cc-safety-net 2.6.13 → 2.6.14

package/dist/openclaw/cc-safety-net/index.js

@@ -1,52 +1,52 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.6.13
-var Kl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",qe="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Yn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var $i={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},qn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},q=Object.freeze({realpathAttempts:{cap:16384,...$i},processedCandidateBytes:{cap:4194304,...$i},pathEnvironmentExpansion:{cap:64,...$i},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...qn},trackedHeredocFiles:{cap:64,...qn},controlFlowStates:{cap:64,...qn},wrapperPeelIterations:{cap:20,...qn},derivedCommandShape:qn});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(q[e].reason);this.kind=e}}function Te(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>q[t].cap)throw new F(t)}}}var Gg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function gt(e){return Fg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Fg(e){return Gg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var zg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $g(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":zg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.6.14
+var Xl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ki="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Xe="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Xn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Zn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...Vi},processedCandidateBytes:{cap:4194304,...Vi},pathEnvironmentExpansion:{cap:64,...Vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Zn},trackedHeredocFiles:{cap:64,...Zn},controlFlowStates:{cap:64,...Zn},wrapperPeelIterations:{cap:20,...Zn},derivedCommandShape:Zn});class G extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Te(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new G(t)}}}var Ug=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function yt(e){return Hg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Hg(e){return Ug.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var jg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Vg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":jg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ql(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Zn(e={}){return{reason:Yn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Bg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Xn(e,t={}){return{...Bg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Yl(e){return $g({...e,redact:gt})}function Zl(e){return gt(e instanceof Error?e.message:String(e))}import{isAbsolute as Xi,relative as hh,resolve as yc,sep as yh}from"node:path";import{basename as Ql,dirname as Ug,isAbsolute as Hg,join as jg,normalize as Vg,resolve as Xl}from"node:path";var Kg=256,qr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ue(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function nt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Vi(e,t){return Ui(e,0,t)}function Ui(e,t,n){let r="",o=0,i=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let a=Hi(e,o+2),l=qg(e,o,t);if(l===null){if(qr.has(a))throw new F("pathEnvironmentExpansion");if(i++,i>q.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");r+="${",o+=2;continue}let c=e.slice(o,l+1);r+=Yg(c,t,n),o=l+1;continue}let s=Hi(e,o+1);if(!s){r+="$",o++;continue}r+=ji(s,n)??`$${s}`,o+=s.length+1}return r}function qg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>q.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Yg(e,t,n){let r=e.slice(2,-1),o=Hi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return ji(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(qr.has(o))throw new F("pathEnvironmentExpansion");return e}if(!qr.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=ji(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ui(i.slice(s.length),t+1,n);return l?Ui(i.slice(s.length),t+1,n):""}function Hi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function ji(e,t){if(!qr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function W(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ec(n,i);let s=t.realpath(i);if(s!==null)return Jl(n,e,s,o);let a=Ug(i);if(a===i||o.length>=Kg)return Jl(n,e,i,o);o.push(Ql(i)),i=a}}function Jl(e,t,n,r){let o=r.length===0?n:jg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Zg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ec(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ec(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function me(e,t,n,r){let o=nc(e,t,n);if(!o)return"";return W(o,n.paths,r).replace(/\\/g,"/")}function tc(e,t,n,r,o){let i=nc(e,t,n);if(!i)return null;if(o(Ql(i)))return W(i,n.paths,r).replace(/\\/g,"/");let s=Zg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function nc(e,t,n){let r=n.home,o=Vi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Xl(r,o.slice(2)):o,s=ue(i);return Vg(Hg(s)?s:Xl(t,s))}import{types as Xg}from"node:util";var Jg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Qg=new Set(["command","diff","input","patch","patchtext"]),rc=new TextEncoder,eh=new TextDecoder,th=/\s/,nh=64;class rt extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Jn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function rh(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Zr(e){return Jg.has(rh(e))}function er(e){if(!e||typeof e!=="object")return;pc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ye();return}if(t.get||t.set)Ye();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function lc(e,t){return cc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function cc(e,t,n,r,o){let i=fc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>cc(l,t,i.array?n:t.has(dc(a)),r,o+1));return r.ancestors.delete(i.object),s}function dc(e){return e.replace(/-/g,"_").toLowerCase()}function uc(e){return mc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(ih)}function mc(e,t,n,r){let o=fc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>mc(a,o.array?t:Qg.has(dc(s)),n,r+1));return n.ancestors.delete(o.object),i}function oh(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Jn.maxDepth||t.nodes>Jn.maxNodes)Ye();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Jn.maxStringBytes||t.stringBytes>Jn.maxAggregateStringBytes)Ye()}function fc(e,t,n){if(oh(e,t,n),!e||typeof e!=="object")return null;let r=pc(e);if(t.ancestors.has(e))Ye();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Jn.maxKeys)Ye();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ye();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function pc(e){if(Xg.isProxy(e))Ye();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ye();return t}function Ye(){throw new rt}function ih(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=sh(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ki(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ki(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Yi(Yr(c.slice(4),!0),Yr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ki(c))}return t}function sh(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ki(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return ac(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return ac(n[1]);if(e.startsWith("diff --git "))return ah(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return sc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return sc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ph(i[1]);return[]}function ah(e){let t=lh(e);if(t.length===2&&t[0]&&t[1])return Yi(t[0],t[1]);let n=ch(e);return n?Yi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function lh(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Lt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Lt(e[n]))n++;t.push(e.slice(i,n));continue}let o=gc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Lt(e[n]))n++;return n===e.length?t:[]}function ch(e){let t=0;while(t<e.length&&Lt(e[t]))t++;let n=e.length;while(n>t&&Lt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Lt(e[o])){o++;continue}let i=o;while(o<n&&Lt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>nh)Ye();if(dh(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function dh(e,t,n,r,o){if(qi(e,t,n,r,o))return!0;let i=oc(e,"/",t,n),s=oc(e,"/",r,o);if(i<=t||s<=r)return!1;if(qi(e,t,i,r,s))return!1;return qi(e,i+1,n,s+1,o)}function qi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function oc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Lt(e){return e!==void 0&&th.test(e)}function gc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:eh.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...rc.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...rc.encode(uh(s[0]??""))),o+=2}return null}function uh(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function mh(e){return Qn(gh(e))}function Yi(e,t){if(e==="/dev/null")return ic(t);if(t==="/dev/null")return ic(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Qn);let n=fh(e,t)??(e===t?hc(e):null);return[e,t,...n?[n]:[]].flatMap(Qn)}function ic(e){let t=hc(e);return[e,...t?[t]:[]].flatMap(Qn)}function hc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function fh(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function sc(e){return mh(Yr(e,!0))}function ph(e){return Qn(Yr(e,!1))}function Yr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=gc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function gh(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Qn(e){return e===""||e==="/dev/null"?[]:[e]}function ac(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Ji(e,t,n){if(nt(e))return;let r=t.flatMap((i)=>Zi(i,n));if(!r[0])return;let o=Zi(Xi(e)?e:yc(r[0],e),n)[0];if(!o)return;return r.some((i)=>Ch(o,i))?o:void 0}function Qi(e,t,n){if(nt(e))return;return Zi(Xi(e)?e:yc(t,e),n)[0]}function Cc(e,t,n){return Qi(e,t,n)?"outside-workspace":"unusable"}function Zi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Ch(e,t){let n=hh(t,e);return n===""||n!==".."&&!n.startsWith(`..${yh}`)&&!Xi(n)}function Xr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as jh,realpathSync as Vh,statSync as Kh}from"node:fs";import{homedir as qh,tmpdir as Yh}from"node:os";import{statSync as Bh}from"node:fs";import{join as Uh}from"node:path";import{spawnSync as Sh}from"node:child_process";import{accessSync as Sc,constants as bc,existsSync as tr,lstatSync as bh,opendirSync as Eh,readFileSync as nr,realpathSync as pn,statSync as gn}from"node:fs";import{dirname as Rc,isAbsolute as es,join as Ie,resolve as Jr}from"node:path";var vh=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Rh=5000;function _c(e,t=Gh(),n=Rh){let r=_h(e),o=r===null?null:wh(r);if(r===null||o===null)return null;let i=Lh(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function _h(e){try{let t=pn(Jr(e));return gn(t).isDirectory()?t:null}catch{return null}}function wh(e){let t=Nh(e);if(!t)return null;try{let n=bh(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ts(t);if(!r?.commonDir)return null;if(!Ph(r.gitDir,t))return null;return Ac(r.gitDir,r.commonDir)?null:{gitDir:r.gitDir,commonDir:r.commonDir}}catch{return null}}function ts(e){try{let t=xh(e);if(!t)return null;let n=pn(es(t)?t:Jr(Rc(e),t));if(!gn(n).isDirectory())return null;return{gitDir:n,commonDir:Ah(n)}}catch{return null}}function xh(e){let t=nr(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ah(e){try{let t=nr(Ie(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=pn(es(t)?t:Jr(e,t));return gn(n).isDirectory()?n:null}catch{return null}}function Ph(e,t){let n=Th(e);return n===null?!1:Ih(e,n,t)}function Th(e){let t=Ie(e,"gitdir");if(!tr(t))return null;let n=nr(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Ih(e,t,n){try{return kh(es(t)?t:Jr(e,t),n)}catch{return!1}}function kh(e,t){try{let n=gn(e),r=gn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ec(pn.native(e))===Ec(pn.native(t))}function Ec(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function wc(e){try{return Sc(Ie(e,"objects"),bc.X_OK),Sc(Ie(e,"refs"),bc.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Pc(Ie(e,"HEAD")))}catch{return!1}}function xc(e){return tr(Ie(e,"commondir"))||Ac(e,e)}function Ac(e,t){return[Ie(t,"config"),Ie(e,"config.worktree")].some(Oh)||Mh(e)}var vc=1048576;function Pc(e){let t=gn(e);if(!t.isFile()||t.size>vc)throw Error(`${e} is not a regular file within ${vc} bytes`);return nr(e,"utf-8")}function Oh(e){try{return/(?:^|[\s\]])worktree\s*=/i.test(Pc(e))}catch(t){return t.code!=="ENOENT"}}var Dh=1e4;function Mh(e){let t=[e],n=0;try{while(t.length>0){let r=t.pop(),o=Eh(r);try{for(let i=o.readSync();i!==null;i=o.readSync()){if(n++,i.isSymbolicLink()||i.isFIFO()||n>Dh)return!0;let s=r===e&&i.name==="objects";if(i.isDirectory()&&!s)t.push(Ie(r,i.name))}}finally{o.closeSync()}}return!1}catch(r){return r.code!=="ENOENT"}}function Nh(e){try{return ns(pn(e))}catch{return null}}function ns(e){let t=e;while(!0){let n=Ie(t,".git");if(tr(n))return n;let r=Rc(t);if(r===t)return null;t=r}}function Lh(e,t,n,r){if(Wh(t))return!0;if(n===null)return!0;let o=Sh(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Fh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Tc(o.stdout.trim())}function Wh(e){return[Ie(e.commonDir,"config"),Ie(e.gitDir,"config.worktree")].filter((t)=>tr(t)).some((t)=>zh(t))}function Gh(){return vh.find((e)=>tr(e))??null}function rr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Fh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!rr(t)))}function zh(e){let t;try{t=nr(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if($h(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Tc(c)}return r}function $h(e){return e==="include"||e.startsWith("includeif ")}function Tc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Ic(e,t){if(e==="")return null;let n=Te(),r=ns(me(e,e,t,n)),o=r?Hh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Hh(e,t,n,r){try{let o=me(e,t,n,r),i=Bh(e),s=i.isFile()?o:null,a=i.isFile()?ts(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[hn(me(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[hn(e.replace(/\\/g,"/")),...l]:l)];return{entry:hn(o),markerFile:s?hn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let f=hn(Uh(d,"hooks").replace(/\\/g,"/"));return[f,hn(me(f,t,n,r))]}))]}}catch{return null}}function hn(e){return process.platform==="win32"?e.toLowerCase():e}var Zh={realpath:(e)=>{try{return Vh(e)}catch{return null}},entryKind:(e)=>{try{let t=jh(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}catch(t){if(t.code==="ENAMETOOLONG")return"missing";throw t}},isDirectory:(e)=>{try{return Kh(e).isDirectory()}catch{return!1}}};function kc(){return Xh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ue(process.env.HOME||qh()),tmpdir:Yh(),paths:Zh})}function Xh(e,t={}){let n=new Map,r=new Map,o=new Map,i={...e,gitMetadata:(s)=>rs(n,s,()=>Ic(s,i)),worktreeFacts:(s)=>rs(r,s,()=>_c(s)),isGitDirectory:wc,gitDirectoryRedirects:(s)=>rs(o,s,()=>xc(s)),...t};return i}function rs(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var yn=["fail_closed","paranoid_rm","paranoid_interpreters"],Qr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},eo=["standard","strict","paranoid"];function Oc(e,t){if(!t)return e;return eo.indexOf(t)>eo.indexOf(e)?t:e}function Dc(e){let t=to(Q.level,e);return eo.find((n)=>n===t)}function Mc(e,t){return Oc(e,Dc(t))}function Jh(e){let t=to(Q.level,e);if(!t)return;let n=Dc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${eo.join(", ")}.`);return}function Qh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Nc(e){return Qh(to(Q.auditScope,e))==="all"}function is(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ss(e={},t){let n=e.safety?.level??"standard",r=Jh(t),o=Oc(n,r),i=Qr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(ot(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(ot(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(ot(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(ot(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||ot(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:is(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function ot(e,t){let n=typeof e==="string"?os(e,t):to(e,t);return n==="1"||n?.toLowerCase()==="true"}function os(e,t){return t.get(e)}function to(e,t){let n=os(e.name,t);if(n!==void 0)return n;if(e.legacyName)return os(e.legacyName,t);return}import{dirname as uo}from"node:path";import{closeSync as ey,constants as Lc,fstatSync as ty,fsyncSync as Ek,lstatSync as cs,mkdirSync as vk,openSync as ny,readdirSync as Rk,readFileSync as ry,realpathSync as ds,renameSync as _k,rmdirSync as wk,statSync as oy,unlinkSync as xk,writeFileSync as Ak}from"node:fs";import{isAbsolute as Wc,join as us,normalize as iy,parse as ls,relative as ms,resolve as fs,sep as ps}from"node:path";function as(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var sy=Symbol("PolicyFilesystemScope"),ay=Symbol("PolicyFilesystemTarget"),ly=Lc.O_NOFOLLOW??0;class fe extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Wt(e,t){return{[sy]:!0,root:fs(e),label:t}}function Gc(e,t){let n=iy(t);if(t===""||Wc(t)||n===".."||n.startsWith(`..${ps}`))throw new fe(e.label);return{[ay]:!0,scope:e,relativePath:n,path:us(e.root,n)}}function or(e,t){return Gc(e,ms(e.root,fs(t)))}function Fc(e,t="rules policy"){let n=fs(e),r=ls(n).dir;return Gc(Wt(r,t),ms(r,n))}function ro(e){return $c(e.scope.label,()=>{if(!no(e))return null;let t=ny(e.path,Lc.O_RDONLY|ly);return cy(t,()=>{let n=ty(t);if(!n.isFile())throw new fe(e.scope.label);let r=ry(t,"utf-8"),o=cs(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new fe(e.scope.label);return no(e),r})})}function zc(e,t){if(e.path===t.path)return!0;return $c(e.scope.label,()=>{if(!no(e)||!no(t))return!1;let n=(r)=>us(ds(ls(r).dir),ls(r).base);return n(e.path)===n(t.path)})}function $c(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof fe)throw r;throw new fe(e)}}function cy(e,t){try{return t()}finally{ey(e)}}function no(e,t="file"){let n=dy(e.scope);if(!n)return!1;let r=e.relativePath.split(ps);for(let o of r.keys()){let i=us(e.scope.root,...r.slice(0,o+1)),s=cs(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new fe(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new fe(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new fe(e.scope.label);uy(n,ds(i),e.scope.label)}return!0}function dy(e){if(!cs(e.root,{throwIfNoEntry:!1}))return null;if(!oy(e.root).isDirectory())throw new fe(e.label);return ds(e.root)}function uy(e,t,n){let r=ms(e,t);if(r===".."||r.startsWith(`..${ps}`)||Wc(r))throw new fe(n)}import{dirname as Ft,isAbsolute as hy,join as zt,relative as yy,resolve as ht,sep as Cy}from"node:path";var Gt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Bc="rulebook.json",Uc=".cc-safety-net/rules";var Hc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var my=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,fy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),py="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),kk=new RegExp(`^${fy}/(${Gt.source.slice(1,-1)})/${py}$`);function gy(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function jc(e){if(oo(e))try{return gs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Gt.test(e)?null:`Local rulebook sources must be bare names matching ${Gt}: ${e}`}function gs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Hc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!my.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Gt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:gy(o),name:o}}function oo(e){return Hc.test(e)}var Vc="rule.json",io="policy.json",Kc=".cc-safety-net",Sy="rules",by="CC_SAFETY_NET_HOME",qc="`cc-safety-net rule update`";function Ey(e){return ht(e,Uc)}function vy(e){return zt(Ey(e),Vc)}function Cn(e){return zt(ht(e),Kc,io)}function hs(e,t={}){return t.userConfigDir??(t.userConfigPath?Ft(t.userConfigPath):zt(Ry(e),Sy))}function Ry(e){let t=e.env.get(by);return t?ht(ue(t)):zt(e.home,Kc)}function _y(e,t={}){return zt(hs(e,t),Vc)}function $t(e,t={}){return zt(Ft(hs(e,t)),io)}function Yc(e,t){let n=Te();return W(Cn(t.cwd),e.paths,n)===W(ht($t(e,t)),e.paths,n)}function Zc(e,t){let n=t.userConfigPath??_y(e,t),r=t.projectConfigPath??vy(t.cwd),o=wy(e,t),i=xy(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:or(o,n),projectConfigTarget:or(i,r)}}function wy(e,t){let n=t.userConfigPath?Ft(Ft(ht(t.userConfigPath))):Ft(ht(t.userConfigDir??hs(e,t)));return Wt(n,"user policy")}function xy(e,t){let n=ht(t),r=ht(e),o=yy(n,r);if(o!==".."&&!o.startsWith(`..${Cy}`)&&!hy(o))return Wt(n,"project policy");return Wt(Ft(Ft(r)),"project policy")}function Xc(e,t){return zt(e,t,Bc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),yt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Jc=new Set(["python","python3","python2","node","ruby","perl"]),so=/^python(?:[23](?:\.\d+)*)?$/,ke=new Set(["awk","gawk","nawk","mawk"]),ao=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Qc="Rulebook exceeds CC Safety Net's safe validation limits.",ed="Additional rulebook validation errors were omitted.",Ge=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function td(e){if(ys(e.allowed_commands,Ge.maxAllowedCommands)||ys(e.rules,Ge.maxRules)||ys(e.tests,Ge.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ge,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ge.maxStringCodeUnits||i&&o.length>Ge.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ge.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ys(e,t){return Array.isArray(e)&&e.length>t}var Cs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ss=64,bs="Rule config exceeds CC Safety Net's safe source limit.";function N(e){return M(e).toLowerCase()}function M(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function ye(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Ay={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Es=new Set(["--init-file","--rcfile"]);function vs(e,t,n,r){let o=!1,i=0,s=!1,a=!1;for(let l=1;l<t.length;l++){let c=t[l];if(c===void 0)break;if(e==="ksh"&&c==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&c==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&c==="o"&&l+1<t.length)break;if(r==="startup"&&c==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&c==="c")s=!0;if(r==="argv"&&c==="s")a=t[0]==="-";if(!Ay[e]?.includes(c))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a}}function Oe(e){let t=M(e[0]??"").toLowerCase(),n=!1,r=!1;for(let o=1;o<e.length;o++){let i=e[o];if(i===void 0)break;if(i==="--"){let a=n&&e[o+1]!==void 0?o+1:null;return{command:a===null?null:e[a]??null,commandIndex:a,scriptIndex:!n&&!r&&e[o+1]!==void 0?o+1:null,readsStdinAsCommands:!n&&(r||e[o+1]===void 0)}}if(i==="-"||i[0]!=="-"&&i[0]!=="+")return{command:n?i:null,commandIndex:n?o:null,scriptIndex:!n&&!r&&i!=="-"?o:null,readsStdinAsCommands:!n&&(r||i==="-")};if(i.startsWith("--")){let a=i.split("=",1)[0]??i;if(t==="bash"&&Es.has(a)&&!i.includes("="))o++;continue}let s=vs(t,i,e[o+1],"argv");if(s.commandSelected)n=!0;if(s.stdinMode)r=!0;o+=s.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n}}function ir(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function lo(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Py(e))ir(n,t);return t.inSingle||t.inDouble}function Py(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);ir(s,n)}return t}var Rs=new Set(["rm","find","xargs","parallel"]),Ty=new Set(["git","busybox",...Rs,...J,...Jc,...ke]),Iy=new Set(["python","node","ruby","perl"]);function nd(e){let t=N(e);return Ty.has(t)||Fe(t)}function Fe(e){return Iy.has(ky(e))}function ky(e){let t=M(e).toLowerCase();return so.test(t)?"python":t}function xs(e){try{let t=ro(Oy(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ly(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[],...n.command_tools?{command_tools:n.command_tools}:{}},errors:[]}}catch(t){if(t instanceof fe)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Oy(e){return typeof e==="string"?Fc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ie=(e,t)=>({path:e,message:t,kind:"custom"});function rd(e){let t=new Set;return e.flatMap((n,r)=>{let o=Bt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ie(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var As=`must be one of ${Cs.join(", ")}`,Dy=/^[^/]+\/[^/]+$/,My=["version","rules","overrides","transparent_wrappers","command_tools"],Ny=/^[^\s\p{Cc}]{1,256}$/u,_s="non-empty, at most 256 characters, no whitespace or control characters";function Ly(e){let t=Wy(e);return{errors:Ps(Ky(t,My,(n)=>n.kind==="custom"),": "," "),sources:Vy(e,t)}}function Wy(e){if(!Bt(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ss;return[...e.version===1?[]:[_(["version"],"must be 1")],...Gy(e.rules,t),...$y(e.overrides),...Uy(e.transparent_wrappers),...t?[]:zy(e.rules),...Bt(e.overrides)?Object.keys(e.overrides).filter((n)=>!Dy.test(n)).map((n)=>ie(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Hy(e.transparent_wrappers),...jy(e.command_tools)]}function Gy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...od(e,Ss)?[_(["rules"],bs)]:[]];if(t)return[{path:["rules"],message:bs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Fy(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function od(e,t){let n=id(e);return n!==void 0&&!(n<=t)}function Fy(e,t){let n=id(e);return n!==void 0&&!(n>=t)}function id(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function zy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ie(["rules",r],"must be a non-empty rulebook source string")];let o=jc(n);if(o)return[ie(["rules",r],o)];if(t.has(n))return[ie(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function $y(e){if(e===void 0)return[];if(!Bt(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Bt(n))return[_(["overrides",t],'must be "off" or an object')];return[...By(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Is(n.intent)?[]:[_(["overrides",t,"intent"],As)]]})}function By(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...od(e,Ct)?[_(t,`must be at most ${Ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>Ct?[_(t,`must be at most ${Ct} characters`)]:[]}function Uy(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return yt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Hy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!yt.test(n))return[];if(t.has(n))return[ie(["transparent_wrappers",r],`duplicate command "${n}"`)];if(nd(n))return[ie(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function jy(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let t=new Set,n=(r,o)=>{if(t.has(r))return[ie(["command_tools",o],`duplicate tool "${r}"`)];return t.add(r),[]};return e.flatMap((r,o)=>{if(typeof r==="string")return ws(r)?n(r,o):[_(["command_tools",o],`must be a tool name: ${_s}`)];if(!Bt(r))return[_(["command_tools",o],"must be a tool name or a {name, cwd} object")];let i=[...ws(r.name)?[]:[_(["command_tools",o,"name"],`must be a tool name: ${_s}`)],...r.cwd===void 0||ws(r.cwd)?[]:[_(["command_tools",o,"cwd"],`must be an argument name: ${_s}`)]];return i.length>0?i:n(r.name,o)})}function ws(e){return typeof e==="string"&&Ny.test(e)}function Vy(e,t){let n=Bt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Ky(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Ps(e,t,n){return[...new Set(e.map((r)=>{let o=Ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Is(e){return Cs.includes(e)}function Bt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ad(e){let t=Zy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var qy=`required non-empty string up to ${Ct} characters`,sd="must be a non-empty array of unique non-empty strings",Yy="required non-empty array of non-empty strings";function Zy(e){if(!St(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!td(e))return{errors:[Qc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Ps(Xy(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ge.maxValidationErrors?[...t.slice(0,Ge.maxValidationErrors),ed]:t,ruleNames:new Set(ld(e).map((n)=>n.toLowerCase()))}}function ld(e){let t=St(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=St(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Xy(e,t){return[...typeof e.name==="string"&&Gt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Jy(e.allowed_commands),...Qy(e.rules,t),...rC(e.tests),...oC(e),...iC(e)]}function Jy(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&yt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!yt.test(n))return[];if(t.has(n))return[ie(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Qy(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!St(n))return[_(["rules",r],"must be an object")];return t?tC(n,["rules",r]):eC(n,["rules",r])}),...rd(e)]}function eC(e,t){return[...cd(e.name,t),...dd(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&yt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...co(e.block_args,[...t,"block_args"],"required non-empty array",!1),...ud(e.reason,t),...md(e.intent,t)]}function tC(e,t){return[...cd(e.name,t),...dd(e.command,t),...ud(e.reason,t),...md(e.intent,t),...nC(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function cd(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return Gt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function dd(e,t){return typeof e==="string"&&yt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function ud(e,t){return typeof e==="string"&&e!==""&&e.length<=Ct?[]:[_([...t,"reason"],qy)]}function md(e,t){return e===void 0||Is(e)?[]:[_([...t,"intent"],As)]}function nC(e,t){if(!St(e))return[_(t,"required object")];return[...co(e.command_path,[...t,"command_path"],Yy,!1),...e.any_args===void 0?[]:co(e.any_args,[...t,"any_args"],sd,!0),...e.exclude_args===void 0?[]:co(e.exclude_args,[...t,"exclude_args"],sd,!0)]}function co(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ie([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ie(t,n)]:[],...r&&new Set(e).size!==e.length?[ie(t,"must not contain duplicate values")]:[]]}function rC(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!St(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ie(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function oC(e){if(!Array.isArray(e.tests))return[];let t=new Set(ld(e));return[...new Set(e.tests.flatMap((n)=>St(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ie(["tests"],`blocked fixture references unknown rule "${n}"`))}function iC(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=St(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ie(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function St(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sd(e,t){let n=Zc(e,t),r;try{r=zc(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof fe)return gC(n,m.message);throw m}let o=xs(n.userConfigTarget),i=r?{config:null,errors:[]}:xs(n.projectConfigTarget),s=yd(n.userConfigPath,o.errors),a=yd(n.projectConfigPath,i.errors),l=new Set,c=o.config?fd(o.config,uo(n.userConfigPath),"user",n.userScope,l):Cd(),d=i.config?fd(i.config,uo(n.projectConfigPath),"project",n.projectScope,l):Cd(),f=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...gd(c.rules,f),...gd(d.rules,u)],transparent_wrappers:mC(o.config,i.config),command_tools:fC(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?hd(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?pC(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?hd(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function fd(e,t,n,r=Wt(uo(uo(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=aC(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let f=d.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:sC(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((u)=>`${f.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function sC(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function aC(e,t,n){let r=lC(e),o=Xc(t,r),i=dC(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${cC(e)}`]};let s=uC(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function lC(e){return oo(e)?gs(e).name:e}function cC(e){return oo(e)?`run ${qc} to vendor ${e}`:"create that file or remove that source from the rules config"}function dC(e,t){try{return{content:ro(or(t,e))}}catch(n){if(n instanceof fe)return{error:n.message};throw n}}function uC(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ad(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function mC(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function fC(e,t){let n=(e?.command_tools??[]).map(pd),r=(t?.command_tools??[]).map(pd);return[...n,...r.filter((o)=>!n.some((i)=>i.name===o.name))]}function pd(e){if(typeof e==="string")return{name:e};return e.cwd===void 0?{name:e.name}:{name:e.name,cwd:e.cwd}}function gd(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function hd(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function pC(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function yd(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function gC(e,t){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Cd(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as AC,readFileSync as PC}from"node:fs";var bd=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ks=new Set(bd.map((e)=>e.id)),mo=bd,hC=new Map(mo.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:hC.get(e)??"manual_only"}}var Os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],fo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},yC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],CC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ds=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...CC.flatMap((e)=>yC.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var po=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Ed=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],SC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ms=Ed.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ns=Ed.flatMap((e)=>SC.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),sr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ws=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],bC=[...Os,fo,...Ds,...Ms,...Ns,sr,...Ls,...Ws,...po].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),go=new Set(po.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Gs=new Set(bC.map((e)=>e.id));import{isAbsolute as Fs,join as EC,normalize as vC,sep as ho}from"node:path";var yo=process.platform==="win32",vd=/[*?]/;function zs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(yo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(vd.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function ar(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function $s(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=ar(e.trim(),t);if(!Fs(n))return"must be an absolute path or start with ~/";return lr(n,t)}function Bs(e,t){let n=Rd(e,t);if(n===null)return"must be a non-empty path string";if(!Fs(n))return null;if(lr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var RC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",_C="cannot cover the guard's own configuration";function Rd(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=yo?n.replaceAll("\\","/"):n;return ar(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Us(e,t){let n=Rd(e,t);if(n===null)return"must be a non-empty path string";let r=zs(n)?.root??n;if(vd.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Fs(r))return null;if(lr(r,t)!==null)return RC;return wC(r,t)?_C:null}function wC(e,t){let n=Co(e),r=Co(EC(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${ho}`)}function lr(e,t){let n=Co(e),r=Co(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(ho)?n:`${n}${ho}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Co(e){let t=vC(e);if(yo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(yo?3:1)&&t.endsWith(ho))t=t.slice(0,-1);return t}var _d=30,So=1,bo=365;function wd(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var xd=new Set(mo.filter((e)=>e.catastrophic).map((e)=>e.id));function I(e,t){if(!e)return null;if(xd.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(xd.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ad(e,t){return Object.freeze(Object.fromEntries(mo.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Pd(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ad(e,t)})}var Td={standard:0,strict:1,paranoid:2};function Od(e,t,n=!1,r=e.safety.level){let o=xC(e,t,r),i=new Set(n?o.map((d)=>d.field):[]),s=(d,f)=>i.has(d)?void 0:f,a=(d,f)=>Object.fromEntries(Object.entries(f??{}).filter(([u])=>!i.has(`${d}.${u}`))),l=(d,f)=>f?.filter((u)=>!i.has(`${d}.${u}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:Hs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:Hs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Hs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((d)=>d.message)}}function Hs(e,t){return[...new Set([...e,...t??[]])]}function xC(e,t,n){let r=t.safety?.level,o=Qr[n];return[...r&&Td[r]<Td[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...yn.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Id("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...Id("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!go.has(i))),...e.destructive_command_protection.enabled?kd(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?kd(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function Id(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function kd(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Vs=new Set(["standard","strict","paranoid"]),Nd={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:_d}};function Ld(e,t){let n=GC($t(e,t),e.home),r=Yc(e,t)?{exists:!1,policy:Ht(),errors:[]}:vo(Cn(t.cwd),e.home),o=IC(r.parsed,e.home),i=ot(Q.projectTightenOnly,e.env),s=n.gui??Nd,a=Object.keys(o.policy).length>0?Od(s,o.policy,i,Mc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),d=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?cr(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:d,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var TC="project policy audit settings are ignored; audit is user scope only";function IC(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={...Vs.has(n.level)?{level:n.level}:{},...Re(n.overrides)?Dd({overrides:Wd(n.overrides,yn,["safety","overrides"],Ut)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Eo(o.overrides,ks,Fd,Ut)}:{},...o.allow_paths!==void 0?{allow_paths:bn(o.allow_paths,$s,t,["destructive_command_protection","allow_paths"],Ut)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Eo(i.overrides,Gs,zd,Ut)}:{},...i.deny_paths!==void 0?{deny_paths:bn(i.deny_paths,Bs,t,["secret_protection","deny_paths"],Ut)}:{},...i.allow_paths!==void 0?{allow_paths:bn(i.allow_paths,Us,t,["secret_protection","allow_paths"],Ut)}:{}};return{policy:Dd({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[TC]}}function Wd(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],Ks));return[]}))}function Dd(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Ut=()=>{return},Ks="must be a boolean",qs="must be an object if provided",Gd=`must be an integer between ${So} and ${bo}`,Fd={path:["destructive_command_protection","overrides"],label:"destructive command"},zd={path:["secret_protection","overrides"],label:"secret protection"},kC=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function OC(e,t){let n=[];return{policy:$d(e,t,(o)=>{n.push(o)}),issues:n}}function DC(e,t){return $d(e,t,Ut)}function $d(e,t,n){if(!Re(e))return n(_([],"Config must be an object")),Ht();if(e.version!==1)n(_(["version"],"must be 1"));let r=Sn(e.safety,["safety"],["level","overrides"],n),o=Sn(r.overrides,["safety","overrides"],yn,n),i=Sn(e.workflow,["workflow"],["worktree_mode"],n),s=Sn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=Sn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=Sn(e.audit,["audit"],["retention_days"],n);return Bd(e,kC,[],n),{version:1,safety:{level:MC(r.level,n),overrides:Wd(o,yn,["safety","overrides"],n)},workflow:{worktree_mode:js(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:js(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Eo(s.overrides,ks,Fd,n),allow_paths:bn(s.allow_paths,$s,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:js(a.enabled,["secret_protection","enabled"],!0,n),overrides:Eo(a.overrides,Gs,zd,n),deny_paths:bn(a.deny_paths,Bs,t,["secret_protection","deny_paths"],n),allow_paths:bn(a.allow_paths,Us,t,["secret_protection","allow_paths"],n)},audit:{retention_days:NC(l.retention_days,n)}}}function Sn(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(_(t,qs)),{};return Bd(e,n,t,r),e}function Bd(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function MC(e,t){if(e===void 0)return"standard";if(Vs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function js(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,Ks));return n}function NC(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=So&&e<=bo))t(_(["audit","retention_days"],Gd));return wd(e)}function Eo(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(_(n.path,qs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function bn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ie([...r,s],a):_([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ht(){return structuredClone(Nd)}function vo(e,t){if(!AC(e))return{exists:!1,policy:Ht(),errors:[]};try{let n=PC(e,"utf-8");if(!n.trim())return{exists:!0,policy:Ht(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=OC(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${WC(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Ht(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var LC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[qs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ks,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Gd,`not an integer between ${So} and ${bo}`]]);function WC(e){let t=Ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=LC.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function GC(e,t){let n=vo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:cr(Ht()),errors:[]};let o=DC(r,t);return{policy:cr(o),gui:o,errors:[],levelPresent:Md(r)}}if(n.parsed===void 0)return{policy:cr(Ht()),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:cr(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Md(n.parsed)}}function Md(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return Vs.has(t.level)}function FC(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...go].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function cr(e){return{safety:zC(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:FC(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function zC(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Ud(e,t){let n=Sd(e,t),r=Ld(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,commandTools:n.command_tools,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...HC(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return jC(o,$C(n,r),s,r.policyScopes)}function $C(e,t){let n=UC(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:VC(e.errors.length>0?BC(e.errors):void 0,e.warnings.length>0?Zs(e.warnings.join("; ")):void 0,n)}}function BC(e){return`${Zs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function UC(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function HC(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function jC(e,t,n=Object.freeze({}),r){let o=Ys(structuredClone(e)),i=r?{policyScopes:Ys(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ys(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ys(t);return Object.freeze(e)}function VC(...e){return Zs(e.filter((t)=>!!t).join("; "))}function Zs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Hd(e){let t=e.effectiveCapabilities,n=t.fail_closed.enabled,r=t.paranoid_rm.enabled,o=t.paranoid_interpreters.enabled;return{policy:Pd(e.policySnapshot.policy,t),effectiveCapabilities:t,effectiveLevel:is({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}import{dirname as Kx,isAbsolute as qx,join as Yx,parse as Zx,resolve as Xx,sep as Jx}from"node:path";function dr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var KC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ro(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function ur(e){let t=Ro(e.words[0],"time")?1:0,n=t===1&&Ro(e.words[t],"-p")?t+1:t,r=t===1&&Ro(e.words[n],"--")?n+1:n,o=Ro(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!KC.test(s.text));return i?.provenance==="literal"?i.text:void 0}var bt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function _o(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function wo(e,t,n){e.push(n),t.reset()}function xo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Xs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return{kind:"word",...e,parts:t}}function En(e,t,n,r,o,i,s){return Xs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function Js(e,t,n){if(t>=n||Vd(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Vd(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=jd(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=jd(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Qs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=qC(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?YC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function jd(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Vd(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function qC(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function YC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Xd=new Set(["&&","||","|","|&"]),ZC=new Set(["!","do","elif","else","if","then","until","while"]);function Jd(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=To(e,0,e.length,t,r,0),i=[...o.issues,...sS(e,r.quotedExpansionEnd,o.nodes)?[nu]:[],...oS.test(e)?[tu]:[]];return{kind:"program",dialect:"posix",source:e,span:n,status:ko(i,o.limited),issues:i,nodes:o.nodes}}function To(e,t,n,r,o,i,s){let a=[],l=[],c=_o(),d=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);wo(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return f(),Zd(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(fr(m)){if(m.charCodeAt(0)>127)l.push(tu);if(m===`
+`)}function Jl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Jn(e={}){return{reason:Xn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Kg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Qn(e,t={}){return{...Kg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Ql(e){return Vg({...e,redact:yt})}function ec(e){return yt(e instanceof Error?e.message:String(e))}import{isAbsolute as ns,relative as Eh,resolve as Ec,sep as vh}from"node:path";import{basename as rc,dirname as qg,isAbsolute as Yg,join as Zg,normalize as Xg,resolve as tc}from"node:path";var Jg=256,Jr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function de(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function rt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Xi(e,t){return qi(e,0,t)}function qi(e,t,n){let r="",o=0,i=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let a=Yi(e,o+2),l=Qg(e,o,t);if(l===null){if(Jr.has(a))throw new G("pathEnvironmentExpansion");if(i++,i>V.pathEnvironmentExpansion.cap)throw new G("pathEnvironmentExpansion");r+="${",o+=2;continue}let c=e.slice(o,l+1);r+=eh(c,t,n),o=l+1;continue}let s=Yi(e,o+1);if(!s){r+="$",o++;continue}r+=Zi(s,n)??`$${s}`,o+=s.length+1}return r}function Qg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new G("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function eh(e,t,n){let r=e.slice(2,-1),o=Yi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Zi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Jr.has(o))throw new G("pathEnvironmentExpansion");return e}if(!Jr.has(o))return e;if(s.endsWith("="))throw new G("pathEnvironmentExpansion");let a=Zi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new G("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":qi(i.slice(s.length),t+1,n);return l?qi(i.slice(s.length),t+1,n):""}function Yi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Zi(e,t){if(!Jr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function W(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){oc(n,i);let s=t.realpath(i);if(s!==null)return nc(n,e,s,o);let a=qg(i);if(a===i||o.length>=Jg)return nc(n,e,i,o);o.push(rc(i)),i=a}}function nc(e,t,n,r){let o=r.length===0?n:Zg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function th(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;oc(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function oc(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ue(e,t,n,r){let o=sc(e,t,n);if(!o)return"";return W(o,n.paths,r).replace(/\\/g,"/")}function ic(e,t,n,r,o){let i=sc(e,t,n);if(!i)return null;if(o(rc(i)))return W(i,n.paths,r).replace(/\\/g,"/");let s=th(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function sc(e,t,n){let r=n.home,o=Xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?tc(r,o.slice(2)):o,s=de(i);return Xg(Yg(s)?s:tc(t,s))}import{types as nh}from"node:util";var rh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),oh=new Set(["command","diff","input","patch","patchtext"]),ac=new TextEncoder,ih=new TextDecoder,sh=/\s/,ah=64;class ot extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var er=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function lh(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function eo(e){return rh.has(lh(e))}function nr(e){if(!e||typeof e!=="object")return;Cc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Je();return}if(t.get||t.set)Je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function mc(e,t){return fc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function fc(e,t,n,r,o){let i=yc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>fc(l,t,i.array?n:t.has(pc(a)),r,o+1));return r.ancestors.delete(i.object),s}function pc(e){return e.replace(/-/g,"_").toLowerCase()}function gc(e){return hc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(dh)}function hc(e,t,n,r){let o=yc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>hc(a,o.array?t:oh.has(pc(s)),n,r+1));return n.ancestors.delete(o.object),i}function ch(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>er.maxDepth||t.nodes>er.maxNodes)Je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>er.maxStringBytes||t.stringBytes>er.maxAggregateStringBytes)Je()}function yc(e,t,n){if(ch(e,t,n),!e||typeof e!=="object")return null;let r=Cc(e);if(t.ancestors.has(e))Je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>er.maxKeys)Je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Cc(e){if(nh.isProxy(e))Je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Je();return t}function Je(){throw new ot}function dh(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=uh(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ji(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ji(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...es(Qr(c.slice(4),!0),Qr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ji(c))}return t}function uh(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ji(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return uc(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return uc(n[1]);if(e.startsWith("diff --git "))return mh(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return dc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return dc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Sh(i[1]);return[]}function mh(e){let t=fh(e);if(t.length===2&&t[0]&&t[1])return es(t[0],t[1]);let n=ph(e);return n?es(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function fh(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Lt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Lt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Sc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Lt(e[n]))n++;return n===e.length?t:[]}function ph(e){let t=0;while(t<e.length&&Lt(e[t]))t++;let n=e.length;while(n>t&&Lt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Lt(e[o])){o++;continue}let i=o;while(o<n&&Lt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ah)Je();if(gh(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function gh(e,t,n,r,o){if(Qi(e,t,n,r,o))return!0;let i=lc(e,"/",t,n),s=lc(e,"/",r,o);if(i<=t||s<=r)return!1;if(Qi(e,t,i,r,s))return!1;return Qi(e,i+1,n,s+1,o)}function Qi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function lc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Lt(e){return e!==void 0&&sh.test(e)}function Sc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:ih.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...ac.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...ac.encode(hh(s[0]??""))),o+=2}return null}function hh(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function yh(e){return tr(bh(e))}function es(e,t){if(e==="/dev/null")return cc(t);if(t==="/dev/null")return cc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(tr);let n=Ch(e,t)??(e===t?bc(e):null);return[e,t,...n?[n]:[]].flatMap(tr)}function cc(e){let t=bc(e);return[e,...t?[t]:[]].flatMap(tr)}function bc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Ch(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function dc(e){return yh(Qr(e,!0))}function Sh(e){return tr(Qr(e,!1))}function Qr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Sc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function bh(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function tr(e){return e===""||e==="/dev/null"?[]:[e]}function uc(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function rs(e,t,n){if(rt(e))return;let r=t.flatMap((i)=>ts(i,n));if(!r[0])return;let o=ts(ns(e)?e:Ec(r[0],e),n)[0];if(!o)return;return r.some((i)=>_h(o,i))?o:void 0}function os(e,t,n){if(rt(e))return;return ts(ns(e)?e:Ec(t,e),n)[0]}function vc(e,t,n){return os(e,t,n)?"outside-workspace":"unusable"}function ts(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function _h(e,t){let n=Eh(t,e);return n===""||n!==".."&&!n.startsWith(`..${vh}`)&&!ns(n)}function to(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{spawnSync as Zh}from"node:child_process";import{lstatSync as Xh,realpathSync as Jh,statSync as Qh}from"node:fs";import{homedir as ey,tmpdir as ty}from"node:os";import{statSync as Kh}from"node:fs";import{join as qh}from"node:path";import{spawnSync as Rh}from"node:child_process";import{accessSync as _c,constants as Rc,existsSync as rr,lstatSync as wh,opendirSync as xh,readFileSync as or,realpathSync as gn,statSync as hn}from"node:fs";import{dirname as Ac,isAbsolute as is,join as Ie,resolve as no}from"node:path";var Ah=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Ph=5000;function Pc(e,t=Uh(),n=Ph){let r=Th(e),o=r===null?null:Ih(r);if(r===null||o===null)return null;let i=$h(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Th(e){try{let t=gn(no(e));return hn(t).isDirectory()?t:null}catch{return null}}function Ih(e){let t=zh(e);if(!t)return null;try{let n=wh(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ss(t);if(!r?.commonDir)return null;if(!Dh(r.gitDir,t))return null;return kc(r.gitDir,r.commonDir)?null:{gitDir:r.gitDir,commonDir:r.commonDir}}catch{return null}}function ss(e){try{let t=kh(e);if(!t)return null;let n=gn(is(t)?t:no(Ac(e),t));if(!hn(n).isDirectory())return null;return{gitDir:n,commonDir:Oh(n)}}catch{return null}}function kh(e){let t=or(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Oh(e){try{let t=or(Ie(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=gn(is(t)?t:no(e,t));return hn(n).isDirectory()?n:null}catch{return null}}function Dh(e,t){let n=Mh(e);return n===null?!1:Nh(e,n,t)}function Mh(e){let t=Ie(e,"gitdir");if(!rr(t))return null;let n=or(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Nh(e,t,n){try{return Lh(is(t)?t:no(e,t),n)}catch{return!1}}function Lh(e,t){try{let n=hn(e),r=hn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return wc(gn.native(e))===wc(gn.native(t))}function wc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Tc(e){try{return _c(Ie(e,"objects"),Rc.X_OK),_c(Ie(e,"refs"),Rc.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Oc(Ie(e,"HEAD")))}catch{return!1}}function Ic(e){return rr(Ie(e,"commondir"))||kc(e,e)}function kc(e,t){return[Ie(t,"config"),Ie(e,"config.worktree")].some(Wh)||Fh(e)}var xc=1048576;function Oc(e){let t=hn(e);if(!t.isFile()||t.size>xc)throw Error(`${e} is not a regular file within ${xc} bytes`);return or(e,"utf-8")}function Wh(e){try{return/(?:^|[\s\]])worktree\s*=/i.test(Oc(e))}catch(t){return t.code!=="ENOENT"}}var Gh=1e4;function Fh(e){let t=[e],n=0;try{while(t.length>0){let r=t.pop(),o=xh(r);try{for(let i=o.readSync();i!==null;i=o.readSync()){if(n++,i.isSymbolicLink()||i.isFIFO()||n>Gh)return!0;let s=r===e&&i.name==="objects";if(i.isDirectory()&&!s)t.push(Ie(r,i.name))}}finally{o.closeSync()}}return!1}catch(r){return r.code!=="ENOENT"}}function zh(e){try{return as(gn(e))}catch{return null}}function as(e){let t=e;while(!0){let n=Ie(t,".git");if(rr(n))return n;let r=Ac(t);if(r===t)return null;t=r}}function $h(e,t,n,r){if(Bh(t))return!0;if(n===null)return!0;let o=Rh(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Hh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Dc(o.stdout.trim())}function Bh(e){return[Ie(e.commonDir,"config"),Ie(e.gitDir,"config.worktree")].filter((t)=>rr(t)).some((t)=>jh(t))}function Uh(){return Ah.find((e)=>rr(e))??null}function ir(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Hh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!ir(t)))}function jh(e){let t;try{t=or(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Vh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Dc(c)}return r}function Vh(e){return e==="include"||e.startsWith("includeif ")}function Dc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Mc(e,t){if(e==="")return null;let n=Te(),r=as(ue(e,e,t,n)),o=r?Yh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Yh(e,t,n,r){try{let o=ue(e,t,n,r),i=Kh(e),s=i.isFile()?o:null,a=i.isFile()?ss(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[yn(ue(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[yn(e.replace(/\\/g,"/")),...l]:l)];return{entry:yn(o),markerFile:s?yn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let f=yn(qh(d,"hooks").replace(/\\/g,"/"));return[f,yn(ue(f,t,n,r))]}))]}}catch{return null}}function yn(e){return process.platform==="win32"?e.toLowerCase():e}var ny={realpath:(e)=>{try{return Jh(e)}catch{return null}},entryKind:(e)=>{try{let t=Xh(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}catch(t){if(t.code==="ENAMETOOLONG")return"missing";throw t}},isDirectory:(e)=>{try{return Qh(e).isDirectory()}catch{return!1}}};function Nc(){let e=new Map;return oy({env:new Map(Object.entries(process.env).flatMap(([t,n])=>n===void 0?[]:[[t,n]])),home:de(process.env.HOME||ey()),tmpdir:ty(),darwinUserTempDir:()=>ro(e,"",ry),paths:ny})}function ry(){if(process.platform!=="darwin")return null;let e=Zh("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),t=e.stdout?.replace(/\n$/,"");return e.status===0&&t?.startsWith("/")?t:null}function oy(e,t={}){let n=new Map,r=new Map,o=new Map,i={...e,gitMetadata:(s)=>ro(n,s,()=>Mc(s,i)),worktreeFacts:(s)=>ro(r,s,()=>Pc(s)),isGitDirectory:Tc,gitDirectoryRedirects:(s)=>ro(o,s,()=>Ic(s)),...t};return i}function ro(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Cn=["fail_closed","paranoid_rm","paranoid_interpreters"],oo={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},io=["standard","strict","paranoid"];function Lc(e,t){if(!t)return e;return io.indexOf(t)>io.indexOf(e)?t:e}function Wc(e){let t=so(ee.level,e);return io.find((n)=>n===t)}function Gc(e,t){return Lc(e,Wc(t))}function iy(e){let t=so(ee.level,e);if(!t)return;let n=Wc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${io.join(", ")}.`);return}function sy(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Fc(e){return sy(so(ee.auditScope,e))==="all"}function cs(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ds(e={},t){let n=e.safety?.level??"standard",r=iy(t),o=Lc(n,r),i=oo[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(it(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(it(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(it(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(it(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||it(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:cs(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function it(e,t){let n=typeof e==="string"?ls(e,t):so(e,t);return n==="1"||n?.toLowerCase()==="true"}function ls(e,t){return t.get(e)}function so(e,t){let n=ls(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ls(e.legacyName,t);return}import{dirname as ho}from"node:path";import{closeSync as ay,constants as zc,fstatSync as ly,fsyncSync as Lk,lstatSync as fs,mkdirSync as Wk,openSync as cy,readdirSync as Gk,readFileSync as dy,realpathSync as ps,renameSync as Fk,rmdirSync as zk,statSync as uy,unlinkSync as $k,writeFileSync as Bk}from"node:fs";import{isAbsolute as $c,join as gs,normalize as my,parse as ms,relative as hs,resolve as ys,sep as Cs}from"node:path";function us(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var fy=Symbol("PolicyFilesystemScope"),py=Symbol("PolicyFilesystemTarget"),gy=zc.O_NOFOLLOW??0;class me extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Wt(e,t){return{[fy]:!0,root:ys(e),label:t}}function Bc(e,t){let n=my(t);if(t===""||$c(t)||n===".."||n.startsWith(`..${Cs}`))throw new me(e.label);return{[py]:!0,scope:e,relativePath:n,path:gs(e.root,n)}}function sr(e,t){return Bc(e,hs(e.root,ys(t)))}function Uc(e,t="rules policy"){let n=ys(e),r=ms(n).dir;return Bc(Wt(r,t),hs(r,n))}function lo(e){return jc(e.scope.label,()=>{if(!ao(e))return null;let t=cy(e.path,zc.O_RDONLY|gy);return hy(t,()=>{let n=ly(t);if(!n.isFile())throw new me(e.scope.label);let r=dy(t,"utf-8"),o=fs(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new me(e.scope.label);return ao(e),r})})}function Hc(e,t){if(e.path===t.path)return!0;return jc(e.scope.label,()=>{if(!ao(e)||!ao(t))return!1;let n=(r)=>gs(ps(ms(r).dir),ms(r).base);return n(e.path)===n(t.path)})}function jc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof me)throw r;throw new me(e)}}function hy(e,t){try{return t()}finally{ay(e)}}function ao(e,t="file"){let n=yy(e.scope);if(!n)return!1;let r=e.relativePath.split(Cs);for(let o of r.keys()){let i=gs(e.scope.root,...r.slice(0,o+1)),s=fs(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new me(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new me(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new me(e.scope.label);Cy(n,ps(i),e.scope.label)}return!0}function yy(e){if(!fs(e.root,{throwIfNoEntry:!1}))return null;if(!uy(e.root).isDirectory())throw new me(e.label);return ps(e.root)}function Cy(e,t,n){let r=hs(e,t);if(r===".."||r.startsWith(`..${Cs}`)||$c(r))throw new me(n)}import{dirname as Ft,isAbsolute as _y,join as zt,relative as Ry,resolve as Ct,sep as wy}from"node:path";var Gt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Vc="rulebook.json",Kc=".cc-safety-net/rules";var qc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Sy=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,by=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Ey="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vk=new RegExp(`^${by}/(${Gt.source.slice(1,-1)})/${Ey}$`);function vy(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Yc(e){if(co(e))try{return Ss(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Gt.test(e)?null:`Local rulebook sources must be bare names matching ${Gt}: ${e}`}function Ss(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(qc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Sy.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Gt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:vy(o),name:o}}function co(e){return qc.test(e)}var Zc="rule.json",uo="policy.json",Xc=".cc-safety-net",xy="rules",Ay="CC_SAFETY_NET_HOME",Jc="`cc-safety-net rule update`";function Py(e){return Ct(e,Kc)}function Ty(e){return zt(Py(e),Zc)}function Sn(e){return zt(Ct(e),Xc,uo)}function bs(e,t={}){return t.userConfigDir??(t.userConfigPath?Ft(t.userConfigPath):zt(Iy(e),xy))}function Iy(e){let t=e.env.get(Ay);return t?Ct(de(t)):zt(e.home,Xc)}function ky(e,t={}){return zt(bs(e,t),Zc)}function $t(e,t={}){return zt(Ft(bs(e,t)),uo)}function Qc(e,t){let n=Te();return W(Sn(t.cwd),e.paths,n)===W(Ct($t(e,t)),e.paths,n)}function ed(e,t){let n=t.userConfigPath??ky(e,t),r=t.projectConfigPath??Ty(t.cwd),o=Oy(e,t),i=Dy(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:sr(o,n),projectConfigTarget:sr(i,r)}}function Oy(e,t){let n=t.userConfigPath?Ft(Ft(Ct(t.userConfigPath))):Ft(Ct(t.userConfigDir??bs(e,t)));return Wt(n,"user policy")}function Dy(e,t){let n=Ct(t),r=Ct(e),o=Ry(n,r);if(o!==".."&&!o.startsWith(`..${wy}`)&&!_y(o))return Wt(n,"project policy");return Wt(Ft(Ft(r)),"project policy")}function td(e,t){return zt(e,t,Vc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),St=/^[a-zA-Z][a-zA-Z0-9_-]*$/,bt=256,Q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nd=new Set(["python","python3","python2","node","ruby","perl"]),mo=/^python(?:[23](?:\.\d+)*)?$/,ke=new Set(["awk","gawk","nawk","mawk"]),fo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rd="Rulebook exceeds CC Safety Net's safe validation limits.",od="Additional rulebook validation errors were omitted.",Fe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function id(e){if(Es(e.allowed_commands,Fe.maxAllowedCommands)||Es(e.rules,Fe.maxRules)||Es(e.tests,Fe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Fe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Fe.maxStringCodeUnits||i&&o.length>Fe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Fe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Es(e,t){return Array.isArray(e)&&e.length>t}var vs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var _s=64,Rs="Rule config exceeds CC Safety Net's safe source limit.";function N(e){return M(e).toLowerCase()}function M(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function Ce(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var My={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ws=new Set(["--init-file","--rcfile"]);function xs(e,t,n,r){let o=!1,i=0,s=!1,a=!1;for(let l=1;l<t.length;l++){let c=t[l];if(c===void 0)break;if(e==="ksh"&&c==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&c==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&c==="o"&&l+1<t.length)break;if(r==="startup"&&c==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&c==="c")s=!0;if(r==="argv"&&c==="s")a=t[0]==="-";if(!My[e]?.includes(c))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a}}function Oe(e){let t=M(e[0]??"").toLowerCase(),n=!1,r=!1;for(let o=1;o<e.length;o++){let i=e[o];if(i===void 0)break;if(i==="--"){let a=n&&e[o+1]!==void 0?o+1:null;return{command:a===null?null:e[a]??null,commandIndex:a,scriptIndex:!n&&!r&&e[o+1]!==void 0?o+1:null,readsStdinAsCommands:!n&&(r||e[o+1]===void 0)}}if(i==="-"||i[0]!=="-"&&i[0]!=="+")return{command:n?i:null,commandIndex:n?o:null,scriptIndex:!n&&!r&&i!=="-"?o:null,readsStdinAsCommands:!n&&(r||i==="-")};if(i.startsWith("--")){let a=i.split("=",1)[0]??i;if(t==="bash"&&ws.has(a)&&!i.includes("="))o++;continue}let s=xs(t,i,e[o+1],"argv");if(s.commandSelected)n=!0;if(s.stdinMode)r=!0;o+=s.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n}}function ar(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function po(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Ny(e))ar(n,t);return t.inSingle||t.inDouble}function Ny(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);ar(s,n)}return t}var As=new Set(["rm","find","xargs","parallel"]),Ly=new Set(["git","busybox",...As,...Q,...nd,...ke]),Wy=new Set(["python","node","ruby","perl"]);function sd(e){let t=N(e);return Ly.has(t)||ze(t)}function ze(e){return Wy.has(Gy(e))}function Gy(e){let t=M(e).toLowerCase();return mo.test(t)?"python":t}function Is(e){try{let t=lo(Fy(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Uy(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[],...n.command_tools?{command_tools:n.command_tools}:{}},errors:[]}}catch(t){if(t instanceof me)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Fy(e){return typeof e==="string"?Uc(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),ie=(e,t)=>({path:e,message:t,kind:"custom"});function ad(e){let t=new Set;return e.flatMap((n,r)=>{let o=Bt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ie(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ks=`must be one of ${vs.join(", ")}`,zy=/^[^/]+\/[^/]+$/,$y=["version","rules","overrides","transparent_wrappers","command_tools"],By=/^[^\s\p{Cc}]{1,256}$/u,Ps="non-empty, at most 256 characters, no whitespace or control characters";function Uy(e){let t=Hy(e);return{errors:Os(eC(t,$y,(n)=>n.kind==="custom"),": "," "),sources:Qy(e,t)}}function Hy(e){if(!Bt(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>_s;return[...e.version===1?[]:[w(["version"],"must be 1")],...jy(e.rules,t),...qy(e.overrides),...Zy(e.transparent_wrappers),...t?[]:Ky(e.rules),...Bt(e.overrides)?Object.keys(e.overrides).filter((n)=>!zy.test(n)).map((n)=>ie(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Xy(e.transparent_wrappers),...Jy(e.command_tools)]}function jy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),...ld(e,_s)?[w(["rules"],Rs)]:[]];if(t)return[{path:["rules"],message:Rs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...Vy(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function ld(e,t){let n=cd(e);return n!==void 0&&!(n<=t)}function Vy(e,t){let n=cd(e);return n!==void 0&&!(n>=t)}function cd(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Ky(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ie(["rules",r],"must be a non-empty rulebook source string")];let o=Yc(n);if(o)return[ie(["rules",r],o)];if(t.has(n))return[ie(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function qy(e){if(e===void 0)return[];if(!Bt(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Bt(n))return[w(["overrides",t],'must be "off" or an object')];return[...Yy(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Ms(n.intent)?[]:[w(["overrides",t,"intent"],ks)]]})}function Yy(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),...ld(e,bt)?[w(t,`must be at most ${bt} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>bt?[w(t,`must be at most ${bt} characters`)]:[]}function Zy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return St.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function Xy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!St.test(n))return[];if(t.has(n))return[ie(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sd(n))return[ie(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Jy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let t=new Set,n=(r,o)=>{if(t.has(r))return[ie(["command_tools",o],`duplicate tool "${r}"`)];return t.add(r),[]};return e.flatMap((r,o)=>{if(typeof r==="string")return Ts(r)?n(r,o):[w(["command_tools",o],`must be a tool name: ${Ps}`)];if(!Bt(r))return[w(["command_tools",o],"must be a tool name or a {name, cwd} object")];let i=[...Ts(r.name)?[]:[w(["command_tools",o,"name"],`must be a tool name: ${Ps}`)],...r.cwd===void 0||Ts(r.cwd)?[]:[w(["command_tools",o,"cwd"],`must be an argument name: ${Ps}`)]];return i.length>0?i:n(r.name,o)})}function Ts(e){return typeof e==="string"&&By.test(e)}function Qy(e,t){let n=Bt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function eC(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Os(e,t,n){return[...new Set(e.map((r)=>{let o=Ds(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Ds(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Ms(e){return vs.includes(e)}function Bt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ud(e){let t=rC(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var tC=`required non-empty string up to ${bt} characters`,dd="must be a non-empty array of unique non-empty strings",nC="required non-empty array of non-empty strings";function rC(e){if(!Et(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!id(e))return{errors:[rd],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Os(oC(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Fe.maxValidationErrors?[...t.slice(0,Fe.maxValidationErrors),od]:t,ruleNames:new Set(md(e).map((n)=>n.toLowerCase()))}}function md(e){let t=Et(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Et(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function oC(e,t){return[...typeof e.name==="string"&&Gt.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...iC(e.allowed_commands),...sC(e.rules,t),...dC(e.tests),...uC(e),...mC(e)]}function iC(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&St.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!St.test(n))return[];if(t.has(n))return[ie(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function sC(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!Et(n))return[w(["rules",r],"must be an object")];return t?lC(n,["rules",r]):aC(n,["rules",r])}),...ad(e)]}function aC(e,t){return[...fd(e.name,t),...pd(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&St.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...go(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gd(e.reason,t),...hd(e.intent,t)]}function lC(e,t){return[...fd(e.name,t),...pd(e.command,t),...gd(e.reason,t),...hd(e.intent,t),...cC(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function fd(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return Gt.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function pd(e,t){return typeof e==="string"&&St.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function gd(e,t){return typeof e==="string"&&e!==""&&e.length<=bt?[]:[w([...t,"reason"],tC)]}function hd(e,t){return e===void 0||Ms(e)?[]:[w([...t,"intent"],ks)]}function cC(e,t){if(!Et(e))return[w(t,"required object")];return[...go(e.command_path,[...t,"command_path"],nC,!1),...e.any_args===void 0?[]:go(e.any_args,[...t,"any_args"],dd,!0),...e.exclude_args===void 0?[]:go(e.exclude_args,[...t,"exclude_args"],dd,!0)]}function go(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[ie([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ie(t,n)]:[],...r&&new Set(e).size!==e.length?[ie(t,"must not contain duplicate values")]:[]]}function dC(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!Et(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ie(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function uC(e){if(!Array.isArray(e.tests))return[];let t=new Set(md(e));return[...new Set(e.tests.flatMap((n)=>Et(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ie(["tests"],`blocked fixture references unknown rule "${n}"`))}function mC(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=Et(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ie(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function Et(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function _d(e,t){let n=ed(e,t),r;try{r=Hc(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof me)return vC(n,m.message);throw m}let o=Is(n.userConfigTarget),i=r?{config:null,errors:[]}:Is(n.projectConfigTarget),s=Ed(n.userConfigPath,o.errors),a=Ed(n.projectConfigPath,i.errors),l=new Set,c=o.config?yd(o.config,ho(n.userConfigPath),"user",n.userScope,l):vd(),d=i.config?yd(i.config,ho(n.projectConfigPath),"project",n.projectScope,l):vd(),f=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Sd(c.rules,f),...Sd(d.rules,u)],transparent_wrappers:SC(o.config,i.config),command_tools:bC(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?bd(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?EC(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?bd(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yd(e,t,n,r=Wt(ho(ho(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=pC(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let f=d.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:fC(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((u)=>`${f.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function fC(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function pC(e,t,n){let r=gC(e),o=td(t,r),i=yC(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${hC(e)}`]};let s=CC(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function gC(e){return co(e)?Ss(e).name:e}function hC(e){return co(e)?`run ${Jc} to vendor ${e}`:"create that file or remove that source from the rules config"}function yC(e,t){try{return{content:lo(sr(t,e))}}catch(n){if(n instanceof me)return{error:n.message};throw n}}function CC(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ud(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function SC(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function bC(e,t){let n=(e?.command_tools??[]).map(Cd),r=(t?.command_tools??[]).map(Cd);return[...n,...r.filter((o)=>!n.some((i)=>i.name===o.name))]}function Cd(e){if(typeof e==="string")return{name:e};return e.cwd===void 0?{name:e.name}:{name:e.name,cwd:e.cwd}}function Sd(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bd(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function EC(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ed(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function vC(e,t){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vd(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as MC,readFileSync as NC}from"node:fs";var Rd=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ns=new Set(Rd.map((e)=>e.id)),yo=Rd,_C=new Map(yo.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:_C.get(e)??"manual_only"}}var Ls=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Co={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},RC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],wC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ws=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...wC.flatMap((e)=>RC.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var So=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],wd=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],xC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Gs=wd.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Fs=wd.flatMap((e)=>xC.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),lr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},zs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),$s=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],AC=[...Ls,Co,...Ws,...Gs,...Fs,lr,...zs,...$s,...So].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),bo=new Set(So.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Bs=new Set(AC.map((e)=>e.id));import{isAbsolute as Us,join as PC,normalize as TC,sep as Eo}from"node:path";var vo=process.platform==="win32",xd=/[*?]/;function Hs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(vo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(xd.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function cr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function js(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=cr(e.trim(),t);if(!Us(n))return"must be an absolute path or start with ~/";return dr(n,t)}function Vs(e,t){let n=Ad(e,t);if(n===null)return"must be a non-empty path string";if(!Us(n))return null;if(dr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var IC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",kC="cannot cover the guard's own configuration";function Ad(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=vo?n.replaceAll("\\","/"):n;return cr(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ks(e,t){let n=Ad(e,t);if(n===null)return"must be a non-empty path string";let r=Hs(n)?.root??n;if(xd.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Us(r))return null;if(dr(r,t)!==null)return IC;return OC(r,t)?kC:null}function OC(e,t){let n=_o(e),r=_o(PC(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Eo}`)}function dr(e,t){let n=_o(e),r=_o(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Eo)?n:`${n}${Eo}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function _o(e){let t=TC(e);if(vo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(vo?3:1)&&t.endsWith(Eo))t=t.slice(0,-1);return t}var Pd=30,Ro=1,wo=365;function Td(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Id=new Set(yo.filter((e)=>e.catastrophic).map((e)=>e.id));function k(e,t){if(!e)return null;if(Id.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Id.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function kd(e,t){return Object.freeze(Object.fromEntries(yo.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Od(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:kd(e,t)})}var Dd={standard:0,strict:1,paranoid:2};function Ld(e,t,n=!1,r=e.safety.level){let o=DC(e,t,r),i=new Set(n?o.map((d)=>d.field):[]),s=(d,f)=>i.has(d)?void 0:f,a=(d,f)=>Object.fromEntries(Object.entries(f??{}).filter(([u])=>!i.has(`${d}.${u}`))),l=(d,f)=>f?.filter((u)=>!i.has(`${d}.${u}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:qs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:qs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:qs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((d)=>d.message)}}function qs(e,t){return[...new Set([...e,...t??[]])]}function DC(e,t,n){let r=t.safety?.level,o=oo[n];return[...r&&Dd[r]<Dd[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...Cn.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Md("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...Md("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!bo.has(i))),...e.destructive_command_protection.enabled?Nd(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?Nd(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function Md(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function Nd(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Zs=new Set(["standard","strict","paranoid"]),Fd={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pd}};function zd(e,t){let n=jC($t(e,t),e.home),r=Qc(e,t)?{exists:!1,policy:Ht(),errors:[]}:Ao(Sn(t.cwd),e.home),o=WC(r.parsed,e.home),i=it(ee.projectTightenOnly,e.env),s=n.gui??Fd,a=Object.keys(o.policy).length>0?Ld(s,o.policy,i,Gc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),d=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?ur(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:d,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var LC="project policy audit settings are ignored; audit is user scope only";function WC(e,t){if(!_e(e))return{policy:{},diagnostics:[]};let n=_e(e.safety)?e.safety:{},r=_e(e.workflow)?e.workflow:{},o=_e(e.destructive_command_protection)?e.destructive_command_protection:{},i=_e(e.secret_protection)?e.secret_protection:{},s={...Zs.has(n.level)?{level:n.level}:{},..._e(n.overrides)?Wd({overrides:$d(n.overrides,Cn,["safety","overrides"],Ut)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:xo(o.overrides,Ns,Ud,Ut)}:{},...o.allow_paths!==void 0?{allow_paths:En(o.allow_paths,js,t,["destructive_command_protection","allow_paths"],Ut)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:xo(i.overrides,Bs,Hd,Ut)}:{},...i.deny_paths!==void 0?{deny_paths:En(i.deny_paths,Vs,t,["secret_protection","deny_paths"],Ut)}:{},...i.allow_paths!==void 0?{allow_paths:En(i.allow_paths,Ks,t,["secret_protection","allow_paths"],Ut)}:{}};return{policy:Wd({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[LC]}}function $d(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],Xs));return[]}))}function Wd(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Ut=()=>{return},Xs="must be a boolean",Js="must be an object if provided",Bd=`must be an integer between ${Ro} and ${wo}`,Ud={path:["destructive_command_protection","overrides"],label:"destructive command"},Hd={path:["secret_protection","overrides"],label:"secret protection"},GC=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function FC(e,t){let n=[];return{policy:jd(e,t,(o)=>{n.push(o)}),issues:n}}function zC(e,t){return jd(e,t,Ut)}function jd(e,t,n){if(!_e(e))return n(w([],"Config must be an object")),Ht();if(e.version!==1)n(w(["version"],"must be 1"));let r=bn(e.safety,["safety"],["level","overrides"],n),o=bn(r.overrides,["safety","overrides"],Cn,n),i=bn(e.workflow,["workflow"],["worktree_mode"],n),s=bn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=bn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=bn(e.audit,["audit"],["retention_days"],n);return Vd(e,GC,[],n),{version:1,safety:{level:$C(r.level,n),overrides:$d(o,Cn,["safety","overrides"],n)},workflow:{worktree_mode:Ys(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ys(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:xo(s.overrides,Ns,Ud,n),allow_paths:En(s.allow_paths,js,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ys(a.enabled,["secret_protection","enabled"],!0,n),overrides:xo(a.overrides,Bs,Hd,n),deny_paths:En(a.deny_paths,Vs,t,["secret_protection","deny_paths"],n),allow_paths:En(a.allow_paths,Ks,t,["secret_protection","allow_paths"],n)},audit:{retention_days:BC(l.retention_days,n)}}}function bn(e,t,n,r){if(e===void 0)return{};if(!_e(e))return r(w(t,Js)),{};return Vd(e,n,t,r),e}function Vd(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function $C(e,t){if(e===void 0)return"standard";if(Zs.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ys(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,Xs));return n}function BC(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ro&&e<=wo))t(w(["audit","retention_days"],Bd));return Td(e)}function xo(e,t,n,r){if(e===void 0)return{};if(!_e(e))return r(w(n.path,Js)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function En(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ie([...r,s],a):w([...r,s],a)),[]})}function _e(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ht(){return structuredClone(Fd)}function Ao(e,t){if(!MC(e))return{exists:!1,policy:Ht(),errors:[]};try{let n=NC(e,"utf-8");if(!n.trim())return{exists:!0,policy:Ht(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=FC(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${HC(i)}`),fallback:_e(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Ht(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var UC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Js,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Xs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Bd,`not an integer between ${Ro} and ${wo}`]]);function HC(e){let t=Ds(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=UC.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function jC(e,t){let n=Ao(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!_e(r))return{policy:ur(Ht()),errors:[]};let o=zC(r,t);return{policy:ur(o),gui:o,errors:[],levelPresent:Gd(r)}}if(n.parsed===void 0)return{policy:ur(Ht()),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ur(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Gd(n.parsed)}}function Gd(e){let t=_e(e)&&_e(e.safety)?e.safety:{};return Zs.has(t.level)}function VC(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...bo].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function ur(e){return{safety:KC(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:VC(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function KC(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Kd(e,t){let n=_d(e,t),r=zd(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,commandTools:n.command_tools,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...XC(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return JC(o,qC(n,r),s,r.policyScopes)}function qC(e,t){let n=ZC(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:QC(e.errors.length>0?YC(e.errors):void 0,e.warnings.length>0?ea(e.warnings.join("; ")):void 0,n)}}function YC(e){return`${ea(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ZC(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function XC(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function JC(e,t,n=Object.freeze({}),r){let o=Qs(structuredClone(e)),i=r?{policyScopes:Qs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Qs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Qs(t);return Object.freeze(e)}function QC(...e){return ea(e.filter((t)=>!!t).join("; "))}function ea(e){return/[.!?]$/.test(e)?e:`${e}.`}function qd(e){let t=e.effectiveCapabilities,n=t.fail_closed.enabled,r=t.paranoid_rm.enabled,o=t.paranoid_interpreters.enabled;return{policy:Od(e.policySnapshot.policy,t),effectiveCapabilities:t,effectiveLevel:cs({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}import{dirname as iA,isAbsolute as sA,join as aA,parse as lA,resolve as cA,sep as dA}from"node:path";function mr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var eS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Po(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function fr(e){let t=Po(e.words[0],"time")?1:0,n=t===1&&Po(e.words[t],"-p")?t+1:t,r=t===1&&Po(e.words[n],"--")?n+1:n,o=Po(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!eS.test(s.text));return i?.provenance==="literal"?i.text:void 0}var vt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function To(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Io(e,t,n){e.push(n),t.reset()}function ko(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ta(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return{kind:"word",...e,parts:t}}function vn(e,t,n,r,o,i,s){return ta({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function na(e,t,n){if(t>=n||Zd(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Zd(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Yd(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Yd(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ra(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=tS(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?nS(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Yd(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Zd(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function tS(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function nS(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]),rS=new Set(["!","do","elif","else","if","then","until","while"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=Mo(e,0,e.length,t,r,0),i=[...o.issues,...fS(e,r.quotedExpansionEnd,o.nodes)?[su]:[],...uS.test(e)?[iu]:[]];return{kind:"program",dialect:"posix",source:e,span:n,status:Lo(i,o.limited),issues:i,nodes:o.nodes}}function Mo(e,t,n,r,o,i,s){let a=[],l=[],c=To(),d=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);Io(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return f(),eu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(gr(m)){if(m.charCodeAt(0)>127)l.push(iu);if(m===`
 `||m==="\r"){f();let A=m==="\r"&&e[u+1]===`
-`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!Xd.has(P.operator))a.push({kind:"connector",operator:e.slice(u,A),span:{start:u,end:A}});if(d.length>0){let k=Qs(e,A,n,d.splice(0));l.push(...k.issues),u=k.next;continue}u=A;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?_S(e,u,n):void 0;if(p){if(ta(a,l),i>=r.maxDepth)return vn(a,l,u,"depth-limit",r.maxDepth);if(!ea(o))return vn(a,l,u,"word-limit",r.maxWords);let A=To(e,p.braceIndex+1,n,r,o,i+1,"}"),P=A.next,k={start:p.braceIndex+1,end:A.closed?P-1:P},C=Kd(e,k,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:P},body:C}),l.push(...A.issues),A.pendingHeredocs.length>0||pr(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return Po(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let g=Io(e,u);if(g){if(f(),!cu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push({kind:"connector",operator:g,span:{start:u,end:u+g.length}}),u+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&uS(e,u,n))&&c.start===-1){if(ta(a,l),i>=r.maxDepth)return vn(a,l,u,"depth-limit",r.maxDepth);let A=m==="("?")":"}",P=To(e,u+1,n,r,o,i+1,A),k=P.next,C={start:u+1,end:P.closed?k-1:k},O=Kd(e,C,P);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:k},body:O}),l.push(...P.issues),P.pendingHeredocs.length>0||pr(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return Po(a,l,P.next);if(!P.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=k;continue}let h=(m==="<"||m===">")&&e[u+1]!=="("?eS(e,u):null;if(h){let A=c.words.at(-1),P=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(P!==void 0)c.words.pop();let k=P===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let C=u+h.length;while(C<n&&/[ \t]/.test(e[C]??""))C++;let O=e[C],T=C>u+h.length&&O==="#",K=!O||fr(O)||!!Io(e,C)||O===s||O===")"||T||(O==="<"||O===">")&&e[C+1]!=="(",Mt=h==="<<"||h==="<<-",j=Mt?Js(e,C,n):void 0,z=j?{word:En(e,C,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!K?na(e,C,n,r,o,i):void 0;if(z){if(l.push(...z.issues),z.limited)return Po(a,l,z.next);if(!ea(o))return vn(a,l,z.next,"word-limit",r.maxWords)}let de=z?.next??u+h.length,te={kind:"redirection",operator:h,span:{start:k,end:de},...P===void 0?{}:{fd:P},...z?{target:z.word}:{}};if(c.redirections.push(te),Mt&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let ne=c.nested;d.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(Ee)=>{if(te.heredoc=Ee,Ee.quotedDelimiter)return;let tt=JC(e,Ee.bodySpan.start,Ee.bodySpan.end,r,o,i+1);ne.push(...tt.programs),l.push(...tt.issues)}})}if(!Mt&&!z)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(z)c.nested.push(...z.nested);c.end=de,u=de;continue}let y=c.start===-1;if(y)ta(a,l);let b=na(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return Po(a,l,b.next);let S=pS(c.words)?SS(e,b.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return vn(a,l,b.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[b.word];for(let A of E){if(!ea(o))return vn(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&du(b.word))f();u=b.next>u?b.next:u+1}return f(),Zd(a,l),l.push(...wS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Kd(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ko(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function na(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],f=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||fr(m)||(m===";"||m==="|"||m==="&")&&Io(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(m==='"'){l=!0;let y=XC(e,a,n,r,o,i);if(s+=y.text,d.push(...y.nested),f.push(...y.issues),u||=y.limited,c=mr(c,y.provenance),a=y.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let y=lS(e,a+2,n);if(s+=y.text,f.push(...y.issues),!y.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(m==="\\"){let y=e[a+1];if(!y){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
-`){a+=2;continue}s+=y,a+=2;continue}if(Vt(e,a))f.push(jt);let g=m==="$"||m==="<"||m===">"||m==="`"?gr(e,a,n,r,o,i):null,h=g?oa(g,d,f):ru(e,a,n,r,o,i,d,f);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(u||=h.limited,c=mr(c,h.provenance),a=h.next,u)break;continue}if(m==="$"){let y=iu(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(m==="*"||m==="?"||m==="[")c=mr(c,"glob");s+=m,a++}return{word:En(e,t,a,s,c,l,c==="literal"?void 0:dS(e,t,a)),nested:d,issues:f,next:a,limited:u}}function XC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,f=t+1;while(f<n){let u=e[f];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:d};if(u==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
+`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!tu.has(P.operator))a.push({kind:"connector",operator:e.slice(u,A),span:{start:u,end:A}});if(d.length>0){let I=ra(e,A,n,d.splice(0));l.push(...I.issues),u=I.next;continue}u=A;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?kS(e,u,n):void 0;if(p){if(ia(a,l),i>=r.maxDepth)return _n(a,l,u,"depth-limit",r.maxDepth);if(!oa(o))return _n(a,l,u,"word-limit",r.maxWords);let A=Mo(e,p.braceIndex+1,n,r,o,i+1,"}"),P=A.next,I={start:p.braceIndex+1,end:A.closed?P-1:P},C=Xd(e,I,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:P},body:C}),l.push(...A.issues),A.pendingHeredocs.length>0||hr(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return Do(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let g=No(e,u);if(g){if(f(),!fu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push({kind:"connector",operator:g,span:{start:u,end:u+g.length}}),u+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&CS(e,u,n))&&c.start===-1){if(ia(a,l),i>=r.maxDepth)return _n(a,l,u,"depth-limit",r.maxDepth);let A=m==="("?")":"}",P=Mo(e,u+1,n,r,o,i+1,A),I=P.next,C={start:u+1,end:P.closed?I-1:I},O=Xd(e,C,P);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:I},body:O}),l.push(...P.issues),P.pendingHeredocs.length>0||hr(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return Do(a,l,P.next);if(!P.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=I;continue}let h=(m==="<"||m===">")&&e[u+1]!=="("?aS(e,u):null;if(h){let A=c.words.at(-1),P=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(P!==void 0)c.words.pop();let I=P===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let C=u+h.length;while(C<n&&/[ \t]/.test(e[C]??""))C++;let O=e[C],T=C>u+h.length&&O==="#",J=!O||gr(O)||!!No(e,C)||O===s||O===")"||T||(O==="<"||O===">")&&e[C+1]!=="(",ye=h==="<<"||h==="<<-",Y=ye?na(e,C,n):void 0,j=Y?{word:vn(e,C,Y.next,Y.delimiter,"literal",Y.quoted),nested:[],issues:[],next:Y.next,limited:!1}:!J?sa(e,C,n,r,o,i):void 0;if(j){if(l.push(...j.issues),j.limited)return Do(a,l,j.next);if(!oa(o))return _n(a,l,j.next,"word-limit",r.maxWords)}let fe=j?.next??u+h.length,Z={kind:"redirection",operator:h,span:{start:I,end:fe},...P===void 0?{}:{fd:P},...j?{target:j.word}:{}};if(c.redirections.push(Z),ye&&!Y)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Y){if(Y.ambiguous||Y.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let ne=c.nested;d.push({delimiter:Y.delimiter,quotedDelimiter:Y.quoted,stripTabs:h==="<<-",attach:(Pe)=>{if(Z.heredoc=Pe,Pe.quotedDelimiter)return;let Ge=iS(e,Pe.bodySpan.start,Pe.bodySpan.end,r,o,i+1);ne.push(...Ge.programs),l.push(...Ge.issues)}})}if(!ye&&!j)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(j)c.nested.push(...j.nested);c.end=fe,u=fe;continue}let y=c.start===-1;if(y)ia(a,l);let b=sa(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return Do(a,l,b.next);let S=ES(c.words)?xS(e,b.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return _n(a,l,b.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[b.word];for(let A of E){if(!oa(o))return _n(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&pu(b.word))f();u=b.next>u?b.next:u+1}return f(),eu(a,l),l.push(...OS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Xd(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function sa(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],f=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||gr(m)||(m===";"||m==="|"||m==="&")&&No(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(m==='"'){l=!0;let y=oS(e,a,n,r,o,i);if(s+=y.text,d.push(...y.nested),f.push(...y.issues),u||=y.limited,c=pr(c,y.provenance),a=y.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let y=gS(e,a+2,n);if(s+=y.text,f.push(...y.issues),!y.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(m==="\\"){let y=e[a+1];if(!y){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
+`){a+=2;continue}s+=y,a+=2;continue}if(Vt(e,a))f.push(jt);let g=m==="$"||m==="<"||m===">"||m==="`"?yr(e,a,n,r,o,i):null,h=g?la(g,d,f):au(e,a,n,r,o,i,d,f);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(u||=h.limited,c=pr(c,h.provenance),a=h.next,u)break;continue}if(m==="$"){let y=cu(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(m==="*"||m==="?"||m==="[")c=pr(c,"glob");s+=m,a++}return{word:vn(e,t,a,s,c,l,c==="literal"?void 0:yS(e,t,a)),nested:d,issues:f,next:a,limited:u}}function oS(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,f=t+1;while(f<n){let u=e[f];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:d};if(u==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
 `){f+=2;continue}if(g==="\r"&&e[f+2]===`
-`){f+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(Vt(e,f))c.push(jt);let m=gr(e,f,n,r,o,i),p=m?oa(m,l,c):ru(e,f,n,r,o,i,l,c);if(p){if(p.provenance!=="command-substitution")s+=e.slice(f,p.next);if(f=p.next,d||=p.limited,a=mr(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:d};continue}if(u==="$"){let g=iu(e,f,n,s,a);s=g.text,a=g.provenance,f=g.next;continue}s+=u??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function gr(e,t,n,r,o,i){let s=eu(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",d=l==="`",f=e[t]==="<"||e[t]===">",u=ia(e,t+a,n,l),m=u===-1?n:u,p=u===-1?n:u+l.length;if(i>=r.maxDepth)return{program:RS(e,t+a,m,"depth-limit"),next:p,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],A=[],P=!1,k=t+a;while(k<m){let C=gr(e,k,m,r,o,i+1);if(!C){if(Vt(e,k))A.push(jt);k++;continue}if(E.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",k=C.next,P)break}if(u===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:ko(A,P),issues:A,nodes:E},next:p,provenance:"arithmetic"}}let g=To(e,t+a,m,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(d||f)&&pr(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],b=d&&/\\[\\$`\n]/.test(e.slice(t+a,m))?[aS]:[],S=[...g.issues,...h,...y,...b];return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:ko(S,g.limited),issues:S,nodes:g.nodes},next:p,provenance:"command-substitution"}}function JC(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let d=c==="$"||c==="`"?gr(e,l,n,r,o,i):null;if(!d){if(Vt(e,l))a.push(jt);l++;continue}if(s.push(d.program),tS(e,l,d.next)&&nS(d.program))a.push(jt);l=d.next}return{programs:s,issues:a}}function oa(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ia(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`){f+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(Vt(e,f))c.push(jt);let m=yr(e,f,n,r,o,i),p=m?la(m,l,c):au(e,f,n,r,o,i,l,c);if(p){if(p.provenance!=="command-substitution")s+=e.slice(f,p.next);if(f=p.next,d||=p.limited,a=pr(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:d};continue}if(u==="$"){let g=cu(e,f,n,s,a);s=g.text,a=g.provenance,f=g.next;continue}s+=u??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function yr(e,t,n,r,o,i){let s=ou(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",d=l==="`",f=e[t]==="<"||e[t]===">",u=ca(e,t+a,n,l),m=u===-1?n:u,p=u===-1?n:u+l.length;if(i>=r.maxDepth)return{program:IS(e,t+a,m,"depth-limit"),next:p,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],A=[],P=!1,I=t+a;while(I<m){let C=yr(e,I,m,r,o,i+1);if(!C){if(Vt(e,I))A.push(jt);I++;continue}if(E.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",I=C.next,P)break}if(u===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:Lo(A,P),issues:A,nodes:E},next:p,provenance:"arithmetic"}}let g=Mo(e,t+a,m,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(d||f)&&hr(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],b=d&&/\\[\\$`\n]/.test(e.slice(t+a,m))?[pS]:[],S=[...g.issues,...h,...y,...b];return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:Lo(S,g.limited),issues:S,nodes:g.nodes},next:p,provenance:"command-substitution"}}function iS(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let d=c==="$"||c==="`"?yr(e,l,n,r,o,i):null;if(!d){if(Vt(e,l))a.push(jt);l++;continue}if(s.push(d.program),lS(e,l,d.next)&&cS(d.program))a.push(jt);l=d.next}return{programs:s,issues:a}}function la(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ca(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let f=l==="\r"&&e[a+1]===`
-`?a+2:a+1,u=Qs(e,f,n,s.splice(0));if(!u.terminated)return-1;a=u.next-1;continue}let c=Qd(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let f=QC(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",u=a+(f?3:2);while(u<n&&/[ \t]/.test(e[u]??""))u++;let m=Js(e,u,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:f,attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let d=i.pop();if(d){o=d;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function QC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Qd(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Qd(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!xS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function Io(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function eS(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function fr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var jt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vt(e,t){if(e[t]!=="$")return!1;let n=qd(e,t+1);if(e[n]!=="{")return!1;let r=e[qd(e,n+1)]??"";return r==="|"||fr(r)}function tS(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Vt(e,r))return!0;return!1}function nS(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===jt.code)}function qd(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
-`,n))n+=e[n+1]==="\r"?3:2;return n}function eu(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var rS=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),oS=/[\v\f\r]/,tu=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),nu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),iS=/\$\(|`|[<>]\(/g;function sS(e,t,n){let r=ra(n);return[...e.slice(t).matchAll(iS)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function ra(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>ra(n.nodes))];return t.kind==="group"||t.kind==="function"?ra(t.body.nodes):[]})}var aS=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function ru(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=Oo(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(rS);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(nu);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let d=l.substitutions.some((f)=>{if(Vt(e,f))return a.push(jt),!1;let u=gr(e,f,c,r,o,i);return u!==null&&oa(u,s,a).limited});return{provenance:"variable",next:c,limited:d}}function Oo(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Vt(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
-`,a+=l==="\\"?2:1;continue}let c=eu(e,a);if(c){r.push(a);let d=ia(e,a+c.length,n,c.closing);if(d===-1)break;a=d+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function ou(e,t,n){if(e[t+1]==="{"){let o=Oo(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function lS(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=cS(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function cS(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Ao(e,t+1,n,16,2,t+1);if(r==="u")return Ao(e,t+1,n,16,4,t+1);if(r==="U")return Ao(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Ao(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Ao(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ko(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"||n.code==="unsupported-blank"))return"invalid";return e.length>0?"partial":"complete"}function iu(e,t,n,r,o){let i=ou(e,t,n);return{text:r+e.slice(t,i),provenance:mr(o,"variable"),next:i}}function dS(e,t,n){let r=xo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||f||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",g=ia(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=ou(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function mr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function uS(e,t,n){return t+1>=n||fr(e[t+1]??"")||Io(e,t+1)!==null}var mS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),fS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function pS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=gS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function gS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return hS(e,t);if(n==="env")return yS(e,t);if(n==="sudo")return CS(e,t);return}function hS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function yS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(mS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function CS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(fS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function su(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=au(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>lu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function SS(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=au(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>lu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>En(e,t.span.start,t.span.end,a,"literal",!1))}}function au(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Yd(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=Yd(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let f=d.start+c.length-d.end,u=d.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...bS(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function Yd(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&vS(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:ES(e,r)}}function bS(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function ES(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function vS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function lu(e,t){let n=`x${e}`,r=na(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function RS(e,t,n,r){return{kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]}}function vn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Po(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ea(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function _S(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function pr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>pr(n.nodes));return(t.kind==="group"||t.kind==="function")&&pr(t.body.nodes)})}function wS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function cu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Zd(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Xd.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function du(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&ZC.has(e.text)}function ta(e,t){let n=e.at(-1);if(!cu(n))return;if(n?.kind==="command"&&du(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function xS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),AS=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],PS=/^\$env:\w/i,TS=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!IS(n))return!1;let r=ca(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||la(r).some(kS)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function IS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function kS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&AS.has(n)&&r.some(OS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function OS(e){return PS.test(e)||TS.test(e)}function ca(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r=da(e,0,e.length,t,0);return{kind:"program",dialect:"powershell",source:e,span:n,status:WS(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function da(e,t,n,r,o,i=!1){let s=[],a=[],l=_o(),c=0,d=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};wo(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=LS(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`?a+2:a+1,u=ra(e,f,n,s.splice(0));if(!u.terminated)return-1;a=u.next-1;continue}let c=ru(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let f=sS(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",u=a+(f?3:2);while(u<n&&/[ \t]/.test(e[u]??""))u++;let m=na(e,u,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:f,attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let d=i.pop();if(d){o=d;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function sS(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ru(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ru(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!DS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function No(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function aS(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function gr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var jt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vt(e,t){if(e[t]!=="$")return!1;let n=Jd(e,t+1);if(e[n]!=="{")return!1;let r=e[Jd(e,n+1)]??"";return r==="|"||gr(r)}function lS(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Vt(e,r))return!0;return!1}function cS(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===jt.code)}function Jd(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
+`,n))n+=e[n+1]==="\r"?3:2;return n}function ou(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var dS=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),uS=/[\v\f\r]/,iu=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),su=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),mS=/\$\(|`|[<>]\(/g;function fS(e,t,n){let r=aa(n);return[...e.slice(t).matchAll(mS)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function aa(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>aa(n.nodes))];return t.kind==="group"||t.kind==="function"?aa(t.body.nodes):[]})}var pS=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function au(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=Wo(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(dS);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(su);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let d=l.substitutions.some((f)=>{if(Vt(e,f))return a.push(jt),!1;let u=yr(e,f,c,r,o,i);return u!==null&&la(u,s,a).limited});return{provenance:"variable",next:c,limited:d}}function Wo(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Vt(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
+`,a+=l==="\\"?2:1;continue}let c=ou(e,a);if(c){r.push(a);let d=ca(e,a+c.length,n,c.closing);if(d===-1)break;a=d+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function lu(e,t,n){if(e[t+1]==="{"){let o=Wo(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function gS(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=hS(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function hS(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Oo(e,t+1,n,16,2,t+1);if(r==="u")return Oo(e,t+1,n,16,4,t+1);if(r==="U")return Oo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Oo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Oo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"||n.code==="unsupported-blank"))return"invalid";return e.length>0?"partial":"complete"}function cu(e,t,n,r,o){let i=lu(e,t,n);return{text:r+e.slice(t,i),provenance:pr(o,"variable"),next:i}}function yS(e,t,n){let r=ko(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||f||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",g=ca(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=lu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function pr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function CS(e,t,n){return t+1>=n||gr(e[t+1]??"")||No(e,t+1)!==null}var SS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),bS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function ES(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=vS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function vS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return _S(e,t);if(n==="env")return RS(e,t);if(n==="sudo")return wS(e,t);return}function _S(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function RS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(SS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function wS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(bS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function du(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=uu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>mu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function xS(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=uu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>mu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>vn(e,t.span.start,t.span.end,a,"literal",!1))}}function uu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Qd(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=Qd(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let f=d.start+c.length-d.end,u=d.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...AS(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function Qd(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&TS(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:PS(e,r)}}function AS(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function PS(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function TS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function mu(e,t){let n=`x${e}`,r=sa(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function IS(e,t,n,r){return{kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]}}function _n(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Do(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function oa(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function kS(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function hr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>hr(n.nodes));return(t.kind==="group"||t.kind==="function")&&hr(t.body.nodes)})}function OS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function fu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function pu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&rS.has(e.text)}function ia(e,t){let n=e.at(-1);if(!fu(n))return;if(n?.kind==="command"&&pu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function DS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var hu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),MS=new Set(["gc","cat","type","cp","mv","rm"]),yu=["-rec","-for","-path","-literalpath","-whatif"],NS=/^\$env:\w/i,LS=/^(?:\$\{?\w+\}?|~)\\./;function Cu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...hu].some((o)=>n.includes(o))&&!(n.includes("rm")&&yu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!WS(n))return!1;let r=fa(e,t);if(Su(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||ma(r).some(GS)}function Su(e){return e.nodes.some((t)=>{if(t.kind==="group")return Su(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function WS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function GS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&hu.has(n))return!0;let r=e.slice(t+1);if(n&&MS.has(n)&&r.some(FS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return yu.some((s)=>i.startsWith(s))})}function FS(e){return NS.test(e)||LS.test(e)}function fa(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r=pa(e,0,e.length,t,0);return{kind:"program",dialect:"powershell",source:e,span:n,status:HS(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function pa(e,t,n,r,o,i=!1){let s=[],a=[],l=To(),c=0,d=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Io(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=US(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
 `){f();let y=m==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(sa(e,u,y)),u=y;continue}u++;continue}let g=Cu(e,u);if(g){f(),s.push(sa(e,u,u+g.length)),u+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=da(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,S={kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes};if(s.push({kind:"group",style:"brace",span:{start:u,end:y.next},body:S}),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(m==="}"){f(),s.push(sa(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let S=b<n?uu(e,b,n,r,o):void 0,E=S?.next??y;if(l.redirections.push({kind:"redirection",operator:e.slice(u,y),span:{start:u,end:E},...S?{target:S.word}:{}}),S)a.push(...S.issues),l.nested.push(...S.nested),c+=S.words,d||=S.limited;l.end=E,u=E;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Xs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=uu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return f(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function uu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,f=!1,u=(p)=>{let g=DS(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=aa(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Cu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:En(e,t,m,i,s,a,s==="literal"?void 0:MS(e,t,m)),next:m,issues:l,nested:c,words:d,limited:f}}function DS(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]},next:a};let l=da(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes},next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function aa(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=aa(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=aa(r)}}return t}function MS(e,t,n){let r=xo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=NS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function NS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function la(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return la(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(la)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function LS(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function WS(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function sa(e,t,n){return{kind:"connector",operator:e.slice(t,n),span:{start:t,end:n}}}function ze(e,t="auto",n=bt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return ca(e,n);return Jd(e,n)}function x(e){return e.provenance==="command-substitution"?e.raw:e.text}function Rn(e,t){return e==="posix"?t:X(t.map((n)=>n.text))}function _n(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function X(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function ua(e,t){return{value:e,work:t}}function R(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function ee(e){return e.value.length}function hr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function _e(e,t){hr(e,t)}function Kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function Y(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ma(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function Z(e,t,n){if(t+n.length>ee(e))return!1;for(let r=0;r<n.length;r++)if(R(e,t+r)!==n[r])return!1;return!0}function it(e,t,n){return!Kt(R(e,t-1))&&Z(e,t,n)&&!Kt(R(e,t+n.length))}function st(e,t){return Kt(R(e,t-1))!==Kt(R(e,t))}function ae(e){return e===`
-`||e===";"||e==="&"||e==="|"}function wn(e){return e==="|"||e===";"}function Do(e,t,n){let r=ua(e,n);if(t==="rm")return GS(r);if(t==="dd")return zS(r);return _u(r,!0)}function Mo(e,t,n){let r=ua(e,n);if(t==="rm")return $S(r);if(t==="reset-hard")return vu(r,"--ha","rd");if(t==="reset-merge")return vu(r,"--me","rge");if(t==="clean")return jS(r);if(t==="checkout")return KS(r);if(t==="push-force")return qS(r);if(t==="push-refspec")return YS(r);if(t==="push-delete")return ZS(r);if(t==="branch")return XS(r);if(t==="tag")return eb(r);if(t==="restore")return tb(r);return _u(r,!1)}function GS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=ee(e);i++){let s=R(e,i);if(!t){let l=R(e,i+2);if(it(e,i,"rm")&&Y(l)&&l!==`
-`)t=!0,i++;continue}let a=FS(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===ee(e)){if(o>=0){let l=Su(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(Y(s)){if(o<0)continue;if(Z(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Su(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function FS(e,t){if(R(e,t)!=="\\"||R(e,t-1)==="\\")return-1;if(Z(e,t,String.raw`\n`))return t+2;if(Z(e,t,String.raw`\x0a`)||Z(e,t,String.raw`\x0A`))return t+5;if(Z(e,t,String.raw`\u000a`)||Z(e,t,String.raw`\u000A`))return t+7;return Z(e,t,String.raw`\012`)?t+4:-1}function Su(e,t,n){if(bu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(bu(e,t,n,"force"))return{recursive:!1,force:!0};if(R(e,t)!=="-"||R(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=R(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function bu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Z(e,t,"--"))return!1;for(let i=0;i<o;i++)if(R(e,t+i+2)!==r[i])return!1;return!0}function zS(e){let t=!1;for(let n=0;n<ee(e);n++){if(ae(R(e,n))){t=!1;continue}if(it(e,n,"dd")){t=!0,n++;continue}if(!t||!it(e,n,"of")||!Z(e,n,"of=/dev/"))continue;let r=n+8;if(r<ee(e)&&!Y(R(e,r))&&R(e,r)!=="'"&&R(e,r)!=='"')return!0}return!1}function $S(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ee(e);){let i=R(e,o);if(o===ee(e)||ae(i)){t=!1,n=!1,r=!1,o++;continue}let s=US(e,o);if(s>=0){if(BS(e,s))return!0;let a=s,l=!1;while(Y(R(e,a)))l||=R(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Z(e,o,"--")&&(o===0||Y(R(e,o-1)))&&(!R(e,o+2)||Y(R(e,o+2))||ae(R(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Z(e,o,"--recursive")&&st(e,o+11)||fa(e,o,"recursive"),r||=Z(e,o,"--force")&&st(e,o+7)||fa(e,o,"force"),n&&r)return!0;o++}return!1}function fa(e,t,n){if(!Z(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=R(e,t+r+2);if(!o||Y(o)||ae(o))break;if(o!==n[r])return!1;r++}return r>0&&st(e,t+r+2)}function BS(e,t){let n=t,r=!1,o=!1;while(n<ee(e)){while(Y(R(e,n)))n++;let i=n;while(n<ee(e)&&!Y(R(e,n)))n++;if(R(e,i)!=="-"||n-i===2&&Z(e,i,"--"))return!1;let s=Eu(e,i,"recursive"),a=Eu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,R(e,i+1)==="-")continue;let l=HS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Eu(e,t,n){return Z(e,t,`--${n}`)&&st(e,t+n.length+2)||fa(e,t,n)}function US(e,t){if(t>0&&Kt(R(e,t-1)))return-1;let n=t;if(R(e,n)==="\\")n++;if(R(e,n)!=="r")return-1;if(n++,R(e,n)==="\\")n++;if(R(e,n)!=="m"||!Y(R(e,n+1)))return-1;return n+1}function HS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(R(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=R(e,c)??"",f=(d==="r"||d==="f")&&st(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&f,s||=d==="f"&&f,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&f,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function vu(e,t,n){return Cr(e,"reset",wn,!0,(r)=>R(e,r)==="-"&&xn(e,r,t,n)?!0:r)}function jS(e){return Cr(e,"clean",wn,!0,(t)=>{if(R(e,t)!=="-")return t;if(xn(e,t,"--fo","rce"))return!0;let n=yr(e,t,wn);for(let r=t+1;r<n;r++)if(R(e,r)==="f")return!0;return n-1})}function No(e,t,n){if(!it(e,t,"git"))return null;let r=t+3;if(!Y(R(e,r)))return{commandEnd:-1,next:r};while(Y(R(e,r)))r++;while(r<ee(e)){if(ae(R(e,r)))return{commandEnd:-1,next:r};let o=yr(e,r,ae);if(it(e,r,n))return{commandEnd:r+n.length,next:o};if(R(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Z(e,r,"--"),s=VS(e,r,o);r=o;while(Y(R(e,r)))r++;if(i)return{commandEnd:it(e,r,n)?r+n.length:-1,next:yr(e,r,ae)};if(!s)continue;if(r>=ee(e)||ae(R(e,r)))return{commandEnd:-1,next:r};r=yr(e,r,ae);while(Y(R(e,r)))r++}return{commandEnd:-1,next:r}}function VS(e,t,n){for(let r of ve)if(n-t===r.length&&Z(e,t,r))return!0;return!1}function KS(e){return Ru(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function qS(e){return Cr(e,"push",wn,!0,(t)=>{if(R(e,t)!=="-")return t;if(R(e,t+1)==="f"&&!Kt(R(e,t+2))&&!Z(e,t+2,"-with-lease"))return!0;let n=wu(e,t,"--fo","rce");if(n>=0&&!Z(e,n,"-with-lease"))return!0;return t})}function YS(e){return Cr(e,"push",ae,!1,(t)=>{if(Y(R(e,t))&&R(e,t+1)==="+"&&t+2<ee(e)&&!ae(R(e,t+2))&&!Y(R(e,t+2)))return!0;if(R(e,t)===":"&&R(e,t+1)==="+")return!0;return t})}function ZS(e){return Cr(e,"push",ae,!1,(t)=>{if(R(e,t)==="-"&&xn(e,t,"--de","lete"))return!0;if(Y(R(e,t))&&R(e,t+1)===":"&&t+2<ee(e)&&!Y(R(e,t+2))&&!ae(R(e,t+2)))return!0;return t})}function XS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ee(e);o++){if(o===ee(e)||ae(R(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=No(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||R(e,o)!=="-")continue;let i=yr(e,o,ae),s=JS(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function JS(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(R(e,i)!=="-")continue;if(xn(e,i,"--de","lete"))r=!0;if(xn(e,i,"--fo","rce"))o=!0;if(R(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&QS(R(e,s))){let d=R(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!st(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function QS(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function eb(e){return Ru(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ru(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<ee(e);r++){let o=R(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&R(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(Y(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=No(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&Y(R(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(xn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(R(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&st(e,r+1))return!0;if(wn(o))i.outerActive=!1}return!1}function Cr(e,t,n,r,o){let i=!1;for(let s=0;s<ee(e);s++){let a=R(e,s),l=n(a);if(!i&&!l){let c=No(e,s,t);if(c){i=c.commandEnd>=0&&(!r||Y(R(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(R(e,d)))i=!1;s=c}if(l)i=!1}return!1}function tb(e){let t=!1;for(let n=0;n<ee(e);n++){if(ma(R(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=No(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&R(e,n)==="-"&&R(e,n+1)==="-"&&(Z(e,n+2,"staged")||Z(e,n+2,"help")))t=!1}return t}function _u(e,t){let n=!1;for(let r=0;r<ee(e);r++){let o=R(e,r),i=t?ma(o):ae(o);if(n&&Y(o)&&R(e,r+1)==="-"&&it(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(it(e,r,"find"))n=!0,r+=3}return!1}function yr(e,t,n){let r=t;while(r<ee(e)&&!Y(R(e,r))&&!n(R(e,r)))r++;return r}function wu(e,t,n,r){if(!Z(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&R(e,o)===r[i];i++)o++;return st(e,o)?o:-1}function xn(e,t,n,r){return wu(e,t,n,r)>=0}function De(e,t){hr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)_e(t,a);if((s.regex?.test(a)??!1)||s.scan&&Mo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var nb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Au(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;hr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Pu(t.nodes,r,i)}function Pu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Pu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return rb(r,t,n)})}function rb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!nb.test(o.text));return e.words.every((o,i)=>o===t||xu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||xu(o.target.raw,n.anchored,!0)))}function xu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var ob="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",ib="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",sb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",ab="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",lb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",cb=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Tu=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,db=new Set(["diskutil","wipefs","sgdisk","parted"]),ub=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),mb=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,fb=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),pb=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),gb=new Set(["i","b"]),hb=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,yb=new Set([">",">|",">>","<>",">&"]),Cb=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Iu(e){return e==="dd"||e==="shred"||Tu.test(e)||db.has(e)}function Sb(e,t){let n=t.some((r)=>r.startsWith("/dev/"));if(e==="diskutil"){let r=t.find((o)=>!o.startsWith("-"));return r!==void 0&&ub.has(r.toLowerCase())}if(e==="wipefs")return n&&t.some((r)=>mb.test(r));if(e==="sgdisk")return n&&t.some((r)=>r.startsWith("-")&&!bb(r));return e==="parted"&&n&&t.some((r)=>Cb.has(r.toLowerCase()))}function bb(e){if(fb.has(e.split("=",1)[0]??e))return!0;if(e.startsWith("--"))return!1;let t=e.slice(1).split("");return gb.has(t[0]??"")||t.every((n)=>pb.has(n))}function ku(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)&&!cb.has(r)))return v("dd.device-write",ob);if(Tu.test(e)&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",ib);if(Sb(e,n))return v("disk.erase",sb);if(e==="shred"&&n.length>0)return v("shred.target",lb);return null}function Ou(e){return e.some((t)=>yb.has(t.operator)&&t.target?.provenance==="literal"&&hb.test(t.target.text))?v("redirect.block-device",ab):null}import{isAbsolute as Eb,resolve as Du}from"node:path";function Sr(e,t,n,r){let o=Eb(e)?Du(e):t?Du(t,e):void 0;if(!o)return;try{return W(o,n,r)}catch{return o}}function Mu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var An="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",br="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ga=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),vb=new Set(["-p","--print"]),Rb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),_b=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),wb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),xb=new Map([["python",new Set(["m"])]]),Ab=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Pb=new Set(["always","default","never"]),Tb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Ib=/\\\r?\n/g,kb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Nu(e){return Wo(e).code}function Lo(e){return Wo(e).sources}function Lu(e){return kb.get(ya(e))??[]}function Wo(e){let t=ya(e[0]??"");if(!ga.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return $e(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return $e(t,n,r,o,i,s);if(t==="node"&&vb.has(s)){let f=e[i+1];if(f===void 0)return $e(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(Db(t,s)){let f=e[i+1];if(f===void 0)return $e(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return $e(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Mb(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=Ob(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,$e(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return $e(t,n,r,o);if(Ab.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&Tb.has(s))||t==="python"&&!Pb.has(f))return $e(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let u=s[f];if(u===void 0)break;if(xb.get(t)?.has(u)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return $e(t,n,r,o)}if(Rb.get(t)?.has(u)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(_b.get(t)?.has(u)){if(f+1===s.length)i++;break}if(wb.get(t)?.has(u)&&f+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return $e(t,n,r,o);if(c)i++}return $e(t,n,r,o,void 0,void 0,!0)}function $e(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Ob(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ha(e,t){return ya(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ya(e){let t=M(e).toLowerCase();return so.test(t)?"python":t}function Db(e,t){return ga.get(e)?.has(t)??!1}function Mb(e){return ga.get(e)?.has("--eval")??!1}function Er(e,t,n=!1){let r=Wb(e,t);if(!pa(r,t))return!1;_e(t,r);let o=Lb(r);if(pa(o,t))return!0;if(_e(t,o),!Wu.test(o))return!1;return!n||Nb(r,t)}function Nb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,f=l+d.length,u=f;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:f,text:e.slice(f,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Wu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Go(i,c)}});if(s.some((l)=>Ca(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((f)=>l.start>=f.start&&l.start<f.end);return(c||d)&&pa(l.text,t)})}function Go(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ca(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Wu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Lb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function pa(e,t){if(Do(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(_e(t,e),r.test(e))return!0;if(Do(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(_e(t,e),r.test(e))return!0;if(Do(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(_e(t,e),n.some((o)=>Mo(o,r))))}function Wb(e,t){return _e(t,e),e.replace(Ib,"")}import{lstatSync as ME,readdirSync as NE}from"node:fs";import{basename as LE,isAbsolute as cm,join as WE,relative as dm}from"node:path";import{isAbsolute as Hu,parse as Kb}from"node:path";import{dirname as Gb,isAbsolute as Fb,parse as zb,sep as $b}from"node:path";function Et(e,t,n){if(nt(t))throw Error("Unsupported Windows namespace path");let r=Fb(t)?zb(t).root:"",o=r||e;for(let i of Ub(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Gb(o);continue}let s=Bb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Bb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${$b}${t}`}function Ub(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Sa=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Hb=new Set(Sa),jb=1024,Gu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Fu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Vb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Fo(e){return Hb.has(e)}function ba(e){return Fo(e)||Gu.has(e)||Fu.has(e)||rr(e)}function at(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function zu(e,t){let n=at("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=jb?{state:"valid",count:r}:{state:"invalid"}}function zo(e,t,n){let o=e.match(Vb)?.[1];if(!o||!ba(o))return null;let i=e.indexOf("=");return{name:o,value:`${at(o,t,n)??""}${e.slice(i+1)}`}}function $u(e){return Uu(e,Fu)}function Bu(e){return Uu(e,Gu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Vu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Me(e){if(!Vu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function $o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Me(x(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ku(e){let t=N(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function qt(e,t,n,r){if(!Ku(Pn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<q.wrapperPeelIterations.cap;f++){let u=ju(i),m=$o(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&Pn(i).includes("=")&&!Yb(i)){let g=Zb(Pn(i),a,t.env)??zo(Pn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=N(Pn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Jb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=tE(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=nE(i);if(p==="builtin")i=i.slice(Be(i,1)==="--"?2:1);if(ju(i)===u)break}let d=$o(i);for(let[f,u]of d.envAssignments)s.set(f,u),a.set(f,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:qb(d.words,o)}}function qb(e,t){return e.some((n)=>!t.has(n))}function ju(e){return e.map(x).join(" ")}function Pn(e){let t=e[0];return t?x(t):""}function Be(e,t){let n=e[t];return n?x(n):void 0}function Yb(e){return Vu.test(Pn(e))}function Zb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Xb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Jb(e,t,n){let r=1,o=n;while(r<e.length){let i=Be(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Be(e,r+1);o=s?vr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=vr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=vr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Xb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Qb=new Set(["-i","-0","--null"]),eE=new Set(["-u","--unset","-C","--chdir","-P"]);function tE(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Be(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(Qb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Be(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Be(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(eE.has(c)){if(c==="-C"||c==="--chdir"){let f=Be(e,a+1);s=f?vr(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=vr(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Me(c))break;while(a<e.length){let f=Me(Be(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Be(e,a)==="--")a++;return l(a)}return l(a)}function vr(e,t,n){if(t==="")return null;if(!e&&!Hu(t))return null;let r=Hu(t)?Kb(t).root:n.realpath(e??"/");if(r===null)return null;try{return Et(r,t,n)}catch{return null}}function nE(e){if(Be(e,1)==="-v")return[...X(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Be(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var rE=/['"\\$`{}#]/;function Bo(e,t){if(e.some((r)=>rE.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function vt(e,t,n){return Uo(e,t,n).tokens}function oE(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Rt(e,t,n,r=0){let o=Uo(e,t,n),i=(o.envSplitValues??[]).flatMap(oE);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Rt(s,t,n,r+1)}function Uo(e,t,n,r){if(!Ku(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=qt(X(e),t,n,r);return{tokens:o.words.map(x),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ra=Symbol("adopt-as-operand"),iE=new Set(["env","sudo","command","builtin"]),sE=new Set(["&&","||","|&","|","&",";"]),aE=new Set(["<<","<<<",">|"]),qu=new Set(["|","|&"]),lE=/[*@#?$!_-]/,cE=/^\w+(?::\w+)*/,dE=Object.freeze([]),Rr=Object.freeze({kind:"scope",edge:"enter"}),_r=Object.freeze({kind:"scope",edge:"exit"}),uE=Object.freeze([]),mE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),wr=new Set(["bash","sh","zsh","dash","ksh"]),fE=256,Qu=new WeakMap;function em(e,t){let n=t.status==="complete"?new Set(va(t)):new Set,r=hE(e,n);if(lo(r))return Ho("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Yt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ho("structural-limit",r,t);if(o.invalid)return Ho("invalid",r,t);let s=Ho("complete",r,t,o.assignmentFallbacks);return Qu.set(s,Object.freeze(i)),s}function Ko(e,t,n,r,o){let i=o.word??((p)=>p),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[],f=tm(e),u=f.findLastIndex((p)=>p.kind==="operator"&&qu.has(p.operator)),m=u!==-1&&f.some((p)=>p.kind==="redirection"&&p.operator==="<<"&&p.body===void 0);for(let[p,g]of f.entries()){let h=m||p<=u;if(g.kind==="scope"){if(g.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let y=o.segment(a,s,c,null,l,h);if(y)return y;let b=d.pop();if(b===void 0)throw Error("scope exit without a matching enter");s=b.state,a=b.segment,l=b.shellWords,c=b.pipeProducer;continue}if(g.kind==="operator"){if(!g.boundary)continue;let y=o.segment(a,s,c,g.operator,l,h);if(y)return y;s=pE(a,s,n,r),c=a.length>0&&qu.has(g.operator)?a:null,a=[],l=new Set;continue}if(g.kind==="redirection"){if(g.fd!==void 0)l.add(a.length-1);if(g.target===void 0)continue;let y=o.redirection({operator:g.operator,role:g.role,targetOrder:g.targetOrder,target:g.target,...g.body===void 0?{}:{body:g.body,consumer:g.consumer}},s,h);if(y===Ra){l.add(a.length),a.push(i(g.target));continue}if(y)return y;continue}a.push(i(g.text))}return o.segment(a,s,c,null,l,m)}function qo(e){return tm(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Ce(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Ce(i,t);return a?Ce(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function xr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function pE(e,t,n,r){let o=xr(e)?new Map([...t.variables,...gE(e,t.variables)]):t.variables,i=vt([...e],n),s=M(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:me(Ce(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function gE(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Ce(o,t)]]:[]})}function tm(e){return Qu.get(e)??dE}function hE(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ho(e,t,n,r=uE){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Yt(e,t){return e.nodes.flatMap((n,r)=>yE(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function yE(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ue(vE(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ue(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[jo("{"),...Yt(e.body,a),...s?[jo("}")]:[]]:[Rr,Ue("("),...Yt(e.body,a),...s?[Ue(")")]:[],_r]}]}let o=xE(e,r.functions);if(o){if(r.depth>=bt.maxDepth||++r.flags.expansions>fE)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Yu(e,r),jo(";"),...Yt(o,{...r,depth:r.depth+1}),jo(";")]},...Zu(e,t,n,r)]}return[{start:e.span.start,events:Yu(e,r)},...Zu(e,t,n,r)]}function Yu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:rm(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:CE(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function CE(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?rm(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[_a(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:RE(r),targetOrder:aE.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:im(t)}:{}}),...s===void 0?o:o.slice(1)]}function Zu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[_a(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ue(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...nm(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?SE(t,n,r):[]]}function SE(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:nm(n.source.slice(r.span.end,e.span.end),n)}]}function nm(e,t){if(t.depth>=bt.maxDepth)return t.flags.limited=!0,[];let n=ze(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Yt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function rm(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ue("glob"):s!==""||e.quoted&&o.length===0?_a(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Ea(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(Ue(m));continue}s+=m.text,a||=m.glob}continue}let d=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Ea(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Yt(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Rr,...p,_r);continue}let f=d?Yt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Rr,...f,_r);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ue("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Rr,...f,...c.raw.endsWith(")")?[Ue(")")]:[],_r);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ue("(")),...u===1?[Rr]:[],...f,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ue(")")):[],...u===1?[_r]:[])}return l(),o}function Ea(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Xu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Xu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Xu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?EE(e,t+2):Oo(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return bE(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&lE.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?cE:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function bE(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ea(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function EE(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function vE(e){return/^[\r\n]+$/.test(e)?";":e}function Ue(e){return Object.freeze({kind:"operator",operator:e,boundary:sE.has(e)})}function jo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function _a(e){return Object.freeze({kind:"word",text:e})}function RE(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Tn(e){return mE.has(e)||/^python\d/.test(e)}var _E=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function om(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=_E.get(e)?.has(n)??!1;return om(e,t.slice(r?2:1))}function Vo(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Vo(e.slice(1));if(t==="uv"&&e[1]==="run")return Vo(e.slice(2));if(!iE.has(t))return[...e];return Vo(om(t,e.slice(1)))}function im(e){let t=ur(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Vo(n<0?[]:e.words.slice(n).map((r)=>r.text))}function wE(e){let t=im(e)[0];if(t===void 0)return!1;let n=M(t).toLowerCase();return Tn(n)&&!wr.has(n)}function va(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return va(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>va(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(wE(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!PE(t))return r;return[...r,...o]})}function xE(e,t){let n=ur(e);return n===void 0?void 0:t.get(n)}function _t(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function AE(e){if(_t(e.words[0],"git"))return _t(e.words[1],"commit");if(!_t(e.words[0],"gh")||!_t(e.words[2],"create"))return!1;return _t(e.words[1],"pr")||_t(e.words[1],"issue")}function PE(e){return(_t(e.words[0],"cat")||_t(e.words[0],"tee")||AE(e))&&!e.words.some(Ju)&&!e.redirections.some((n)=>Ju(n.target))}function Ju(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Ze="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Yo="Unsupported heredoc syntax",Ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function wt(){return{id:"analysis.dynamic-shell-source",reason:Ar,intent:"stop_and_explain"}}var sm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var wa=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),TE=new Set([...wa,"dir_path","glob","glob_pattern","include_pattern"]),IE=new Set([...wa,"folder","glob","pattern","patterns"]);class He extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class Zt extends Error{name="UnparseableCommandError";constructor(){super(Ze)}}function am(e){let t=kE(),n=er(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:OE(e),store:t}}function In(e,t){return e.commands.find((n)=>n.usages.includes(t))}function lt(e){return In(e,"declared-command")??In(e,"input-candidate")}function ct(e,t){if(!e.includes("$"))return e;return Vi(e,t)}function kE(){let e=new Map,t=new WeakMap,n=(o,i)=>{let s=`${i}\x00${o}`,a=e.get(s);if(a)return a;let l=ze(o,i);return e.set(s,l),l};return{getShellSyntax:(o,i)=>{if(i&&i.source!==o)throw TypeError("Shell syntax source does not match command program source.");let s=i??n(o,"posix"),a=t.get(s);if(a)return a;let l=s.status==="limited"?{status:"structural-limit",source:o,program:s,assignmentFallbacks:[]}:em(o,s);return t.set(s,l),l},getCommandProgram:n,readsAutoAsPowerShell:()=>[...e].some(([o,i])=>o.startsWith("auto\x00")&&i.dialect==="powershell")}}function OE(e){let t=e.route.kind==="grep"?TE:e.route.kind==="glob"?IE:wa;return[...lc(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?uc(e.input):[]]}var DE=new Set(["-S","--suffix"]);function kn(e,t,n,r,o){if(e.status==="structural-limit")throw new He;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ko(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Ce(i.target,s.variables),s)?i.target:null})}function Zo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&DE.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var we="Git metadata and hooks are protected. Ask the user before modifying them.";function um(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Zr(e.invocation.toolName))return null;let a=e.paths.find((l)=>lm(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=lt(e);if(!i)return null;let s=kn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>UE(a,l,t,n,r),isRedirectionTarget:(a,l)=>lm(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Xt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Jo(me(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(xa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(f)=>c?Xo(f,l):GE(f,l);if(n.markerFiles.some(d))return!0;return r&&Aa(n).some(d)}if(xa(a,n))return!0;return r&&Aa(n).some((c)=>Xo(c,a))}function GE(e,t){let n=dm(t,e);if(n===""||n.startsWith("..")||cm(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function FE(e,t,n,r,o){return Xt(e,t,n,!0,r,o)}function zE(e,t,n,r,o){if(!n)return!1;return xa(Jo(me(e,t,r,o)),n)}function lm(e,t,n,r,o,i){let s=Jo(me(e,t,r,o));return i.includes(s)||fm(s,n)}function mm(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Xo(i,Jo(me(s,t,r,o)))))}function xa(e,t){return t.entries.includes(e)||t.directories.includes(e)||fm(e,t)}function fm(e,t){return t.hooksDirectories.some((n)=>Xo(e,n))}var $E=50000;function pm(e,t){let n=[...new Set(Aa(e))];if(n.some((o)=>t(LE(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=BE(o);if(!i)return!0;if(r+=i.length,r>$E)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>WE(o,s.name)))}return!1}function BE(e){try{let t=ME(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return NE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Xo(e,t){let n=dm(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!cm(n)}function Jo(e){return process.platform==="win32"?e.toLowerCase():e}function UE(e,t,n,r,o){if(xr(e))return null;let i=Rt([...e],r);if(M(i[0]??"").toLowerCase()!=="mv")return null;let s=Zo(i.slice(1)),a=s.sources.find((l)=>FE(Ce(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&zE(Ce(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ni,normalize as XE,parse as JE,posix as vm,resolve as Qt,sep as ka}from"node:path";import{isAbsolute as HE,join as gm,normalize as Cm,parse as jE,sep as hm}from"node:path";var VE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],KE=` 	
-`;function Pr(e,t){if(Jt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Pa(e.get("TMPDIR")??"",t)}function On(e,t){if(e.has("TMPDIR"))return Pa(e.get("TMPDIR")??"",t);let n=Ta(e,t);if(n===void 0)return!0;return Pa(n,t)}function Ta(e,t){return bm(e,t,"TMPDIR")}function Pa(e,t){if(!e)return!1;if(YE(e))return!1;return Dn(e,t)}function Jt(e,t){let n=bm(e,t,"IFS");return n!==void 0&&n!==""&&n!==KE}function Dn(e,t){let n=Qo(e,t.paths);if(n===null)return!1;return Sm(t).some((r)=>xt(n,r))}function ti(e,t){let n=Qo(e,t.paths);if(n===null)return!1;return Sm(t).some((r)=>ei(r)===ei(n))}var ym=new WeakMap;function Sm(e){let t=ym.get(e);if(t)return t;let n=qE(e);return ym.set(e,n),n}function qE(e){let t=VE.map((r)=>Qo(r,e.paths)??Cm(r)),n=Qo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&ZE(n))return[...t,n];return t}function YE(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function bm(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function ZE(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Qo(e,t){try{let n=Cm(e);if(!HE(n))return n;let r=jE(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=gm(i,o[s]??"");if(t.entryKind(a)==="missing")return gm(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function xt(e,t){let n=ei(e),r=ei(t);if(n===r)return!0;let o=r.endsWith(hm)?r:`${r}${hm}`;return n.startsWith(o)}function ei(e){return process.platform==="win32"?e.toLowerCase():e}var QE=process.platform==="win32",Em=64,ev=16384;function en(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Tr(e){let t=su(e,Em,Em,ev);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:tv(e)}}function tv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>nv(e.raw,n.span.start-e.span.start))}function nv(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Xe(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Te();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:lv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function xe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&dv(e))return{kind:"outside_anchored_cwd"};let o=!r&&_m(e,t.posixShell);if(nt(e))return{kind:"outside_anchored_cwd"};if(Oa(e,r))return{kind:"root_or_home_target"};if(ov(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Xt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(iv(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(cv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&pv(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>gv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(hv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(rv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function rv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ni(r)||r.startsWith("~"))return!1;if(Da(r))return!1;if(wm(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Dn(Qt(t.resolvedCwd,r),t.environment)}function Rm(e,t,n={}){let{containmentTarget:r,...o}=n;if(xe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(av(i))return!1;if(ti(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>wm(r??i,s,t.environment.paths,t.budget))}function Oa(e,t=!1){let n=e.trim(),r=vm.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function ov(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ni(o)?o:t.resolvedCwd?Qt(t.resolvedCwd,o):null;if(!i)return!1;let s=Se(W(i,t.environment.paths,t.budget));if(s===JE(s).root)return!0;return s===Se(W(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Se(e){let t=XE(e);if(QE){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function iv(e,t,n,r,o,i,s,a){let l=e.trim();if(Da(l))return!1;if(!r&&Dn(l,a))return!0;return(t||i&&s)&&n&&!o&&sv(l,n)}function sv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!_m(e.slice(n.length+1),t)})}function av(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return vm.normalize(`/${t[1]??""}`)==="/"}function Da(e){return e.split(/[\\/]+/).includes("..")}function lv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=ar(o.trim(),t);if(!ni(i))return[];try{let s=W(i,n,r);if(lr(s,W(t,n,r)))return[];return[Se(s)]}catch{return[]}})}function cv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Da(r))return!1;let o=n?r:ar(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ni(o)?o:i?Qt(i,o):null;if(!s)return!1;try{let a=Se(W(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ka)?l:`${l}${ka}`))}catch{return!1}}function dv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function _m(e,t=!1){return e.includes("$")||e.includes("`")||uv(e)||t&&mv(e)}function uv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function mv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&fv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function fv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function pv(e,t,n,r){try{return Se(W(e,n,r))===Se(W(t,n,r))}catch{try{return Se(e)===Se(t)}catch{return!1}}}function gv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Se(W(Qt(t,e),n,r))===Se(W(o,n,r))}catch{try{return Se(Qt(t,e))===Se(o)}catch{return!1}}}function hv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ia(Qt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ia(Qt(a,e),t,i,s)}catch{return!1}}function Ia(e,t,n,r){try{return xm(W(e,n,r),W(t,n,r))}catch{return!1}}function wm(e,t,n,r){if(!t)return!1;try{return xm(W(t,n,r),W(e,n,r))}catch{return!0}}function xm(e,t){let n=Se(e),r=Se(t);return n.startsWith(`${r}${ka}`)||n===r}var yv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Am="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Pm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Tm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Sv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",Ev={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Tm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:we},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Pm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Sv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Am},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Cv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Am}};function Im(e,t,n){return vv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,Xe({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function vv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=_v(o),s=o[i];if(!s||!yv.has(Dv(s.text)))return null;let a=Rv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",bv);for(let l of a.targets)if(!nt(l.text)&&Oa(Ir(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Tm);for(let l of a.targets)if(n.resolvedCwd&&Xt(Ir(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",we);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Pm);for(let l of a.targets){let c=en(xe(Ir(l.text),n),n,r,Ev);if(c)return c}return null}function Rv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(wv(l))continue;if(s){t.push(Ma(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Av(l.text);if(!c){t.push(Ma(l)),i=i||l.dynamic;continue}if(Pv(c.name)){let d=c.value?xv(c.value,l):e[++a];if(d?.kind==="word"){t.push(Ma(d)),i=i||d.dynamic;continue}i=!0;continue}if(Tv(c.name)){n=!0;continue}if(Iv(c.name)){r=!0;continue}if(kv(c.name))o=Ov(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function _v(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Ma(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function wv(e){return e.kind==="word"&&e.text===","}function Ir(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function xv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Av(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Pv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function Tv(e){return"recurse".startsWith(e)}function Iv(e){return e.length>=2&&"force".startsWith(e)}function kv(e){return e==="wi"||"whatif".startsWith(e)}function Ov(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Dv(e){return e.toLowerCase()}var Mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Nv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Lv=new Set(["-o","--output","--query","--subscription"]),Wv=new Set;function km(e){if(e==="aws")return Mv;if(e==="gcloud")return Nv;if(e==="az")return Lv;return Wv}var Gv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Fv=new Set;function Om(e){if(e==="git")return ve;if(e==="docker")return Gv;return Fv}function dt(e,t){if(e.length===0||t.length===0)return null;let n=N(e[0]??""),r=ye(e);for(let o of t){if(!Bv(n,o.command))continue;if(o.match){if(zv(n,e,o.match))return Dm(o);continue}if(!Uv(n,e,o.subcommand))continue;if(jv(e,new Set(o.block_args),r))return Dm(o)}return null}function Dm(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function zv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return $v(r,n.command_path,km(e))}function $v(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Bv(e,t){return e===N(t)}function Uv(e,t,n){if(!n)return!0;return Mm(t,1,n,Om(e))}function Mm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Hv(e,i,n,r))return!0;continue}return s===n}return!1}function Hv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Mm(e,t+2,n,r)}function jv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Vv=new Set(["-e","--source"]),Kv=new Set(["-F","-v","--assign","--field-separator"]),Nm=new Set(["-f","--file"]),qv=new Set(["print","printf","return"]),Lm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Yv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Wm(e,t,n){let r=!1;for(let o of Zv(e)){let i=Xv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Yv):null}function La(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Vv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Kv.has(a)||Nm.has(a))){let l=e[s+1];if(i&&=l!==void 0,Nm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Or(e){return La(e).sources}function Zv(e){return Or(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Xv(e,t){_e(t,e);let n=e.includes("system")?Wa(e,t):null,r=Jv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Wa(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=oi(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Gm(e,i+1);continue}if(s==="/"&&Fm(e,i)){i=zm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,kr(e[a-1])||kr(e[i]))continue;let l=ri(e,i);if(e[l]!=="(")continue;l=ri(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=oi(e,l,c);if(!d){r=!0,o=!0;continue}if(l=ri(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Jv(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let m=oi(e,i,d);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(d==="#"){i=Gm(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Fm(e,i)){let m=zm(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Na(e,i,"print")||Na(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,u=ri(e,f);if(Na(e,u,"getline")){o=!0;let m=tR(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(rR(s,a)){o=!0;let m=eR(e,u);if(!m){r=!0,c=f,i=f;continue}if(!Qv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function kr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function ri(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Qv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function oi(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=nR(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function eR(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return oi(e,t,n)}function tR(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function nR(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Na(e,t,n){return e.startsWith(n,t)&&!kr(e[t-1])&&!kr(e[t+n.length])}function rR(e,t){return t!==null&&t>=e}function Gm(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Fm(e,t){let n=oR(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(kr(e[r-1]))r--;return qv.has(e.slice(r,n+1))}function oR(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function zm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var iR=new Set(["sudo","env","command","builtin"]),sR=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function ii(e,t){let n=e[0];if(!n||!$m(M(n),t))return null;let r=M(n),o=e[1]==="--"?2:1,i=aR(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function aR(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=M(a)!==n&&lR(a,r);if(l)i.push(s);if(!l&&ao.has(N(a)))break;if(o)break}return i}function lR(e,t){let n=M(e),r=N(e);return r==="git"||n==="busybox"||tn(e)||Rs.has(n)||Iu(r)||$m(n,t)||J.has(r)||e==="$SHELL"||Fe(r)||ke.has(r)||t.rules.some((o)=>o.command===n)}function $m(e,t){return sR.has(e)||t.transparentWrappers.includes(e)}function tn(e){return iR.has(e.toLowerCase())}function nn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function je(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return si([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*si(e,t,n,r,o,i,s,a,l){let c=Uo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:d,cwd:f}=c;if(c.envSplitValues){let m=Bo(c.envSplitValues,d);if(!m)throw new F("derivedCommandShape");Ga(a),yield*si(m,t,f,r,o,i,s,a,l);return}if(tn(d[0]??""))throw new F("wrapperPeelIterations");let u=ii(d,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])Ga(a),yield*si(m===u.childIndex?u.tokens:d.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(dR(d)){Ga(a),yield*si(d.slice(1),t,f,r,o,i,s,a,l);return}yield cR(d,f,r,o,i,l)}function cR(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:M(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ga(e){if(e.iterations>=q.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function dR(e){return M(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Fa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ut(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||za(r,"recursive")){t=!0;continue}if(r==="-f"||za(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function ai(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>za(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function za(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var uR=["--init-file","--rcfile"],mR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ne(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Um(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Um(e,t,!1);if(r!==null)return r}}return null}var Bm=/^-[cn]+$/;function Ve(e){let t=e.slice(1);if(t.some((r)=>/^[-+]./.test(r)&&r!=="--"&&!Bm.test(r)))return!1;let n=t.findIndex((r)=>!Bm.test(r));return t.slice(0,n===-1?void 0:n).some((r)=>r.includes("n"))}var fR=/^-[abcefhiklmnprstuvx]+$/;function li(e){let t=e.findIndex((i,s)=>s>0&&!fR.test(i)),n=t===-1||/^[-+]/.test(e[t]??"")?e.slice(1):e.slice(1,t+1);if(n.some((i)=>i.startsWith("+")))return!0;let r=n.filter((i)=>i.startsWith("-")&&!i.startsWith("--")&&i.includes("c"));if(r.length===0)return!1;let o=Ne(e);if(o===null)return n.some((i)=>i.startsWith("-")&&!r.includes(i));return/^[-+]/.test(o)||r.some((i)=>/[oO]/.test(i))}function Um(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Hm(e){let t=M(e[0]??"").toLowerCase(),n=pR(e,t),r=mR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function pR(e,t){let n=Oe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?uR.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Es.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=vs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var gR="find -delete permanently removes files. Use -print first to preview.",hR="find -exec rm -rf is dangerous. Use explicit file list instead.",yR=new Set(["-exec","-execdir","-ok","-okdir"]),CR=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function jm(e,t){let n=e.map(x),r=SR(e,n,t);if(r)return r;if(ci(n,1)&&!wR(e,n,t)){let s=I(v("find.delete",gR),t.policy);if(s)return s}let o=t.budget??Te(),i=0;while(i<n.length){let s=n[i],a=mt(s??"");if(a>0){i+=a+1;continue}if(!Je(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Mn(n,i);i=l.nextIndex;let c=AR(l.tokens,t.environment);if(c){let m=I(c,t.policy);if(m)return m}let d=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?.(l.tokens,d?null:t.cwd)??null,u=f?.id.startsWith("custom.")?f:I(f,t.policy);if(u)return u}return null}function SR(e,t,n){if(!ci(t,1)&&!$a(t,n.environment))return null;let o=Dr(e)??X(["."]),i=Xe({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Tr(s);for(let l of a.expandedTargets??[x(s)]){let c=xe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!bR(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",we)}}if(_R(t)&&i.resolvedCwd&&mm(o.map(x),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",we);return null}function bR(e,t,n){if(!t)return!1;let r=e.map(x),o=[],i=!1,s=Dr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(Je(l)){let c=Mn(r,a),d=Rt([...c.tokens],n),f=ai(d),u=J.has(M(d[0]??"").toLowerCase()),m=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(f||u||m||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(vR(c.text,l==="-iname"));a+=2;continue}if(!ER.has(l))return!1;a+=1+mt(l)}return o.length>0&&!pm(t,(l)=>o.every((c)=>c.test(l)))}var ER=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function vR(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var RR=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function $a(e,t){let n=0;while(n<e.length){if(!Je(e[n])){n++;continue}let r=Mn(e,n),o=Rt([...r.tokens],t),i=M(o[0]??"").toLowerCase(),s=J.has(i)&&RR.test((Ne(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function _R(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function wR(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Dr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ta(o,n.environment),s=n.trustedTmpdirValue??On(o,n.environment),a=n.allowTmpdirVar??!Pr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Jt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Xe(l),d=Xe({...l,cwd:n.originalCwd??n.cwd}),f=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),m=f&&u&&!xt(u,f)?n.cwd:void 0;return r.every((p)=>{let g=Tr(p);if(g.unsafeBraceExpansion)return!1;return(g.expandedTargets??[x(p)]).every((h)=>{let y=/^\.\/*$/.test(h)?m:void 0,b=y??h,S={targetIsLiteral:g.expandedTargets!==void 0||g.targetIsLiteral,tmpdirWordSplittingProtected:g.tmpdirWordSplittingProtected};if(!re(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&xe(b,c,S).kind==="within_anchored_cwd")return!0;return Rm(b,y?d:c,{...S,containmentTarget:xR(b,i)})})})}function xR(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Dr(e){let t=(o)=>{let i=e[o];return i?x(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function AR(e,t){let n=vt([...e],t);if(n.length===0)return null;let r=M(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=M(n[0]??"");if(r==="rm"&&ut(n))return v("find.exec-rm-recursive-force",hR);return null}function Mn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function ci(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Je(r)){n=Mn(e,n).nextIndex;continue}let o=mt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function mt(e){return CR.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Je(e){return e!==void 0&&yR.has(e)}import{resolve as ew}from"node:path";function Mr(e){let t=ze(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var PR=5,Ba="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function le(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Km(e,t,n){let r=Nn(e,t,n),o=TR(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<PR;a++){let{subcommand:l,rest:c}=Ae(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(d),u=MR(f);if(u===null||u.length===0)return{blockedReason:Ba,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:Ba,expanded:!0,tokens:i}}function qm(e,t,n){return Nn(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ae(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?M(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function TR(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Nn(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?M(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=kR(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...IR(e,t,n)]}}function IR(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ua(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ua(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Vm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Vm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function kR(e,t){let n=OR(e,t),r=DR(e,t);return{blockedReason:n===null||r===null?Ba:null,entries:[...n??[],...r??[]]}}function OR(e,t){let n=at("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Mr(n);if(!o)return null;for(let i of o){let s=Ua(i);if(!s)return null;r.push(s)}return r}function DR(e,t){let n=zu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=at(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=at(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ua(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Vm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:at(e.slice(r+1),t,n)}}function MR(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Mr(t)}var NR="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",LR="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",WR="git checkout --force discards uncommitted changes. Use 'git stash' first.",GR="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",FR="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",zR="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",$R="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",BR="git switch --force discards uncommitted changes. Use 'git stash' first.",UR="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",HR="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",jR="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",VR="git reset --merge can lose uncommitted changes. Use 'git stash' first.",KR="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",qR="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",YR="git push --force destroys remote history. Use --force-with-lease for safer force push.",ZR="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",XR="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",JR="git branch -D force-deletes without merge check. Use -d for safe delete.",QR="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",e_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",t_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",n_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",r_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",o_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",i_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",s_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),a_=new Set(["--recurse-submodules","--track","-t"]),Ha=new Set(["-b","-B","-U"]),ja=new Set(["-c","-C"]),l_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function L(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Ln=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zm(e,t){let{subcommand:n,rest:r}=Ae(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return At(c_(r,t));case"switch":return At(u_(r));case"restore":return At(f_(r));case"reset":return g_(r);case"clean":return At(y_(r));case"rm":return At(C_(r));case"push":return rn(S_(r));case"branch":return rn(v_(r));case"stash":return rn(A_(r));case"worktree":return rn(P_(r));case"rebase":return At(R_(r));case"merge":return At(__(r));case"tag":return rn(w_(r));case"reflog":return rn(x_(r));default:return null}}function At(e){return e?{...e,localDiscard:!0}:null}function rn(e){return e?{...e,localDiscard:!1}:null}function c_(e,t){let{index:n,before:r}=le(e),o=ye(r,{shortOptsWithValue:Ha});if(r.some((a)=>L(a,"--force"))||o.has("-f"))return v("git.checkout-force",WR);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(L(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",FR)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",GR);return v("git.checkout-double-dash",NR)}let i=m_(e);if(i.length>=2)return v("git.checkout-ambiguous",zR);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>L(a,"--detach")||L(a,"--track")))return null;if(d_(s)||t(s))return v("git.checkout-double-dash",LR);return null}function d_(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function u_(e){let{before:t}=le(e);if(t.some((r)=>L(r,"--discard-changes")))return v("git.switch-discard-changes",$R);let n=ye(t,{shortOptsWithValue:ja});if(t.some((r)=>L(r,"--force"))||n.has("-f"))return v("git.switch-force",BR);return null}function m_(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(s_.has(r)){n+=2;continue}if(a_.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function f_(e){let t=p_(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",HR):v("git.restore-unstaged",UR)}function p_(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(l_.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function g_(e){let t=null;for(let n of e){if(L(n,"--hard")){t=v("git.reset-hard",jR);break}if(L(n,"--merge")){t=v("git.reset-merge",VR);break}}if(!t)return null;return h_(e)?rn(t):At(t)}function h_(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function y_(e){for(let n of e)if(n==="-n"||L(n,"--dry-run"))return null;let t=ye(e.filter((n)=>n!=="--"));if(e.some((n)=>L(n,"--force"))||t.has("-f"))return v("git.clean-force",KR);return null}function C_(e){let t=!1,n=!1,r=!1;for(let o of le(e).before){if(L(o,"--no-force")){t=!1;continue}if(L(o,"--force")){t=!0;continue}if(L(o,"--no-cached")){n=!1;continue}if(L(o,"--cached")){n=!0;continue}if(L(o,"--no-dry-run")){r=!1;continue}if(L(o,"--dry-run")){r=!0;continue}let i=ye([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",qR):null}function S_(e){let{before:t,after:n}=le(e),r=ye(t);if(t.some((s)=>L(s,"--mirror")))return v("git.push-mirror",XR);if(t.some((s)=>L(s,"--force"))||r.has("-f")||Ym(t,n).some(b_))return v("git.push-force",YR);if(t.some((s)=>L(s,"--delete"))||r.has("-d")||Ym(t,n).some(E_))return v("git.push-delete",ZR);return null}function Ym(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function b_(e){return e.startsWith("+")||e.includes(":+")}function E_(e){return e.length>1&&e.startsWith(":")}function v_(e){let{before:t}=le(e),n=ye(t),r=n.has("-D")||n.has("-d")||t.some((i)=>L(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>L(i,"--force"));if(r&&o)return v("git.branch-force-delete",JR);return null}function R_(e){let{before:t}=le(e);return t.some((n)=>L(n,"--abort"))?v("git.rebase-abort",QR):null}function __(e){let{before:t}=le(e);return t.some((n)=>L(n,"--abort"))?v("git.merge-abort",e_):null}function w_(e){let{before:t}=le(e);return ye(t).has("-d")||t.some((r)=>L(r,"--delete"))?v("git.tag-delete",t_):null}function x_(e){return e[0]==="delete"?v("git.reflog-delete",n_):null}function A_(e){for(let t of e){if(t==="drop")return v("git.stash-drop",r_);if(t==="clear")return v("git.stash-clear",o_)}return null}function P_(e){let{before:t}=le(e);if(!t.includes("remove"))return null;let r=ye(t);if(t.some((o)=>L(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",i_);return null}import{isAbsolute as Y_,join as Z_,resolve as X_}from"node:path";var Ka="TMPDIR",qa="IFS",Jm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qm=/^[A-Za-z_][A-Za-z0-9_]*$/,ef=new Set(["export","typeset","declare","readonly"]),T_=new Set(["builtin","command","time"]),I_=new Set(["do","then","else"]),k_=new Set(["do","then","case"]),Xm=new Set(["done","fi","esac"]),O_=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function tf(e,t){return e.map((n)=>n.provenance==="variable"&&cf(n.text)?nf(n.text,t.shellAssignments):x(n))}function nf(e,t){return e.replace(O_,(n,r,o)=>t.get(r??o??"")??n)}function Qe(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=nf(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function rf(e,t){return{env:e,effectiveEnvAssignments:L_(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function of(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ya(e,t){let n=af(e,t),r=e[0]??"";if(k_.has(r))t.bodyDepth+=1;if(r==="elif"||Xm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Xm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Za(t,a)});let o=n.commandIndex;if(o!==-1&&ef.has(e[o]??""))e.filter((a)=>Qm.test(a)&&Va(a)).forEach((a)=>{W_(t,a)});let i=o===-1?-1:lf(e,o);if(i===-1||e[i]!=="unset")return;let s=F_(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}G_(t,a)})}function sf(e,t){let n=af(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function af(e,t){let n=I_.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!cf(a)),o=r!==-1&&ef.has(e[lf(e,r)]??""),i=N_(t);return{assignments:e.flatMap((a,l)=>{let c=D_(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Fo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function lf(e,t){let n=t;while(T_.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function cf(e){return Me(e)!==null||Jm.test(e)}function D_(e,t,n){return Me(e)??M_(e,t,n)}function M_(e,t,n){let r=zo(e,n,t);if(r)return r;let o=e.match(Jm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Va(e){return e===Ka||e===qa||ba(e)}function N_(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function L_(e,t){let n=[Ka,qa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Za(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function W_(e,t){Za(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function G_(e,t){if(!Va(t)&&!Qm.test(t))return;if(e.shellAssignments.set(t,""),Fo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Va(t)||t===Ka||t===qa||rr(t)){Za(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function F_(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{dirname as uf,join as di,resolve as z_}from"node:path";function ui(e,t){return Sa.some((n)=>t?.has(n)||e.has(n))}function Wn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(z_(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=df(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=df(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function df(e,t,n){try{let r=Et(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Nr(e,t){if(t.entryKind(di(e,".git"))!=="missing")return e;let n=uf(e);return n===e?null:Nr(n,t)}function mi(e,t,n,r,o){let i=r.paths,s=di(n,".git"),a=i.isDirectory(s),l=a&&!r.isGitDirectory(s),c=mf(t).filter((d)=>l||d!==n&&xt(d,n));return Nn(e,r.env,o).entries.some((d)=>d.key.toLowerCase()==="core.worktree")||c.some((d)=>i.entryKind(di(d,"HEAD"))!=="missing"||d!==n&&i.entryKind(di(d,".git"))!=="missing")||a&&r.gitDirectoryRedirects(s)}function mf(e){let t=uf(e);return t===e?[e]:[e,...mf(t)]}function ff(e,t,n){if(!t.localDiscard||!n.worktreeMode||ui(n.environment.env,n.envAssignments))return null;let r=Wn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd),i=Nr(r.gitCwd,n.environment.paths);if(!o||i===null||mi(e,r.gitCwd,i,n.environment,n.envAssignments))return null;if(Xa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Xa(e,t,n){let{subcommand:r,rest:o}=Ae(e),i=r?.toLowerCase();if(t.dynamicArguments||$_(o)||V_(e,t.environment.env,t.envAssignments,n)||H_(o)||B_(i,o))return!0;return i==="clean"&&j_(o)>1}function $_(e){return e.some((t)=>/[$*?[]/.test(t))}function B_(e,t){if(e==="checkout"){let{before:n}=le(t),r=ye(n,{shortOptsWithValue:Ha}),o=n.some((s)=>L(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=le(t),r=ye(n,{shortOptsWithValue:ja}),o=n.some((s)=>L(s,"--force"))||n.some((s)=>L(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||U_(s))||r.has("-C");return o&&i}return!1}function U_(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function H_(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function j_(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function V_(e,t,n,r){if(at("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Nn(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>q_(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||K_(s.value);if(Bu(n))return!0;return r.recursiveSubmodules}function K_(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function q_(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function pf(e,t,n){let r=e.map((l)=>Qe(l,n.shellAssignments??new Map)??x(l)),o=n.environment.paths,i=Wn(r,n.cwd,o),s=n.originalCwd?o.realpath(X_(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||ui(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Q_(e,n.shellAssignments,o):Nr(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!J_(a,i.gitCwd,r,t,n)||!Dn(a,n.environment)||ti(a,n.environment)||xt(s,a)||xt(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function J_(e,t,n,r,o){let i=o.environment.paths,s=Z_(e,".git");if(i.entryKind(s)!=="present"||mi(n,t,e,o.environment,o.envAssignments))return!1;if(i.isDirectory(s))return!0;if(!r.localDiscard)return!1;let l=o.environment.worktreeFacts(e);return l!==null&&!Xa(n,o,l)}function Q_(e,t,n){let r=Ae(e.map(x)).rest,{before:o,after:i}=le(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Qe(l,t??new Map))??a;if(!Y_(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}var tw="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",nw=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function fi(e,t){return gf(e,t)}function gf(e,t,n){let r=e.map(x),o=Km(r,t.environment.env,t.envAssignments),i=o.blockedReason?I(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if(($u(t.envAssignments)||qm(r,t.environment.env,t.envAssignments))&&rw(s))return v("git.ssh-env",tw);let a=Zm(s,(c)=>{let d=Wn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(ew(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=ff(r,a,t)??pf(e,a,t);if(!l)return a;return n?.(l),null}function hf(e,t){let n=null;return{match:gf(e,t,(o)=>{n=o}),relaxation:n}}function rw(e){let{subcommand:t,rest:n}=Ae(e),r=t?.toLowerCase();if(!r)return!1;if(nw.has(r))return!0;if(r==="archive")return le(n).before.some((o)=>L(o,"--remote"));return r==="remote"&&ow(n)}function ow(e){return e.find((t)=>!iw(t))?.toLowerCase()==="update"}function iw(e){return e==="-v"||L(e,"--verbose")||L(e,"--no-verbose")}import{isAbsolute as Nw}from"node:path";function yf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function pi(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Cf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",sw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",aw="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",lw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",cw="rm -rf in home directory is dangerous. Change to a project directory first.",Sf={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:lw},git_metadata_target:{id:"rm.git-metadata",reason:we},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:aw},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:cw},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Cf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:sw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Cf}};function gi(e,t){let n=Xe({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(x),o=ai(r),i=uw(e);for(let s of i){let a=Tr(s.word);if(o&&a.unsafeBraceExpansion){let l=I(en({kind:"outside_anchored_cwd"},n,t.policy,Sf),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=ue(l),d={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Xt(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",we);if(!o)continue;for(let f of dw(c,n,d)){let u=en(f,n,t.policy,Sf),m=I(u,t.policy);if(m)return m}}}return null}function dw(e,t,n){let r=xe(e,t,n);if(r.kind==="cwd_self_target")return[r,xe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=xe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,xe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function uw(e){let t=[],n=!1;for(let r of e.slice(1)){let o=x(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Pt={kind:"none"},on={kind:"dynamic"},mw=new Set(["<","<<","<<-","<<<","<&","<>"]),Ef=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,fw=/^(?:[0-9]+|[@*])$/,pw=bt.maxWords,vf=bt.maxInputLength;function Rf(e){if(!e||M(N(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?u+2:u+1;s.push(da(e,u,y)),u=y;continue}u++;continue}let g=vu(e,u);if(g){f(),s.push(da(e,u,u+g.length)),u+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(Eu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=pa(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,S={kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes};if(s.push({kind:"group",style:"brace",span:{start:u,end:y.next},body:S}),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(m==="}"){f(),s.push(da(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let S=b<n?gu(e,b,n,r,o):void 0,E=S?.next??y;if(l.redirections.push({kind:"redirection",operator:e.slice(u,y),span:{start:u,end:E},...S?{target:S.word}:{}}),S)a.push(...S.issues),l.nested.push(...S.nested),c+=S.words,d||=S.limited;l.end=E,u=E;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(ta({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=gu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return f(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function gu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,f=!1,u=(p)=>{let g=zS(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=ua(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||vu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:vn(e,t,m,i,s,a,s==="literal"?void 0:$S(e,t,m)),next:m,issues:l,nested:c,words:d,limited:f}}function zS(e,t,n,r,o){let i=bu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Eu(r.maxDepth)],nodes:[]},next:a};let l=pa(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes},next:a}}function bu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ua(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ua(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ua(r)}}return t}function $S(e,t,n){let r=ko(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=bu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=BS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function BS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Eu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function ma(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return ma(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(ma)]})}function vu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function US(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function HS(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function da(e,t,n){return{kind:"connector",operator:e.slice(t,n),span:{start:t,end:n}}}function $e(e,t="auto",n=vt){if(t==="powershell"||t==="auto"&&Cu(e.slice(0,n.maxInputLength),n))return fa(e,n);return nu(e,n)}function x(e){return e.provenance==="command-substitution"?e.raw:e.text}function Rn(e,t){return e==="posix"?t:X(t.map((n)=>n.text))}function wn(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function X(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function ga(e,t){return{value:e,work:t}}function _(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function te(e){return e.value.length}function Cr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){Cr(e,t)}function Kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function K(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ha(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function q(e,t,n){if(t+n.length>te(e))return!1;for(let r=0;r<n.length;r++)if(_(e,t+r)!==n[r])return!1;return!0}function st(e,t,n){return!Kt(_(e,t-1))&&q(e,t,n)&&!Kt(_(e,t+n.length))}function at(e,t){return Kt(_(e,t-1))!==Kt(_(e,t))}function se(e){return e===`
+`||e===";"||e==="&"||e==="|"}function xn(e){return e==="|"||e===";"}function Go(e,t,n){let r=ga(e,n);if(t==="rm")return jS(r);if(t==="dd")return KS(r);return Pu(r,!0)}function Fo(e,t,n){let r=ga(e,n);if(t==="rm")return qS(r);if(t==="reset-hard")return xu(r,"--ha","rd");if(t==="reset-merge")return xu(r,"--me","rge");if(t==="clean")return JS(r);if(t==="checkout")return eb(r);if(t==="push-force")return tb(r);if(t==="push-refspec")return nb(r);if(t==="push-delete")return rb(r);if(t==="branch")return ob(r);if(t==="tag")return ab(r);if(t==="restore")return lb(r);return Pu(r,!1)}function jS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=te(e);i++){let s=_(e,i);if(!t){let l=_(e,i+2);if(st(e,i,"rm")&&K(l)&&l!==`
+`)t=!0,i++;continue}let a=VS(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===te(e)){if(o>=0){let l=_u(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(K(s)){if(o<0)continue;if(q(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=_u(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function VS(e,t){if(_(e,t)!=="\\"||_(e,t-1)==="\\")return-1;if(q(e,t,String.raw`\n`))return t+2;if(q(e,t,String.raw`\x0a`)||q(e,t,String.raw`\x0A`))return t+5;if(q(e,t,String.raw`\u000a`)||q(e,t,String.raw`\u000A`))return t+7;return q(e,t,String.raw`\012`)?t+4:-1}function _u(e,t,n){if(Ru(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Ru(e,t,n,"force"))return{recursive:!1,force:!0};if(_(e,t)!=="-"||_(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=_(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Ru(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!q(e,t,"--"))return!1;for(let i=0;i<o;i++)if(_(e,t+i+2)!==r[i])return!1;return!0}function KS(e){let t=!1;for(let n=0;n<te(e);n++){if(se(_(e,n))){t=!1;continue}if(st(e,n,"dd")){t=!0,n++;continue}if(!t||!st(e,n,"of")||!q(e,n,"of=/dev/"))continue;let r=n+8;if(r<te(e)&&!K(_(e,r))&&_(e,r)!=="'"&&_(e,r)!=='"')return!0}return!1}function qS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);){let i=_(e,o);if(o===te(e)||se(i)){t=!1,n=!1,r=!1,o++;continue}let s=ZS(e,o);if(s>=0){if(YS(e,s))return!0;let a=s,l=!1;while(K(_(e,a)))l||=_(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(q(e,o,"--")&&(o===0||K(_(e,o-1)))&&(!_(e,o+2)||K(_(e,o+2))||se(_(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=q(e,o,"--recursive")&&at(e,o+11)||ya(e,o,"recursive"),r||=q(e,o,"--force")&&at(e,o+7)||ya(e,o,"force"),n&&r)return!0;o++}return!1}function ya(e,t,n){if(!q(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=_(e,t+r+2);if(!o||K(o)||se(o))break;if(o!==n[r])return!1;r++}return r>0&&at(e,t+r+2)}function YS(e,t){let n=t,r=!1,o=!1;while(n<te(e)){while(K(_(e,n)))n++;let i=n;while(n<te(e)&&!K(_(e,n)))n++;if(_(e,i)!=="-"||n-i===2&&q(e,i,"--"))return!1;let s=wu(e,i,"recursive"),a=wu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,_(e,i+1)==="-")continue;let l=XS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function wu(e,t,n){return q(e,t,`--${n}`)&&at(e,t+n.length+2)||ya(e,t,n)}function ZS(e,t){if(t>0&&Kt(_(e,t-1)))return-1;let n=t;if(_(e,n)==="\\")n++;if(_(e,n)!=="r")return-1;if(n++,_(e,n)==="\\")n++;if(_(e,n)!=="m"||!K(_(e,n+1)))return-1;return n+1}function XS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(_(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=_(e,c)??"",f=(d==="r"||d==="f")&&at(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&f,s||=d==="f"&&f,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&f,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function xu(e,t,n){return br(e,"reset",xn,!0,(r)=>_(e,r)==="-"&&An(e,r,t,n)?!0:r)}function JS(e){return br(e,"clean",xn,!0,(t)=>{if(_(e,t)!=="-")return t;if(An(e,t,"--fo","rce"))return!0;let n=Sr(e,t,xn);for(let r=t+1;r<n;r++)if(_(e,r)==="f")return!0;return n-1})}function zo(e,t,n){if(!st(e,t,"git"))return null;let r=t+3;if(!K(_(e,r)))return{commandEnd:-1,next:r};while(K(_(e,r)))r++;while(r<te(e)){if(se(_(e,r)))return{commandEnd:-1,next:r};let o=Sr(e,r,se);if(st(e,r,n))return{commandEnd:r+n.length,next:o};if(_(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&q(e,r,"--"),s=QS(e,r,o);r=o;while(K(_(e,r)))r++;if(i)return{commandEnd:st(e,r,n)?r+n.length:-1,next:Sr(e,r,se)};if(!s)continue;if(r>=te(e)||se(_(e,r)))return{commandEnd:-1,next:r};r=Sr(e,r,se);while(K(_(e,r)))r++}return{commandEnd:-1,next:r}}function QS(e,t,n){for(let r of ve)if(n-t===r.length&&q(e,t,r))return!0;return!1}function eb(e){return Au(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function tb(e){return br(e,"push",xn,!0,(t)=>{if(_(e,t)!=="-")return t;if(_(e,t+1)==="f"&&!Kt(_(e,t+2))&&!q(e,t+2,"-with-lease"))return!0;let n=Tu(e,t,"--fo","rce");if(n>=0&&!q(e,n,"-with-lease"))return!0;return t})}function nb(e){return br(e,"push",se,!1,(t)=>{if(K(_(e,t))&&_(e,t+1)==="+"&&t+2<te(e)&&!se(_(e,t+2))&&!K(_(e,t+2)))return!0;if(_(e,t)===":"&&_(e,t+1)==="+")return!0;return t})}function rb(e){return br(e,"push",se,!1,(t)=>{if(_(e,t)==="-"&&An(e,t,"--de","lete"))return!0;if(K(_(e,t))&&_(e,t+1)===":"&&t+2<te(e)&&!K(_(e,t+2))&&!se(_(e,t+2)))return!0;return t})}function ob(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);o++){if(o===te(e)||se(_(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=zo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||_(e,o)!=="-")continue;let i=Sr(e,o,se),s=ib(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ib(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(_(e,i)!=="-")continue;if(An(e,i,"--de","lete"))r=!0;if(An(e,i,"--fo","rce"))o=!0;if(_(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&sb(_(e,s))){let d=_(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!at(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function sb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function ab(e){return Au(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Au(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<te(e);r++){let o=_(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&_(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(K(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=zo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&K(_(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(An(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(_(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&at(e,r+1))return!0;if(xn(o))i.outerActive=!1}return!1}function br(e,t,n,r,o){let i=!1;for(let s=0;s<te(e);s++){let a=_(e,s),l=n(a);if(!i&&!l){let c=zo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||K(_(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(_(e,d)))i=!1;s=c}if(l)i=!1}return!1}function lb(e){let t=!1;for(let n=0;n<te(e);n++){if(ha(_(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=zo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&_(e,n)==="-"&&_(e,n+1)==="-"&&(q(e,n+2,"staged")||q(e,n+2,"help")))t=!1}return t}function Pu(e,t){let n=!1;for(let r=0;r<te(e);r++){let o=_(e,r),i=t?ha(o):se(o);if(n&&K(o)&&_(e,r+1)==="-"&&st(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(st(e,r,"find"))n=!0,r+=3}return!1}function Sr(e,t,n){let r=t;while(r<te(e)&&!K(_(e,r))&&!n(_(e,r)))r++;return r}function Tu(e,t,n,r){if(!q(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&_(e,o)===r[i];i++)o++;return at(e,o)?o:-1}function An(e,t,n,r){return Tu(e,t,n,r)>=0}function De(e,t){Cr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&Fo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var cb=/^[A-Za-z_][A-Za-z0-9_]*=/;function ku(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Cr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Ou(t.nodes,r,i)}function Ou(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Ou(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return db(r,t,n)})}function db(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!cb.test(o.text));return e.words.every((o,i)=>o===t||Iu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Iu(o.target.raw,n.anchored,!0)))}function Iu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var ub="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",mb="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",fb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",pb="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",gb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",hb=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Du=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,yb=new Set(["diskutil","wipefs","sgdisk","parted"]),Cb=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),Sb=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,bb=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),Eb=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),vb=new Set(["i","b"]),_b=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,Rb=new Set([">",">|",">>","<>",">&"]),wb=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Mu(e){return e==="dd"||e==="shred"||Du.test(e)||yb.has(e)}function xb(e,t){let n=t.some((r)=>r.startsWith("/dev/"));if(e==="diskutil"){let r=t.find((o)=>!o.startsWith("-"));return r!==void 0&&Cb.has(r.toLowerCase())}if(e==="wipefs")return n&&t.some((r)=>Sb.test(r));if(e==="sgdisk")return n&&t.some((r)=>r.startsWith("-")&&!Ab(r));return e==="parted"&&n&&t.some((r)=>wb.has(r.toLowerCase()))}function Ab(e){if(bb.has(e.split("=",1)[0]??e))return!0;if(e.startsWith("--"))return!1;let t=e.slice(1).split("");return vb.has(t[0]??"")||t.every((n)=>Eb.has(n))}function Nu(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)&&!hb.has(r)))return v("dd.device-write",ub);if(Du.test(e)&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",mb);if(xb(e,n))return v("disk.erase",fb);if(e==="shred"&&n.length>0)return v("shred.target",gb);return null}function Lu(e){return e.some((t)=>Rb.has(t.operator)&&t.target?.provenance==="literal"&&_b.test(t.target.text))?v("redirect.block-device",pb):null}import{isAbsolute as Pb,resolve as Wu}from"node:path";function Er(e,t,n,r){let o=Pb(e)?Wu(e):t?Wu(t,e):void 0;if(!o)return;try{return W(o,n,r)}catch{return o}}function Gu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var Pn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",vr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Sa=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Tb=new Set(["-p","--print"]),Ib=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),kb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Ob=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Db=new Map([["python",new Set(["m"])]]),Mb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Nb=new Set(["always","default","never"]),Lb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Wb=/\\\r?\n/g,Gb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Fu(e){return Bo(e).code}function $o(e){return Bo(e).sources}function zu(e){return Gb.get(Ea(e))??[]}function Bo(e){let t=Ea(e[0]??"");if(!Sa.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Be(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Be(t,n,r,o,i,s);if(t==="node"&&Tb.has(s)){let f=e[i+1];if(f===void 0)return Be(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(zb(t,s)){let f=e[i+1];if(f===void 0)return Be(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return Be(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if($b(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=Fb(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Be(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Be(t,n,r,o);if(Mb.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&Lb.has(s))||t==="python"&&!Nb.has(f))return Be(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let u=s[f];if(u===void 0)break;if(Db.get(t)?.has(u)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Be(t,n,r,o)}if(Ib.get(t)?.has(u)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(kb.get(t)?.has(u)){if(f+1===s.length)i++;break}if(Ob.get(t)?.has(u)&&f+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Be(t,n,r,o);if(c)i++}return Be(t,n,r,o,void 0,void 0,!0)}function Be(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function Fb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ba(e,t){return Ea(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ea(e){let t=M(e).toLowerCase();return mo.test(t)?"python":t}function zb(e,t){return Sa.get(e)?.has(t)??!1}function $b(e){return Sa.get(e)?.has("--eval")??!1}function _r(e,t,n=!1){let r=Hb(e,t);if(!Ca(r,t))return!1;Re(t,r);let o=Ub(r);if(Ca(o,t))return!0;if(Re(t,o),!$u.test(o))return!1;return!n||Bb(r,t)}function Bb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,f=l+d.length,u=f;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:f,text:e.slice(f,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>$u.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Uo(i,c)}});if(s.some((l)=>va(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((f)=>l.start>=f.start&&l.start<f.end);return(c||d)&&Ca(l.text,t)})}function Uo(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function va(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var $u=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Ub(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ca(e,t){if(Go(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(Go(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(Go(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>Fo(o,r))))}function Hb(e,t){return Re(t,e),e.replace(Wb,"")}import{lstatSync as $E,readdirSync as BE}from"node:fs";import{basename as UE,isAbsolute as fm,join as HE,relative as pm}from"node:path";import{isAbsolute as qu,parse as eE}from"node:path";import{dirname as jb,isAbsolute as Vb,parse as Kb,sep as qb}from"node:path";function _t(e,t,n){if(rt(t))throw Error("Unsupported Windows namespace path");let r=Vb(t)?Kb(t).root:"",o=r||e;for(let i of Zb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=jb(o);continue}let s=Yb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Yb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${qb}${t}`}function Zb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var _a=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Xb=new Set(_a),Jb=1024,Bu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Uu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Qb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ho(e){return Xb.has(e)}function Ra(e){return Ho(e)||Bu.has(e)||Uu.has(e)||ir(e)}function lt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Hu(e,t){let n=lt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Jb?{state:"valid",count:r}:{state:"invalid"}}function jo(e,t,n){let o=e.match(Qb)?.[1];if(!o||!Ra(o))return null;let i=e.indexOf("=");return{name:o,value:`${lt(o,t,n)??""}${e.slice(i+1)}`}}function ju(e){return Ku(e,Uu)}function Vu(e){return Ku(e,Bu)}function Ku(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Zu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Me(e){if(!Zu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Vo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Me(x(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Xu(e){let t=N(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function qt(e,t,n,r){if(!Xu(Tn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let u=Yu(i),m=Vo(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&Tn(i).includes("=")&&!nE(i)){let g=rE(Tn(i),a,t.env)??jo(Tn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=N(Tn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=iE(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=lE(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=cE(i);if(p==="builtin")i=i.slice(Ue(i,1)==="--"?2:1);if(Yu(i)===u)break}let d=Vo(i);for(let[f,u]of d.envAssignments)s.set(f,u),a.set(f,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:tE(d.words,o)}}function tE(e,t){return e.some((n)=>!t.has(n))}function Yu(e){return e.map(x).join(" ")}function Tn(e){let t=e[0];return t?x(t):""}function Ue(e,t){let n=e[t];return n?x(n):void 0}function nE(e){return Zu.test(Tn(e))}function rE(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var oE=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function iE(e,t,n){let r=1,o=n;while(r<e.length){let i=Ue(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ue(e,r+1);o=s?Rr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Rr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Rr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(oE.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var sE=new Set(["-i","-0","--null"]),aE=new Set(["-u","--unset","-C","--chdir","-P"]);function lE(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ue(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(sE.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Ue(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Ue(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(aE.has(c)){if(c==="-C"||c==="--chdir"){let f=Ue(e,a+1);s=f?Rr(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Rr(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Me(c))break;while(a<e.length){let f=Me(Ue(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Ue(e,a)==="--")a++;return l(a)}return l(a)}function Rr(e,t,n){if(t==="")return null;if(!e&&!qu(t))return null;let r=qu(t)?eE(t).root:n.realpath(e??"/");if(r===null)return null;try{return _t(r,t,n)}catch{return null}}function cE(e){if(Ue(e,1)==="-v")return[...X(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ue(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var dE=/['"\\$`{}#]/;function Ko(e,t){if(e.some((r)=>dE.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Rt(e,t,n){return qo(e,t,n).tokens}function uE(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function wt(e,t,n,r=0){let o=qo(e,t,n),i=(o.envSplitValues??[]).flatMap(uE);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return wt(s,t,n,r+1)}function qo(e,t,n,r){if(!Xu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=qt(X(e),t,n,r);return{tokens:o.words.map(x),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Aa=Symbol("adopt-as-operand"),mE=new Set(["env","sudo","command","builtin"]),fE=new Set(["&&","||","|&","|","&",";"]),pE=new Set(["<<","<<<",">|"]),Ju=new Set(["|","|&"]),gE=/[*@#?$!_-]/,hE=/^\w+(?::\w+)*/,yE=Object.freeze([]),wr=Object.freeze({kind:"scope",edge:"enter"}),xr=Object.freeze({kind:"scope",edge:"exit"}),CE=Object.freeze([]),SE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Ar=new Set(["bash","sh","zsh","dash","ksh"]),bE=256,rm=new WeakMap;function om(e,t){let n=t.status==="complete"?new Set(xa(t)):new Set,r=_E(e,n);if(po(r))return Yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Yt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Yo("structural-limit",r,t);if(o.invalid)return Yo("invalid",r,t);let s=Yo("complete",r,t,o.assignmentFallbacks);return rm.set(s,Object.freeze(i)),s}function Jo(e,t,n,r,o){let i=o.word??((p)=>p),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[],f=im(e),u=f.findLastIndex((p)=>p.kind==="operator"&&Ju.has(p.operator)),m=u!==-1&&f.some((p)=>p.kind==="redirection"&&p.operator==="<<"&&p.body===void 0);for(let[p,g]of f.entries()){let h=m||p<=u;if(g.kind==="scope"){if(g.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let y=o.segment(a,s,c,null,l,h);if(y)return y;let b=d.pop();if(b===void 0)throw Error("scope exit without a matching enter");s=b.state,a=b.segment,l=b.shellWords,c=b.pipeProducer;continue}if(g.kind==="operator"){if(!g.boundary)continue;let y=o.segment(a,s,c,g.operator,l,h);if(y)return y;s=EE(a,s,n,r),c=a.length>0&&Ju.has(g.operator)?a:null,a=[],l=new Set;continue}if(g.kind==="redirection"){if(g.fd!==void 0)l.add(a.length-1);if(g.target===void 0)continue;let y=o.redirection({operator:g.operator,role:g.role,targetOrder:g.targetOrder,target:g.target,...g.body===void 0?{}:{body:g.body,consumer:g.consumer}},s,h);if(y===Aa){l.add(a.length),a.push(i(g.target));continue}if(y)return y;continue}a.push(i(g.text))}return o.segment(a,s,c,null,l,m)}function Qo(e){return im(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Se(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Se(i,t);return a?Se(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Pr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function EE(e,t,n,r){let o=Pr(e)?new Map([...t.variables,...vE(e,t.variables)]):t.variables,i=Rt([...e],n),s=M(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ue(Se(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vE(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Se(o,t)]]:[]})}function im(e){return rm.get(e)??yE}function _E(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Yo(e,t,n,r=CE){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Yt(e,t){return e.nodes.flatMap((n,r)=>RE(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function RE(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[He(TE(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[He(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Zo("{"),...Yt(e.body,a),...s?[Zo("}")]:[]]:[wr,He("("),...Yt(e.body,a),...s?[He(")")]:[],xr]}]}let o=DE(e,r.functions);if(o){if(r.depth>=vt.maxDepth||++r.flags.expansions>bE)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Qu(e,r),Zo(";"),...Yt(o,{...r,depth:r.depth+1}),Zo(";")]},...em(e,t,n,r)]}return[{start:e.span.start,events:Qu(e,r)},...em(e,t,n,r)]}function Qu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:am(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:wE(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function wE(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?am(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Pa(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:IE(r),targetOrder:pE.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:cm(t)}:{}}),...s===void 0?o:o.slice(1)]}function em(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Pa(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[He(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...sm(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?xE(t,n,r):[]]}function xE(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:sm(n.source.slice(r.span.end,e.span.end),n)}]}function sm(e,t){if(t.depth>=vt.maxDepth)return t.flags.limited=!0,[];let n=$e(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Yt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function am(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?He("glob"):s!==""||e.quoted&&o.length===0?Pa(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of wa(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(He(m));continue}s+=m.text,a||=m.glob}continue}let d=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=wa(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Yt(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(wr,...p,xr);continue}let f=d?Yt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(wr,...f,xr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?He("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),wr,...f,...c.raw.endsWith(")")?[He(")")]:[],xr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>He("(")),...u===1?[wr]:[],...f,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>He(")")):[],...u===1?[xr]:[])}return l(),o}function wa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=tm(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=tm(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function tm(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?PE(e,t+2):Wo(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return AE(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&gE.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?hE:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function AE(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=wa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function PE(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function TE(e){return/^[\r\n]+$/.test(e)?";":e}function He(e){return Object.freeze({kind:"operator",operator:e,boundary:fE.has(e)})}function Zo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Pa(e){return Object.freeze({kind:"word",text:e})}function IE(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function In(e){return SE.has(e)||/^python\d/.test(e)}var kE=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function lm(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=kE.get(e)?.has(n)??!1;return lm(e,t.slice(r?2:1))}function Xo(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Xo(e.slice(1));if(t==="uv"&&e[1]==="run")return Xo(e.slice(2));if(!mE.has(t))return[...e];return Xo(lm(t,e.slice(1)))}function cm(e){let t=fr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Xo(n<0?[]:e.words.slice(n).map((r)=>r.text))}function OE(e){let t=cm(e)[0];if(t===void 0)return!1;let n=M(t).toLowerCase();return In(n)&&!Ar.has(n)}function xa(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return xa(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>xa(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(OE(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!NE(t))return r;return[...r,...o]})}function DE(e,t){let n=fr(e);return n===void 0?void 0:t.get(n)}function xt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function ME(e){if(xt(e.words[0],"git"))return xt(e.words[1],"commit");if(!xt(e.words[0],"gh")||!xt(e.words[2],"create"))return!1;return xt(e.words[1],"pr")||xt(e.words[1],"issue")}function NE(e){return(xt(e.words[0],"cat")||xt(e.words[0],"tee")||ME(e))&&!e.words.some(nm)&&!e.redirections.some((n)=>nm(n.target))}function nm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Qe="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ei="Unsupported heredoc syntax",Tr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function At(){return{id:"analysis.dynamic-shell-source",reason:Tr,intent:"stop_and_explain"}}var dm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Ta=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),LE=new Set([...Ta,"dir_path","glob","glob_pattern","include_pattern"]),WE=new Set([...Ta,"folder","glob","pattern","patterns"]);class je extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class Zt extends Error{name="UnparseableCommandError";constructor(){super(Qe)}}function um(e){let t=GE(),n=nr(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:FE(e),store:t}}function kn(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ct(e){return kn(e,"declared-command")??kn(e,"input-candidate")}function dt(e,t){if(!e.includes("$"))return e;return Xi(e,t)}function GE(){let e=new Map,t=new WeakMap,n=(o,i)=>{let s=`${i}\x00${o}`,a=e.get(s);if(a)return a;let l=$e(o,i);return e.set(s,l),l};return{getShellSyntax:(o,i)=>{if(i&&i.source!==o)throw TypeError("Shell syntax source does not match command program source.");let s=i??n(o,"posix"),a=t.get(s);if(a)return a;let l=s.status==="limited"?{status:"structural-limit",source:o,program:s,assignmentFallbacks:[]}:om(o,s);return t.set(s,l),l},getCommandProgram:n,readsAutoAsPowerShell:()=>[...e].some(([o,i])=>o.startsWith("auto\x00")&&i.dialect==="powershell")}}function FE(e){let t=e.route.kind==="grep"?LE:e.route.kind==="glob"?WE:Ta;return[...mc(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?gc(e.input):[]]}var zE=new Set(["-S","--suffix"]);function On(e,t,n,r,o){if(e.status==="structural-limit")throw new je;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Jo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Se(i.target,s.variables),s)?i.target:null})}function ti(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&zE.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var we="Git metadata and hooks are protected. Ask the user before modifying them.";function gm(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(eo(e.invocation.toolName))return null;let a=e.paths.find((l)=>mm(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ct(e);if(!i)return null;let s=On(i.shell,o,n,r,{findSegmentTarget:(a,l)=>ZE(a,l,t,n,r),isRedirectionTarget:(a,l)=>mm(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Xt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=ri(ue(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ia(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(f)=>c?ni(f,l):jE(f,l);if(n.markerFiles.some(d))return!0;return r&&ka(n).some(d)}if(Ia(a,n))return!0;return r&&ka(n).some((c)=>ni(c,a))}function jE(e,t){let n=pm(t,e);if(n===""||n.startsWith("..")||fm(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function VE(e,t,n,r,o){return Xt(e,t,n,!0,r,o)}function KE(e,t,n,r,o){if(!n)return!1;return Ia(ri(ue(e,t,r,o)),n)}function mm(e,t,n,r,o,i){let s=ri(ue(e,t,r,o));return i.includes(s)||ym(s,n)}function hm(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>ni(i,ri(ue(s,t,r,o)))))}function Ia(e,t){return t.entries.includes(e)||t.directories.includes(e)||ym(e,t)}function ym(e,t){return t.hooksDirectories.some((n)=>ni(e,n))}var qE=50000;function Cm(e,t){let n=[...new Set(ka(e))];if(n.some((o)=>t(UE(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=YE(o);if(!i)return!0;if(r+=i.length,r>qE)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>HE(o,s.name)))}return!1}function YE(e){try{let t=$E(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return BE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function ka(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function ni(e,t){let n=pm(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!fm(n)}function ri(e){return process.platform==="win32"?e.toLowerCase():e}function ZE(e,t,n,r,o){if(Pr(e))return null;let i=wt([...e],r);if(M(i[0]??"").toLowerCase()!=="mv")return null;let s=ti(i.slice(1)),a=s.sources.find((l)=>VE(Se(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&KE(Se(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ai,normalize as ov,parse as iv,posix as xm,resolve as Qt,sep as Na}from"node:path";import{isAbsolute as XE,join as Sm,normalize as vm,parse as JE,sep as bm}from"node:path";var QE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],ev=` 	
+`;function Ir(e,t){if(Jt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Oa(e.get("TMPDIR")??"",t)}function Dn(e,t){if(e.has("TMPDIR"))return Oa(e.get("TMPDIR")??"",t);let n=Da(e,t);if(n===void 0)return!0;return Oa(n,t)}function Da(e,t){return Rm(e,t,"TMPDIR")}function Oa(e,t){if(!e)return!1;if(nv(e))return!1;return Mn(e,t)}function Jt(e,t){let n=Rm(e,t,"IFS");return n!==void 0&&n!==""&&n!==ev}function Mn(e,t){let n=oi(e,t.paths);if(n===null)return!1;return _m(t).some((r)=>Pt(n,r))}function si(e,t){let n=oi(e,t.paths);if(n===null)return!1;return _m(t).some((r)=>ii(r)===ii(n))}var Em=new WeakMap;function _m(e){let t=Em.get(e);if(t)return t;let n=tv(e);return Em.set(e,n),n}function tv(e){let t=QE.map((r)=>oi(r,e.paths)??vm(r)),n=oi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&rv(n))return[...t,n];return t}function nv(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Rm(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function rv(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function oi(e,t){try{let n=vm(e);if(!XE(n))return n;let r=JE(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Sm(i,o[s]??"");if(t.entryKind(a)==="missing")return Sm(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Pt(e,t){let n=ii(e),r=ii(t);if(n===r)return!0;let o=r.endsWith(bm)?r:`${r}${bm}`;return n.startsWith(o)}function ii(e){return process.platform==="win32"?e.toLowerCase():e}var sv=process.platform==="win32",wm=64,av=16384;function en(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function kr(e){let t=du(e,wm,wm,av);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:lv(e)}}function lv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>cv(e.raw,n.span.start-e.span.start))}function cv(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function et(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Te();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:gv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function xe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&yv(e))return{kind:"outside_anchored_cwd"};let o=!r&&Pm(e,t.posixShell);if(rt(e))return{kind:"outside_anchored_cwd"};if(La(e,r))return{kind:"root_or_home_target"};if(uv(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Xt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(mv(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(hv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Ev(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>vv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(_v(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(dv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function dv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ai(r)||r.startsWith("~"))return!1;if(Wa(r))return!1;if(Tm(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Mn(Qt(t.resolvedCwd,r),t.environment)}function Am(e,t,n={}){let{containmentTarget:r,...o}=n;if(xe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(pv(i))return!1;if(si(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Tm(r??i,s,t.environment.paths,t.budget))}function La(e,t=!1){let n=e.trim(),r=xm.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function uv(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ai(o)?o:t.resolvedCwd?Qt(t.resolvedCwd,o):null;if(!i)return!1;let s=be(W(i,t.environment.paths,t.budget));if(s===iv(s).root)return!0;return s===be(W(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function be(e){let t=ov(e);if(sv){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function mv(e,t,n,r,o,i,s,a){let l=e.trim();if(Wa(l))return!1;if(!r&&Mn(l,a))return!0;return(t||i&&s)&&n&&!o&&fv(l,n)}function fv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Pm(e.slice(n.length+1),t)})}function pv(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return xm.normalize(`/${t[1]??""}`)==="/"}function Wa(e){return e.split(/[\\/]+/).includes("..")}function gv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=cr(o.trim(),t);if(!ai(i))return[];try{let s=W(i,n,r);if(dr(s,W(t,n,r)))return[];return[be(s)]}catch{return[]}})}function hv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Wa(r))return!1;let o=n?r:cr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ai(o)?o:i?Qt(i,o):null;if(!s)return!1;try{let a=be(W(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Na)?l:`${l}${Na}`))}catch{return!1}}function yv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Pm(e,t=!1){return e.includes("$")||e.includes("`")||Cv(e)||t&&Sv(e)}function Cv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function Sv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&bv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function bv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Ev(e,t,n,r){try{return be(W(e,n,r))===be(W(t,n,r))}catch{try{return be(e)===be(t)}catch{return!1}}}function vv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return be(W(Qt(t,e),n,r))===be(W(o,n,r))}catch{try{return be(Qt(t,e))===be(o)}catch{return!1}}}function _v(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ma(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ma(Qt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ma(Qt(a,e),t,i,s)}catch{return!1}}function Ma(e,t,n,r){try{return Im(W(e,n,r),W(t,n,r))}catch{return!1}}function Tm(e,t,n,r){if(!t)return!1;try{return Im(W(t,n,r),W(e,n,r))}catch{return!0}}function Im(e,t){let n=be(e),r=be(t);return n.startsWith(`${r}${Na}`)||n===r}var Rv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),km="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",wv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Om="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Dm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",xv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Av="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",Pv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Dm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:we},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Om},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:xv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:km},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:wv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:km}};function Mm(e,t,n){return Tv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function Tv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=kv(o),s=o[i];if(!s||!Rv.has(zv(s.text)))return null;let a=Iv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",Av);for(let l of a.targets)if(!rt(l.text)&&La(Or(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Dm);for(let l of a.targets)if(n.resolvedCwd&&Xt(Or(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",we);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Om);for(let l of a.targets){let c=en(xe(Or(l.text),n),n,r,Pv);if(c)return c}return null}function Iv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Ov(l))continue;if(s){t.push(Ga(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Mv(l.text);if(!c){t.push(Ga(l)),i=i||l.dynamic;continue}if(Nv(c.name)){let d=c.value?Dv(c.value,l):e[++a];if(d?.kind==="word"){t.push(Ga(d)),i=i||d.dynamic;continue}i=!0;continue}if(Lv(c.name)){n=!0;continue}if(Wv(c.name)){r=!0;continue}if(Gv(c.name))o=Fv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function kv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Ga(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Ov(e){return e.kind==="word"&&e.text===","}function Or(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function Dv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Mv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Nv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function Lv(e){return"recurse".startsWith(e)}function Wv(e){return e.length>=2&&"force".startsWith(e)}function Gv(e){return e==="wi"||"whatif".startsWith(e)}function Fv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function zv(e){return e.toLowerCase()}var $v=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Bv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Uv=new Set(["-o","--output","--query","--subscription"]),Hv=new Set;function Nm(e){if(e==="aws")return $v;if(e==="gcloud")return Bv;if(e==="az")return Uv;return Hv}var jv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Vv=new Set;function Lm(e){if(e==="git")return ve;if(e==="docker")return jv;return Vv}function ut(e,t){if(e.length===0||t.length===0)return null;let n=N(e[0]??""),r=Ce(e);for(let o of t){if(!Yv(n,o.command))continue;if(o.match){if(Kv(n,e,o.match))return Wm(o);continue}if(!Zv(n,e,o.subcommand))continue;if(Jv(e,new Set(o.block_args),r))return Wm(o)}return null}function Wm(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function Kv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return qv(r,n.command_path,Nm(e))}function qv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Yv(e,t){return e===N(t)}function Zv(e,t,n){if(!n)return!0;return Gm(t,1,n,Lm(e))}function Gm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Xv(e,i,n,r))return!0;continue}return s===n}return!1}function Xv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Gm(e,t+2,n,r)}function Jv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Qv=new Set(["-e","--source"]),e_=new Set(["-F","-v","--assign","--field-separator"]),Fm=new Set(["-f","--file"]),t_=new Set(["print","printf","return"]),zm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],n_="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function $m(e,t,n){let r=!1;for(let o of r_(e)){let i=o_(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",n_):null}function za(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Qv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(e_.has(a)||Fm.has(a))){let l=e[s+1];if(i&&=l!==void 0,Fm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Mr(e){return za(e).sources}function r_(e){return Mr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function o_(e,t){Re(t,e);let n=e.includes("system")?$a(e,t):null,r=i_(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function $a(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=ci(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Bm(e,i+1);continue}if(s==="/"&&Um(e,i)){i=Hm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Dr(e[a-1])||Dr(e[i]))continue;let l=li(e,i);if(e[l]!=="(")continue;l=li(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=ci(e,l,c);if(!d){r=!0,o=!0;continue}if(l=li(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function i_(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let m=ci(e,i,d);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(d==="#"){i=Bm(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Um(e,i)){let m=Hm(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Fa(e,i,"print")||Fa(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,u=li(e,f);if(Fa(e,u,"getline")){o=!0;let m=l_(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(d_(s,a)){o=!0;let m=a_(e,u);if(!m){r=!0,c=f,i=f;continue}if(!s_(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function Dr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function li(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function s_(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function ci(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=c_(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function a_(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return ci(e,t,n)}function l_(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function c_(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Fa(e,t,n){return e.startsWith(n,t)&&!Dr(e[t-1])&&!Dr(e[t+n.length])}function d_(e,t){return t!==null&&t>=e}function Bm(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Um(e,t){let n=u_(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Dr(e[r-1]))r--;return t_.has(e.slice(r,n+1))}function u_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Hm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var m_=new Set(["sudo","env","command","builtin"]),f_=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function di(e,t){let n=e[0];if(!n||!jm(M(n),t))return null;let r=M(n),o=e[1]==="--"?2:1,i=p_(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function p_(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=M(a)!==n&&g_(a,r);if(l)i.push(s);if(!l&&fo.has(N(a)))break;if(o)break}return i}function g_(e,t){let n=M(e),r=N(e);return r==="git"||n==="busybox"||tn(e)||As.has(n)||Mu(r)||jm(n,t)||Q.has(r)||e==="$SHELL"||ze(r)||ke.has(r)||t.rules.some((o)=>o.command===n)}function jm(e,t){return f_.has(e)||t.transparentWrappers.includes(e)}function tn(e){return m_.has(e.toLowerCase())}function nn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Ve(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return ui([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*ui(e,t,n,r,o,i,s,a,l){let c=qo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:d,cwd:f}=c;if(c.envSplitValues){let m=Ko(c.envSplitValues,d);if(!m)throw new G("derivedCommandShape");Ba(a),yield*ui(m,t,f,r,o,i,s,a,l);return}if(tn(d[0]??""))throw new G("wrapperPeelIterations");let u=di(d,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])Ba(a),yield*ui(m===u.childIndex?u.tokens:d.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(y_(d)){Ba(a),yield*ui(d.slice(1),t,f,r,o,i,s,a,l);return}yield h_(d,f,r,o,i,l)}function h_(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:M(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ba(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new G("wrapperPeelIterations");e.iterations++}function y_(e){return M(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Ua(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function mt(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ha(r,"recursive")){t=!0;continue}if(r==="-f"||Ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function mi(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var C_=["--init-file","--rcfile"],S_=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ne(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Km(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Km(e,t,!1);if(r!==null)return r}}return null}var Vm=/^-[cn]+$/;function Ke(e){let t=e.slice(1);if(t.some((r)=>/^[-+]./.test(r)&&r!=="--"&&!Vm.test(r)))return!1;let n=t.findIndex((r)=>!Vm.test(r));return t.slice(0,n===-1?void 0:n).some((r)=>r.includes("n"))}var b_=/^-[abcefhiklmnprstuvx]+$/;function fi(e){let t=e.findIndex((i,s)=>s>0&&!b_.test(i)),n=t===-1||/^[-+]/.test(e[t]??"")?e.slice(1):e.slice(1,t+1);if(n.some((i)=>i.startsWith("+")))return!0;let r=n.filter((i)=>i.startsWith("-")&&!i.startsWith("--")&&i.includes("c"));if(r.length===0)return!1;let o=Ne(e);if(o===null)return n.some((i)=>i.startsWith("-")&&!r.includes(i));return/^[-+]/.test(o)||r.some((i)=>/[oO]/.test(i))}function Km(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function qm(e){let t=M(e[0]??"").toLowerCase(),n=E_(e,t),r=S_.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function E_(e,t){let n=Oe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?C_.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&ws.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=xs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var v_="find -delete permanently removes files. Use -print first to preview.",__="find -exec rm -rf is dangerous. Use explicit file list instead.",R_=new Set(["-exec","-execdir","-ok","-okdir"]),w_=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Ym(e,t){let n=e.map(x),r=x_(e,n,t);if(r)return r;if(pi(n,1)&&!O_(e,n,t)){let s=k(v("find.delete",v_),t.policy);if(s)return s}let o=t.budget??Te(),i=0;while(i<n.length){let s=n[i],a=ft(s??"");if(a>0){i+=a+1;continue}if(!tt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Nn(n,i);i=l.nextIndex;let c=M_(l.tokens,t.environment);if(c){let m=k(c,t.policy);if(m)return m}let d=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?.(l.tokens,d?null:t.cwd)??null,u=f?.id.startsWith("custom.")?f:k(f,t.policy);if(u)return u}return null}function x_(e,t,n){if(!pi(t,1)&&!ja(t,n.environment))return null;let o=Nr(e)??X(["."]),i=et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=kr(s);for(let l of a.expandedTargets??[x(s)]){let c=xe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!A_(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",we)}}if(k_(t)&&i.resolvedCwd&&hm(o.map(x),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",we);return null}function A_(e,t,n){if(!t)return!1;let r=e.map(x),o=[],i=!1,s=Nr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(tt(l)){let c=Nn(r,a),d=wt([...c.tokens],n),f=mi(d),u=Q.has(M(d[0]??"").toLowerCase()),m=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(f||u||m||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(T_(c.text,l==="-iname"));a+=2;continue}if(!P_.has(l))return!1;a+=1+ft(l)}return o.length>0&&!Cm(t,(l)=>o.every((c)=>c.test(l)))}var P_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function T_(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var I_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function ja(e,t){let n=0;while(n<e.length){if(!tt(e[n])){n++;continue}let r=Nn(e,n),o=wt([...r.tokens],t),i=M(o[0]??"").toLowerCase(),s=Q.has(i)&&I_.test((Ne(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function k_(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function O_(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Nr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Da(o,n.environment),s=n.trustedTmpdirValue??Dn(o,n.environment),a=n.allowTmpdirVar??!Ir(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Jt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=et(l),d=et({...l,cwd:n.originalCwd??n.cwd}),f=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),m=f&&u&&!Pt(u,f)?n.cwd:void 0;return r.every((p)=>{let g=kr(p);if(g.unsafeBraceExpansion)return!1;return(g.expandedTargets??[x(p)]).every((h)=>{let y=/^\.\/*$/.test(h)?m:void 0,b=y??h,S={targetIsLiteral:g.expandedTargets!==void 0||g.targetIsLiteral,tmpdirWordSplittingProtected:g.tmpdirWordSplittingProtected};if(!re(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&xe(b,c,S).kind==="within_anchored_cwd")return!0;return Am(b,y?d:c,{...S,containmentTarget:D_(b,i)})})})}function D_(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Nr(e){let t=(o)=>{let i=e[o];return i?x(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function M_(e,t){let n=Rt([...e],t);if(n.length===0)return null;let r=M(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=M(n[0]??"");if(r==="rm"&&mt(n))return v("find.exec-rm-recursive-force",__);return null}function Nn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function pi(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(tt(r)){n=Nn(e,n).nextIndex;continue}let o=ft(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ft(e){return w_.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function tt(e){return e!==void 0&&R_.has(e)}import{resolve as dw}from"node:path";function Lr(e){let t=$e(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var N_=5,Va="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ae(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Xm(e,t,n){let r=Ln(e,t,n),o=L_(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<N_;a++){let{subcommand:l,rest:c}=Ae(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(d),u=$_(f);if(u===null||u.length===0)return{blockedReason:Va,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:Va,expanded:!0,tokens:i}}function Jm(e,t,n){return Ln(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ae(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?M(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function L_(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Ln(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?M(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=G_(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...W_(e,t,n)]}}function W_(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ka(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ka(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Zm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Zm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function G_(e,t){let n=F_(e,t),r=z_(e,t);return{blockedReason:n===null||r===null?Va:null,entries:[...n??[],...r??[]]}}function F_(e,t){let n=lt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Lr(n);if(!o)return null;for(let i of o){let s=Ka(i);if(!s)return null;r.push(s)}return r}function z_(e,t){let n=Hu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=lt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=lt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ka(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Zm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:lt(e.slice(r+1),t,n)}}function $_(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Lr(t)}var B_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",U_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",H_="git checkout --force discards uncommitted changes. Use 'git stash' first.",j_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",V_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",K_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",q_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Y_="git switch --force discards uncommitted changes. Use 'git stash' first.",Z_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",X_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",J_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Q_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",eR="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",tR="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",nR="git push --force destroys remote history. Use --force-with-lease for safer force push.",rR="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",oR="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",iR="git branch -D force-deletes without merge check. Use -d for safe delete.",sR="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",aR="git merge --abort discards merge conflict resolutions. Use 'git status' first.",lR="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",cR="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",dR="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",uR="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",mR="git worktree remove --force can delete uncommitted changes. Remove --force flag.",fR=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),pR=new Set(["--recurse-submodules","--track","-t"]),qa=new Set(["-b","-B","-U"]),Ya=new Set(["-c","-C"]),gR=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function L(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Wn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function ef(e,t){let{subcommand:n,rest:r}=Ae(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Tt(hR(r,t));case"switch":return Tt(CR(r));case"restore":return Tt(bR(r));case"reset":return vR(r);case"clean":return Tt(RR(r));case"rm":return Tt(wR(r));case"push":return rn(xR(r));case"branch":return rn(TR(r));case"stash":return rn(MR(r));case"worktree":return rn(NR(r));case"rebase":return Tt(IR(r));case"merge":return Tt(kR(r));case"tag":return rn(OR(r));case"reflog":return rn(DR(r));default:return null}}function Tt(e){return e?{...e,localDiscard:!0}:null}function rn(e){return e?{...e,localDiscard:!1}:null}function hR(e,t){let{index:n,before:r}=ae(e),o=Ce(r,{shortOptsWithValue:qa});if(r.some((a)=>L(a,"--force"))||o.has("-f"))return v("git.checkout-force",H_);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(L(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",V_)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",j_);return v("git.checkout-double-dash",B_)}let i=SR(e);if(i.length>=2)return v("git.checkout-ambiguous",K_);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>L(a,"--detach")||L(a,"--track")))return null;if(yR(s)||t(s))return v("git.checkout-double-dash",U_);return null}function yR(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function CR(e){let{before:t}=ae(e);if(t.some((r)=>L(r,"--discard-changes")))return v("git.switch-discard-changes",q_);let n=Ce(t,{shortOptsWithValue:Ya});if(t.some((r)=>L(r,"--force"))||n.has("-f"))return v("git.switch-force",Y_);return null}function SR(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(fR.has(r)){n+=2;continue}if(pR.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function bR(e){let t=ER(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",X_):v("git.restore-unstaged",Z_)}function ER(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(gR.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function vR(e){let t=null;for(let n of e){if(L(n,"--hard")){t=v("git.reset-hard",J_);break}if(L(n,"--merge")){t=v("git.reset-merge",Q_);break}}if(!t)return null;return _R(e)?rn(t):Tt(t)}function _R(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function RR(e){for(let n of e)if(n==="-n"||L(n,"--dry-run"))return null;let t=Ce(e.filter((n)=>n!=="--"));if(e.some((n)=>L(n,"--force"))||t.has("-f"))return v("git.clean-force",eR);return null}function wR(e){let t=!1,n=!1,r=!1;for(let o of ae(e).before){if(L(o,"--no-force")){t=!1;continue}if(L(o,"--force")){t=!0;continue}if(L(o,"--no-cached")){n=!1;continue}if(L(o,"--cached")){n=!0;continue}if(L(o,"--no-dry-run")){r=!1;continue}if(L(o,"--dry-run")){r=!0;continue}let i=Ce([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",tR):null}function xR(e){let{before:t,after:n}=ae(e),r=Ce(t);if(t.some((s)=>L(s,"--mirror")))return v("git.push-mirror",oR);if(t.some((s)=>L(s,"--force"))||r.has("-f")||Qm(t,n).some(AR))return v("git.push-force",nR);if(t.some((s)=>L(s,"--delete"))||r.has("-d")||Qm(t,n).some(PR))return v("git.push-delete",rR);return null}function Qm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function AR(e){return e.startsWith("+")||e.includes(":+")}function PR(e){return e.length>1&&e.startsWith(":")}function TR(e){let{before:t}=ae(e),n=Ce(t),r=n.has("-D")||n.has("-d")||t.some((i)=>L(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>L(i,"--force"));if(r&&o)return v("git.branch-force-delete",iR);return null}function IR(e){let{before:t}=ae(e);return t.some((n)=>L(n,"--abort"))?v("git.rebase-abort",sR):null}function kR(e){let{before:t}=ae(e);return t.some((n)=>L(n,"--abort"))?v("git.merge-abort",aR):null}function OR(e){let{before:t}=ae(e);return Ce(t).has("-d")||t.some((r)=>L(r,"--delete"))?v("git.tag-delete",lR):null}function DR(e){return e[0]==="delete"?v("git.reflog-delete",cR):null}function MR(e){for(let t of e){if(t==="drop")return v("git.stash-drop",dR);if(t==="clear")return v("git.stash-clear",uR)}return null}function NR(e){let{before:t}=ae(e);if(!t.includes("remove"))return null;let r=Ce(t);if(t.some((o)=>L(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",mR);return null}import{isAbsolute as iw,join as sw,resolve as aw}from"node:path";var Xa="TMPDIR",Ja="IFS",nf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rf=/^[A-Za-z_][A-Za-z0-9_]*$/,of=new Set(["export","typeset","declare","readonly"]),LR=new Set(["builtin","command","time"]),WR=new Set(["do","then","else"]),GR=new Set(["do","then","case"]),tf=new Set(["done","fi","esac"]),FR=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,zR=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Gn(e,t){return new Map([["HOME",t.home],...typeof t.cwd==="string"?[["PWD",t.cwd]]:[],...e])}function Fn(e,t){return e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.raw.startsWith("~/")?`${t}${e.raw.slice(1)}`:null}function sf(e,t,n){let r=Gn(t.shellAssignments,n);return e.map((o)=>{if(!ff(o.text))return x(o);if(o.provenance==="variable")return af(o.text,r);if(o.provenance==="command-substitution")return BR(o,n.darwinUserTempDir)??x(o);return o.provenance==="literal"&&FR.test(o.raw)?o.text.replace("=~",`=${r.get("HOME")}`):x(o)})}function af(e,t){return e.replace(zR,(n,r,o)=>t.get(r??o??"")??n)}var $R=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function BR(e,t){if(e.provenance!=="command-substitution")return null;let n=e.parts.map((o)=>{if(o.provenance==="command-substitution")return $R.has(o.raw)?t():null;return o.provenance==="literal"&&!/[$`\\']/.test(o.raw)?o.raw.replaceAll('"',""):null});if(!n.every((o)=>o!==null))return null;let r=n.join("");return/[\s$`*?[]/.test(r)?null:r}function qe(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=af(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function lf(e,t){return{env:e,effectiveEnvAssignments:VR(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function cf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Qa(e,t){let n=uf(e,t),r=e[0]??"";if(GR.has(r))t.bodyDepth+=1;if(r==="elif"||tf.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(tf.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);el(t,a)});let o=n.commandIndex;if(o!==-1&&of.has(e[o]??""))e.filter((a)=>rf.test(a)&&Za(a)).forEach((a)=>{KR(t,a)});let i=o===-1?-1:mf(e,o);if(i===-1||e[i]!=="unset")return;let s=YR(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}qR(t,a)})}function df(e,t){let n=uf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function uf(e,t){let n=WR.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!ff(a)),o=r!==-1&&of.has(e[mf(e,r)]??""),i=jR(t);return{assignments:e.flatMap((a,l)=>{let c=UR(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Ho(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function mf(e,t){let n=t;while(LR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function ff(e){return Me(e)!==null||nf.test(e)}function UR(e,t,n){return Me(e)??HR(e,t,n)}function HR(e,t,n){let r=jo(e,n,t);if(r)return r;let o=e.match(nf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Za(e){return e===Xa||e===Ja||Ra(e)}function jR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function VR(e,t){let n=[Xa,Ja].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function el(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function KR(e,t){el(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function qR(e,t){if(!Za(t)&&!rf.test(t))return;if(e.shellAssignments.set(t,""),Ho(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Za(t)||t===Xa||t===Ja||ir(t)){el(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function YR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{dirname as gf,join as gi,resolve as ZR}from"node:path";function hi(e,t){return _a.some((n)=>t?.has(n)||e.has(n))}function zn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(ZR(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=pf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=pf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function pf(e,t,n){try{let r=_t(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Wr(e,t){if(t.entryKind(gi(e,".git"))!=="missing")return e;let n=gf(e);return n===e?null:Wr(n,t)}function yi(e,t,n,r,o){let i=r.paths,s=gi(n,".git"),a=i.isDirectory(s),l=a&&!r.isGitDirectory(s),c=hf(t).filter((d)=>l||d!==n&&Pt(d,n));return Ln(e,r.env,o).entries.some((d)=>d.key.toLowerCase()==="core.worktree")||c.some((d)=>i.entryKind(gi(d,"HEAD"))!=="missing"||d!==n&&i.entryKind(gi(d,".git"))!=="missing")||a&&r.gitDirectoryRedirects(s)}function hf(e){let t=gf(e);return t===e?[e]:[e,...hf(t)]}function yf(e,t,n){if(!t.localDiscard||!n.worktreeMode||hi(n.environment.env,n.envAssignments))return null;let r=zn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd),i=Wr(r.gitCwd,n.environment.paths);if(!o||i===null||yi(e,r.gitCwd,i,n.environment,n.envAssignments))return null;if(tl(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function tl(e,t,n){let{subcommand:r,rest:o}=Ae(e),i=r?.toLowerCase();if(t.dynamicArguments||XR(o)||nw(e,t.environment.env,t.envAssignments,n)||ew(o)||JR(i,o))return!0;return i==="clean"&&tw(o)>1}function XR(e){return e.some((t)=>/[$*?[]/.test(t))}function JR(e,t){if(e==="checkout"){let{before:n}=ae(t),r=Ce(n,{shortOptsWithValue:qa}),o=n.some((s)=>L(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ae(t),r=Ce(n,{shortOptsWithValue:Ya}),o=n.some((s)=>L(s,"--force"))||n.some((s)=>L(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||QR(s))||r.has("-C");return o&&i}return!1}function QR(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function ew(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function tw(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function nw(e,t,n,r){if(lt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Ln(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>ow(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||rw(s.value);if(Vu(n))return!0;return r.recursiveSubmodules}function rw(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ow(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Cf(e,t,n){let r=e.map((l)=>qe(l,n.shellAssignments??new Map)??x(l)),o=n.environment.paths,i=zn(r,n.cwd,o),s=n.originalCwd?o.realpath(aw(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||hi(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?cw(e,n.shellAssignments,o):Wr(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!lw(a,i.gitCwd,r,t,n)||!Mn(a,n.environment)||si(a,n.environment)||Pt(s,a)||Pt(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function lw(e,t,n,r,o){let i=o.environment.paths,s=sw(e,".git");if(i.entryKind(s)!=="present"||yi(n,t,e,o.environment,o.envAssignments))return!1;if(i.isDirectory(s))return!0;if(!r.localDiscard)return!1;let l=o.environment.worktreeFacts(e);return l!==null&&!tl(n,o,l)}function cw(e,t,n){let r=Ae(e.map(x)).rest,{before:o,after:i}=ae(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&qe(l,t??new Map))??a;if(!iw(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}var uw="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",mw=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ci(e,t){return Sf(e,t)}function Sf(e,t,n){let r=e.map(x),o=Xm(r,t.environment.env,t.envAssignments),i=o.blockedReason?k(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((ju(t.envAssignments)||Jm(r,t.environment.env,t.envAssignments))&&fw(s))return v("git.ssh-env",uw);let a=ef(s,(c)=>{let d=zn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(dw(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=yf(r,a,t)??Cf(e,a,t);if(!l)return a;return n?.(l),null}function bf(e,t){let n=null;return{match:Sf(e,t,(o)=>{n=o}),relaxation:n}}function fw(e){let{subcommand:t,rest:n}=Ae(e),r=t?.toLowerCase();if(!r)return!1;if(mw.has(r))return!0;if(r==="archive")return ae(n).before.some((o)=>L(o,"--remote"));return r==="remote"&&pw(n)}function pw(e){return e.find((t)=>!gw(t))?.toLowerCase()==="update"}function gw(e){return e==="-v"||L(e,"--verbose")||L(e,"--no-verbose")}import{isAbsolute as jw}from"node:path";function Ef(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Si(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var vf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",hw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yw="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Cw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Sw="rm -rf in home directory is dangerous. Change to a project directory first.",_f={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Cw},git_metadata_target:{id:"rm.git-metadata",reason:we},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:yw},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Sw},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:vf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:hw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:vf}};function bi(e,t){let n=et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(x),o=mi(r),i=Ew(e);for(let s of i){let a=kr(s.word);if(o&&a.unsafeBraceExpansion){let l=k(en({kind:"outside_anchored_cwd"},n,t.policy,_f),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=de(l),d={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Xt(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",we);if(!o)continue;for(let f of bw(c,n,d)){let u=en(f,n,t.policy,_f),m=k(u,t.policy);if(m)return m}}}return null}function bw(e,t,n){let r=xe(e,t,n);if(r.kind==="cwd_self_target")return[r,xe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=xe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,xe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Ew(e){let t=[],n=!1;for(let r of e.slice(1)){let o=x(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var It={kind:"none"},on={kind:"dynamic"},vw=new Set(["<","<<","<<-","<<<","<&","<>"]),wf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,_w=/^(?:[0-9]+|[@*])$/,Rw=vt.maxWords,xf=vt.maxInputLength;function Af(e){if(!e||M(N(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function hi(e){let t=Gn(e[1])==="--"?2:1;if(e.length<=t)return Pt;let n=e.slice(t);if(!n.every(Wr))return on;return{kind:"literal",source:n.map(x).join(" ")}}function _f(e){let t=Gn(e[1])==="--"?2:1,n=e[t],r=Gn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Pt;if(!Wr(n))return on;return{kind:"literal",source:r}}function yi(e,t){let n=Af(e);if(n===-1)return Pt;let r=hw(t);if(!r)return Pt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Cw(s,e,n,r.ifs);if(!a)return on;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>pw||i>vf)return on;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Ci)].filter((s)=>s!==null).join(" ")}}function wf(e,t){let n=Af(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Wr)||o)return t;let i=r.map(Gn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let f=d[1]??d[2],u=f==="@"||f==="*"?i.slice(1):[i[Number(f)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(f==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?Ci(g):"").join(" ")).join(" "),s.length>vf)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function xf(e,t,n,r){if(!Oe(e.map(x)).readsStdinAsCommands)return Pt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&mw.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Pt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return on;return{kind:"literal",source:o.target.text}}if(!n)return Pt;return r===void 0?on:{kind:"literal",source:r}}function ft(e,t=new Map){let n=Oe(e.map(x)).scriptIndex;if(n===null)return Pt;let r=e[n],o=Gn(r);if(_n(r,o))return{kind:"literal",source:o};let i=r?Qe(r,t):null;return i===null?on:{kind:"literal",source:i}}var gw=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function tl(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Me(s)!==null)return!1;let a=M(N(s));return!gw.has(a)&&!J.has(a)&&!tn(a)}function Af(e){return Oe(e.map(x)).commandIndex??-1}function hw(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(yw);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function yw(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Cw(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ja(o):Sw(o,r);if(e.parameter==="*"){let a=Ja(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Qa(l,r)}let i=t[n+1+e.parameter];if(i&&!Wr(i))return;let s=Gn(i);return e.quoted?[s]:Qa(s,r)}function Ja(e){return e.every(Wr)?e.map(x):void 0}function Sw(e,t){let n=Ja(e);if(!n)return;let r=n.map((o)=>Qa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Qa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ei(e){let t=$n(e[1])==="--"?2:1;if(e.length<=t)return It;let n=e.slice(t);if(!n.every(Fr))return on;return{kind:"literal",source:n.map(x).join(" ")}}function Pf(e){let t=$n(e[1])==="--"?2:1,n=e[t],r=$n(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return It;if(!Fr(n))return on;return{kind:"literal",source:r}}function vi(e,t){let n=kf(e);if(n===-1)return It;let r=xw(t);if(!r)return It;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Pw(s,e,n,r.ifs);if(!a)return on;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>Rw||i>xf)return on;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(_i)].filter((s)=>s!==null).join(" ")}}function Tf(e,t){let n=kf(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Fr)||o)return t;let i=r.map($n),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let f=d[1]??d[2],u=f==="@"||f==="*"?i.slice(1):[i[Number(f)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(f==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?_i(g):"").join(" ")).join(" "),s.length>xf)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function If(e,t,n,r){if(!Oe(e.map(x)).readsStdinAsCommands)return It;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&vw.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return It;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return on;return{kind:"literal",source:o.target.text}}if(!n)return It;return r===void 0?on:{kind:"literal",source:r}}function pt(e,t,n=new Map){let r=Oe(e.map(x)).scriptIndex;if(r===null)return It;let o=e[r],i=o&&t!==void 0?Fn(o,t):null;if(i!==null)return{kind:"literal",source:i};let s=$n(o);if(wn(o,s))return{kind:"literal",source:s};let a=o?qe(o,n):null;return a===null?on:{kind:"literal",source:a}}var ww=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function il(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Me(s)!==null)return!1;let a=M(N(s));return!ww.has(a)&&!Q.has(a)&&!tn(a)}function kf(e){return Oe(e.map(x)).commandIndex??-1}function xw(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Aw);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function Aw(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Pw(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?nl(o):Tw(o,r);if(e.parameter==="*"){let a=nl(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:rl(l,r)}let i=t[n+1+e.parameter];if(i&&!Fr(i))return;let s=$n(i);return e.quoted?[s]:rl(s,r)}function nl(e){return e.every(Fr)?e.map(x):void 0}function Tw(e,t){let n=nl(e);if(!n)return;let r=n.map((o)=>rl(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function rl(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Wr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(x(e)):e.provenance==="literal"}function Gn(e){return e?x(e):""}function Ci(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function nl(e,t){return el(ze(e,"posix"),t)}function Gr(e){return nl(e,new Set(Array.from(e.matchAll(Ef)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function el(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(el(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>el(o,n))||Pf(r.words,n))return!0;_w(r,n)}return!1}function Pf(e,t){let n=e.findIndex((s)=>Me(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Lr(r,t))return!0;let o=N(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return bf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=s.map((d)=>d.text),l=Oe(a),c=l.commandIndex??l.scriptIndex;return!Ve(a)&&c!==null&&bf(s[c],t)}let i=bw(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Pf(e.slice(i),t)}function bw(e,t,n){let r=N(e[t]?.text??"");if(r==="command")return Ew(e,t+1);if(r==="exec")return vw(e,t+1);if(r==="env")return Rw(e,t+1,n);return null}function Ew(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function vw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Rw(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Lr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Lr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Me(i))continue;return r}return null}function _w(e,t){if(!e.words.every((n)=>Me(n.text)!==null))return;for(let n of e.words){let r=Me(n.text);if(!r)continue;if(Lr(n,t))t.add(r.name)}}function Lr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Ef)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(fw.test(o)||t.has(o))}))}function bf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Lr(e,t))}var rl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ol="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",ww="__CC_SAFETY_NET_XARGS_INPUT__",Si="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",bi="rm",xw=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Aw=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Pw=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Tw=/^(?:[0-9]+|[@*])$/;function kf(e,t){let n=e.map(x),{childStart:r,replacementToken:o}=sn(n),i=n.slice(r),s=v("xargs.shell-dynamic",ol);if(kw(i,o,t)&&I(s,t.policy))return I(s,t.policy);for(let a of je(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?I(s,t.policy):null;if(c)return c;let d=Wf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Nf(l,o),u=t.analyzeChild(l,{...nn(a,t),dynamicInput:d,dynamicSourceInput:f||Df(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",rl)});if(u)return u;let m=Iw(l,o,t.policy?.rules??[],I(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,ww]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...nn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=dt(l,t.policy?.rules??[]);if(p)return p}return null}function Iw(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=dt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=N(e[0]??"");if(!n.some((i)=>N(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Of(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=yf(e,r,t.length,n);return o===null?[]:[o]}function Df(e,t,n,r,o,i,s){if(J.has(t)){if(Ve(e))return!1;if(n!==null&&Ow(e,n,s))return!0;let a=Ne(e);if(!a){let l=ft(X(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Mf(a,n,s))return!0;if(De(a))return!0;return Dw(a,n,r)}if(Fe(t))return Tf(e,n,Wo,Lu(t));if(ke.has(t))return Tf(e,n,La,Lm);if(t==="eval"){let a=hi(X(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Mw(e,n,i);if(t==="git"){let a=Ae(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Ln.has(a.subcommand.toLowerCase())&&Lf(a.rest,n).some((l)=>l.includes(n))}return!1}function Mf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return De(i)===null&&n(i)===null}function Tf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Si]).sources.some((a)=>a.value===Si);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Si}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Si}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Of(l,t,a))));return pi(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function kw(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(je(e,n),(i)=>i.head)),o=t===null?[...e,bi]:e.map((i,s)=>s===0?i:i.replaceAll(t,bi));return Array.from(je(o,n)).some((i)=>i.head===bi&&!r.has(bi))}function Nf(e,t){return Lf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Lf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Wf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Ow(e,t,n){let r=Oe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Mf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Of(a,t,s).some((d)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,d):m),u=Oe(f);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(f[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(f[u.scriptIndex]??"").includes(d)})}))}function Dw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(xw))if(If(o,r))return!0;for(let o of e.matchAll(Aw))for(let i of(o[1]??"").matchAll(Pw))if(If(i,r))return!0;return nl(e,r)}function If(e,t){let n=e[1]??e[2];return n!==void 0&&(Tw.test(n)||t.has(n))}function Mw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Je(s)){let l=Mn(e,i);i=l.nextIndex-1;for(let c of je(l.tokens,{environment:n,cwd:void 0})){let d=Wf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Nf(c.tokens,t)||Df(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=mt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function sn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Fr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",zr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Lw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Ww="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",vi=/\{[^{}\s]*\}/g,Gf=/\{\}|\{-?\d+\}/g,Ff=/[\s;&|<>()$`\\"']/,Gw=["e","f","source","file","-e","-f","--source","--file"],Fw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],zw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),$w=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),zf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Bw=new Set(["--workdir","--wd"]),$f="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Le(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Hf(e){return Le([...e],(t)=>De(t))}function jf(e,t){let n=e.map(x);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Fn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=rp(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:f}=o;if(c){let p=Fn(t);if(p)return p;let g=Hf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=Yw(t);if(p)return p}if(d!==void 0&&a){let p=Fn(t);if(p)return p}let u=Zw(d,t.cwd,t.environment.paths);if(u===null){let p=Fn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(f){if([...je(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(al)){let g=Fn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Xf(m.envAssignments,m.cwd,a);return Le(p,(h)=>t.analyzeNested(h,g))}return Le(je(i,m),(p)=>Uw(p,o,t,m))}function Uw(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(tp)){let E=Fn(n);if(E)return E}let c=Hf(l);if(c)return c;let d=l.some(B),f=o||d,u=s&&f,m=Xf(e.envAssignments,e.wrapperCwd,i||u),p=f?{...m,worktreeMode:!1}:m,g=a.join(" "),h=B(g.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>Ff.test(E))),b=h||Ff.test(a[0]??""),S=y&&b&&t.jobs.length>0?null:Hw(e,t,n,r,p,d);if(S||!y)return S;return Vf(B(g)?g:`${g} {}`,!h,e,t,n,r,p)}function Hw(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,d=e.tokens,f=a||i;if(J.has(e.head)){let m=()=>{if(!a||s.length===0)return null;return Le(s,(h)=>n.analyzeChild(Ei(d,h,n.budget),nn(e,r)))};if(Ve(d))return m();if(li(d))return wt();let p=Ne(d);if(p){if(np(p)){let S=Tt(n);if(S)return S;if(s.length===0)return null;return Le(s,(E)=>n.analyzeNested(Qf(p,E,n.budget),o))}if(B(p))return Vf(p,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((S)=>yi(X(S===void 0?d:a?d.map((E)=>Jf(E,S)):[...d,...S]),p)):[];if(h.some((S)=>S.kind==="dynamic")){let S=Tt(n);if(S)return S}let y=h.flatMap((S)=>S.kind==="literal"?[S.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),Le(y,(S)=>n.analyzeNested(S,o));if(Gr(p)){let S=Tt(n);if(S)return S}let b=n.analyzeNested(p,o);if(b)return b;if(f)return Tt(n);return null}let g=ft(X(d));if(g.kind==="dynamic"||g.kind==="literal"&&B(g.source))return Tt(n)??m();if(g.kind==="literal")return m();if(s.length>0){let h=Tt(n);if(h)return h;let y=m();if(y)return y;if(a)return null;let b=s.flatMap((S)=>S[0]===void 0?[]:[S[0]]);return n.budget.charge("derivedTokens",b.length),Le(b,(S)=>n.analyzeNested(S,o))}if(f||c)return Tt(n)??m();return null}if(e.head==="rm"&&ut(d)){if(a&&s.length>0)return Le(s,(p)=>il(Ei(d,p,n.budget,Gf),e.cwd,r));if(s.length>0)return Le(s,(p)=>il(Uf(d,p,n.budget),e.cwd,r));let m=il(d.flatMap((p,g)=>{if(g===0||!B(p))return[p];return p.startsWith("-")?[p.replace(Gf,"")]:[]}),e.cwd,r);if(m)return m;return Zf(n)}let u=s.length>0?s:[void 0];return Le(u,(m)=>{let p=m===void 0?d:a?Ei(d,m,n.budget):Uf(d,m,n.budget),g=v("parallel.shell-dynamic",zr),h=c&&e.head==="find"?qw(p,r):null,y=qf(p,c,n)??h?.customResult??null,b=N(e.head),S=c&&(b==="rm"&&sl(p)||b==="xargs"&&Yf(p)||h?.rmOptions===!0),E=c&&(S||h?.executedSource===!0||h===null&&Kf(p,b)),A=n.analyzeChild(p,{...nn(e,r),worktreeMode:l||c||f?!1:n.worktreeMode,dynamicInput:c||f,dynamicRmInput:S,dynamicSourceInput:y!==null||E,shellDynamicMatch:g,dynamicSourceMatch:g,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Fr)});if(E){let P=I(g,n.policy);if(P)return P}return A??y??dt(p,n.policy?.rules??[])})}function Vf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Le(r.jobs,(c)=>o.analyzeNested(Qf(e,t?c.map(Ci):c,o.budget),s));let a=Mr(e);if(a?.[0]&&N(a[0])==="rm"&&ut(a)){let c=Zf(o);if(c)return c}return(a?o.analyzeChild(a,{...nn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",zr),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Fr)}):null)??o.analyzeNested(e,s)}function Kf(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return Kw(e);if(t==="git")return jw(e);if(t==="find")return!0;if(ke.has(t))return Bf(e,Gw,Or);if(Fe(t))return Bf(e,Fw,Lo);return!1}function sl(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||np(o)))}function jw(e){if(Vw(e))return!0;let t=Ae(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!Ln.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function Vw(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function Kw(e){if(Ve(e))return!1;let t=Ne(e);if(t!==null)return B(t);let n=ft(X(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function Bf(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,$f]).some((o)=>o.value===$f);return pi(r,t,(o)=>n(e.map((i)=>Jf(i,[o]))))}function qf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>N(i.command)===N(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return Tt(n);return Le(o,(i)=>dt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function qw(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of je(i,t))n.executedSource||=Kf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&sl(a.tokens)||a.head==="xargs"&&Yf(a.tokens),n.customResult??=qf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Je(a)){i=[],n.executedSource||=B(a);continue}let l=mt(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function Yf(e){let t=e.slice(sn(e).childStart);return N(t[0]??"")==="rm"&&sl(t)}function Ri(e,t){return(n)=>I(v(e,t),n.policy)}var Tt=Ri("parallel.shell-dynamic",zr),Yw=Ri("parallel.command-stream-dynamic",Lw),Fn=Ri("parallel.command-stream-dynamic",Ww),Zf=Ri("parallel.rm-recursive-force-dynamic",Fr);function il(e,t,n){return I(gi(X(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:On(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Xf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Jf(e,t){return e.replace(vi,(n)=>ep(n,t))}function Ei(e,t,n,r=vi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=ep(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Qf(e,t,n){return Ei([e],t,n)[0]??""}function Uf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function ep(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(vi)!==-1}function tp(e){if(al(e))return!0;for(let t of e.matchAll(vi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function al(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function np(e){return/^\{[^{}\s]*\}$/.test(e)}function Zw(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Nw(e))return null;try{return Et(t??e,e,n)}catch{return null}}function rp(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,d=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Fa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Fa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=g.indexOf("="),b=y===-1?g:g.slice(0,y),S=y===-1?void 0:g.slice(y+1);if(g==="--dry-run"){c=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){d||=(g==="-I"?h:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){d=!0,t+=2;continue}if(b==="--replace"||g.startsWith("-i")&&g.length>2){let E=b==="--replace"?S:g.slice(2);d||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||$w.has(b)){d=!0,t+=S===void 0?2:1;continue}if(g==="-q"||g==="--quote"){s=!0,t++;continue}if(g==="--pipe"||g==="--pipepart"){a=!0,t++;continue}if(b==="--env"){d=!0,t+=S===void 0?2:1;continue}if(zf.has(b)||g.startsWith("-S")&&g.length>2){i=!0,t+=zf.has(g)?2:1;continue}if(Bw.has(b)){d=!0;let E=S??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=S===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&S!==void 0){t++;continue}if(zw.has(g)){if(h===void 0||h===":::"||h==="--"){d=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}d||=n.some(c?al:tp);let f=[];if(o!==-1){let g=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){f.push(g),g=[];continue}if(y!==void 0)g.push(y)}f.push(g)}d||=f.length>1;let u=Xw(f),m=n.some(B),p=n.length===0&&o===-1;return{template:n,jobs:u,childStart:r,templateHasPlaceholder:m,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:p,unsupported:d,workdir:l,dryRun:c}}function Xw(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>q.derivedTokens.cap)throw new F("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>q.derivedTokens.cap)throw new F("derivedTokens");o.push([...i,s])}t=o}return t}function op(e){return rp(e).childStart}var Jw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",_i="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function cl(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ll(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function sp(e,t,n,r,o=!1,i){let a=(dr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",Jw):null;return I(a,i)??ap(e,t,n,o,i)}function ap(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>cl(a)?[l]:[]);if(i.length===0)return null;let s=N(t[0]?.text??"");if(s==="git"){let a=Rn(e,t),l=ex(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return I(v("shell.dynamic-structure",_i),o);if(I(fi(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((f,u)=>u>l&&x(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&Ln.has(c)&&i.some((f)=>f>l&&(d===-1||f<d)))return I(v("shell.dynamic-structure",_i),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&tx(t)?I(v("shell.dynamic-structure",_i),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&x(c)==="--"),l=ut(t.map(x));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?I(v("shell.dynamic-structure",_i),o):null}if(s==="xargs")return ip(e,t.slice(sn(t.map(x)).childStart),"xargs",n,r,o);if(s==="parallel")return ip(e,t.slice(op(t.map(x))),"parallel",n,r,o);return null}function ip(e,t,n,r,o,i){if(t.length===0)return null;let s=Qw(t,r);if(dr(e,s)){let l=I(v(`${n}.shell-dynamic`,n==="xargs"?ol:zr),i);if(l)return l}let a=ap(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>cl(l)&&ll(l)))return I(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?rl:Fr),i);return null}function Qw(e,t){let n=qt(e,t),r=n.rewritten?X(n.words.map(x)):n.words,o=r[0];return o&&x(o)==="busybox"?r.slice(1):r}function ex(e){let t=1;while(t<e.length){let n=e[t],r=n?x(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function tx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=cl(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ll(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ll(s)))return!0;continue}if(t=!0,a)return!0;let l=mt(s.text);if(l>0){n=l;continue}if(Je(s.text))o=!0,r=!0}return!1}function dl(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!_n(t[n.tokenIndex],n.value)})}var lp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nx="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",rx="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",ox="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",ix="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",sx="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",ax={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:ox},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:we},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:rx},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:sx},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:lp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:nx},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:lp}},lx=/^\/\/?[ck]$/i,cp=/[&|]+/,cx=/(?:"[^"]*"|[^\s"])+/g,dx=/[\^%!]/,ux=/\\"./s,mx=/(^|\/)[*.]*\*[*.]*$/,fx=/^"?[\\/]+[?.][\\/]/,px=new Set(["rmdir","rd","del","erase"]),gx=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,hx=/\/s(?!\w)/i,yx=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function dp(e,t){let n=e.map(x),r=n.findIndex((u)=>lx.test(u));if(r===-1)return null;let o=n.slice(r+1).join(" "),i=/^".*"$/s.test(o)?o.slice(1,-1):o,s=i.split(cp).map((u)=>{let m=u.match(cx)??[],p=m.findIndex((h)=>px.has(h.replace(/^@/,"").toLowerCase())),g=p===-1?[]:m.slice(p);return{piece:u,tokens:m,deleteTokens:g,recursiveDelete:g.slice(1).some((h)=>h.startsWith("/")&&h.toLowerCase().split("/").includes("s"))}}),a=s.filter((u)=>u.recursiveDelete),l=a.length>0||gx.test(i)&&hx.test(i);if(l&&(i.includes("\\\"")||t.gitBashEscapesBodyQuotes&&i.includes('"')||t.powerShellRawWords.some((u)=>ux.test(u))||a.some((u)=>u.tokens.some((m)=>fx.test(m)))))return v("cmd.recursive-delete-escaped-quote",ix);let c=Xe({...t,allowPaths:t.policy?.destructiveCommandAllowPaths}),d=s.reduce((u,m)=>u??(m.recursiveDelete?Cx(m.deleteTokens,c,t.policy):t.analyzeNested(m.piece)),null),f=l&&(a.length===0||dx.test(i)||yx.test(i)||i.includes('"')&&cp.test(i));return d??(f?wt():null)}function Cx(e,t,n){return e.slice(1).filter((r)=>!r.startsWith("/")).reduce((r,o)=>r??I(en(xe(Ir(o.replaceAll('"',"")).replace(mx,"$1*"),t),t,n,ax),n),null)}var Sx="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",bx=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,Ex=/^-(?:executionpolicy|ep)$/i,vx=/^-(?:command|c)$/i,Rx=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,_x="encodedcommand",wx=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,xx=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Ax=/[$`]/,Px="--%";function up(e,t){let n=e.map(x),r=n.every((i,s)=>s===0||i!==Px&&Tx(e[s],i))?ml(n):void 0;if(r!==void 0)return t(r);if(n.some(Ix))return wt();let o=n.join(" ");return wx.test(o)&&xx.test(o)?v("powershell.nested-recursive-delete-unread",Sx):null}function ml(e){let t=ul(e,1),n=t===void 0?[]:e.slice(t+1);return n.length>0?n.join(" "):void 0}function ul(e,t){let n=e[t]??"";if(vx.test(n))return t;if(bx.test(n))return ul(e,t+1);return Ex.test(n)?ul(e,t+2):void 0}function Tx(e,t){return e?.provenance==="unknown"?!Ax.test(t):_n(e,t)}function Ix(e){let t=Rx.exec(e)?.[1]?.toLowerCase();return t!==void 0&&(t==="ec"||_x.startsWith(t))}var fp=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>gi(e.words,fl(e))},{heads:new Set(["cmd"]),analyze:(e)=>dp(e.words,{...fl(e),powerShellRawWords:e.options.commandView?.dialect==="powershell"?e.options.commandView.words.map((t)=>t.raw):[],gitBashEscapesBodyQuotes:e.options.commandView?.dialect!=="powershell",analyzeNested:(t)=>It(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(e)=>up(e.parsedWords,(t)=>It(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(e)=>fi(e.words,pl(e))},{heads:new Set(["find"]),analyze:(e)=>jm(e.words,{...fl(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>kf(e.words,{...mp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>It(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>jf(e.words,{...mp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>It(e.options.analyzeNested(t,n))})}];function mp(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function It(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function fl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(e.envAssignments,e.options.environment),trustedTmpdirValue:On(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function pl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function hp(e){return fp.find((t)=>t.heads.has(e))?.analyze}function $n(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((D)=>o==="posix"?x(D):D.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,u=$o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=qt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let w=[...p,...i(m.words)].join(" "),D=De(w);if(D)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:D.reason}),ge(D);if(n.strict)return pe(r);let U=Bo(p,i(m.words));if(U){n.budget.charge("derivedTokens",U.length);let se=n.analyzeNested(U.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(se)return se}}let g=m.rewritten?X(i(m.words)):Rn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let w=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),S=h[0];if(!S)return null;if(tn(S))throw new F("wrapperPeelIterations");let E=N(S),A=m.cwd===null?void 0:m.cwd??d,P=m.cwd===null?void 0:f,k=m.cwd===void 0?n.effectiveCwd:m.cwd,C=s?s.allowTmpdirVar:!Pr(b,n.environment),O=sp(o,m.words,n.environment,t===0,n.strict,n.policy);if(O)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:O.reason}),ge(O);let T=ii(h,n.policy);if(T){for(let w of[T.childIndex,...T.alternativeChildIndices]){pp(y.wrapperNormalizationBudget);let D=g.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:T.wrapper,output:i(D)});let U=$n(D,t,{...y,effectiveCwd:k,envAssignments:b});if(U)return U}return null}let K=l?void 0:E==="eval"?hi(g):E==="trap"&&!a?_f(g):void 0;if(a&&s&&E==="eval"){if(K?.kind==="dynamic")return zn(s,n.policy);if(K?.kind==="literal"){let w=n.analyzeNested(K.source,{effectiveCwd:k,envAssignments:b});if(w)return w}return Bn(s,n.policy)}if(K?.kind==="dynamic"&&(n.strict||!n.commandView||!tl(n.commandView)))return pe(r);if(K?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:K.source,depth:t+1});let w=n.analyzeNested(K.source,{effectiveCwd:k,envAssignments:b,functionDefinitions:n.functionDefinitions});if(w)return w}if(a?J.has(E):Cp(S,E)){if(Ve(h))return null;if(li(h))return pe(r);if(a&&s){let w=Ne(h);if(w){if(s.dynamicSourceInput??s.dynamicInput){let U=zn(s,n.policy);if(U)return U}if(Gr(w)){let U=zn(s,n.policy);if(U)return U}return n.analyzeNested(w,{effectiveCwd:k,envAssignments:b})}let D=ft(g);if(D.kind==="dynamic")return zn(s,n.policy);if(D.kind==="literal")return s.dynamicSourceInput?zn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?zn(s,n.policy):null}if(l){let w=Ne(h),D=w?n.analyzeNested(w,{effectiveCwd:k,envAssignments:b}):ft(g).kind==="dynamic"?pe(r):null;if(D)return D}if(s===void 0){let w=Mx(h,b,k,n,r,t);if(w)return w;let D=Ne(h);if(D){let fn=yi(g,D);if(fn.kind==="dynamic")return pe(r);let zi=fn.kind==="literal"?fn.source:wf(g,D),jl=Nx(zi);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:jl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:jl,depth:t+1});let Vl=n.analyzeNested(zi,{effectiveCwd:k,envAssignments:b});if(Vl)return Vl;return Gr(zi)?pe(r):null}let U=ft(g,n.strict?void 0:n.shellAssignments);if(U.kind==="dynamic")return pe(r);if(U.kind==="literal")return wi(U.source,k,b,n,r,t);let se=xf(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(se.kind==="dynamic")return pe(r);if(se.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:se.source,depth:t+1}),n.analyzeNested(se.source,{effectiveCwd:k,envAssignments:b})}}if(!s&&(E==="source"||E===".")){let w=h[1]==="-p"?2:null;if(w!==null){let fn=n.commandView?g[w]:void 0;if(!fn)return null;if(fn.provenance!=="literal")return pe(r)}let D=w===null?1:3,U=h[D]==="--"?D+1:D,se=n.commandView?g[U]:void 0;if(!se)return null;if(se.provenance==="literal")return wi(se.text,k,b,n,r,t);if(n.strict||!n.commandView||!tl(n.commandView))return pe(r)}if(ke.has(E)&&!l){if(!s&&n.strict&&dl(Or(h),g))return pe(r);let w=Wm(h,(U)=>It(n.analyzeNested(U,{effectiveCwd:k,envAssignments:b}))),D=I(w,n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:D.reason}),ge(D)}if(Fe(E)&&!l){if(!s&&n.strict&&dl(Lo(h),g))return pe(r);let w=Nu(h);if(a&&s)return Ox(E,w,k,b,n,s);if(w){let D=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:w,paranoidBlocked:D}),D){let se=I(v("interpreter.one-liner-paranoid",br),n.policy);if(se)return ge(se)}if(ha(E,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let U=n.analyzeNested(w,{effectiveCwd:k,envAssignments:b});if(U&&!yp(U,w))return U;if(Er(w,void 0,!n.strict)){let se=I(v("interpreter.dangerous-command",An),n.policy);if(se)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:An}),ge(se)}r=void 0}}if(E==="busybox"&&h.length>1)return pp(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),$n(g.slice(1),t,{...y,effectiveCwd:k,envAssignments:b});let j=s?null:I(ku(E,h),n.policy);if(j)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:j.reason}),ge(j);let z=r===y.trace?y:{...y,trace:r},de={words:g,parsedWords:m.words,head:E,cwd:A,originalCwd:P,envAssignments:b,allowTmpdirVar:C,dynamicArguments:m.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:k,options:z,analyzeChildTokens:(w,D)=>a&&s?hl(w,t,z,{...s,cwd:D??void 0,effectiveCwd:D??void 0}):It($n(X(w),t+1,{...z,child:void 0,commandView:void 0,effectiveCwd:D,envAssignments:b}))??dt(w,z.policy.rules),analyzeChild:(w,D)=>hl(w,t,z,D)},te=s&&(E==="xargs"||E==="parallel")?void 0:hp(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:C});let ne=r&&E==="git"?hf(de.words,pl(de)):void 0,Ee=gp(ne?ne.match:te?.(de)??null,n.policy);if(r)Lx(de,Ee,ne?.relaxation??null);if(Ee)return ge(Ee);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(ut(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Bn(s,n.policy):null)??Dx(s,n.policy)}let tt=te!==void 0&&!Gx.has(E),Nt=!s&&!tt&&!ao.has(E),Kn=r&&Nt?[]:void 0;if(Nt)for(let w=1;w<h.length;w++){let D=h[w];if(!D)continue;Kn?.push(D);let U=gp(kx(h,w,t,z,A,P,k,b),n.policy);if(U)return r?.recordSegment({type:"fallback-scan",tokensScanned:Kn??[],embeddedCommandFound:N(D)}),ge(U)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Kn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Pe=dt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Pe,reason:Pe?.reason}),Pe)return ge(Pe);return a&&s?Bn(s,n.policy):null}function hl(e,t,n,r){return It($n(X(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function kx(e,t,n,r,o,i,s,a){for(let l of je(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=N(c);if(Cp(c,d)||hp(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=hl(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!Pr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function Ox(e,t,n,r,o,i){if(!t)return Bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=I(v("interpreter.one-liner-paranoid",br),o.policy);if(a)return ge(a)}if(ha(e,t))return Bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!yp(s,t))return s;if(Er(t,void 0,!o.strict)){let a=I(v("interpreter.dangerous-command",An),o.policy);if(a)return ge(a)}return Bn(i,o.policy)}function yp(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Yo)||e.reason===Ze)&&!lo(t);return n||r}function zn(e,t){let n=e.shellDynamicMatch?I(e.shellDynamicMatch,t):null;return n?ge(n):null}function Bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?I(e.dynamicSourceMatch,t):null;return n?ge(n):null}function Dx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?I(e.rmDynamicMatch,t):null;return n?ge(n):null}function Mx(e,t,n,r,o,i){let s=Hm(e);if(s.argvSource?.kind==="absent")return pe(o);if(s.argvSourceApplies&&s.argvSource){let l=wi(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return wi(a,n,t,r,o,i,!0)}function wi(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return pe(o);let a=Sr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?pe(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Nx(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Lx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function pp(e){if(e.iterations>=q.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function ge(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function pe(e){return e?.recordSegment({type:"error",message:Ar}),ge(wt())}function Cp(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(M(t))}function gp(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:I(e,t)}var Wx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Gx=new Set(["powershell","pwsh"]),Fx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function zx(e,t){let n=Ep(e,t);if(n.length===0)return!1;let r=n[bp(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Wx.test(e.join(" "))}function Sp(e,t,n,r,o){if(e.dialect==="powershell"){let S=$x(e.words,o);if(S.kind==="none")return;if(!t||S.kind==="unknown")return null;return gl(jx(S.target),t,n.paths)}let i=e.words.map(x),s=i.some((S)=>/^CDPATH\+?=/.test(S));if(!zx(i,n))return s?null:void 0;if(!t)return null;let a=Ep(i,n,t),l=bp(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((S)=>S.length<=1||!S.startsWith("-")||S==="--");if((d===-1?c:c.slice(0,d)).some((S)=>!/^-[LP]+$/.test(S)))return null;let u=d===-1?[]:c.slice(d),m=u[0]==="--"?u.slice(1):u;if(m.length>1)return null;let p=m[0],g=r.get("HOME")||n.home;if(p===void 0)return gl(ue(g),t,n.paths);let h=e.words.find((S)=>S.provenance==="variable"&&S.text===p),y=e.words.find((S)=>S.text===p&&/^~(?:\/|$)/.test(S.raw)),b=h?Qe(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return gl(ue(b),t,n.paths)}function gl(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=Et(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function $x(e,t){let n=Bx(e[0])?1:0,r=e[n];if(!Ux(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Fx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Hx(e.slice(n+1),t)}function Bx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Ux(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Hx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function jx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function bp(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Ep(e,t,n){let r=Vx(e);return vt([...r],t,n)}function Vx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Qx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",an="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function vl(e,t,n,r){if(t>=q.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:qe}),{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??ze(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:qe}),{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return El(e,n);let d=`${Yo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Pp(e,n),{reason:Ze,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Pp(e,n),{reason:Ze,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return El(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=rf(n.environment.env,n.envAssignments);return Pi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Pi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let f=e.nodes[c+1],u=f?.kind==="connector"?f.operator:void 0,m=eA(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],S={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(kt(u)&&!kt(a))l=S;let E=kt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:kt(a)?l??S:S,A=ln(E.connector)||ln(u);if(d.kind==="function"){let j=h.flatMap((de)=>{let te=cn(de);return te.functionDefinitions.set(d.name,d.body),yl(de,[te],m,u==="&",ln(u))}),z=Cl(j,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=z.states,s=z.conditionalStates,a=void 0;continue}if(d.kind==="group"){let j=[],z=[];for(let te of h){let ne=Pi(d.body,t,n,r,[cn(te)]);if(ne.result)return ne;if(j.push(...yl(te,ne.states,m,u==="&",ln(u))),A)z.push(te,...m?ne.states.map((Ee)=>xi(te,Ee)):ne.states)}let de=Cl(j,z,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=de.states,s=de.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let P=RA(e.nodes[c-1]),k=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],O=kt(a)&&C?.kind==="command"?Rf(C)??nA(C):void 0,T=[],K=[];for(let j of h){let z=rA(d,t,n,r,[cn(j)]);if(z.result)return{result:z.result,states:i};let de=e.dialect==="powershell"?z.states:z.states.map((te)=>xi(j,te));for(let te of de){let ne=cn(te),Ee=sA(d,t,n.trace?{...n,trace:Tp(n.trace,k)}:n,r,ne,kt(a),O);if(Ee)return{result:Ee,states:i};let tt=IA(d,ne.functionDefinitions);if(tt)n.budget.charge("derivedTokens",Ti(tt));let Nt=tt?t+1>=q.recursionDepth.cap?Sl(d.displayText,n,[ne]):Pi(tt,t+1,n,r,[ne]):{result:null,states:PA(d,ne).flatMap((Pe)=>_A(d,te,Pe,P))};if(Nt.result)return Nt;T.push(...yl(j,Nt.states,m,u==="&",ln(u)));let Kn=typeof ne.effectiveCwd==="string"&&ne.effectiveCwd!==te.effectiveCwd&&d.redirections.every((Pe)=>["<",">",">>",">|"].includes(Pe.operator)&&Pe.target?.text==="/dev/null");if(A&&(P||!Kn))K.push(j),K.push(...Nt.states.map((Pe)=>m?xi(j,Pe):Pe))}}let Mt=Cl(T,K,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=Mt.states,s=Mt.conditionalStates,a=void 0}return{result:null,states:i}}function eA(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(kt(r)||kt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&tA(e,t)}function yl(e,t,n,r,o){let i=n?t.map((a)=>xi(e,a)):[...t],s=o?i.flatMap((a)=>Un(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function xi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function tA(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(oA(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function kt(e){return e==="|"||e==="|&"}function nA(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function ln(e){return e==="&&"||e==="||"}function Cl(e,t,n,r,o,i){let s={success:Ai([...n,...e]),failure:Ai([...r,...t])},a=ln(i)?s:void 0;return{states:ln(o)||a?Ai([...s.success,...s.failure]):s.success,conditionalStates:a}}function Tp(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,branch:e.branch,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function rA(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=iA(e);if(s){if(t+1>=q.recursionDepth.cap)return Sl(s,n,o);let a=ze(s,"powershell");if(a.status==="limited")return Sl(s,n,o);if(a.status!=="complete")return vp(i,n,r,o);n.budget.charge("derivedTokens",Ti(a)),i.push({program:a,depth:t+1})}}return vp(i,n,r,o)}function oA(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function vp(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Pi(i.program,i.depth,t,n,[cn(a)]);if(l.result)return l;s.push(...l.states)}o=Ai(s)}return{result:null,states:o}}function iA(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Ti(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Ti(o),0):n.kind==="group"||n.kind==="function"?Ti(n.body):0),0)}function Sl(e,t,n){return t.trace?.recordSegment({type:"error",message:qe}),{result:{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function sA(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:uA(n.environment.paths,o.createdDirectories,n.budget)}},l=yA(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Ip(e,o,"before-consumer",a.environment.paths,a.budget);let c=Rn(e.dialect,e.words),d=c.map(x),f=e.displayText,u=tf(c,o.shellGitContextState),m=sf(u,o.shellGitContextState);if(e.dialect==="powershell"){let y=I(Im(e,i,kA(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!y,reason:y?.reason}),y)return Ap(f,y)}let p=I(Ou(e.redirections),a.policy);if(p)return a.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:p.reason}),Ap(f,p);if(d.length===1&&d[0]?.includes(" ")&&!dr(e.dialect,e.words)){let y=I(De(d[0]),a.policy),b=y!==null&&!a.strict&&Au(e,a.rootProgram);if(y&&!b)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:y.reason}),{reason:y.reason,segment:f,ruleId:y.id,intent:y.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let S=Rp(e,l,o,m,s,a);if(S)return S;return Ya(u,o.shellGitContextState),null}let g=$n(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(y,b)=>{let S=b&&Object.hasOwn(b,"effectiveCwd")?b.effectiveCwd:o.effectiveCwd,E=vl(y,t+1,{...a,effectiveCwd:S,envAssignments:b?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:b?.functionDefinitions,worktreeMode:b?.worktreeMode??a.worktreeMode,shell:b?.shell??a.shell,trace:a.trace?Tp(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:f};let h=Rp(e,l,o,m,s,a);if(h)return h;return Ya(u,o.shellGitContextState),null}function Rp(e,t,n,r,o,i){let s=CA(e,t,n,r??new Map,i);if(s)return s;return Ip(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),cA(e,t,n,i.environment.paths,i.budget),mA(e,n,i.environment.paths,i.budget),EA(e,n,o,i.environment,i.trace),null}var aA=new Set([">>","<>"]);function Ip(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?lA(s):aA.has(s.operator)))continue;_p(s.target,t,r,o)}if(n!=="before-consumer"||!ce(e.words[0],"tee"))return;let i=Op(e.words.slice(1));if(!i)return;for(let s of i.operands)_p(s,t,r,o)}function lA(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function _p(e,t,n,r){let o=e?.provenance==="literal"?Sr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function cA(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of dA(e,n.shellGitContextState.shellAssignments)){let a=Sr(s,n.effectiveCwd,r,o);if(!a||!Mu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=q.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function dA(e,t){let n=bl(gA(e.redirections)?.target,t),r=n===void 0?[]:[n];if(ce(e.words[0],"cat"))return pA(e.words)?r:[];if(!ce(e.words[0],"tee"))return[];let o=Op(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>bl(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function bl(e,t){if(hA(e))return e.text;return(e&&Qe(e,t))??void 0}function uA(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=W(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${Jx}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?W(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function mA(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!ce(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>bl(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!qx(c)&&!l)continue;let d=W(Xx(l??"",c),n,r);if(a?fA(d,n):n.isDirectory(Kx(d))&&kp(d,n))t.createdDirectories.add(d)}}function fA(e,t){let n=Zx(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>Yx(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||kp(o(i),t)}function kp(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function pA(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function gA(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Op(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Qe(s,t)===null)return;if(r&&ce(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function hA(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function ce(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Rl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function yA(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return an;let r=n[0];if(!r?.heredoc)return an;let o=/\$\(|`/.test(r.heredoc.body);if(!Rl(r.heredoc)&&(!t||o))return Qx;if(r.fd!==void 0&&r.fd!==0)return an;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return an;let i=e.redirections.some((l)=>l!==r&&wp(l.target));if(ce(e.words[0],"cat"))return i?an:void 0;if(ce(e.words[0],"tee"))return i||e.words.slice(1).some(wp)?an:void 0;let s=e.words[0],a=e.words[1];if(ce(s,"git")&&(ce(a,"apply")||ce(a,"commit")))return;if(ce(s,"gh")&&(ce(a,"pr")||ce(a,"issue"))&&ce(e.words[2],"create"))return;return an}function wp(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function CA(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(bA(e,i,n,r,o))return null;let a=SA(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=El(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function SA(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Rl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=ce(e.words[0],"uv")&&ce(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Fe(i.text))return;let s=o.findIndex((f)=>ce(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=I(v("interpreter.one-liner-paranoid",br),n.policy);if(f)return f}if(!Er(l,void 0,!n.strict))return null;let d=I(v("interpreter.dangerous-command",An),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function bA(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Rl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=qt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(x),l=N(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(M(l)))return!1;return Ve(a)}function EA(e,t,n,r,o){let i=Sp(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(x).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var vA=new Set(["fi","done","esac"]);function RA(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function _A(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&vA.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((f)=>{if(f===n.effectiveCwd)return n;let u=cn(n);return u.effectiveCwd=f,u})}function wA(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var xA=/^[A-Za-z_][A-Za-z0-9_]*$/,AA=8;function PA(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!xA.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=AA&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=cn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function cn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:of(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function Ai(e){let t=[];for(let n of e){if(!t.some((r)=>TA(r,n)))t.push(n);if(t.length>q.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function TA(e,t){return e.effectiveCwd===t.effectiveCwd&&wA(e.compoundBodies,t.compoundBodies)&&Un(e.shellGitContextState.env,t.shellGitContextState.env)&&Un(e.literalHeredocFiles,t.literalHeredocFiles)&&Un(e.functionDefinitions,t.functionDefinitions)&&Un(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Un(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&xp(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&xp(e.createdDirectories,t.createdDirectories)}function xp(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Un(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function IA(e,t){let n=ur(e);return n===void 0?void 0:t.get(n)}function Ap(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function kA(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function El(e,t){let n=I(De(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Pp(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Ze},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var OA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Dp(e,t,n,r){let o=vl(e,0,{...t,...Hd(t),budget:t.budget??Te(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function Mp(e,t,n){try{return{decision:e()}}catch(r){let o=DA(r,t,n);if(!o)throw r;return o}}function DA(e,t,n){if(!(e instanceof F)||!OA.has(e.kind))return null;let r=q[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var MA=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),wl=new Set(["cc-safety-net","ccsn"]),NA=new Set(["bunx","npx","pnpx"]),LA=new Set(["pnpm","yarn"]),WA=new Set(["npm","pnpm","yarn"]),GA=new Set(["bun","node"]);function ki(e,t,n={}){if(wl.has(e))return 0;if(NA.has(e)){if(n.broad)return _l(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Ii(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&WA.has(e)&&n.broad&&t[r]==="exec"){let o=_l(t.slice(r+1));return o===null?null:r+1+o}if(LA.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Ii(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=_l(t.slice(r+1));return o===null?null:r+1+o}if(GA.has(e)){let o=n.broad&&r!==-1?r:0;if(Np(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Np(t[o+1]))return o+2}return null}function _l(e){let t=e.findIndex((r)=>Ii(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Ii(r))break;n++}return n}function Ii(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return wl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return wl.has(e.slice(0,t))}function Np(e){let t=e?.replaceAll("\\","/");return[...MA].some((n)=>t===n||t?.endsWith(`/${n}`))}var Lp="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Wp(e,t,n){let r=lt(e);if(!r)return null;let o=kn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>FA(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function FA(e,t){let n=vt([...e],t),r=n.slice(1),o=ki(M(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as Oi}from"node:path";var $p="This path contains the protected policy config and you must not modify or delete it.",zA=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Bp(e,t,n){let r=VA(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Gp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=lt(e);if(e.invocation.route.kind==="command")return o?Fp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Fp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Gp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Zr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Gp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>$r(a,n,r,o,i));return s?{target:s}:null}function Fp(e,t,n,r,o){let i=kn(e,t,r,o,{findSegmentTarget:(s,a)=>$A(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>$r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>jA(s,t,n,r,o)?.target??null});return i?{target:i}:null}function $A(e,t,n,r,o){if(xr(e))return null;let i=Rt([...e],r),s=M(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&BA(a)){let l=UA(a).find((c)=>zp(Ce(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(ci(i,1)||$a(i,r)){let c=(Dr(X(i))??X(["."])).find((d)=>{let f=Ce(d.text,t.variables);return $r(f,t.cwd,n,r,o)||zp(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Zo(a).sources.find((c)=>KA(Ce(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(HA(i,s))return null;for(let l of[...e,...i])for(let c of Up(l))if($r(Ce(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function BA(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function UA(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function HA(e,t){if(!zA.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function jA(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Up(i))if($r(s,t,n,r,o))return{target:s};return null}function Up(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function VA(e,t,n){let r=(a)=>Br(me(a,e.executionCwd,t,n)),o=r($t(t)),i=[r(Cn(e.executionCwd)),r(Cn(e.configCwd))],s=new Set(i.map((a)=>Oi(a)));for(let a=Oi(o);;a=Oi(a))if(s.add(a),Oi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function $r(e,t,n,r,o){let i=tc(e,t,r,o,(s)=>Br(s)===io);return i!==null&&n.files.has(Br(i))}function zp(e,t,n,r,o){return n.directoriesAndAncestors.has(Br(me(e,t,r,o)))}function KA(e,t,n,r,o){let i=Br(me(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Br(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as Di,posix as ng,resolve as Wi,win32 as qA}from"node:path";import{fileURLToPath as YA}from"node:url";var rg="Access to a sensitive path is not allowed.",og=new Set(["echo","printf"]),ZA=new Set(["find"]),XA=new Set(["!","do","elif","else","if","then","until","while"]),JA=new Set(["-exec","-execdir"]),QA=new Set([";","+"]),eP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),tP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ig=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),nP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),rP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Il=new Set(["-c","-e","-r","-E","--eval","--exec"]),oP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),kl=new Set(["grep","rg"]),sg=new Set(["files-with-matches","files-without-match","count","quiet"]),iP=new Set([...sg,"ignore-case","fixed-strings","hidden"]),sP=new Set(["wc",...kl]),aP=new Set(["cd","grep","head","openssl","tail","tailscale"]),lP=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,cP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),dP=new Set(["commit","merge","notes","stash","tag"]),uP=new Set(["-m","--message"]),mP=new Set(["--grep"]),fP=new Set(["powershell","pwsh"]),Hp=new Set(["jq","gojq","jaq"]),jp="f",Vp="file",pP="files",gP=new Set(["e","f"]),hP=new Set(["regexp","file"]),yP=new Set(["e","f","A","B","C","m"]),CP=new Set(["regexp","file","after-context","before-context","context","max-count"]),xl="__CC_SAFETY_NET_PIPE_INPUT__",Pl=/[\w./~@+-]*[./~][\w./~@+-]*/g,SP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,bP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,EP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Kp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,qp=/\b(?:system|exec|spawn|popen)\s*$/,vP=/\b(?:eval|exec)\s*\(/g,RP=/\b(?:eval|exec)\s*$/,_P=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Yp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(HT(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=BT(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(bg(a,s.cwd,r,o)))continue;if(c&&i?.get(a)==="data")continue;if(c&&(s.isRedirectionWriteTarget===!0||i?.get(a)==="write")&&!a.includes("$")&&!Li(a,s.cwd,r,o))continue;if(c&&(s.isCreatedPath===!0||s.isCertificateInput===!0))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Li(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&jT(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function ag(e,t,n,r,o={}){let i=Zp(e,n,r),s=Yp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Zp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),l=new Map;a.forEach((p)=>lg(p.target).forEach((g)=>l.set(g,(l.get(g)??new Set).add(p.loopVariable))));let c=(p,g)=>(l.get(p)?.size??0)>(l.get(p)?.has(g)?1:0),d=a.filter(({loopVariable:p})=>p===void 0||c(p,p)||c("!",p)),f=new Set(d.filter((p)=>p.literalRole===void 0).map((p)=>p.target)),u=new Set(d.filter((p)=>p.literalRole==="write").map((p)=>p.target)),m=Yp(i,t,e.invocation.context.configCwd,n,r,new Map(d.map((p)=>[p.target,f.has(p.target)?"path":u.has(p.target)?"write":"data"])));return m?.ruleId!=="secret.deny-path"&&wP(e,n)?null:m}function wP(e,t){let n=lt(e);if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of qo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ct(s.text,t))}let o=et(r);if(o.length===0)return!1;let i=he(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Ol(i,o.slice(1))}function Ol(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e==="wc")return t.every((n)=>!n.startsWith("-")||lP.test(n));if(kl.has(e))return xP(e,t);if(e!=="find")return!1;return!t.some((n)=>eP.has(n))}function xP(e,t){let n=t.includes("--")?t.slice(0,t.indexOf("--")):t;if(n.some((c)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(c)||/^-[^-]*f/.test(c)))return!1;let r=e==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,o=e==="rg"?/[clq]/:/[Lclq]/,i=(c)=>/^-[^-]/.test(c),s=(c)=>{let d=n[c-1]??"";return/^--[^=]+$/.test(d)&&!iP.has(d.slice(2))||i(d)&&d.slice(1).search(r)===d.length-2},a=n.findIndex((c,d)=>!c.startsWith("-")&&!s(d));return(e==="grep"&&a>=0?n.slice(0,a):n).some((c,d)=>{if(s(d))return!1;if(c.startsWith("--"))return sg.has(c.slice(2));return i(c)&&o.test(c.slice(1).split(r)[0]??"")})}function Zp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=lt(e);return[...s?Vn(s.shell,e.store,r,t,o,n,AP(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function AP(e){return e.program.dialect==="powershell"}function Vn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new He;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw new Zt;let a=[...e.assignmentFallbacks.map((h)=>({target:h,cwd:o})),..._T(ct(e.source,r),t,n,r,o,i)],l=(h)=>ct(FP(h,s),r),c=/[<>=]\(/.test(e.source),d=/\bcoproc\b|\|&/.test(e.source),f=[],u=[],m=(h)=>({...n,commandHoldsPipe:n.commandHoldsPipe===!0||h||d});Ko(e,o,r,i,{word:l,segment:(h,y,b,S,E,A)=>{if(h.length===0)return null;let P=m(A);if(P.commandHoldsPipe)f.push(...h);if(u.push(he(cg(et(h))[0]??"").toLowerCase()),a.push(...Hr(h,t,c||S==="|"||S==="|&"?{...P,segmentMayFeedReader:!0}:P,r,y.cwd,i,E)),b!==null)a.push(...IP(b,h,t,P,r,y.cwd,i));return null},redirection:(h,y,b)=>{if(h.body!==void 0&&h.consumer!==void 0){let S=m(b);a.push(...dg(h.consumer,[h.body],t,S,r,y.cwd,i,(E)=>kP(h.consumer??[],E,t,S,r,y.cwd,i)))}if(h.targetOrder==="legacy-segment")return Ra;return a.push({target:l(h.target),cwd:y.cwd,...h.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let p=new Set(f.flatMap(lg)),g=c||/\$\(|`/.test(e.source)||!u.every((h)=>aP.has(h));return a.map(({loopVariable:h,...y})=>{if(y.certificateOutputMayFeedReader===!0&&g)return{target:y.target,cwd:y.cwd};return h===void 0||c||p.has(h)||p.has("!")?y:{...y,loopVariable:h}})}function lg(e){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(e)?[e]:[],...Array.from(e.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(t)=>t[1]??t[2]??"")]}function Mi(e,t,n,r,o,i,s=!1){let a=t.getShellSyntax(e,s?t.getCommandProgram(e,"powershell"):void 0);if(a.status==="structural-limit")throw new He;return a.status==="complete"?Vn(a,t,n,r,o,i,s):null}function Hr(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:o}),l=e.findIndex((C)=>!XA.has(C));if(n.skipMetadataOnlySegments===!0&&l>0)return Hr(e.slice(l),t,n,r,o,i,new Set([...s??[]].map((C)=>C-l)));let c=e[1]??"";if(n.skipMetadataOnlySegments===!0&&e[0]==="for"&&e[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(c))return e.slice(3).flatMap((C)=>We("for",C)).map((C)=>({...a(C),loopVariable:c}));if(s?.size){let C=e.filter((O,T)=>!s.has(T));if(Hp.has(he(et(C)[0]??"").toLowerCase()))return[...e.filter((O,T)=>s.has(T)).map(a),...Hr(C,t,n,r,o,i)]}let d=GP(e).map(a),f=et(e);if(f.length===0)return d;let u=f[0]??"",m=he(u).toLowerCase(),p=f.slice(1),g=n.segmentMayFeedReader===!0||n.commandHoldsPipe===!0||n.displayOperandsAreCapturedOutput===!0,h=g&&sP.has(m);if(n.skipMetadataOnlySegments===!0&&!h&&Ol(m,p))return d;let y=TP(u,m,p);if(y)return[...d,...y.map(a)];if(og.has(m))return n.displayOperandsAreCapturedOutput===!0?[...d,...ug(e).map(a)]:d;if(m==="eval")return[...d,...Mi(p.join(" "),t,n,r,o,i)??p.map(a)];let b=fP.has(N(u))?ml(f):void 0;if(b!==void 0)i.charge("derivedTokens",f.length);let S=b===void 0?null:Mi(b,t,n,r,o,i,!0);if(S?.length)return[...d,...S];if(m==="export")return[...d,...p.flatMap((C)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(C)?[C.slice(C.indexOf("=")+1)]:We(m,C)).map(a)];if(m==="git")return[...d,...$P(p).map(a)];if(m==="gh")return[...d,...Tl(m,p,cP).map(a)];if(Hp.has(m))return[...d,...zP(p).map(a)];if(kl.has(m))return[...d,...OT(p).map(a)];if(ZA.has(m))return[...d,...UP(p,t,n,r,o,i).map(a)];if(m==="mkdir"||m==="touch"){let C=new Set(e.filter((T,K)=>s?.has(K))),O=n.segmentMayFeedReader!==!0&&!(m==="touch"&&p.some((T)=>/^(?:--r|-[^-]*r)/.test(T)));return[...d,...p.flatMap((T)=>We(m,T).map((K)=>O&&!T.startsWith("-")&&!C.has(T)?{...a(K),isCreatedPath:!0}:a(K)))]}if(ke.has(m))return[...d,...p.flatMap((C)=>We("awk",C)).map(a),...p.flatMap((C)=>jP(C,t,n,r,o,i)),...p.flatMap(VP).map(a)];if(m==="curl")return[...d,...p.filter((C,O)=>fg(C)===null&&mg(p[O-1])===null).flatMap((C)=>We(m,C)).map(a),...BP(p).map(a)];if(Tn(m)){let C=wr.has(m)?Oe([m,...p]):null;if(C!==null&&C.command!==null&&C.commandIndex!==null){let O=t.getShellSyntax(C.command);if(O.status==="structural-limit")throw new He;if(O.status==="complete")return[...d,...Vn(O,t,n,r,o,i),...p.slice(C.commandIndex).filter((T)=>!T.startsWith("-")).map(a)]}return[...d,...HP(m,p,t,n,r,o,i)]}let E=(C,O)=>new RegExp(`^--?${C}=`).test(p[O]??"")||new RegExp(`^--?${C}$`).test(p[O-1]??""),A=PP(f),P=m==="openssl"&&p[0]==="x509",k=g?{certificateOutputMayFeedReader:!0}:{};return[...d,...p.flatMap((C,O)=>We(m,C).map((T)=>A&&E("(?:cert|key)-file",O)?{...a(T),isCreatedPath:!0,...k}:P&&E("in",O)?{...a(T),isCertificateInput:!0,...k}:a(T)))]}function cg(e){return he(e[0]??"").toLowerCase()==="timeout"?e.slice(2):e}function PP(e){let t=cg(e);return he(t[0]??"").toLowerCase()==="tailscale"&&t[1]==="cert"}function TP(e,t,n){let r=ki(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function IP(e,t,n,r,o,i,s){if(NP(t,n,r,o,i,s)){let a=et(e),l=Ol(he(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...ug(e),...l].map((c)=>({target:c,cwd:i}))}return dg(t,OP(e),n,r,o,i,s,()=>[])}function kP(e,t,n,r,o,i,s){let a=et(e);if(!Tn(he(a[0]??"").toLowerCase()))return[];return Mi(t,n,r,o,i,s)??[{target:t,cwd:i}]}function dg(e,t,n,r,o,i,s,a){let l=LP(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>wr.has(l)?Vn(n.getShellSyntax(c),n,r,o,i,s):Ni(l,c,n,r,o,i,s))}function ug(e){let t=et(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase();if(!og.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Dl(r.replaceAll("%%","%"))];return t.slice(1)}function OP(e){let t=et(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return DP(r);return[]}function DP(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Dl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>MP(t,r.slice(i*n,(i+1)*n)))}function MP(e,t){let n=0;return Dl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Dl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function NP(e,t,n,r,o,i){let s=et(e);if(s.length===0||he(s[0]??"").toLowerCase()!=="xargs")return!1;let a=sn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,xl]:l.map((f)=>f.split(c).join(xl));return Hr(d,t,n,r,o,i).some((f)=>f.target.includes(xl))}function LP(e){let t=et(e);if(t.length===0)return null;let n=he(t[0]??"").toLowerCase();if(!Tn(n))return null;return WP(n,t.slice(1))?n:null}function WP(e,t){let n=Ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Il.has(o)||pg(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(_P.get(n)?.has(o))r++;continue}return!1}return!0}function Ml(e){return/^python\d/.test(e)?"python":e}function GP(e){let t=[];for(let n of e){if(Sg(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Xp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function FP(e,t){if(!t||!Xp.test(e))return e;return`~${e.replace(Xp,"").replace(/\\/g,"/")}`}function We(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function zP(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>We("jq",i))}return e.flatMap((r,o)=>o===t?[]:We("jq",r))}function $P(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...dP.has(r)?Tl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),uP):Tl("git",e.slice(n),mP)];if(t.push(...We("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:We("git",o)),n++}return t}function Tl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>We(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...We(e,i))}return r}function BP(e){return e.flatMap((t,n)=>{let r=fg(t);if(r!==null)return Jp(r.flag,r.value);let o=mg(e[n-1]);return o===null?[]:Jp(o,t)})}function Jp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Al(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Al(t.slice(n+1))}return t.startsWith("@")?Al(t.slice(1)):[]}function mg(e){if(e===void 0)return null;if(ig.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function fg(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ig.has(r)?{flag:r,value:e.slice(n+1)}:null}function Al(e){return e===""||e==="-"?[]:[e]}function UP(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!JA.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>QA.has(m)),f=d===-1?c:c.slice(0,d),u=Hr(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!tP.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function HP(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Il.has(c)||pg(e,c)){let f=t[l+1];if(f!==void 0)a.push(...Ni(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...Ni(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function pg(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return oP.get(t[t.length-1]??"")?.has(Ml(e))??!1}function jP(e,t,n,r,o,i){if(!e.includes("system"))return[];return Wa(e)?.commands.flatMap((s)=>Vn(t.getShellSyntax(s),t,n,r,o,i))??[]}function VP(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function KP(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ll),...e.match(Pl)??[]]}function Ni(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:i}),l=hT(e),c=CT(t,l);if(c.kind==="unmaskable")return KP(t).map(a);let d=c.masked.match(Kp)!==null||c.literals.some((C)=>qp.test(c.masked.slice(0,C.start))),f=c.masked.match(vP)!==null||c.literals.some((C)=>RP.test(c.masked.slice(0,C.start))),u=r.inlineLiteralsPresumedData===!0&&!wr.has(e),m=u&&(l==="python"||l==="javascript"),p=u&&!(RT(c.masked)||d||f)?[]:c.literals,g=u?Array.from(c.masked.matchAll(Kp),(C)=>{let O=C.index+C[0].length;return{start:O,end:Go(c.masked,O)}}):[],h=!u||g.some((C)=>Ca(c.masked,C.start)&&!tT(c,C.start))?c.literals:c.literals.filter((C)=>qp.test(c.masked.slice(0,C.start))||g.some((O)=>C.start>=O.start&&C.start<O.end)),y=new Set(d?h:[]),b=m&&p.length>0&&!XP(c.masked,l==="python"?"#":"//"),S=b?nT(c.masked):[],E=b?Array.from(c.masked.matchAll(/[A-Za-z_$][\w$]*/g),(C)=>({name:C[0],index:C.index})):[],A=QP(E),P=!JP(c.masked,E),k=E.filter((C)=>!Qp(c.masked,{start:C.index,text:C.name,tokenStart:C.index,tokenEnd:C.index+C.name.length},S,A,P)).reduce((C,O)=>{let T=C.get(O.name)??[];return T.push(O.index),C.set(O.name,T)},new Map);return[...p.filter((C)=>C.text!=="").map((C)=>{if(!b||y.has(C))return a(C.text);if(Qp(c.masked,C,S,A,P)||rT(c.masked,C,S,k))return{...a(C.text),literalRole:"data"};return fT(c,C,S)?{...a(C.text),literalRole:"write"}:a(C.text)}),...p.flatMap((C)=>Ll(C.text)).map(a),...u?[]:c.literals.flatMap((C)=>C.text.match(Pl)??[]).map(a),...d?h.flatMap((C)=>Mi(C.text,n,{...r,commandHoldsPipe:!0},o,i,s)??[a(C.text)]):[],...f?c.literals.flatMap((C)=>Ni(e,C.text.replace(/\\(.)/g,(O,T)=>T==="n"?`
-`:T),n,r,o,i,s)):[],...m?[]:(c.masked.match(Pl)??[]).map(a),...u?(t.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(a):[]]}var Nl={"(":")","[":"]","{":"}"},gg="and|elif|else|if|in|is|not|of|or|return|while|yield",qP=new RegExp(`(?:^|[^\\w$])(?:${gg})$`),YP=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${gg})\\s*\\(|/\\*`),ZP=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function XP(e,t){return YP.test(e)||e.split(`
-`).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function JP(e,t){return sT.test(e)||t.some((n)=>{let r=iT.get(n.name),o=n.index+n.name.length;return r!==void 0&&!r.test(e.slice(o,o+40))})}function QP(e){return e.some((t)=>yg(t.name).some((n)=>ZP.test(n)))}var eT=new Set(["cmd","powershell","pwsh"]);function tT(e,t){let n=dn(e.masked,t),r=Nl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice(dn(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Il.has(s.text)||Tn(he(s.text).toLowerCase())||eT.has(he(s.text).toLowerCase().replace(/\.exe$/,""))))}function nT(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in Nl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function Qp(e,t,n,r,o){let i=n[t.tokenStart]??-1,s=e[i]??"",a=jn(e,t.tokenStart),l=dn(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,a-3),a+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(l,l+8)))return!0;if(r&&(s==="["||s==="("))return!1;let c=e[a],d=e[l];if(s==="{"&&c===":")return pT(e,a);let f=(c===s||c===",")&&(d===","||d===Nl[s]||s==="{"&&d===":");if(s!=="(")return f&&s!=="";return f&&(o&&oT.test(e.slice(Math.max(0,i-20),i))||(c===","||d===",")&&gT(e,i))}function rT(e,t,n,r){let o=Math.max(0,t.tokenStart-80),i=`${o===0?`
-`:""}${e.slice(o,t.tokenStart)}`,s=aT.exec(i)?.[1],a=e[n[t.tokenStart]??-1];if(s===void 0||a==="("||a==="[")return!1;let l=dn(e,t.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(e.slice(t.tokenEnd,l)))return!1;let c=t.tokenStart-i.length+i.lastIndexOf(s);return(r.get(s)??[]).every((d)=>d===c)}var oT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,iT=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),sT=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,aT=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,lT=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,cT=/^\s*\.\s*write_(?:text|bytes)\s*\(/,dT=/(?:^|[^\w$.])open\s*$/,uT=/^[bt]*[awx][abtwx]*$/,mT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function fT(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=jn(e.masked,t.tokenStart),i=dn(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(lT.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&cT.test(e.masked.slice(Go(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(mT.test(a))return!0;if(!dT.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&uT.test(l.text)&&/^[,)]/.test(e.masked.slice(dn(e.masked,l.tokenEnd)))}function pT(e,t){let n=jn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[jn(e,n+1-r.length)];return o==="{"||o===","}function gT(e,t){let n=jn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||qP.test(r)}function hT(e){let t=Ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var yT={python:"#",javascript:"/"};function CT(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return hg(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function hg(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===yT[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(bP.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&vT(e,s))return null;let c=n==="python"?bT(e,s):"",d=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+d.length,u=l==="`"||/[fF]/.test(c),m=s-c.length,p=u?ST(e,m,f,d,n,r):ET(e,f,d);if(p===null)return null;if(!u){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&EP.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+d.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+d.length),s=p+d.length-1}return o?null:e.length}function ST(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let d=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(d===`
-`||d==="\r"))return null;let f=o==="python"&&(d==="{"||d==="}")&&e[c+1]===d;if(!f&&e.startsWith(s,c)){let p=hg(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=d==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function bT(e,t){return SP.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ET(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
-`||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function vT(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function RT(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(nP.has(n.toLowerCase()))return!0;let o=yg(n);if(!o.some((i)=>rP.has(i)))continue;if(o.length>1)return!0;if(e[jn(e,r)]===".")return!0;if(e[dn(e,r+n.length)]==="(")return!0}return!1}function yg(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function jn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function dn(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function _T(e,t,n,r,o,i){return TT(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Vn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...wT(a,r)?xT(a,r).map((l)=>({target:l,cwd:o})):[]]})}function wT(e,t){let n=qo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||he(ct(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ct(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xT(e,t){return qo(e).flatMap((n)=>n.kind==="word"?[ct(n.text,t)]:n.kind==="redirection"&&n.target?[ct(n.target,t)]:[]).flatMap(Ll)}function Ll(e){let t=PT(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||AT(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function AT(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function PT(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function TT(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(ir(o,n))continue;if(Cg(e,r,n)){let i=IT(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=kT(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function IT(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(ir(i,n))continue;if(Cg(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function kT(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cg(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function OT(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===pP)o=!0;if(hP.has(f))r=!0;if(u!==void 0){if(f===Vp)t.push(u);continue}if(CP.has(f)){let m=e[l+1];if(f===Vp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(gP.has(h))r=!0;if(yP.has(h)){u=h,m=f.slice(g+1);break}}if(u==="")continue;if(m.length>0){if(u===jp)t.push(m);continue}let p=e[l+1];if(u===jp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function et(e){let t=e.findIndex((n)=>!Sg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Sg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var DT=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),MT=".env.",NT=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),LT=[".env.example.",".env.sample."];function WT(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function GT(e){return e.length>0&&!/\s/.test(e)}function Li(e,t,n,r){let o=bg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function bg(e,t,n,r){try{return jr(e,t,n,r)}catch(o){if(o instanceof F)throw o;return""}}var FT=/[?&][^?&=/]+=/,zT=new Set(["node_modules","__pycache__"]),$T=[["vendor","bundle"],["vendor","cache"]];function BT(e,t,n,r,o){if(WT(e))return null;let i=be(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>GT(s)||Li(e,t,r,o),c=H(qT(e,t,r,o));for(let u of Ds){let m=`~/${u.suffixParts.join("/")}`;if((tg(a,m)||tg(c,m))&&pt(u.id,n))return u.id}if(NT.has(s)||LT.some((u)=>s.startsWith(u)))return null;let d=UT(i,t,n,r,o);if(d)return d;if(DT.has(s))return null;for(let u of Os)if(s===u.basename&&pt(u.id,n))return u.id;if(s.startsWith(MT)&&pt(fo.id,n)&&l())return fo.id;for(let u of Ms)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&pt(u.id,n)&&l())return u.id}for(let u of Ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&pt(u.id,n))return u.id}if(VT(a))return null;if(!s.includes(".")&&sr.pattern.test(s)&&pt(sr.id,n))return sr.id;if(FT.test(e)&&!Li(e,t,r,o))return null;let f=KT(s,n);if(f)return f;return null}function UT(e,t,n,r,o){return po.find((i)=>{if(!pt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return G(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return G(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ur(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return G(e,be("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return G(e,s,["auth.json",".credentials.json"])||Hn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return G(e,s,["config.toml"])||a.endsWith(".config.toml")&&G(e,s,[a])}case"secret.cli.gemini":return G(e,oe(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[oe(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return G(e,oe(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ur(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>G(e,be(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return G(e,s,["config.json"])||Hn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return G(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return G(e,s,["server.token"])||Hn(e,s,["credentials"])||Hn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||G(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||G(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=oe(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return G(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&G(e,s,[a])||c.some((d)=>Ur(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[oe(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||G(e,s,["config.json"])||(c?.trim()?Ur(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>G(e,be(d,t,r,o),l))}case"secret.cli.pi":return G(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return G(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=be("~",t,r,o);return[oe(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),oe(s,".local","share","amp")].some((l)=>G(e,l,["secrets.json"]))||Hn(e,oe(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),oe(be("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>G(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ur(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=oe(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return G(e,be("~/.cursor",t,r,o),["auth.json"])||G(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&un(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return G(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||G(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||G(e,be("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return G(e,be("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||G(e,be("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),be("~/.local/share",t,r,o)].some((s)=>G(e,oe(s,"devin"),["credentials.toml"])||Hn(e,oe(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),be("~/.config",t,r,o)].some((s)=>G(e,oe(s,"devin"),["config.json"]));default:return!1}})?.id??null}var eg=new WeakMap;function V(e,t,n,r,o){let i=eg.get(o)??new Map;eg.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=be(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function G(e,t,n){return n.some((r)=>Eg(e,oe(t,r)))}function Hn(e,t,n){return n.some((r)=>un(H(e),H(oe(t,r))))}function Ur(e,t,n,r,o){return Eg(e,be(t,n,r,o))}function Eg(e,t){return H(e)===H(t)}function oe(e,...t){return Ke([e,...t].filter(Boolean).join("/"))}function HT(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(jr(e,t,o,i));return n.some((a)=>un(s,H(jr(a,r,o,i))))}function jT(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(jr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ke(W(ue(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=H(d?Ke(W(Wi(ue(d)),o.paths,i)):l&&Ke(W(`${l}/.cc-safety-net`,o.paths,i)));if(f&&un(s,f))return!1;return n.some((u)=>{let m=zs(u);if(m&&ng.basename(s)!==H(m.name))return!1;let p=H(jr(m?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return un(s,p)&&!(m&&s===p)})}function VT(e){let t=e.split("/");return t.some((n)=>zT.has(n))||$T.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function KT(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ls)if(r===o.extension&&pt(o.id,t))return o.id;for(let o of Ws)if(o.pattern.test(r)&&pt(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function pt(e,t){return!t?.disabledRules?.includes(e)}function be(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i)return"";if(!o)return i;let s=Gl(i,o),a=Di(s)?s:Ke(Wi(t,s)),l=Ke(W(a,n.paths,r));if(!un(l,o)){if(Di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function tg(e,t){return e===t||e.startsWith(`${t}/`)}function qT(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i||!o)return"";let s=Gl(i,o),a=ng.normalize(Di(s)?s:Ke(Wi(t,s))),l=Ke(ue(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&un(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function jr(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i)return"";let s=o?Gl(i,o):i;return Ke(W(Di(s)?s:Wi(t,s),n.paths,r))}function Wl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ke(W(ue(r),t.paths,n)):"",i=Ke(ue(YT(ct(e,t))));return{home:o,normalized:i}}function YT(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return YA(e)}catch{return e}}function Gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return oe(t,e.slice(2));return e}function ZT(e){if(process.platform==="win32")return!0;return qA.parse(e).root.length>1}function Ke(e){let t=e.trim(),n=(t.includes("\\")&&ZT(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function un(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function he(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class mn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var XT={findPolicyMutation:Bp,findGitMetadataMutation:um,resolveGitMetadata:tI,loadPolicySnapshot:Ud,findSensitiveTarget:ag,analyzeCommand:Dp,getModes:ss},JT=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,QT=["workdir","cwd","working_directory"];function Fl(e,t){let n={...XT,...t.dependencies},r=oI(e),o=()=>Ot("config-load",r,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),i=e.route.kind==="unknown"&&r?o():void 0,s=i?.policy.commandTools.find((T)=>T.name===e.toolName),a=s&&r?eI(e,r,s.cwd,t.environment.paths):e;if("decision"in a)return a;let l=a,c=l===e?{}:{promotedInvocation:l},d=Vr(l)?l.command:r,f=Ot("policy-protection",d,()=>am(l)),u=In(f,"input-candidate"),m=In(f,"declared-command");if(Vr(l)&&l.command?.trim()&&m?.program.status==="limited")return{stage:"command-analysis",...c,decision:{kind:"deny",reason:qe,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:l.command,segment:l.command}}};if(u?.program.status==="limited")return{stage:"command-validation",...c,decision:{kind:"deny",reason:sm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let p=Te(),g=Ot("policy-protection",d,()=>n.resolveGitMetadata([l.context.executionCwd,l.context.configCwd],t.environment)),h=Ot("policy-protection",d,()=>n.findPolicyMutation(f,t.environment,p));if(h){let T=d??h.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:$p,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:T,segment:h.target}}}}let y=Ot("policy-protection",d,()=>Wp(f,t.environment,p));if(y){let T=d??y.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:Lp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:T,segment:y.target}}}}let b=Ot("policy-protection",d,()=>n.findGitMetadataMutation(f,g,t.environment,p));if(b){let T=d??b.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:we,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:T,segment:b.target}}}}let S=i??o(),E=S.policy,A=n.getModes(E,t.environment.env),P={level:A.effectiveLevel,...nI(S),...c},k=E.secretProtection.enabled===!1?null:Ot("secret-protection",d,()=>n.findSensitiveTarget(f,E.secretProtection,t.environment,p,{strict:Vr(l)||u?.program.dialect==="powershell"?A.strict:void 0}));if(k){let T=d??k.target;return{stage:"secret-protection",...P,decision:{kind:"deny",reason:rg,intent:"hard_stop",ruleId:k.ruleId,evidence:{command:T,segment:k.target}}}}if(!Vr(l))return{stage:"non-command",...P,decision:{kind:"allow"}};if(!l.command||l.command.trim()==="")return{...Gi("command-validation",d),...P};let C=Ot("command-analysis",d,()=>Mp(()=>n.analyzeCommand(l.command,{cwd:l.context.executionCwd,shell:l.route.shell,policySnapshot:S,environment:t.environment,protectedGitMetadata:g,effectiveCapabilities:A.capabilities,worktreeMode:A.worktreeMode,budget:p,...t.trace?{trace:t.trace}:{}},rI(f),f.store),l.command,t.trace)),O=l.route.shell==="auto"&&f.store.readsAutoAsPowerShell()?()=>{let T=t.trace?.branch(),K={...Fl({...l,route:{kind:"command",shell:"posix"}},{...t,...T?{trace:T.trace}:{},dependencies:{...t.dependencies,loadPolicySnapshot:()=>S,resolveGitMetadata:()=>g}}),...c};return{decision:K.decision,withItsTrace:()=>(T?.adopt(),K)}}:void 0;if(C.decision){let T=!A.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===Ar&&!JT.test(C.decision.evidence?.segment??"")&&De(l.command)===null),K=T?O?.():void 0;if(K?.decision.kind==="deny"&&!K.decision.unverifiedByStandardMode)return K.withItsTrace();return{stage:"command-analysis",...P,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:T?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return O?.().withItsTrace()??{stage:"command-analysis",...P,decision:{kind:"allow"}}}function eI(e,t,n,r){let o=[...new Set((n?[n]:QT).flatMap((l)=>{let c=Object.getOwnPropertyDescriptor(e.input,l);return c?[c.value]:[]}))],i=o.filter((l)=>typeof l==="string"&&l.trim()!=="");if(o.length>1||i.length!==o.length)return Gi("command-validation",t);let s=i[0],a=s===void 0?e.context.configCwd:Qi(s,e.context.configCwd,r);if(!a){let l=Xn({directory:"requested",problem:"unusable",cwd:s??""});return{stage:"command-validation",decision:{kind:"deny",reason:l.reason,ruleId:l.ruleId,intent:l.intent,evidence:{command:t,segment:t}}}}return Xr(e.toolName,e.input,{kind:"command",shell:"auto"},{configCwd:e.context.configCwd,executionCwd:a},t)}function tI(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function nI(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function rI(e){return In(e,"declared-command")?.program}function oI(e){try{return er(e.input)}catch(t){let n=Vr(e)?e.command:void 0;throw new mn("policy-protection",Gi("policy-protection",t instanceof rt?void 0:n,t),t)}}function Ot(e,t,n){try{return n()}catch(r){throw new mn(e,Gi(e,r instanceof rt?void 0:t,r),r)}}function Gi(e,t,n){let r=n instanceof Zt?{reason:Ze,ruleId:"analysis.strict-unparseable"}:n instanceof F||n instanceof He?{reason:Bi,ruleId:"analysis.limit"}:{reason:Yn,ruleId:"analysis.failed-closed"};return{stage:e,decision:{kind:"deny",...r,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Vr(e){return e.route.kind==="command"}import{appendFileSync as yI,mkdirSync as CI}from"node:fs";import{isAbsolute as SI,join as Bl}from"node:path";import{lstatSync as Rg,readdirSync as iI,readFileSync as sI,rmdirSync as aI,statSync as _g,unlinkSync as lI,utimesSync as cI,writeFileSync as dI}from"node:fs";import{join as Kr}from"node:path";function vg(e,t={}){return vo($t(e,t),e.home).policy.audit.retention_days}var $l=86400000,uI=".last-prune",mI=/^\d{4}-\d{2}$/,fI=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,wg=(e)=>Math.floor(e/$l);function Ag(e,t,n=()=>new Date){try{let r=n().getTime();if(!_g(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Kr(t,uI),i=_g(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&wg(i)===wg(r))return;let s=r-vg(e)*$l,a=new Date(r).toISOString().slice(0,7);for(let l of zl(t)){if(l.isDirectory()){pI(Kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))gI(Kr(t,l.name),s)}dI(o,"",{mode:384}),cI(o,r/1000,r/1000)}catch{}}function pI(e,t,n){for(let r of zl(e)){if(!r.isDirectory()||!mI.test(r.name))continue;let o=Kr(e,r.name);for(let i of zl(o)){if(!i.isFile())continue;let s=fI.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+$l;if(!Number.isFinite(a)||a>=t)continue;Pg(Kr(o,i.name))}if(r.name!==n)xg(o)}xg(e)}function gI(e,t){try{let n=Rg(e);if(n.mtimeMs>=t)return;let r=sI(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(hI);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Rg(e).mtimeMs!==n.mtimeMs)return;Pg(e)}catch{}}function hI(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function zl(e){try{return iI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Pg(e){try{lI(e)}catch{}}function xg(e){try{aI(e)}catch{}}var bI="2.6.13",EI=1e4,vI=2000,RI=256,_I=32768;function wI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function xI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ul(e,t,n,r,o,i,s={}){let a=wI(t);if(!a)return;let l=PI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Fi(gt(n),s.failureStage?Number.POSITIVE_INFINITY:EI),f=Fi(gt(r),vI),u=s.toolName?Fi(gt(s.toolName),RI):void 0,m=i===null?void 0:Fi(gt(i),_I),p=Bl(l,xI(m?.value??null),c.slice(0,7));CI(p,{recursive:!0,mode:448});let g=Bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??as)(),v:bI,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};yI(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Ag(e,l,s.now)}catch{}}function Fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function AI(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&SI(n)?n:null}function PI(e){let t=AI(e);return t?Bl(t,".cc-safety-net","logs"):null}function Ig(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Tg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Tg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Tg(e){return"command"in e?e.command??"":""}function kg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ul(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Og(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ul(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Mg(e,t,n){try{let r=Fl(t,{environment:e,...n.guard});return Dg(e,t,r,n),r}catch(r){if(!(r instanceof mn))throw r;throw Dg(e,t,r.evaluation,n,!(r.cause instanceof rt),{stage:r.stage,errorCode:TI(r.cause)}),r}}function Dg(e,t,n,r,o=!0,i){kg(e,Ig(n.promotedInvocation??t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function TI(e){if(e instanceof F)return q[e.kind].errorCode;if(e instanceof rt)return"tool-input-limit";if(e instanceof He)return"structural-shell-syntax-limit";if(e instanceof Zt)return"unparseable-command";return"unexpected-error"}function Dt(e,t={}){return{malformed:!0,denial:Zn(t),cwd:e}}function Hl(e,t){return{malformed:!0,denial:Xn(e,t),cwd:e.cwd}}function Ng(e,t={}){return(n,r)=>{try{return II(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Zn())}}}function II(e,t,n,r){let o=kc();if(n.cancelled?.(t))return n.block(Zn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Og(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=ql(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Mg(o,i,{guard:{auditAllowed:Nc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof mn))throw l;if(ot(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Zl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Lg="exec",kI=new Set(["auto","gateway"]);function Wg(e){e.on("before_tool_call",OI(e),{matcher:[Lg],priority:50})}function OI(e,t={}){return Ng({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>DI(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>NI(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function DI(e,t,n,r){if(!e||typeof e!=="object")return Dt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Dt(null);if(o!==Lg)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Dt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Dt(null,{toolName:o});if(s.host!==void 0&&!kI.has(s.host))return Dt(null,{command:a,toolName:o});let l=MI(n,t.agentId);if(!l)return Dt(null,{command:a,toolName:o});let c=Ji(".",[l],r);if(!c)return Hl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let d=s.workdir;if(d!==void 0&&(typeof d!=="string"||d.trim()===""))return Dt(c,{command:a,toolName:o});let f=typeof d==="string"?d:".",u=Ji(f,[c],r);if(!u)return Hl({directory:"requested",problem:Cc(f,c,r),cwd:f},{command:a,toolName:o});return Xr(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:u},a)}function MI(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function NI(e){return{block:!0,blockReason:Yl(e)}}var RG={...Kl,register:Wg};export{RG as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Fr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(x(e)):e.provenance==="literal"}function $n(e){return e?x(e):""}function _i(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function sl(e,t){return ol($e(e,"posix"),t)}function zr(e){return sl(e,new Set(Array.from(e.matchAll(wf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ol(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ol(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ol(o,n))||Of(r.words,n))return!0;Mw(r,n)}return!1}function Of(e,t){let n=e.findIndex((s)=>Me(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Gr(r,t))return!0;let o=N(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Rf(e[s],t)}if(Q.has(o)){let s=e.slice(n),a=s.map((d)=>d.text),l=Oe(a),c=l.commandIndex??l.scriptIndex;return!Ke(a)&&c!==null&&Rf(s[c],t)}let i=Iw(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Of(e.slice(i),t)}function Iw(e,t,n){let r=N(e[t]?.text??"");if(r==="command")return kw(e,t+1);if(r==="exec")return Ow(e,t+1);if(r==="env")return Dw(e,t+1,n);return null}function kw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Ow(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Dw(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Gr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Gr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Me(i))continue;return r}return null}function Mw(e,t){if(!e.words.every((n)=>Me(n.text)!==null))return;for(let n of e.words){let r=Me(n.text);if(!r)continue;if(Gr(n,t))t.add(r.name)}}function Gr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(wf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(_w.test(o)||t.has(o))}))}function Rf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Gr(e,t))}var al="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ll="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Nw="__CC_SAFETY_NET_XARGS_INPUT__",Ri="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",wi="rm",Lw=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Ww=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Gw=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Fw=/^(?:[0-9]+|[@*])$/;function Nf(e,t){let n=e.map(x),{childStart:r,replacementToken:o}=sn(n),i=n.slice(r),s=v("xargs.shell-dynamic",ll);if($w(i,o,t)&&k(s,t.policy))return k(s,t.policy);for(let a of Ve(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?k(s,t.policy):null;if(c)return c;let d=$f(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Ff(l,o),u=t.analyzeChild(l,{...nn(a,t),dynamicInput:d,dynamicSourceInput:f||Wf(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",al)});if(u)return u;let m=zw(l,o,t.policy?.rules??[],k(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,Nw]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...nn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=ut(l,t.policy?.rules??[]);if(p)return p}return null}function zw(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=ut([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=N(e[0]??"");if(!n.some((i)=>N(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Lf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Ef(e,r,t.length,n);return o===null?[]:[o]}function Wf(e,t,n,r,o,i,s){if(Q.has(t)){if(Ke(e))return!1;if(n!==null&&Bw(e,n,s))return!0;let a=Ne(e);if(!a){let l=pt(X(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Gf(a,n,s))return!0;if(De(a))return!0;return Uw(a,n,r)}if(ze(t))return Df(e,n,Bo,zu(t));if(ke.has(t))return Df(e,n,za,zm);if(t==="eval"){let a=Ei(X(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Hw(e,n,i);if(t==="git"){let a=Ae(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Wn.has(a.subcommand.toLowerCase())&&zf(a.rest,n).some((l)=>l.includes(n))}return!1}function Gf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return De(i)===null&&n(i)===null}function Df(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ri]).sources.some((a)=>a.value===Ri);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ri}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ri}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Lf(l,t,a))));return Si(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function $w(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Ve(e,n),(i)=>i.head)),o=t===null?[...e,wi]:e.map((i,s)=>s===0?i:i.replaceAll(t,wi));return Array.from(Ve(o,n)).some((i)=>i.head===wi&&!r.has(wi))}function Ff(e,t){return zf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function zf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function $f(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Bw(e,t,n){let r=Oe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Gf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Lf(a,t,s).some((d)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,d):m),u=Oe(f);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(f[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(f[u.scriptIndex]??"").includes(d)})}))}function Uw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Lw))if(Mf(o,r))return!0;for(let o of e.matchAll(Ww))for(let i of(o[1]??"").matchAll(Gw))if(Mf(i,r))return!0;return sl(e,r)}function Mf(e,t){let n=e[1]??e[2];return n!==void 0&&(Fw.test(n)||t.has(n))}function Hw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(tt(s)){let l=Nn(e,i);i=l.nextIndex-1;for(let c of Ve(l.tokens,{environment:n,cwd:void 0})){let d=$f(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Ff(c.tokens,t)||Wf(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=ft(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function sn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var $r="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Br="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Vw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Kw="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ai=/\{[^{}\s]*\}/g,Bf=/\{\}|\{-?\d+\}/g,Uf=/[\s;&|<>()$`\\"']/,qw=["e","f","source","file","-e","-f","--source","--file"],Yw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Zw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Xw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Hf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Jw=new Set(["--workdir","--wd"]),jf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Le(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function qf(e){return Le([...e],(t)=>De(t))}function Yf(e,t){let n=e.map(x);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Bn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=ap(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:f}=o;if(c){let p=Bn(t);if(p)return p;let g=qf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=ix(t);if(p)return p}if(d!==void 0&&a){let p=Bn(t);if(p)return p}let u=sx(d,t.cwd,t.environment.paths);if(u===null){let p=Bn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(f){if([...Ve(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(ul)){let g=Bn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=tp(m.envAssignments,m.cwd,a);return Le(p,(h)=>t.analyzeNested(h,g))}return Le(Ve(i,m),(p)=>Qw(p,o,t,m))}function Qw(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(ip)){let E=Bn(n);if(E)return E}let c=qf(l);if(c)return c;let d=l.some(z),f=o||d,u=s&&f,m=tp(e.envAssignments,e.wrapperCwd,i||u),p=f?{...m,worktreeMode:!1}:m,g=a.join(" "),h=z(g.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>Uf.test(E))),b=h||Uf.test(a[0]??""),S=y&&b&&t.jobs.length>0?null:ex(e,t,n,r,p,d);if(S||!y)return S;return Zf(z(g)?g:`${g} {}`,!h,e,t,n,r,p)}function ex(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,d=e.tokens,f=a||i;if(Q.has(e.head)){let m=()=>{if(!a||s.length===0)return null;return Le(s,(h)=>n.analyzeChild(xi(d,h,n.budget),nn(e,r)))};if(Ke(d))return m();if(fi(d))return At();let p=Ne(d);if(p){if(sp(p)){let S=kt(n);if(S)return S;if(s.length===0)return null;return Le(s,(E)=>n.analyzeNested(rp(p,E,n.budget),o))}if(z(p))return Zf(p,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((S)=>vi(X(S===void 0?d:a?d.map((E)=>np(E,S)):[...d,...S]),p)):[];if(h.some((S)=>S.kind==="dynamic")){let S=kt(n);if(S)return S}let y=h.flatMap((S)=>S.kind==="literal"?[S.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),Le(y,(S)=>n.analyzeNested(S,o));if(zr(p)){let S=kt(n);if(S)return S}let b=n.analyzeNested(p,o);if(b)return b;if(f)return kt(n);return null}let g=pt(X(d));if(g.kind==="dynamic"||g.kind==="literal"&&z(g.source))return kt(n)??m();if(g.kind==="literal")return m();if(s.length>0){let h=kt(n);if(h)return h;let y=m();if(y)return y;if(a)return null;let b=s.flatMap((S)=>S[0]===void 0?[]:[S[0]]);return n.budget.charge("derivedTokens",b.length),Le(b,(S)=>n.analyzeNested(S,o))}if(f||c)return kt(n)??m();return null}if(e.head==="rm"&&mt(d)){if(a&&s.length>0)return Le(s,(p)=>cl(xi(d,p,n.budget,Bf),e.cwd,r));if(s.length>0)return Le(s,(p)=>cl(Kf(d,p,n.budget),e.cwd,r));let m=cl(d.flatMap((p,g)=>{if(g===0||!z(p))return[p];return p.startsWith("-")?[p.replace(Bf,"")]:[]}),e.cwd,r);if(m)return m;return ep(n)}let u=s.length>0?s:[void 0];return Le(u,(m)=>{let p=m===void 0?d:a?xi(d,m,n.budget):Kf(d,m,n.budget),g=v("parallel.shell-dynamic",Br),h=c&&e.head==="find"?ox(p,r):null,y=Jf(p,c,n)??h?.customResult??null,b=N(e.head),S=c&&(b==="rm"&&dl(p)||b==="xargs"&&Qf(p)||h?.rmOptions===!0),E=c&&(S||h?.executedSource===!0||h===null&&Xf(p,b)),A=n.analyzeChild(p,{...nn(e,r),worktreeMode:l||c||f?!1:n.worktreeMode,dynamicInput:c||f,dynamicRmInput:S,dynamicSourceInput:y!==null||E,shellDynamicMatch:g,dynamicSourceMatch:g,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",$r)});if(E){let P=k(g,n.policy);if(P)return P}return A??y??ut(p,n.policy?.rules??[])})}function Zf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Le(r.jobs,(c)=>o.analyzeNested(rp(e,t?c.map(_i):c,o.budget),s));let a=Lr(e);if(a?.[0]&&N(a[0])==="rm"&&mt(a)){let c=ep(o);if(c)return c}return(a?o.analyzeChild(a,{...nn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",Br),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",$r)}):null)??o.analyzeNested(e,s)}function Xf(e,t){if(z(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Q.has(t))return rx(e);if(t==="git")return tx(e);if(t==="find")return!0;if(ke.has(t))return Vf(e,qw,Mr);if(ze(t))return Vf(e,Yw,$o);return!1}function dl(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(z))return t===-1;return n.some((o)=>z(o)&&(o.startsWith("-")||sp(o)))}function tx(e){if(nx(e))return!0;let t=Ae(e);if(t.subcommand===null||z(t.subcommand))return!0;if(!Wn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(z))return n===-1;return r.some(z)}function nx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(z(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(z(n))return!0;continue}if(z(n))return!0}return!1}function rx(e){if(Ke(e))return!1;let t=Ne(e);if(t!==null)return z(t);let n=pt(X(e));if(n.kind==="literal")return z(n.source);if(n.kind==="dynamic")return!0;return!e.some(z)}function Vf(e,t,n){let r=n(e);if(r.some((o)=>z(o.value)))return!0;if(!e.some(z))return n([...e,jf]).some((o)=>o.value===jf);return Si(r,t,(o)=>n(e.map((i)=>np(i,[o]))))}function Jf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>N(i.command)===N(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(z))return kt(n);return Le(o,(i)=>ut([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function ox(e,t){let n={customResult:null,executedSource:!e.some(z),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(z))return;for(let a of Ve(i,t))n.executedSource||=Xf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&dl(a.tokens)||a.head==="xargs"&&Qf(a.tokens),n.customResult??=Jf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=z(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(tt(a)){i=[],n.executedSource||=z(a);continue}let l=ft(a);if(l>0){o=l,n.executedSource||=z(a);continue}n.executedSource||=z(a)}return s(),n}function Qf(e){let t=e.slice(sn(e).childStart);return N(t[0]??"")==="rm"&&dl(t)}function Pi(e,t){return(n)=>k(v(e,t),n.policy)}var kt=Pi("parallel.shell-dynamic",Br),ix=Pi("parallel.command-stream-dynamic",Vw),Bn=Pi("parallel.command-stream-dynamic",Kw),ep=Pi("parallel.rm-recursive-force-dynamic",$r);function cl(e,t,n){return k(bi(X(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Dn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function tp(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function np(e,t){return e.replace(Ai,(n)=>op(n,t))}function xi(e,t,n,r=Ai){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=op(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function rp(e,t,n){return xi([e],t,n)[0]??""}function Kf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function op(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function z(e){return e.search(Ai)!==-1}function ip(e){if(ul(e))return!0;for(let t of e.matchAll(Ai))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function ul(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function sp(e){return/^\{[^{}\s]*\}$/.test(e)}function sx(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!jw(e))return null;try{return _t(t??e,e,n)}catch{return null}}function ap(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,d=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Ua(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Ua(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=g.indexOf("="),b=y===-1?g:g.slice(0,y),S=y===-1?void 0:g.slice(y+1);if(g==="--dry-run"){c=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){d||=(g==="-I"?h:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){d=!0,t+=2;continue}if(b==="--replace"||g.startsWith("-i")&&g.length>2){let E=b==="--replace"?S:g.slice(2);d||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||Xw.has(b)){d=!0,t+=S===void 0?2:1;continue}if(g==="-q"||g==="--quote"){s=!0,t++;continue}if(g==="--pipe"||g==="--pipepart"){a=!0,t++;continue}if(b==="--env"){d=!0,t+=S===void 0?2:1;continue}if(Hf.has(b)||g.startsWith("-S")&&g.length>2){i=!0,t+=Hf.has(g)?2:1;continue}if(Jw.has(b)){d=!0;let E=S??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=S===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&S!==void 0){t++;continue}if(Zw.has(g)){if(h===void 0||h===":::"||h==="--"){d=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}d||=n.some(c?ul:ip);let f=[];if(o!==-1){let g=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){f.push(g),g=[];continue}if(y!==void 0)g.push(y)}f.push(g)}d||=f.length>1;let u=ax(f),m=n.some(z),p=n.length===0&&o===-1;return{template:n,jobs:u,childStart:r,templateHasPlaceholder:m,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:p,unsupported:d,workdir:l,dryRun:c}}function ax(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new G("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new G("derivedTokens");o.push([...i,s])}t=o}return t}function lp(e){return ap(e).childStart}var lx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ti="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function fl(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ml(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function dp(e,t,n,r,o=!1,i){let a=(mr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",lx):null;return k(a,i)??up(e,t,n,o,i)}function up(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>fl(a)?[l]:[]);if(i.length===0)return null;let s=N(t[0]?.text??"");if(s==="git"){let a=Rn(e,t),l=dx(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return k(v("shell.dynamic-structure",Ti),o);if(k(Ci(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((f,u)=>u>l&&x(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&Wn.has(c)&&i.some((f)=>f>l&&(d===-1||f<d)))return k(v("shell.dynamic-structure",Ti),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&ux(t)?k(v("shell.dynamic-structure",Ti),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&x(c)==="--"),l=mt(t.map(x));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?k(v("shell.dynamic-structure",Ti),o):null}if(s==="xargs")return cp(e,t.slice(sn(t.map(x)).childStart),"xargs",n,r,o);if(s==="parallel")return cp(e,t.slice(lp(t.map(x))),"parallel",n,r,o);return null}function cp(e,t,n,r,o,i){if(t.length===0)return null;let s=cx(t,r);if(mr(e,s)){let l=k(v(`${n}.shell-dynamic`,n==="xargs"?ll:Br),i);if(l)return l}let a=up(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>fl(l)&&ml(l)))return k(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?al:$r),i);return null}function cx(e,t){let n=qt(e,t),r=n.rewritten?X(n.words.map(x)):n.words,o=r[0];return o&&x(o)==="busybox"?r.slice(1):r}function dx(e){let t=1;while(t<e.length){let n=e[t],r=n?x(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function ux(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=fl(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ml(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ml(s)))return!0;continue}if(t=!0,a)return!0;let l=ft(s.text);if(l>0){n=l;continue}if(tt(s.text))o=!0,r=!0}return!1}function pl(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!wn(t[n.tokenIndex],n.value)})}var mp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mx="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",fx="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",px="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",gx="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",hx="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",yx={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:px},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:we},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:fx},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:hx},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:mp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:mx},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:mp}},Cx=/^\/\/?[ck]$/i,fp=/[&|]+/,Sx=/(?:"[^"]*"|[^\s"])+/g,bx=/[\^%!]/,Ex=/\\"./s,vx=/(^|\/)[*.]*\*[*.]*$/,_x=/^"?[\\/]+[?.][\\/]/,Rx=new Set(["rmdir","rd","del","erase"]),wx=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,xx=/\/s(?!\w)/i,Ax=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function pp(e,t){let n=e.map(x),r=n.findIndex((u)=>Cx.test(u));if(r===-1)return null;let o=n.slice(r+1).join(" "),i=/^".*"$/s.test(o)?o.slice(1,-1):o,s=i.split(fp).map((u)=>{let m=u.match(Sx)??[],p=m.findIndex((h)=>Rx.has(h.replace(/^@/,"").toLowerCase())),g=p===-1?[]:m.slice(p);return{piece:u,tokens:m,deleteTokens:g,recursiveDelete:g.slice(1).some((h)=>h.startsWith("/")&&h.toLowerCase().split("/").includes("s"))}}),a=s.filter((u)=>u.recursiveDelete),l=a.length>0||wx.test(i)&&xx.test(i);if(l&&(i.includes("\\\"")||t.gitBashEscapesBodyQuotes&&i.includes('"')||t.powerShellRawWords.some((u)=>Ex.test(u))||a.some((u)=>u.tokens.some((m)=>_x.test(m)))))return v("cmd.recursive-delete-escaped-quote",gx);let c=et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths}),d=s.reduce((u,m)=>u??(m.recursiveDelete?Px(m.deleteTokens,c,t.policy):t.analyzeNested(m.piece)),null),f=l&&(a.length===0||bx.test(i)||Ax.test(i)||i.includes('"')&&fp.test(i));return d??(f?At():null)}function Px(e,t,n){return e.slice(1).filter((r)=>!r.startsWith("/")).reduce((r,o)=>r??k(en(xe(Or(o.replaceAll('"',"")).replace(vx,"$1*"),t),t,n,yx),n),null)}var Tx="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",Ix=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,kx=/^-(?:executionpolicy|ep)$/i,Ox=/^-(?:command|c)$/i,Dx=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,Mx="encodedcommand",Nx=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,Lx=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Wx=/[$`]/,Gx="--%";function gp(e,t){let n=e.map(x),r=n.every((i,s)=>s===0||i!==Gx&&Fx(e[s],i))?hl(n):void 0;if(r!==void 0)return t(r);if(n.some(zx))return At();let o=n.join(" ");return Nx.test(o)&&Lx.test(o)?v("powershell.nested-recursive-delete-unread",Tx):null}function hl(e){let t=gl(e,1),n=t===void 0?[]:e.slice(t+1);return n.length>0?n.join(" "):void 0}function gl(e,t){let n=e[t]??"";if(Ox.test(n))return t;if(Ix.test(n))return gl(e,t+1);return kx.test(n)?gl(e,t+2):void 0}function Fx(e,t){return e?.provenance==="unknown"?!Wx.test(t):wn(e,t)}function zx(e){let t=Dx.exec(e)?.[1]?.toLowerCase();return t!==void 0&&(t==="ec"||Mx.startsWith(t))}var yp=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>bi(e.words,yl(e))},{heads:new Set(["cmd"]),analyze:(e)=>pp(e.words,{...yl(e),powerShellRawWords:e.options.commandView?.dialect==="powershell"?e.options.commandView.words.map((t)=>t.raw):[],gitBashEscapesBodyQuotes:e.options.commandView?.dialect!=="powershell",analyzeNested:(t)=>Ot(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(e)=>gp(e.parsedWords,(t)=>Ot(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(e)=>Ci(e.words,Cl(e))},{heads:new Set(["find"]),analyze:(e)=>Ym(e.words,{...yl(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>Nf(e.words,{...hp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ot(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Yf(e.words,{...hp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ot(e.options.analyzeNested(t,n))})}];function hp(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ot(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function yl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(e.envAssignments,e.options.environment),trustedTmpdirValue:Dn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function Cl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function Ep(e){return yp.find((t)=>t.heads.has(e))?.analyze}function Hn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((D)=>o==="posix"?x(D):D.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,u=Vo(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=qt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let R=[...p,...i(m.words)].join(" "),D=De(R);if(D)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:D.reason}),ge(D);if(n.strict)return pe(r);let B=Ko(p,i(m.words));if(B){n.budget.charge("derivedTokens",B.length);let ce=n.analyzeNested(B.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(ce)return ce}}let g=m.rewritten?X(i(m.words)):Rn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),S=h[0];if(!S)return null;if(tn(S))throw new G("wrapperPeelIterations");let E=N(S),A=m.cwd===null?void 0:m.cwd??d,P=m.cwd===null?void 0:f,I=m.cwd===void 0?n.effectiveCwd:m.cwd,C=m.cwd===void 0?n.effectiveCwd:null,O=s?s.allowTmpdirVar:!Ir(b,n.environment),T=dp(o,m.words,n.environment,t===0,n.strict,n.policy);if(T)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:T.reason}),ge(T);let J=di(h,n.policy);if(J){for(let R of[J.childIndex,...J.alternativeChildIndices]){Sp(y.wrapperNormalizationBudget);let D=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:J.wrapper,output:i(D)});let B=Hn(D,t,{...y,effectiveCwd:I,envAssignments:b});if(B)return B}return null}let ye=l?void 0:E==="eval"?Ei(g):E==="trap"&&!a?Pf(g):void 0;if(a&&s&&E==="eval"){if(ye?.kind==="dynamic")return Un(s,n.policy);if(ye?.kind==="literal"){let R=n.analyzeNested(ye.source,{effectiveCwd:I,envAssignments:b});if(R)return R}return jn(s,n.policy)}if(ye?.kind==="dynamic"&&(n.strict||!n.commandView||!il(n.commandView)))return pe(r);if(ye?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:ye.source,depth:t+1});let R=n.analyzeNested(ye.source,{effectiveCwd:I,envAssignments:b,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?Q.has(E):_p(S,E)){if(Ke(h))return null;if(fi(h))return pe(r);if(a&&s){let R=Ne(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let B=Un(s,n.policy);if(B)return B}if(zr(R)){let B=Un(s,n.policy);if(B)return B}return n.analyzeNested(R,{effectiveCwd:I,envAssignments:b})}let D=pt(g);if(D.kind==="dynamic")return Un(s,n.policy);if(D.kind==="literal")return s.dynamicSourceInput?Un(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Un(s,n.policy):null}if(l){let R=Ne(h),D=R?n.analyzeNested(R,{effectiveCwd:I,envAssignments:b}):pt(g).kind==="dynamic"?pe(r):null;if(D)return D}if(s===void 0){let R=Hx(h,b,I,n,r,t);if(R)return R;let D=Ne(h);if(D){let fn=vi(g,D);if(fn.kind==="dynamic")return pe(r);let pn=fn.kind==="literal"?fn.source:Tf(g,D),Yl=Kx(pn);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:Yl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Yl,depth:t+1});let Zl=n.analyzeNested(pn,{effectiveCwd:I,envAssignments:b});if(Zl)return Zl;return zr(pn)?pe(r):null}let B=pt(g,n.environment.home,n.strict?void 0:Gn(n.shellAssignments??new Map,{home:n.environment.home,cwd:C}));if(B.kind==="dynamic")return pe(r);if(B.kind==="literal")return Ur(B.source,I,b,n,r,t);let ce=If(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ce.kind==="dynamic")return pe(r);if(ce.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ce.source,depth:t+1}),n.analyzeNested(ce.source,{effectiveCwd:I,envAssignments:b})}}if(!s&&(E==="source"||E===".")){let R=h[1]==="-p"?2:null;if(R!==null){let pn=n.commandView?g[R]:void 0;if(!pn)return null;if(pn.provenance!=="literal")return pe(r)}let D=R===null?1:3,B=h[D]==="--"?D+1:D,ce=n.commandView?g[B]:void 0;if(!ce)return null;let fn=Cp(ce,n,C);if(fn!==null)return Ur(fn,I,b,n,r,t);if(n.strict||!n.commandView||!il(n.commandView))return pe(r)}let j=g[0];if(!s&&j&&S.includes("/")&&n.literalHeredocFiles?.size){let R=Cp(j,n,C),D=R===null?null:Ur(R,I,b,n,r,t,!1,!0);if(D)return D}if(ke.has(E)&&!l){if(!s&&n.strict&&pl(Mr(h),g))return pe(r);let R=$m(h,(B)=>Ot(n.analyzeNested(B,{effectiveCwd:I,envAssignments:b}))),D=k(R,n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:D.reason}),ge(D)}if(ze(E)&&!l){if(!s&&n.strict&&pl($o(h),g))return pe(r);let R=Fu(h);if(a&&s)return Bx(E,R,I,b,n,s);if(R){let D=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:R,paranoidBlocked:D}),D){let ce=k(v("interpreter.one-liner-paranoid",vr),n.policy);if(ce)return ge(ce)}if(ba(E,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let B=n.analyzeNested(R,{effectiveCwd:I,envAssignments:b});if(B&&!vp(B,R))return B;if(_r(R,void 0,!n.strict)){let ce=k(v("interpreter.dangerous-command",Pn),n.policy);if(ce)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:Pn}),ge(ce)}r=void 0}}if(E==="busybox"&&h.length>1)return Sp(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Hn(g.slice(1),t,{...y,effectiveCwd:I,envAssignments:b});let fe=s?null:k(Nu(E,h),n.policy);if(fe)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:fe.reason}),ge(fe);let Z=r===y.trace?y:{...y,trace:r},ne={words:g,parsedWords:m.words,head:E,cwd:A,originalCwd:P,envAssignments:b,allowTmpdirVar:O,dynamicArguments:m.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:I,options:Z,analyzeChildTokens:(R,D)=>a&&s?bl(R,t,Z,{...s,cwd:D??void 0,effectiveCwd:D??void 0}):Ot(Hn(X(R),t+1,{...Z,child:void 0,commandView:void 0,effectiveCwd:D,envAssignments:b}))??ut(R,Z.policy.rules),analyzeChild:(R,D)=>bl(R,t,Z,D)},Pe=s&&(E==="xargs"||E==="parallel")?void 0:Ep(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:O});let Ge=r&&E==="git"?bf(ne.words,Cl(ne)):void 0,ht=bp(Ge?Ge.match:Pe?.(ne)??null,n.policy);if(r)qx(ne,ht,Ge?.relaxation??null);if(ht)return ge(ht);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(mt(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?jn(s,n.policy):null)??Ux(s,n.policy)}let Hi=Pe!==void 0&&!Zx.has(E),Ze=!s&&!Hi&&!fo.has(E),ji=r&&Ze?[]:void 0;if(Ze)for(let R=1;R<h.length;R++){let D=h[R];if(!D)continue;ji?.push(D);let B=bp($x(h,R,t,Z,A,P,I,b),n.policy);if(B)return r?.recordSegment({type:"fallback-scan",tokensScanned:ji??[],embeddedCommandFound:N(D)}),ge(B)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ji??[]}),l&&s&&!s.wrappedByTransparent)return null;let Xr=ut(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Xr,reason:Xr?.reason}),Xr)return ge(Xr);return a&&s?jn(s,n.policy):null}function bl(e,t,n,r){return Ot(Hn(X(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function $x(e,t,n,r,o,i,s,a){for(let l of Ve(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=N(c);if(_p(c,d)||Ep(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=bl(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!Ir(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function Bx(e,t,n,r,o,i){if(!t)return jn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=k(v("interpreter.one-liner-paranoid",vr),o.policy);if(a)return ge(a)}if(ba(e,t))return jn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!vp(s,t))return s;if(_r(t,void 0,!o.strict)){let a=k(v("interpreter.dangerous-command",Pn),o.policy);if(a)return ge(a)}return jn(i,o.policy)}function vp(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(ei)||e.reason===Qe)&&!po(t);return n||r}function Un(e,t){let n=e.shellDynamicMatch?k(e.shellDynamicMatch,t):null;return n?ge(n):null}function jn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?k(e.dynamicSourceMatch,t):null;return n?ge(n):null}function Ux(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?k(e.rmDynamicMatch,t):null;return n?ge(n):null}function Hx(e,t,n,r,o,i){let s=qm(e);if(s.argvSource?.kind==="absent")return pe(o);if(s.argvSourceApplies&&s.argvSource){let l=Ur(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ur(a,n,t,r,o,i,!0)}function Cp(e,t,n){let r=t.environment.home,o=Fn(e,r);if(o!==null)return o;if(e.provenance==="literal")return e.text;return t.strict?null:qe(e,Gn(t.shellAssignments??new Map,{home:r,cwd:n}))}var jx=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function Ur(e,t,n,r,o,i,s=!1,a=!1){if(s&&/[$`*?[\]]/.test(e))return pe(o);let l=Er(e,t,r.environment.paths,r.budget),c=l?r.literalHeredocFiles?.get(l):void 0;if(c===void 0)return s?pe(o):null;if(a&&c.startsWith("#!")&&!jx.test(c))return null;if(r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:c,depth:i+1}),!a)return r.analyzeNested(c,{effectiveCwd:t,envAssignments:n});let d=Vx(()=>r.analyzeNested(c,{effectiveCwd:t,envAssignments:n}));return d?.intent==="stop_and_explain"?null:d}function Vx(e){try{return e()}catch(t){if(t instanceof G)return null;throw t}}function Kx(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function qx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Sp(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new G("wrapperPeelIterations");e.iterations++}function ge(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function pe(e){return e?.recordSegment({type:"error",message:Tr}),ge(At())}function _p(e,t){return Q.has(t)||e==="$SHELL"||e==="${SHELL}"||Q.has(M(t))}function bp(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:k(e,t)}var Yx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Zx=new Set(["powershell","pwsh"]),Xx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Jx(e,t){let n=xp(e,t);if(n.length===0)return!1;let r=n[wp(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Yx.test(e.join(" "))}function Rp(e,t,n,r,o){if(e.dialect==="powershell"){let S=Qx(e.words,o);if(S.kind==="none")return;if(!t||S.kind==="unknown")return null;return Sl(rA(S.target),t,n.paths)}let i=e.words.map(x),s=i.some((S)=>/^CDPATH\+?=/.test(S));if(!Jx(i,n))return s?null:void 0;if(!t)return null;let a=xp(i,n,t),l=wp(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((S)=>S.length<=1||!S.startsWith("-")||S==="--");if((d===-1?c:c.slice(0,d)).some((S)=>!/^-[LP]+$/.test(S)))return null;let u=d===-1?[]:c.slice(d),m=u[0]==="--"?u.slice(1):u;if(m.length>1)return null;let p=m[0],g=r.get("HOME")||n.home;if(p===void 0)return Sl(de(g),t,n.paths);let h=e.words.find((S)=>S.provenance==="variable"&&S.text===p),y=e.words.find((S)=>S.text===p&&/^~(?:\/|$)/.test(S.raw)),b=h?qe(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return Sl(de(b),t,n.paths)}function Sl(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=_t(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function Qx(e,t){let n=eA(e[0])?1:0,r=e[n];if(!tA(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Xx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return nA(e.slice(n+1),t)}function eA(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function tA(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function nA(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function rA(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function wp(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function xp(e,t,n){let r=oA(e);return Rt([...r],t,n)}function oA(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var uA="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",an="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function xl(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Xe}),{reason:Xe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??$e(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Xe}),{reason:Xe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return wl(e,n);let d=`${ei}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Dp(e,n),{reason:Qe,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Dp(e,n),{reason:Qe,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return wl(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=lf(n.environment.env,n.envAssignments);return Oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Oi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let f=e.nodes[c+1],u=f?.kind==="connector"?f.operator:void 0,m=mA(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],S={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(Dt(u)&&!Dt(a))l=S;let E=Dt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Dt(a)?l??S:S,A=ln(E.connector)||ln(u);if(d.kind==="function"){let Y=h.flatMap((fe)=>{let Z=cn(fe);return Z.functionDefinitions.set(d.name,d.body),El(fe,[Z],m,u==="&",ln(u))}),j=vl(Y,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=j.states,s=j.conditionalStates,a=void 0;continue}if(d.kind==="group"){let Y=[],j=[];for(let Z of h){let ne=Oi(d.body,t,n,r,[cn(Z)]);if(ne.result)return ne;if(Y.push(...El(Z,ne.states,m,u==="&",ln(u))),A)j.push(Z,...m?ne.states.map((Pe)=>Ii(Z,Pe)):ne.states)}let fe=vl(Y,j,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=fe.states,s=fe.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let P=WA(e.nodes[c-1]),I=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],O=Dt(a)&&C?.kind==="command"?Af(C)??pA(C):void 0,T=[],J=[];for(let Y of h){let j=gA(d,t,n,r,[cn(Y)]);if(j.result)return{result:j.result,states:i};let fe=e.dialect==="powershell"?j.states:j.states.map((Z)=>Ii(Y,Z));for(let Z of fe){let ne=cn(Z),Pe=CA(d,t,n.trace?{...n,trace:Mp(n.trace,I)}:n,r,ne,Dt(a),O);if(Pe)return{result:Pe,states:i};let Ge=HA(d,ne.functionDefinitions);if(Ge)n.budget.charge("derivedTokens",Di(Ge));let ht=Ge?t+1>=V.recursionDepth.cap?_l(d.displayText,n,[ne]):Oi(Ge,t+1,n,r,[ne]):{result:null,states:BA(d,ne).flatMap((Ze)=>GA(d,Z,Ze,P))};if(ht.result)return ht;T.push(...El(Y,ht.states,m,u==="&",ln(u)));let Hi=typeof ne.effectiveCwd==="string"&&ne.effectiveCwd!==Z.effectiveCwd&&d.redirections.every((Ze)=>["<",">",">>",">|"].includes(Ze.operator)&&Ze.target?.text==="/dev/null");if(A&&(P||!Hi))J.push(Y),J.push(...ht.states.map((Ze)=>m?Ii(Y,Ze):Ze))}}let ye=vl(T,J,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=ye.states,s=ye.conditionalStates,a=void 0}return{result:null,states:i}}function mA(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Dt(r)||Dt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&fA(e,t)}function El(e,t,n,r,o){let i=n?t.map((a)=>Ii(e,a)):[...t],s=o?i.flatMap((a)=>Vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function Ii(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function fA(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(hA(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Dt(e){return e==="|"||e==="|&"}function pA(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function ln(e){return e==="&&"||e==="||"}function vl(e,t,n,r,o,i){let s={success:ki([...n,...e]),failure:ki([...r,...t])},a=ln(i)?s:void 0;return{states:ln(o)||a?ki([...s.success,...s.failure]):s.success,conditionalStates:a}}function Mp(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,branch:e.branch,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function gA(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=yA(e);if(s){if(t+1>=V.recursionDepth.cap)return _l(s,n,o);let a=$e(s,"powershell");if(a.status==="limited")return _l(s,n,o);if(a.status!=="complete")return Ap(i,n,r,o);n.budget.charge("derivedTokens",Di(a)),i.push({program:a,depth:t+1})}}return Ap(i,n,r,o)}function hA(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Ap(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Oi(i.program,i.depth,t,n,[cn(a)]);if(l.result)return l;s.push(...l.states)}o=ki(s)}return{result:null,states:o}}function yA(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Di(o),0):n.kind==="group"||n.kind==="function"?Di(n.body):0),0)}function _l(e,t,n){return t.trace?.recordSegment({type:"error",message:Xe}),{result:{reason:Xe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function CA(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:wA(n.environment.paths,o.createdDirectories,n.budget)}},l=kA(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Np(e,o,"before-consumer",a.environment.paths,a.budget);let c=Rn(e.dialect,e.words),d=c.map(x),f=e.displayText,u=sf(c,o.shellGitContextState,{home:a.environment.home,cwd:o.effectiveCwd,darwinUserTempDir:a.environment.darwinUserTempDir}),m=df(u,o.shellGitContextState);if(e.dialect==="powershell"){let y=k(Mm(e,i,jA(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!y,reason:y?.reason}),y)return Op(f,y)}let p=k(Lu(e.redirections),a.policy);if(p)return a.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:p.reason}),Op(f,p);if(d.length===1&&d[0]?.includes(" ")&&!mr(e.dialect,e.words)){let y=k(De(d[0]),a.policy),b=y!==null&&!a.strict&&ku(e,a.rootProgram);if(y&&!b)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:y.reason}),{reason:y.reason,segment:f,ruleId:y.id,intent:y.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let S=Pp(e,l,o,m,s,a);if(S)return S;return Qa(u,o.shellGitContextState),null}let g=Hn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(y,b)=>{let S=b&&Object.hasOwn(b,"effectiveCwd")?b.effectiveCwd:o.effectiveCwd,E=xl(y,t+1,{...a,effectiveCwd:S,envAssignments:b?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:b?.functionDefinitions,worktreeMode:b?.worktreeMode??a.worktreeMode,shell:b?.shell??a.shell,trace:a.trace?Mp(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:f};let h=Pp(e,l,o,m,s,a);if(h)return h;return Qa(u,o.shellGitContextState),null}function Pp(e,t,n,r,o,i){let s=OA(e,t,n,r??new Map,i);if(s)return s;if(Np(e,n,"after-consumer",i.environment.paths,i.budget),!EA(e))n.literalHeredocFiles.clear();return _A(e,t,n,i.environment.paths,i.budget,i.environment.home),xA(e,n,i.environment.paths,i.budget,i.environment.home),NA(e,n,o,i.environment,i.trace),null}var SA=new Set([">>","<>"]),bA=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function EA(e){return e.nested.length===0&&e.redirections.length===0&&e.words.length>0&&e.words.every((t)=>bA.test(t.raw))}function Np(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?vA(s):SA.has(s.operator)))continue;Tp(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Wp(e.words.slice(1));if(!i)return;for(let s of i.operands)Tp(s,t,r,o)}function vA(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Tp(e,t,n,r){let o=e?.provenance==="literal"?Er(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function _A(e,t,n,r,o,i){if(t)return;let s=e.redirections.find((a)=>a.operator==="<<"||a.operator==="<<-")?.heredoc;if(!s)return;for(let a of RA(e,Gn(n.shellGitContextState.shellAssignments,{home:i,cwd:n.effectiveCwd}),i)){let l=Er(a,n.effectiveCwd,r,o);if(!l||!Gu(l))continue;if(!n.literalHeredocFiles.has(l)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new G("trackedHeredocFiles");n.literalHeredocFiles.set(l,s.body)}}function RA(e,t,n){let r=Rl(TA(e.redirections)?.target,t,n),o=r===void 0?[]:[r];if(le(e.words[0],"cat"))return PA(e.words)?o:[];if(!le(e.words[0],"tee"))return[];let i=Wp(e.words.slice(1),t);if(!i||i.append||i.hasUnsupportedOptions)return[];let s=i.operands.map((a)=>Rl(a,t,n));if(!s.every((a)=>a!==void 0))return[];return[...s,...o]}function Rl(e,t,n){if(IA(e))return e.text;if(!e)return;return Fn(e,n)??qe(e,t)??void 0}function wA(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=W(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${dA}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?W(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function xA(e,t,n,r,o){if(t.shellGitContextState.bodyDepth>0||!le(e.words[0],"mkdir"))return;let i=e.words.slice(1).map((d)=>Rl(d,t.shellGitContextState.shellAssignments,o));if(!i.every((d)=>d!==void 0))return;let s=i.findIndex((d)=>d==="--"||d==="-"||!d.startsWith("-")),a=i.slice(0,s);if(s===-1||!a.every((d)=>/^(?:-[pv]+|--parents|--verbose)$/.test(d)))return;let l=a.some((d)=>d==="--parents"||/^-v*p/.test(d)),c=t.effectiveCwd;for(let d of i.slice(i[s]==="--"?s+1:s)){if(d.split(/[\\/]/).includes("..")||!sA(d)&&!c)continue;let f=W(cA(c??"",d),n,r);if(l?AA(f,n):n.isDirectory(iA(f))&&Lp(f,n))t.createdDirectories.add(f)}}function AA(e,t){let n=lA(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>aA(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||Lp(o(i),t)}function Lp(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function PA(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function TA(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Wp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&qe(s,t)===null)return;if(r&&le(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function IA(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Al(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function kA(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return an;let r=n[0];if(!r?.heredoc)return an;let o=/\$\(|`/.test(r.heredoc.body);if(!Al(r.heredoc)&&(!t||o))return uA;if(r.fd!==void 0&&r.fd!==0)return an;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return an;let i=e.redirections.some((l)=>l!==r&&Ip(l.target));if(le(e.words[0],"cat"))return i?an:void 0;if(le(e.words[0],"tee"))return i||e.words.slice(1).some(Ip)?an:void 0;let s=e.words[0],a=e.words[1];if(le(s,"git")&&(le(a,"apply")||le(a,"commit")))return;if(le(s,"gh")&&(le(a,"pr")||le(a,"issue"))&&le(e.words[2],"create"))return;return an}function Ip(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function OA(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(MA(e,i,n,r,o))return null;let a=DA(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=wl(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function DA(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Al(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!ze(i.text))return;let s=o.findIndex((f)=>le(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=k(v("interpreter.one-liner-paranoid",vr),n.policy);if(f)return f}if(!_r(l,void 0,!n.strict))return null;let d=k(v("interpreter.dangerous-command",Pn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function MA(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Al(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=qt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(x),l=N(a[0]??"");if((s.envSplitValues?.length??0)>0||!Q.has(l)&&!Q.has(M(l)))return!1;return Ke(a)}function NA(e,t,n,r,o){let i=Rp(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(x).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var LA=new Set(["fi","done","esac"]);function WA(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function GA(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&LA.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((f)=>{if(f===n.effectiveCwd)return n;let u=cn(n);return u.effectiveCwd=f,u})}function FA(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var zA=/^[A-Za-z_][A-Za-z0-9_]*$/,$A=8;function BA(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!zA.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=$A&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=cn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function cn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:cf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function ki(e){let t=[];for(let n of e){if(!t.some((r)=>UA(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new G("controlFlowStates")}return t}function UA(e,t){return e.effectiveCwd===t.effectiveCwd&&FA(e.compoundBodies,t.compoundBodies)&&Vn(e.shellGitContextState.env,t.shellGitContextState.env)&&Vn(e.literalHeredocFiles,t.literalHeredocFiles)&&Vn(e.functionDefinitions,t.functionDefinitions)&&Vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&kp(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&kp(e.createdDirectories,t.createdDirectories)}function kp(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function HA(e,t){let n=fr(e);return n===void 0?void 0:t.get(n)}function Op(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function jA(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function wl(e,t){let n=k(De(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Dp(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Qe},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var VA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Gp(e,t,n,r){let o=xl(e,0,{...t,...qd(t),budget:t.budget??Te(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function Fp(e,t,n){try{return{decision:e()}}catch(r){let o=KA(r,t,n);if(!o)throw r;return o}}function KA(e,t,n){if(!(e instanceof G)||!VA.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var qA=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Tl=new Set(["cc-safety-net","ccsn"]),YA=new Set(["bunx","npx","pnpx"]),ZA=new Set(["pnpm","yarn"]),XA=new Set(["npm","pnpm","yarn"]),JA=new Set(["bun","node"]);function Ni(e,t,n={}){if(Tl.has(e))return 0;if(YA.has(e)){if(n.broad)return Pl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&XA.has(e)&&n.broad&&t[r]==="exec"){let o=Pl(t.slice(r+1));return o===null?null:r+1+o}if(ZA.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Pl(t.slice(r+1));return o===null?null:r+1+o}if(JA.has(e)){let o=n.broad&&r!==-1?r:0;if(zp(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&zp(t[o+1]))return o+2}return null}function Pl(e){let t=e.findIndex((r)=>Mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Mi(r))break;n++}return n}function Mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Tl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Tl.has(e.slice(0,t))}function zp(e){let t=e?.replaceAll("\\","/");return[...qA].some((n)=>t===n||t?.endsWith(`/${n}`))}var $p="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Bp(e,t,n){let r=ct(e);if(!r)return null;let o=On(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>QA(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function QA(e,t){let n=Rt([...e],t),r=n.slice(1),o=Ni(M(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as Li}from"node:path";var Vp="This path contains the protected policy config and you must not modify or delete it.",eP=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Kp(e,t,n){let r=sP(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Up(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ct(e);if(e.invocation.route.kind==="command")return o?Hp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Hp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Up(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||eo(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Up(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Hr(a,n,r,o,i));return s?{target:s}:null}function Hp(e,t,n,r,o){let i=On(e,t,r,o,{findSegmentTarget:(s,a)=>tP(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Hr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>iP(s,t,n,r,o)?.target??null});return i?{target:i}:null}function tP(e,t,n,r,o){if(Pr(e))return null;let i=wt([...e],r),s=M(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&nP(a)){let l=rP(a).find((c)=>jp(Se(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(pi(i,1)||ja(i,r)){let c=(Nr(X(i))??X(["."])).find((d)=>{let f=Se(d.text,t.variables);return Hr(f,t.cwd,n,r,o)||jp(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=ti(a).sources.find((c)=>aP(Se(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(oP(i,s))return null;for(let l of[...e,...i])for(let c of qp(l))if(Hr(Se(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function nP(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function rP(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function oP(e,t){if(!eP.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function iP(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of qp(i))if(Hr(s,t,n,r,o))return{target:s};return null}function qp(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function sP(e,t,n){let r=(a)=>jr(ue(a,e.executionCwd,t,n)),o=r($t(t)),i=[r(Sn(e.executionCwd)),r(Sn(e.configCwd))],s=new Set(i.map((a)=>Li(a)));for(let a=Li(o);;a=Li(a))if(s.add(a),Li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Hr(e,t,n,r,o){let i=ic(e,t,r,o,(s)=>jr(s)===uo);return i!==null&&n.files.has(jr(i))}function jp(e,t,n,r,o){return n.directoriesAndAncestors.has(jr(ue(e,t,r,o)))}function aP(e,t,n,r,o){let i=jr(ue(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function jr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as Wi,posix as ag,resolve as $i,win32 as lP}from"node:path";import{fileURLToPath as cP}from"node:url";var lg="Access to a sensitive path is not allowed.",cg=new Set(["echo","printf"]),dP=new Set(["find"]),uP=new Set(["!","do","elif","else","if","then","until","while"]),mP=new Set(["-exec","-execdir"]),fP=new Set([";","+"]),pP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),gP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),dg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),hP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),yP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Ml=new Set(["-c","-e","-r","-E","--eval","--exec"]),CP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Nl=new Set(["grep","rg"]),ug=new Set(["files-with-matches","files-without-match","count","quiet"]),SP=new Set([...ug,"ignore-case","fixed-strings","hidden"]),bP=new Set(["wc",...Nl]),EP=new Set(["cd","grep","head","openssl","tail","tailscale"]),vP=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,_P=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),RP=new Set(["commit","merge","notes","stash","tag"]),wP=new Set(["-m","--message"]),xP=new Set(["--grep"]),AP=new Set(["powershell","pwsh"]),Yp=new Set(["jq","gojq","jaq"]),Zp="f",Xp="file",PP="files",TP=new Set(["e","f"]),IP=new Set(["regexp","file"]),kP=new Set(["e","f","A","B","C","m"]),OP=new Set(["regexp","file","after-context","before-context","context","max-count"]),Il="__CC_SAFETY_NET_PIPE_INPUT__",Ol=/[\w./~@+-]*[./~][\w./~@+-]*/g,DP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,MP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,NP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Jp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Qp=/\b(?:system|exec|spawn|popen)\s*$/,LP=/\b(?:eval|exec)\s*\(/g,WP=/\b(?:eval|exec)\s*$/,GP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function eg(e,t,n,r,o,i){for(let s of e){let a=s.target;if(oI(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=nI(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(wg(a,s.cwd,r,o)))continue;if(c&&i?.get(a)==="data")continue;if(c&&(s.isRedirectionWriteTarget===!0||i?.get(a)==="write")&&!a.includes("$")&&!zi(a,s.cwd,r,o))continue;if(c&&(s.isCreatedPath===!0||s.isCertificateInput===!0))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!zi(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&iI(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function mg(e,t,n,r,o={}){let i=tg(e,n,r),s=eg(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=tg(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),l=new Map;a.forEach((p)=>fg(p.target).forEach((g)=>l.set(g,(l.get(g)??new Set).add(p.loopVariable))));let c=(p,g)=>(l.get(p)?.size??0)>(l.get(p)?.has(g)?1:0),d=a.filter(({loopVariable:p})=>p===void 0||c(p,p)||c("!",p)),f=new Set(d.filter((p)=>p.literalRole===void 0).map((p)=>p.target)),u=new Set(d.filter((p)=>p.literalRole==="write").map((p)=>p.target)),m=eg(i,t,e.invocation.context.configCwd,n,r,new Map(d.map((p)=>[p.target,f.has(p.target)?"path":u.has(p.target)?"write":"data"])));return m?.ruleId!=="secret.deny-path"&&FP(e,n)?null:m}function FP(e,t){let n=ct(e);if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Qo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(dt(s.text,t))}let o=nt(r);if(o.length===0)return!1;let i=he(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Ll(i,o.slice(1))}function Ll(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e==="wc")return t.every((n)=>!n.startsWith("-")||vP.test(n));if(Nl.has(e))return zP(e,t);if(e!=="find")return!1;return!t.some((n)=>pP.has(n))}function zP(e,t){let n=t.includes("--")?t.slice(0,t.indexOf("--")):t;if(n.some((c)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(c)||/^-[^-]*f/.test(c)))return!1;let r=e==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,o=e==="rg"?/[clq]/:/[Lclq]/,i=(c)=>/^-[^-]/.test(c),s=(c)=>{let d=n[c-1]??"";return/^--[^=]+$/.test(d)&&!SP.has(d.slice(2))||i(d)&&d.slice(1).search(r)===d.length-2},a=n.findIndex((c,d)=>!c.startsWith("-")&&!s(d));return(e==="grep"&&a>=0?n.slice(0,a):n).some((c,d)=>{if(s(d))return!1;if(c.startsWith("--"))return ug.has(c.slice(2));return i(c)&&o.test(c.slice(1).split(r)[0]??"")})}function tg(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ct(e);return[...s?Yn(s.shell,e.store,r,t,o,n,$P(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function $P(e){return e.program.dialect==="powershell"}function Yn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new je;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw new Zt;let a=[...e.assignmentFallbacks.map((h)=>({target:h,cwd:o})),...GT(dt(e.source,r),t,n,r,o,i)],l=(h)=>dt(QP(h,s),r),c=/[<>=]\(/.test(e.source),d=/\bcoproc\b|\|&/.test(e.source),f=[],u=[],m=(h)=>({...n,commandHoldsPipe:n.commandHoldsPipe===!0||h||d});Jo(e,o,r,i,{word:l,segment:(h,y,b,S,E,A)=>{if(h.length===0)return null;let P=m(A);if(P.commandHoldsPipe)f.push(...h);if(u.push(he(pg(nt(h))[0]??"").toLowerCase()),a.push(...Kr(h,t,c||S==="|"||S==="|&"?{...P,segmentMayFeedReader:!0}:P,r,y.cwd,i,E)),b!==null)a.push(...HP(b,h,t,P,r,y.cwd,i));return null},redirection:(h,y,b)=>{if(h.body!==void 0&&h.consumer!==void 0){let S=m(b);a.push(...gg(h.consumer,[h.body],t,S,r,y.cwd,i,(E)=>jP(h.consumer??[],E,t,S,r,y.cwd,i)))}if(h.targetOrder==="legacy-segment")return Aa;return a.push({target:l(h.target),cwd:y.cwd,...h.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let p=new Set(f.flatMap(fg)),g=c||/\$\(|`/.test(e.source)||!u.every((h)=>EP.has(h));return a.map(({loopVariable:h,...y})=>{if(y.certificateOutputMayFeedReader===!0&&g)return{target:y.target,cwd:y.cwd};return h===void 0||c||p.has(h)||p.has("!")?y:{...y,loopVariable:h}})}function fg(e){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(e)?[e]:[],...Array.from(e.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(t)=>t[1]??t[2]??"")]}function Gi(e,t,n,r,o,i,s=!1){let a=t.getShellSyntax(e,s?t.getCommandProgram(e,"powershell"):void 0);if(a.status==="structural-limit")throw new je;return a.status==="complete"?Yn(a,t,n,r,o,i,s):null}function Kr(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:o}),l=e.findIndex((C)=>!uP.has(C));if(n.skipMetadataOnlySegments===!0&&l>0)return Kr(e.slice(l),t,n,r,o,i,new Set([...s??[]].map((C)=>C-l)));let c=e[1]??"";if(n.skipMetadataOnlySegments===!0&&e[0]==="for"&&e[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(c))return e.slice(3).flatMap((C)=>We("for",C)).map((C)=>({...a(C),loopVariable:c}));if(s?.size){let C=e.filter((O,T)=>!s.has(T));if(Yp.has(he(nt(C)[0]??"").toLowerCase()))return[...e.filter((O,T)=>s.has(T)).map(a),...Kr(C,t,n,r,o,i)]}let d=JP(e).map(a),f=nt(e);if(f.length===0)return d;let u=f[0]??"",m=he(u).toLowerCase(),p=f.slice(1),g=n.segmentMayFeedReader===!0||n.commandHoldsPipe===!0||n.displayOperandsAreCapturedOutput===!0,h=g&&bP.has(m);if(n.skipMetadataOnlySegments===!0&&!h&&Ll(m,p))return d;let y=UP(u,m,p);if(y)return[...d,...y.map(a)];if(cg.has(m))return n.displayOperandsAreCapturedOutput===!0?[...d,...hg(e).map(a)]:d;if(m==="eval")return[...d,...Gi(p.join(" "),t,n,r,o,i)??p.map(a)];let b=AP.has(N(u))?hl(f):void 0;if(b!==void 0)i.charge("derivedTokens",f.length);let S=b===void 0?null:Gi(b,t,n,r,o,i,!0);if(S?.length)return[...d,...S];if(m==="export")return[...d,...p.flatMap((C)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(C)?[C.slice(C.indexOf("=")+1)]:We(m,C)).map(a)];if(m==="git")return[...d,...tT(p).map(a)];if(m==="gh")return[...d,...Dl(m,p,_P).map(a)];if(Yp.has(m))return[...d,...eT(p).map(a)];if(Nl.has(m))return[...d,...VT(p).map(a)];if(dP.has(m))return[...d,...rT(p,t,n,r,o,i).map(a)];if(m==="mkdir"||m==="touch"){let C=new Set(e.filter((T,J)=>s?.has(J))),O=n.segmentMayFeedReader!==!0&&!(m==="touch"&&p.some((T)=>/^(?:--r|-[^-]*r)/.test(T)));return[...d,...p.flatMap((T)=>We(m,T).map((J)=>O&&!T.startsWith("-")&&!C.has(T)?{...a(J),isCreatedPath:!0}:a(J)))]}if(ke.has(m))return[...d,...p.flatMap((C)=>We("awk",C)).map(a),...p.flatMap((C)=>iT(C,t,n,r,o,i)),...p.flatMap(sT).map(a)];if(m==="curl")return[...d,...p.filter((C,O)=>Cg(C)===null&&yg(p[O-1])===null).flatMap((C)=>We(m,C)).map(a),...nT(p).map(a)];if(In(m)){let C=Ar.has(m)?Oe([m,...p]):null;if(C!==null&&C.command!==null&&C.commandIndex!==null){let O=t.getShellSyntax(C.command);if(O.status==="structural-limit")throw new je;if(O.status==="complete")return[...d,...Yn(O,t,n,r,o,i),...p.slice(C.commandIndex).filter((T)=>!T.startsWith("-")).map(a)]}return[...d,...oT(m,p,t,n,r,o,i)]}let E=(C,O)=>new RegExp(`^--?${C}=`).test(p[O]??"")||new RegExp(`^--?${C}$`).test(p[O-1]??""),A=BP(f),P=m==="openssl"&&p[0]==="x509",I=g?{certificateOutputMayFeedReader:!0}:{};return[...d,...p.flatMap((C,O)=>We(m,C).map((T)=>A&&E("(?:cert|key)-file",O)?{...a(T),isCreatedPath:!0,...I}:P&&E("in",O)?{...a(T),isCertificateInput:!0,...I}:a(T)))]}function pg(e){return he(e[0]??"").toLowerCase()==="timeout"?e.slice(2):e}function BP(e){let t=pg(e);return he(t[0]??"").toLowerCase()==="tailscale"&&t[1]==="cert"}function UP(e,t,n){let r=Ni(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function HP(e,t,n,r,o,i,s){if(YP(t,n,r,o,i,s)){let a=nt(e),l=Ll(he(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...hg(e),...l].map((c)=>({target:c,cwd:i}))}return gg(t,VP(e),n,r,o,i,s,()=>[])}function jP(e,t,n,r,o,i,s){let a=nt(e);if(!In(he(a[0]??"").toLowerCase()))return[];return Gi(t,n,r,o,i,s)??[{target:t,cwd:i}]}function gg(e,t,n,r,o,i,s,a){let l=ZP(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Ar.has(l)?Yn(n.getShellSyntax(c),n,r,o,i,s):Fi(l,c,n,r,o,i,s))}function hg(e){let t=nt(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase();if(!cg.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Wl(r.replaceAll("%%","%"))];return t.slice(1)}function VP(e){let t=nt(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return KP(r);return[]}function KP(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Wl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>qP(t,r.slice(i*n,(i+1)*n)))}function qP(e,t){let n=0;return Wl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Wl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function YP(e,t,n,r,o,i){let s=nt(e);if(s.length===0||he(s[0]??"").toLowerCase()!=="xargs")return!1;let a=sn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Il]:l.map((f)=>f.split(c).join(Il));return Kr(d,t,n,r,o,i).some((f)=>f.target.includes(Il))}function ZP(e){let t=nt(e);if(t.length===0)return null;let n=he(t[0]??"").toLowerCase();if(!In(n))return null;return XP(n,t.slice(1))?n:null}function XP(e,t){let n=Gl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Ml.has(o)||Sg(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(GP.get(n)?.has(o))r++;continue}return!1}return!0}function Gl(e){return/^python\d/.test(e)?"python":e}function JP(e){let t=[];for(let n of e){if(Rg(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var ng=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function QP(e,t){if(!t||!ng.test(e))return e;return`~${e.replace(ng,"").replace(/\\/g,"/")}`}function We(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function eT(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>We("jq",i))}return e.flatMap((r,o)=>o===t?[]:We("jq",r))}function tT(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...RP.has(r)?Dl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),wP):Dl("git",e.slice(n),xP)];if(t.push(...We("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:We("git",o)),n++}return t}function Dl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>We(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...We(e,i))}return r}function nT(e){return e.flatMap((t,n)=>{let r=Cg(t);if(r!==null)return rg(r.flag,r.value);let o=yg(e[n-1]);return o===null?[]:rg(o,t)})}function rg(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return kl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return kl(t.slice(n+1))}return t.startsWith("@")?kl(t.slice(1)):[]}function yg(e){if(e===void 0)return null;if(dg.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Cg(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return dg.has(r)?{flag:r,value:e.slice(n+1)}:null}function kl(e){return e===""||e==="-"?[]:[e]}function rT(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!mP.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>fP.has(m)),f=d===-1?c:c.slice(0,d),u=Kr(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!gP.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function oT(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Ml.has(c)||Sg(e,c)){let f=t[l+1];if(f!==void 0)a.push(...Fi(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...Fi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Sg(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return CP.get(t[t.length-1]??"")?.has(Gl(e))??!1}function iT(e,t,n,r,o,i){if(!e.includes("system"))return[];return $a(e)?.commands.flatMap((s)=>Yn(t.getShellSyntax(s),t,n,r,o,i))??[]}function sT(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function aT(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(zl),...e.match(Ol)??[]]}function Fi(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:i}),l=IT(e),c=OT(t,l);if(c.kind==="unmaskable")return aT(t).map(a);let d=c.masked.match(Jp)!==null||c.literals.some((C)=>Qp.test(c.masked.slice(0,C.start))),f=c.masked.match(LP)!==null||c.literals.some((C)=>WP.test(c.masked.slice(0,C.start))),u=r.inlineLiteralsPresumedData===!0&&!Ar.has(e),m=u&&(l==="python"||l==="javascript"),p=u&&!(WT(c.masked)||d||f)?[]:c.literals,g=u?Array.from(c.masked.matchAll(Jp),(C)=>{let O=C.index+C[0].length;return{start:O,end:Uo(c.masked,O)}}):[],h=!u||g.some((C)=>va(c.masked,C.start)&&!gT(c,C.start))?c.literals:c.literals.filter((C)=>Qp.test(c.masked.slice(0,C.start))||g.some((O)=>C.start>=O.start&&C.start<O.end)),y=new Set(d?h:[]),b=m&&p.length>0&&!uT(c.masked,l==="python"?"#":"//"),S=b?hT(c.masked):[],E=b?Array.from(c.masked.matchAll(/[A-Za-z_$][\w$]*/g),(C)=>({name:C[0],index:C.index})):[],A=fT(E),P=!mT(c.masked,E),I=E.filter((C)=>!og(c.masked,{start:C.index,text:C.name,tokenStart:C.index,tokenEnd:C.index+C.name.length},S,A,P)).reduce((C,O)=>{let T=C.get(O.name)??[];return T.push(O.index),C.set(O.name,T)},new Map);return[...p.filter((C)=>C.text!=="").map((C)=>{if(!b||y.has(C))return a(C.text);if(og(c.masked,C,S,A,P)||yT(c.masked,C,S,I))return{...a(C.text),literalRole:"data"};return AT(c,C,S)?{...a(C.text),literalRole:"write"}:a(C.text)}),...p.flatMap((C)=>zl(C.text)).map(a),...u?[]:c.literals.flatMap((C)=>C.text.match(Ol)??[]).map(a),...d?h.flatMap((C)=>Gi(C.text,n,{...r,commandHoldsPipe:!0},o,i,s)??[a(C.text)]):[],...f?c.literals.flatMap((C)=>Fi(e,C.text.replace(/\\(.)/g,(O,T)=>T==="n"?`
+`:T),n,r,o,i,s)):[],...m?[]:(c.masked.match(Ol)??[]).map(a),...u?(t.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(a):[]]}var Fl={"(":")","[":"]","{":"}"},bg="and|elif|else|if|in|is|not|of|or|return|while|yield",lT=new RegExp(`(?:^|[^\\w$])(?:${bg})$`),cT=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${bg})\\s*\\(|/\\*`),dT=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function uT(e,t){return cT.test(e)||e.split(`
+`).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function mT(e,t){return bT.test(e)||t.some((n)=>{let r=ST.get(n.name),o=n.index+n.name.length;return r!==void 0&&!r.test(e.slice(o,o+40))})}function fT(e){return e.some((t)=>vg(t.name).some((n)=>dT.test(n)))}var pT=new Set(["cmd","powershell","pwsh"]);function gT(e,t){let n=dn(e.masked,t),r=Fl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice(dn(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Ml.has(s.text)||In(he(s.text).toLowerCase())||pT.has(he(s.text).toLowerCase().replace(/\.exe$/,""))))}function hT(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in Fl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function og(e,t,n,r,o){let i=n[t.tokenStart]??-1,s=e[i]??"",a=qn(e,t.tokenStart),l=dn(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,a-3),a+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(l,l+8)))return!0;if(r&&(s==="["||s==="("))return!1;let c=e[a],d=e[l];if(s==="{"&&c===":")return PT(e,a);let f=(c===s||c===",")&&(d===","||d===Fl[s]||s==="{"&&d===":");if(s!=="(")return f&&s!=="";return f&&(o&&CT.test(e.slice(Math.max(0,i-20),i))||(c===","||d===",")&&TT(e,i))}function yT(e,t,n,r){let o=Math.max(0,t.tokenStart-80),i=`${o===0?`
+`:""}${e.slice(o,t.tokenStart)}`,s=ET.exec(i)?.[1],a=e[n[t.tokenStart]??-1];if(s===void 0||a==="("||a==="[")return!1;let l=dn(e,t.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(e.slice(t.tokenEnd,l)))return!1;let c=t.tokenStart-i.length+i.lastIndexOf(s);return(r.get(s)??[]).every((d)=>d===c)}var CT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,ST=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),bT=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,ET=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,vT=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,_T=/^\s*\.\s*write_(?:text|bytes)\s*\(/,RT=/(?:^|[^\w$.])open\s*$/,wT=/^[bt]*[awx][abtwx]*$/,xT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function AT(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=qn(e.masked,t.tokenStart),i=dn(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(vT.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&_T.test(e.masked.slice(Uo(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(xT.test(a))return!0;if(!RT.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&wT.test(l.text)&&/^[,)]/.test(e.masked.slice(dn(e.masked,l.tokenEnd)))}function PT(e,t){let n=qn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[qn(e,n+1-r.length)];return o==="{"||o===","}function TT(e,t){let n=qn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||lT.test(r)}function IT(e){let t=Gl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var kT={python:"#",javascript:"/"};function OT(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return Eg(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function Eg(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===kT[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(MP.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&LT(e,s))return null;let c=n==="python"?MT(e,s):"",d=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+d.length,u=l==="`"||/[fF]/.test(c),m=s-c.length,p=u?DT(e,m,f,d,n,r):NT(e,f,d);if(p===null)return null;if(!u){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&NP.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+d.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+d.length),s=p+d.length-1}return o?null:e.length}function DT(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let d=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(d===`
+`||d==="\r"))return null;let f=o==="python"&&(d==="{"||d==="}")&&e[c+1]===d;if(!f&&e.startsWith(s,c)){let p=Eg(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=d==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function MT(e,t){return DP.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function NT(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
+`||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function LT(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function WT(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(hP.has(n.toLowerCase()))return!0;let o=vg(n);if(!o.some((i)=>yP.has(i)))continue;if(o.length>1)return!0;if(e[qn(e,r)]===".")return!0;if(e[dn(e,r+n.length)]==="(")return!0}return!1}function vg(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function qn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function dn(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function GT(e,t,n,r,o,i){return UT(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Yn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...FT(a,r)?zT(a,r).map((l)=>({target:l,cwd:o})):[]]})}function FT(e,t){let n=Qo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||he(dt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=dt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function zT(e,t){return Qo(e).flatMap((n)=>n.kind==="word"?[dt(n.text,t)]:n.kind==="redirection"&&n.target?[dt(n.target,t)]:[]).flatMap(zl)}function zl(e){let t=BT(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||$T(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function $T(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function BT(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function UT(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(ar(o,n))continue;if(_g(e,r,n)){let i=HT(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=jT(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function HT(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(ar(i,n))continue;if(_g(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function jT(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function _g(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function VT(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===PP)o=!0;if(IP.has(f))r=!0;if(u!==void 0){if(f===Xp)t.push(u);continue}if(OP.has(f)){let m=e[l+1];if(f===Xp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(TP.has(h))r=!0;if(kP.has(h)){u=h,m=f.slice(g+1);break}}if(u==="")continue;if(m.length>0){if(u===Zp)t.push(m);continue}let p=e[l+1];if(u===Zp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function nt(e){let t=e.findIndex((n)=>!Rg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Rg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var KT=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),qT=".env.",YT=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),ZT=[".env.example.",".env.sample."];function XT(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function JT(e){return e.length>0&&!/\s/.test(e)}function zi(e,t,n,r){let o=wg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function wg(e,t,n,r){try{return qr(e,t,n,r)}catch(o){if(o instanceof G)throw o;return""}}var QT=/[?&][^?&=/]+=/,eI=new Set(["node_modules","__pycache__"]),tI=[["vendor","bundle"],["vendor","cache"]];function nI(e,t,n,r,o){if(XT(e))return null;let i=Ee(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>JT(s)||zi(e,t,r,o),c=U(lI(e,t,r,o));for(let u of Ws){let m=`~/${u.suffixParts.join("/")}`;if((sg(a,m)||sg(c,m))&&gt(u.id,n))return u.id}if(YT.has(s)||ZT.some((u)=>s.startsWith(u)))return null;let d=rI(i,t,n,r,o);if(d)return d;if(KT.has(s))return null;for(let u of Ls)if(s===u.basename&&gt(u.id,n))return u.id;if(s.startsWith(qT)&&gt(Co.id,n)&&l())return Co.id;for(let u of Gs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&gt(u.id,n)&&l())return u.id}for(let u of Fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&gt(u.id,n))return u.id}if(sI(a))return null;if(!s.includes(".")&&lr.pattern.test(s)&&gt(lr.id,n))return lr.id;if(QT.test(e)&&!zi(e,t,r,o))return null;let f=aI(s,n);if(f)return f;return null}function rI(e,t,n,r,o){return So.find((i)=>{if(!gt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ee("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Kn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,oe(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[oe(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,oe(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ee(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Kn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Kn(e,s,["credentials"])||Kn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=oe(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((d)=>Vr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=oe(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[oe(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>F(e,Ee(d,t,r,o),l))}case"secret.cli.pi":return F(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ee("~",t,r,o);return[oe(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),oe(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Kn(e,oe(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[oe(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),oe(Ee("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>F(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=oe(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=oe(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ee("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&un(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ee("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return F(e,Ee("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||F(e,Ee("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),Ee("~/.local/share",t,r,o)].some((s)=>F(e,oe(s,"devin"),["credentials.toml"])||Kn(e,oe(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),Ee("~/.config",t,r,o)].some((s)=>F(e,oe(s,"devin"),["config.json"]));default:return!1}})?.id??null}var ig=new WeakMap;function H(e,t,n,r,o){let i=ig.get(o)??new Map;ig.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ee(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>xg(e,oe(t,r)))}function Kn(e,t,n){return n.some((r)=>un(U(e),U(oe(t,r))))}function Vr(e,t,n,r,o){return xg(e,Ee(t,n,r,o))}function xg(e,t){return U(e)===U(t)}function oe(e,...t){return Ye([e,...t].filter(Boolean).join("/"))}function oI(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(qr(e,t,o,i));return n.some((a)=>un(s,U(qr(a,r,o,i))))}function iI(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(qr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ye(W(de(a),o.paths,i)):"",c=U(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=U(d?Ye(W($i(de(d)),o.paths,i)):l&&Ye(W(`${l}/.cc-safety-net`,o.paths,i)));if(f&&un(s,f))return!1;return n.some((u)=>{let m=Hs(u);if(m&&ag.basename(s)!==U(m.name))return!1;let p=U(qr(m?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return un(s,p)&&!(m&&s===p)})}function sI(e){let t=e.split("/");return t.some((n)=>eI.has(n))||tI.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function aI(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of zs)if(r===o.extension&&gt(o.id,t))return o.id;for(let o of $s)if(o.pattern.test(r)&&gt(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function gt(e,t){return!t?.disabledRules?.includes(e)}function Ee(e,t,n,r){let{home:o,normalized:i}=$l(e,n,r);if(!i)return"";if(!o)return i;let s=Bl(i,o),a=Wi(s)?s:Ye($i(t,s)),l=Ye(W(a,n.paths,r));if(!un(l,o)){if(Wi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function sg(e,t){return e===t||e.startsWith(`${t}/`)}function lI(e,t,n,r){let{home:o,normalized:i}=$l(e,n,r);if(!i||!o)return"";let s=Bl(i,o),a=ag.normalize(Wi(s)?s:Ye($i(t,s))),l=Ye(de(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&un(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function qr(e,t,n,r){let{home:o,normalized:i}=$l(e,n,r);if(!i)return"";let s=o?Bl(i,o):i;return Ye(W(Wi(s)?s:$i(t,s),n.paths,r))}function $l(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ye(W(de(r),t.paths,n)):"",i=Ye(de(cI(dt(e,t))));return{home:o,normalized:i}}function cI(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return cP(e)}catch{return e}}function Bl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return oe(t,e.slice(2));return e}function dI(e){if(process.platform==="win32")return!0;return lP.parse(e).root.length>1}function Ye(e){let t=e.trim(),n=(t.includes("\\")&&dI(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function un(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function he(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class mn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var uI={findPolicyMutation:Kp,findGitMetadataMutation:gm,resolveGitMetadata:gI,loadPolicySnapshot:Kd,findSensitiveTarget:mg,analyzeCommand:Gp,getModes:ds},mI=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,fI=["workdir","cwd","working_directory"];function Ul(e,t){let n={...uI,...t.dependencies},r=CI(e),o=()=>Mt("config-load",r,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),i=e.route.kind==="unknown"&&r?o():void 0,s=i?.policy.commandTools.find((T)=>T.name===e.toolName),a=s&&r?pI(e,r,s.cwd,t.environment.paths):e;if("decision"in a)return a;let l=a,c=l===e?{}:{promotedInvocation:l},d=Yr(l)?l.command:r,f=Mt("policy-protection",d,()=>um(l)),u=kn(f,"input-candidate"),m=kn(f,"declared-command");if(Yr(l)&&l.command?.trim()&&m?.program.status==="limited")return{stage:"command-analysis",...c,decision:{kind:"deny",reason:Xe,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:l.command,segment:l.command}}};if(u?.program.status==="limited")return{stage:"command-validation",...c,decision:{kind:"deny",reason:dm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let p=Te(),g=Mt("policy-protection",d,()=>n.resolveGitMetadata([l.context.executionCwd,l.context.configCwd],t.environment)),h=Mt("policy-protection",d,()=>n.findPolicyMutation(f,t.environment,p));if(h){let T=d??h.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:Vp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:T,segment:h.target}}}}let y=Mt("policy-protection",d,()=>Bp(f,t.environment,p));if(y){let T=d??y.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:$p,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:T,segment:y.target}}}}let b=Mt("policy-protection",d,()=>n.findGitMetadataMutation(f,g,t.environment,p));if(b){let T=d??b.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:we,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:T,segment:b.target}}}}let S=i??o(),E=S.policy,A=n.getModes(E,t.environment.env),P={level:A.effectiveLevel,...hI(S),...c},I=E.secretProtection.enabled===!1?null:Mt("secret-protection",d,()=>n.findSensitiveTarget(f,E.secretProtection,t.environment,p,{strict:Yr(l)||u?.program.dialect==="powershell"?A.strict:void 0}));if(I){let T=d??I.target;return{stage:"secret-protection",...P,decision:{kind:"deny",reason:lg,intent:"hard_stop",ruleId:I.ruleId,evidence:{command:T,segment:I.target}}}}if(!Yr(l))return{stage:"non-command",...P,decision:{kind:"allow"}};if(!l.command||l.command.trim()==="")return{...Bi("command-validation",d),...P};let C=Mt("command-analysis",d,()=>Fp(()=>n.analyzeCommand(l.command,{cwd:l.context.executionCwd,shell:l.route.shell,policySnapshot:S,environment:t.environment,protectedGitMetadata:g,effectiveCapabilities:A.capabilities,worktreeMode:A.worktreeMode,budget:p,...t.trace?{trace:t.trace}:{}},yI(f),f.store),l.command,t.trace)),O=l.route.shell==="auto"&&f.store.readsAutoAsPowerShell()?()=>{let T=t.trace?.branch(),J={...Ul({...l,route:{kind:"command",shell:"posix"}},{...t,...T?{trace:T.trace}:{},dependencies:{...t.dependencies,loadPolicySnapshot:()=>S,resolveGitMetadata:()=>g}}),...c};return{decision:J.decision,withItsTrace:()=>(T?.adopt(),J)}}:void 0;if(C.decision){let T=!A.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===Tr&&!mI.test(C.decision.evidence?.segment??"")&&De(l.command)===null),J=T?O?.():void 0;if(J?.decision.kind==="deny"&&!J.decision.unverifiedByStandardMode)return J.withItsTrace();return{stage:"command-analysis",...P,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:T?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return O?.().withItsTrace()??{stage:"command-analysis",...P,decision:{kind:"allow"}}}function pI(e,t,n,r){let o=[...new Set((n?[n]:fI).flatMap((l)=>{let c=Object.getOwnPropertyDescriptor(e.input,l);return c?[c.value]:[]}))],i=o.filter((l)=>typeof l==="string"&&l.trim()!=="");if(o.length>1||i.length!==o.length)return Bi("command-validation",t);let s=i[0],a=s===void 0?e.context.configCwd:os(s,e.context.configCwd,r);if(!a){let l=Qn({directory:"requested",problem:"unusable",cwd:s??""});return{stage:"command-validation",decision:{kind:"deny",reason:l.reason,ruleId:l.ruleId,intent:l.intent,evidence:{command:t,segment:t}}}}return to(e.toolName,e.input,{kind:"command",shell:"auto"},{configCwd:e.context.configCwd,executionCwd:a},t)}function gI(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function hI(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function yI(e){return kn(e,"declared-command")?.program}function CI(e){try{return nr(e.input)}catch(t){let n=Yr(e)?e.command:void 0;throw new mn("policy-protection",Bi("policy-protection",t instanceof ot?void 0:n,t),t)}}function Mt(e,t,n){try{return n()}catch(r){throw new mn(e,Bi(e,r instanceof ot?void 0:t,r),r)}}function Bi(e,t,n){let r=n instanceof Zt?{reason:Qe,ruleId:"analysis.strict-unparseable"}:n instanceof G||n instanceof je?{reason:Ki,ruleId:"analysis.limit"}:{reason:Xn,ruleId:"analysis.failed-closed"};return{stage:e,decision:{kind:"deny",...r,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Yr(e){return e.route.kind==="command"}import{appendFileSync as kI,mkdirSync as OI}from"node:fs";import{isAbsolute as DI,join as Vl}from"node:path";import{lstatSync as Pg,readdirSync as SI,readFileSync as bI,rmdirSync as EI,statSync as Tg,unlinkSync as vI,utimesSync as _I,writeFileSync as RI}from"node:fs";import{join as Zr}from"node:path";function Ag(e,t={}){return Ao($t(e,t),e.home).policy.audit.retention_days}var jl=86400000,wI=".last-prune",xI=/^\d{4}-\d{2}$/,AI=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Ig=(e)=>Math.floor(e/jl);function Og(e,t,n=()=>new Date){try{let r=n().getTime();if(!Tg(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Zr(t,wI),i=Tg(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Ig(i)===Ig(r))return;let s=r-Ag(e)*jl,a=new Date(r).toISOString().slice(0,7);for(let l of Hl(t)){if(l.isDirectory()){PI(Zr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))TI(Zr(t,l.name),s)}RI(o,"",{mode:384}),_I(o,r/1000,r/1000)}catch{}}function PI(e,t,n){for(let r of Hl(e)){if(!r.isDirectory()||!xI.test(r.name))continue;let o=Zr(e,r.name);for(let i of Hl(o)){if(!i.isFile())continue;let s=AI.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+jl;if(!Number.isFinite(a)||a>=t)continue;Dg(Zr(o,i.name))}if(r.name!==n)kg(o)}kg(e)}function TI(e,t){try{let n=Pg(e);if(n.mtimeMs>=t)return;let r=bI(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(II);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Pg(e).mtimeMs!==n.mtimeMs)return;Dg(e)}catch{}}function II(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Hl(e){try{return SI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Dg(e){try{vI(e)}catch{}}function kg(e){try{EI(e)}catch{}}var MI="2.6.14",NI=1e4,LI=2000,WI=256,GI=32768;function FI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function zI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Kl(e,t,n,r,o,i,s={}){let a=FI(t);if(!a)return;let l=BI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Ui(yt(n),s.failureStage?Number.POSITIVE_INFINITY:NI),f=Ui(yt(r),LI),u=s.toolName?Ui(yt(s.toolName),WI):void 0,m=i===null?void 0:Ui(yt(i),GI),p=Vl(l,zI(m?.value??null),c.slice(0,7));OI(p,{recursive:!0,mode:448});let g=Vl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??us)(),v:MI,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};kI(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Og(e,l,s.now)}catch{}}function Ui(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function $I(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&DI(n)?n:null}function BI(e){let t=$I(e);return t?Vl(t,".cc-safety-net","logs"):null}function Ng(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Mg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Mg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Mg(e){return"command"in e?e.command??"":""}function Lg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Kl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Wg(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Kl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Fg(e,t,n){try{let r=Ul(t,{environment:e,...n.guard});return Gg(e,t,r,n),r}catch(r){if(!(r instanceof mn))throw r;throw Gg(e,t,r.evaluation,n,!(r.cause instanceof ot),{stage:r.stage,errorCode:UI(r.cause)}),r}}function Gg(e,t,n,r,o=!0,i){Lg(e,Ng(n.promotedInvocation??t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function UI(e){if(e instanceof G)return V[e.kind].errorCode;if(e instanceof ot)return"tool-input-limit";if(e instanceof je)return"structural-shell-syntax-limit";if(e instanceof Zt)return"unparseable-command";return"unexpected-error"}function Nt(e,t={}){return{malformed:!0,denial:Jn(t),cwd:e}}function ql(e,t){return{malformed:!0,denial:Qn(e,t),cwd:e.cwd}}function zg(e,t={}){return(n,r)=>{try{return HI(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Jn())}}}function HI(e,t,n,r){let o=Nc();if(n.cancelled?.(t))return n.block(Jn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Wg(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=Jl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Fg(o,i,{guard:{auditAllowed:Fc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof mn))throw l;if(it(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ec(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var $g="exec",jI=new Set(["auto","gateway"]);function Bg(e){e.on("before_tool_call",VI(e),{matcher:[$g],priority:50})}function VI(e,t={}){return zg({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>KI(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>YI(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function KI(e,t,n,r){if(!e||typeof e!=="object")return Nt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Nt(null);if(o!==$g)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Nt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Nt(null,{toolName:o});if(s.host!==void 0&&!jI.has(s.host))return Nt(null,{command:a,toolName:o});let l=qI(n,t.agentId);if(!l)return Nt(null,{command:a,toolName:o});let c=rs(".",[l],r);if(!c)return ql({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let d=s.workdir;if(d!==void 0&&(typeof d!=="string"||d.trim()===""))return Nt(c,{command:a,toolName:o});let f=typeof d==="string"?d:".",u=rs(f,[c],r);if(!u)return ql({directory:"requested",problem:vc(f,c,r),cwd:f},{command:a,toolName:o});return to(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:u},a)}function qI(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function YI(e){return{block:!0,blockReason:Ql(e)}}var GG={...Xl,register:Bg};export{GG as default};