:!0};Ye=Qe.next;continue}if(/\s/.test(Ze)){if(Ze==="\r"||Ze===`
-`){Xe();let gt=Ze==="\r"&&G[Ye+1]===`
-`?Ye+2:Ye+1;fe.push(vl(G,Ye,gt)),Ye=gt;continue}Ye++;continue}let et=im(G,Ye);if(et){Xe(),fe.push(vl(G,Ye,Ye+et.length)),Ye+=et.length;continue}if(Ze==="{"){if(Xe(),oe>=J.maxDepth)return Re.push(om(J.maxDepth)),{nodes:fe,issues:Re,next:j,closed:!1,words:ke,limited:!0};let gt=xl(G,Ye+1,j,J,oe+1,!0),_t=gt.closed?gt.next-1:gt.next,yt={kind:"program",dialect:"powershell",source:G.slice(Ye+1,_t),span:{start:Ye+1,end:_t},status:gt.limited?"limited":gt.issues.length>0?"partial":"complete",issues:gt.issues,nodes:gt.nodes};if(fe.push({kind:"group",style:"brace",span:{start:Ye,end:gt.next},body:yt}),Re.push(...gt.issues),!gt.closed)Re.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ke+=gt.words,Le||=gt.limited,Ye=gt.next;continue}if(Ze==="}"){Xe(),fe.push(vl(G,Ye,Ye+1)),Ye++;continue}if(Ze===">"||Ze==="<"){Te.start=Te.start===-1?Ye:Te.start;let gt=G[Ye+1]===Ze?Ye+2:Ye+1,_t=gt;while(/[ \t]/.test(G[_t]??""))_t++;let yt=_t<j?Ju(G,_t,j,J,oe):void 0,At=yt?.next??gt;if(Te.redirections.push({kind:"redirection",operator:G.slice(Ye,gt),span:{start:Ye,end:At},...yt?{target:yt.word}:{}}),yt)Re.push(...yt.issues),Te.nested.push(...yt.nested),ke+=yt.words,Le||=yt.limited;Te.end=At,Ye=At;continue}if(Ze===","){Te.start=Te.start===-1?Ye:Te.start,Te.words.push(ml({text:",",raw:",",span:{start:Ye,end:Ye+1},provenance:"literal",quoted:!1})),Te.end=++Ye;continue}let tt=Ju(G,Ye,j,J,oe);if(Te.start=Te.start===-1?Ye:Te.start,Te.end=tt.next,Te.words.push(tt.word),Re.push(...tt.issues),Te.nested.push(...tt.nested),ke+=1+tt.words,Le||=tt.limited,ke>J.maxWords)return Re.push({code:"word-limit",message:`command exceeds ${J.maxWords} words`}),Xe(),{nodes:fe,issues:Re,next:tt.next,closed:!1,words:ke,limited:!0};Ye=tt.next>Ye?tt.next:Ye+1}return Xe(),{nodes:fe,issues:Re,next:Ye,closed:!ie,words:ke,limited:Le}}function Ju(G,H,j,J,oe){let ie="",fe="literal",Re=!1,Te=[],ke=[],Le=0,Xe=!1,Ye=(Qe)=>{let et=qS(G,Qe,j,J,oe);return ie+=G.slice(Qe,et.next),ke.push(et.program),Te.push(...et.program.issues),Le+=El(et.program),Xe||=et.program.status==="limited",fe="command-substitution",et.next},Ze=H;while(Ze<j){let Qe=G[Ze];if(!Qe||/\s/.test(Qe)||im(G,Ze)||Qe===">"||Qe==="<"||Qe==="#")break;if(Qe===",")break;if(Qe==="`"){let et=G[Ze+1];if(!et){Te.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Ze++;break}ie+=et,Ze+=2;continue}if(G.startsWith("$(",Ze)){Ze=Ye(Ze);continue}if(Qe==="'"){Re=!0,Ze++;let et=!1;while(Ze<G.length){if(G[Ze]==="'"&&G[Ze+1]==="'"){ie+="'",Ze+=2;continue}if(G[Ze]==="'"){et=!0,Ze++;break}ie+=G[Ze]??"",Ze++}if(!et)Te.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Qe==='"'){Re=!0,Ze++;let et=!1;while(Ze<j){let tt=G[Ze];if(tt==="`"&&G[Ze+1]){ie+=G[Ze+1],Ze+=2;continue}if(tt==='"'){et=!0,Ze++;break}if(G.startsWith("$(",Ze)){Ze=Ye(Ze);continue}if(tt==="$")fe=G[Ze+1]==="("?"command-substitution":"variable";ie+=tt??"",Ze++}if(!et)Te.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Qe==="$")fe=G[Ze+1]==="("?"command-substitution":"variable";if(Qe==="@"&&Ze===H)fe="variable";ie+=Qe,Ze++}return{word:ao(G,H,Ze,ie,fe,Re,fe==="literal"?void 0:YS(G,H,Ze)),next:Ze,issues:Te,nested:ke,words:Le,limited:Xe}}function qS(G,H,j,J,oe){let ie=rm(G,H+2,j),fe=ie===-1?j:ie,Re=ie===-1?j:ie+1;if(oe>=J.maxDepth)return{program:{kind:"program",dialect:"powershell",source:G.slice(H+2,fe),span:{start:H+2,end:fe},status:"limited",issues:[om(J.maxDepth)],nodes:[]},next:Re};let Te=xl(G,H+2,fe,J,oe+1),ke=ie===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:G.slice(H+2,fe),span:{start:H+2,end:fe},status:Te.limited?"limited":Te.issues.length+ke.length>0?"partial":"complete",issues:[...Te.issues,...ke],nodes:Te.nodes},next:Re}}function rm(G,H,j){let J=1,oe=!1,ie=!1;for(let fe=H;fe<j;fe++){let Re=G[fe];if(Re==="`"){fe++;continue}if(!ie&&Re==="'"){if(oe&&G[fe+1]==="'"){fe++;continue}oe=!oe;continue}if(!oe&&Re==='"'){ie=!ie;continue}if(oe)continue;if(G.startsWith("$(",fe)){J++,fe++;continue}if(!ie&&Re==="(")J++;if(Re!==")")continue;if(J--,J===0)return fe}return-1}function El(G){let H=0;for(let j of G.nodes){if(j.kind==="group")H+=El(j.body);if(j.kind==="command"){H+=j.words.length;for(let J of j.nested)H+=El(J)}}return H}function YS(G,H,j){let J=is(G),oe=H,ie=!1,fe=H;while(fe<j){let Re=G[fe];if(Re==="`"){fe+=2;continue}if(Re==="'"){if(ie&&G[fe+1]==="'"){fe+=2;continue}ie=!ie,fe++;continue}if(ie){fe++;continue}if(G.startsWith("$(",fe)){let Te=rm(G,fe+2,j),ke=Te===-1?j:Te+1;J.push(oe,fe,"literal"),J.push(fe,ke,"command-substitution"),fe=ke,oe=ke;continue}if(Re==="$"||Re==="@"&&fe===H){let Te=ZS(G,fe+1,j);J.push(oe,fe,"literal"),J.push(fe,Te,"variable"),fe=Te,oe=Te;continue}fe++}return J.push(oe,j,"literal"),J.parts}function ZS(G,H,j){if(G[H]==="{"){let oe=G.indexOf("}",H+1);return oe===-1||oe>=j?j:oe+1}let J=H;while(J<j&&/[A-Za-z0-9_:?]/.test(G[J]??""))J++;return J}function om(G){return{code:"depth-limit",message:`command structure exceeds parser limit ${G}`}}function Rl(G){return G.nodes.flatMap((H)=>{if(H.kind==="group")return Rl(H.body);if(H.kind!=="command")return[];return[[...H.words,...H.redirections.flatMap((j)=>j.target?[j.target]:[])].sort((j,J)=>j.span.start-J.span.start).filter((j)=>j.text!==""&&j.raw!==",").map((j)=>j.text),...H.nested.flatMap(Rl)]})}function im(G,H){for(let j of["&&","||",";","|"])if(G.startsWith(j,H))return j;return null}function XS(G,H,j,J){if(G[H]==="#"&&G[H+1]!==">"){let fe=H+1;while(fe<j&&G[fe]!=="\r"&&G[fe]!==`
-`)fe++;return{next:fe,limited:!1}}if(!G.startsWith("<#",H))return null;let oe=1,ie=H+2;while(ie<j){if(G.startsWith("<#",ie)){if(oe++,oe>J)return{next:j,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${J}`},limited:!0};ie+=2;continue}if(G.startsWith("#>",ie)){if(oe--,ie+=2,oe===0)return{next:ie,limited:!1};continue}ie++}return{next:j,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function JS(G,H){if(H)return"limited";if(G.some((j)=>j.code==="unclosed-block-comment"))return"invalid";return G.length>0?"partial":"complete"}function vl(G,H,j){return{kind:"connector",operator:G.slice(H,j),span:{start:H,end:j}}}function y(G,H="auto",j=pr){if(H==="powershell"||H==="auto"&&tm(G.slice(0,j.maxInputLength),j))return _l(G,j);return zu(G,j)}function t(G){return G.provenance==="command-substitution"?G.raw:G.text}function re(G,H){return G==="posix"?H:Jt(H.map((j)=>j.text))}function co(G,H){return G&&G.provenance!=="unknown"?G.provenance==="literal":!/[$`*?[\]]/.test(H)}function Jt(G){return G.map((H)=>({kind:"word",text:H,raw:H,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function wl(G,H){return{value:G,work:H}}function Tt(G,H){if(G.work)G.work.units=Math.min(Number.MAX_SAFE_INTEGER,G.work.units+1);return G.value[H]}function en(G){return G.value.length}function ni(G,H,j=1){if(G)G.units=Math.min(Number.MAX_SAFE_INTEGER,G.units+H.length*j)}function Pn(G,H){ni(G,H)}function Lr(G){if(!G)return!1;let H=G.charCodeAt(0);return H>=48&&H<=57||H>=65&&H<=90||H===95||H>=97&&H<=122}function Zt(G){if(!G)return!1;let H=G.charCodeAt(0);return H===9||H===10||H===11||H===12||H===13||H===32||H===160||H===65279||H===5760||H>=8192&&H<=8202||H===8232||H===8233||H===8239||H===8287||H===12288}function Al(G){return G===`
-`||G==="\r"||G==="\u2028"||G==="\u2029"}function Xt(G,H,j){if(H+j.length>en(G))return!1;for(let J=0;J<j.length;J++)if(Tt(G,H+J)!==j[J])return!1;return!0}function rr(G,H,j){return!Lr(Tt(G,H-1))&&Xt(G,H,j)&&!Lr(Tt(G,H+j.length))}function or(G,H){return Lr(Tt(G,H-1))!==Lr(Tt(G,H))}function dn(G){return G===`
-`||G===";"||G==="&"||G==="|"}function uo(G){return G==="|"||G===";"}function ms(G,H,j){let J=wl(G,j);if(H==="rm")return QS(J);if(H==="dd")return tb(J);return um(J,!0)}function fs(G,H,j){let J=wl(G,j);if(H==="rm")return nb(J);if(H==="reset-hard")return cm(J,"--ha","rd");if(H==="reset-merge")return cm(J,"--me","rge");if(H==="clean")return sb(J);if(H==="checkout")return lb(J);if(H==="push-force")return cb(J);if(H==="push-refspec")return db(J);if(H==="push-delete")return ub(J);if(H==="branch")return mb(J);if(H==="tag")return gb(J);if(H==="restore")return hb(J);return um(J,!1)}function QS(G){let H=!1,j=!1,J=!1,oe=-1;for(let ie=0;ie<=en(G);ie++){let fe=Tt(G,ie);if(!H){let Te=Tt(G,ie+2);if(rr(G,ie,"rm")&&Zt(Te)&&Te!==`
-`)H=!0,ie++;continue}let Re=eb(G,ie);if(fe===`
-`||Re!==-1){if(H=!1,j=!1,J=!1,oe=-1,Re!==-1)ie=Re-1;continue}if(fe===";"||fe==="&"||fe==="|"||ie===en(G)){if(oe>=0){let Te=sm(G,oe,ie);j||=Te.recursive,J||=Te.force}if(j&&J)return!0;H=!1,j=!1,J=!1,oe=-1;continue}if(Zt(fe)){if(oe<0)continue;if(Xt(G,oe,"--")&&ie-oe===2){H=!1,j=!1,J=!1,oe=-1;continue}let Te=sm(G,oe,ie);if(j||=Te.recursive,J||=Te.force,j&&J)return!0;oe=-1;continue}if(oe<0)oe=ie}return!1}function eb(G,H){if(Tt(G,H)!=="\\"||Tt(G,H-1)==="\\")return-1;if(Xt(G,H,String.raw`\n`))return H+2;if(Xt(G,H,String.raw`\x0a`)||Xt(G,H,String.raw`\x0A`))return H+5;if(Xt(G,H,String.raw`\u000a`)||Xt(G,H,String.raw`\u000A`))return H+7;return Xt(G,H,String.raw`\012`)?H+4:-1}function sm(G,H,j){if(am(G,H,j,"recursive"))return{recursive:!0,force:!1};if(am(G,H,j,"force"))return{recursive:!1,force:!0};if(Tt(G,H)!=="-"||Tt(G,H+1)==="-")return{recursive:!1,force:!1};let J=!1,oe=!1;for(let ie=H+1;ie<j;ie++){let fe=Tt(G,ie);J||=fe==="r"||fe==="R",oe||=fe==="f"||fe==="F"}return{recursive:J,force:oe}}function am(G,H,j,J){let oe=j-H-2;if(oe<1||oe>J.length||!Xt(G,H,"--"))return!1;for(let ie=0;ie<oe;ie++)if(Tt(G,H+ie+2)!==J[ie])return!1;return!0}function tb(G){let H=!1;for(let j=0;j<en(G);j++){if(dn(Tt(G,j))){H=!1;continue}if(rr(G,j,"dd")){H=!0,j++;continue}if(!H||!rr(G,j,"of")||!Xt(G,j,"of=/dev/"))continue;let J=j+8;if(J<en(G)&&!Zt(Tt(G,J))&&Tt(G,J)!=="'"&&Tt(G,J)!=='"')return!0}return!1}function nb(G){let H=!1,j=!1,J=!1;for(let oe=0;oe<=en(G);){let ie=Tt(G,oe);if(oe===en(G)||dn(ie)){H=!1,j=!1,J=!1,oe++;continue}let fe=ob(G,oe);if(fe>=0){if(rb(G,fe))return!0;let Re=fe,Te=!1;while(Zt(Tt(G,Re)))Te||=Tt(G,Re)===`
-`,Re++;if(Te)j=!1,J=!1;H=!0,oe=Re;continue}if(!H){oe++;continue}if(Xt(G,oe,"--")&&(oe===0||Zt(Tt(G,oe-1)))&&(!Tt(G,oe+2)||Zt(Tt(G,oe+2))||dn(Tt(G,oe+2)))){H=!1,j=!1,J=!1,oe+=2;continue}if(j||=Xt(G,oe,"--recursive")&&or(G,oe+11)||Pl(G,oe,"recursive"),J||=Xt(G,oe,"--force")&&or(G,oe+7)||Pl(G,oe,"force"),j&&J)return!0;oe++}return!1}function Pl(G,H,j){if(!Xt(G,H,"--"))return!1;let J=0;while(J<=j.length){let oe=Tt(G,H+J+2);if(!oe||Zt(oe)||dn(oe))break;if(oe!==j[J])return!1;J++}return J>0&&or(G,H+J+2)}function rb(G,H){let j=H,J=!1,oe=!1;while(j<en(G)){while(Zt(Tt(G,j)))j++;let ie=j;while(j<en(G)&&!Zt(Tt(G,j)))j++;if(Tt(G,ie)!=="-"||j-ie===2&&Xt(G,ie,"--"))return!1;let fe=lm(G,ie,"recursive"),Re=lm(G,ie,"force");if(J&&Re||oe&&fe)return!0;if(J||=fe,oe||=Re,Tt(G,ie+1)==="-")continue;let Te=ib(G,ie,j);if(Te.combined||J&&Te.forceAtBoundary||oe&&Te.recursiveAtBoundary)return!0;J||=Te.recursive,oe||=Te.force}return!1}function lm(G,H,j){return Xt(G,H,`--${j}`)&&or(G,H+j.length+2)||Pl(G,H,j)}function ob(G,H){if(H>0&&Lr(Tt(G,H-1)))return-1;let j=H;if(Tt(G,j)==="\\")j++;if(Tt(G,j)!=="r")return-1;if(j++,Tt(G,j)==="\\")j++;if(Tt(G,j)!=="m"||!Zt(Tt(G,j+1)))return-1;return j+1}function ib(G,H,j){let J=!1,oe=!1,ie=!1,fe=!1,Re=!1;if(Tt(G,H)!=="-")return{recursive:J,force:oe,recursiveAtBoundary:ie,forceAtBoundary:fe,combined:Re};let Te="";for(let ke=H+1;ke<j;ke++){let Le=Tt(G,ke)??"",Xe=(Le==="r"||Le==="f")&&or(G,ke+1);J||=Le==="r",oe||=Le==="f",ie||=Le==="r"&&Xe,fe||=Le==="f"&&Xe,Re||=(Te==="r"&&Le==="f"||Te==="f"&&Le==="r")&&Xe,Te=Le}return{recursive:J,force:oe,recursiveAtBoundary:ie,forceAtBoundary:fe,combined:Re}}function cm(G,H,j){return oi(G,"reset",uo,!0,(J)=>Tt(G,J)==="-"&&mo(G,J,H,j)?!0:J)}function sb(G){return oi(G,"clean",uo,!0,(H)=>{if(Tt(G,H)!=="-")return H;if(mo(G,H,"--fo","rce"))return!0;let j=ri(G,H,uo);for(let J=H+1;J<j;J++)if(Tt(G,J)==="f")return!0;return j-1})}function ps(G,H,j){if(!rr(G,H,"git"))return null;let J=H+3;if(!Zt(Tt(G,J)))return{commandEnd:-1,next:J};while(Zt(Tt(G,J)))J++;while(J<en(G)){if(dn(Tt(G,J)))return{commandEnd:-1,next:J};let oe=ri(G,J,dn);if(rr(G,J,j))return{commandEnd:J+j.length,next:oe};if(Tt(G,J)!=="-")return{commandEnd:-1,next:oe};let ie=oe-J===2&&Xt(G,J,"--"),fe=ab(G,J,oe);J=oe;while(Zt(Tt(G,J)))J++;if(ie)return{commandEnd:rr(G,J,j)?J+j.length:-1,next:ri(G,J,dn)};if(!fe)continue;if(J>=en(G)||dn(Tt(G,J)))return{commandEnd:-1,next:J};J=ri(G,J,dn);while(Zt(Tt(G,J)))J++}return{commandEnd:-1,next:J}}function ab(G,H,j){for(let J of xn)if(j-H===J.length&&Xt(G,H,J))return!0;return!1}function lb(G){return dm(G,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function cb(G){return oi(G,"push",uo,!0,(H)=>{if(Tt(G,H)!=="-")return H;if(Tt(G,H+1)==="f"&&!Lr(Tt(G,H+2))&&!Xt(G,H+2,"-with-lease"))return!0;let j=mm(G,H,"--fo","rce");if(j>=0&&!Xt(G,j,"-with-lease"))return!0;return H})}function db(G){return oi(G,"push",dn,!1,(H)=>{if(Zt(Tt(G,H))&&Tt(G,H+1)==="+"&&H+2<en(G)&&!dn(Tt(G,H+2))&&!Zt(Tt(G,H+2)))return!0;if(Tt(G,H)===":"&&Tt(G,H+1)==="+")return!0;return H})}function ub(G){return oi(G,"push",dn,!1,(H)=>{if(Tt(G,H)==="-"&&mo(G,H,"--de","lete"))return!0;if(Zt(Tt(G,H))&&Tt(G,H+1)===":"&&H+2<en(G)&&!Zt(Tt(G,H+2))&&!dn(Tt(G,H+2)))return!0;return H})}function mb(G){let H=!1,j=!1,J=!1;for(let oe=0;oe<=en(G);oe++){if(oe===en(G)||dn(Tt(G,oe))){if(j&&J)return!0;H=!1,j=!1,J=!1;continue}if(!H){let Re=ps(G,oe,"branch");if(Re){H=Re.commandEnd>=0,oe=Math.max(oe,(H?Re.commandEnd:Re.next)-1);continue}}if(!H||Tt(G,oe)!=="-")continue;let ie=ri(G,oe,dn),fe=fb(G,oe,ie);if(j||=fe.deletion,J||=fe.force,j&&J)return!0;oe=ie-1}return!1}function fb(G,H,j){let J=!1,oe=!1;for(let ie=H;ie<j;ie++){if(Tt(G,ie)!=="-")continue;if(mo(G,ie,"--de","lete"))J=!0;if(mo(G,ie,"--fo","rce"))oe=!0;if(Tt(G,ie+1)==="-")continue;let fe=ie+1,Re=!1,Te=!1,ke=!1;while(fe<j&&pb(Tt(G,fe))){let Le=Tt(G,fe);Re||=Le==="d"||Le==="D",Te||=Le==="f",ke||=Le==="D",fe++}if(!or(G,fe))continue;J||=Re,oe||=Te||ke}return{deletion:J,force:oe}}function pb(G){if(!G)return!1;let H=G.charCodeAt(0);return H>=65&&H<=90||H>=97&&H<=122}function gb(G){return dm(G,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function dm(G,H){let j=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let J=0;J<en(G);J++){let oe=Tt(G,J),ie=j[j.length-1];if(!ie)return!1;let fe=ie.escaped;if(ie.escaped=!fe&&ie.quote!=="'"&&oe==="\\",!fe&&oe==="'"&&ie.quote!=='"')ie.quote=ie.quote==="'"?"":"'";if(!fe&&oe==='"'&&ie.quote!=="'")ie.quote=ie.quote==='"'?"":'"';if(oe==="$"&&Tt(G,J+1)==="("&&(j.length===1||!fe&&ie.quote!=="'")){j.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),J++;continue}if(!fe&&!ie.quote&&j.length>1&&oe==="("){ie.depth++;continue}if(!fe&&!ie.quote&&j.length>1&&oe===")"){if(ie.depth--,ie.depth===0)j.pop();continue}if(Zt(oe))ie.shortActive=!1,ie.hasShortFlag=!1;if(!ie.outerActive){let Re=ps(G,J,H.command);if(Re){ie.outerActive=Re.commandEnd>=0&&Zt(Tt(G,Re.commandEnd)),ie.shortActive=!1,ie.hasShortFlag=!1,J=Math.max(J,(ie.outerActive?Re.commandEnd:Re.next)-1);continue}}if(ie.outerActive&&oe==="-"){if(mo(G,J,H.longPrefix,H.longOptional))return!0;ie.shortActive||=!H.excludedShortStarts.includes(Tt(G,J+1)??"")}if(ie.hasShortFlag||=ie.shortActive&&oe===H.shortFlag,ie.hasShortFlag&&or(G,J+1))return!0;if(uo(oe))ie.outerActive=!1}return!1}function oi(G,H,j,J,oe){let ie=!1;for(let fe=0;fe<en(G);fe++){let Re=Tt(G,fe),Te=j(Re);if(!ie&&!Te){let ke=ps(G,fe,H);if(ke){ie=ke.commandEnd>=0&&(!J||Zt(Tt(G,ke.commandEnd))),fe=Math.max(fe,(ie?ke.commandEnd:ke.next)-1);continue}}if(ie){let ke=oe(fe);if(ke===!0)return!0;for(let Le=fe;Le<=ke;Le++)if(j(Tt(G,Le)))ie=!1;fe=ke}if(Te)ie=!1}return!1}function hb(G){let H=!1;for(let j=0;j<en(G);j++){if(Al(Tt(G,j))){if(H)return!0;H=!1;continue}if(!H){let J=ps(G,j,"restore");if(J){H=J.commandEnd>=0,j=Math.max(j,(H?J.commandEnd:J.next)-1);continue}}if(H&&Tt(G,j)==="-"&&Tt(G,j+1)==="-"&&(Xt(G,j+2,"staged")||Xt(G,j+2,"help")))H=!1}return H}function um(G,H){let j=!1;for(let J=0;J<en(G);J++){let oe=Tt(G,J),ie=H?Al(oe):dn(oe);if(j&&Zt(oe)&&Tt(G,J+1)==="-"&&rr(G,J+2,"delete"))return!0;if(ie){j=!1;continue}if(rr(G,J,"find"))j=!0,J+=3}return!1}function ri(G,H,j){let J=H;while(J<en(G)&&!Zt(Tt(G,J))&&!j(Tt(G,J)))J++;return J}function mm(G,H,j,J){if(!Xt(G,H,j))return-1;let oe=H+j.length;for(let ie=0;ie<J.length&&Tt(G,oe)===J[ie];ie++)oe++;return or(G,oe)?oe:-1}function mo(G,H,j,J){return mm(G,H,j,J)>=0}function Nn(G,H){ni(H,G,2);let j=G.toLowerCase(),J=j.trimStart(),oe=J.startsWith("echo ")||J.startsWith("rg "),ie=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let fe of ie){if(fe.skipForEchoRg&&oe)continue;let Re=fe.caseSensitive?G:j;if(fe.regex)Pn(H,Re);if((fe.regex?.test(Re)??!1)||fe.scan&&fs(Re,fe.scan,H))return Pt("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${fe.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var yb=/^[A-Za-z_][A-Za-z0-9_]*=/;function pm(G,H,j){let J=G.words[0];if(!H||!J||G.words.length!==1||G.dialect!=="posix")return!1;if(!J.quoted||J.provenance!=="literal")return!1;let oe=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(J.text)?.[1];if(!oe)return!1;ni(j,H.source,2);let ie={anchored:new RegExp(`^\\$\\{?${oe}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${oe}(?![A-Za-z0-9_])`)};return gm(H.nodes,J,ie)}function gm(G,H,j){return G.every((J)=>{if(J.kind==="connector")return!0;if(J.kind==="group"||J.kind==="function")return gm(J.body.nodes,H,j);if(J.kind==="unknown")return!j.loose.test(J.source);return Cb(J,H,j)})}function Cb(G,H,j){if(G.nested.some((oe)=>j.loose.test(oe.source)))return!1;let J=G.words.findIndex((oe)=>!yb.test(oe.text));return G.words.every((oe,ie)=>oe===H||fm(oe.raw,j.anchored,ie!==J))&&G.redirections.every((oe)=>(!oe.heredoc||oe.heredoc.quotedDelimiter||!j.loose.test(oe.heredoc.body))&&(!oe.target||fm(oe.target.raw,j.anchored,!0)))}function fm(G,H,j){let J=!1,oe=!1;for(let ie=0;ie<G.length;ie++){let fe=G[ie];if(fe==="\\"&&!J){ie++;continue}if(!oe&&fe==="'"){J=!J;continue}if(!J&&fe==='"'){oe=!oe;continue}if(J||fe!=="$")continue;if(!H.test(G.slice(ie)))continue;if(!oe||!j)return!1}return!0}var Sb="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",bb="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",vb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",Eb="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",Rb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",_b=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),hm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,xb=new Set(["diskutil","wipefs","sgdisk","parted"]),wb=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),Ab=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,Pb=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),Tb=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),Ib=new Set(["i","b"]),kb=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,Ob=new Set([">",">|",">>","<>",">&"]),Mb=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function ym(G){return G==="dd"||G==="shred"||hm.test(G)||xb.has(G)}function Db(G,H){let j=H.some((J)=>J.startsWith("/dev/"));if(G==="diskutil"){let J=H.find((oe)=>!oe.startsWith("-"));return J!==void 0&&wb.has(J.toLowerCase())}if(G==="wipefs")return j&&H.some((J)=>Ab.test(J));if(G==="sgdisk")return j&&H.some((J)=>J.startsWith("-")&&!Nb(J));return G==="parted"&&j&&H.some((J)=>Mb.has(J.toLowerCase()))}function Nb(G){if(Pb.has(G.split("=",1)[0]??G))return!0;if(G.startsWith("--"))return!1;let H=G.slice(1).split("");return Ib.has(H[0]??"")||H.every((j)=>Tb.has(j))}function Cm(G,H){let j=H.slice(1);if(G==="dd"&&j.some((J)=>/^of=\/dev\/.+/.test(J)&&!_b.has(J)))return Pt("dd.device-write",Sb);if(hm.test(G)&&j.some((J)=>J.startsWith("/dev/")))return Pt("mkfs.device",bb);if(Db(G,j))return Pt("disk.erase",vb);if(G==="shred"&&j.length>0)return Pt("shred.target",Rb);return null}function Sm(G){return G.some((H)=>Ob.has(H.operator)&&H.target?.provenance==="literal"&&kb.test(H.target.text))?Pt("redirect.block-device",Eb):null}import{isAbsolute as Lb,resolve as bm}from"node:path";function ii(G,H,j,J){let oe=Lb(G)?bm(G):H?bm(H,G):void 0;if(!oe)return;try{return Bt(oe,j,J)}catch{return oe}}function vm(G){return!["/dev","/proc","/sys"].some((H)=>G===H||G.startsWith(`${H}/`))}var fo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",si="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Il=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Wb=new Set(["-p","--print"]),Fb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Gb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),zb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),$b=new Map([["python",new Set(["m"])]]),Bb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Ub=new Set(["always","default","never"]),Hb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),jb=/\\\r?\n/g,Vb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Em(G){return hs(G).code}function gs(G){return hs(G).sources}function Rm(G){return Vb.get(Ol(G))??[]}function hs(G){let H=Ol(G[0]??"");if(!Il.has(H))return{code:null,sources:[],optionsOpen:!1};let j=[],J=[],oe=!0;for(let ie=1;ie<G.length;ie++){let fe=G[ie];if(fe===void 0)break;if(fe==="--")return $n(H,j,J,oe,G[ie+1]===void 0?void 0:ie+1,G[ie+1]);if(fe===""||fe==="-"||!fe.startsWith("-"))return $n(H,j,J,oe,ie,fe);if(H==="node"&&Wb.has(fe)){let Xe=G[ie+1];if(Xe===void 0)return $n(H,j,J,oe);if(Xe.startsWith("-"))continue;j.push({tokenIndex:ie+1,value:Xe}),J.push({tokenIndex:ie+1,kind:"inline-code",value:Xe}),ie++;continue}if(qb(H,fe)){let Xe=G[ie+1];if(Xe===void 0)return $n(H,j,J,oe);if(j.push({tokenIndex:ie+1,value:Xe}),J.push({tokenIndex:ie+1,kind:"inline-code",value:Xe}),H==="python")return $n(H,j,J,oe);ie++;continue}let Re=/^--eval=(.*)$/s.exec(fe);if(Yb(H)&&Re){let Xe=Re[1]??"";j.push({tokenIndex:ie,value:Xe}),J.push({tokenIndex:ie,kind:"inline-code",value:Xe});continue}if(H==="node"){let Xe=Kb(fe);if(Xe){if(Xe.attached){if(oe&&=Xe.value!=="",Xe.value!=="")J.push({tokenIndex:ie,kind:"module-file",value:Xe.value});continue}let Ye=G[ie+1];if(Ye===void 0||Ye.startsWith("-"))return oe=!1,$n(H,j,J,oe);J.push({tokenIndex:ie+1,kind:"module-file",value:Ye}),ie++;continue}}if(H==="python"&&fe.startsWith("--check-hash-based-pycs=")||H==="node"&&(fe==="--conditions="||fe==="--diagnostic-dir="||fe==="--title=")||H==="ruby"&&(fe==="--disable="||fe==="--enable="))return $n(H,j,J,oe);if(Bb.get(H)?.has(fe)){let Xe=G[ie+1];if(Xe===void 0||Xe.startsWith("-")&&!(H==="ruby"&&Hb.has(fe))||H==="python"&&!Ub.has(Xe))return $n(H,j,J,oe);ie++;continue}if(fe.startsWith("--"))continue;let Te,ke=!1;for(let Xe=1;Xe<fe.length;Xe++){let Ye=fe[Xe];if(Ye===void 0)break;if($b.get(H)?.has(Ye)){let Ze=fe.slice(Xe+1),Qe=Ze||G[ie+1];if(Qe!==void 0)J.push({tokenIndex:Ze?ie:ie+1,kind:"module-file",value:Qe});return $n(H,j,J,oe)}if(Fb.get(H)?.has(Ye)){Te=fe.slice(Xe+1)||G[ie+1],ke=Xe+1===fe.length;break}if(H==="node"&&Ye==="r"){if(oe&&=fe==="-r",fe==="-r"){let Ze=G[ie+1];if(oe&&=Ze!==void 0&&!Ze.startsWith("-"),oe&&Ze!==void 0)J.push({tokenIndex:ie+1,kind:"module-file",value:Ze});ie++}break}if(H==="ruby"&&Ye==="r"){let Ze=fe.slice(Xe+1),Qe=Ze||G[ie+1];if(oe&&=Qe!==void 0,Qe!==void 0)J.push({tokenIndex:Ze?ie:ie+1,kind:"module-file",value:Qe});if(!Ze)ie++;break}if(H==="perl"&&(Ye==="M"||Ye==="m")){let Ze=fe.slice(Xe+1);if(!Ze){if(oe=!1,Xe+1===fe.length)ie++;break}J.push({tokenIndex:ie,kind:"module-file",value:Ze});break}if(Gb.get(H)?.has(Ye)){if(Xe+1===fe.length)ie++;break}if(zb.get(H)?.has(Ye)&&Xe+1<fe.length)break}if(Te===void 0)continue;let Le=ke?ie+1:ie;if(j.push({tokenIndex:Le,value:Te}),J.push({tokenIndex:Le,kind:"inline-code",value:Te}),H==="python")return $n(H,j,J,oe);if(ke)ie++}return $n(H,j,J,oe,void 0,void 0,!0)}function $n(G,H,j,J,oe,ie,fe=!1){let Re=G==="node"?H.slice(-1):H,Te=new Set(Re.map((Le)=>Le.tokenIndex)),ke=j.filter((Le)=>Le.kind!=="inline-code"||Te.has(Le.tokenIndex));if(J&&H.length===0&&oe!==void 0&&ie!==void 0)ke.push({tokenIndex:oe,kind:"main-script",value:ie});return{code:(G==="node"?Re[0]?.value:Re.map((Le)=>Le.value).join(`
-`))||null,sources:J?ke:[],optionsOpen:J&&fe}}function Kb(G){for(let H of["--import","--loader","--experimental-loader","--require"]){if(G===H)return{attached:!1,value:""};if(G.startsWith(`${H}=`))return{attached:!0,value:G.slice(H.length+1)}}return}function kl(G,H){return Ol(G)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(H)}function Ol(G){let H=Wt(G).toLowerCase();return Ui.test(H)?"python":H}function qb(G,H){return Il.get(G)?.has(H)??!1}function Yb(G){return Il.get(G)?.has("--eval")??!1}function ai(G,H,j=!1){let J=Jb(G,H);if(!Tl(J,H))return!1;Pn(H,J);let oe=Xb(J);if(Tl(oe,H))return!0;if(Pn(H,oe),!_m.test(oe))return!1;return!j||Zb(J,H)}function Zb(G,H){if(/`|%x|\bqx\b/.test(G))return!0;let J=G.split(""),oe=[];for(let Te=0;Te<G.length;Te++){let ke=G[Te];if(ke!=="'"&&ke!=='"')continue;let Le=G.startsWith(ke.repeat(3),Te)?ke.repeat(3):ke,Xe=Te+Le.length,Ye=Xe;while(Ye<G.length&&!G.startsWith(Le,Ye))Ye+=G[Ye]==="\\"?2:1;if(Ye>=G.length)return!0;oe.push({start:Xe,text:G.slice(Xe,Ye)}),J.fill(" ",Te,Ye+Le.length),Te=Ye+Le.length-1}let ie=J.join(""),fe=Array.from(ie.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((Te)=>_m.test(Te[1]??"")).map((Te)=>{let ke=Te.index+Te[0].length;return{start:ke,end:ys(ie,ke)}});if(fe.some((Te)=>Ml(ie,Te.start)))return!0;return oe.some((Te)=>{let ke=/\b(?:system|exec|spawn|popen)\s*$/.test(ie.slice(0,Te.start)),Le=fe.some((Xe)=>Te.start>=Xe.start&&Te.start<Xe.end);return(ke||Le)&&Tl(Te.text,H)})}function ys(G,H){let j=1;for(let J=H;J<G.length;J++){if(G[J]==="(")j++;if(G[J]===")")j--;if(j===0)return J}return G.length}function Ml(G,H){let j=0;for(let J=H;J<G.length;J++){let oe=G[J]??"";if("([{".includes(oe))j++;if(")]}".includes(oe)&&j--===0)return!1;if(oe===","&&j===0)return!1;if(/[A-Za-z_$]/.test(oe))return!0}return!1}var _m=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Xb(G){let H=[],j=0,J=0;while(J<G.length){let oe=G[J];if(oe!=="'"&&oe!=='"'){J++;continue}let ie=G.startsWith(oe.repeat(3),J)?oe.repeat(3):oe,fe=J+ie.length;while(fe<G.length&&!G.startsWith(ie,fe))fe+=G[fe]==="\\"?2:1;if(fe>=G.length)break;H.push(G.slice(j,J)," "),J=fe+ie.length,j=J}return H.push(G.slice(j)),H.join("")}function Tl(G,H){if(ms(G,"rm",H))return!0;for(let J of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Pn(H,G),J.test(G))return!0;if(ms(G,"dd",H))return!0;for(let J of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Pn(H,G),J.test(G))return!0;if(ms(G,"find",H))return!0;let j=G.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((J)=>(Pn(H,G),j.some((oe)=>fs(oe,J))))}function Jb(G,H){return Pn(H,G),G.replace(jb,"")}import{lstatSync as Yv,readdirSync as Zv}from"node:fs";import{basename as Xv,isAbsolute as Zm,join as Jv,relative as Xm}from"node:path";import{isAbsolute as km,parse as lv}from"node:path";import{dirname as Qb,isAbsolute as ev,parse as tv,sep as nv}from"node:path";function gr(G,H,j){if(tr(H))throw Error("Unsupported Windows namespace path");let J=ev(H)?tv(H).root:"",oe=J||G;for(let ie of ov(J?H.slice(J.length):H)){if(ie===""||ie===".")continue;if(ie===".."){oe=Qb(oe);continue}let fe=rv(oe,ie),Re=j.entryKind(fe),Te=Re==="symlink"?j.realpath(fe):fe;if(Re==="missing"||Te===null)throw Error(`Cannot resolve path component: ${fe}`);oe=Te}return oe}function rv(G,H){return G.endsWith("/")||G.endsWith("\\")?`${G}${H}`:`${G}${nv}${H}`}function ov(G){let H=process.platform==="win32"?/[\\/]+/:/\/+/;return G.split(H)}var Dl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],iv=new Set(Dl),sv=1024,xm=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),wm=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),av=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Cs(G){return iv.has(G)}function Nl(G){return Cs(G)||xm.has(G)||wm.has(G)||Go(G)}function ir(G,H,j){return j?.has(G)?j.get(G):H.get(G)}function Am(G,H){let j=ir("GIT_CONFIG_COUNT",G,H);if(j===void 0)return{state:"absent"};if(j==="")return{state:"valid",count:0};if(!/^\d+$/.test(j))return{state:"invalid"};let J=Number(j);return Number.isSafeInteger(J)&&J<=sv?{state:"valid",count:J}:{state:"invalid"}}function Ss(G,H,j){let oe=G.match(av)?.[1];if(!oe||!Nl(oe))return null;let ie=G.indexOf("=");return{name:oe,value:`${ir(oe,H,j)??""}${G.slice(ie+1)}`}}function Pm(G){return Im(G,wm)}function Tm(G){return Im(G,xm)}function Im(G,H){if(!G)return!1;for(let j of G.keys())if(H.has(j))return!0;return!1}var Mm=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ln(G){if(!Mm.test(G))return null;let H=G.indexOf("=");return{name:G.slice(0,H),value:G.slice(H+1)}}function Ce(G){let H=new Map,j=0;while(j<G.length){let J=G[j];if(!J)break;let oe=Ln(t(J));if(!oe)break;H.set(oe.name,oe.value),j++}return{words:G.slice(j),envAssignments:H}}function Dm(G){let H=Gt(G);return G.includes("=")||H==="sudo"||H==="env"||H==="command"||H==="builtin"}function Wr(G,H,j,J){if(!Dm(po(G)))return{words:G,envAssignments:new Map,cwd:j,rewritten:!1};let oe=new Set(G),ie=G,fe=new Map,Re=new Map(J??[]),Te=[],ke=j;for(let Xe=0;Xe<a.wrapperPeelIterations.cap;Xe++){let Ye=Om(ie),Ze=Ce(ie);for(let[et,tt]of Ze.envAssignments)fe.set(et,tt),Re.set(et,tt);if(ie=Ze.words,ie.length===0)break;while(ie.length>0&&po(ie).includes("=")&&!dv(ie)){let et=uv(po(ie),Re,H.env)??Ss(po(ie),H.env,Re);if(et)fe.set(et.name,et.value),Re.set(et.name,et.value);ie=ie.slice(1)}if(ie.length===0)break;let Qe=Gt(po(ie));if(Qe!=="sudo"&&Qe!=="env"&&Qe!=="command"&&Qe!=="builtin")break;if(Qe==="sudo"){let et=fv(ie,H.paths,ke);if(ie=et.words,et.cwd!==void 0)ke=et.cwd}if(Qe==="env"){let et=hv(ie,ke,Re,H);if(Te.push(...et.envSplitValues??[]),ie=et.words,et.cwd!==void 0)ke=et.cwd;for(let[tt,gt]of et.envAssignments)fe.set(tt,gt),Re.set(tt,gt)}if(Qe==="command")ie=yv(ie);if(Qe==="builtin")ie=ie.slice(Bn(ie,1)==="--"?2:1);if(Om(ie)===Ye)break}let Le=Ce(ie);for(let[Xe,Ye]of Le.envAssignments)fe.set(Xe,Ye),Re.set(Xe,Ye);return{words:Le.words,envAssignments:fe,cwd:ke,envSplitValues:Te.length>0?Te:void 0,rewritten:cv(Le.words,oe)}}function cv(G,H){return G.some((j)=>!H.has(j))}function Om(G){return G.map(t).join(" ")}function po(G){let H=G[0];return H?t(H):""}function Bn(G,H){let j=G[H];return j?t(j):void 0}function dv(G){return Mm.test(po(G))}function uv(G,H,j){if(!G.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${H.get("TMPDIR")??j.get("TMPDIR")??""}${G.slice(8)}`}}var mv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function fv(G,H,j){let J=1,oe=j;while(J<G.length){let ie=Bn(G,J);if(!ie)break;if(ie==="--")return{words:G.slice(J+1),cwd:oe};if(!ie.startsWith("-"))break;if(ie==="-D"||ie==="--chdir"){let fe=Bn(G,J+1);oe=fe?li(oe,fe,H):null,J+=2;continue}if(ie.startsWith("--chdir=")){oe=li(oe,ie.slice(8),H),J++;continue}if(ie.startsWith("-D")&&ie.length>2){oe=li(oe,ie.slice(2),H),J++;continue}if(ie==="-i"||ie==="--login"){oe=null,J++;continue}if(mv.has(ie)){J+=2;continue}J++}return{words:G.slice(J),cwd:oe}}var pv=new Set(["-i","-0","--null"]),gv=new Set(["-u","--unset","-C","--chdir","-P"]);function hv(G,H,j,J){let oe=new Map,ie=[],fe=H,Re=1,Te=(ke)=>({words:G.slice(ke),envAssignments:oe,cwd:fe,envSplitValues:ie.length>0?ie:void 0});while(Re<G.length){let ke=Bn(G,Re);if(!ke)break;if(ke==="--")return Te(Re+1);if(ke==="-i"||ke==="--ignore-environment"||ke==="-"){oe.clear();for(let Xe of j.keys())oe.set(Xe,"");oe.set("TMPDIR",""),Re++;continue}if(pv.has(ke)){Re++;continue}if(ke==="-u"||ke==="--unset"){let Xe=Bn(G,Re+1);if(Xe!==void 0)oe.set(Xe,"");Re+=2;continue}if(ke.startsWith("-u")&&ke.length>2&&!ke.startsWith("-u=")){oe.set(ke.slice(2),""),Re++;continue}if(ke.startsWith("--unset=")){oe.set(ke.slice(8),""),Re++;continue}let Le=ke==="-S"||ke==="--split-string"?{value:Bn(G,Re+1),consumed:2}:ke.startsWith("-S")&&ke.length>2?{value:ke.slice(2),consumed:1}:ke.startsWith("--split-string=")?{value:ke.slice(15),consumed:1}:null;if(Le){if(Le.value!==void 0)ie.push(Le.value);return fe=null,Te(Re+Le.consumed)}if(gv.has(ke)){if(ke==="-C"||ke==="--chdir"){let Xe=Bn(G,Re+1);fe=Xe?li(fe,Xe,J.paths):null}Re+=2;continue}if(ke.startsWith("-u=")){Re++;continue}if(ke.startsWith("-C")&&ke.length>2||ke.startsWith("--chdir=")){let Xe=ke.startsWith("--chdir=")?ke.slice(8):ke.startsWith("-C=")?ke.slice(3):ke.slice(2);fe=li(fe,Xe,J.paths),Re++;continue}if(ke.startsWith("-P")){Re++;continue}if(ke.startsWith("-")){Re++;continue}if(!Ln(ke))break;while(Re<G.length){let Xe=Ln(Bn(G,Re)??"");if(!Xe)break;oe.set(Xe.name,Xe.value),Re++}if(Bn(G,Re)==="--")Re++;return Te(Re)}return Te(Re)}function li(G,H,j){if(H==="")return null;if(!G&&!km(H))return null;let J=km(H)?lv(H).root:j.realpath(G??"/");if(J===null)return null;try{return gr(J,H,j)}catch{return null}}function yv(G){if(Bn(G,1)==="-v")return[...Jt(["type"]),...G.slice(2)];let H=1;while(H<G.length){let j=Bn(G,H);if(!j)break;if(j==="-p"||j==="-v"||j==="-V"){H++;continue}if(j==="--")return G.slice(H+1);if(j.startsWith("-")&&!j.startsWith("--")&&j.length>1){if(!/^[pvV]+$/.test(j.slice(1)))break;H++;continue}break}return G.slice(H)}var Cv=/['"\\$`{}#]/;function bs(G,H){if(G.some((J)=>Cv.test(J)))return null;let j=[...G.flatMap((J)=>J.split(/\s+/).filter((oe)=>oe.length>0)),...H];return j.length<=64?j:null}function hr(G,H,j){return vs(G,H,j).tokens}function Sv(G){let H=[],j="",J=0;while(J<G.length){let oe=G.charAt(J);if(oe==='"'||oe==="'"){let ie=G.indexOf(oe,J+1);if(ie===-1)return G.split(/\s+/).map((fe)=>fe.replace(/["']/g,"")).filter((fe)=>fe.length>0);j+=G.slice(J+1,ie),J=ie+1;continue}if(/\s/.test(oe)){if(j.length>0)H.push(j);j="",J++;continue}j+=oe,J++}if(j.length>0)H.push(j);return H}function yr(G,H,j,J=0){let oe=vs(G,H,j),ie=(oe.envSplitValues??[]).flatMap(Sv);if(ie.length===0)return oe.tokens;let fe=[...ie,...oe.tokens];if(J>=8)return fe;return yr(fe,H,j,J+1)}function vs(G,H,j,J){if(!Dm(G[0]??""))return{tokens:[...G],envAssignments:new Map,cwd:j};let oe=Wr(Jt(G),H,j,J);return{tokens:oe.words.map(t),envAssignments:oe.envAssignments,cwd:oe.cwd,envSplitValues:oe.envSplitValues}}var Fl=Symbol("adopt-as-operand"),bv=new Set(["env","sudo","command","builtin"]),vv=new Set(["&&","||","|&","|","&",";"]),Ev=new Set(["<<","<<<",">|"]),Nm=new Set(["|","|&"]),Rv=/[*@#?$!_-]/,_v=/^\w+(?::\w+)*/,xv=Object.freeze([]),ci=Object.freeze({kind:"scope",edge:"enter"}),di=Object.freeze({kind:"scope",edge:"exit"}),wv=Object.freeze([]),Av=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ui=new Set(["bash","sh","zsh","dash","ksh"]),Pv=256,zm=new WeakMap;function $m(G,H){let j=H.status==="complete"?new Set(Wl(H)):new Set,J=kv(G,j);if(ji(J))return Es("unclosed-quote",J,H);let oe={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},ie=Fr(H,{source:J,suppressed:j,flags:oe,depth:0,functions:new Map,powershell:H.dialect==="powershell"});if(oe.limited)return Es("structural-limit",J,H);if(oe.invalid)return Es("invalid",J,H);let fe=Es("complete",J,H,oe.assignmentFallbacks);return zm.set(fe,Object.freeze(ie)),fe}function xs(G,H,j,J,oe){let ie=oe.word??((Qe)=>Qe),fe={cwd:H,variables:new Map,previous:null},Re=[],Te=new Set,ke=null,Le=[],Xe=Bm(G),Ye=Xe.findLastIndex((Qe)=>Qe.kind==="operator"&&Nm.has(Qe.operator)),Ze=Ye!==-1&&Xe.some((Qe)=>Qe.kind==="redirection"&&Qe.operator==="<<"&&Qe.body===void 0);for(let[Qe,et]of Xe.entries()){let tt=Ze||Qe<=Ye;if(et.kind==="scope"){if(et.edge==="enter"){Le.push({state:fe,segment:[...Re],shellWords:new Set(Te),pipeProducer:ke});continue}let gt=oe.segment(Re,fe,ke,null,Te,tt);if(gt)return gt;let _t=Le.pop();if(_t===void 0)throw Error("scope exit without a matching enter");fe=_t.state,Re=_t.segment,Te=_t.shellWords,ke=_t.pipeProducer;continue}if(et.kind==="operator"){if(!et.boundary)continue;let gt=oe.segment(Re,fe,ke,et.operator,Te,tt);if(gt)return gt;fe=Tv(Re,fe,j,J),ke=Re.length>0&&Nm.has(et.operator)?Re:null,Re=[],Te=new Set;continue}if(et.kind==="redirection"){if(et.fd!==void 0)Te.add(Re.length-1);if(et.target===void 0)continue;let gt=oe.redirection({operator:et.operator,role:et.role,targetOrder:et.targetOrder,target:et.target,...et.body===void 0?{}:{body:et.body,consumer:et.consumer}},fe,tt);if(gt===Fl){Te.add(Re.length),Re.push(ie(et.target));continue}if(gt)return gt;continue}Re.push(ie(et.text))}return oe.segment(Re,fe,ke,null,Te,Ze)}function ws(G){return Bm(G).flatMap((H)=>{if(H.kind==="word")return[{kind:"word",text:H.text}];if(H.kind==="operator")return[{kind:"operator",boundary:H.boundary}];if(H.kind==="redirection")return[{kind:"redirection",target:H.target}];return[]})}function Sn(G,H){return G.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(j,J,oe,ie)=>{let fe=H.get(J);if(fe===void 0)return j;let Re=oe.startsWith(":")?fe!=="":!0;if(oe.endsWith("-"))return Re?fe:Sn(ie,H);return Re?Sn(ie,H):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(j,J)=>H.get(J)??j).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(j,J)=>H.get(J)??j)}function mi(G){return G.length>0&&G.every((H)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(H))}function Tv(G,H,j,J){let oe=mi(G)?new Map([...H.variables,...Iv(G,H.variables)]):H.variables,ie=hr([...G],j),fe=Wt(ie[0]??"").toLowerCase()==="cd"?ie[1]:void 0;if(!fe)return{...H,variables:oe};if(fe==="-"){if(H.previous===null)return{...H,variables:oe};return{cwd:H.previous,variables:oe,previous:H.cwd}}return{cwd:gn(Sn(fe,oe),H.cwd,j,J),variables:oe,previous:H.cwd}}function Iv(G,H){return G.flatMap((j)=>{let J=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(j),oe=J?.[2]?.startsWith("=")?J[2].slice(1):void 0;return J?.[1]!==void 0&&oe!==void 0?[[J[1],Sn(oe,H)]]:[]})}function Bm(G){return zm.get(G)??xv}function kv(G,H){return[...H].reduce((j,J)=>j.slice(0,J.start)+" ".repeat(J.end-J.start)+j.slice(J.end),G)}function Es(G,H,j,J=wv){return Object.freeze({status:G,source:H,program:j,assignmentFallbacks:Object.freeze(J)})}function Fr(G,H){return G.nodes.flatMap((j,J)=>Ov(j,G,J,H)).sort((j,J)=>j.start-J.start).flatMap((j)=>[...j.events])}function Ov(G,H,j,J){if(G.kind==="connector")return[{start:G.span.start,events:[Un(Wv(G.operator))]}];if(G.kind==="unknown")return[{start:G.span.start,events:[Un(G.source)]}];if(G.kind==="function")return J.functions.set(G.name,G.body),[];if(G.kind==="group"){let ie=G.style!=="subshell",fe=J.source[G.span.end-1]===(ie?"}":")"),Re=ie?J:{...J,functions:new Map(J.functions)};return[{start:G.span.start,events:ie?[Rs("{"),...Fr(G.body,Re),...fe?[Rs("}")]:[]]:[ci,Un("("),...Fr(G.body,Re),...fe?[Un(")")]:[],di]}]}let oe=$v(G,J.functions);if(oe){if(J.depth>=pr.maxDepth||++J.flags.expansions>Pv)return J.flags.limited=!0,[];return[{start:G.span.start,events:[...Lm(G,J),Rs(";"),...Fr(oe,{...J,depth:J.depth+1}),Rs(";")]},...Wm(G,H,j,J)]}return[{start:G.span.start,events:Lm(G,J)},...Wm(G,H,j,J)]}function Lm(G,H){return[...G.words.map((j)=>({start:j.span.start,events:Hm(j,G,H,!1)})),...G.redirections.map((j)=>({start:j.span.start,events:Mv(j,G,H)}))].sort((j,J)=>j.start-J.start).flatMap((j)=>j.events)}function Mv(G,H,j){let J=G.operator==="<<-"?"<<":G.operator,oe=G.target?Hm(G.target,H,j,!0):[],ie=oe[0],fe=ie?.kind==="word"?ie.text:void 0;return[...G.fd===void 0?[]:[Gl(String(G.fd))],Object.freeze({kind:"redirection",operator:J,...G.fd===void 0?{}:{fd:G.fd},role:Fv(J),targetOrder:Ev.has(J)?"legacy-segment":"immediate",...fe===void 0?{}:{target:fe},...G.heredoc&&j.suppressed.has(G.heredoc.bodySpan)?{body:G.heredoc.body,consumer:Vm(H)}:{}}),...fe===void 0?oe:oe.slice(1)]}function Wm(G,H,j,J){let oe=G.redirections.filter((ie)=>ie.operator==="<<"||ie.operator==="<<-");return[...oe.flatMap((ie)=>{let fe=ie.heredoc;if(!fe)return[];let Re=[Gl(fe.delimiter),.../[\r\n]/.test(J.source[fe.terminatorSpan.end]??"")?[Un(";")]:[]];if(J.suppressed.has(fe.bodySpan))return[{start:fe.bodySpan.start,events:Re}];return[{start:fe.bodySpan.start,events:[...Um(J.source.slice(fe.bodySpan.start,fe.bodySpan.end),J),...Re]}]}),...oe.some((ie)=>!ie.heredoc&&ie.target)?Dv(H,j,J):[]]}function Dv(G,H,j){let J=G.nodes.slice(H+1).find((oe)=>oe.kind==="connector");if(!J||J.span.end>=G.span.end)return[];return[{start:J.span.end,events:Um(j.source.slice(J.span.end,G.span.end),j)}]}function Um(G,H){if(H.depth>=pr.maxDepth)return H.flags.limited=!0,[];let j=y(G,"posix");if(j.status==="limited")return H.flags.limited=!0,[];let J={invalid:!1,limited:!1,expansions:H.flags.expansions,assignmentFallbacks:H.flags.assignmentFallbacks},oe=Fr(j,{source:G,suppressed:new Set,flags:J,depth:H.depth+1,functions:new Map,powershell:!1});return H.flags.limited||=J.limited,H.flags.expansions=J.expansions,oe}function Hm(G,H,j,J){let oe=[],ie={single:!1,double:!1},fe="",Re=!1,Te=()=>{let ke=Re&&!J?Un("glob"):fe!==""||G.quoted&&oe.length===0?Gl(fe):void 0;if(ke)oe.push(ke);fe="",Re=!1};for(let ke of G.parts){if(ke.provenance!=="command-substitution"&&ke.provenance!=="arithmetic"){for(let Ze of Ll(ke.raw,ie,j.flags,j.powershell)){if(typeof Ze==="string"){Te(),oe.push(Un(Ze));continue}fe+=Ze.text,Re||=Ze.glob}continue}let Le=H.nested.find((Ze)=>Ze.span.start>=ke.span.start&&Ze.span.end<=ke.span.end);if(ie.double){let Ze=j.source.slice(ke.span.start,ke.span.end);fe+=Ll(Ze,{single:!1,double:!0},j.flags,j.powershell).map((et)=>typeof et==="string"?et:et.text).join("");let Qe=Le?Fr(Le,j).filter((et)=>et.kind==="redirection"&&et.body!==void 0):[];if(Qe.length>0)oe.push(ci,...Qe,di);continue}let Xe=Le?Fr(Le,j):[];if(ke.raw.startsWith("`")){fe+="${}",Te(),oe.push(ci,...Xe,di);continue}if(ke.raw.startsWith("<(")||ke.raw.startsWith(">(")){Te(),oe.push(ke.raw.startsWith("<(")?Un("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),ci,...Xe,...ke.raw.endsWith(")")?[Un(")")]:[],di);continue}let Ye=ke.raw.startsWith("$((")?2:1;fe+="${}",Te(),oe.push(...Array.from({length:Ye},()=>Un("(")),...Ye===1?[ci]:[],...Xe,...ke.raw.endsWith(")".repeat(Ye))?Array.from({length:Ye},()=>Un(")")):[],...Ye===1?[di]:[])}return Te(),oe}function Ll(G,H,j,J){let oe=[],ie="",fe=!1,Re=0;while(Re<G.length){let Te=G[Re]??"";if(!H.single&&!H.double&&(Te==="("||Te===")")){oe.push({text:ie,glob:fe},Te),ie="",fe=!1,Re++;continue}if(J&&Te==="`"&&!H.single){ie+=G[Re+1]??"",Re+=2;continue}if(H.single&&Te==="'"){H.single=!1,Re++;continue}if(H.single){ie+=Te,Re++;continue}if(H.double){if(Te==='"'){H.double=!1,Re++;continue}if(!J&&Te==="\\"){let ke=G[Re+1]??"";ie+=['"',"\\","$"].includes(ke)?ke:`\\${ke}`,Re+=2;continue}if(Te==="$"){let ke=Fm(G,Re,H,j,J);ie+=ke.text,Re=ke.next;continue}ie+=Te,Re++;continue}if(Te==="'"||Te==='"'){H.single=Te==="'",H.double=Te==='"',Re++;continue}if(!J&&Te==="\\"){let ke=G[Re+1]??"";fe||=ke==="*"||ke==="?",ie+=ke,Re+=2;continue}if(Te==="$"){let ke=Fm(G,Re,H,j,J);ie+=ke.text,Re=ke.next;continue}fe||=Te==="*"||Te==="?",ie+=Te,Re++}return[...oe,{text:ie,glob:fe}]}function Fm(G,H,j,J,oe){let ie=G[H+1];if(ie==="{"){let Re=oe?Lv(G,H+2):us(G,H+2,G.length).close;if(Re===-1)return J.invalid=!0,{text:"",next:G.length};let Te=G.slice(H,Re+1);return Nv(Te,j,J,oe),{text:Te,next:Re+1}}if(ie!==void 0&&Rv.test(ie))return{text:`\${${ie}}`,next:H+2};let fe=(oe?_v:/^\w*/).exec(G.slice(H+1))?.[0]??"";return{text:`\${${fe}}`,next:H+1+fe.length}}function Nv(G,H,j,J){let oe=G.slice(2,-1),ie=/^[A-Za-z_][A-Za-z0-9_]*/.exec(oe)?.[0];if(!ie)return;let fe=oe.slice(ie.length),Re=[":=","="].find((ke)=>fe.startsWith(ke));if(!Re)return;let Te=Ll(fe.slice(Re.length),{...H},j,J);j.assignmentFallbacks.push(...Te.flatMap((ke)=>typeof ke==="string"||!ke.text?[]:[ke.text]))}function Lv(G,H){let j=1,J=H;while(j>0&&J<G.length){if(G[J]==="{"&&G[J-1]==="$")j++;if(G[J]==="}")j--;J++}return j===0?J-1:-1}function Wv(G){return/^[\r\n]+$/.test(G)?";":G}function Un(G){return Object.freeze({kind:"operator",operator:G,boundary:vv.has(G)})}function Rs(G){return Object.freeze({kind:"operator",operator:G,boundary:!0})}function Gl(G){return Object.freeze({kind:"word",text:G})}function Fv(G){if(G==="<<"||G==="<<<")return"here-data";if(G==="<"||G==="<&")return"file-read";return"file-write"}function go(G){return Av.has(G)||/^python\d/.test(G)}var Gv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function jm(G,H){let j=H[0];if(j===void 0||!j.startsWith("-"))return H;let J=Gv.get(G)?.has(j)??!1;return jm(G,H.slice(J?2:1))}function _s(G){let H=G[0];if(H===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(H))return _s(G.slice(1));if(H==="uv"&&G[1]==="run")return _s(G.slice(2));if(!bv.has(H))return[...G];return _s(jm(H,G.slice(1)))}function Vm(G){let H=Xo(G),j=G.words.findIndex((J)=>J.provenance==="literal"&&J.text===H);return _s(j<0?[]:G.words.slice(j).map((J)=>J.text))}function zv(G){let H=Vm(G)[0];if(H===void 0)return!1;let j=Wt(H).toLowerCase();return go(j)&&!ui.has(j)}function Wl(G){return G.nodes.flatMap((H,j)=>{if(H.kind==="group"||H.kind==="function")return Wl(H.body);if(H.kind!=="command")return[];let J=H.nested.flatMap((Re)=>Wl(Re)),oe=H.redirections.flatMap((Re)=>Re.heredoc?.quotedDelimiter?[Re.heredoc.bodySpan]:[]);if(zv(H))return[...J,...oe];let ie=G.nodes[j+1];if(ie?.kind==="connector"&&(ie.operator==="|"||ie.operator==="|&")||!Uv(H))return J;return[...J,...oe]})}function $v(G,H){let j=Xo(G);return j===void 0?void 0:H.get(j)}function Cr(G,H){return G!==void 0&&G.provenance==="literal"&&!G.quoted&&G.raw===G.text&&G.text===H}function Bv(G){if(Cr(G.words[0],"git"))return Cr(G.words[1],"commit");if(!Cr(G.words[0],"gh")||!Cr(G.words[2],"create"))return!1;return Cr(G.words[1],"pr")||Cr(G.words[1],"issue")}function Uv(G){return(Cr(G.words[0],"cat")||Cr(G.words[0],"tee")||Bv(G))&&!G.words.some(Gm)&&!G.redirections.some((j)=>Gm(j.target))}function Gm(G){return G?.parts.some((H)=>H.provenance==="command-substitution"&&H.raw.startsWith(">("))??!1}var Yn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",As="Unsupported heredoc syntax",fi="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function ho(){return{id:"analysis.dynamic-shell-source",reason:fi,intent:"stop_and_explain"}}var Km="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var zl=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Hv=new Set([...zl,"dir_path","glob","glob_pattern","include_pattern"]),jv=new Set([...zl,"folder","glob","pattern","patterns"]);class b extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class U extends Error{name="UnparseableCommandError";constructor(){super(Yn)}}function qm(G){let H=Vv(),j=se(G.input),J=[];if((G.route.kind==="command"||G.route.kind==="unknown")&&j)J.push({usage:"input-candidate",source:j});if(G.route.kind==="command"&&"command"in G&&G.command)J.push({usage:"declared-command",source:G.command});let oe=J.reduce((ie,fe)=>{let Re=ie.findIndex((Le)=>Le.source===fe.source);if(Re!==-1){let Le=ie[Re];if(!Le)return ie;return ie[Re]={...Le,usages:[...Le.usages,fe.usage]},ie}let Te=G.route.kind==="command"?G.route.shell:process.platform==="win32"?"powershell":"posix",ke=H.getCommandProgram(fe.source,Te);return ie.push({usages:[fe.usage],source:fe.source,program:ke,shell:H.getShellSyntax(fe.source,ke)}),ie},[]);return{invocation:{toolName:G.toolName,route:G.route,context:G.context},commands:oe,paths:Kv(G),store:H}}function bn(G,H){return G.commands.find((j)=>j.usages.includes(H))}function sr(G,H){if(!G.includes("$"))return G;return ba(G,H)}function Vv(){let G=new Map,H=new WeakMap,j=(oe,ie)=>{let fe=`${ie}\x00${oe}`,Re=G.get(fe);if(Re)return Re;let Te=y(oe,ie);return G.set(fe,Te),Te};return{getShellSyntax:(oe,ie)=>{if(ie&&ie.source!==oe)throw TypeError("Shell syntax source does not match command program source.");let fe=ie??j(oe,"posix"),Re=H.get(fe);if(Re)return Re;let Te=fe.status==="limited"?{status:"structural-limit",source:oe,program:fe,assignmentFallbacks:[]}:$m(oe,fe);return H.set(fe,Te),Te},getCommandProgram:j}}function Kv(G){let H=G.route.kind==="grep"?Hv:G.route.kind==="glob"?jv:zl;return[...vd(G.input,H),...G.route.kind==="patch"||typeof G.input==="string"?_d(G.input):[]]}var qv=new Set(["-S","--suffix"]);function yo(G,H,j,J,oe){if(G.status==="structural-limit")throw new b;if(G.status!=="complete")return oe.findMalformedTarget(G.source);return xs(G,H,j,J,{segment:(ie,fe)=>oe.findSegmentTarget(ie,fe),redirection:(ie,fe)=>ie.role==="file-write"&&oe.isRedirectionTarget(Sn(ie.target,fe.variables),fe)?ie.target:null})}function Ps(G){let H=[],j=null,J=!1;for(let oe=0;oe<G.length;oe++){let ie=G[oe];if(ie===void 0)break;if(!J&&ie==="--"){J=!0;continue}if(!J&&(ie==="-t"||ie==="--target-directory")){j=G[++oe]??null;continue}if(!J&&ie.startsWith("--target-directory=")){j=ie.slice(19);continue}if(!J&&ie.startsWith("-t")&&ie.length>2){j=ie.slice(2);continue}if(!J&&qv.has(ie)){oe++;continue}if(!J&&(ie.startsWith("--suffix=")||ie.startsWith("--backup=")))continue;if(!J&&ie.startsWith("-"))continue;H.push(ie)}return j?{sources:H,destination:j}:{sources:H.slice(0,-1),destination:H.at(-1)??null}}var v="Git metadata and hooks are protected. Ask the user before modifying them.";function Jm(G,H,j,J){let oe=G.invocation.context.executionCwd;if(!H)return null;if(G.invocation.route.kind==="patch"||G.invocation.route.kind==="path"||G.invocation.route.kind==="unknown"){if(Ni(G.invocation.toolName))return null;let Re=G.paths.find((Te)=>Ym(Te,oe,H,j,J,H.entries));return Re?{target:Re}:null}if(G.invocation.route.kind!=="command")return null;let ie=bn(G,"input-candidate");if(!ie)return null;let fe=yo(ie.shell,oe,j,J,{findSegmentTarget:(Re,Te)=>oE(Re,Te,H,j,J),isRedirectionTarget:(Re,Te)=>Ym(Re,Te.cwd,H,j,J,H.markerFiles),findMalformedTarget:()=>null});return fe?{target:fe}:null}function Gr(G,H,j,J,oe,ie,fe=!1){if(!j)return!1;let Re=Is(gn(G,H,oe,ie)),Te=Re.replace(/(\/\.?\*+)+$/,"");if(Te!==Re&&Te!==""){if($l(Te,j))return!0;let ke=fe||Re.slice(Te.length).includes("/."),Le=(Xe)=>ke?Ts(Xe,Te):Qv(Xe,Te);if(j.markerFiles.some(Le))return!0;return J&&Bl(j).some(Le)}if($l(Re,j))return!0;return J&&Bl(j).some((ke)=>Ts(ke,Re))}function Qv(G,H){let j=Xm(H,G);if(j===""||j.startsWith("..")||Zm(j))return!1;return!j.split(/[\\/]/)[0]?.startsWith(".")}function eE(G,H,j,J,oe){return Gr(G,H,j,!0,J,oe)}function tE(G,H,j,J,oe){if(!j)return!1;return $l(Is(gn(G,H,J,oe)),j)}function Ym(G,H,j,J,oe,ie){let fe=Is(gn(G,H,J,oe));return ie.includes(fe)||ef(fe,j)}function Qm(G,H,j,J,oe){if(!j)return!1;return j.hooksDirectories.some((ie)=>G.some((fe)=>Ts(ie,Is(gn(fe,H,J,oe)))))}function $l(G,H){return H.entries.includes(G)||H.directories.includes(G)||ef(G,H)}function ef(G,H){return H.hooksDirectories.some((j)=>Ts(G,j))}var nE=50000;function tf(G,H){let j=[...new Set(Bl(G))];if(j.some((oe)=>H(Xv(oe))))return!0;let J=0;while(j.length>0){let oe=j.pop()??"",ie=rE(oe);if(!ie)return!0;if(J+=ie.length,J>nE)return!0;if(ie.some((fe)=>H(fe.name)))return!0;j.push(...ie.filter((fe)=>fe.isDirectory()).map((fe)=>Jv(oe,fe.name)))}return!1}function rE(G){try{let H=Yv(G,{throwIfNoEntry:!1});if(!H)return[];if(!H.isDirectory())return H.isSymbolicLink()?null:[];return Zv(G,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Bl(G){return[...G.entries,...G.directories,...G.hooksDirectories]}function Ts(G,H){let j=Xm(H,G);return j===""||!/^\.\.(?:[\\/]|$)/.test(j)&&!Zm(j)}function Is(G){return process.platform==="win32"?G.toLowerCase():G}function oE(G,H,j,J,oe){if(mi(G))return null;let ie=yr([...G],J);if(Wt(ie[0]??"").toLowerCase()!=="mv")return null;let fe=Ps(ie.slice(1)),Re=fe.sources.find((Te)=>eE(Sn(Te,H.variables),H.cwd,j,J,oe));if(Re)return Re;return fe.destination&&tE(Sn(fe.destination,H.variables),H.cwd,j,J,oe)?fe.destination:null}import{isAbsolute as Ds,normalize as mE,parse as fE,posix as df,resolve as $r,sep as Vl}from"node:path";import{isAbsolute as iE,join as nf,normalize as sf,parse as sE,sep as rf}from"node:path";var aE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],lE=` 	
-`;function pi(G,H){if(zr(G,H))return!0;if(!G.has("TMPDIR"))return!1;return!Ul(G.get("TMPDIR")??"",H)}function Co(G,H){if(G.has("TMPDIR"))return Ul(G.get("TMPDIR")??"",H);let j=Hl(G,H);if(j===void 0)return!0;return Ul(j,H)}function Hl(G,H){return lf(G,H,"TMPDIR")}function Ul(G,H){if(!G)return!1;if(dE(G))return!1;return So(G,H)}function zr(G,H){let j=lf(G,H,"IFS");return j!==void 0&&j!==""&&j!==lE}function So(G,H){let j=ks(G,H.paths);if(j===null)return!1;return af(H).some((J)=>bo(j,J))}function Ms(G,H){let j=ks(G,H.paths);if(j===null)return!1;return af(H).some((J)=>Os(J)===Os(j))}var of=new WeakMap;function af(G){let H=of.get(G);if(H)return H;let j=cE(G);return of.set(G,j),j}function cE(G){let H=aE.map((J)=>ks(J,G.paths)??sf(J)),j=ks(G.tmpdir,G.paths);if(!j)return H;if(process.platform==="win32")return[...H,j];if(process.platform==="darwin"&&uE(j))return[...H,j];return H}function dE(G){return/[\s$`*?[]/.test(G)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(G)||/[+@!]\([^)]*\)/.test(G)}function lf(G,H,j){return G.has(j)?G.get(j):H.env.get(j)}function uE(G){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(G)}function ks(G,H){try{let j=sf(G);if(!iE(j))return j;let J=sE(j).root,oe=j.slice(J.length).split(/[\\/]+/).filter(Boolean),ie=J;for(let fe=0;fe<oe.length;fe++){let Re=nf(ie,oe[fe]??"");if(H.entryKind(Re)==="missing")return nf(Re,...oe.slice(fe+1));let Te=H.realpath(Re);if(Te===null)return null;ie=Te}return ie}catch{return null}}function bo(G,H){let j=Os(G),J=Os(H);if(j===J)return!0;let oe=J.endsWith(rf)?J:`${J}${rf}`;return j.startsWith(oe)}function Os(G){return process.platform==="win32"?G.toLowerCase():G}var pE=process.platform==="win32",cf=64,gE=16384;function Br(G,H,j,J){if(G.kind==="temp_target")return null;let oe=J[G.kind];if(G.kind==="dynamic_target"&&!rn(j,oe.id,H.strict))return null;if(G.kind==="within_anchored_cwd"&&!rn(j,oe.id,H.paranoid))return null;return Pt(oe.id,oe.reason)}function gi(G){let H=Ku(G,cf,cf,gE);return{expandedTargets:H&&"words"in H?H.words:void 0,unsafeBraceExpansion:H!==void 0&&"limited"in H,targetIsLiteral:H===void 0&&G.provenance==="literal"&&(G.quoted||G.raw!==G.text),tmpdirWordSplittingProtected:hE(G)}}function hE(G){let H=G.parts.filter((j)=>j.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(j.raw));return H.length>0&&H.every((j)=>yE(G.raw,j.span.start-G.span.start))}function yE(G,H){let j=null,J=!1;for(let oe=0;oe<H;oe++){let ie=G[oe];if(J){J=!1;continue}if(ie==="\\"&&j!=="'"){J=!0;continue}if(j===ie){j=null;continue}if(j===null&&(ie==="'"||ie==='"'))j=ie}return j==='"'}function Zn(G){let H=G.environment.home,j=G.environment.paths,J=G.budget??On();return{anchoredCwd:G.originalCwd??G.cwd??null,resolvedCwd:G.cwd??null,strict:G.strict??!1,paranoid:G.paranoid??!1,trustTmpdirVar:G.allowTmpdirVar??!0,posixShell:G.posixShell??!1,tmpdirWordSplittingUnsafe:G.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:G.trustedTmpdirValue??G.allowTmpdirVar??!0,environment:G.environment,allowRoots:RE(G.allowPaths,H,j,J),protectedGitMetadata:G.protectedGitMetadata,budget:J}}function Tn(G,H,j={}){let J=j.targetIsLiteral??!1;if(!J&&H.tmpdirWordSplittingUnsafe&&!j.tmpdirWordSplittingProtected&&xE(G))return{kind:"outside_anchored_cwd"};let oe=!J&&mf(G,H.posixShell);if(tr(G))return{kind:"outside_anchored_cwd"};if(Kl(G,J))return{kind:"root_or_home_target"};if(SE(G,H,J))return{kind:"root_or_home_target"};if(H.resolvedCwd&&Gr(G,H.resolvedCwd,H.protectedGitMetadata,!0,H.environment,H.budget,!H.posixShell))return{kind:"git_metadata_target"};if(bE(G,H.trustTmpdirVar,H.posixShell,oe,J,j.tmpdirWordSplittingProtected??!1,H.trustedTmpdirValue,H.environment))return{kind:"temp_target"};if(oe)return{kind:"dynamic_target"};if(_E(G,H,J))return{kind:"temp_target"};let ie=H.anchoredCwd;if(ie){if(!j.skipHomeCwd&&TE(ie,H.environment.home,H.environment.paths,H.budget))return{kind:"home_cwd_target"};if(!j.skipCwdSelf&&[H.resolvedCwd??ie,ie].some((fe)=>IE(G,H.resolvedCwd??ie,H.environment.paths,H.budget,fe)))return{kind:"cwd_self_target"};if(kE(G,ie,H.resolvedCwd??ie,oe,J,H.environment.paths,H.budget))return{kind:"within_anchored_cwd"}}if(CE(G,H,oe))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function CE(G,H,j){let J=G.trim();if(j||!H.resolvedCwd||!H.anchoredCwd||!J)return!1;if(Ds(J)||J.startsWith("~"))return!1;if(ql(J))return!1;if(ff(H.resolvedCwd,H.anchoredCwd,H.environment.paths,H.budget))return!1;return So($r(H.resolvedCwd,J),H.environment)}function uf(G,H,j={}){let{containmentTarget:J,...oe}=j;if(Tn(G,H,oe).kind!=="temp_target")return!1;let ie=G.trim();if(EE(ie))return!1;if(Ms(ie,H.environment))return!1;return![H.anchoredCwd,H.resolvedCwd].some((fe)=>ff(J??ie,fe,H.environment.paths,H.budget))}function Kl(G,H=!1){let j=G.trim(),J=df.normalize(j),oe=j.replace(/\\/g,"/"),ie=J==="/"?J:J.replace(/\/+$/,"");if(ie==="/"||ie.startsWith("/")&&ie.slice(1).split("/").every((fe)=>/^\*+$/.test(fe)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(oe)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(oe))return!0;if(!H&&(J==="~"||J==="~/"||J==="~/*"))return!0;if(!H&&(J==="$HOME"||J==="$HOME/"||J==="$HOME/*"))return!0;if(!H&&(J==="${HOME}"||J==="${HOME}/"||J==="${HOME}/*"))return!0;return!1}function SE(G,H,j){let J=G.trim(),oe=j?J:J==="*"?".":J.endsWith("/*")?J.slice(0,-2):J;if(!oe)return!1;try{let ie=Ds(oe)?oe:H.resolvedCwd?$r(H.resolvedCwd,oe):null;if(!ie)return!1;let fe=vn(Bt(ie,H.environment.paths,H.budget));if(fe===fE(fe).root)return!0;return fe===vn(Bt(H.environment.home,H.environment.paths,H.budget))}catch{return!1}}function vn(G){let H=mE(G);if(pE){if(H=H.replace(/\//g,"\\").toLowerCase(),H.length>3&&H.endsWith("\\"))H=H.slice(0,-1);return H}if(H.length>1&&H.endsWith("/"))H=H.slice(0,-1);return H}function bE(G,H,j,J,oe,ie,fe,Re){let Te=G.trim();if(ql(Te))return!1;if(!J&&So(Te,Re))return!0;return(H||ie&&fe)&&j&&!oe&&vE(Te,j)}function vE(G,H){return["$TMPDIR","${TMPDIR}"].some((j)=>{if(G===j)return!0;if(!G.startsWith(`${j}/`))return!1;return!mf(G.slice(j.length+1),H)})}function EE(G){let H=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(G);if(!H)return!1;return df.normalize(`/${H[1]??""}`)==="/"}function ql(G){return G.split(/[\\/]+/).includes("..")}function RE(G,H,j,J){if(!G?.length)return[];return G.flatMap((oe)=>{let ie=Ko(oe.trim(),H);if(!Ds(ie))return[];try{let fe=Bt(ie,j,J);if(qo(fe,Bt(H,j,J)))return[];return[vn(fe)]}catch{return[]}})}function _E(G,H,j){if(H.allowRoots.length===0)return!1;let J=G.trim();if(ql(J))return!1;let oe=j?J:Ko(J,H.environment.home),ie=H.resolvedCwd??H.anchoredCwd,fe=Ds(oe)?oe:ie?$r(ie,oe):null;if(!fe)return!1;try{let Re=vn(Bt(fe,H.environment.paths,H.budget));return H.allowRoots.some((Te)=>Re===Te||Re.startsWith(Te.endsWith(Vl)?Te:`${Te}${Vl}`))}catch{return!1}}function xE(G){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(G)}function mf(G,H=!1){return G.includes("$")||G.includes("`")||wE(G)||H&&AE(G)}function wE(G){let H=!1;for(let j of G){if(H){H=!1;continue}if(j==="\\"){H=!0;continue}if(j==="*"||j==="?"||j==="[")return!0}return!1}function AE(G){let H=!1;for(let j=0;j<G.length;j++){let J=G[j];if(H){H=!1;continue}if(J==="\\"){H=!0;continue}if(J==="{"&&PE(G,j)||(J==="+"||J==="@"||J==="!")&&G[j+1]==="(")return!0}return!1}function PE(G,H){let j=G.indexOf("}",H+1);if(j===-1)return!1;let J=G.slice(H+1,j);return J.includes(",")||J.includes("..")}function TE(G,H,j,J){try{return vn(Bt(G,j,J))===vn(Bt(H,j,J))}catch{try{return vn(G)===vn(H)}catch{return!1}}}function IE(G,H,j,J,oe=H){if(oe===H&&(G==="."||G==="./"||G===".\\"))return!0;try{return vn(Bt($r(H,G),j,J))===vn(Bt(oe,j,J))}catch{try{return vn($r(H,G))===vn(oe)}catch{return!1}}}function kE(G,H,j,J,oe,ie,fe){let Re=j??H;if(!oe&&(G.startsWith("~")||G.startsWith("$HOME")||G.startsWith("${HOME}")))return!1;if(J)return!1;if(G.startsWith("/")||/^[A-Za-z]:[\\/]/.test(G))try{return jl(G,H,ie,fe)}catch{return!1}if(G.startsWith("./")||G.startsWith(".\\")||!G.includes("/")&&!G.includes("\\"))try{return jl($r(Re,G),H,ie,fe)}catch{return!1}if(G.startsWith("../"))return!1;try{return jl($r(Re,G),H,ie,fe)}catch{return!1}}function jl(G,H,j,J){try{return pf(Bt(G,j,J),Bt(H,j,J))}catch{return!1}}function ff(G,H,j,J){if(!H)return!1;try{return pf(Bt(H,j,J),Bt(G,j,J))}catch{return!0}}function pf(G,H){let j=vn(G),J=vn(H);return j.startsWith(`${J}${Vl}`)||j===J}var OE=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),gf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ME="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",hf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",yf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",DE="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",NE="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",LE={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:yf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:v},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:hf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:DE},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:gf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ME},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:gf}};function Cf(G,H,j){return WE(G.words.map((J)=>({kind:"word",text:J.text,dynamic:J.provenance!=="literal"})),H,Zn({...j,allowPaths:j.policy?.destructiveCommandAllowPaths}),j.policy)}function WE(G,H,j,J){let oe=G.filter((Te)=>Te.kind==="word"),ie=GE(oe),fe=oe[ie];if(!fe||!OE.has(qE(fe.text)))return null;let Re=FE(oe.slice(ie+1));if(Re.whatIfProtected)return null;if(rn(J,"powershell.remove-item-pipeline-dynamic-target",j.strict)&&H&&(Re.targets.length===0||Re.recursive))return Pt("powershell.remove-item-pipeline-dynamic-target",NE);for(let Te of Re.targets)if(!tr(Te.text)&&Kl(hi(Te.text)))return Pt(Re.recursive&&Re.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",yf);for(let Te of Re.targets)if(j.resolvedCwd&&Gr(hi(Te.text),j.resolvedCwd,j.protectedGitMetadata,Re.recursive,j.environment,j.budget,!0))return Pt("powershell.remove-item-git-metadata",v);if(!Re.recursive||!Re.force)return null;if(rn(J,"powershell.remove-item-recursive-force-dynamic-target",j.strict)&&(Re.hasDynamicTarget||Re.targets.length===0))return Pt("powershell.remove-item-recursive-force-dynamic-target",hf);for(let Te of Re.targets){let ke=Br(Tn(hi(Te.text),j),j,J,LE);if(ke)return ke}return null}function FE(G){let H=[],j=!1,J=!1,oe=!1,ie=!1,fe=!1;for(let Re=0;Re<G.length;Re++){let Te=G[Re];if(!Te||Te.kind!=="word")continue;if(zE(Te))continue;if(fe){H.push(Yl(Te)),ie=ie||Te.dynamic;continue}if(Te.text==="--"){fe=!0;continue}let ke=BE(Te.text);if(!ke){H.push(Yl(Te)),ie=ie||Te.dynamic;continue}if(UE(ke.name)){let Le=ke.value?$E(ke.value,Te):G[++Re];if(Le?.kind==="word"){H.push(Yl(Le)),ie=ie||Le.dynamic;continue}ie=!0;continue}if(HE(ke.name)){j=!0;continue}if(jE(ke.name)){J=!0;continue}if(VE(ke.name))oe=KE(ke.value)}return{targets:H,recursive:j,force:J,whatIfProtected:oe,hasDynamicTarget:ie}}function GE(G){let H=G[0];if(H?.kind==="word"&&H.text==="&"||H?.text===".")return G.length>1?1:0;return 0}function Yl(G){return{text:G.kind==="word"?G.text:"",dynamic:G.kind==="word"&&G.dynamic}}function zE(G){return G.kind==="word"&&G.text===","}function hi(G){let H=G.replace(/\\/g,"/"),j=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(H);return j?`$HOME${H.slice(j[0].length)}`:H}function $E(G,H){return{kind:"word",text:G,dynamic:H.kind==="word"&&(H.dynamic||G.includes("$"))}}function BE(G){if(!G.startsWith("-")||G==="-")return null;let H=G.slice(1),j=H.indexOf(":");if(j===-1)return{name:H.toLowerCase()};return{name:H.slice(0,j).toLowerCase(),value:H.slice(j+1)}}function UE(G){return"path".startsWith(G)||"literalpath".startsWith(G)}function HE(G){return"recurse".startsWith(G)}function jE(G){return G.length>=2&&"force".startsWith(G)}function VE(G){return G==="wi"||"whatif".startsWith(G)}function KE(G){if(G===void 0||G==="")return!0;let H=G.toLowerCase();return H==="$true"||H==="true"}function qE(G){return G.toLowerCase()}var YE=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),ZE=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),XE=new Set(["-o","--output","--query","--subscription"]),JE=new Set;function Sf(G){if(G==="aws")return YE;if(G==="gcloud")return ZE;if(G==="az")return XE;return JE}var QE=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),eR=new Set;function bf(G){if(G==="git")return xn;if(G==="docker")return QE;return eR}function N(G,H){if(G.length===0||H.length===0)return null;let j=Gt(G[0]??""),J=Cn(G);for(let oe of H){if(!rR(j,oe.command))continue;if(oe.match){if(tR(j,G,oe.match))return vf(oe);continue}if(!oR(j,G,oe.subcommand))continue;if(sR(G,new Set(oe.block_args),J))return vf(oe)}return null}function vf(G){return{id:`custom.${G.name}`,reason:`[${G.name}] ${G.reason}`,intent:G.intent??"manual_only"}}function tR(G,H,j){let J=H.slice(1);if(j.exclude_args?.some((oe)=>J.includes(oe)))return!1;if(j.any_args&&!j.any_args.some((oe)=>J.includes(oe)))return!1;return nR(J,j.command_path,Sf(G))}function nR(G,H,j){let J=0,oe=!1;for(let ie of G){if(J>=H.length)return!0;if(oe){oe=!1;continue}if(ie.startsWith("-")){oe=!ie.includes("=")&&j.has(ie);continue}if(ie!==H[J])return!1;J++}return J>=H.length}function rR(G,H){return G===Gt(H)}function oR(G,H,j){if(!j)return!0;return Ef(H,1,j,bf(G))}function Ef(G,H,j,J){let oe=!1;for(let ie=H;ie<G.length;ie++){let fe=G[ie];if(!fe)continue;if(oe){oe=!1;continue}if(fe==="--"){let Re=G[ie+1];if(Re&&!Re.startsWith("-"))return Re===j;return!1}if(J.has(fe)){oe=!0;continue}if(fe.startsWith("-")){if(!fe.includes("=")&&iR(G,ie,j,J))return!0;continue}return fe===j}return!1}function iR(G,H,j,J){let oe=G[H+1];if(!oe||oe.startsWith("-"))return!1;return Ef(G,H+2,j,J)}function sR(G,H,j){return G.some((J)=>H.has(J))||[...j].some((J)=>H.has(J))}var aR=new Set(["-e","--source"]),lR=new Set(["-F","-v","--assign","--field-separator"]),Rf=new Set(["-f","--file"]),cR=new Set(["print","printf","return"]),_f=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],dR="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function xf(G,H,j){let J=!1;for(let oe of uR(G)){let ie=mR(oe,j);if(!ie)continue;for(let fe of ie.commands){let Re=H(fe);if(Re)return Re;if(fe.includes("{}")||/[$`]/.test(fe))J=!0}J||=ie.dynamic}return J?Pt("awk.system-dynamic",dR):null}function Xl(G){let H=[],j=!1,J=!1,oe=!0,ie=!0;for(let fe=1;fe<G.length;fe++){let Re=G[fe];if(Re===void 0)break;if(oe&&Re==="--"){oe=!1;continue}if(oe&&aR.has(Re)){j=!0;let Te=G[fe+1];if(ie&&=Te!==void 0,Te!==void 0)H.push({tokenIndex:fe+1,kind:"inline-code",value:Te});fe++;continue}if(oe&&Re.startsWith("--source=")){j=!0,H.push({tokenIndex:fe,kind:"inline-code",value:Re.slice(9)});continue}if(oe&&Re.startsWith("-e")&&Re.length>2){j=!0,H.push({tokenIndex:fe,kind:"inline-code",value:Re.slice(2)});continue}if(oe&&(lR.has(Re)||Rf.has(Re))){let Te=G[fe+1];if(ie&&=Te!==void 0,Rf.has(Re)){if(J=!0,Te!==void 0)H.push({tokenIndex:fe+1,kind:"program-file",value:Te})}fe++;continue}if(oe&&(Re.startsWith("-F")||Re.startsWith("-v")&&Re.slice(2).includes("=")))continue;if(oe&&Re.startsWith("-f")&&Re.length>2){J=!0,H.push({tokenIndex:fe,kind:"program-file",value:Re.slice(2)});continue}if(oe&&(Re.startsWith("--assign=")||Re.startsWith("--field-separator=")))continue;if(oe&&Re.startsWith("--file=")){J=!0,H.push({tokenIndex:fe,kind:"program-file",value:Re.slice(7)});continue}if(oe&&Re.startsWith("-")&&Re!=="-")continue;if(!j&&!J)H.push({tokenIndex:fe,kind:"main-program",value:Re});return{sources:H,optionsOpen:!1}}return{sources:ie?H:[],optionsOpen:oe&&ie}}function Ci(G){return Xl(G).sources}function uR(G){return Ci(G).filter((H)=>H.kind!=="program-file").map((H)=>H.value)}function mR(G,H){Pn(H,G);let j=G.includes("system")?Jl(G,H):null,J=fR(G,H);if(!j&&!J)return null;return{dynamic:!!j?.dynamic||!!J?.dynamic,commands:[...j?.commands??[],...J?.commands??[]]}}function Jl(G,H){Pn(H,G);let j=[],J=!1,oe=!1,ie=0;while(ie<G.length){let fe=G[ie];if(fe==='"'||fe==="'"){ie=Ls(G,ie,fe)?.endIndex??ie+1;continue}if(fe==="#"){ie=wf(G,ie+1);continue}if(fe==="/"&&Af(G,ie)){ie=Pf(G,ie+1)??ie+1;continue}if(!G.startsWith("system",ie)){ie++;continue}let Re=ie;if(ie+=6,yi(G[Re-1])||yi(G[ie]))continue;let Te=Ns(G,ie);if(G[Te]!=="(")continue;Te=Ns(G,Te+1);let ke=G[Te];if(ke!=='"'&&ke!=="'"){J=!0,oe=!0;continue}let Le=Ls(G,Te,ke);if(!Le){J=!0,oe=!0;continue}if(Te=Ns(G,Le.endIndex),J=!0,G[Te]!==")"){oe=!0,ie=Le.endIndex;continue}j.push(Le.value),ie=Te+1}if(!J)return null;return{dynamic:oe,commands:j}}function fR(G,H){Pn(H,G);let j=[],J=!1,oe=!1,ie=0,fe=0,Re=null,Te=null,ke=0;while(ie<G.length){let Le=G[ie];if(!Le)break;if(Le==='"'||Le==="'"){let Ze=Ls(G,ie,Le);if(Ze&&ke===fe)Te={...Ze,startIndex:ie};ke=Ze?.endIndex??ie+1,ie=Ze?.endIndex??ie+1;continue}if(Le==="#"){ie=wf(G,ie+1),fe=ie,Re=null,Te=null,ke=ie;continue}if(Le==="/"&&Af(G,ie)){let Ze=Pf(G,ie+1);ke=Ze??ie+1,ie=Ze??ie+1;continue}if(`;
-{}`.includes(Le)){ie++,fe=ie,Re=null,Te=null,ke=ie;continue}if(Re===null&&(Zl(G,ie,"print")||Zl(G,ie,"printf")))Re=ie;if(Le!=="|"||G[ie-1]==="|"||G[ie+1]==="|"){if(!/\s/.test(Le))ke=ie+1;ie++;continue}let Xe=G[ie+1]==="&"?ie+2:ie+1,Ye=Ns(G,Xe);if(Zl(G,Ye,"getline")){oe=!0;let Ze=hR(fe,Te,ke);if(J||=Ze===null,Ze!==null)j.push(Ze);ke=Xe,ie=Xe;continue}if(CR(fe,Re)){oe=!0;let Ze=gR(G,Ye);if(!Ze){J=!0,ke=Xe,ie=Xe;continue}if(!pR(G,Ze.endIndex)){J=!0,ke=Ze.endIndex,ie=Ze.endIndex;continue}j.push(Ze.value),ke=Ze.endIndex,ie=Ze.endIndex;continue}ke=Xe,ie++}if(!oe)return null;return{dynamic:J,commands:j}}function yi(G){return!!G&&/[A-Za-z0-9_]/.test(G)}function Ns(G,H){let j=H;while(/\s/.test(G[j]??""))j++;return j}function pR(G,H){let j=H;while(/[\t\f\v\r ]/.test(G[j]??""))j++;let J=G[j];return!J||`;
-}#`.includes(J)}function Ls(G,H,j){let J="",oe=!1;for(let ie=H+1;ie<G.length;ie++){let fe=G[ie];if(!fe)break;if(oe){let Re=yR(G,ie);if(!Re)return null;J+=Re.value,ie=Re.endIndex,oe=!1;continue}if(fe==="\\"){oe=!0;continue}if(fe===j)return{value:J,endIndex:ie+1};J+=fe}return null}function gR(G,H){let j=G[H];if(j!=='"'&&j!=="'")return null;return Ls(G,H,j)}function hR(G,H,j){if(!H)return null;return H.startIndex>=G&&H.endIndex===j?H.value:null}function yR(G,H){let j=G[H];if(!j)return null;if(j==="x"){let oe=G.slice(H+1,H+3);if(!/^[0-9A-Fa-f]{2}$/.test(oe))return null;return{value:String.fromCharCode(Number.parseInt(oe,16)),endIndex:H+2}}if(/[0-7]/.test(j)){let oe=/^[0-7]{1,3}/.exec(G.slice(H));if(!oe)return null;return{value:String.fromCharCode(Number.parseInt(oe[0],8)),endIndex:H+oe[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[j]??j,endIndex:H}}function Zl(G,H,j){return G.startsWith(j,H)&&!yi(G[H-1])&&!yi(G[H+j.length])}function CR(G,H){return H!==null&&H>=G}function wf(G,H){let j=G.indexOf(`
-`,H);return j===-1?G.length:j+1}function Af(G,H){let j=SR(G,H);if(j===-1)return!0;if("{([,;!~=".includes(G[j]??""))return!0;let J=j;while(yi(G[J-1]))J--;return cR.has(G.slice(J,j+1))}function SR(G,H){for(let j=H-1;j>=0;j--)if(!/\s/.test(G[j]??""))return j;return-1}function Pf(G,H){let j=!1;for(let J=H;J<G.length;J++){let oe=G[J];if(!oe)break;if(j){j=!1;continue}if(oe==="\\"){j=!0;continue}if(oe==="/")return J+1}return null}var bR=new Set(["sudo","env","command","builtin"]),vR=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Ws(G,H){let j=G[0];if(!j||!Tf(Wt(j),H))return null;let J=Wt(j),oe=G[1]==="--"?2:1,ie=ER(G,oe,J,H),fe=ie[0];if(fe===void 0)return null;return{wrapper:J,tokens:G.slice(fe),childIndex:fe,alternativeChildIndices:ie.slice(1)}}function ER(G,H,j,J){let oe=G[1]==="--",ie=[];for(let fe=H;fe<G.length;fe++){let Re=G[fe];if(!Re)continue;let Te=Wt(Re)!==j&&RR(Re,J);if(Te)ie.push(fe);if(!Te&&Hi.has(Gt(Re)))break;if(oe)break}return ie}function RR(G,H){let j=Wt(G),J=Gt(G);return J==="git"||j==="busybox"||Ur(G)||$a.has(j)||ym(J)||Tf(j,H)||Qt.has(J)||G==="$SHELL"||zn(J)||Dn.has(J)||H.rules.some((oe)=>oe.command===j)}function Tf(G,H){return vR.has(G)||H.transparentWrappers.includes(G)}function Ur(G){return bR.has(G.toLowerCase())}function Hr(G,H){return{embedded:!1,cwd:G.cwd,originalCwd:H.originalCwd,effectiveCwd:G.cwd,envAssignments:G.envAssignments,allowTmpdirVar:H.allowTmpdirVar,worktreeMode:H.worktreeMode,wrappedByTransparent:!1}}function Hn(G,H){let j=H.policy??{rules:[],transparentWrappers:[]};return Fs([...G],H.environment,H.cwd,H.cwd,new Map,new Map(H.envAssignments??[]),j,{iterations:0},!1)}function*Fs(G,H,j,J,oe,ie,fe,Re,Te){let ke=vs(G,H,j,ie);for(let[Ze,Qe]of ke.envAssignments)ie.set(Ze,Qe),oe.set(Ze,Qe);let{tokens:Le,cwd:Xe}=ke;if(ke.envSplitValues){let Ze=bs(ke.envSplitValues,Le);if(!Ze)throw new s("derivedCommandShape");Ql(Re),yield*Fs(Ze,H,Xe,J,oe,ie,fe,Re,Te);return}if(Ur(Le[0]??""))throw new s("wrapperPeelIterations");let Ye=Ws(Le,fe);if(Ye){for(let Ze of[Ye.childIndex,...Ye.alternativeChildIndices])Ql(Re),yield*Fs(Ze===Ye.childIndex?Ye.tokens:Le.slice(Ze),H,Xe,J,new Map(oe),new Map(ie),fe,Re,!0);return}if(xR(Le)){Ql(Re),yield*Fs(Le.slice(1),H,Xe,J,oe,ie,fe,Re,Te);return}yield _R(Le,Xe,J,oe,ie,Te)}function _R(G,H,j,J,oe,ie){return{tokens:G,cwd:H===null?void 0:H??j,wrapperCwd:H,wrapperEnvAssignments:J,envAssignments:oe,head:Wt(G[0]??"").toLowerCase(),wrappedByTransparent:ie}}function Ql(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function xR(G){return Wt(G[0]??"").toLowerCase()==="busybox"&&G.length>1}function ec(G,H){let j=[],J=H;while(J<G.length){let oe=G[J];if(oe===void 0||oe===":::")break;j.push(oe),J++}return{markerIndex:J<G.length&&G[J]===":::"?J:-1,templateTokens:j}}function ar(G){let H=!1,j=!1;for(let J of G){if(J==="--")break;if(J==="-r"||J==="-R"||tc(J,"recursive")){H=!0;continue}if(J==="-f"||tc(J,"force")){j=!0;continue}if(J.startsWith("-")&&!J.startsWith("--")){if(J.includes("r")||J.includes("R"))H=!0;if(J.includes("f"))j=!0}}return H&&j}function Gs(G){let H=G.indexOf("--");return G.slice(1,H===-1?void 0:H).some((j)=>tc(j,"recursive")||/^-[A-Za-z]+$/.test(j)&&/[rR]/.test(j.slice(1)))}function tc(G,H){return G.length>2&&G.startsWith("--")&&H.startsWith(G.slice(2))}var wR=["--init-file","--rcfile"],AR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function jn(G){for(let H=1;H<G.length;H++){let j=G[H];if(!j)continue;if(j==="-c")return If(G,H,!0);if(j.startsWith("-")&&j.includes("c")&&!j.startsWith("--")){let J=If(G,H,!1);if(J!==null)return J}}return null}function lr(G){let H=Wt(G[0]??"").toLowerCase();if(H==="zsh"||H==="ksh")return wn(G).syntaxCheck;let j=!1;for(let J of G.slice(1)){if(J==="--")return j;if(J.startsWith("+")&&!J.startsWith("++")){if(J.slice(1).includes("n"))j=!1;continue}if(!J.startsWith("-")||J.startsWith("--"))return j;let oe=J.slice(1);if(oe.includes("n"))j=!0;if(oe.includes("c"))return j}return j}function If(G,H,j){if(G[H+1]==="--")return G[H+2]||null;let J=G[H+1];if(!J||!j&&J.startsWith("-"))return null;return J}function kf(G){let H=Wt(G[0]??"").toLowerCase(),j=PR(G,H),J=AR.get(H)??null,oe=j.argvSource?.kind!=="absent";return{argvSource:H==="bash"?j.argvSource:null,argvSourceApplies:H==="bash"&&j.interactive&&j.argvSource?.kind==="literal",envName:J,envSourceApplies:oe&&(J==="BASH_ENV"?!j.interactive:J==="ENV"&&j.interactive)}}function PR(G,H){let j=wn(G),J=j.commandIndex??j.scriptIndex??G.length,oe=[],ie=!1,fe=!0;for(let Re=1;Re<J;Re++){let Te=G[Re];if(Te===void 0||Te==="--"||Te==="-"||Te[0]!=="-"&&Te[0]!=="+")break;if(Te.startsWith("--")){if(H==="bash"&&fe?wR.find((Ye)=>Te===Ye):void 0){let Ye=G[Re+1];oe.push(Ye===void 0?{kind:"absent"}:{kind:"literal",value:Ye}),Re++;continue}let Xe=Te.split("=",1)[0]??Te;if(H==="bash"&&Ga.has(Xe)&&!Te.includes("="))Re++;continue}if(H==="bash")fe=!1;let ke=za(H,Te,G[Re+1],"startup");if(ke.interactive)ie=Te[0]==="-";Re+=ke.followingValues}return{argvSource:oe.at(-1)??null,interactive:ie}}var TR="find -delete permanently removes files. Use -print first to preview.",IR="find -exec rm -rf is dangerous. Use explicit file list instead.",kR=new Set(["-exec","-execdir","-ok","-okdir"]),OR=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((G)=>[G,1]),["-fprintf",2]]);function Of(G,H){let j=G.map(t),J=MR(G,j,H);if(J)return J;if(zs(j,1)&&!GR(G,j,H)){let fe=Nt(Pt("find.delete",TR),H.policy);if(fe)return fe}let oe=H.budget??On(),ie=0;while(ie<j.length){let fe=j[ie],Re=cr(fe??"");if(Re>0){ie+=Re+1;continue}if(!Xn(fe)){ie++;continue}oe.charge("derivedTokens",j.length-ie-1);let Te=vo(j,ie);ie=Te.nextIndex;let ke=$R(Te.tokens,H.environment);if(ke){let Ze=Nt(ke,H.policy);if(Ze)return Ze}let Le=fe==="-execdir"||fe==="-okdir",Xe=H.analyzeTokens?.(Te.tokens,Le?null:H.cwd)??null,Ye=Xe?.id.startsWith("custom.")?Xe:Nt(Xe,H.policy);if(Ye)return Ye}return null}function MR(G,H,j){if(!zs(H,1)&&!nc(H,j.environment))return null;let oe=Si(G)??Jt(["."]),ie=Zn({...j,allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let fe of oe){let Re=gi(fe);for(let Te of Re.expandedTargets??[t(fe)]){let ke=Tn(Te,ie,{targetIsLiteral:Re.expandedTargets!==void 0||Re.targetIsLiteral,tmpdirWordSplittingProtected:Re.tmpdirWordSplittingProtected});if(ke.kind==="root_or_home_target")return Pt("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ke.kind==="git_metadata_target"&&!DR(G,ie.protectedGitMetadata,j.environment))return Pt("find.delete-git-metadata",v)}}if(FR(H)&&ie.resolvedCwd&&Qm(oe.map(t),ie.resolvedCwd,ie.protectedGitMetadata,ie.environment,ie.budget))return Pt("find.delete-git-metadata",v);return null}function DR(G,H,j){if(!H)return!1;let J=G.map(t),oe=[],ie=!1,fe=Si(G)?.at(-1),Re=fe?G.indexOf(fe)+1:1;while(Re<J.length){let Te=J[Re]??"";if(Xn(Te)){let ke=vo(J,Re),Le=yr([...ke.tokens],j),Xe=Gs(Le),Ye=Qt.has(Wt(Le[0]??"").toLowerCase()),Ze=ke.tokens.some((et)=>et!=="{}"&&et.includes("{}")),Qe=(Te==="-execdir"||Te==="-okdir")&&Le.slice(1).some((et)=>et!=="{}"&&!et.startsWith("-"));if(Xe||Ye||Ze||Qe)return!1;ie=!0,Re=ke.nextIndex;continue}if(Te==="-delete"){ie=!0,Re++;continue}if(Te==="-name"||Te==="-iname"){let ke=G[Re+1];if(!(ke?.provenance==="literal"&&!/[[\\]/.test(ke.text)))return!1;if(!ie)oe.push(LR(ke.text,Te==="-iname"));Re+=2;continue}if(!NR.has(Te))return!1;Re+=1+cr(Te)}return oe.length>0&&!tf(H,(Te)=>oe.every((ke)=>ke.test(Te)))}var NR=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function LR(G,H){let j=G.replace(/[*?]|[.+^${}()|\]/]/g,(J)=>J==="*"?".*":J==="?"?".":`\\${J}`);return new RegExp(`^${j}$`,H?"isu":"su")}var WR=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function nc(G,H){let j=0;while(j<G.length){if(!Xn(G[j])){j++;continue}let J=vo(G,j),oe=yr([...J.tokens],H),ie=Wt(oe[0]??"").toLowerCase(),fe=Qt.has(ie)&&WR.test((jn(oe)??"").replace(/["'\\]/g,""));if((ie==="rm"||ie==="rmdir"||fe)&&oe.some((Te)=>Te.includes("{}")))return!0;j=J.nextIndex}return!1}function FR(G){return G.some((H,j)=>{if(!["-name","-iname"].includes(H))return!1;return G[j+1]?.toLowerCase()==="hooks"})}function GR(G,H,j){if(H.includes("-L")||H.includes("-f")||H.includes("-follow"))return!1;let J=Si(G);if(!J)return!1;let oe=j.envAssignments??new Map,ie=Hl(oe,j.environment),fe=j.trustedTmpdirValue??Co(oe,j.environment),Re=j.allowTmpdirVar??!pi(oe,j.environment),Te={environment:j.environment,protectedGitMetadata:j.protectedGitMetadata,cwd:j.cwd,originalCwd:j.originalCwd,strict:j.strict,allowTmpdirVar:Re&&fe&&Boolean(ie),allowPaths:j.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:j.tmpdirWordSplittingUnsafe??zr(oe,j.environment),trustedTmpdirValue:fe,budget:j.budget},ke=Zn(Te),Le=Zn({...Te,cwd:j.originalCwd??j.cwd}),Xe=j.originalCwd&&j.environment.paths.realpath(j.originalCwd),Ye=j.cwd&&j.environment.paths.realpath(j.cwd),Ze=Xe&&Ye&&!bo(Ye,Xe)?j.cwd:void 0;return J.every((Qe)=>{let et=gi(Qe);if(et.unsafeBraceExpansion)return!1;return(et.expandedTargets??[t(Qe)]).every((tt)=>{let gt=/^\.\/*$/.test(tt)?Ze:void 0,_t=gt??tt,yt={targetIsLiteral:et.expandedTargets!==void 0||et.targetIsLiteral,tmpdirWordSplittingProtected:et.tmpdirWordSplittingProtected};if(!rn(j.policy,"rm.recursive-force-paranoid",j.paranoid??!1)&&!gt&&Tn(_t,ke,yt).kind==="within_anchored_cwd")return!0;return uf(_t,gt?Le:ke,{...yt,containmentTarget:zR(_t,ie)})})})}function zR(G,H){if(!H)return G;return G.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>H)}function Si(G){let H=(oe)=>{let ie=G[oe];return ie?t(ie):void 0},j=1;while(H(j)==="-H"||H(j)==="-P")j++;if(H(j)==="--")j++;let J=[];while(j<G.length){let oe=H(j),ie=G[j];if(!oe||!ie||oe.startsWith("-")||["!","(",")"].includes(oe))break;J.push(ie),j++}return J.length>0?J:null}function $R(G,H){let j=hr([...G],H);if(j.length===0)return null;let J=Wt(j[0]??"");if(J==="busybox"&&j.length>1)j=j.slice(1),J=Wt(j[0]??"");if(J==="rm"&&ar(j))return Pt("find.exec-rm-recursive-force",IR);return null}function vo(G,H){let j=H+1;while(j<G.length&&G[j]!==";"&&!(G[j]==="+"&&G[j-1]==="{}"))j++;return{tokens:G.slice(H+1,j),nextIndex:Math.min(j+1,G.length)}}function zs(G,H){let j=H;while(j<G.length){let J=G[j];if(!J){j++;continue}if(Xn(J)){j=vo(G,j).nextIndex;continue}let oe=cr(J);if(oe>0){j+=oe+1;continue}if(J==="-delete")return!0;j++}return!1}function cr(G){return OR.get(G)??(/^-newer[A-Za-z]{2}$/.test(G)?1:0)}function Xn(G){return G!==void 0&&kR.has(G)}import{resolve as hx}from"node:path";function*rc(G){for(let H of G.nodes)yield*UR(H)}function BR(G){return[...rc(G)]}function Rt(G){return BR(G).map((H)=>H.words.map((j)=>j.text))}function bi(G){let H=y(G,"posix");if(H.status!=="complete"||H.nodes.length!==1)return null;let j=H.nodes[0];if(j?.kind!=="command")return null;if(j.redirections.length>0||j.nested.length>0)return null;if(j.words.some((J)=>J.provenance==="command-substitution"))return null;return j.words.map((J)=>J.text)}function*UR(G){if(G.kind==="command"){yield G;for(let H of G.nested)yield*rc(H);return}if(G.kind==="group")yield*rc(G.body)}var HR=5,oc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function un(G){let H=G.indexOf("--");if(H===-1)return{index:-1,before:G,after:[]};return{index:H,before:G.slice(0,H),after:G.slice(H+1)}}function Df(G,H,j){let J=$s(G,H,j),oe=jR(J.entries);if(oe.size===0)return{blockedReason:J.blockedReason,expanded:!1,tokens:G};let ie=G,fe=!1;for(let Re=0;Re<HR;Re++){let{subcommand:Te,rest:ke}=In(ie),Le=Te?.toLowerCase();if(!Le||!oe.has(Le))return{blockedReason:J.blockedReason,expanded:fe,tokens:ie};let Xe=oe.get(Le),Ye=ZR(Xe);if(Ye===null||Ye.length===0)return{blockedReason:oc,expanded:!0,tokens:ie};ie=["git",...Ye,...ke],fe=!0}return{blockedReason:oc,expanded:!0,tokens:ie}}function Nf(G,H,j){return $s(G,H,j).entries.some((J)=>J.key.toLowerCase()==="core.sshcommand")}function In(G){if(G.length===0)return{subcommand:null,rest:[]};let H=G[0];if((H?Wt(H).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let J=1;while(J<G.length){let oe=G[J];if(!oe)break;if(oe==="--"){let ie=G[J+1];if(ie&&!ie.startsWith("-"))return{subcommand:ie,rest:G.slice(J+2)};return{subcommand:null,rest:G.slice(J+1)}}if(!oe.startsWith("-"))return{subcommand:oe,rest:G.slice(J+1)};J+=xn.has(oe)?2:1}return{subcommand:null,rest:[]}}function jR(G){let H=new Map;for(let j of G){let J=j.key.toLowerCase();if(!J.startsWith("alias."))continue;let oe=J.slice(6);if(oe!=="")H.set(oe,j.value)}return H}function $s(G,H,j){if(G.length===0)return{blockedReason:null,entries:[]};let J=G[0];if((J?Wt(J).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let ie=KR(H,j);return{blockedReason:ie.blockedReason,entries:[...ie.entries,...VR(G,H,j)]}}function VR(G,H,j){let J=[],oe=1;while(oe<G.length){let ie=G[oe];if(!ie||ie==="--"||!ie.startsWith("-"))return J;if(ie==="-c"){let fe=ic(G[oe+1]);if(fe)J.push(fe);oe+=2;continue}if(ie.startsWith("-c")&&ie.length>2){let fe=ic(ie.slice(2));if(fe)J.push(fe);oe++;continue}if(ie==="--config-env"){let fe=Mf(G[oe+1],H,j);if(fe)J.push(fe);oe+=2;continue}if(ie.startsWith("--config-env=")){let fe=Mf(ie.slice(13),H,j);if(fe)J.push(fe);oe++;continue}if(xn.has(ie)){oe+=2;continue}oe++}return J}function KR(G,H){let j=qR(G,H),J=YR(G,H);return{blockedReason:j===null||J===null?oc:null,entries:[...j??[],...J??[]]}}function qR(G,H){let j=ir("GIT_CONFIG_PARAMETERS",G,H);if(j===void 0)return[];let J=[],oe=bi(j);if(!oe)return null;for(let ie of oe){let fe=ic(ie);if(!fe)return null;J.push(fe)}return J}function YR(G,H){let j=Am(G,H);if(j.state==="absent")return[];if(j.state==="invalid")return null;let J=[];for(let oe=0;oe<j.count;oe++){let ie=ir(`GIT_CONFIG_KEY_${oe}`,G,H)?.trim(),fe=ir(`GIT_CONFIG_VALUE_${oe}`,G,H);if(!ie||fe===void 0)return null;J.push({key:ie,value:fe})}return J}function ic(G){if(!G)return null;let H=G.indexOf("=");return{key:(H===-1?G:G.slice(0,H)).trim(),value:H===-1?void 0:G.slice(H+1)}}function Mf(G,H,j){let J=G?.indexOf("=")??-1;if(!G||J===-1)return null;return{key:G.slice(0,J).trim(),value:ir(G.slice(J+1),H,j)}}function ZR(G){let H=G?.trimStart();if(!H||H.startsWith("!"))return null;return bi(H)}var XR="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",JR="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",QR="git checkout --force discards uncommitted changes. Use 'git stash' first.",e_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",t_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",n_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",r_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",o_="git switch --force discards uncommitted changes. Use 'git stash' first.",i_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",s_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",a_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",l_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",c_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",d_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",u_="git push --force destroys remote history. Use --force-with-lease for safer force push.",m_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",f_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",p_="git branch -D force-deletes without merge check. Use -d for safe delete.",g_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",h_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",y_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",C_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",S_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",b_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",v_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",E_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),R_=new Set(["--recurse-submodules","--track","-t"]),sc=new Set(["-b","-B","-U"]),ac=new Set(["-c","-C"]),__=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function zt(G,H){let j=G.split("=",1)[0]??G;return j.length>=4&&H.startsWith(j)&&j.startsWith("--")&&j.slice(2).length>=2}var Eo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Wf(G,H){let{subcommand:j,rest:J}=In(G);if(!j)return null;switch(j.toLowerCase()){case"checkout":return Sr(x_(J,H));case"switch":return Sr(A_(J));case"restore":return Sr(T_(J));case"reset":return k_(J);case"clean":return Sr(M_(J));case"rm":return Sr(D_(J));case"push":return jr(N_(J));case"branch":return jr(F_(J));case"stash":return jr(U_(J));case"worktree":return jr(H_(J));case"rebase":return Sr(G_(J));case"merge":return Sr(z_(J));case"tag":return jr($_(J));case"reflog":return jr(B_(J));default:return null}}function Sr(G){return G?{...G,localDiscard:!0}:null}function jr(G){return G?{...G,localDiscard:!1}:null}function x_(G,H){let{index:j,before:J}=un(G),oe=Cn(J,{shortOptsWithValue:sc});if(J.some((Re)=>zt(Re,"--force"))||oe.has("-f"))return Pt("git.checkout-force",QR);for(let Re of G){if(Re==="-b"||Re==="-B"||Re==="--orphan")return null;if(zt(Re,"--pathspec-from-file"))return Pt("git.checkout-pathspec-from-file",t_)}if(j!==-1){if(J.some((Te)=>!Te.startsWith("-")))return Pt("git.checkout-ref-path",e_);return Pt("git.checkout-double-dash",XR)}let ie=P_(G);if(ie.length>=2)return Pt("git.checkout-ambiguous",n_);let fe=ie[0];if(fe===void 0||oe.has("-d")||oe.has("-t")||G.some((Re)=>zt(Re,"--detach")||zt(Re,"--track")))return null;if(w_(fe)||H(fe))return Pt("git.checkout-double-dash",JR);return null}function w_(G){return G==="."||G===".."||/^\.\.?[/\\]/.test(G)||/^([/\\]|[A-Za-z]:[/\\])/.test(G)||G.endsWith("/")||G.startsWith(":")||/[*?[]/.test(G)}function A_(G){let{before:H}=un(G);if(H.some((J)=>zt(J,"--discard-changes")))return Pt("git.switch-discard-changes",r_);let j=Cn(H,{shortOptsWithValue:ac});if(H.some((J)=>zt(J,"--force"))||j.has("-f"))return Pt("git.switch-force",o_);return null}function P_(G){let H=[],j=0;while(j<G.length){let J=G[j];if(!J)break;if(J==="--")break;if(!J.startsWith("-")){H.push(J),j++;continue}if(E_.has(J)){j+=2;continue}if(R_.has(J)){let oe=G[j+1],ie=J==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];j+=oe&&!oe.startsWith("-")&&ie.includes(oe)?2:1;continue}j++}return H}function T_(G){let H=I_(G);if(H.isTerminal||!H.hasPathspec&&!H.hasPatch||!H.hasWorktree)return null;return H.hasExplicitLocation?Pt("git.restore-worktree",s_):Pt("git.restore-unstaged",i_)}function I_(G){let H=!1,j=!1,J=!0,oe=!1,ie=(fe)=>{if(!oe)J=!1,oe=!0;if(fe!==void 0)J=fe};for(let fe=0;fe<G.length;fe++){let Re=G[fe];if(Re===void 0)break;if(Re==="--"){H||=fe+1<G.length;break}if(Re==="--pathspec-from-file"){H=!0,fe++;continue}if(Re.startsWith("--pathspec-from-file=")){H=!0;continue}if(Re==="-h"||Re==="--help"||Re==="--version")return{hasPathspec:H,hasPatch:j,hasWorktree:J,hasExplicitLocation:oe,isTerminal:!0};if(Re==="--staged"){ie();continue}if(Re==="--no-staged"){ie();continue}if(Re==="--worktree"){ie(!0);continue}if(Re==="--no-worktree"){ie(!1);continue}if(Re==="--patch"){j=!0;continue}if(Re==="--no-patch"){j=!1;continue}if(__.has(Re)){fe++;continue}if(Re.startsWith("--"))continue;if(Re==="-"){H=!0;continue}if(!Re.startsWith("-")){H=!0;continue}for(let Te=1;Te<Re.length;Te++){let ke=Re.charAt(Te);if(ke==="h")return{hasPathspec:H,hasPatch:j,hasWorktree:J,hasExplicitLocation:oe,isTerminal:!0};if(ke==="S"){ie();continue}if(ke==="W"){ie(!0);continue}if(ke==="p"){j=!0;continue}if(ke==="s"||ke==="U"){if(Te===Re.length-1)fe++;break}}}return{hasPathspec:H,hasPatch:j,hasWorktree:J,hasExplicitLocation:oe,isTerminal:!1}}function k_(G){let H=null;for(let j of G){if(zt(j,"--hard")){H=Pt("git.reset-hard",a_);break}if(zt(j,"--merge")){H=Pt("git.reset-merge",l_);break}}if(!H)return null;return O_(G)?jr(H):Sr(H)}function O_(G){for(let H of G){if(H==="--")return!1;if(!H.startsWith("-"))return!0}return!1}function M_(G){for(let j of G)if(j==="-n"||zt(j,"--dry-run"))return null;let H=Cn(G.filter((j)=>j!=="--"));if(G.some((j)=>zt(j,"--force"))||H.has("-f"))return Pt("git.clean-force",c_);return null}function D_(G){let H=!1,j=!1,J=!1;for(let oe of un(G).before){if(zt(oe,"--no-force")){H=!1;continue}if(zt(oe,"--force")){H=!0;continue}if(zt(oe,"--no-cached")){j=!1;continue}if(zt(oe,"--cached")){j=!0;continue}if(zt(oe,"--no-dry-run")){J=!1;continue}if(zt(oe,"--dry-run")){J=!0;continue}let ie=Cn([oe]);H||=ie.has("-f"),J||=ie.has("-n")}return H&&!j&&!J?Pt("git.rm-force",d_):null}function N_(G){let{before:H,after:j}=un(G),J=Cn(H);if(H.some((fe)=>zt(fe,"--mirror")))return Pt("git.push-mirror",f_);if(H.some((fe)=>zt(fe,"--force"))||J.has("-f")||Lf(H,j).some(L_))return Pt("git.push-force",u_);if(H.some((fe)=>zt(fe,"--delete"))||J.has("-d")||Lf(H,j).some(W_))return Pt("git.push-delete",m_);return null}function Lf(G,H){return[...G.filter((j)=>j!==""&&!j.startsWith("-")),...H]}function L_(G){return G.startsWith("+")||G.includes(":+")}function W_(G){return G.length>1&&G.startsWith(":")}function F_(G){let{before:H}=un(G),j=Cn(H),J=j.has("-D")||j.has("-d")||H.some((ie)=>zt(ie,"--delete")),oe=j.has("-D")||j.has("-f")||H.some((ie)=>zt(ie,"--force"));if(J&&oe)return Pt("git.branch-force-delete",p_);return null}function G_(G){let{before:H}=un(G);return H.some((j)=>zt(j,"--abort"))?Pt("git.rebase-abort",g_):null}function z_(G){let{before:H}=un(G);return H.some((j)=>zt(j,"--abort"))?Pt("git.merge-abort",h_):null}function $_(G){let{before:H}=un(G);return Cn(H).has("-d")||H.some((J)=>zt(J,"--delete"))?Pt("git.tag-delete",y_):null}function B_(G){return G[0]==="delete"?Pt("git.reflog-delete",C_):null}function U_(G){for(let H of G){if(H==="drop")return Pt("git.stash-drop",S_);if(H==="clear")return Pt("git.stash-clear",b_)}return null}function H_(G){let{before:H}=un(G);if(!H.includes("remove"))return null;let J=Cn(H);if(H.some((oe)=>zt(oe,"--force"))||J.has("-f"))return Pt("git.worktree-remove-force",v_);return null}import{dirname as ux,isAbsolute as mx,join as Jf,resolve as fx}from"node:path";var cc="TMPDIR",dc="IFS",Gf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,zf=/^[A-Za-z_][A-Za-z0-9_]*$/,$f=new Set(["export","typeset","declare","readonly"]),j_=new Set(["builtin","command","time"]),V_=new Set(["do","then","else"]),K_=new Set(["do","then","case"]),Ff=new Set(["done","fi","esac"]),q_=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Bf(G,H){return G.map((j)=>j.provenance==="variable"&&Yf(j.text)?Uf(j.text,H.shellAssignments):t(j))}function Uf(G,H){return G.replace(q_,(j,J,oe)=>H.get(J??oe??"")??j)}function Jn(G,H){let j=G.parts.every((oe)=>oe.provenance!=="literal"||!/[$`]/.test(oe.raw));if(G.provenance!=="variable"||!j)return null;let J=Uf(G.text,H);return/^[~-]/.test(J)||/[\s$`*?[]/.test(J)?null:J}function Hf(G,H){return{env:G,effectiveEnvAssignments:J_(G,H),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function jf(G){return{env:G.env,effectiveEnvAssignments:G.effectiveEnvAssignments?new Map(G.effectiveEnvAssignments):void 0,shellAssignments:new Map(G.shellAssignments),bodyDepth:G.bodyDepth,bodyAssignments:new Set(G.bodyAssignments)}}function uc(G,H){let j=Kf(G,H),J=G[0]??"";if(K_.has(J))H.bodyDepth+=1;if(J==="elif"||Ff.has(J))H.bodyDepth=Math.max(0,H.bodyDepth-1);if(Ff.has(J)&&H.bodyDepth===0)H.bodyAssignments.forEach((Re)=>{H.shellAssignments.delete(Re)}),H.bodyAssignments.clear();j.assignments.filter((Re)=>Re.persists).forEach((Re)=>{if(H.shellAssignments.set(Re.name,Re.value),H.bodyDepth>0)H.bodyAssignments.add(Re.name);mc(H,Re)});let oe=j.commandIndex;if(oe!==-1&&$f.has(G[oe]??""))G.filter((Re)=>zf.test(Re)&&lc(Re)).forEach((Re)=>{Q_(H,Re)});let ie=oe===-1?-1:qf(G,oe);if(ie===-1||G[ie]!=="unset")return;let fe=tx(G,ie);if(fe===null)return;G.slice(fe).forEach((Re)=>{if(H.bodyDepth>0){H.shellAssignments.set(Re,"");return}ex(H,Re)})}function Vf(G,H){let j=Kf(G,H).assignments;if(j.length===0)return H.effectiveEnvAssignments;let J=new Map(H.effectiveEnvAssignments??[]);return j.forEach((oe)=>{J.set(oe.name,oe.value)}),J}function Kf(G,H){let j=V_.has(G[0]??"")?1:0,J=G.findIndex((Re,Te)=>Te>=j&&!Yf(Re)),oe=J!==-1&&$f.has(G[qf(G,J)]??""),ie=X_(H);return{assignments:G.flatMap((Re,Te)=>{let ke=Y_(Re,ie,H.env);if(!ke)return[];if(J!==-1&&Te>J&&!oe&&!Cs(ke.name))return[];return ie.set(ke.name,ke.value),[{...ke,persists:J===-1||oe}]}),commandIndex:J}}function qf(G,H){let j=H;while(j_.has(G[j]??"")){j+=1;while(G[j]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(G[j]??""))return H;j+=1}}return j}function Yf(G){return Ln(G)!==null||Gf.test(G)}function Y_(G,H,j){return Ln(G)??Z_(G,H,j)}function Z_(G,H,j){let J=Ss(G,j,H);if(J)return J;let oe=G.match(Gf)?.[1];if(!oe)return null;let ie=G.indexOf("=");return{name:oe,value:`${H.has(oe)?H.get(oe):j.get(oe)??""}${G.slice(ie+1)}`}}function lc(G){return G===cc||G===dc||Nl(G)}function X_(G){return new Map([...G.effectiveEnvAssignments??[],...G.shellAssignments])}function J_(G,H){let j=[cc,dc].map((J)=>{let oe=G.get(J);return oe===void 0?null:[J,oe]}).filter((J)=>J!==null);if(j.length===0)return H;return new Map([...j,...H??[]])}function mc(G,H){let j=new Map(G.effectiveEnvAssignments??[]);j.set(H.name,H.value),G.effectiveEnvAssignments=j}function Q_(G,H){mc(G,{name:H,value:G.shellAssignments.get(H)??G.effectiveEnvAssignments?.get(H)??G.env.get(H)??""})}function ex(G,H){if(!lc(H)&&!zf.test(H))return;if(G.shellAssignments.set(H,""),Cs(H)&&G.env.has(H)){let J=new Map(G.env);J.delete(H),G.env=J}if(!lc(H)||H===cc||H===dc||Go(H)){mc(G,{name:H,value:""});return}if(!G.effectiveEnvAssignments?.has(H))return;let j=new Map(G.effectiveEnvAssignments);j.delete(H),G.effectiveEnvAssignments=j.size===0?void 0:j}function tx(G,H){let j=H+1;while(j<G.length){let J=G[j];if(!J)return null;if(J==="--")return j+1;if(J==="-v"){j++;continue}if(J.startsWith("-"))return null;return j}return j}import{resolve as nx}from"node:path";function Bs(G,H){return Dl.some((j)=>H?.has(j)||G.has(j))}function Ro(G,H,j){if(!H)return{gitCwd:null,hasExplicitGitContext:!1};let J=j.realpath(nx(H));if(J===null||!j.isDirectory(J))return{gitCwd:null,hasExplicitGitContext:!1};let oe=J,ie=!1,fe=1;while(fe<G.length){let Re=G[fe];if(!Re)break;if(Re==="--")break;if(!Re.startsWith("-"))break;if(Re==="-C"){let Te=G[fe+1];if(!Te)return{gitCwd:null,hasExplicitGitContext:ie};let ke=Zf(oe,Te,j);if(!ke)return{gitCwd:null,hasExplicitGitContext:ie};oe=ke,fe+=2;continue}if(Re.startsWith("-C")&&Re.length>2){let Te=Zf(oe,Re.slice(2),j);if(!Te)return{gitCwd:null,hasExplicitGitContext:ie};oe=Te,fe++;continue}if(Re==="--git-dir"||Re==="--work-tree"){ie=!0,fe+=2;continue}if(Re.startsWith("--git-dir=")||Re.startsWith("--work-tree=")){ie=!0,fe++;continue}fe+=xn.has(Re)?2:1}return{gitCwd:oe,hasExplicitGitContext:ie}}function Zf(G,H,j){try{let J=gr(G,H,j);return j.isDirectory(J)?J:null}catch{return null}}function Xf(G,H,j){if(!H.localDiscard||!j.worktreeMode||Bs(j.environment.env,j.envAssignments))return null;let J=Ro(G,j.cwd,j.environment.paths);if(!J.gitCwd||J.hasExplicitGitContext)return null;let oe=j.environment.worktreeFacts(J.gitCwd);if(!oe)return null;if(fc(G,j,oe))return null;return{kind:"worktree",originalReason:H.reason,gitCwd:J.gitCwd}}function fc(G,H,j){let{subcommand:J,rest:oe}=In(G),ie=J?.toLowerCase();if(H.dynamicArguments||rx(oe)||lx(G,H.environment.env,H.envAssignments,j)||sx(oe)||ox(ie,oe))return!0;return ie==="clean"&&ax(oe)>1}function rx(G){return G.some((H)=>/[$*?[]/.test(H))}function ox(G,H){if(G==="checkout"){let{before:j}=un(H),J=Cn(j,{shortOptsWithValue:sc}),oe=j.some((fe)=>zt(fe,"--force"))||J.has("-f"),ie=J.has("-B")||j.some((fe)=>fe==="-B"||fe.startsWith("-B"));return oe&&ie}if(G==="switch"){let{before:j}=un(H),J=Cn(j,{shortOptsWithValue:ac}),oe=j.some((fe)=>zt(fe,"--force"))||j.some((fe)=>zt(fe,"--discard-changes"))||J.has("-f"),ie=j.some((fe)=>fe==="-C"||fe.startsWith("-C")||ix(fe))||J.has("-C");return oe&&ie}return!1}function ix(G){let H=G.split("=",1)[0]??G;return H==="--force-create"||H.length>=9&&"--force-create".startsWith(H)}function sx(G){return G.some((H)=>H.startsWith("--recurse-sub"))}function ax(G){let H=0;for(let j of G){if(j==="--force"){H++;continue}if(j.startsWith("-")&&!j.startsWith("--")){for(let J of j.slice(1))if(J==="f")H++}}return H}function lx(G,H,j,J){if(ir("GIT_CONFIG_PARAMETERS",H,j)!==void 0)return!0;let oe=$s(G,H,j);if(oe.blockedReason!==null)return!0;let ie=oe.entries.map((Re)=>({key:Re.key.toLowerCase(),value:Re.value}));if(ie.some((Re)=>dx(Re.key)))return!0;let fe=ie.filter((Re)=>Re.key==="submodule.recurse").at(-1);if(fe)return fe.value===void 0||cx(fe.value);if(Tm(j))return!0;return J.recursiveSubmodules}function cx(G){let H=G.toLowerCase();return H!=="false"&&H!=="no"&&H!=="off"&&H!=="0"}function dx(G){return G==="include.path"||G.startsWith("includeif.")&&G.endsWith(".path")}function Qf(G,H,j){let J=G.map((Te)=>Jn(Te,j.shellAssignments??new Map)??t(Te)),oe=j.environment.paths,ie=Ro(J,j.cwd,oe),fe=j.originalCwd?oe.realpath(fx(j.originalCwd)):null;if(H.id.startsWith("git.push-")||fe===null||ie.gitCwd===null||ie.hasExplicitGitContext||Bs(j.environment.env,j.envAssignments))return null;let Re=H.id==="git.worktree-remove-force"?gx(G,j.shellAssignments,oe):ep(ie.gitCwd,oe);if(Re===null||H.id!=="git.worktree-remove-force"&&!px(Re,J,H,j)||!So(Re,j.environment)||Ms(Re,j.environment)||bo(fe,Re)||bo(Re,fe))return null;return{kind:"temp-root",originalReason:H.reason,gitCwd:ie.gitCwd}}function px(G,H,j,J){let oe=J.environment.paths,ie=Jf(G,".git");if(oe.entryKind(ie)!=="present")return!1;if(oe.isDirectory(ie))return!0;if(!j.localDiscard)return!1;let Re=J.environment.worktreeFacts(G);return Re!==null&&!fc(H,J,Re)}function gx(G,H,j){let J=In(G.map(t)).rest,{before:oe,after:ie}=un(J.slice(J.indexOf("remove")+1)),fe=[...oe.filter((Le)=>!Le.startsWith("-")),...ie],Re=fe.length===1?fe[0]??"":"",Te=G.find((Le)=>Le.text===Re),ke=(Te&&Jn(Te,H??new Map))??Re;if(!mx(ke)||/[\s$`*?[]/.test(ke)||j.entryKind(ke)!=="present"||!j.isDirectory(ke))return null;return j.realpath(ke)}function ep(G,H){if(H.entryKind(Jf(G,".git"))!=="missing")return G;let j=ux(G);return j===G?null:ep(j,H)}var yx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Cx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Us(G,H){return tp(G,H)}function tp(G,H,j){let J=G.map(t),oe=Df(J,H.environment.env,H.envAssignments),ie=oe.blockedReason?Nt(Pt("git.alias-config",oe.blockedReason),H.policy):null;if(ie)return ie;let fe=oe.tokens;if((Pm(H.envAssignments)||Nf(J,H.environment.env,H.envAssignments))&&Sx(fe))return Pt("git.ssh-env",yx);let Re=Wf(fe,(ke)=>{let Le=Ro(J,H.cwd,H.environment.paths).gitCwd;return Le!==null&&H.environment.paths.entryKind(hx(Le,ke))!=="missing"});if(!Re)return null;if(oe.expanded||oe.blockedReason)return Re;let Te=Xf(J,Re,H)??Qf(G,Re,H);if(!Te)return Re;return j?.(Te),null}function np(G,H){let j=null;return{match:tp(G,H,(oe)=>{j=oe}),relaxation:j}}function Sx(G){let{subcommand:H,rest:j}=In(G),J=H?.toLowerCase();if(!J)return!1;if(Cx.has(J))return!0;if(J==="archive")return un(j).before.some((oe)=>zt(oe,"--remote"));return J==="remote"&&bx(j)}function bx(G){return G.find((H)=>!vx(H))?.toLowerCase()==="update"}function vx(G){return G==="-v"||zt(G,"--verbose")||zt(G,"--no-verbose")}import{isAbsolute as Xx}from"node:path";function rp(G,H,j,J){let oe=G.slice(0,H),ie=G.slice(H+j);return J.startsWith(oe)&&J.endsWith(ie)?J.slice(oe.length,J.length-ie.length):null}function Hs(G,H,j){let J=(ie)=>`${ie.tokenIndex}\x00${ie.kind}\x00${ie.value}`,oe=new Set(G.map(J));return Array.from(H).some((ie)=>j(ie).some((fe)=>!oe.has(J(fe))))}var op="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ex="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",_x="rm -rf targeting root or home directory is extremely dangerous and always blocked.",xx="rm -rf in home directory is dangerous. Change to a project directory first.",ip={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:_x},git_metadata_target:{id:"rm.git-metadata",reason:v},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Rx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:xx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:op},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Ex},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:op}};function js(G,H){let j=Zn({...H,allowPaths:H.policy?.destructiveCommandAllowPaths,posixShell:!0}),J=G.map(t),oe=Gs(J),ie=Ax(G);for(let fe of ie){let Re=gi(fe.word);if(oe&&Re.unsafeBraceExpansion){let Te=Nt(Br({kind:"outside_anchored_cwd"},j,H.policy,ip),H.policy);if(Te)return Te;continue}for(let Te of Re.expandedTargets??[fe.text]){let ke=pn(Te),Le={targetIsLiteral:Re.expandedTargets!==void 0||Re.targetIsLiteral,tmpdirWordSplittingProtected:Re.tmpdirWordSplittingProtected};if(!oe&&j.resolvedCwd&&Gr(ke,j.resolvedCwd,j.protectedGitMetadata,oe,j.environment,j.budget))return Pt("rm.git-metadata",v);if(!oe)continue;for(let Xe of wx(ke,j,Le)){let Ye=Br(Xe,j,H.policy,ip),Ze=Nt(Ye,H.policy);if(Ze)return Ze}}}return null}function wx(G,H,j){let J=Tn(G,H,j);if(J.kind==="cwd_self_target")return[J,Tn(G,H,{...j,skipCwdSelf:!0})];if(J.kind!=="home_cwd_target")return[J];let oe=Tn(G,H,{...j,skipHomeCwd:!0});if(oe.kind!=="cwd_self_target")return[J,oe];return[J,oe,Tn(G,H,{...j,skipHomeCwd:!0,skipCwdSelf:!0})]}function Ax(G){let H=[],j=!1;for(let J of G.slice(1)){let oe=t(J);if(!oe)continue;if(oe==="--"){j=!0;continue}if(j){H.push({text:oe,word:J});continue}if(!oe.startsWith("-"))H.push({text:oe,word:J})}return H}var br={kind:"none"},Vr={kind:"dynamic"},Px=new Set(["<","<<","<<-","<<<","<&","<>"]),ap=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Tx=/^(?:[0-9]+|[@*])$/,Ix=pr.maxWords,lp=pr.maxInputLength;function cp(G){if(!G||Wt(Gt(G.words[0]?.text??""))!=="printf")return;if(G.words.some((oe)=>oe.provenance!=="literal"))return;let H=G.words.slice(G.words[1]?.text==="--"?2:1),j=H[0]?.text;if(j===void 0)return"";let J=H.slice(1).map((oe)=>oe.text);if(j==="%s")return J.join("");if(j==="%s\\n"||j===`%s
-`)return`${J.join(`
-`)}
-`;if(j.includes("%")||/\\(?![\\nrt])/.test(j))return;return j.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vs(G){let H=_o(G[1])==="--"?2:1;if(G.length<=H)return br;let j=G.slice(H);if(!j.every(Ei))return Vr;return{kind:"literal",source:j.map(t).join(" ")}}function dp(G){let H=_o(G[1])==="--"?2:1,j=G[H],J=_o(j);if(j===void 0||G.length<=H+1||J==="-"||J===""||J==="-l"||J==="-p")return br;if(!Ei(j))return Vr;return{kind:"literal",source:J}}function Ks(G,H){let j=fp(G);if(j===-1)return br;let J=Ox(H);if(!J)return br;let oe=[],ie=J.command?.length??0;for(let fe of J.references){let Re=Dx(fe,G,j,J.ifs);if(!Re)return Vr;if(ie+=Re.reduce((Te,ke)=>Te+ke.length+3,0),oe.length+Re.length>Ix||ie>lp)return Vr;oe.push(...Re)}if(J.command==="eval")return{kind:"literal",source:oe.join(" ")};if(oe.length===0||/\s/.test(oe[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[J.command,J.command&&J.optionTerminator?"--":null,...oe.map(Ee)].filter((fe)=>fe!==null).join(" ")}}function up(G,H){let j=fp(G),J=G.slice(j+1),oe=/\bIFS\b/.test(H);if(j===-1||!J.every(Ei)||oe)return H;let ie=J.map(_o),fe="",Re=null,Te=0;while(Te<H.length){let ke=H[Te]??"",Le=Re==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(H.slice(Te));if(Le){let Xe=Le[1]??Le[2],Ye=Xe==="@"||Xe==="*"?ie.slice(1):[ie[Number(Xe)]??""];if(Re!=='"'&&Ye.some((Qe)=>/[*?[]/.test(Qe)))return H;if(fe+=Re==='"'?Ye.map((Qe)=>Qe.replace(/["$`\\]/g,"\\$&")).join(Xe==="@"?'" "':" "):Ye.map((Qe)=>Qe.split(/[ \t\n]+/).map((et)=>et?Ee(et):"").join(" ")).join(" "),fe.length>lp)return H;Te+=Le[0].length;continue}if(ke==="\\"&&Re!=="'"){fe+=H.slice(Te,Te+2),Te+=2;continue}if(ke==="'"&&Re!=='"'||ke==='"'&&Re!=="'")Re=Re?null:ke;fe+=ke,Te++}return fe}function mp(G,H,j,J){if(!wn(G.map(t)).readsStdinAsCommands)return br;let oe=H.filter((ie)=>(ie.fd===void 0||ie.fd===0)&&Px.has(ie.operator)).at(-1);if(oe){if(oe.operator==="<<"||oe.operator==="<<-")return br;if(oe.operator!=="<<<"||oe.target?.provenance!=="literal")return Vr;return{kind:"literal",source:oe.target.text}}if(!j)return br;return J===void 0?Vr:{kind:"literal",source:J}}function dr(G,H=new Map){let j=wn(G.map(t)).scriptIndex;if(j===null)return br;let J=G[j],oe=_o(J);if(co(J,oe))return{kind:"literal",source:oe};let ie=J?Jn(J,H):null;return ie===null?Vr:{kind:"literal",source:ie}}var kx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function yc(G){if(G.words.length!==2||G.redirections.length!==0||G.nested.length!==1)return!1;let H=G.words[0],j=G.words[1];if(!H||H.provenance!=="literal"||H.quoted||H.raw!==H.text||!j)return!1;if(!(H.text==="eval"&&j.quoted&&j.parts.length===3&&j.parts[0]?.raw==='"'&&j.parts[1]?.provenance==="command-substitution"&&j.parts[1].raw.startsWith("$(")&&j.parts[2]?.raw==='"'||H.text==="eval"&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("$(")||(H.text==="source"||H.text===".")&&!j.quoted&&j.parts.length===1&&j.parts[0]?.provenance==="command-substitution"&&j.parts[0].raw.startsWith("<(")))return!1;let oe=G.nested[0];if(oe?.status!=="complete"||oe.nodes.length!==1)return!1;let ie=oe.nodes[0];if(ie?.kind!=="command"||ie.redirections.length!==0||ie.nested.length!==0||ie.words.some((Te)=>Te.provenance!=="literal"||Te.parts.some((ke)=>ke.provenance!=="literal")))return!1;let fe=ie.words[0]?.text;if(fe===void 0||Ln(fe)!==null)return!1;let Re=Wt(Gt(fe));return!kx.has(Re)&&!Qt.has(Re)&&!Ur(Re)}function fp(G){return wn(G.map(t)).commandIndex??-1}function Ox(G){let H=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(G.trim()),j=H?.[4]??G.trim(),J=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(j),oe=(J?.[3]??j).split(/\s+/).map(Mx);if(oe.length===0||oe.some((ie)=>ie===null))return null;return{command:J?.[1]??null,optionTerminator:J?.[2]!==void 0,references:oe.filter((ie)=>!!ie),ifs:H?H[1]??H[2]??H[3]??"":` 	
-`}}function Mx(G){let H=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(G),j=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(G),J=H??j;if(!J)return null;let oe=J[1]??J[2];return{parameter:oe==="@"||oe==="*"?oe:Number(oe),quoted:H!==null}}function Dx(G,H,j,J){let oe=H.slice(j+2);if(G.parameter==="@")return G.quoted?pc(oe):Nx(oe,J);if(G.parameter==="*"){let Re=pc(oe);if(!Re)return;let Te=Re.join(J[0]??"");return G.quoted?[Te]:gc(Te,J)}let ie=H[j+1+G.parameter];if(ie&&!Ei(ie))return;let fe=_o(ie);return G.quoted?[fe]:gc(fe,J)}function pc(G){return G.every(Ei)?G.map(t):void 0}function Nx(G,H){let j=pc(G);if(!j)return;let J=j.map((oe)=>gc(oe,H));return J.some((oe)=>oe===void 0)?void 0:J.flatMap((oe)=>oe??[])}function gc(G,H){if(["*","?","[","]"].some((j)=>G.includes(j)))return;if(H==="")return G===""?[]:[G];if(H===` 	
-`)return G.trim().split(/\s+/).filter(Boolean);if(H.length!==1)return;return H===" "||H==="\t"||H===`
-`?G.trim().split(/\s+/).filter(Boolean):G.split(H).filter(Boolean)}function Ei(G){if(!G)return!0;return G.provenance==="unknown"?!/[$`]/.test(t(G)):G.provenance==="literal"}function _o(G){return G?t(G):""}function Ee(G){return`'${G.replaceAll("'",`'"'"'`)}'`}function Cc(G,H){return hc(y(G,"posix"),H)}function Ri(G){return Cc(G,new Set(Array.from(G.matchAll(ap)).flatMap((H)=>{let j=H[1]??H[2];return j===void 0?[]:[j]})))}function hc(G,H){if(G.status==="invalid"||G.status==="limited")return!1;let j=new Set(H);for(let J of G.nodes){if(J.kind==="group"){if(hc(J.body,j))return!0;continue}if(J.kind!=="command")continue;if(J.nested.some((oe)=>hc(oe,j))||pp(J.words,j))return!0;zx(J,j)}return!1}function pp(G,H){let j=G.findIndex((fe)=>Ln(fe.text)===null);if(j===-1)return!1;let J=G[j];if(!J)return!1;if(vi(J,H))return!0;let oe=Gt(J.text);if(oe==="source"||oe==="."){let fe=G[j+1]?.text==="--"?j+2:j+1;return sp(G[fe],H)}if(Qt.has(oe)){let fe=G.slice(j),Re=wn(fe.map((ke)=>ke.text)),Te=Re.commandIndex??Re.scriptIndex;return!Re.syntaxCheck&&Te!==null&&sp(fe[Te],H)}let ie=Lx(G,j,H);if(ie===null)return!1;if(ie===-1)return!0;return pp(G.slice(ie),H)}function Lx(G,H,j){let J=Gt(G[H]?.text??"");if(J==="command")return Wx(G,H+1);if(J==="exec")return Fx(G,H+1);if(J==="env")return Gx(G,H+1,j);return null}function Wx(G,H){for(let j=H;j<G.length;j++){let J=G[j]?.text??"";if(J==="--")return G[j+1]?j+1:null;if(/^-[p]*[vV][pvV]*$/.test(J))return null;if(/^-p+$/.test(J))continue;return j}return null}function Fx(G,H){for(let j=H;j<G.length;j++){let J=G[j]?.text??"";if(J==="--")return G[j+1]?j+1:null;if(J==="-a"){j++;continue}if(/^-a.+/.test(J)||/^-[cl]+$/.test(J))continue;return j}return null}function Gx(G,H,j){for(let J=H;J<G.length;J++){let oe=G[J],ie=oe?.text??"";if(ie==="--")return G[J+1]?J+1:null;if(ie==="-S"||ie==="--split-string")return vi(G[J+1],j)?-1:J+2;if(ie.startsWith("-S")||ie.startsWith("--split-string="))return vi(oe,j)?-1:J+1;if(ie==="-u"||ie==="--unset"||ie==="-C"||ie==="--chdir"||ie==="-P"){J++;continue}if(ie==="-i"||ie==="-0"||ie==="--null"||ie.startsWith("-u=")||ie.startsWith("--unset=")||ie.startsWith("-C")||ie.startsWith("--chdir=")||ie.startsWith("-P"))continue;if(ie.startsWith("-"))continue;if(Ln(ie))continue;return J}return null}function zx(G,H){if(!G.words.every((j)=>Ln(j.text)!==null))return;for(let j of G.words){let J=Ln(j.text);if(!J)continue;if(vi(j,H))H.add(J.name)}}function vi(G,H){if(!G)return!1;return G.parts.filter((j)=>j.provenance==="variable").some((j)=>Array.from(j.raw.matchAll(ap)).some((J)=>{let oe=J[1]??J[2];return oe!==void 0&&(Tx.test(oe)||H.has(oe))}))}function sp(G,H){return!!G&&(G.parts.some((j)=>j.provenance!=="literal"&&j.provenance!=="variable")||vi(G,H))}var Sc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",bc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",$x="__CC_SAFETY_NET_XARGS_INPUT__",qs="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ys="rm",Bx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Ux=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Hx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,jx=/^(?:[0-9]+|[@*])$/;function yp(G,H){let j=G.map(t),{childStart:J,replacementToken:oe}=Kr(j),ie=j.slice(J),fe=Pt("xargs.shell-dynamic",bc);if(Kx(ie,oe,H)&&Nt(fe,H.policy))return Nt(fe,H.policy);for(let Re of Hn(ie,H)){let Te=Re.tokens,ke=oe!==null&&Te[0]!==ie[0]&&(Te[0]?.includes(oe)??!1)?Nt(fe,H.policy):null;if(ke)return ke;let Le=Rp(Te,oe,Re.wrapperEnvAssignments),Xe=Re.head==="rm"&&oe!==null&&vp(Te,oe),Ye=H.analyzeChild(Te,{...Hr(Re,H),dynamicInput:Le,dynamicSourceInput:Xe||Sp(Te,Re.head,oe,Re.wrapperEnvAssignments,Le,H.environment,H.strict?void 0:H.analyzeNested),dynamicRmInput:Xe,shellDynamicMatch:fe,dynamicSourceMatch:fe,rmDynamicMatch:Pt("xargs.rm-recursive-force-dynamic",Sc)});if(Ye)return Ye;let Ze=Vx(Te,oe,H.policy?.rules??[],Nt(fe,H.policy));if(Ze)return Ze;if(Re.head==="git"){let et=oe===null?[...Te,$x]:Te,tt=oe!==null&&(Te.some((_t)=>_t.includes(oe))||Array.from(Re.envAssignments.values()).some((_t)=>_t.includes(oe))),gt=H.analyzeChild(et,{...Hr(Re,H),worktreeMode:oe===null||tt?!1:H.worktreeMode});if(gt)return gt}let Qe=N(Te,H.policy?.rules??[]);if(Qe)return Qe}return null}function Vx(G,H,j,J){if(j.length===0)return null;if(H===null){for(let ie of j){let fe=N([...G,...ie.subcommand?[ie.subcommand]:[],...ie.block_args],j);if(fe)return fe}return null}let oe=Gt(G[0]??"");if(!j.some((ie)=>Gt(ie.command)===oe))return null;return G.slice(1).some((ie)=>ie.includes(H))?J:null}function Cp(G,H,j){let J=G.indexOf(H);if(J===-1||G.indexOf(H,J+H.length)!==-1)return[];let oe=rp(G,J,H.length,j);return oe===null?[]:[oe]}function Sp(G,H,j,J,oe,ie,fe){if(Qt.has(H)){if(lr(G))return!1;if(j!==null&&qx(G,j,fe))return!0;let Re=jn(G);if(!Re){let Te=dr(Jt(G));if(Te.kind==="literal")return j!==null&&Te.source.includes(j);return Te.kind==="none"&&oe}if(j!==null&&Re.includes(j)&&!bp(Re,j,fe))return!0;if(Nn(Re))return!0;return Yx(Re,j,J)}if(zn(H))return gp(G,j,hs,Rm(H));if(Dn.has(H))return gp(G,j,Xl,_f);if(H==="eval"){let Re=Vs(Jt(G));if(Re.kind==="dynamic")return!0;if(j!==null)return Re.kind==="literal"&&Re.source.includes(j);return oe}if(H==="find")return Zx(G,j,ie);if(H==="git"){let Re=In(G);return j===null?Re.subcommand===null:(Re.subcommand?.includes(j)??!1)||Re.subcommand!==null&&Eo.has(Re.subcommand.toLowerCase())&&Ep(Re.rest,j).some((Te)=>Te.includes(j))}return!1}function bp(G,H,j){if(j===void 0)return!1;let J=H.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${J}`).test(G)||/\bcase\b/.test(G))return!1;let ie=G.replaceAll(H,"/");return Nn(ie)===null&&j(ie)===null}function gp(G,H,j,J){let oe=j(G);if(H===null)return oe.optionsOpen||j([...G,qs]).sources.some((Re)=>Re.value===qs);if(oe.sources.some((Re)=>Re.value.includes(H)))return!0;let ie=J.flatMap((Re)=>[Re.selector,...Re.valueForm==="attached-only"||Re.valueForm==="attached-or-separate"?[`${Re.selector}${qs}`]:[],...Re.valueForm==="equals-or-separate"?[`${Re.selector}=${qs}`]:[]]),fe=new Set(ie.flatMap((Re)=>G.flatMap((Te)=>Cp(Te,H,Re))));return Hs(oe.sources,fe,(Re)=>j(G.map((Te)=>Te.replaceAll(H,Re))).sources)}function Kx(G,H,j){if(G.length===0||(G[0]??"").toLowerCase()==="command")return!1;let J=new Set(Array.from(Hn(G,j),(ie)=>ie.head)),oe=H===null?[...G,Ys]:G.map((ie,fe)=>fe===0?ie:ie.replaceAll(H,Ys));return Array.from(Hn(oe,j)).some((ie)=>ie.head===Ys&&!J.has(Ys))}function vp(G,H){return Ep(G.slice(1),H).some((j)=>j.includes(H)&&(j.startsWith("-")||j.startsWith(H)))}function Ep(G,H){let j=G.findIndex((J)=>J==="--"&&!J.includes(H));return j===-1?G:G.slice(0,j)}function Rp(G,H,j){if(H===null)return!0;return G.some((J)=>J.includes(H))||Array.from(j.values()).some((J)=>J.includes(H))}function qx(G,H,j){let J=wn(G),oe=J.commandIndex===null?"":G[J.commandIndex]??"";if(oe.includes(H)&&!bp(oe,H,j)||J.scriptIndex!==null&&(G[J.scriptIndex]??"").includes(H))return!0;return["-c","-nc","-cn",`--${H}`,H].some((fe)=>G.some((Re,Te)=>{if(Te===0||!Re.includes(H))return!1;return Cp(Re,H,fe).some((Le)=>{let Xe=G.map((Ze,Qe)=>Qe===Te?Ze.replaceAll(H,Le):Ze),Ye=wn(Xe);if(Ye.commandIndex===null&&Ye.scriptIndex===null)return!1;if(J.commandIndex===null&&Ye.commandIndex!==null)return!0;if(J.scriptIndex===null&&Ye.scriptIndex!==null)return!0;if(Ye.commandIndex!==null&&(Xe[Ye.commandIndex]??"").includes(Le))return!0;return Ye.scriptIndex!==null&&(Xe[Ye.scriptIndex]??"").includes(Le)})}))}function Yx(G,H,j){let J=new Set(H===null?[]:Array.from(j).filter(([,oe])=>oe.includes(H)).map(([oe])=>oe));for(let oe of G.matchAll(Bx))if(hp(oe,J))return!0;for(let oe of G.matchAll(Ux))for(let ie of(oe[1]??"").matchAll(Hx))if(hp(ie,J))return!0;return Cc(G,J)}function hp(G,H){let j=G[1]??G[2];return j!==void 0&&(jx.test(j)||H.has(j))}function Zx(G,H,j){if(H===null)return!0;let J=!1,oe=0;for(let ie=1;ie<G.length;ie++){let fe=G[ie]??"";if(!J&&!fe.startsWith("-")&&fe!=="!"&&fe!=="("){if(fe.indexOf(H)===0)return!0;continue}if(J=!0,oe>0){oe--;continue}if(Xn(fe)){let Te=vo(G,ie);ie=Te.nextIndex-1;for(let ke of Hn(Te.tokens,{environment:j,cwd:void 0})){let Le=Rp(ke.tokens,H,ke.wrapperEnvAssignments);if(ke.head==="rm"&&vp(ke.tokens,H)||Sp(ke.tokens,ke.head,H,ke.wrapperEnvAssignments,Le,j))return!0}continue}let Re=cr(fe);if(Re>0){if(oe=Re,fe.includes(H))return!0;continue}if(fe.includes(H))return!0}return!1}function Kr(G){let H=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),j=null,J=1;while(J<G.length){let oe=G[J];if(!oe)break;if(oe==="--")return{childStart:J+1,replacementToken:j};if(!oe.startsWith("-"))return{childStart:J,replacementToken:j};if(oe==="-I"){j=G[J+1]??"{}",J+=2;continue}if(oe.startsWith("-I")&&oe.length>2){j=oe.slice(2),J++;continue}if(oe==="--replace"){j="{}",J++;continue}if(oe.startsWith("--replace=")){let ie=oe.slice(10);j=ie===""?"{}":ie,J++;continue}if(oe==="-J"){j=G[J+1]??"{}",J+=2;continue}J+=H.has(oe)?2:1}return{childStart:G.length,replacementToken:j}}var _i="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",xi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Jx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Qx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Xs=/\{[^{}\s]*\}/g,_p=/\{\}|\{-?\d+\}/g,xp=/[\s;&|<>()$`\\"']/,ew=["e","f","source","file","-e","-f","--source","--file"],tw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],nw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),rw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),wp=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),ow=new Set(["--workdir","--wd"]),Ap="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Wn(G,H){for(let j of G){let J=H(j);if(J)return J}return null}function Ip(G){return Wn([...G],(H)=>Nn(H))}function kp(G,H){let j=G.map(t);if((H.envAssignments?.has("PARALLEL")?H.envAssignments.get("PARALLEL"):H.environment.env.get("PARALLEL"))?.trim()){let Qe=xo(H);if(Qe)return Qe}if(j.length===2&&(j[1]==="--version"||j[1]==="--help"))return null;let oe=Up(j),{template:ie,jobs:fe,runsRemotely:Re,readsCommandsFromInput:Te,unsupported:ke,workdir:Le,dryRun:Xe}=oe;if(ke){let Qe=xo(H);if(Qe)return Qe;let et=Ip(H.envAssignments?.values()??[]);if(et)return et}if(Te){let Qe=uw(H);if(Qe)return Qe}if(Le!==void 0&&Re){let Qe=xo(H);if(Qe)return Qe}let Ye=mw(Le,H.cwd,H.environment.paths);if(Ye===null){let Qe=xo(H);if(Qe)return Qe}let Ze=Re?{...H,cwd:void 0,originalCwd:void 0}:Ye===null||Ye===void 0||Ye===H.cwd?H:{...H,cwd:Ye};if(Xe){if([...Hn(ie,Ze)].flatMap((et)=>[...et.envAssignments.values()]).some(Rc)){let et=xo(H);if(et)return et}return null}if(ie.length===0){let Qe=fe.map((tt)=>tt[0]??"");H.budget.charge("derivedTokens",Qe.length);let et=Wp(Ze.envAssignments,Ze.cwd,Re);return Wn(Qe,(tt)=>H.analyzeNested(tt,et))}return Wn(Hn(ie,Ze),(Qe)=>iw(Qe,oe,H,Ze))}function iw(G,H,j,J){let{templateHasPlaceholder:oe,runsRemotely:ie,usesStdin:fe}=H,Re=G.tokens,Te=[...G.envAssignments.values()];if(Te.some($p)){let At=xo(j);if(At)return At}let ke=Ip(Te);if(ke)return ke;let Le=Te.some(jt),Xe=oe||Le,Ye=fe&&Xe,Ze=Wp(G.envAssignments,G.wrapperCwd,ie||Ye),Qe=Xe?{...Ze,worktreeMode:!1}:Ze,et=Re.join(" "),tt=jt(et.split(/[ \t\n=]/,1)[0]??""),gt=!H.quotesCommand&&(tt||Re.some((At)=>xp.test(At))),_t=tt||xp.test(Re[0]??""),yt=gt&&_t&&H.jobs.length>0?null:sw(G,H,j,J,Qe,Le);if(yt||!gt)return yt;return Op(jt(et)?et:`${et} {}`,!tt,G,H,j,J,Qe)}function sw(G,H,j,J,oe,ie){let{jobs:fe,templateHasPlaceholder:Re,runsRemotely:Te,usesStdin:ke}=H,Le=G.tokens,Xe=Re||ie;if(Qt.has(G.head)){let Ze=()=>{if(!Re||fe.length===0)return null;return Wn(fe,(tt)=>j.analyzeChild(Zs(Le,tt,j.budget),Hr(G,J)))};if(lr(Le))return Ze();let Qe=jn(Le);if(Qe){if(Bp(Qe)){let yt=vr(j);if(yt)return yt;if(fe.length===0)return null;return Wn(fe,(At)=>j.analyzeNested(Gp(Qe,At,j.budget),oe))}if(jt(Qe))return Op(Qe,!1,G,H,j,J,oe);let tt=!ie&&(!Re||fe.length>0)?(fe.length>0?fe:[void 0]).map((yt)=>Ks(Jt(yt===void 0?Le:Re?Le.map((At)=>Fp(At,yt)):[...Le,...yt]),Qe)):[];if(tt.some((yt)=>yt.kind==="dynamic")){let yt=vr(j);if(yt)return yt}let gt=tt.flatMap((yt)=>yt.kind==="literal"?[yt.source]:[]);if(gt.length>0)return j.budget.charge("derivedTokens",gt.length),Wn(gt,(yt)=>j.analyzeNested(yt,oe));if(Ri(Qe)){let yt=vr(j);if(yt)return yt}let _t=j.analyzeNested(Qe,oe);if(_t)return _t;if(Xe)return vr(j);return null}let et=dr(Jt(Le));if(et.kind==="dynamic"||et.kind==="literal"&&jt(et.source))return vr(j)??Ze();if(et.kind==="literal")return Ze();if(fe.length>0){let tt=vr(j);if(tt)return tt;let gt=Ze();if(gt)return gt;if(Re)return null;let _t=fe.flatMap((yt)=>yt[0]===void 0?[]:[yt[0]]);return j.budget.charge("derivedTokens",_t.length),Wn(_t,(yt)=>j.analyzeNested(yt,oe))}if(Xe||ke)return vr(j)??Ze();return null}if(G.head==="rm"&&ar(Le)){if(Re&&fe.length>0)return Wn(fe,(Qe)=>vc(Zs(Le,Qe,j.budget,_p),G.cwd,J));if(fe.length>0)return Wn(fe,(Qe)=>vc(Tp(Le,Qe,j.budget),G.cwd,J));let Ze=vc(Le.flatMap((Qe,et)=>{if(et===0||!jt(Qe))return[Qe];return Qe.startsWith("-")?[Qe.replace(_p,"")]:[]}),G.cwd,J);if(Ze)return Ze;return Lp(j)}let Ye=fe.length>0?fe:[void 0];return Wn(Ye,(Ze)=>{let Qe=Ze===void 0?Le:Re?Zs(Le,Ze,j.budget):Tp(Le,Ze,j.budget),et=Pt("parallel.shell-dynamic",xi),tt=ke&&G.head==="find"?dw(Qe,J):null,gt=Dp(Qe,ke,j)??tt?.customResult??null,_t=Gt(G.head),yt=ke&&(_t==="rm"&&Ec(Qe)||_t==="xargs"&&Np(Qe)||tt?.rmOptions===!0),At=ke&&(yt||tt?.executedSource===!0||tt===null&&Mp(Qe,_t)),Mt=j.analyzeChild(Qe,{...Hr(G,J),worktreeMode:Te||ke||Xe?!1:j.worktreeMode,dynamicInput:ke||Xe,dynamicRmInput:yt,dynamicSourceInput:gt!==null||At,shellDynamicMatch:et,dynamicSourceMatch:et,rmDynamicMatch:Pt("parallel.rm-recursive-force-dynamic",_i)});if(At){let Dt=Nt(et,j.policy);if(Dt)return Dt}return Mt??gt??N(Qe,j.policy?.rules??[])})}function Op(G,H,j,J,oe,ie,fe){if(J.jobs.length>0)return Wn(J.jobs,(ke)=>oe.analyzeNested(Gp(G,H?ke.map(Ee):ke,oe.budget),fe));let Re=bi(G);if(Re?.[0]&&Gt(Re[0])==="rm"&&ar(Re)){let ke=Lp(oe);if(ke)return ke}return(Re?oe.analyzeChild(Re,{...Hr(j,ie),dynamicInput:J.usesStdin,shellDynamicMatch:Pt("parallel.shell-dynamic",xi),rmDynamicMatch:Pt("parallel.rm-recursive-force-dynamic",_i)}):null)??oe.analyzeNested(G,fe)}function Mp(G,H){if(jt(G[0]??""))return!0;if(H==="eval"||H==="source"||H===".")return!0;if(H==="parallel"||H==="xargs")return!0;if(Qt.has(H))return cw(G);if(H==="git")return aw(G);if(H==="find")return!0;if(Dn.has(H))return Pp(G,ew,Ci);if(zn(H))return Pp(G,tw,gs);return!1}function Ec(G){let H=G.indexOf("--"),j=G.slice(1,H===-1?void 0:H);if(!G.some(jt))return H===-1;return j.some((oe)=>jt(oe)&&(oe.startsWith("-")||Bp(oe)))}function aw(G){if(lw(G))return!0;let H=In(G);if(H.subcommand===null||jt(H.subcommand))return!0;if(!Eo.has(H.subcommand.toLowerCase()))return!1;let j=H.rest.indexOf("--"),J=H.rest.slice(0,j===-1?void 0:j);if(!G.some(jt))return j===-1;return J.some(jt)}function lw(G){for(let H=1;H<G.length;H++){let j=G[H];if(!j||j==="--"||!j.startsWith("-"))return!1;if(j==="-c"||j==="--config-env"){if(jt(G[H+1]??""))return!0;H++;continue}if(j.startsWith("-c")&&j.length>2||j.startsWith("--config-env=")){if(jt(j))return!0;continue}if(jt(j))return!0}return!1}function cw(G){if(lr(G))return!1;let H=jn(G);if(H!==null)return jt(H);let j=dr(Jt(G));if(j.kind==="literal")return jt(j.source);if(j.kind==="dynamic")return!0;return!G.some(jt)}function Pp(G,H,j){let J=j(G);if(J.some((oe)=>jt(oe.value)))return!0;if(!G.some(jt))return j([...G,Ap]).some((oe)=>oe.value===Ap);return Hs(J,H,(oe)=>j(G.map((ie)=>Fp(ie,[oe]))))}function Dp(G,H,j){let J=j.policy?.rules??[];if(!H||J.length===0)return null;let oe=J.filter((ie)=>Gt(ie.command)===Gt(G[0]??""));if(oe.length===0)return null;if(G.slice(1).some(jt))return vr(j);return Wn(oe,(ie)=>N([...G,...ie.subcommand?[ie.subcommand]:[],...ie.block_args],[ie]))}function dw(G,H){let j={customResult:null,executedSource:!G.some(jt),rmOptions:!1},J=!1,oe=0,ie=null,fe=()=>{if(!ie?.some(jt))return;for(let Re of Hn(ie,H))j.executedSource||=Mp(Re.tokens,Re.head),j.rmOptions||=Re.head==="rm"&&Ec(Re.tokens)||Re.head==="xargs"&&Np(Re.tokens),j.customResult??=Dp(Re.tokens,!0,H)};for(let Re of G.slice(1)){if(!J&&!Re.startsWith("-")&&Re!=="!"&&Re!=="("){j.executedSource||=jt(Re);continue}if(J=!0,ie){if(Re===";"||Re==="+"){fe(),ie=null;continue}ie.push(Re);continue}if(oe>0){oe--;continue}if(Xn(Re)){ie=[],j.executedSource||=jt(Re);continue}let Te=cr(Re);if(Te>0){oe=Te,j.executedSource||=jt(Re);continue}j.executedSource||=jt(Re)}return fe(),j}function Np(G){let H=G.slice(Kr(G).childStart);return Gt(H[0]??"")==="rm"&&Ec(H)}function Js(G,H){return(j)=>Nt(Pt(G,H),j.policy)}var vr=Js("parallel.shell-dynamic",xi),uw=Js("parallel.command-stream-dynamic",Jx),xo=Js("parallel.command-stream-dynamic",Qx),Lp=Js("parallel.rm-recursive-force-dynamic",_i);function vc(G,H,j){return Nt(js(Jt(G),{environment:j.environment,cwd:H,budget:j.budget,originalCwd:j.originalCwd,strict:j.strict,paranoid:j.paranoidRm,allowTmpdirVar:j.allowTmpdirVar,tmpdirWordSplittingUnsafe:zr(j.envAssignments??new Map,j.environment),trustedTmpdirValue:Co(j.envAssignments??new Map,j.environment),protectedGitMetadata:j.protectedGitMetadata,policy:j.policy}),j.policy)}function Wp(G,H,j){let J={};if(G)J.envAssignments=G;if(j)return J.effectiveCwd=null,J.worktreeMode=!1,J;if(H!==void 0)J.effectiveCwd=H;return Object.keys(J).length>0?J:void 0}function Fp(G,H){return G.replace(Xs,(j)=>zp(j,H))}function Zs(G,H,j,J=Xs){return j.charge("derivedTokens",G.reduce((oe,ie)=>oe+1+Math.floor(ie.length/64),0)),G.map((oe)=>oe.replace(J,(ie)=>{let fe=zp(ie,H);return j.charge("derivedTokens",Math.max(1,Math.ceil(fe.length/64))),fe}))}function Gp(G,H,j){return Zs([G],H,j)[0]??""}function Tp(G,H,j){return j.charge("derivedTokens",G.length+H.length),[...G,...H]}function zp(G,H){let j=/^\{(-?\d+)[^{}\s]*\}$/.exec(G)?.[1];if(j===void 0)return H[0]??"";let J=Number(j);return H[J>0?J-1:H.length+J]??""}function jt(G){return G.search(Xs)!==-1}function $p(G){if(Rc(G))return!0;for(let H of G.matchAll(Xs))if(!/^(?:\{\}|\{\d+\})$/.test(H[0]))return!0;return!1}function Rc(G){let H=G.indexOf("{=");return H!==-1&&G.indexOf("=}",H+2)!==-1}function Bp(G){return/^\{[^{}\s]*\}$/.test(G)}function mw(G,H,j){if(G===void 0)return;if(G==="..."||/^~|[{}$`*?[]/.test(G))return null;if(!H&&!Xx(G))return null;try{return gr(H??G,G,j)}catch{return null}}function Up(G){let H=1,j=[],J=G.length,oe=-1,ie=!1,fe=!1,Re=!1,Te,ke=!1,Le=G.some((et)=>et==="::::"||et==="::::+"||et===":::+");while(H<G.length){let et=G[H];if(et===void 0)break;if(et===":::"){oe=H;break}if(et==="--"){let At=ec(G,H+1);j.push(...At.templateTokens),J=H+1,oe=At.markerIndex;break}if(!et.startsWith("-")){let At=ec(G,H);j.push(...At.templateTokens),J=H,oe=At.markerIndex;break}let tt=G[H+1],gt=et.indexOf("="),_t=gt===-1?et:et.slice(0,gt),yt=gt===-1?void 0:et.slice(gt+1);if(et==="--dry-run"){ke=!0,H++;continue}if(et==="-I"||et.startsWith("-I")&&et.length>2){Le||=(et==="-I"?tt:et.slice(2))!=="{}",H+=et==="-I"?2:1;continue}if(et==="--replace"||et==="-i"){Le=!0,H+=2;continue}if(_t==="--replace"||et.startsWith("-i")&&et.length>2){let At=_t==="--replace"?yt:et.slice(2);Le||=At!==""&&At!=="{}",H++;continue}if(et==="-a"||rw.has(_t)){Le=!0,H+=yt===void 0?2:1;continue}if(et==="-q"||et==="--quote"){fe=!0,H++;continue}if(et==="--pipe"||et==="--pipepart"){Re=!0,H++;continue}if(_t==="--env"){Le=!0,H+=yt===void 0?2:1;continue}if(wp.has(_t)||et.startsWith("-S")&&et.length>2){ie=!0,H+=wp.has(et)?2:1;continue}if(ow.has(_t)){Le=!0;let At=yt??tt;if(At===void 0||At===":::"||At==="--"){H++;continue}Te=At,H+=yt===void 0?2:1;continue}if(et.startsWith("-j")&&et.length>2&&/^\d+$/.test(et.slice(2))){H++;continue}if(et.startsWith("--")&&yt!==void 0){H++;continue}if(nw.has(et)){if(tt===void 0||tt===":::"||tt==="--"){Le=!0,H++;continue}H+=2;continue}H+=et==="-j"||et==="--jobs"?2:1}Le||=j.some(ke?Rc:$p);let Xe=[];if(oe!==-1){let et=[];for(let tt=oe+1;tt<G.length;tt++){let gt=G[tt];if(gt===":::"){Xe.push(et),et=[];continue}if(gt!==void 0)et.push(gt)}Xe.push(et)}Le||=Xe.length>1;let Ye=fw(Xe),Ze=j.some(jt),Qe=j.length===0&&oe===-1;return{template:j,jobs:Ye,childStart:J,templateHasPlaceholder:Ze,runsRemotely:ie,quotesCommand:fe,usesStdin:Re||oe===-1,readsCommandsFromInput:Qe,unsupported:Le,workdir:Te,dryRun:ke}}function fw(G){if(G.length===0||G.some((j)=>j.length===0))return[];let H=[[]];for(let[j,J]of G.entries()){if(J.length===1){let ie=J[0];if(ie===void 0)return[];for(let fe of H)fe.push(ie);if(H.length*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let oe=[];for(let ie of H)for(let fe of J){if((oe.length+1)*(j+1)>a.derivedTokens.cap)throw new s("derivedTokens");oe.push([...ie,fe])}H=oe}return H}function Hp(G){return Up(G).childStart}var pw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qs="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function xc(G){return G?.parts.some((H)=>H.provenance==="command-substitution")??!1}function _c(G){return G?.parts.some((H)=>H.provenance==="literal"&&H.raw.replace(/^["']/,"").startsWith("-"))??!1}function Vp(G,H,j,J,oe=!1,ie){let Re=(Zo(G,H)||J&&G!=="powershell"&&H[0]?.provenance==="variable")&&rn(ie,"shell.dynamic-executable",oe)?Pt("shell.dynamic-executable",pw):null;return Nt(Re,ie)??Kp(G,H,j,oe,ie)}function Kp(G,H,j,J,oe){if(H.length<2)return null;let ie=H.flatMap((Re,Te)=>xc(Re)?[Te]:[]);if(ie.length===0)return null;let fe=Gt(H[0]?.text??"");if(fe==="git"){let Re=re(G,H),Te=hw(Re);if(rn(oe,"shell.dynamic-structure",J)&&ie.some((Xe)=>Xe<=Te))return Nt(Pt("shell.dynamic-structure",Qs),oe);if(Nt(Us(Re,{environment:j}),oe))return null;let ke=H[Te]?.text.toLowerCase(),Le=Re.findIndex((Xe,Ye)=>Ye>Te&&t(Xe)==="--");if(rn(oe,"shell.dynamic-structure",J)&&ke&&Eo.has(ke)&&ie.some((Xe)=>Xe>Te&&(Le===-1||Xe<Le)))return Nt(Pt("shell.dynamic-structure",Qs),oe);return null}if(fe==="find")return rn(oe,"shell.dynamic-structure",J)&&yw(H)?Nt(Pt("shell.dynamic-structure",Qs),oe):null;if(fe==="rm"){let Re=H.findIndex((ke,Le)=>Le>0&&t(ke)==="--"),Te=ar(H.map(t));return rn(oe,"shell.dynamic-structure",J)&&ie.some((ke)=>(Re===-1||ke<Re)&&(ke<H.length-1||!Te))?Nt(Pt("shell.dynamic-structure",Qs),oe):null}if(fe==="xargs")return jp(G,H.slice(Kr(H.map(t)).childStart),"xargs",j,J,oe);if(fe==="parallel")return jp(G,H.slice(Hp(H.map(t))),"parallel",j,J,oe);return null}function jp(G,H,j,J,oe,ie){if(H.length===0)return null;let fe=gw(H,J);if(Zo(G,fe)){let Te=Nt(Pt(`${j}.shell-dynamic`,j==="xargs"?bc:xi),ie);if(Te)return Te}let Re=Kp(G,fe,J,oe,ie);if(Re)return Re;if(fe[0]?.text==="rm"&&fe.slice(1).some((Te)=>xc(Te)&&_c(Te)))return Nt(Pt(`${j}.rm-recursive-force-dynamic`,j==="xargs"?Sc:_i),ie);return null}function gw(G,H){let j=Wr(G,H),J=j.rewritten?Jt(j.words.map(t)):j.words,oe=J[0];return oe&&t(oe)==="busybox"?J.slice(1):J}function hw(G){let H=1;while(H<G.length){let j=G[H],J=j?t(j):"";if(xn.has(J)){H+=2;continue}if(J.startsWith("-")){H++;continue}return H}return H}function yw(G){let H=!1,j=0,J=!1,oe=!1;for(let ie=1;ie<G.length;ie++){let fe=G[ie];if(!fe)continue;let Re=xc(fe);if(j>0){j--;continue}if(oe){if(fe.text===";"||fe.text==="+"){oe=!1,H=!0,J=!1;continue}if(Re&&(J||_c(fe)))return!0;J=!1;continue}if(!H&&!fe.text.startsWith("-")){if(Re&&(ie>1||_c(fe)))return!0;continue}if(H=!0,Re)return!0;let Te=cr(fe.text);if(Te>0){j=Te;continue}if(Xn(fe.text))oe=!0,J=!0}return!1}function wc(G,H){return G.some((j)=>{if(j.value==="-"&&(j.kind==="main-script"||j.kind==="program-file"))return!0;return!co(H[j.tokenIndex],j.value)})}var qp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cw="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Sw="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",bw="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",vw="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",Ew="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",Rw={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:bw},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:v},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:Sw},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:Ew},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:qp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:Cw},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:qp}},_w=/^\/\/?[ck]$/i,Yp=/[&|]+/,xw=/(?:"[^"]*"|[^\s"])+/g,ww=/[\^%!]/,Aw=/\\"./s,Pw=/(^|\/)[*.]*\*[*.]*$/,Tw=/^"?[\\/]+[?.][\\/]/,Iw=new Set(["rmdir","rd","del","erase"]),kw=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,Ow=/\/s(?!\w)/i,Mw=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Zp(G,H){let j=G.map(t),J=j.findIndex((Ye)=>_w.test(Ye));if(J===-1)return null;let oe=j.slice(J+1).join(" "),ie=/^".*"$/s.test(oe)?oe.slice(1,-1):oe,fe=ie.split(Yp).map((Ye)=>{let Ze=Ye.match(xw)??[],Qe=Ze.findIndex((tt)=>Iw.has(tt.replace(/^@/,"").toLowerCase())),et=Qe===-1?[]:Ze.slice(Qe);return{piece:Ye,tokens:Ze,deleteTokens:et,recursiveDelete:et.slice(1).some((tt)=>tt.startsWith("/")&&tt.toLowerCase().split("/").includes("s"))}}),Re=fe.filter((Ye)=>Ye.recursiveDelete),Te=Re.length>0||kw.test(ie)&&Ow.test(ie);if(Te&&(ie.includes("\\\"")||H.gitBashEscapesBodyQuotes&&ie.includes('"')||H.powerShellRawWords.some((Ye)=>Aw.test(Ye))||Re.some((Ye)=>Ye.tokens.some((Ze)=>Tw.test(Ze)))))return Pt("cmd.recursive-delete-escaped-quote",vw);let ke=Zn({...H,allowPaths:H.policy?.destructiveCommandAllowPaths}),Le=fe.reduce((Ye,Ze)=>Ye??(Ze.recursiveDelete?Dw(Ze.deleteTokens,ke,H.policy):H.analyzeNested(Ze.piece)),null),Xe=Te&&(Re.length===0||ww.test(ie)||Mw.test(ie)||ie.includes('"')&&Yp.test(ie));return Le??(Xe?ho():null)}function Dw(G,H,j){return G.slice(1).filter((J)=>!J.startsWith("/")).reduce((J,oe)=>J??Nt(Br(Tn(hi(oe.replaceAll('"',"")).replace(Pw,"$1*"),H),H,j,Rw),j),null)}var Nw="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",Lw=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,Ww=/^-(?:executionpolicy|ep)$/i,Fw=/^-(?:command|c)$/i,Gw=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,zw="encodedcommand",$w=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,Bw=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Uw=/[$`]/,Hw="--%";function Xp(G,H){let j=G.map(t),J=j.every((ie,fe)=>fe===0||ie!==Hw&&jw(G[fe],ie))?Pc(j):void 0;if(J!==void 0)return H(J);if(j.some(Vw))return ho();let oe=j.join(" ");return $w.test(oe)&&Bw.test(oe)?Pt("powershell.nested-recursive-delete-unread",Nw):null}function Pc(G){let H=Ac(G,1),j=H===void 0?[]:G.slice(H+1);return j.length>0?j.join(" "):void 0}function Ac(G,H){let j=G[H]??"";if(Fw.test(j))return H;if(Lw.test(j))return Ac(G,H+1);return Ww.test(j)?Ac(G,H+2):void 0}function jw(G,H){return G?.provenance==="unknown"?!Uw.test(H):co(G,H)}function Vw(G){let H=Gw.exec(G)?.[1]?.toLowerCase();return H!==void 0&&(H==="ec"||zw.startsWith(H))}var Qp=[{heads:new Set(["rm","rmdir"]),analyze:(G)=>js(G.words,Tc(G))},{heads:new Set(["cmd"]),analyze:(G)=>Zp(G.words,{...Tc(G),powerShellRawWords:G.options.commandView?.dialect==="powershell"?G.options.commandView.words.map((H)=>H.raw):[],gitBashEscapesBodyQuotes:G.options.commandView?.dialect!=="powershell",analyzeNested:(H)=>Er(G.options.analyzeNested(H,{effectiveCwd:G.effectiveCwd,envAssignments:G.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(G)=>Xp(G.parsedWords,(H)=>Er(G.options.analyzeNested(H,{effectiveCwd:G.effectiveCwd,envAssignments:G.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(G)=>Us(G.words,Ic(G))},{heads:new Set(["find"]),analyze:(G)=>Of(G.words,{...Tc(G),envAssignments:G.envAssignments,analyzeTokens:G.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(G)=>yp(G.words,{...Jp(G),analyzeChild:G.analyzeChild,analyzeNested:(H,j)=>Er(G.options.analyzeNested(H,j))})},{heads:new Set(["parallel"]),analyze:(G)=>kp(G.words,{...Jp(G),analyzeChild:G.analyzeChild,analyzeNested:(H,j)=>Er(G.options.analyzeNested(H,j))})}];function Jp(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoidRm:G.options.paranoidRm,paranoidInterpreters:G.options.paranoidInterpreters,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.options.protectedGitMetadata,budget:G.options.budget,envAssignments:G.envAssignments,worktreeMode:G.options.worktreeMode,policy:G.options.policy}}function Er(G){return G?{id:G.ruleId,reason:G.reason,intent:G.intent??"manual_only"}:null}function Tc(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,strict:G.options.strict,paranoid:G.options.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,tmpdirWordSplittingUnsafe:zr(G.envAssignments,G.options.environment),trustedTmpdirValue:Co(G.envAssignments,G.options.environment),protectedGitMetadata:G.options.protectedGitMetadata,policy:G.options.policy,budget:G.options.budget}}function Ic(G){return{environment:G.options.environment,cwd:G.cwd,originalCwd:G.originalCwd,dynamicArguments:G.dynamicArguments,envAssignments:G.envAssignments,shellAssignments:G.options.shellAssignments,policy:G.options.policy,worktreeMode:G.options.worktreeMode}}function ng(G){return Qp.find((H)=>H.heads.has(G))?.analyze}function Ao(G,H,j){let J=j.trace;if(G.length===0)return null;let oe=j.commandView?.dialect??"posix",ie=(It)=>It.map((Ft)=>oe==="posix"?t(Ft):Ft.text),fe=j.child,Re=fe!==void 0&&!fe.embedded,Te=fe?.embedded===!0,ke=j.effectiveCwd===null,Le=fe?fe.cwd:ke?void 0:j.effectiveCwd??j.cwd,Xe=fe?fe.originalCwd:ke?void 0:j.cwd,Ye=Ce(G);if(Ye.envAssignments.size>0)J?.recordSegment({type:"env-strip",input:ie(G),envVars:[...Ye.envAssignments.keys()],output:ie(Ye.words)});let Ze=Wr(Ye.words,j.environment,Le,new Map([...j.envAssignments??[],...Ye.envAssignments])),Qe=Ze.envSplitValues??[];if(Qe.length>0){let It=[...Qe,...ie(Ze.words)].join(" "),Ft=Nn(It);if(Ft)return J?.recordSegment({type:"dangerous-text",token:It,matched:!0,reason:Ft.reason}),hn(Ft);if(j.strict)return En(J);let Vt=bs(Qe,ie(Ze.words));if(Vt){j.budget.charge("derivedTokens",Vt.length);let ln=j.analyzeNested(Vt.join(" "),{effectiveCwd:Ze.cwd===void 0?j.effectiveCwd:Ze.cwd,envAssignments:new Map([...j.envAssignments??[],...Ye.envAssignments,...Ze.envAssignments])});if(ln)return ln}}let et=Ze.rewritten?Jt(ie(Ze.words)):re(oe,Ze.words),tt=ie(et),gt={...j,wrapperNormalizationBudget:j.wrapperNormalizationBudget??{iterations:0}};if(J&&Ye.words.length>et.length){let It=ie(Ye.words);J.recordSegment({type:"leading-tokens-stripped",input:It,removed:It.slice(0,It.length-et.length),output:tt})}let _t=new Map([...j.envAssignments??[],...Ye.envAssignments,...Ze.envAssignments]),yt=tt[0];if(!yt)return null;if(Ur(yt))throw new s("wrapperPeelIterations");let At=Gt(yt),Mt=Ze.cwd===null?void 0:Ze.cwd??Le,Dt=Ze.cwd===null?void 0:Xe,Lt=Ze.cwd===void 0?j.effectiveCwd:Ze.cwd,ht=fe?fe.allowTmpdirVar:!pi(_t,j.environment),Ot=Vp(oe,Ze.words,j.environment,H===0,j.strict,j.policy);if(Ot)return J?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Ot.reason}),hn(Ot);let $t=Ws(tt,j.policy);if($t){for(let It of[$t.childIndex,...$t.alternativeChildIndices]){eg(gt.wrapperNormalizationBudget);let Ft=et.slice(It);J?.recordSegment({type:"transparent-wrapper",wrapper:$t.wrapper,output:ie(Ft)});let Vt=Ao(Ft,H,{...gt,effectiveCwd:Lt,envAssignments:_t});if(Vt)return Vt}return null}let sn=Te?void 0:At==="eval"?Vs(et):At==="trap"&&!Re?dp(et):void 0;if(Re&&fe&&At==="eval"){if(sn?.kind==="dynamic")return wo(fe,j.policy);if(sn?.kind==="literal"){let It=j.analyzeNested(sn.source,{effectiveCwd:Lt,envAssignments:_t});if(It)return It}return Po(fe,j.policy)}if(sn?.kind==="dynamic"&&(j.strict||!j.commandView||!yc(j.commandView)))return En(J);if(sn?.kind==="literal"){J?.recordSegment({type:"recurse",reason:At==="eval"?"shell-eval":"shell-trap",innerCommand:sn.source,depth:H+1});let It=j.analyzeNested(sn.source,{effectiveCwd:Lt,envAssignments:_t,functionDefinitions:j.functionDefinitions});if(It)return It}if(Re?Qt.has(At):og(yt,At)){if(lr(tt))return null;if(Re&&fe){let It=jn(tt);if(It){if(fe.dynamicSourceInput??fe.dynamicInput){let Vt=wo(fe,j.policy);if(Vt)return Vt}if(Ri(It)){let Vt=wo(fe,j.policy);if(Vt)return Vt}return j.analyzeNested(It,{effectiveCwd:Lt,envAssignments:_t})}let Ft=dr(et);if(Ft.kind==="dynamic")return wo(fe,j.policy);if(Ft.kind==="literal")return fe.dynamicSourceInput?wo(fe,j.policy):null;return fe.dynamicSourceInput??fe.dynamicInput?wo(fe,j.policy):null}if(Te){let It=jn(tt),Ft=It?j.analyzeNested(It,{effectiveCwd:Lt,envAssignments:_t}):dr(et).kind==="dynamic"?En(J):null;if(Ft)return Ft}if(fe===void 0){let It=Zw(tt,_t,Lt,j,J,H);if(It)return It;let Ft=jn(tt);if(Ft){let Qr=Ks(et,Ft);if(Qr.kind==="dynamic")return En(J);let pa=Qr.kind==="literal"?Qr.source:up(et,Ft),td=Xw(pa);J?.recordSegment({type:"shell-wrapper",wrapper:At,innerCommand:td}),J?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:td,depth:H+1});let nd=j.analyzeNested(pa,{effectiveCwd:Lt,envAssignments:_t});if(nd)return nd;return Ri(pa)?En(J):null}let Vt=dr(et,j.strict?void 0:j.shellAssignments);if(Vt.kind==="dynamic")return En(J);if(Vt.kind==="literal")return ea(Vt.source,Lt,_t,j,J,H);let ln=mp(et,j.commandView?.redirections??[],j.hasPipelineInput??!1,j.literalShellInput);if(ln.kind==="dynamic")return En(J);if(ln.kind==="literal")return J?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ln.source,depth:H+1}),j.analyzeNested(ln.source,{effectiveCwd:Lt,envAssignments:_t})}}if(!fe&&(At==="source"||At===".")){let It=tt[1]==="-p"?2:null;if(It!==null){let Qr=j.commandView?et[It]:void 0;if(!Qr)return null;if(Qr.provenance!=="literal")return En(J)}let Ft=It===null?1:3,Vt=tt[Ft]==="--"?Ft+1:Ft,ln=j.commandView?et[Vt]:void 0;if(!ln)return null;if(ln.provenance==="literal")return ea(ln.text,Lt,_t,j,J,H);if(j.strict||!j.commandView||!yc(j.commandView))return En(J)}if(Dn.has(At)&&!Te){if(!fe&&j.strict&&wc(Ci(tt),et))return En(J);let It=xf(tt,(Vt)=>Er(j.analyzeNested(Vt,{effectiveCwd:Lt,envAssignments:_t}))),Ft=Nt(It,j.policy);if(Ft)return J?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Ft.reason}),hn(Ft)}if(zn(At)&&!Te){if(!fe&&j.strict&&wc(gs(tt),et))return En(J);let It=Em(tt);if(Re&&fe)return qw(At,It,Lt,_t,j,fe);if(It){let Ft=rn(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(J?.recordSegment({type:"interpreter",interpreter:At,codeArg:It,paranoidBlocked:Ft}),Ft){let ln=Nt(Pt("interpreter.one-liner-paranoid",si),j.policy);if(ln)return hn(ln)}if(kl(At,It))return null;J?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:It,depth:H+1});let Vt=j.analyzeNested(It,{effectiveCwd:Lt,envAssignments:_t});if(Vt&&!rg(Vt,It))return Vt;if(ai(It,void 0,!j.strict)){let ln=Nt(Pt("interpreter.dangerous-command",fo),j.policy);if(ln)return J?.recordSegment({type:"dangerous-text",token:It,matched:!0,reason:fo}),hn(ln)}J=void 0}}if(At==="busybox"&&tt.length>1)return eg(gt.wrapperNormalizationBudget),J?.recordSegment({type:"busybox",subcommand:tt[1]??"unknown"}),J?.recordSegment({type:"recurse",reason:"busybox",innerCommand:tt.slice(1).join(" "),depth:H+1}),Ao(et.slice(1),H,{...gt,effectiveCwd:Lt,envAssignments:_t});let qt=fe?null:Nt(Cm(At,tt),j.policy);if(qt)return J?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:qt.reason}),hn(qt);let Ht=J===gt.trace?gt:{...gt,trace:J},fn={words:et,parsedWords:Ze.words,head:At,cwd:Mt,originalCwd:Dt,envAssignments:_t,allowTmpdirVar:ht,dynamicArguments:Ze.words.some((It)=>It.provenance==="command-substitution"),depth:H,effectiveCwd:Lt,options:Ht,analyzeChildTokens:(It,Ft)=>Re&&fe?Oc(It,H,Ht,{...fe,cwd:Ft??void 0,effectiveCwd:Ft??void 0}):Er(Ao(Jt(It),H+1,{...Ht,child:void 0,commandView:void 0,effectiveCwd:Ft,envAssignments:_t}))??N(It,Ht.policy.rules),analyzeChild:(It,Ft)=>Oc(It,H,Ht,Ft)},tn=fe&&(At==="xargs"||At==="parallel")?void 0:ng(At);if(At==="rm"||At==="xargs"||At==="parallel")J?.recordSegment({type:"tmpdir-check",tmpdirValue:_t.has("TMPDIR")||j.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:ht});let nn=J&&At==="git"?np(fn.words,Ic(fn)):void 0,_n=tg(nn?nn.match:tn?.(fn)??null,j.policy);if(J)Jw(fn,_n,nn?.relaxation??null);if(_n)return hn(_n);if(Re&&fe&&(At==="rm"||At==="rmdir")){if(!(At==="rm"&&(ar(tt)||fe.dynamicRmInput)))return null;return(fe.dynamicRmInput?Po(fe,j.policy):null)??Yw(fe,j.policy)}let er=tn!==void 0&&!eA.has(At),wr=!fe&&!er&&!Hi.has(At),Mo=J&&wr?[]:void 0;if(wr)for(let It=1;It<tt.length;It++){let Ft=tt[It];if(!Ft)continue;Mo?.push(Ft);let Vt=tg(Kw(tt,It,H,Ht,Mt,Dt,Lt,_t),j.policy);if(Vt)return J?.recordSegment({type:"fallback-scan",tokensScanned:Mo??[],embeddedCommandFound:Gt(Ft)}),hn(Vt)}if(J?.recordSegment({type:"fallback-scan",tokensScanned:Mo??[]}),Te&&fe&&!fe.wrappedByTransparent)return null;let kn=N(tt,j.policy.rules);if(J?.recordSegment({type:"custom-rules-check",rulesChecked:j.policy.rules.length>0,matched:!!kn,reason:kn?.reason}),kn)return hn(kn);return Re&&fe?Po(fe,j.policy):null}function Oc(G,H,j,J){return Er(Ao(Jt(G),H+1,{...j,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:J.originalCwd,effectiveCwd:J.effectiveCwd,envAssignments:J.envAssignments,worktreeMode:J.dynamicInput?!1:J.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:J}))}function Kw(G,H,j,J,oe,ie,fe,Re){for(let Te of Hn(G.slice(H),{environment:J.environment,cwd:oe,envAssignments:Re,policy:J.policy})){let ke=Te.tokens[0];if(!ke)continue;let Le=Gt(ke);if(og(ke,Le)||ng(Le)!==void 0&&Le!=="xargs"&&Le!=="parallel"||Te.wrappedByTransparent&&J.policy.rules.length>0)J.budget.charge("derivedTokens",G.length-H);let Ye=Oc(Te.tokens,j,J,{embedded:!0,cwd:Te.cwd,originalCwd:Te.wrapperCwd===null?void 0:ie,effectiveCwd:Te.wrapperCwd===void 0?fe:Te.wrapperCwd,envAssignments:Te.envAssignments,allowTmpdirVar:!pi(Te.envAssignments,J.environment),worktreeMode:!1,wrappedByTransparent:Te.wrappedByTransparent});if(Ye)return Ye}return null}function qw(G,H,j,J,oe,ie){if(!H)return Po(ie,oe.policy);if(rn(oe.policy,"interpreter.one-liner-paranoid",!!oe.paranoidInterpreters)){let Re=Nt(Pt("interpreter.one-liner-paranoid",si),oe.policy);if(Re)return hn(Re)}if(kl(G,H))return Po(ie,oe.policy);let fe=oe.analyzeNested(H,{effectiveCwd:j,envAssignments:J});if(fe&&!rg(fe,H))return fe;if(ai(H,void 0,!oe.strict)){let Re=Nt(Pt("interpreter.dangerous-command",fo),oe.policy);if(Re)return hn(Re)}return Po(ie,oe.policy)}function rg(G,H){let j=G.ruleId==="raw-text.dangerous-command",J=(G.reason.startsWith(As)||G.reason===Yn)&&!ji(H);return j||J}function wo(G,H){let j=G.shellDynamicMatch?Nt(G.shellDynamicMatch,H):null;return j?hn(j):null}function Po(G,H){let j=G.dynamicSourceInput&&G.dynamicSourceMatch?Nt(G.dynamicSourceMatch,H):null;return j?hn(j):null}function Yw(G,H){let j=G.dynamicInput&&G.rmDynamicMatch?Nt(G.rmDynamicMatch,H):null;return j?hn(j):null}function Zw(G,H,j,J,oe,ie){let fe=kf(G);if(fe.argvSource?.kind==="absent")return En(oe);if(fe.argvSourceApplies&&fe.argvSource){let Te=ea(fe.argvSource.value,j,H,J,oe,ie,!0);if(Te)return Te}if(!fe.envSourceApplies||!fe.envName)return null;let Re=H.get(fe.envName);if(!Re)return null;return ea(Re,j,H,J,oe,ie,!0)}function ea(G,H,j,J,oe,ie,fe=!1){if(fe&&/[$`*?[\]]/.test(G))return En(oe);let Re=ii(G,H,J.environment.paths,J.budget),Te=Re?J.literalHeredocFiles?.get(Re):void 0;if(Te===void 0)return fe?En(oe):null;return J.budget.charge("derivedTokens",1),oe?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:Te,depth:ie+1}),J.analyzeNested(Te,{effectiveCwd:H,envAssignments:j})}function Xw(G){let H=G[0];return G.length>=2&&(H==='"'||H==="'")&&G.at(-1)===H?G.slice(1,-1):G}function Jw(G,H,j){let J={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[G.head];if(!J)return;if(G.options.trace?.recordSegment({type:"rule-check",rule:J,matched:!!H||!!j,reason:H?.reason??j?.originalReason}),j)G.options.trace?.recordSegment({type:j.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:j.originalReason,gitCwd:j.gitCwd})}function eg(G){if(G.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");G.iterations++}function hn(G){return{reason:G.reason,ruleId:G.id,intent:G.intent}}function En(G){return G?.recordSegment({type:"error",message:fi}),hn(ho())}function og(G,H){return Qt.has(H)||G==="$SHELL"||G==="${SHELL}"||Qt.has(Wt(H))}function tg(G,H){return G?.id.startsWith("custom.")||G?.id==="raw-text.dangerous-command"?G:Nt(G,H)}var Qw=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,eA=new Set(["powershell","pwsh"]),tA=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function nA(G,H){let j=ag(G,H);if(j.length===0)return!1;let J=j[sg(j)];if(J==="cd"||J==="pushd"||J==="popd")return!0;return Qw.test(G.join(" "))}function ig(G,H,j,J,oe){if(G.dialect==="powershell"){let yt=rA(G.words,oe);if(yt.kind==="none")return;if(!H||yt.kind==="unknown")return null;return kc(aA(yt.target),H,j.paths)}let ie=G.words.map(t),fe=ie.some((yt)=>/^CDPATH\+?=/.test(yt));if(!nA(ie,j))return fe?null:void 0;if(!H)return null;let Re=ag(ie,j,H),Te=sg(Re);if(Te===-1||Re[Te]!=="cd")return null;let ke=Re.slice(Te+1),Le=ke.findIndex((yt)=>yt.length<=1||!yt.startsWith("-")||yt==="--");if((Le===-1?ke:ke.slice(0,Le)).some((yt)=>!/^-[LP]+$/.test(yt)))return null;let Ye=Le===-1?[]:ke.slice(Le),Ze=Ye[0]==="--"?Ye.slice(1):Ye;if(Ze.length>1)return null;let Qe=Ze[0],et=J.get("HOME")||j.home;if(Qe===void 0)return kc(pn(et),H,j.paths);let tt=G.words.find((yt)=>yt.provenance==="variable"&&yt.text===Qe),gt=G.words.find((yt)=>yt.text===Qe&&/^~(?:\/|$)/.test(yt.raw)),_t=tt?Jn(tt,new Map([...J,["HOME",et]])):gt?`${et}${Qe.slice(1)}`:Qe;if(_t===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(_t)&&(fe||j.env.has("CDPATH")))return null;return kc(pn(_t),H,j.paths)}function kc(G,H,j){if(!G||G==="-"||G.startsWith("~")||G.includes("$")||G.includes("`"))return null;try{let J=gr(H,G,j);return j.isDirectory(J)?J:null}catch{return null}}function rA(G,H){let j=oA(G[0])?1:0,J=G[j];if(!iA(J,j===1))return{kind:"none"};let oe=J.text.toLowerCase(),ie=oe.split(/[\\/]/).pop()??oe;if(!tA.has(ie))return{kind:"none"};if(oe!==ie||ie==="pop-location"||ie==="popd")return{kind:"unknown"};return sA(G.slice(j+1),H)}function oA(G){return G?.provenance==="literal"&&!G.quoted&&G.raw===G.text&&(G.text==="&"||G.text===".")}function iA(G,H){return G?.provenance==="literal"&&(H||!G.quoted&&G.raw===G.text)}function sA(G,H){let j;for(let J of G){if(J.provenance!=="literal"||j!==void 0)return{kind:"unknown"};j=J.text}if(j!==void 0)return{kind:"target",target:j};return H===void 0?{kind:"unknown"}:{kind:"target",target:H}}function aA(G){return G.includes("::")?void 0:G.replaceAll("\\","/")}function sg(G){let H=0;if(G[0]==="builtin"&&G.length>1)H=1;if(G[H]!=="time")return H;let j=H+1;while(G[j]?.startsWith("-"))j++;return j}function ag(G,H,j){let J=lA(G);return hr([...J],H,j)}function lA(G){let H=0;while(H<G.length){let j=G[H];if(j!=="{"&&j!=="("&&j!=="$(")break;H++}return G.slice(H)}var gA="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",qr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Fc(G,H,j,J){if(H>=a.recursionDepth.cap)return j.trace?.recordSegment({type:"error",message:Kn}),{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let oe=J??j.factStore?.getCommandProgram(G,j.shell??"auto")??y(G,j.shell);if(oe.status==="limited")return j.trace?.recordSegment({type:"error",message:Kn}),{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(oe.status==="invalid"){let ke=oe.issues.find((Le)=>Le.code.includes("heredoc"));if(ke){if(!j.strict)return Wc(G,j);let Le=`${As}: ${ke.message}`;return j.trace?.recordGlobal({type:"error",message:Le}),{reason:Le,segment:G,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return pg(G,j),{reason:Yn,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(j.strict&&oe.status==="partial")return pg(G,j),{reason:Yn,segment:G,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(oe.issues.some((ke)=>ke.code.includes("quote")))return Wc(G,j);let fe=j.cwd,Re=j.effectiveCwd!==void 0?j.effectiveCwd:j.cwd,Te=Hf(j.environment.env,j.envAssignments);return ra(oe,H,{...j,rootProgram:oe},fe,[{effectiveCwd:Re,shellGitContextState:Te,literalHeredocFiles:new Map(j.literalHeredocFiles),functionDefinitions:new Map(j.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function ra(G,H,j,J,oe){let ie=[...oe],fe,Re,Te;for(let[ke,Le]of G.nodes.entries()){if(Le.kind==="connector"){Re=Le.operator;continue}let Xe=G.nodes[ke+1],Ye=Xe?.kind==="connector"?Xe.operator:void 0,Ze=hA(G,ke,Le,Re,Ye),et=Re==="&&"||Re==="||"?fe:void 0,tt=Re==="&&"?et?.success??ie:Re==="||"?et?.failure??ie:ie,gt=Re==="||"?et?.success??[]:[],_t=Re==="&&"?et?.failure??[]:[],yt={connector:Re,skippedSuccessStates:gt,skippedFailureStates:_t};if(Rr(Ye)&&!Rr(Re))Te=yt;let At=Rr(Ye)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Rr(Re)?Te??yt:yt,Mt=Yr(At.connector)||Yr(Ye);if(Le.kind==="function"){let qt=tt.flatMap((fn)=>{let tn=Zr(fn);return tn.functionDefinitions.set(Le.name,Le.body),Mc(fn,[tn],Ze,Ye==="&",Yr(Ye))}),Ht=Dc(qt,[],At.skippedSuccessStates,At.skippedFailureStates,At.connector,Ye);ie=Ht.states,fe=Ht.conditionalStates,Re=void 0;continue}if(Le.kind==="group"){let qt=[],Ht=[];for(let tn of tt){let nn=ra(Le.body,H,j,J,[Zr(tn)]);if(nn.result)return nn;if(qt.push(...Mc(tn,nn.states,Ze,Ye==="&",Yr(Ye))),Mt)Ht.push(tn,...Ze?nn.states.map((_n)=>ta(tn,_n)):nn.states)}let fn=Dc(qt,Ht,At.skippedSuccessStates,At.skippedFailureStates,At.connector,Ye);ie=fn.states,fe=fn.conditionalStates,Re=void 0;continue}if(Le.kind!=="command")continue;let Dt=GA(G.nodes[ke-1]),Lt=j.trace?.flattenNested?j.trace.currentSegmentIndex:j.trace?.allocateSegment(),ht=G.nodes[ke-2],Ot=Rr(Re)&&ht?.kind==="command"?cp(ht)??CA(ht):void 0,$t=[],sn=[];for(let qt of tt){let Ht=SA(Le,H,j,J,[Zr(qt)]);if(Ht.result)return{result:Ht.result,states:ie};let fn=G.dialect==="powershell"?Ht.states:Ht.states.map((tn)=>ta(qt,tn));for(let tn of fn){let nn=Zr(tn),_n=EA(Le,H,j.trace?{...j,trace:gg(j.trace,Lt)}:j,J,nn,Rr(Re),Ot);if(_n)return{result:_n,states:ie};let er=VA(Le,nn.functionDefinitions);if(er)j.budget.charge("derivedTokens",oa(er));let wr=er?H+1>=a.recursionDepth.cap?Nc(Le.displayText,j,[nn]):ra(er,H+1,j,J,[nn]):{result:null,states:HA(Le,nn).flatMap((kn)=>zA(Le,tn,kn,Dt))};if(wr.result)return wr;$t.push(...Mc(qt,wr.states,Ze,Ye==="&",Yr(Ye)));let Mo=typeof nn.effectiveCwd==="string"&&nn.effectiveCwd!==tn.effectiveCwd&&Le.redirections.every((kn)=>["<",">",">>",">|"].includes(kn.operator)&&kn.target?.text==="/dev/null");if(Mt&&(Dt||!Mo))sn.push(qt),sn.push(...wr.states.map((kn)=>Ze?ta(qt,kn):kn))}}let xr=Dc($t,sn,At.skippedSuccessStates,At.skippedFailureStates,At.connector,Ye);ie=xr.states,fe=xr.conditionalStates,Re=void 0}return{result:null,states:ie}}function hA(G,H,j,J,oe){if(j.kind==="group"&&j.style==="subshell")return!0;if(G.dialect==="posix"&&(Rr(J)||Rr(oe)))return!0;if(oe==="&")return!0;return G.dialect==="powershell"&&j.kind==="group"&&j.style==="brace"&&yA(G,H)}function Mc(G,H,j,J,oe){let ie=j?H.map((Re)=>ta(G,Re)):[...H],fe=oe?ie.flatMap((Re)=>To(G.literalHeredocFiles,Re.literalHeredocFiles)?[Re]:[{...Re,literalHeredocFiles:new Map(G.literalHeredocFiles)},Re]):ie;return J?[G,...fe]:fe}function ta(G,H){return{...G,literalHeredocFiles:new Map(H.literalHeredocFiles),createdDirectories:new Set(H.createdDirectories)}}function yA(G,H){let j=G.nodes.slice(0,H).reverse().find((oe)=>oe.kind==="command"||oe.kind==="connector");if(!j||j.kind!=="command")return!0;let J=j.words[0]?.text.toLowerCase();if(J==="&"||J===".")return!1;if(J==="write-output"||J==="function"||J==="start-job")return!0;if(bA(j))return!0;return j.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Rr(G){return G==="|"||G==="|&"}function CA(G){if(G?.dialect!=="powershell")return;if(G.words.length===1&&G.words[0]?.quoted&&G.words[0].provenance==="literal")return G.words[0].text;if(G.words[0]?.text.toLowerCase()==="write-output"&&G.words.length===2&&G.words[1]?.provenance==="literal")return G.words[1].text;return}function Yr(G){return G==="&&"||G==="||"}function Dc(G,H,j,J,oe,ie){let fe={success:na([...j,...G]),failure:na([...J,...H])},Re=Yr(ie)?fe:void 0;return{states:Yr(oe)||Re?na([...fe.success,...fe.failure]):fe.success,conditionalStates:Re}}function gg(G,H,j=G.flattenNested){return{currentSegmentIndex:H,flattenNested:j,allocateSegment:G.allocateSegment,getNextSegmentIndex:G.getNextSegmentIndex,recordGlobal:G.recordGlobal,recordSegment:(J,oe=H)=>G.recordSegment(J,oe)}}function SA(G,H,j,J,oe){let ie=G.nested.map((fe)=>({program:fe,depth:H}));if(G.dialect==="powershell"){let fe=vA(G);if(fe){if(H+1>=a.recursionDepth.cap)return Nc(fe,j,oe);let Re=y(fe,"powershell");if(Re.status==="limited")return Nc(fe,j,oe);if(Re.status!=="complete")return lg(ie,j,J,oe);j.budget.charge("derivedTokens",oa(Re)),ie.push({program:Re,depth:H+1})}}return lg(ie,j,J,oe)}function bA(G){let H=G.words[0];return H?.provenance==="variable"&&G.words.at(-1)?.text==="="?H.text.toLowerCase():void 0}function lg(G,H,j,J){let oe=[...J];for(let ie of G){let fe=[];for(let Re of oe){let Te=ra(ie.program,ie.depth,H,j,[Zr(Re)]);if(Te.result)return Te;fe.push(...Te.states)}oe=na(fe)}return{result:null,states:oe}}function vA(G){let H=G.words[0]?.provenance==="literal"&&!G.words[0].quoted&&G.words[0].raw===G.words[0].text&&(G.words[0].text==="&"||G.words[0].text==="."),j=H?1:0,J=G.words[j];if(J?.provenance!=="literal"||!H&&(J.quoted||J.raw!==J.text)||!["iex","invoke-expression"].includes(J.text.toLowerCase()))return;let oe=G.words.slice(j+1),ie=oe[0]&&!oe[0].quoted&&oe[0].raw===oe[0].text&&["-c","-command"].includes(oe[0].text.toLowerCase())?1:0,fe=oe[ie];return oe.length===ie+1&&fe?.quoted&&fe.provenance==="literal"?fe.text:void 0}function oa(G){return G.nodes.reduce((H,j)=>H+(j.kind==="command"?j.words.length+j.nested.reduce((J,oe)=>J+oa(oe),0):j.kind==="group"||j.kind==="function"?oa(j.body):0),0)}function Nc(G,H,j){return H.trace?.recordSegment({type:"error",message:Kn}),{result:{reason:Kn,segment:G,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...j]}}function EA(G,H,j,J,oe,ie,fe){let Re={...j,environment:{...j.environment,env:oe.shellGitContextState.env,paths:AA(j.environment.paths,oe.createdDirectories,j.budget)}},Te=MA(G,!Re.strict);if(Te&&Re.strict)return Re.trace?.recordSegment({type:"error",message:Te}),{reason:Te,segment:G.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};hg(G,oe,"before-consumer",Re.environment.paths,Re.budget);let ke=re(G.dialect,G.words),Le=ke.map(t),Xe=G.displayText,Ye=Bf(ke,oe.shellGitContextState),Ze=Vf(Ye,oe.shellGitContextState);if(G.dialect==="powershell"){let gt=Nt(Cf(G,ie,KA(Re,oe.effectiveCwd)),Re.policy);if(Re.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!gt,reason:gt?.reason}),gt)return fg(Xe,gt)}let Qe=Nt(Sm(G.redirections),Re.policy);if(Qe)return Re.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Qe.reason}),fg(Xe,Qe);if(Le.length===1&&Le[0]?.includes(" ")&&!Zo(G.dialect,G.words)){let gt=Nt(Nn(Le[0]),Re.policy),_t=gt!==null&&!Re.strict&&pm(G,Re.rootProgram);if(gt&&!_t)return Re.trace?.recordSegment({type:"dangerous-text",token:Le[0],matched:!0,reason:gt.reason}),{reason:gt.reason,segment:Xe,ruleId:gt.id,intent:gt.intent};Re.trace?.recordSegment({type:"dangerous-text",token:Le[0],matched:!1});let yt=cg(G,Te,oe,Ze,fe,Re);if(yt)return yt;return uc(Ye,oe.shellGitContextState),null}let et=Ao(G.words,H,{...Re,commandView:G,cwd:J,effectiveCwd:oe.effectiveCwd,envAssignments:Ze,shellAssignments:oe.shellGitContextState.shellAssignments,literalHeredocFiles:oe.literalHeredocFiles,functionDefinitions:oe.functionDefinitions,hasPipelineInput:ie,literalShellInput:fe,analyzeNested:(gt,_t)=>{let yt=_t&&Object.hasOwn(_t,"effectiveCwd")?_t.effectiveCwd:oe.effectiveCwd,At=Fc(gt,H+1,{...Re,effectiveCwd:yt,envAssignments:_t?.envAssignments??Ze,literalHeredocFiles:oe.literalHeredocFiles,functionDefinitions:_t?.functionDefinitions,worktreeMode:_t?.worktreeMode??Re.worktreeMode,shell:_t?.shell??Re.shell,trace:Re.trace?gg(Re.trace,Re.trace.currentSegmentIndex,!0):void 0});return At?{reason:At.reason,ruleId:At.ruleId,intent:At.intent}:null}});if(et)return{...et,segment:Xe};let tt=cg(G,Te,oe,Ze,fe,Re);if(tt)return tt;return uc(Ye,oe.shellGitContextState),null}function cg(G,H,j,J,oe,ie){let fe=DA(G,H,j,J??new Map,ie);if(fe)return fe;return hg(G,j,"after-consumer",ie.environment.paths,ie.budget),j.literalHeredocFiles.clear(),xA(G,H,j,ie.environment.paths,ie.budget),PA(G,j,ie.environment.paths,ie.budget),WA(G,j,oe,ie.environment,ie.trace),null}var RA=new Set([">>","<>"]);function hg(G,H,j,J,oe){for(let fe of G.redirections){if(!(j==="before-consumer"?_A(fe):RA.has(fe.operator)))continue;dg(fe.target,H,J,oe)}if(j!=="before-consumer"||!mn(G.words[0],"tee"))return;let ie=Cg(G.words.slice(1));if(!ie)return;for(let fe of ie.operands)dg(fe,H,J,oe)}function _A(G){if(G.operator===">"||G.operator===">|")return!0;return G.operator===">&"&&G.fd===void 0&&G.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(G.target.text)}function dg(G,H,j,J){let oe=G?.provenance==="literal"?ii(G.text,H.effectiveCwd,j,J):void 0;if(!oe)return;H.literalHeredocFiles.delete(oe)}function xA(G,H,j,J,oe){if(H)return;let ie=G.redirections.find((fe)=>fe.operator==="<<"||fe.operator==="<<-")?.heredoc;if(!ie)return;for(let fe of wA(G,j.shellGitContextState.shellAssignments)){let Re=ii(fe,j.effectiveCwd,J,oe);if(!Re||!vm(Re))continue;if(!j.literalHeredocFiles.has(Re)&&j.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");j.literalHeredocFiles.set(Re,ie.body)}}function wA(G,H){let j=Lc(kA(G.redirections)?.target,H),J=j===void 0?[]:[j];if(mn(G.words[0],"cat"))return IA(G.words)?J:[];if(!mn(G.words[0],"tee"))return[];let oe=Cg(G.words.slice(1),H);if(!oe||oe.append||oe.hasUnsupportedOptions)return[];let ie=oe.operands.map((fe)=>Lc(fe,H));if(!ie.every((fe)=>fe!==void 0))return[];return[...ie,...J]}function Lc(G,H){if(OA(G))return G.text;return(G&&Jn(G,H))??void 0}function AA(G,H,j){if(H.size===0)return G;let J=(oe)=>{let ie=Bt(oe,G,j);return[...H].some((fe)=>fe===ie||fe.startsWith(`${ie}${pA}`))};return{realpath:(oe)=>G.realpath(oe)??(J(oe)?Bt(oe,G,j):null),entryKind:(oe)=>{let ie=G.entryKind(oe);return ie==="missing"&&J(oe)?"present":ie},isDirectory:(oe)=>G.isDirectory(oe)||J(oe)}}function PA(G,H,j,J){if(H.shellGitContextState.bodyDepth>0||!mn(G.words[0],"mkdir"))return;let oe=G.words.slice(1).map((ke)=>Lc(ke,H.shellGitContextState.shellAssignments));if(!oe.every((ke)=>ke!==void 0))return;let ie=oe.findIndex((ke)=>ke==="--"||ke==="-"||!ke.startsWith("-")),fe=oe.slice(0,ie);if(ie===-1||!fe.every((ke)=>/^(?:-[pv]+|--parents|--verbose)$/.test(ke)))return;let Re=fe.some((ke)=>ke==="--parents"||/^-v*p/.test(ke)),Te=H.effectiveCwd;for(let ke of oe.slice(oe[ie]==="--"?ie+1:ie)){if(ke.split(/[\\/]/).includes("..")||!dA(ke)&&!Te)continue;let Le=Bt(fA(Te??"",ke),j,J);if(Re?TA(Le,j):j.isDirectory(cA(Le))&&yg(Le,j))H.createdDirectories.add(Le)}}function TA(G,H){let j=mA(G).root,J=G.slice(j.length).split(/[\\/]+/).filter(Boolean),oe=(fe)=>uA(j,...J.slice(0,fe+1)),ie=J.findIndex((fe,Re)=>!H.isDirectory(oe(Re)));return ie===-1||yg(oe(ie),H)}function yg(G,H){try{return H.entryKind(G)==="missing"}catch{return!1}}function IA(G){let H=!1;for(let j of G.slice(1)){if(H||j.provenance!=="literal")return!1;if(j.text==="--"){H=!0;continue}if(!/^-u+$/.test(j.text))return!1}return!0}function kA(G){let H=G.findLast((j)=>(j.fd??([">",">|",">>",">&"].includes(j.operator)?1:0))===1);return H?.operator===">"||H?.operator===">|"?H:void 0}function Cg(G,H=new Map){let j=[],J=!0,oe=!1,ie=!1;for(let fe of G){if(fe.provenance!=="literal"&&Jn(fe,H)===null)return;if(J&&mn(fe,"--")){J=!1;continue}if(J&&!fe.quoted&&fe.raw===fe.text&&/^-[^-]/.test(fe.text)){oe||=fe.text.slice(1).includes("a"),ie||=Array.from(fe.text.slice(1)).some((Re)=>Re!=="a"&&Re!=="i");continue}if(J&&!fe.quoted&&fe.raw===fe.text&&fe.text.startsWith("--")){oe||=fe.text==="--append",ie||=fe.text!=="--append"&&fe.text!=="--ignore-interrupts";continue}j.push(fe)}return{operands:j,append:oe,hasUnsupportedOptions:ie}}function OA(G){if(!G||G.provenance!=="literal"||G.text.length===0)return!1;if(G.quoted||G.raw!==G.text)return!0;return!G.raw.startsWith("~")&&!/[{}]/.test(G.raw)}function mn(G,H){return G?.text===H&&G.raw===H&&G.provenance==="literal"&&!G.quoted}function Gc(G){return G.quotedDelimiter||!/[$`\\]/.test(G.body)}function MA(G,H){let j=G.redirections.filter((Te)=>Te.operator==="<<"||Te.operator==="<<-");if(j.length===0)return;if(j.length!==1)return qr;let J=j[0];if(!J?.heredoc)return qr;let oe=/\$\(|`/.test(J.heredoc.body);if(!Gc(J.heredoc)&&(!H||oe))return gA;if(J.fd!==void 0&&J.fd!==0)return qr;if(G.redirections.some((Te)=>Te!==J&&["<","<<","<<-","<<<","<&","<>"].includes(Te.operator)))return qr;let ie=G.redirections.some((Te)=>Te!==J&&ug(Te.target));if(mn(G.words[0],"cat"))return ie?qr:void 0;if(mn(G.words[0],"tee"))return ie||G.words.slice(1).some(ug)?qr:void 0;let fe=G.words[0],Re=G.words[1];if(mn(fe,"git")&&(mn(Re,"apply")||mn(Re,"commit")))return;if(mn(fe,"gh")&&(mn(Re,"pr")||mn(Re,"issue"))&&mn(G.words[2],"create"))return;return qr}function ug(G){return G?.parts.some((H)=>H.provenance==="command-substitution"&&H.raw.startsWith(">("))??!1}function DA(G,H,j,J,oe){if(!H)return null;let ie=G.redirections.filter((ke)=>ke.operator==="<<"||ke.operator==="<<-"),fe=ie.flatMap((ke)=>ke.heredoc?[ke.heredoc.body]:[]);if(LA(G,ie,j,J,oe))return null;let Re=NA(G,ie,oe);if(Re!==void 0)return Re?{reason:Re.reason,segment:G.displayText,ruleId:Re.id,intent:Re.intent}:null;let Te=Wc(fe.length===ie.length?fe.join(`
-`):G.source,oe);return Te?{...Te,segment:G.displayText}:null}function NA(G,H,j){let J=H.length===1?H[0]:void 0;if(!J?.heredoc||!Gc(J.heredoc)||J.fd!==void 0&&J.fd!==0)return;let oe=mn(G.words[0],"uv")&&mn(G.words[1],"run")?G.words.slice(2):G.words,ie=oe[0];if(ie?.provenance!=="literal"||!zn(ie.text))return;let fe=oe.findIndex((Xe)=>mn(Xe,"-"));if(!oe.slice(1,fe===-1?void 0:fe).every((Xe)=>Xe.provenance==="literal"&&Xe.text.startsWith("-")))return;let Te=J.heredoc.body,ke=rn(j.policy,"interpreter.one-liner-paranoid",!!j.paranoidInterpreters);if(j.trace?.recordSegment({type:"interpreter",interpreter:ie.text,codeArg:Te,paranoidBlocked:ke}),ke){let Xe=Nt(Pt("interpreter.one-liner-paranoid",si),j.policy);if(Xe)return Xe}if(!ai(Te,void 0,!j.strict))return null;let Le=Nt(Pt("interpreter.dangerous-command",fo),j.policy);if(!Le)return null;return j.trace?.recordSegment({type:"dangerous-text",token:Te,matched:!0,reason:Le.reason}),Le}function LA(G,H,j,J,oe){let ie=H.length===1?H[0]:void 0;if(!ie?.heredoc||!Gc(ie.heredoc)||ie.fd!==void 0&&ie.fd!==0)return!1;let fe=Wr(G.words,oe.environment,j.effectiveCwd,J),Re=fe.words.map(t),Te=Gt(Re[0]??"");if((fe.envSplitValues?.length??0)>0||!Qt.has(Te)&&!Qt.has(Wt(Te)))return!1;return lr(Re)}function WA(G,H,j,J,oe){let ie=ig(G,H.effectiveCwd,J,H.shellGitContextState.shellAssignments,j);if(ie===null)oe?.recordSegment({type:"cwd-change",segment:G.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(ie!==void 0)H.effectiveCwd=ie}var FA=new Set(["fi","done","esac"]);function GA(G){return G?.kind==="command"&&G.words.length===1&&G.words[0]?.raw==="!"}function zA(G,H,j,J){let oe=G.words[0]?.text??"",ie=H.shellGitContextState.bodyDepth,fe=j.shellGitContextState.bodyDepth,Re=j.compoundBodies;if(fe>ie)return j.compoundBodies=[...Re.slice(0,ie),{entryCwd:H.effectiveCwd,branchCwds:Re[ie]?.branchCwds??[],hasElse:!1}],[j];let Te=ie>0?Re[ie-1]:void 0;if(Te&&(oe==="else"||oe==="elif"))return j.compoundBodies=[...Re.slice(0,ie-1),{entryCwd:Te.entryCwd,branchCwds:[...Te.branchCwds,j.effectiveCwd],hasElse:oe==="else"}],j.effectiveCwd=Te.entryCwd,[j];let ke=Te!==void 0&&FA.has(oe);if(ke)j.compoundBodies=Re.slice(0,fe);return[...new Set([j.effectiveCwd,...ke?Te.branchCwds:[],...ke&&!Te.hasElse?[Te.entryCwd]:[],...J?[H.effectiveCwd]:[]])].map((Xe)=>{if(Xe===j.effectiveCwd)return j;let Ye=Zr(j);return Ye.effectiveCwd=Xe,Ye})}function $A(G,H){return G.length===H.length&&G.every((j,J)=>{let oe=H[J];return oe!==void 0&&j.entryCwd===oe.entryCwd&&j.hasElse===oe.hasElse&&j.branchCwds.length===oe.branchCwds.length&&j.branchCwds.every((ie,fe)=>ie===oe.branchCwds[fe])})}var BA=/^[A-Za-z_][A-Za-z0-9_]*$/,UA=8;function HA(G,H){let j=G.words[1]?.text;if(G.dialect!=="posix"||G.words[0]?.text!=="for"||j===void 0||!BA.test(j))return[H];let J=G.words.slice(3);if(!(G.words[2]?.text==="in"&&J.length>=1&&J.length<=UA&&J.every((ie)=>ie.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(ie.text))))return H.shellGitContextState.shellAssignments.delete(j),[H];return J.map((ie)=>{let fe=Zr(H);return fe.shellGitContextState.shellAssignments.set(j,ie.text),fe})}function Zr(G){return{effectiveCwd:G.effectiveCwd,shellGitContextState:jf(G.shellGitContextState),literalHeredocFiles:new Map(G.literalHeredocFiles),functionDefinitions:new Map(G.functionDefinitions),createdDirectories:new Set(G.createdDirectories),compoundBodies:G.compoundBodies}}function na(G){let H=[];for(let j of G){if(!H.some((J)=>jA(J,j)))H.push(j);if(H.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return H}function jA(G,H){return G.effectiveCwd===H.effectiveCwd&&$A(G.compoundBodies,H.compoundBodies)&&To(G.shellGitContextState.env,H.shellGitContextState.env)&&To(G.literalHeredocFiles,H.literalHeredocFiles)&&To(G.functionDefinitions,H.functionDefinitions)&&To(G.shellGitContextState.effectiveEnvAssignments,H.shellGitContextState.effectiveEnvAssignments)&&To(G.shellGitContextState.shellAssignments,H.shellGitContextState.shellAssignments)&&G.shellGitContextState.bodyDepth===H.shellGitContextState.bodyDepth&&mg(G.shellGitContextState.bodyAssignments,H.shellGitContextState.bodyAssignments)&&mg(G.createdDirectories,H.createdDirectories)}function mg(G,H){return G.size===H.size&&[...G].every((j)=>H.has(j))}function To(G,H){if(G===H)return!0;if(!G||!H||G.size!==H.size)return!1;return[...G].every(([j,J])=>H.get(j)===J&&H.has(j))}function VA(G,H){let j=Xo(G);return j===void 0?void 0:H.get(j)}function fg(G,H){if(!H)return null;return{reason:H.reason,segment:G,ruleId:H.id,intent:H.intent}}function KA(G,H=G.effectiveCwd){let j=H===null;return{environment:G.environment,cwd:j?void 0:H??G.cwd,originalCwd:j?void 0:G.cwd,strict:G.strict,paranoid:G.paranoidRm,allowTmpdirVar:G.allowTmpdirVar,protectedGitMetadata:G.protectedGitMetadata,policy:G.policy,budget:G.budget}}function Wc(G,H){let j=Nt(Nn(G),H.policy),J=H.trace?.currentSegmentIndex??H.trace?.allocateSegment(),oe={type:"dangerous-text",token:G,matched:!!j,reason:j?.reason};if(H.trace?.recordSegment(oe,J),!j&&/^(?:cd|pushd)\s/.test(G))H.trace?.recordSegment({type:"cwd-change",segment:G,effectiveCwdNowUnknown:!0},J);return j?{reason:j.reason,segment:G,ruleId:j.id,intent:j.intent}:null}function pg(G,H){let j={type:"strict-unparseable",rawCommand:G,reason:Yn},J=H.trace?.currentSegmentIndex;if(J===void 0)H.trace?.recordGlobal(j);if(J!==void 0)H.trace?.recordSegment(j)}var qA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sg(G,H,j,J){let oe=Fc(G,0,{...H,...qe(H),budget:H.budget??On(),factStore:J},j);if(!oe)return null;return{kind:"deny",reason:oe.reason,intent:oe.intent??"manual_only",ruleId:oe.ruleId,evidence:{command:G,segment:oe.segment}}}function bg(G,H,j){try{return{decision:G()}}catch(J){let oe=YA(J,H,j);if(!oe)throw J;return oe}}function YA(G,H,j){if(!(G instanceof s)||!qA.has(G.kind))return null;let J=a[G.kind];if(j?.currentSegmentIndex!==void 0)j.recordSegment({type:"error",message:J.reason});if(j?.currentSegmentIndex===void 0)j?.recordGlobal({type:"error",message:J.reason});return{decision:{kind:"deny",reason:J.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:H,segment:H}},errorCode:J.errorCode}}var ZA=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$c=new Set(["cc-safety-net","ccsn"]),XA=new Set(["bunx","npx","pnpx"]),JA=new Set(["pnpm","yarn"]),QA=new Set(["npm","pnpm","yarn"]),eP=new Set(["bun","node"]);function sa(G,H,j={}){if($c.has(G))return 0;if(XA.has(G)){if(j.broad)return zc(H);let oe=H[0]==="-y"||H[0]==="--yes"?1:0;return ia(H[oe])?oe+1:null}let J=j.broad?H.findIndex((oe)=>!oe.startsWith("-")):0;if(J!==-1&&QA.has(G)&&j.broad&&H[J]==="exec"){let oe=zc(H.slice(J+1));return oe===null?null:J+1+oe}if(JA.has(G)){if(G==="yarn"&&!j.broad)return null;if(!j.broad)return H[0]==="dlx"&&ia(H[1])?2:null;if(J===-1||H[J]!=="dlx")return null;let oe=zc(H.slice(J+1));return oe===null?null:J+1+oe}if(eP.has(G)){let oe=j.broad&&J!==-1?J:0;if(vg(H[oe]))return oe+1;if(G==="bun"&&H[oe]==="run"&&vg(H[oe+1]))return oe+2}return null}function zc(G){let H=G.findIndex((J)=>ia(J));if(H===-1)return null;let j=H;while(j<G.length){let J=G[j]??"";if(!J.startsWith("-")&&!ia(J))break;j++}return j}function ia(G){if(!G)return!1;let H=G.indexOf("@");if(H===-1)return $c.has(G);if(H===0)return!1;let j=G.slice(H+1);if(j===""||j.includes("/")||j.includes(":"))return!1;return $c.has(G.slice(0,H))}function vg(G){let H=G?.replaceAll("\\","/");return[...ZA].some((j)=>H===j||H?.endsWith(`/${j}`))}var Ke="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Eg(G,H,j){let J=bn(G,"input-candidate");if(!J)return null;let oe=yo(J.shell,G.invocation.context.executionCwd,H,j,{findSegmentTarget:(ie)=>tP(ie,H),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return oe?{target:oe}:null}function tP(G,H){let j=hr([...G],H),J=j.slice(1),oe=sa(Wt(j[0]??"").toLowerCase(),J,{broad:!0});if(oe===null)return null;let ie=J.slice(oe).filter((fe)=>fe!=="-g"&&fe!=="--global");return ie[0]==="policy"&&ie[1]==="apply"?j.join(" "):null}import{dirname as aa}from"node:path";var Je="This path contains the protected policy config and you must not modify or delete it.",nP=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function wg(G,H,j){let J=lP(G.invocation.context,H,j);if(G.invocation.route.kind==="patch")return Rg(G.paths,!1,G.invocation.context.executionCwd,J,H,j);let oe=bn(G,"input-candidate");if(G.invocation.route.kind==="command")return oe?_g(oe.shell,G.invocation.context.executionCwd,J,H,j):null;if(G.invocation.route.kind==="unknown"&&oe){let ie=_g(oe.shell,G.invocation.context.executionCwd,J,H,j);if(ie)return ie}return Rg(G.paths,G.invocation.route.kind==="grep"||G.invocation.route.kind==="glob"||Ni(G.invocation.toolName),G.invocation.context.executionCwd,J,H,j)}function Rg(G,H,j,J,oe,ie){if(H)return null;let fe=G.find((Re)=>wi(Re,j,J,oe,ie));return fe?{target:fe}:null}function _g(G,H,j,J,oe){let ie=yo(G,H,J,oe,{findSegmentTarget:(fe,Re)=>rP(fe,Re,j,J,oe)?.target??null,isRedirectionTarget:(fe,Re)=>wi(fe,Re.cwd,j,J,oe),findMalformedTarget:(fe)=>aP(fe,H,j,J,oe)?.target??null});return ie?{target:ie}:null}function rP(G,H,j,J,oe){if(mi(G))return null;let ie=yr([...G],J),fe=Wt(ie[0]??"").toLowerCase(),Re=ie.slice(1);if(fe==="rm"&&oP(Re)){let Te=iP(Re).find((ke)=>xg(Sn(ke,H.variables),H.cwd,j,J,oe));if(Te)return{target:Te}}if(fe==="find"){if(zs(ie,1)||nc(ie,J)){let ke=(Si(Jt(ie))??Jt(["."])).find((Le)=>{let Xe=Sn(Le.text,H.variables);return wi(Xe,H.cwd,j,J,oe)||xg(Xe,H.cwd,j,J,oe)})?.text;if(ke)return{target:ke}}}if(fe==="mv"){let Te=Ps(Re).sources.find((ke)=>cP(Sn(ke,H.variables),H.cwd,j,J,oe));if(Te)return{target:Te}}if(sP(ie,fe))return null;for(let Te of[...G,...ie])for(let ke of Ag(Te))if(wi(Sn(ke,H.variables),H.cwd,j,J,oe))return{target:ke};return null}function oP(G){return G.some((H)=>H==="--recursive"||H.startsWith("-")&&!H.startsWith("--")&&/[rR]/.test(H.slice(1)))}function iP(G){let H=G.indexOf("--");if(H!==-1)return[...G.slice(0,H).filter((j)=>!j.startsWith("-")),...G.slice(H+1)];return G.filter((j)=>!j.startsWith("-"))}function sP(G,H){if(!nP.has(H))return!1;if(H!=="sed")return!0;return!G.slice(1).some((j)=>j.startsWith("-i")||j==="--in-place"||j.startsWith("--in-place="))}function aP(G,H,j,J,oe){for(let ie of G.split(/\s+/))for(let fe of Ag(ie))if(wi(fe,H,j,J,oe))return{target:fe};return null}function Ag(G){let H=G.trim().replace(/^['"]|['"]$/g,""),j=H.indexOf("=");return j===-1||j===H.length-1?[H]:[H,H.slice(j+1)]}function lP(G,H,j){let J=(Re)=>Ai(gn(Re,G.executionCwd,H,j)),oe=J(u(H)),ie=[J(h(G.executionCwd)),J(h(G.configCwd))],fe=new Set(ie.map((Re)=>aa(Re)));for(let Re=aa(oe);;Re=aa(Re))if(fe.add(Re),aa(Re)===Re)break;return{files:new Set([oe,...ie]),directoriesAndAncestors:fe}}function wi(G,H,j,J,oe){let ie=ld(G,H,J,oe,(fe)=>Ai(fe)===Bi);return ie!==null&&j.files.has(Ai(ie))}function xg(G,H,j,J,oe){return j.directoriesAndAncestors.has(Ai(gn(G,H,J,oe)))}function cP(G,H,j,J,oe){let ie=Ai(gn(G,H,J,oe));return j.files.has(ie)||j.directoriesAndAncestors.has(ie)}function Ai(G){return process.platform==="win32"?G.toLowerCase():G}import{isAbsolute as la,posix as zg,resolve as ma,win32 as dP}from"node:path";import{fileURLToPath as uP}from"node:url";var $g="Access to a sensitive path is not allowed.",Bg=new Set(["echo","printf"]),mP=new Set(["find"]),fP=new Set(["!","do","elif","else","if","then","until","while"]),pP=new Set(["-exec","-execdir"]),gP=new Set([";","+"]),hP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),yP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Ug=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),CP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),SP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Vc=new Set(["-c","-e","-r","-E","--eval","--exec"]),bP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Kc=new Set(["grep","rg"]),Hg=new Set(["files-with-matches","files-without-match","count","quiet"]),vP=new Set([...Hg,"ignore-case","fixed-strings","hidden"]),EP=new Set(["wc",...Kc]),RP=new Set(["cd","grep","head","openssl","tail","tailscale"]),_P=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,xP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),wP=new Set(["commit","merge","notes","stash","tag"]),AP=new Set(["-m","--message"]),PP=new Set(["--grep"]),TP=new Set(["powershell","pwsh"]),Pg=new Set(["jq","gojq","jaq"]),Tg="f",Ig="file",IP="files",kP=new Set(["e","f"]),OP=new Set(["regexp","file"]),MP=new Set(["e","f","A","B","C","m"]),DP=new Set(["regexp","file","after-context","before-context","context","max-count"]),Bc="__CC_SAFETY_NET_PIPE_INPUT__",Hc=/[\w./~@+-]*[./~][\w./~@+-]*/g,NP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,LP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,WP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,kg=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Og=/\b(?:system|exec|spawn|popen)\s*$/,FP=/\b(?:eval|exec)\s*\(/g,GP=/\b(?:eval|exec)\s*$/,zP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Mg(G,H,j,J,oe,ie){for(let fe of G){let Re=fe.target;if(sI(Re,fe.cwd,H?.denyPaths??[],j,J,oe))return{target:Re,ruleId:"secret.deny-path"};if(ie&&!ie.has(Re))continue;let Te=oI(Re,fe.cwd,H,J,oe);if(Te){let ke=ie!==void 0&&!Te.startsWith("secret.home.")&&!Te.startsWith("secret.cli.");if(ke&&J.paths.isDirectory(oh(Re,fe.cwd,J,oe)))continue;if(ke&&ie?.get(Re)==="data")continue;if(ke&&(fe.isRedirectionWriteTarget===!0||ie?.get(Re)==="write")&&!Re.includes("$")&&!ua(Re,fe.cwd,J,oe))continue;if(ke&&(fe.isCreatedPath===!0||fe.isCertificateInput===!0))continue;if(ke&&/\s/.test(Re)&&!Re.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Re)&&!ua(Re,fe.cwd,J,oe))continue;if(!Te.startsWith("secret.cli.")&&aI(Re,fe.cwd,H?.allowPaths??[],j,J,oe))continue;return{target:Re,ruleId:Te}}}return null}function jg(G,H,j,J,oe={}){let ie=Dg(G,j,J),fe=Mg(ie,H,G.invocation.context.configCwd,j,J);if(fe===null||fe.ruleId==="secret.deny-path"||oe.strict!==!1)return fe;let Re=Dg(G,j,J,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),Te=new Map;Re.forEach((Qe)=>Vg(Qe.target).forEach((et)=>Te.set(et,(Te.get(et)??new Set).add(Qe.loopVariable))));let ke=(Qe,et)=>(Te.get(Qe)?.size??0)>(Te.get(Qe)?.has(et)?1:0),Le=Re.filter(({loopVariable:Qe})=>Qe===void 0||ke(Qe,Qe)||ke("!",Qe)),Xe=new Set(Le.filter((Qe)=>Qe.literalRole===void 0).map((Qe)=>Qe.target)),Ye=new Set(Le.filter((Qe)=>Qe.literalRole==="write").map((Qe)=>Qe.target)),Ze=Mg(ie,H,G.invocation.context.configCwd,j,J,new Map(Le.map((Qe)=>[Qe.target,Xe.has(Qe.target)?"path":Ye.has(Qe.target)?"write":"data"])));return Ze?.ruleId!=="secret.deny-path"&&$P(G,j)?null:Ze}function $P(G,H){let j=bn(G,"input-candidate")??bn(G,"declared-command");if(!j)return!1;if(j.program.nodes.some((fe)=>fe.kind==="command"&&fe.nested.length>0))return!1;let J=[];for(let fe of ws(j.shell)){if(fe.kind==="operator"&&fe.boundary)return!1;if(fe.kind==="redirection")return!1;if(fe.kind==="operator")continue;J.push(sr(fe.text,H))}let oe=Qn(J);if(oe.length===0)return!1;let ie=yn(oe[0]??"").toLowerCase();if(G.invocation.route.kind==="unknown")return j.program.dialect==="powershell"&&(ie==="ls"||ie==="stat");return qc(ie,oe.slice(1))}function qc(G,H){if(G==="ls"||G==="stat")return!0;if(G==="test")return H.length===2&&(H[0]==="-e"||H[0]==="-f");if(G==="[")return H.length===3&&(H[0]==="-e"||H[0]==="-f")&&H[2]==="]";if(G==="git")return H[0]==="check-ignore";if(G==="wc")return H.every((j)=>!j.startsWith("-")||_P.test(j));if(Kc.has(G))return BP(G,H);if(G!=="find")return!1;return!H.some((j)=>hP.has(j))}function BP(G,H){let j=H.includes("--")?H.slice(0,H.indexOf("--")):H;if(j.some((ke)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ke)||/^-[^-]*f/.test(ke)))return!1;let J=G==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,oe=G==="rg"?/[clq]/:/[Lclq]/,ie=(ke)=>/^-[^-]/.test(ke),fe=(ke)=>{let Le=j[ke-1]??"";return/^--[^=]+$/.test(Le)&&!vP.has(Le.slice(2))||ie(Le)&&Le.slice(1).search(J)===Le.length-2},Re=j.findIndex((ke,Le)=>!ke.startsWith("-")&&!fe(Le));return(G==="grep"&&Re>=0?j.slice(0,Re):j).some((ke,Le)=>{if(fe(Le))return!1;if(ke.startsWith("--"))return Hg.has(ke.slice(2));return ie(ke)&&oe.test(ke.slice(1).split(J)[0]??"")})}function Dg(G,H,j,J={}){let oe=G.invocation.context.executionCwd,ie=G.invocation.route.kind;if(ie!=="command"&&ie!=="unknown")return G.paths.map((Re)=>({target:Re,cwd:oe}));let fe=bn(G,"input-candidate");return[...fe?Oo(fe.shell,G.store,J,H,oe,j,UP(fe)):[],...ie==="unknown"?G.paths.map((Re)=>({target:Re,cwd:oe})):[]]}function UP(G){return G.program.dialect==="powershell"}function Oo(G,H,j,J,oe,ie,fe=!1){if(G.status==="structural-limit")throw new b;if(G.status==="unclosed-quote")return[];if(G.status==="invalid")throw new U;let Re=[...G.assignmentFallbacks.map((tt)=>({target:tt,cwd:oe})),...zT(sr(G.source,J),H,j,J,oe,ie)],Te=(tt)=>sr(tT(tt,fe),J),ke=/[<>=]\(/.test(G.source),Le=/\bcoproc\b|\|&/.test(G.source),Xe=[],Ye=[],Ze=(tt)=>({...j,commandHoldsPipe:j.commandHoldsPipe===!0||tt||Le});xs(G,oe,J,ie,{word:Te,segment:(tt,gt,_t,yt,At,Mt)=>{if(tt.length===0)return null;let Dt=Ze(Mt);if(Dt.commandHoldsPipe)Xe.push(...tt);if(Ye.push(yn(Kg(Qn(tt))[0]??"").toLowerCase()),Re.push(...Ti(tt,H,ke||yt==="|"||yt==="|&"?{...Dt,segmentMayFeedReader:!0}:Dt,J,gt.cwd,ie,At)),_t!==null)Re.push(...VP(_t,tt,H,Dt,J,gt.cwd,ie));return null},redirection:(tt,gt,_t)=>{if(tt.body!==void 0&&tt.consumer!==void 0){let yt=Ze(_t);Re.push(...qg(tt.consumer,[tt.body],H,yt,J,gt.cwd,ie,(At)=>KP(tt.consumer??[],At,H,yt,J,gt.cwd,ie)))}if(tt.targetOrder==="legacy-segment")return Fl;return Re.push({target:Te(tt.target),cwd:gt.cwd,...tt.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Qe=new Set(Xe.flatMap(Vg)),et=ke||/\$\(|`/.test(G.source)||!Ye.every((tt)=>RP.has(tt));return Re.map(({loopVariable:tt,...gt})=>{if(gt.certificateOutputMayFeedReader===!0&&et)return{target:gt.target,cwd:gt.cwd};return tt===void 0||ke||Qe.has(tt)||Qe.has("!")?gt:{...gt,loopVariable:tt}})}function Vg(G){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(G)?[G]:[],...Array.from(G.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(H)=>H[1]??H[2]??"")]}function ca(G,H,j,J,oe,ie,fe=!1){let Re=H.getShellSyntax(G,fe?H.getCommandProgram(G,"powershell"):void 0);if(Re.status==="structural-limit")throw new b;return Re.status==="complete"?Oo(Re,H,j,J,oe,ie,fe):null}function Ti(G,H,j,J,oe,ie,fe){let Re=(ht)=>({target:ht,cwd:oe}),Te=G.findIndex((ht)=>!fP.has(ht));if(j.skipMetadataOnlySegments===!0&&Te>0)return Ti(G.slice(Te),H,j,J,oe,ie,new Set([...fe??[]].map((ht)=>ht-Te)));let ke=G[1]??"";if(j.skipMetadataOnlySegments===!0&&G[0]==="for"&&G[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ke))return G.slice(3).flatMap((ht)=>Fn("for",ht)).map((ht)=>({...Re(ht),loopVariable:ke}));if(fe?.size){let ht=G.filter((Ot,$t)=>!fe.has($t));if(Pg.has(yn(Qn(ht)[0]??"").toLowerCase()))return[...G.filter((Ot,$t)=>fe.has($t)).map(Re),...Ti(ht,H,j,J,oe,ie)]}let Le=eT(G).map(Re),Xe=Qn(G);if(Xe.length===0)return Le;let Ye=Xe[0]??"",Ze=yn(Ye).toLowerCase(),Qe=Xe.slice(1),et=j.segmentMayFeedReader===!0||j.commandHoldsPipe===!0||j.displayOperandsAreCapturedOutput===!0,tt=et&&EP.has(Ze);if(j.skipMetadataOnlySegments===!0&&!tt&&qc(Ze,Qe))return Le;let gt=jP(Ye,Ze,Qe);if(gt)return[...Le,...gt.map(Re)];if(Bg.has(Ze))return j.displayOperandsAreCapturedOutput===!0?[...Le,...Yg(G).map(Re)]:Le;if(Ze==="eval")return[...Le,...ca(Qe.join(" "),H,j,J,oe,ie)??Qe.map(Re)];let _t=TP.has(Gt(Ye))?Pc(Xe):void 0;if(_t!==void 0)ie.charge("derivedTokens",Xe.length);let yt=_t===void 0?null:ca(_t,H,j,J,oe,ie,!0);if(yt?.length)return[...Le,...yt];if(Ze==="export")return[...Le,...Qe.flatMap((ht)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ht)?[ht.slice(ht.indexOf("=")+1)]:Fn(Ze,ht)).map(Re)];if(Ze==="git")return[...Le,...rT(Qe).map(Re)];if(Ze==="gh")return[...Le,...jc(Ze,Qe,xP).map(Re)];if(Pg.has(Ze))return[...Le,...nT(Qe).map(Re)];if(Kc.has(Ze))return[...Le,...qT(Qe).map(Re)];if(mP.has(Ze))return[...Le,...iT(Qe,H,j,J,oe,ie).map(Re)];if(Ze==="mkdir"||Ze==="touch"){let ht=new Set(G.filter(($t,sn)=>fe?.has(sn))),Ot=j.segmentMayFeedReader!==!0&&!(Ze==="touch"&&Qe.some(($t)=>/^(?:--r|-[^-]*r)/.test($t)));return[...Le,...Qe.flatMap(($t)=>Fn(Ze,$t).map((sn)=>Ot&&!$t.startsWith("-")&&!ht.has($t)?{...Re(sn),isCreatedPath:!0}:Re(sn)))]}if(Dn.has(Ze))return[...Le,...Qe.flatMap((ht)=>Fn("awk",ht)).map(Re),...Qe.flatMap((ht)=>aT(ht,H,j,J,oe,ie)),...Qe.flatMap(lT).map(Re)];if(Ze==="curl")return[...Le,...Qe.filter((ht,Ot)=>Xg(ht)===null&&Zg(Qe[Ot-1])===null).flatMap((ht)=>Fn(Ze,ht)).map(Re),...oT(Qe).map(Re)];if(go(Ze)){let ht=ui.has(Ze)?wn([Ze,...Qe]):null;if(ht!==null&&ht.command!==null&&ht.commandIndex!==null){let Ot=H.getShellSyntax(ht.command);if(Ot.status==="structural-limit")throw new b;if(Ot.status==="complete")return[...Le,...Oo(Ot,H,j,J,oe,ie),...Qe.slice(ht.commandIndex).filter(($t)=>!$t.startsWith("-")).map(Re)]}return[...Le,...sT(Ze,Qe,H,j,J,oe,ie)]}let At=(ht,Ot)=>new RegExp(`^--?${ht}=`).test(Qe[Ot]??"")||new RegExp(`^--?${ht}$`).test(Qe[Ot-1]??""),Mt=HP(Xe),Dt=Ze==="openssl"&&Qe[0]==="x509",Lt=et?{certificateOutputMayFeedReader:!0}:{};return[...Le,...Qe.flatMap((ht,Ot)=>Fn(Ze,ht).map(($t)=>Mt&&At("(?:cert|key)-file",Ot)?{...Re($t),isCreatedPath:!0,...Lt}:Dt&&At("in",Ot)?{...Re($t),isCertificateInput:!0,...Lt}:Re($t)))]}function Kg(G){return yn(G[0]??"").toLowerCase()==="timeout"?G.slice(2):G}function HP(G){let H=Kg(G);return yn(H[0]??"").toLowerCase()==="tailscale"&&H[1]==="cert"}function jP(G,H,j){let J=sa(H,j);if(J===null||j[J]!=="explain")return null;let oe=[G,...j.slice(0,J)],ie=j.slice(J+1);for(let fe=0;fe<ie.length;fe++){let Re=ie[fe];if(Re==="--json"||Re==="--help"||Re==="-h")continue;if(Re==="--cwd"){let Te=ie[fe+1];if(Te&&!Te.startsWith("--"))oe.push(Te);fe++;continue}return oe}return oe}function VP(G,H,j,J,oe,ie,fe){if(XP(H,j,J,oe,ie,fe)){let Re=Qn(G),Te=qc(yn(Re[0]??"").toLowerCase(),Re.slice(1))?Re.slice(1).filter((ke)=>!ke.startsWith("-")):[];return[...Yg(G),...Te].map((ke)=>({target:ke,cwd:ie}))}return qg(H,qP(G),j,J,oe,ie,fe,()=>[])}function KP(G,H,j,J,oe,ie,fe){let Re=Qn(G);if(!go(yn(Re[0]??"").toLowerCase()))return[];return ca(H,j,J,oe,ie,fe)??[{target:H,cwd:ie}]}function qg(G,H,j,J,oe,ie,fe,Re){let Te=JP(G);if(Te===null)return H.flatMap(Re);return H.flatMap((ke)=>ui.has(Te)?Oo(j.getShellSyntax(ke),j,J,oe,ie,fe):da(Te,ke,j,J,oe,ie,fe))}function Yg(G){let H=Qn(G);if(H.length===0)return[];let j=yn(H[0]??"").toLowerCase();if(!Bg.has(j))return[];let J=H[H[1]==="--"?2:1];if(j==="printf"&&J!==void 0&&!J.startsWith("-")&&!J.replaceAll("%%","").includes("%"))return[Yc(J.replaceAll("%%","%"))];return H.slice(1)}function qP(G){let H=Qn(G);if(H.length===0)return[];let j=yn(H[0]??"").toLowerCase(),J=H.slice(1);if(j==="echo"){let oe=J.findIndex((ie)=>!/^-[neE]+$/.test(ie));return[(oe===-1?[]:J.slice(oe)).join(" ")]}if(j==="printf")return YP(J);return[]}function YP(G){let H=G[0];if(H===void 0)return[];let j=(H.match(/%%|%[bqs]/g)??[]).filter((oe)=>oe!=="%%").length;if(j===0||G.length===1)return[Yc(H)];let J=G.slice(1);return Array.from({length:Math.ceil(J.length/j)},(oe,ie)=>ZP(H,J.slice(ie*j,(ie+1)*j)))}function ZP(G,H){let j=0;return Yc(G.replace(/%%|%[bqs]/g,(J)=>{if(J==="%%")return"%";let oe=H[j]??"";return j++,oe}))}function Yc(G){return G.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function XP(G,H,j,J,oe,ie){let fe=Qn(G);if(fe.length===0||yn(fe[0]??"").toLowerCase()!=="xargs")return!1;let Re=Kr(fe),Te=fe.slice(Re.childStart);if(Te.length===0)return!1;if(Re.replacementToken==="")return!1;let ke=Re.replacementToken,Le=ke===null?[...Te,Bc]:Te.map((Xe)=>Xe.split(ke).join(Bc));return Ti(Le,H,j,J,oe,ie).some((Xe)=>Xe.target.includes(Bc))}function JP(G){let H=Qn(G);if(H.length===0)return null;let j=yn(H[0]??"").toLowerCase();if(!go(j))return null;return QP(j,H.slice(1))?j:null}function QP(G,H){let j=Zc(G);for(let J=0;J<H.length;J++){let oe=H[J];if(oe===void 0)break;if(Vc.has(oe)||Jg(G,oe)||/^--(?:eval|exec)=/.test(oe))return!1;if(oe==="-")return!0;if(oe.startsWith("-")){if(j==="python"&&oe==="-m")return!1;if(zP.get(j)?.has(oe))J++;continue}return!1}return!0}function Zc(G){return/^python\d/.test(G)?"python":G}function eT(G){let H=[];for(let j of G){if(rh(j))continue;let J=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(j);if(J===null)break;if(J[1]!==void 0&&J[1]!=="")H.push(J[1])}return H}var Ng=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function tT(G,H){if(!H||!Ng.test(G))return G;return`~${G.replace(Ng,"").replace(/\\/g,"/")}`}function Fn(G,H){if(H==="--")return[];let j=[],J=H.indexOf("=");if(J>0&&J<H.length-1&&!H.slice(0,J).includes("?"))j.push(H.slice(J+1));if(H.startsWith("-"))return j;if(G==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(H))return j;if(G==="zip"&&/\.zip$/i.test(H))return j;return j.push(H),j}function nT(G){let H=-1,j=!1;for(let J=0;J<G.length;J++){let oe=G[J]??"";if(!j&&oe==="--"){j=!0;continue}if(j||!/^-(?:[A-Za-z]|-)/.test(oe)){if(H===-1)H=J;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(oe)){J+=2;continue}if(oe==="--indent"||oe==="-L"){J++;continue}if(oe.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(oe)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(oe))continue;return G.flatMap((ie)=>Fn("jq",ie))}return G.flatMap((J,oe)=>oe===H?[]:Fn("jq",J))}function rT(G){let H=[];for(let j=0;j<G.length;j++){let J=G[j]??"";if(J==="--"||!J.startsWith("-"))return[...H,...wP.has(J)?jc("git",G.slice(j).map((ie)=>/^-[aeinopqsv]+m$/.test(ie)?"-m":ie),AP):jc("git",G.slice(j),PP)];if(H.push(...Fn("git",J)),!xn.has(J))continue;let oe=G[j+1];if(oe===void 0)break;H.push(...J==="-c"&&oe.includes("=")?[oe.slice(oe.indexOf("=")+1)]:Fn("git",oe)),j++}return H}function jc(G,H,j){let J=[];for(let oe=0;oe<H.length;oe++){let ie=H[oe]??"";if(ie==="--")return[...J,...H.slice(oe).flatMap((fe)=>Fn(G,fe))];if(j.has(ie)){oe++;continue}if(ie.includes("=")&&j.has(ie.slice(0,ie.indexOf("="))))continue;J.push(...Fn(G,ie))}return J}function oT(G){return G.flatMap((H,j)=>{let J=Xg(H);if(J!==null)return Lg(J.flag,J.value);let oe=Zg(G[j-1]);return oe===null?[]:Lg(oe,H)})}function Lg(G,H){if(G==="-F"||G==="--form"){let j=H.indexOf("="),J=j===-1?H:H.slice(j+1);if(!J.startsWith("@")&&!J.startsWith("<"))return[];return Uc(J.slice(1).split(";")[0]??"")}if(G==="--data-urlencode"){let j=H.indexOf("@"),J=H.indexOf("=");if(j===-1||J!==-1&&J<j)return[];return Uc(H.slice(j+1))}return H.startsWith("@")?Uc(H.slice(1)):[]}function Zg(G){if(G===void 0)return null;if(Ug.has(G))return G;return/^-[A-Za-z]+[dF]$/.test(G)?`-${G.slice(-1)}`:null}function Xg(G){let H=G.slice(0,2);if(G.length>2&&(H==="-d"||H==="-F"))return{flag:H,value:G.slice(2)};let j=G.indexOf("=");if(j===-1)return null;let J=G.slice(0,j);return Ug.has(J)?{flag:J,value:G.slice(j+1)}:null}function Uc(G){return G===""||G==="-"?[]:[G]}function iT(G,H,j,J,oe,ie){let fe=G.findIndex((Te)=>Te.startsWith("-")||Te==="("||Te==="!"||Te===";"),Re=[...G.slice(0,fe===-1?G.length:fe),...G.flatMap((Te,ke)=>Te==="-files0-from"&&G[ke+1]!==void 0?[G[ke+1]??""]:[])];for(let Te=0;Te<G.length;Te++){if(!pP.has(G[Te]??""))continue;let ke=G.slice(Te+1),Le=ke.findIndex((Ze)=>gP.has(Ze)),Xe=Le===-1?ke:ke.slice(0,Le),Ye=Ti(Xe,H,j,J,oe,ie).map((Ze)=>Ze.target);if(Re.push(...Ye.filter((Ze)=>Ze!=="{}")),!Ye.includes("{}"))continue;Re.push(...G.slice(0,Te).flatMap((Ze,Qe,et)=>{if(!yP.has(Ze))return[];let tt=et[Qe+1];return tt===void 0?[]:[tt,tt.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Re}function sT(G,H,j,J,oe,ie,fe){let Re=[];for(let Te=0;Te<H.length;Te++){let ke=H[Te];if(ke===void 0)break;if(Vc.has(ke)||Jg(G,ke)){let Xe=H[Te+1];if(Xe!==void 0)Re.push(...da(G,Xe,j,J,oe,ie,fe)),Te++;continue}let Le=/^--(?:eval|exec)=(.*)$/.exec(ke);if(Le!==null&&Le[1]!==void 0){Re.push(...da(G,Le[1],j,J,oe,ie,fe));continue}if(!ke.startsWith("-"))Re.push({target:ke,cwd:ie})}return Re}function Jg(G,H){if(!H.startsWith("-")||H.startsWith("--")||H.length<=2)return!1;return bP.get(H[H.length-1]??"")?.has(Zc(G))??!1}function aT(G,H,j,J,oe,ie){if(!G.includes("system"))return[];return Jl(G)?.commands.flatMap((fe)=>Oo(H.getShellSyntax(fe),H,j,J,oe,ie))??[]}function lT(G){return Array.from(G.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((H)=>H[1]).filter((H)=>H!==void 0&&H!=="")}function cT(G){let H=Array.from(G.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((j)=>j[2]).filter((j)=>j!==void 0&&j!=="");return[...H,...H.flatMap(Jc),...G.match(Hc)??[]]}function da(G,H,j,J,oe,ie,fe){let Re=(ht)=>({target:ht,cwd:ie}),Te=OT(G),ke=DT(H,Te);if(ke.kind==="unmaskable")return cT(H).map(Re);let Le=ke.masked.match(kg)!==null||ke.literals.some((ht)=>Og.test(ke.masked.slice(0,ht.start))),Xe=ke.masked.match(FP)!==null||ke.literals.some((ht)=>GP.test(ke.masked.slice(0,ht.start))),Ye=J.inlineLiteralsPresumedData===!0&&!ui.has(G),Ze=Ye&&(Te==="python"||Te==="javascript"),Qe=Ye&&!(GT(ke.masked)||Le||Xe)?[]:ke.literals,et=Ye?Array.from(ke.masked.matchAll(kg),(ht)=>{let Ot=ht.index+ht[0].length;return{start:Ot,end:ys(ke.masked,Ot)}}):[],tt=!Ye||et.some((ht)=>Ml(ke.masked,ht.start)&&!yT(ke,ht.start))?ke.literals:ke.literals.filter((ht)=>Og.test(ke.masked.slice(0,ht.start))||et.some((Ot)=>ht.start>=Ot.start&&ht.start<Ot.end)),gt=new Set(Le?tt:[]),_t=Ze&&Qe.length>0&&!fT(ke.masked,Te==="python"?"#":"//"),yt=_t?CT(ke.masked):[],At=_t?Array.from(ke.masked.matchAll(/[A-Za-z_$][\w$]*/g),(ht)=>({name:ht[0],index:ht.index})):[],Mt=gT(At),Dt=!pT(ke.masked,At),Lt=At.filter((ht)=>!Wg(ke.masked,{start:ht.index,text:ht.name,tokenStart:ht.index,tokenEnd:ht.index+ht.name.length},yt,Mt,Dt)).reduce((ht,Ot)=>{let $t=ht.get(Ot.name)??[];return $t.push(Ot.index),ht.set(Ot.name,$t)},new Map);return[...Qe.filter((ht)=>ht.text!=="").map((ht)=>{if(!_t||gt.has(ht))return Re(ht.text);if(Wg(ke.masked,ht,yt,Mt,Dt)||ST(ke.masked,ht,yt,Lt))return{...Re(ht.text),literalRole:"data"};return TT(ke,ht,yt)?{...Re(ht.text),literalRole:"write"}:Re(ht.text)}),...Qe.flatMap((ht)=>Jc(ht.text)).map(Re),...Ye?[]:ke.literals.flatMap((ht)=>ht.text.match(Hc)??[]).map(Re),...Le?tt.flatMap((ht)=>ca(ht.text,j,{...J,commandHoldsPipe:!0},oe,ie,fe)??[Re(ht.text)]):[],...Xe?ke.literals.flatMap((ht)=>da(G,ht.text.replace(/\\(.)/g,(Ot,$t)=>$t==="n"?`
-`:$t),j,J,oe,ie,fe)):[],...Ze?[]:(ke.masked.match(Hc)??[]).map(Re),...Ye?(H.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Re):[]]}var Xc={"(":")","[":"]","{":"}"},Qg="and|elif|else|if|in|is|not|of|or|return|while|yield",dT=new RegExp(`(?:^|[^\\w$])(?:${Qg})$`),uT=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${Qg})\\s*\\(|/\\*`),mT=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function fT(G,H){return uT.test(G)||G.split(`
-`).some((j)=>{let J=j.indexOf(H);return J>=0&&/[()[\]{}]/.test(j.slice(J))})}function pT(G,H){return ET.test(G)||H.some((j)=>{let J=vT.get(j.name),oe=j.index+j.name.length;return J!==void 0&&!J.test(G.slice(oe,oe+40))})}function gT(G){return G.some((H)=>th(H.name).some((j)=>mT.test(j)))}var hT=new Set(["cmd","powershell","pwsh"]);function yT(G,H){let j=Xr(G.masked,H),J=Xc[G.masked[j]??""];if(J===void 0||J==="}")return!1;let oe=G.masked.indexOf(J,j+1),ie=G.masked.slice(j+1,oe);return oe!==-1&&/^\s*,[\w\s,]*$/.test(ie)&&/^[,)]/.test(G.masked.slice(Xr(G.masked,oe+1)))&&!G.literals.some((fe)=>fe.tokenStart>j&&fe.tokenStart<oe&&(Vc.has(fe.text)||go(yn(fe.text).toLowerCase())||hT.has(yn(fe.text).toLowerCase().replace(/\.exe$/,""))))}function CT(G){let H=[];return G.split("").map((j,J)=>{let oe=H.at(-1)??-1;if(j in Xc)H.push(J);if(j===")"||j==="]"||j==="}")H.pop();return oe})}function Wg(G,H,j,J,oe){let ie=j[H.tokenStart]??-1,fe=G[ie]??"",Re=ko(G,H.tokenStart),Te=Xr(G,H.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(G.slice(Math.max(0,Re-3),Re+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(G.slice(Te,Te+8)))return!0;if(J&&(fe==="["||fe==="("))return!1;let ke=G[Re],Le=G[Te];if(fe==="{"&&ke===":")return IT(G,Re);let Xe=(ke===fe||ke===",")&&(Le===","||Le===Xc[fe]||fe==="{"&&Le===":");if(fe!=="(")return Xe&&fe!=="";return Xe&&(oe&&bT.test(G.slice(Math.max(0,ie-20),ie))||(ke===","||Le===",")&&kT(G,ie))}function ST(G,H,j,J){let oe=Math.max(0,H.tokenStart-80),ie=`${oe===0?`
-`:""}${G.slice(oe,H.tokenStart)}`,fe=RT.exec(ie)?.[1],Re=G[j[H.tokenStart]??-1];if(fe===void 0||Re==="("||Re==="[")return!1;let Te=Xr(G,H.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(G.slice(H.tokenEnd,Te)))return!1;let ke=H.tokenStart-ie.length+ie.lastIndexOf(fe);return(J.get(fe)??[]).every((Le)=>Le===ke)}var bT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,vT=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),ET=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,RT=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,_T=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,xT=/^\s*\.\s*write_(?:text|bytes)\s*\(/,wT=/(?:^|[^\w$.])open\s*$/,AT=/^[bt]*[awx][abtwx]*$/,PT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function TT(G,H,j){let J=j[H.tokenStart]??-1;if(G.masked[J]!=="(")return!1;let oe=ko(G.masked,H.tokenStart),ie=Xr(G.masked,H.tokenEnd),fe=G.masked[ie],Re=G.masked.slice(Math.max(0,J-40),J);if(_T.test(Re))return(oe===J||G.masked[oe]===",")&&(fe===","||fe===")")&&!G.literals.some((ke)=>ke.tokenStart>J&&ke.tokenStart<H.tokenStart)&&xT.test(G.masked.slice(ys(G.masked,J+1)+1));if(oe!==J||fe!==",")return!1;if(PT.test(Re))return!0;if(!wT.test(Re))return!1;let Te=G.literals.find((ke)=>/^,\s*(?:mode\s*=\s*)?$/.test(G.masked.slice(ie,ke.tokenStart)));return Te!==void 0&&AT.test(Te.text)&&/^[,)]/.test(G.masked.slice(Xr(G.masked,Te.tokenEnd)))}function IT(G,H){let j=ko(G,H),J=/[\w$]*$/.exec(G.slice(Math.max(0,j-63),j+1))?.[0]??"",oe=G[ko(G,j+1-J.length)];return oe==="{"||oe===","}function kT(G,H){let j=ko(G,H),J=G.slice(Math.max(0,j-7),j+1);return!/[\w$)\]]$/.test(J)||dT.test(J)}function OT(G){let H=Zc(G);if(H==="python")return"python";if(H==="osascript")return"opaque";return H==="node"||H==="bun"||H==="deno"?"javascript":"simple"}var MT={python:"#",javascript:"/"};function DT(G,H){if(H==="opaque")return{kind:"unmaskable"};let j={masked:G.split(""),literals:[]};return eh(G,0,H,j,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:j.masked.join(""),literals:j.literals}}function eh(G,H,j,J,oe){let ie=0;for(let fe=H;fe<G.length;fe++){let Re=G[fe]??"";if(oe&&Re==="}"&&ie===0)return fe;if(oe&&Re===MT[j])return null;if(Re==="{")ie++;if(Re==="}")ie--;if(j==="simple"&&(Re==="`"||Re==="%"||Re==="<")){if(LP.test(G.slice(fe)))return null}let Te=Re==="'"||Re==='"'||j==="javascript"&&Re==="`"?Re:null;if(Te===null)continue;if(Te==="`"&&FT(G,fe))return null;let ke=j==="python"?LT(G,fe):"",Le=j==="python"&&G.startsWith(Te.repeat(3),fe)?Te.repeat(3):Te,Xe=fe+Le.length,Ye=Te==="`"||/[fF]/.test(ke),Ze=fe-ke.length,Qe=Ye?NT(G,Ze,Xe,Le,j,J):WT(G,Xe,Le);if(Qe===null)return null;if(!Ye){let et=G.slice(Xe,Qe);if(j==="simple"&&Te==='"'&&WP.test(et))return null;J.literals.push({start:Xe,text:et,tokenStart:Ze,tokenEnd:Qe+Le.length}),J.masked.fill(" ",Xe,Qe)}J.masked.fill(" ",fe,Xe),J.masked.fill(" ",Qe,Qe+Le.length),fe=Qe+Le.length-1}return oe?null:G.length}function NT(G,H,j,J,oe,ie){let fe=oe==="python"?"{":"${",Re=J==="`"||J.length===3,Te="";for(let ke=j;ke<G.length;ke++){let Le=G[ke]??"";if(G.startsWith(J,ke))return ie.literals.push({start:j,text:Te,tokenStart:H,tokenEnd:ke+J.length}),ke;if(!Re&&(Le===`
-`||Le==="\r"))return null;let Xe=oe==="python"&&(Le==="{"||Le==="}")&&G[ke+1]===Le;if(!Xe&&G.startsWith(fe,ke)){let Qe=eh(G,ke+fe.length,oe,ie,!0);if(Qe===null)return null;Te+=`${fe}}`,ie.masked.fill(" ",ke,ke+fe.length),ie.masked[Qe]=" ",ke=Qe;continue}let Ze=Le==="\\"&&!(oe==="python"&&G[ke+1]==="{")||Xe?2:1;Te+=G.slice(ke,ke+Ze),ie.masked.fill(" ",ke,ke+Ze),ke+=Ze-1}return null}function LT(G,H){return NP.exec(G.slice(Math.max(0,H-3),H))?.[1]??""}function WT(G,H,j){let J=j.length===3;for(let oe=H;oe<G.length;oe++){let ie=G[oe];if(ie==="\\"){oe++;continue}if(!J&&(ie===`
-`||ie==="\r"))return null;if(G.startsWith(j,oe))return oe}return null}function FT(G,H){for(let j=H-1;j>=0;j--){let J=G[j];if(!J||/\s/.test(J))continue;return/[\w$\])]/.test(J)}return!1}function GT(G){for(let H of G.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let j=H[0],J=H.index;if(CP.has(j.toLowerCase()))return!0;let oe=th(j);if(!oe.some((ie)=>SP.has(ie)))continue;if(oe.length>1)return!0;if(G[ko(G,J)]===".")return!0;if(G[Xr(G,J+j.length)]==="(")return!0}return!1}function th(G){return G.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((H)=>H.toLowerCase())}function ko(G,H){for(let j=H-1;j>=0;j--)if(!/\s/.test(G[j]??""))return j;return-1}function Xr(G,H){for(let j=H;j<G.length;j++)if(!/\s/.test(G[j]??""))return j;return G.length}function zT(G,H,j,J,oe,ie){return jT(G).flatMap((fe)=>{let Re=H.getShellSyntax(fe);if(Re.status==="invalid")return[];return[...Oo(Re,H,{...j,displayOperandsAreCapturedOutput:!0},J,oe,ie),...$T(Re,J)?BT(Re,J).map((Te)=>({target:Te,cwd:oe})):[]]})}function $T(G,H){let j=ws(G);for(let J=0;J<j.length;J++){let oe=j[J];if(oe?.kind!=="word"||yn(sr(oe.text,H)).toLowerCase()!=="base64")continue;for(let ie=J+1;ie<j.length;ie++){let fe=j[ie];if(fe?.kind==="operator")break;if(fe?.kind!=="word")continue;let Re=sr(fe.text,H);if(Re==="--decode"||!Re.startsWith("--")&&Re.startsWith("-")&&/[dD]/.test(Re))return!0}}return!1}function BT(G,H){return ws(G).flatMap((j)=>j.kind==="word"?[sr(j.text,H)]:j.kind==="redirection"&&j.target?[sr(j.target,H)]:[]).flatMap(Jc)}function Jc(G){let H=HT(G);if(H===null)return[];let j=Buffer.from(H,"base64").toString("utf8");if(j===""||UT(j))return[];return Buffer.from(j,"utf8").toString("base64").replace(/=+$/g,"")===H.replace(/=+$/g,"")?[j]:[]}function UT(G){return Array.from(G).some((H)=>{let j=H.charCodeAt(0);return j<32||j===127})}function HT(G){if(G.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(G))return null;if(/=/.test(G.replace(/=+$/g,"")))return null;let H=G.replace(/=+$/g,"");if(H.length%4===1)return null;return`${H.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-H.length%4)%4)}`}function jT(G){let H=[],j={inSingle:!1,inDouble:!1,escaped:!1};for(let J=0;J<G.length;J++){let oe=G[J];if(!oe)break;if(jo(oe,j))continue;if(nh(G,J,j)){let ie=VT(G,J+1);if(ie!==null)H.push(ie.body),J=ie.endIndex;continue}if(!j.inSingle&&oe==="`"){let ie=KT(G,J);if(ie!==null)H.push(ie.body),J=ie.endIndex}}return H}function VT(G,H){let j={inSingle:!1,inDouble:!1,escaped:!1},J=1;for(let oe=H+1;oe<G.length;oe++){let ie=G[oe];if(!ie)break;if(jo(ie,j))continue;if(nh(G,oe,j)){J++,oe++;continue}if(!j.inSingle&&!j.inDouble&&ie===")"){if(J--,J===0)return{body:G.slice(H+1,oe),endIndex:oe}}}return null}function KT(G,H){let j=!1;for(let J=H+1;J<G.length;J++){let oe=G[J];if(!oe)break;if(j){j=!1;continue}if(oe==="\\"){j=!0;continue}if(oe==="`")return{body:G.slice(H+1,J),endIndex:J}}return null}function nh(G,H,j){return!j.inSingle&&G[H]==="$"&&G[H+1]==="("&&G[H+2]!=="("}function qT(G){let H=[],j=[],J=!1,oe=!1,ie=!1;for(let Te=0;Te<G.length;Te++){let ke=G[Te];if(ke===void 0)break;if(!ie&&ke==="--"){ie=!0;continue}if(ie){j.push(ke);continue}let Le=/^--([^=]+)(?:=(.*))?$/.exec(ke);if(Le!==null){let Xe=Le[1]??"",Ye=Le[2];if(Xe===IP)oe=!0;if(OP.has(Xe))J=!0;if(Ye!==void 0){if(Xe===Ig)H.push(Ye);continue}if(DP.has(Xe)){let Ze=G[Te+1];if(Xe===Ig&&Ze!==void 0)H.push(Ze);Te++}continue}if(ke.startsWith("-")&&ke.length>1){let Xe=ke.slice(1),Ye="",Ze="";for(let et=0;et<Xe.length;et++){let tt=Xe[et]??"";if(kP.has(tt))J=!0;if(MP.has(tt)){Ye=tt,Ze=Xe.slice(et+1);break}}if(Ye==="")continue;if(Ze.length>0){if(Ye===Tg)H.push(Ze);continue}let Qe=G[Te+1];if(Ye===Tg&&Qe!==void 0)H.push(Qe);Te++;continue}j.push(ke)}let Re=!J&&!oe?j.slice(1):j;return[...H,...Re]}function Qn(G){let H=G.findIndex((j)=>!rh(j)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(j));return H===-1?[]:G.slice(H)}function rh(G){return G==="env"||G==="command"||G==="builtin"||G==="sudo"}var YT=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),ZT=".env.",XT=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),JT=[".env.example.",".env.sample."];function QT(G){let H;try{H=new URL(G.trim())}catch{return!1}return H.protocol!=="file:"&&H.host!==""}function eI(G){return G.length>0&&!/\s/.test(G)}function ua(G,H,j,J){let oe=oh(G,H,j,J);return oe!==""&&j.paths.entryKind(oe)!=="missing"}function oh(G,H,j,J){try{return Ii(G,H,j,J)}catch(oe){if(oe instanceof s)throw oe;return""}}var tI=/[?&][^?&=/]+=/,nI=new Set(["node_modules","__pycache__"]),rI=[["vendor","bundle"],["vendor","cache"]];function oI(G,H,j,J,oe){if(QT(G))return null;let ie=Rn(G,H,J,oe);if(!ie)return null;let fe=Kt(ie.split("/").pop()??""),Re=Kt(ie),Te=()=>eI(fe)||ua(G,H,J,oe),ke=Kt(dI(G,H,J,oe));for(let Ye of qa){let Ze=`~/${Ye.suffixParts.join("/")}`;if((Gg(Re,Ze)||Gg(ke,Ze))&&ur(Ye.id,j))return Ye.id}if(XT.has(fe)||JT.some((Ye)=>fe.startsWith(Ye)))return null;let Le=iI(ie,H,j,J,oe);if(Le)return Le;if(YT.has(fe))return null;for(let Ye of Ka)if(fe===Ye.basename&&ur(Ye.id,j))return Ye.id;if(fe.startsWith(ZT)&&ur(Ki.id,j)&&Te())return Ki.id;for(let Ye of Ya)if(fe.length>Ye.prefix.length&&fe.startsWith(Ye.prefix)){let Ze=fe.slice(Ye.prefix.length)[0];if((Ze==="-"||Ze==="_")&&ur(Ye.id,j)&&Te())return Ye.id}for(let Ye of Za)if(fe.length>Ye.prefix.length&&fe.startsWith(Ye.prefix)){if(fe.slice(Ye.prefix.length)===Ye.suffix&&ur(Ye.id,j))return Ye.id}if(lI(Re))return null;if(!fe.includes(".")&&Vo.pattern.test(fe)&&ur(Vo.id,j))return Vo.id;if(tI.test(G)&&!ua(G,H,J,oe))return null;let Xe=cI(fe,j);if(Xe)return Xe;return null}function iI(G,H,j,J,oe){return qi.find((ie)=>{if(!ur(ie.id,j))return!1;switch(ie.id){case"secret.cli.claude-code":return Ut(G,Yt(J.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",H,J,oe),[".credentials.json"]);case"secret.cli.claude-code.config":{let fe=Kt(G).split("/");return Ut(G,Yt(J.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",H,J,oe),["settings.json","settings.local.json"])||Pi(G,"~/.claude.json",H,J,oe)||fe.at(-1)==="settings.local.json"&&fe.at(-2)===".claude"||fe.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Ut(G,Rn("~/.gemini/config",H,J,oe),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let fe=Yt(J.env.get("CODEX_HOME"),"~/.codex",H,J,oe);return Ut(G,fe,["auth.json",".credentials.json"])||Io(G,fe,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let fe=Yt(J.env.get("CODEX_HOME"),"~/.codex",H,J,oe),Re=Kt(G).split("/").at(-1)??"";return Ut(G,fe,["config.toml"])||Re.endsWith(".config.toml")&&Ut(G,fe,[Re])}case"secret.cli.gemini":return Ut(G,on(Yt(J.env.get("GEMINI_CLI_HOME"),"~",H,J,oe),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let fe=Kt(G).split("/"),Re=J.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),Te=J.env.get("ProgramData")?[on(Yt(J.env.get("ProgramData"),"",H,J,oe),"gemini-cli")]:[];return Ut(G,on(Yt(J.env.get("GEMINI_CLI_HOME"),"~",H,J,oe),".gemini"),["settings.json","google_accounts.json"])||fe.at(-1)==="settings.json"&&fe.at(-2)===".gemini"||(Re?.trim()?Pi(G,Re,H,J,oe):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...Te].some((ke)=>Ut(G,Rn(ke,H,J,oe),["settings.json"]))}case"secret.cli.copilot-cli":{let fe=Yt(J.env.get("COPILOT_HOME"),"~/.copilot",H,J,oe);return Ut(G,fe,["config.json"])||Io(G,fe,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Ut(G,Yt(J.env.get("COPILOT_HOME"),"~/.copilot",H,J,oe),["mcp-config.json"]);case"secret.cli.kimi-code":{let fe=Yt(J.env.get("KIMI_CODE_HOME"),"~/.kimi-code",H,J,oe),Re=Yt(J.env.get("KIMI_SHARE_DIR"),"~/.kimi",H,J,oe);return Ut(G,fe,["server.token"])||Io(G,fe,["credentials"])||Io(G,Re,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let fe=["config.toml","mcp.json"],Re=Kt(G).split("/");return Re.at(-1)==="mcp.json"&&Re.at(-2)===".kimi-code"||Ut(G,Yt(J.env.get("KIMI_CODE_HOME"),"~/.kimi-code",H,J,oe),fe)||Ut(G,Yt(J.env.get("KIMI_SHARE_DIR"),"~/.kimi",H,J,oe),[...fe,"config.json","config.json.bak"])}case"secret.cli.opencode":{let fe=on(Yt(J.env.get("XDG_DATA_HOME"),"~/.local/share",H,J,oe),"opencode"),Re=Kt(G).split("/").at(-1)??"",Te=J.env.get("OPENCODE_DB")?.trim(),ke=Te&&Te!==":memory:"?[Te,`${Te}-wal`,`${Te}-shm`]:[];return Ut(G,fe,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Re)&&Ut(G,fe,[Re])||ke.some((Le)=>Pi(G,Le,H,J,oe))}case"secret.cli.opencode.config":{let fe=on(Yt(J.env.get("XDG_CONFIG_HOME"),"~/.config",H,J,oe),"opencode"),Re=J.env.get("ProgramData")?[on(Yt(J.env.get("ProgramData"),"",H,J,oe),"opencode")]:[],Te=["opencode.json","opencode.jsonc"],ke=J.env.get("OPENCODE_CONFIG");return Te.includes(Kt(G).split("/").at(-1)??"")||Ut(G,fe,["config.json"])||(ke?.trim()?Pi(G,ke,H,J,oe):!1)||["/Library/Application Support/opencode","/etc/opencode",...Re].some((Le)=>Ut(G,Rn(Le,H,J,oe),Te))}case"secret.cli.pi":return Ut(G,Yt(J.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",H,J,oe),["auth.json"]);case"secret.cli.pi.config":return Ut(G,Yt(J.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",H,J,oe),["models.json"]);case"secret.cli.amp":{let fe=Rn("~",H,J,oe);return[on(Yt(J.env.get("XDG_DATA_HOME"),"~/.local/share",H,J,oe),"amp"),on(fe,".local","share","amp")].some((Te)=>Ut(G,Te,["secrets.json"]))||Io(G,on(fe,".amp"),["oauth"])}case"secret.cli.amp.config":{let fe=["settings.json","settings.jsonc"],Re=[on(Yt(J.env.get("XDG_CONFIG_HOME"),"~/.config",H,J,oe),"amp"),on(Rn("~",H,J,oe),".config","amp")],Te=Kt(G).split("/"),ke=J.env.get("AMP_SETTINGS_FILE");return Re.some((Le)=>Ut(G,Le,fe))||Te.at(-2)===".amp"&&fe.includes(Te.at(-1)??"")||(ke?.trim()?Pi(G,ke,H,J,oe):!1)}case"secret.cli.cursor":{let fe=on(Yt(J.env.get("XDG_CONFIG_HOME"),"~/.config",H,J,oe),"cursor"),Re=on(Yt(J.env.get("CURSOR_DATA_DIR"),"~/.cursor",H,J,oe),"projects");return Ut(G,Rn("~/.cursor",H,J,oe),["auth.json"])||Ut(G,fe,["auth.json"])||Kt(G).split("/").at(-1)==="mcp-auth.json"&&Jr(Kt(G),Kt(Re))}case"secret.cli.cursor.config":{let fe=Kt(G).split("/");return fe.at(-1)==="mcp.json"&&fe.at(-2)===".cursor"}case"secret.cli.grok-build":return Ut(G,Yt(J.env.get("GROK_HOME"),"~/.grok",H,J,oe),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let fe=Kt(G).split("/");return fe.at(-1)==="config.toml"&&fe.at(-2)===".grok"||Ut(G,Yt(J.env.get("GROK_HOME"),"~/.grok",H,J,oe),["config.toml","managed_config.toml","requirements.toml"])||Ut(G,Rn("/etc/grok",H,J,oe),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Ut(G,Rn("~/.factory",H,J,oe),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let fe=Kt(G).split("/");return fe.at(-1)==="mcp.json"&&fe.at(-2)===".factory"||Ut(G,Rn("~/.factory",H,J,oe),["settings.json","hooks.json"])}case"secret.cli.devin":return[Yt(J.env.get("XDG_DATA_HOME"),"~/.local/share",H,J,oe),Rn("~/.local/share",H,J,oe)].some((fe)=>Ut(G,on(fe,"devin"),["credentials.toml"])||Io(G,on(fe,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[Yt(J.env.get("XDG_CONFIG_HOME"),"~/.config",H,J,oe),Rn("~/.config",H,J,oe)].some((fe)=>Ut(G,on(fe,"devin"),["config.json"]));default:return!1}})?.id??null}var Fg=new WeakMap;function Yt(G,H,j,J,oe){let ie=Fg.get(oe)??new Map;Fg.set(oe,ie);let fe=`${j}\x00${G??""}\x00${H}`,Re=ie.get(fe);if(Re!==void 0)return Re;let Te=Rn(G?.trim()?G:H,j,J,oe);return ie.set(fe,Te),Te}function Ut(G,H,j){return j.some((J)=>ih(G,on(H,J)))}function Io(G,H,j){return j.some((J)=>Jr(Kt(G),Kt(on(H,J))))}function Pi(G,H,j,J,oe){return ih(G,Rn(H,j,J,oe))}function ih(G,H){return Kt(G)===Kt(H)}function on(G,...H){return Vn([G,...H].filter(Boolean).join("/"))}function sI(G,H,j,J,oe,ie){if(j.length===0)return!1;let fe=Kt(Ii(G,H,oe,ie));return j.some((Re)=>Jr(fe,Kt(Ii(Re,J,oe,ie))))}function aI(G,H,j,J,oe,ie){if(j.length===0)return!1;let fe=Kt(Ii(G,H,oe,ie));if(!fe)return!1;let Re=oe.env.get("HOME")??oe.home,Te=Re?Vn(Bt(pn(Re),oe.paths,ie)):"",ke=Kt(Te),Le=oe.env.get("CC_SAFETY_NET_HOME"),Xe=Kt(Le?Vn(Bt(ma(pn(Le)),oe.paths,ie)):Te&&Vn(Bt(`${Te}/.cc-safety-net`,oe.paths,ie)));if(Xe&&Jr(fe,Xe))return!1;return j.some((Ye)=>{let Ze=tl(Ye);if(Ze&&zg.basename(fe)!==Kt(Ze.name))return!1;let Qe=Kt(Ii(Ze?.root??Ye,J,oe,ie));if(!Qe)return!1;if(ke&&(ke===Qe||ke.startsWith(Qe.endsWith("/")?Qe:`${Qe}/`)))return!1;return Jr(fe,Qe)&&!(Ze&&fe===Qe)})}function lI(G){let H=G.split("/");return H.some((j)=>nI.has(j))||rI.some(([j,J])=>H.some((oe,ie)=>oe===j&&H[ie+1]===J))}function cI(G,H){let j=G.lastIndexOf("."),J=j>0&&j<G.length-1?G.slice(j+1):"";if(J==="")return null;for(let oe of Xa)if(J===oe.extension&&ur(oe.id,H))return oe.id;for(let oe of Ja)if(oe.pattern.test(J)&&ur(oe.id,H))return oe.id;return null}function Kt(G){return G.toLowerCase()}function ur(G,H){return!H?.disabledRules?.includes(G)}function Rn(G,H,j,J){let{home:oe,normalized:ie}=Qc(G,j,J);if(!ie)return"";if(!oe)return ie;let fe=ed(ie,oe),Re=la(fe)?fe:Vn(ma(H,fe)),Te=Vn(Bt(Re,j.paths,J));if(!Jr(Te,oe)){if(la(fe))return Te;return Te===Re?ie:Te}let ke=Te.slice(oe.length);return ke?`~${ke}`:"~"}function Gg(G,H){return G===H||G.startsWith(`${H}/`)}function dI(G,H,j,J){let{home:oe,normalized:ie}=Qc(G,j,J);if(!ie||!oe)return"";let fe=ed(ie,oe),Re=zg.normalize(la(fe)?fe:Vn(ma(H,fe))),Te=Vn(pn(j.env.get("HOME")??j.home)),ke=(Ye)=>process.platform==="win32"?Ye.toLowerCase():Ye,Le=[oe,Te].find((Ye)=>Ye!==""&&Jr(ke(Re),ke(Ye)));if(Le===void 0)return"";let Xe=Re.slice(Le.length);return Xe?`~${Xe}`:"~"}function Ii(G,H,j,J){let{home:oe,normalized:ie}=Qc(G,j,J);if(!ie)return"";let fe=oe?ed(ie,oe):ie;return Vn(Bt(la(fe)?fe:ma(H,fe),j.paths,J))}function Qc(G,H,j){let J=H.env.get("HOME")??H.home,oe=J?Vn(Bt(pn(J),H.paths,j)):"",ie=Vn(pn(uI(sr(G,H))));return{home:oe,normalized:ie}}function uI(G){if(!G.trim().toLowerCase().startsWith("file:"))return G;try{return uP(G)}catch{return G}}function ed(G,H){if(G==="~")return H;if(G.startsWith("~/"))return on(H,G.slice(2));return G}function mI(G){if(process.platform==="win32")return!0;return dP.parse(G).root.length>1}function Vn(G){let H=G.trim(),j=(H.includes("\\")&&mI(H)?H.replace(/\\/g,"/"):H).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(j==="/")return j;return j.replace(/\/+$/g,"")}function Jr(G,H){return G===H||G.startsWith(H.endsWith("/")?H:`${H}/`)}function yn(G){return G.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??G}class f extends Error{stage;evaluation;name="GuardEvaluationError";constructor(G,H,j){super(`CC Safety Net ${G} dependency failed`,{cause:j});this.stage=G;this.evaluation=H}}var fI={findPolicyMutation:wg,findGitMetadataMutation:Jm,resolveGitMetadata:yI,loadPolicySnapshot:R,findSensitiveTarget:jg,analyzeCommand:Sg,getModes:P},pI=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,gI=["workdir","cwd","working_directory"];function K(G,H){let j={...fI,...H.dependencies},J=bI(G),oe=()=>_r("config-load",J,()=>j.loadPolicySnapshot(H.environment,{...H.policyOptions,cwd:G.context.configCwd})),ie=G.route.kind==="unknown"&&J?oe():void 0,fe=ie?.policy.commandTools.find((Ot)=>Ot.name===G.toolName),Re=fe&&J?hI(G,J,fe.cwd,H.environment.paths):G;if("decision"in Re)return Re;let Te=Re,ke=Te===G?{}:{promotedInvocation:Te},Le=ki(Te)?Te.command:J,Xe=_r("policy-protection",Le,()=>qm(Te)),Ye=bn(Xe,"input-candidate"),Ze=bn(Xe,"declared-command");if(ki(Te)&&Te.command?.trim()&&Ze?.program.status==="limited")return{stage:"command-analysis",...ke,decision:{kind:"deny",reason:Kn,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:Te.command,segment:Te.command}}};if(Ye?.program.status==="limited")return{stage:"command-validation",...ke,decision:{kind:"deny",reason:Km,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Qe=On(),et=_r("policy-protection",Le,()=>j.resolveGitMetadata([Te.context.executionCwd,Te.context.configCwd],H.environment)),tt=_r("policy-protection",Le,()=>j.findPolicyMutation(Xe,H.environment,Qe));if(tt){let Ot=Le??tt.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:Je,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Ot,segment:tt.target}}}}let gt=_r("policy-protection",Le,()=>Eg(Xe,H.environment,Qe));if(gt){let Ot=Le??gt.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:Ke,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Ot,segment:gt.target}}}}let _t=_r("policy-protection",Le,()=>j.findGitMetadataMutation(Xe,et,H.environment,Qe));if(_t){let Ot=Le??_t.target;return{stage:"policy-protection",...ke,decision:{kind:"deny",reason:v,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Ot,segment:_t.target}}}}let yt=ie??oe(),At=yt.policy,Mt=j.getModes(At,H.environment.env),Dt={level:Mt.effectiveLevel,...CI(yt),...ke},Lt=At.secretProtection.enabled===!1?null:_r("secret-protection",Le,()=>j.findSensitiveTarget(Xe,At.secretProtection,H.environment,Qe,{strict:ki(Te)||Ye?.program.dialect==="powershell"?Mt.strict:void 0}));if(Lt){let Ot=Le??Lt.target;return{stage:"secret-protection",...Dt,decision:{kind:"deny",reason:$g,intent:"hard_stop",ruleId:Lt.ruleId,evidence:{command:Ot,segment:Lt.target}}}}if(!ki(Te))return{stage:"non-command",...Dt,decision:{kind:"allow"}};if(!Te.command||Te.command.trim()==="")return{...fa("command-validation",Le),...Dt};let ht=_r("command-analysis",Le,()=>bg(()=>j.analyzeCommand(Te.command,{cwd:Te.context.executionCwd,shell:Te.route.shell,policySnapshot:yt,environment:H.environment,protectedGitMetadata:et,effectiveCapabilities:Mt.capabilities,worktreeMode:Mt.worktreeMode,budget:Qe,...H.trace?{trace:H.trace}:{}},SI(Xe),Xe.store),Te.command,H.trace));if(ht.decision){let Ot=!Mt.strict&&(ht.decision.ruleId==="raw-text.dangerous-command"||ht.decision.reason===fi&&!pI.test(ht.decision.evidence?.segment??"")&&Nn(Te.command)===null);return{stage:"command-analysis",...Dt,..."errorCode"in ht?{errorCode:ht.errorCode}:{},decision:Ot?{...ht.decision,unverifiedByStandardMode:!0}:ht.decision}}return{stage:"command-analysis",...Dt,decision:{kind:"allow"}}}function hI(G,H,j,J){let oe=[...new Set((j?[j]:gI).flatMap((Te)=>{let ke=Object.getOwnPropertyDescriptor(G.input,Te);return ke?[ke.value]:[]}))],ie=oe.filter((Te)=>typeof Te==="string"&&Te.trim()!=="");if(oe.length>1||ie.length!==oe.length)return fa("command-validation",H);let fe=ie[0],Re=fe===void 0?G.context.configCwd:Od(fe,G.context.configCwd,J);if(!Re){let Te=_({directory:"requested",problem:"unusable",cwd:fe??""});return{stage:"command-validation",decision:{kind:"deny",reason:Te.reason,ruleId:Te.ruleId,intent:Te.intent,evidence:{command:H,segment:H}}}}return l(G.toolName,G.input,{kind:"command",shell:"auto"},{configCwd:G.context.configCwd,executionCwd:Re},H)}function yI(G,H){let j=[...new Set(G.filter((J)=>typeof J==="string"&&J!==""))].flatMap((J)=>H.gitMetadata(J)??[]);if(j.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(j.flatMap((J)=>J.entries))]),markerFiles:Object.freeze([...new Set(j.flatMap((J)=>J.markerFiles))]),directories:Object.freeze([...new Set(j.flatMap((J)=>J.directories))]),hooksDirectories:Object.freeze([...new Set(j.flatMap((J)=>J.hooksDirectories))])})}function CI(G){if(G.state==="ready")return{};return{configFallback:{reason:G.reason}}}function SI(G){return bn(G,"declared-command")?.program}function bI(G){try{return se(G.input)}catch(H){let j=ki(G)?G.command:void 0;throw new f("policy-protection",fa("policy-protection",H instanceof m?void 0:j,H),H)}}function _r(G,H,j){try{return j()}catch(J){throw new f(G,fa(G,J instanceof m?void 0:H,J),J)}}function fa(G,H,j){let J=j instanceof U?{reason:Yn,ruleId:"analysis.strict-unparseable"}:j instanceof s||j instanceof b?{reason:ha,ruleId:"analysis.limit"}:{reason:No,ruleId:"analysis.failed-closed"};return{stage:G,decision:{kind:"deny",...J,intent:"stop_and_explain",...H?{evidence:{command:H,segment:H}}:{}}}}function ki(G){return G.route.kind==="command"}
-export{a,s,Y,Me,nt,T,bt,rt,_e,L,_,Z,xt,c,n,ot,Pe,P,S,me,vt,m,Ie,x,se,ge,St,it,st,l,Fe,o,w,i,ae,r,g,he,W,wt,Ct,p,ye,be,Et,M,X,ce,C,kt,I,h,Ae,B,u,O,Q,at,ct,F,E,D,xe,ve,$e,le,d,e,Ue,Oe,je,Se,lt,ut,ue,De,de,Ge,ee,z,He,we,V,dt,q,te,ne,pe,pt,ft,k,A,We,Be,mt,ze,R,Ve,Ne,qe,y,t,re,Ce,b,U,v,N,Rt,Ee,Ke,Je,f,K};