cc-safety-net 2.6.13 → 2.6.15

package/dist/openclaw/cc-safety-net/index.js

@@ -1,52 +1,52 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.6.13
-var Kl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",qe="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Yn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var $i={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},qn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},q=Object.freeze({realpathAttempts:{cap:16384,...$i},processedCandidateBytes:{cap:4194304,...$i},pathEnvironmentExpansion:{cap:64,...$i},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...qn},trackedHeredocFiles:{cap:64,...qn},controlFlowStates:{cap:64,...qn},wrapperPeelIterations:{cap:20,...qn},derivedCommandShape:qn});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(q[e].reason);this.kind=e}}function Te(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>q[t].cap)throw new F(t)}}}var Gg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function gt(e){return Fg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Fg(e){return Gg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var zg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $g(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":zg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.6.15
+var Jl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Yi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Jn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var qi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Xn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...qi},processedCandidateBytes:{cap:4194304,...qi},pathEnvironmentExpansion:{cap:64,...qi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Xn},trackedHeredocFiles:{cap:64,...Xn},controlFlowStates:{cap:64,...Xn},wrapperPeelIterations:{cap:20,...Xn},derivedCommandShape:Xn});class G extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Te(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new G(t)}}}var Hg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function yt(e){return jg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function jg(e){return Hg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Vg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Kg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Vg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ql(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Zn(e={}){return{reason:Yn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Bg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Xn(e,t={}){return{...Bg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Yl(e){return $g({...e,redact:gt})}function Zl(e){return gt(e instanceof Error?e.message:String(e))}import{isAbsolute as Xi,relative as hh,resolve as yc,sep as yh}from"node:path";import{basename as Ql,dirname as Ug,isAbsolute as Hg,join as jg,normalize as Vg,resolve as Xl}from"node:path";var Kg=256,qr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ue(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function nt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Vi(e,t){return Ui(e,0,t)}function Ui(e,t,n){let r="",o=0,i=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let a=Hi(e,o+2),l=qg(e,o,t);if(l===null){if(qr.has(a))throw new F("pathEnvironmentExpansion");if(i++,i>q.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");r+="${",o+=2;continue}let c=e.slice(o,l+1);r+=Yg(c,t,n),o=l+1;continue}let s=Hi(e,o+1);if(!s){r+="$",o++;continue}r+=ji(s,n)??`$${s}`,o+=s.length+1}return r}function qg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>q.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Yg(e,t,n){let r=e.slice(2,-1),o=Hi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return ji(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(qr.has(o))throw new F("pathEnvironmentExpansion");return e}if(!qr.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=ji(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ui(i.slice(s.length),t+1,n);return l?Ui(i.slice(s.length),t+1,n):""}function Hi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function ji(e,t){if(!qr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function W(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ec(n,i);let s=t.realpath(i);if(s!==null)return Jl(n,e,s,o);let a=Ug(i);if(a===i||o.length>=Kg)return Jl(n,e,i,o);o.push(Ql(i)),i=a}}function Jl(e,t,n,r){let o=r.length===0?n:jg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Zg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ec(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ec(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function me(e,t,n,r){let o=nc(e,t,n);if(!o)return"";return W(o,n.paths,r).replace(/\\/g,"/")}function tc(e,t,n,r,o){let i=nc(e,t,n);if(!i)return null;if(o(Ql(i)))return W(i,n.paths,r).replace(/\\/g,"/");let s=Zg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function nc(e,t,n){let r=n.home,o=Vi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Xl(r,o.slice(2)):o,s=ue(i);return Vg(Hg(s)?s:Xl(t,s))}import{types as Xg}from"node:util";var Jg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Qg=new Set(["command","diff","input","patch","patchtext"]),rc=new TextEncoder,eh=new TextDecoder,th=/\s/,nh=64;class rt extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Jn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function rh(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Zr(e){return Jg.has(rh(e))}function er(e){if(!e||typeof e!=="object")return;pc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ye();return}if(t.get||t.set)Ye();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function lc(e,t){return cc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function cc(e,t,n,r,o){let i=fc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>cc(l,t,i.array?n:t.has(dc(a)),r,o+1));return r.ancestors.delete(i.object),s}function dc(e){return e.replace(/-/g,"_").toLowerCase()}function uc(e){return mc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(ih)}function mc(e,t,n,r){let o=fc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>mc(a,o.array?t:Qg.has(dc(s)),n,r+1));return n.ancestors.delete(o.object),i}function oh(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Jn.maxDepth||t.nodes>Jn.maxNodes)Ye();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Jn.maxStringBytes||t.stringBytes>Jn.maxAggregateStringBytes)Ye()}function fc(e,t,n){if(oh(e,t,n),!e||typeof e!=="object")return null;let r=pc(e);if(t.ancestors.has(e))Ye();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Jn.maxKeys)Ye();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ye();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function pc(e){if(Xg.isProxy(e))Ye();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ye();return t}function Ye(){throw new rt}function ih(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=sh(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ki(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ki(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Yi(Yr(c.slice(4),!0),Yr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ki(c))}return t}function sh(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ki(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return ac(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return ac(n[1]);if(e.startsWith("diff --git "))return ah(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return sc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return sc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ph(i[1]);return[]}function ah(e){let t=lh(e);if(t.length===2&&t[0]&&t[1])return Yi(t[0],t[1]);let n=ch(e);return n?Yi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function lh(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Lt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Lt(e[n]))n++;t.push(e.slice(i,n));continue}let o=gc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Lt(e[n]))n++;return n===e.length?t:[]}function ch(e){let t=0;while(t<e.length&&Lt(e[t]))t++;let n=e.length;while(n>t&&Lt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Lt(e[o])){o++;continue}let i=o;while(o<n&&Lt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>nh)Ye();if(dh(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function dh(e,t,n,r,o){if(qi(e,t,n,r,o))return!0;let i=oc(e,"/",t,n),s=oc(e,"/",r,o);if(i<=t||s<=r)return!1;if(qi(e,t,i,r,s))return!1;return qi(e,i+1,n,s+1,o)}function qi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function oc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Lt(e){return e!==void 0&&th.test(e)}function gc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:eh.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...rc.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...rc.encode(uh(s[0]??""))),o+=2}return null}function uh(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function mh(e){return Qn(gh(e))}function Yi(e,t){if(e==="/dev/null")return ic(t);if(t==="/dev/null")return ic(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Qn);let n=fh(e,t)??(e===t?hc(e):null);return[e,t,...n?[n]:[]].flatMap(Qn)}function ic(e){let t=hc(e);return[e,...t?[t]:[]].flatMap(Qn)}function hc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function fh(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function sc(e){return mh(Yr(e,!0))}function ph(e){return Qn(Yr(e,!1))}function Yr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=gc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function gh(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Qn(e){return e===""||e==="/dev/null"?[]:[e]}function ac(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Ji(e,t,n){if(nt(e))return;let r=t.flatMap((i)=>Zi(i,n));if(!r[0])return;let o=Zi(Xi(e)?e:yc(r[0],e),n)[0];if(!o)return;return r.some((i)=>Ch(o,i))?o:void 0}function Qi(e,t,n){if(nt(e))return;return Zi(Xi(e)?e:yc(t,e),n)[0]}function Cc(e,t,n){return Qi(e,t,n)?"outside-workspace":"unusable"}function Zi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Ch(e,t){let n=hh(t,e);return n===""||n!==".."&&!n.startsWith(`..${yh}`)&&!Xi(n)}function Xr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as jh,realpathSync as Vh,statSync as Kh}from"node:fs";import{homedir as qh,tmpdir as Yh}from"node:os";import{statSync as Bh}from"node:fs";import{join as Uh}from"node:path";import{spawnSync as Sh}from"node:child_process";import{accessSync as Sc,constants as bc,existsSync as tr,lstatSync as bh,opendirSync as Eh,readFileSync as nr,realpathSync as pn,statSync as gn}from"node:fs";import{dirname as Rc,isAbsolute as es,join as Ie,resolve as Jr}from"node:path";var vh=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Rh=5000;function _c(e,t=Gh(),n=Rh){let r=_h(e),o=r===null?null:wh(r);if(r===null||o===null)return null;let i=Lh(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function _h(e){try{let t=pn(Jr(e));return gn(t).isDirectory()?t:null}catch{return null}}function wh(e){let t=Nh(e);if(!t)return null;try{let n=bh(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ts(t);if(!r?.commonDir)return null;if(!Ph(r.gitDir,t))return null;return Ac(r.gitDir,r.commonDir)?null:{gitDir:r.gitDir,commonDir:r.commonDir}}catch{return null}}function ts(e){try{let t=xh(e);if(!t)return null;let n=pn(es(t)?t:Jr(Rc(e),t));if(!gn(n).isDirectory())return null;return{gitDir:n,commonDir:Ah(n)}}catch{return null}}function xh(e){let t=nr(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ah(e){try{let t=nr(Ie(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=pn(es(t)?t:Jr(e,t));return gn(n).isDirectory()?n:null}catch{return null}}function Ph(e,t){let n=Th(e);return n===null?!1:Ih(e,n,t)}function Th(e){let t=Ie(e,"gitdir");if(!tr(t))return null;let n=nr(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Ih(e,t,n){try{return kh(es(t)?t:Jr(e,t),n)}catch{return!1}}function kh(e,t){try{let n=gn(e),r=gn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ec(pn.native(e))===Ec(pn.native(t))}function Ec(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function wc(e){try{return Sc(Ie(e,"objects"),bc.X_OK),Sc(Ie(e,"refs"),bc.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Pc(Ie(e,"HEAD")))}catch{return!1}}function xc(e){return tr(Ie(e,"commondir"))||Ac(e,e)}function Ac(e,t){return[Ie(t,"config"),Ie(e,"config.worktree")].some(Oh)||Mh(e)}var vc=1048576;function Pc(e){let t=gn(e);if(!t.isFile()||t.size>vc)throw Error(`${e} is not a regular file within ${vc} bytes`);return nr(e,"utf-8")}function Oh(e){try{return/(?:^|[\s\]])worktree\s*=/i.test(Pc(e))}catch(t){return t.code!=="ENOENT"}}var Dh=1e4;function Mh(e){let t=[e],n=0;try{while(t.length>0){let r=t.pop(),o=Eh(r);try{for(let i=o.readSync();i!==null;i=o.readSync()){if(n++,i.isSymbolicLink()||i.isFIFO()||n>Dh)return!0;let s=r===e&&i.name==="objects";if(i.isDirectory()&&!s)t.push(Ie(r,i.name))}}finally{o.closeSync()}}return!1}catch(r){return r.code!=="ENOENT"}}function Nh(e){try{return ns(pn(e))}catch{return null}}function ns(e){let t=e;while(!0){let n=Ie(t,".git");if(tr(n))return n;let r=Rc(t);if(r===t)return null;t=r}}function Lh(e,t,n,r){if(Wh(t))return!0;if(n===null)return!0;let o=Sh(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Fh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Tc(o.stdout.trim())}function Wh(e){return[Ie(e.commonDir,"config"),Ie(e.gitDir,"config.worktree")].filter((t)=>tr(t)).some((t)=>zh(t))}function Gh(){return vh.find((e)=>tr(e))??null}function rr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Fh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!rr(t)))}function zh(e){let t;try{t=nr(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if($h(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Tc(c)}return r}function $h(e){return e==="include"||e.startsWith("includeif ")}function Tc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Ic(e,t){if(e==="")return null;let n=Te(),r=ns(me(e,e,t,n)),o=r?Hh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Hh(e,t,n,r){try{let o=me(e,t,n,r),i=Bh(e),s=i.isFile()?o:null,a=i.isFile()?ts(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[hn(me(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[hn(e.replace(/\\/g,"/")),...l]:l)];return{entry:hn(o),markerFile:s?hn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let f=hn(Uh(d,"hooks").replace(/\\/g,"/"));return[f,hn(me(f,t,n,r))]}))]}}catch{return null}}function hn(e){return process.platform==="win32"?e.toLowerCase():e}var Zh={realpath:(e)=>{try{return Vh(e)}catch{return null}},entryKind:(e)=>{try{let t=jh(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}catch(t){if(t.code==="ENAMETOOLONG")return"missing";throw t}},isDirectory:(e)=>{try{return Kh(e).isDirectory()}catch{return!1}}};function kc(){return Xh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ue(process.env.HOME||qh()),tmpdir:Yh(),paths:Zh})}function Xh(e,t={}){let n=new Map,r=new Map,o=new Map,i={...e,gitMetadata:(s)=>rs(n,s,()=>Ic(s,i)),worktreeFacts:(s)=>rs(r,s,()=>_c(s)),isGitDirectory:wc,gitDirectoryRedirects:(s)=>rs(o,s,()=>xc(s)),...t};return i}function rs(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var yn=["fail_closed","paranoid_rm","paranoid_interpreters"],Qr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},eo=["standard","strict","paranoid"];function Oc(e,t){if(!t)return e;return eo.indexOf(t)>eo.indexOf(e)?t:e}function Dc(e){let t=to(Q.level,e);return eo.find((n)=>n===t)}function Mc(e,t){return Oc(e,Dc(t))}function Jh(e){let t=to(Q.level,e);if(!t)return;let n=Dc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${eo.join(", ")}.`);return}function Qh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Nc(e){return Qh(to(Q.auditScope,e))==="all"}function is(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ss(e={},t){let n=e.safety?.level??"standard",r=Jh(t),o=Oc(n,r),i=Qr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(ot(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(ot(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(ot(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(ot(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||ot(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:is(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function ot(e,t){let n=typeof e==="string"?os(e,t):to(e,t);return n==="1"||n?.toLowerCase()==="true"}function os(e,t){return t.get(e)}function to(e,t){let n=os(e.name,t);if(n!==void 0)return n;if(e.legacyName)return os(e.legacyName,t);return}import{dirname as uo}from"node:path";import{closeSync as ey,constants as Lc,fstatSync as ty,fsyncSync as Ek,lstatSync as cs,mkdirSync as vk,openSync as ny,readdirSync as Rk,readFileSync as ry,realpathSync as ds,renameSync as _k,rmdirSync as wk,statSync as oy,unlinkSync as xk,writeFileSync as Ak}from"node:fs";import{isAbsolute as Wc,join as us,normalize as iy,parse as ls,relative as ms,resolve as fs,sep as ps}from"node:path";function as(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var sy=Symbol("PolicyFilesystemScope"),ay=Symbol("PolicyFilesystemTarget"),ly=Lc.O_NOFOLLOW??0;class fe extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Wt(e,t){return{[sy]:!0,root:fs(e),label:t}}function Gc(e,t){let n=iy(t);if(t===""||Wc(t)||n===".."||n.startsWith(`..${ps}`))throw new fe(e.label);return{[ay]:!0,scope:e,relativePath:n,path:us(e.root,n)}}function or(e,t){return Gc(e,ms(e.root,fs(t)))}function Fc(e,t="rules policy"){let n=fs(e),r=ls(n).dir;return Gc(Wt(r,t),ms(r,n))}function ro(e){return $c(e.scope.label,()=>{if(!no(e))return null;let t=ny(e.path,Lc.O_RDONLY|ly);return cy(t,()=>{let n=ty(t);if(!n.isFile())throw new fe(e.scope.label);let r=ry(t,"utf-8"),o=cs(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new fe(e.scope.label);return no(e),r})})}function zc(e,t){if(e.path===t.path)return!0;return $c(e.scope.label,()=>{if(!no(e)||!no(t))return!1;let n=(r)=>us(ds(ls(r).dir),ls(r).base);return n(e.path)===n(t.path)})}function $c(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof fe)throw r;throw new fe(e)}}function cy(e,t){try{return t()}finally{ey(e)}}function no(e,t="file"){let n=dy(e.scope);if(!n)return!1;let r=e.relativePath.split(ps);for(let o of r.keys()){let i=us(e.scope.root,...r.slice(0,o+1)),s=cs(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new fe(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new fe(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new fe(e.scope.label);uy(n,ds(i),e.scope.label)}return!0}function dy(e){if(!cs(e.root,{throwIfNoEntry:!1}))return null;if(!oy(e.root).isDirectory())throw new fe(e.label);return ds(e.root)}function uy(e,t,n){let r=ms(e,t);if(r===".."||r.startsWith(`..${ps}`)||Wc(r))throw new fe(n)}import{dirname as Ft,isAbsolute as hy,join as zt,relative as yy,resolve as ht,sep as Cy}from"node:path";var Gt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Bc="rulebook.json",Uc=".cc-safety-net/rules";var Hc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var my=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,fy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),py="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),kk=new RegExp(`^${fy}/(${Gt.source.slice(1,-1)})/${py}$`);function gy(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function jc(e){if(oo(e))try{return gs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Gt.test(e)?null:`Local rulebook sources must be bare names matching ${Gt}: ${e}`}function gs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Hc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!my.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Gt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:gy(o),name:o}}function oo(e){return Hc.test(e)}var Vc="rule.json",io="policy.json",Kc=".cc-safety-net",Sy="rules",by="CC_SAFETY_NET_HOME",qc="`cc-safety-net rule update`";function Ey(e){return ht(e,Uc)}function vy(e){return zt(Ey(e),Vc)}function Cn(e){return zt(ht(e),Kc,io)}function hs(e,t={}){return t.userConfigDir??(t.userConfigPath?Ft(t.userConfigPath):zt(Ry(e),Sy))}function Ry(e){let t=e.env.get(by);return t?ht(ue(t)):zt(e.home,Kc)}function _y(e,t={}){return zt(hs(e,t),Vc)}function $t(e,t={}){return zt(Ft(hs(e,t)),io)}function Yc(e,t){let n=Te();return W(Cn(t.cwd),e.paths,n)===W(ht($t(e,t)),e.paths,n)}function Zc(e,t){let n=t.userConfigPath??_y(e,t),r=t.projectConfigPath??vy(t.cwd),o=wy(e,t),i=xy(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:or(o,n),projectConfigTarget:or(i,r)}}function wy(e,t){let n=t.userConfigPath?Ft(Ft(ht(t.userConfigPath))):Ft(ht(t.userConfigDir??hs(e,t)));return Wt(n,"user policy")}function xy(e,t){let n=ht(t),r=ht(e),o=yy(n,r);if(o!==".."&&!o.startsWith(`..${Cy}`)&&!hy(o))return Wt(n,"project policy");return Wt(Ft(Ft(r)),"project policy")}function Xc(e,t){return zt(e,t,Bc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),yt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Jc=new Set(["python","python3","python2","node","ruby","perl"]),so=/^python(?:[23](?:\.\d+)*)?$/,ke=new Set(["awk","gawk","nawk","mawk"]),ao=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Qc="Rulebook exceeds CC Safety Net's safe validation limits.",ed="Additional rulebook validation errors were omitted.",Ge=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function td(e){if(ys(e.allowed_commands,Ge.maxAllowedCommands)||ys(e.rules,Ge.maxRules)||ys(e.tests,Ge.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ge,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ge.maxStringCodeUnits||i&&o.length>Ge.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ge.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ys(e,t){return Array.isArray(e)&&e.length>t}var Cs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ss=64,bs="Rule config exceeds CC Safety Net's safe source limit.";function N(e){return M(e).toLowerCase()}function M(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function ye(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Ay={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Es=new Set(["--init-file","--rcfile"]);function vs(e,t,n,r){let o=!1,i=0,s=!1,a=!1;for(let l=1;l<t.length;l++){let c=t[l];if(c===void 0)break;if(e==="ksh"&&c==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&c==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&c==="o"&&l+1<t.length)break;if(r==="startup"&&c==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&c==="c")s=!0;if(r==="argv"&&c==="s")a=t[0]==="-";if(!Ay[e]?.includes(c))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a}}function Oe(e){let t=M(e[0]??"").toLowerCase(),n=!1,r=!1;for(let o=1;o<e.length;o++){let i=e[o];if(i===void 0)break;if(i==="--"){let a=n&&e[o+1]!==void 0?o+1:null;return{command:a===null?null:e[a]??null,commandIndex:a,scriptIndex:!n&&!r&&e[o+1]!==void 0?o+1:null,readsStdinAsCommands:!n&&(r||e[o+1]===void 0)}}if(i==="-"||i[0]!=="-"&&i[0]!=="+")return{command:n?i:null,commandIndex:n?o:null,scriptIndex:!n&&!r&&i!=="-"?o:null,readsStdinAsCommands:!n&&(r||i==="-")};if(i.startsWith("--")){let a=i.split("=",1)[0]??i;if(t==="bash"&&Es.has(a)&&!i.includes("="))o++;continue}let s=vs(t,i,e[o+1],"argv");if(s.commandSelected)n=!0;if(s.stdinMode)r=!0;o+=s.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n}}function ir(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function lo(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Py(e))ir(n,t);return t.inSingle||t.inDouble}function Py(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);ir(s,n)}return t}var Rs=new Set(["rm","find","xargs","parallel"]),Ty=new Set(["git","busybox",...Rs,...J,...Jc,...ke]),Iy=new Set(["python","node","ruby","perl"]);function nd(e){let t=N(e);return Ty.has(t)||Fe(t)}function Fe(e){return Iy.has(ky(e))}function ky(e){let t=M(e).toLowerCase();return so.test(t)?"python":t}function xs(e){try{let t=ro(Oy(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ly(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[],...n.command_tools?{command_tools:n.command_tools}:{}},errors:[]}}catch(t){if(t instanceof fe)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Oy(e){return typeof e==="string"?Fc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ie=(e,t)=>({path:e,message:t,kind:"custom"});function rd(e){let t=new Set;return e.flatMap((n,r)=>{let o=Bt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ie(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var As=`must be one of ${Cs.join(", ")}`,Dy=/^[^/]+\/[^/]+$/,My=["version","rules","overrides","transparent_wrappers","command_tools"],Ny=/^[^\s\p{Cc}]{1,256}$/u,_s="non-empty, at most 256 characters, no whitespace or control characters";function Ly(e){let t=Wy(e);return{errors:Ps(Ky(t,My,(n)=>n.kind==="custom"),": "," "),sources:Vy(e,t)}}function Wy(e){if(!Bt(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ss;return[...e.version===1?[]:[_(["version"],"must be 1")],...Gy(e.rules,t),...$y(e.overrides),...Uy(e.transparent_wrappers),...t?[]:zy(e.rules),...Bt(e.overrides)?Object.keys(e.overrides).filter((n)=>!Dy.test(n)).map((n)=>ie(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Hy(e.transparent_wrappers),...jy(e.command_tools)]}function Gy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...od(e,Ss)?[_(["rules"],bs)]:[]];if(t)return[{path:["rules"],message:bs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Fy(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function od(e,t){let n=id(e);return n!==void 0&&!(n<=t)}function Fy(e,t){let n=id(e);return n!==void 0&&!(n>=t)}function id(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function zy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ie(["rules",r],"must be a non-empty rulebook source string")];let o=jc(n);if(o)return[ie(["rules",r],o)];if(t.has(n))return[ie(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function $y(e){if(e===void 0)return[];if(!Bt(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Bt(n))return[_(["overrides",t],'must be "off" or an object')];return[...By(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Is(n.intent)?[]:[_(["overrides",t,"intent"],As)]]})}function By(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...od(e,Ct)?[_(t,`must be at most ${Ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>Ct?[_(t,`must be at most ${Ct} characters`)]:[]}function Uy(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return yt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Hy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!yt.test(n))return[];if(t.has(n))return[ie(["transparent_wrappers",r],`duplicate command "${n}"`)];if(nd(n))return[ie(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function jy(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let t=new Set,n=(r,o)=>{if(t.has(r))return[ie(["command_tools",o],`duplicate tool "${r}"`)];return t.add(r),[]};return e.flatMap((r,o)=>{if(typeof r==="string")return ws(r)?n(r,o):[_(["command_tools",o],`must be a tool name: ${_s}`)];if(!Bt(r))return[_(["command_tools",o],"must be a tool name or a {name, cwd} object")];let i=[...ws(r.name)?[]:[_(["command_tools",o,"name"],`must be a tool name: ${_s}`)],...r.cwd===void 0||ws(r.cwd)?[]:[_(["command_tools",o,"cwd"],`must be an argument name: ${_s}`)]];return i.length>0?i:n(r.name,o)})}function ws(e){return typeof e==="string"&&Ny.test(e)}function Vy(e,t){let n=Bt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Ky(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Ps(e,t,n){return[...new Set(e.map((r)=>{let o=Ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Is(e){return Cs.includes(e)}function Bt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ad(e){let t=Zy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var qy=`required non-empty string up to ${Ct} characters`,sd="must be a non-empty array of unique non-empty strings",Yy="required non-empty array of non-empty strings";function Zy(e){if(!St(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!td(e))return{errors:[Qc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Ps(Xy(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ge.maxValidationErrors?[...t.slice(0,Ge.maxValidationErrors),ed]:t,ruleNames:new Set(ld(e).map((n)=>n.toLowerCase()))}}function ld(e){let t=St(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=St(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Xy(e,t){return[...typeof e.name==="string"&&Gt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Jy(e.allowed_commands),...Qy(e.rules,t),...rC(e.tests),...oC(e),...iC(e)]}function Jy(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&yt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!yt.test(n))return[];if(t.has(n))return[ie(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Qy(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!St(n))return[_(["rules",r],"must be an object")];return t?tC(n,["rules",r]):eC(n,["rules",r])}),...rd(e)]}function eC(e,t){return[...cd(e.name,t),...dd(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&yt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...co(e.block_args,[...t,"block_args"],"required non-empty array",!1),...ud(e.reason,t),...md(e.intent,t)]}function tC(e,t){return[...cd(e.name,t),...dd(e.command,t),...ud(e.reason,t),...md(e.intent,t),...nC(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function cd(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return Gt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function dd(e,t){return typeof e==="string"&&yt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function ud(e,t){return typeof e==="string"&&e!==""&&e.length<=Ct?[]:[_([...t,"reason"],qy)]}function md(e,t){return e===void 0||Is(e)?[]:[_([...t,"intent"],As)]}function nC(e,t){if(!St(e))return[_(t,"required object")];return[...co(e.command_path,[...t,"command_path"],Yy,!1),...e.any_args===void 0?[]:co(e.any_args,[...t,"any_args"],sd,!0),...e.exclude_args===void 0?[]:co(e.exclude_args,[...t,"exclude_args"],sd,!0)]}function co(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ie([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ie(t,n)]:[],...r&&new Set(e).size!==e.length?[ie(t,"must not contain duplicate values")]:[]]}function rC(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!St(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ie(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function oC(e){if(!Array.isArray(e.tests))return[];let t=new Set(ld(e));return[...new Set(e.tests.flatMap((n)=>St(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ie(["tests"],`blocked fixture references unknown rule "${n}"`))}function iC(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=St(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ie(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function St(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sd(e,t){let n=Zc(e,t),r;try{r=zc(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof fe)return gC(n,m.message);throw m}let o=xs(n.userConfigTarget),i=r?{config:null,errors:[]}:xs(n.projectConfigTarget),s=yd(n.userConfigPath,o.errors),a=yd(n.projectConfigPath,i.errors),l=new Set,c=o.config?fd(o.config,uo(n.userConfigPath),"user",n.userScope,l):Cd(),d=i.config?fd(i.config,uo(n.projectConfigPath),"project",n.projectScope,l):Cd(),f=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...gd(c.rules,f),...gd(d.rules,u)],transparent_wrappers:mC(o.config,i.config),command_tools:fC(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?hd(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?pC(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?hd(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function fd(e,t,n,r=Wt(uo(uo(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=aC(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let f=d.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:sC(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((u)=>`${f.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function sC(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function aC(e,t,n){let r=lC(e),o=Xc(t,r),i=dC(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${cC(e)}`]};let s=uC(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function lC(e){return oo(e)?gs(e).name:e}function cC(e){return oo(e)?`run ${qc} to vendor ${e}`:"create that file or remove that source from the rules config"}function dC(e,t){try{return{content:ro(or(t,e))}}catch(n){if(n instanceof fe)return{error:n.message};throw n}}function uC(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ad(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function mC(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function fC(e,t){let n=(e?.command_tools??[]).map(pd),r=(t?.command_tools??[]).map(pd);return[...n,...r.filter((o)=>!n.some((i)=>i.name===o.name))]}function pd(e){if(typeof e==="string")return{name:e};return e.cwd===void 0?{name:e.name}:{name:e.name,cwd:e.cwd}}function gd(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function hd(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function pC(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function yd(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function gC(e,t){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Cd(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as AC,readFileSync as PC}from"node:fs";var bd=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ks=new Set(bd.map((e)=>e.id)),mo=bd,hC=new Map(mo.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:hC.get(e)??"manual_only"}}var Os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],fo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},yC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],CC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ds=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...CC.flatMap((e)=>yC.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var po=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Ed=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],SC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ms=Ed.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ns=Ed.flatMap((e)=>SC.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),sr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ws=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],bC=[...Os,fo,...Ds,...Ms,...Ns,sr,...Ls,...Ws,...po].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),go=new Set(po.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Gs=new Set(bC.map((e)=>e.id));import{isAbsolute as Fs,join as EC,normalize as vC,sep as ho}from"node:path";var yo=process.platform==="win32",vd=/[*?]/;function zs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(yo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(vd.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function ar(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function $s(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=ar(e.trim(),t);if(!Fs(n))return"must be an absolute path or start with ~/";return lr(n,t)}function Bs(e,t){let n=Rd(e,t);if(n===null)return"must be a non-empty path string";if(!Fs(n))return null;if(lr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var RC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",_C="cannot cover the guard's own configuration";function Rd(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=yo?n.replaceAll("\\","/"):n;return ar(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Us(e,t){let n=Rd(e,t);if(n===null)return"must be a non-empty path string";let r=zs(n)?.root??n;if(vd.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Fs(r))return null;if(lr(r,t)!==null)return RC;return wC(r,t)?_C:null}function wC(e,t){let n=Co(e),r=Co(EC(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${ho}`)}function lr(e,t){let n=Co(e),r=Co(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(ho)?n:`${n}${ho}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Co(e){let t=vC(e);if(yo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(yo?3:1)&&t.endsWith(ho))t=t.slice(0,-1);return t}var _d=30,So=1,bo=365;function wd(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var xd=new Set(mo.filter((e)=>e.catastrophic).map((e)=>e.id));function I(e,t){if(!e)return null;if(xd.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(xd.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ad(e,t){return Object.freeze(Object.fromEntries(mo.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Pd(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ad(e,t)})}var Td={standard:0,strict:1,paranoid:2};function Od(e,t,n=!1,r=e.safety.level){let o=xC(e,t,r),i=new Set(n?o.map((d)=>d.field):[]),s=(d,f)=>i.has(d)?void 0:f,a=(d,f)=>Object.fromEntries(Object.entries(f??{}).filter(([u])=>!i.has(`${d}.${u}`))),l=(d,f)=>f?.filter((u)=>!i.has(`${d}.${u}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:Hs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:Hs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Hs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((d)=>d.message)}}function Hs(e,t){return[...new Set([...e,...t??[]])]}function xC(e,t,n){let r=t.safety?.level,o=Qr[n];return[...r&&Td[r]<Td[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...yn.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Id("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...Id("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!go.has(i))),...e.destructive_command_protection.enabled?kd(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?kd(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function Id(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function kd(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Vs=new Set(["standard","strict","paranoid"]),Nd={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:_d}};function Ld(e,t){let n=GC($t(e,t),e.home),r=Yc(e,t)?{exists:!1,policy:Ht(),errors:[]}:vo(Cn(t.cwd),e.home),o=IC(r.parsed,e.home),i=ot(Q.projectTightenOnly,e.env),s=n.gui??Nd,a=Object.keys(o.policy).length>0?Od(s,o.policy,i,Mc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),d=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?cr(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:d,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var TC="project policy audit settings are ignored; audit is user scope only";function IC(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={...Vs.has(n.level)?{level:n.level}:{},...Re(n.overrides)?Dd({overrides:Wd(n.overrides,yn,["safety","overrides"],Ut)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Eo(o.overrides,ks,Fd,Ut)}:{},...o.allow_paths!==void 0?{allow_paths:bn(o.allow_paths,$s,t,["destructive_command_protection","allow_paths"],Ut)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Eo(i.overrides,Gs,zd,Ut)}:{},...i.deny_paths!==void 0?{deny_paths:bn(i.deny_paths,Bs,t,["secret_protection","deny_paths"],Ut)}:{},...i.allow_paths!==void 0?{allow_paths:bn(i.allow_paths,Us,t,["secret_protection","allow_paths"],Ut)}:{}};return{policy:Dd({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[TC]}}function Wd(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],Ks));return[]}))}function Dd(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Ut=()=>{return},Ks="must be a boolean",qs="must be an object if provided",Gd=`must be an integer between ${So} and ${bo}`,Fd={path:["destructive_command_protection","overrides"],label:"destructive command"},zd={path:["secret_protection","overrides"],label:"secret protection"},kC=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function OC(e,t){let n=[];return{policy:$d(e,t,(o)=>{n.push(o)}),issues:n}}function DC(e,t){return $d(e,t,Ut)}function $d(e,t,n){if(!Re(e))return n(_([],"Config must be an object")),Ht();if(e.version!==1)n(_(["version"],"must be 1"));let r=Sn(e.safety,["safety"],["level","overrides"],n),o=Sn(r.overrides,["safety","overrides"],yn,n),i=Sn(e.workflow,["workflow"],["worktree_mode"],n),s=Sn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=Sn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=Sn(e.audit,["audit"],["retention_days"],n);return Bd(e,kC,[],n),{version:1,safety:{level:MC(r.level,n),overrides:Wd(o,yn,["safety","overrides"],n)},workflow:{worktree_mode:js(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:js(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Eo(s.overrides,ks,Fd,n),allow_paths:bn(s.allow_paths,$s,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:js(a.enabled,["secret_protection","enabled"],!0,n),overrides:Eo(a.overrides,Gs,zd,n),deny_paths:bn(a.deny_paths,Bs,t,["secret_protection","deny_paths"],n),allow_paths:bn(a.allow_paths,Us,t,["secret_protection","allow_paths"],n)},audit:{retention_days:NC(l.retention_days,n)}}}function Sn(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(_(t,qs)),{};return Bd(e,n,t,r),e}function Bd(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function MC(e,t){if(e===void 0)return"standard";if(Vs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function js(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,Ks));return n}function NC(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=So&&e<=bo))t(_(["audit","retention_days"],Gd));return wd(e)}function Eo(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(_(n.path,qs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function bn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ie([...r,s],a):_([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ht(){return structuredClone(Nd)}function vo(e,t){if(!AC(e))return{exists:!1,policy:Ht(),errors:[]};try{let n=PC(e,"utf-8");if(!n.trim())return{exists:!0,policy:Ht(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=OC(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${WC(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Ht(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var LC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[qs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ks,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Gd,`not an integer between ${So} and ${bo}`]]);function WC(e){let t=Ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=LC.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function GC(e,t){let n=vo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:cr(Ht()),errors:[]};let o=DC(r,t);return{policy:cr(o),gui:o,errors:[],levelPresent:Md(r)}}if(n.parsed===void 0)return{policy:cr(Ht()),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:cr(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Md(n.parsed)}}function Md(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return Vs.has(t.level)}function FC(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...go].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function cr(e){return{safety:zC(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:FC(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function zC(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Ud(e,t){let n=Sd(e,t),r=Ld(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,commandTools:n.command_tools,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...HC(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return jC(o,$C(n,r),s,r.policyScopes)}function $C(e,t){let n=UC(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:VC(e.errors.length>0?BC(e.errors):void 0,e.warnings.length>0?Zs(e.warnings.join("; ")):void 0,n)}}function BC(e){return`${Zs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function UC(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function HC(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function jC(e,t,n=Object.freeze({}),r){let o=Ys(structuredClone(e)),i=r?{policyScopes:Ys(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ys(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ys(t);return Object.freeze(e)}function VC(...e){return Zs(e.filter((t)=>!!t).join("; "))}function Zs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Hd(e){let t=e.effectiveCapabilities,n=t.fail_closed.enabled,r=t.paranoid_rm.enabled,o=t.paranoid_interpreters.enabled;return{policy:Pd(e.policySnapshot.policy,t),effectiveCapabilities:t,effectiveLevel:is({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}import{dirname as Kx,isAbsolute as qx,join as Yx,parse as Zx,resolve as Xx,sep as Jx}from"node:path";function dr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var KC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ro(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function ur(e){let t=Ro(e.words[0],"time")?1:0,n=t===1&&Ro(e.words[t],"-p")?t+1:t,r=t===1&&Ro(e.words[n],"--")?n+1:n,o=Ro(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!KC.test(s.text));return i?.provenance==="literal"?i.text:void 0}var bt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function _o(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function wo(e,t,n){e.push(n),t.reset()}function xo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Xs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return{kind:"word",...e,parts:t}}function En(e,t,n,r,o,i,s){return Xs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function Js(e,t,n){if(t>=n||Vd(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Vd(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=jd(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=jd(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Qs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=qC(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?YC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function jd(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Vd(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function qC(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function YC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Xd=new Set(["&&","||","|","|&"]),ZC=new Set(["!","do","elif","else","if","then","until","while"]);function Jd(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=To(e,0,e.length,t,r,0),i=[...o.issues,...sS(e,r.quotedExpansionEnd,o.nodes)?[nu]:[],...oS.test(e)?[tu]:[]];return{kind:"program",dialect:"posix",source:e,span:n,status:ko(i,o.limited),issues:i,nodes:o.nodes}}function To(e,t,n,r,o,i,s){let a=[],l=[],c=_o(),d=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);wo(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return f(),Zd(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(fr(m)){if(m.charCodeAt(0)>127)l.push(tu);if(m===`
+`)}function Ql(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Qn(e={}){return{reason:Jn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var qg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function er(e,t={}){return{...qg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function ec(e){return Kg({...e,redact:yt})}function tc(e){return yt(e instanceof Error?e.message:String(e))}import{isAbsolute as os,relative as vh,resolve as vc,sep as _h}from"node:path";import{basename as oc,dirname as Yg,isAbsolute as Zg,join as Xg,normalize as Jg,resolve as nc}from"node:path";var Qg=256,Jr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function de(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function rt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Qi(e,t){return Zi(e,0,t)}function Zi(e,t,n){let r="",o=0,i=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let a=Xi(e,o+2),l=eh(e,o,t);if(l===null){if(Jr.has(a))throw new G("pathEnvironmentExpansion");if(i++,i>V.pathEnvironmentExpansion.cap)throw new G("pathEnvironmentExpansion");r+="${",o+=2;continue}let c=e.slice(o,l+1);r+=th(c,t,n),o=l+1;continue}let s=Xi(e,o+1);if(!s){r+="$",o++;continue}r+=Ji(s,n)??`$${s}`,o+=s.length+1}return r}function eh(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new G("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function th(e,t,n){let r=e.slice(2,-1),o=Xi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ji(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Jr.has(o))throw new G("pathEnvironmentExpansion");return e}if(!Jr.has(o))return e;if(s.endsWith("="))throw new G("pathEnvironmentExpansion");let a=Ji(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new G("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Zi(i.slice(s.length),t+1,n);return l?Zi(i.slice(s.length),t+1,n):""}function Xi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ji(e,t){if(!Jr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function W(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ic(n,i);let s=t.realpath(i);if(s!==null)return rc(n,e,s,o);let a=Yg(i);if(a===i||o.length>=Qg)return rc(n,e,i,o);o.push(oc(i)),i=a}}function rc(e,t,n,r){let o=r.length===0?n:Xg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function nh(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ic(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ic(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ue(e,t,n,r){let o=ac(e,t,n);if(!o)return"";return W(o,n.paths,r).replace(/\\/g,"/")}function sc(e,t,n,r,o){let i=ac(e,t,n);if(!i)return null;if(o(oc(i)))return W(i,n.paths,r).replace(/\\/g,"/");let s=nh(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function ac(e,t,n){let r=n.home,o=Qi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?nc(r,o.slice(2)):o,s=de(i);return Jg(Zg(s)?s:nc(t,s))}import{types as rh}from"node:util";var oh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ih=new Set(["command","diff","input","patch","patchtext"]),lc=new TextEncoder,sh=new TextDecoder,ah=/\s/,lh=64;class ot extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var tr=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function ch(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function eo(e){return oh.has(ch(e))}function rr(e){if(!e||typeof e!=="object")return;Sc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Qe();return}if(t.get||t.set)Qe();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function fc(e,t){return pc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function pc(e,t,n,r,o){let i=Cc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>pc(l,t,i.array?n:t.has(gc(a)),r,o+1));return r.ancestors.delete(i.object),s}function gc(e){return e.replace(/-/g,"_").toLowerCase()}function hc(e){return yc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(uh)}function yc(e,t,n,r){let o=Cc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>yc(a,o.array?t:ih.has(gc(s)),n,r+1));return n.ancestors.delete(o.object),i}function dh(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>tr.maxDepth||t.nodes>tr.maxNodes)Qe();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>tr.maxStringBytes||t.stringBytes>tr.maxAggregateStringBytes)Qe()}function Cc(e,t,n){if(dh(e,t,n),!e||typeof e!=="object")return null;let r=Sc(e);if(t.ancestors.has(e))Qe();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>tr.maxKeys)Qe();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Qe();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Sc(e){if(rh.isProxy(e))Qe();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Qe();return t}function Qe(){throw new ot}function uh(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=mh(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...es(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...es(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...ns(Qr(c.slice(4),!0),Qr(d.slice(4),!0))),l++;continue}if(!r)t.push(...es(c))}return t}function mh(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function es(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return mc(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return mc(n[1]);if(e.startsWith("diff --git "))return fh(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return uc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return uc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return bh(i[1]);return[]}function fh(e){let t=ph(e);if(t.length===2&&t[0]&&t[1])return ns(t[0],t[1]);let n=gh(e);return n?ns(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function ph(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Lt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Lt(e[n]))n++;t.push(e.slice(i,n));continue}let o=bc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Lt(e[n]))n++;return n===e.length?t:[]}function gh(e){let t=0;while(t<e.length&&Lt(e[t]))t++;let n=e.length;while(n>t&&Lt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Lt(e[o])){o++;continue}let i=o;while(o<n&&Lt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>lh)Qe();if(hh(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function hh(e,t,n,r,o){if(ts(e,t,n,r,o))return!0;let i=cc(e,"/",t,n),s=cc(e,"/",r,o);if(i<=t||s<=r)return!1;if(ts(e,t,i,r,s))return!1;return ts(e,i+1,n,s+1,o)}function ts(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function cc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Lt(e){return e!==void 0&&ah.test(e)}function bc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:sh.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...lc.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...lc.encode(yh(s[0]??""))),o+=2}return null}function yh(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Ch(e){return nr(Eh(e))}function ns(e,t){if(e==="/dev/null")return dc(t);if(t==="/dev/null")return dc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(nr);let n=Sh(e,t)??(e===t?Ec(e):null);return[e,t,...n?[n]:[]].flatMap(nr)}function dc(e){let t=Ec(e);return[e,...t?[t]:[]].flatMap(nr)}function Ec(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Sh(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function uc(e){return Ch(Qr(e,!0))}function bh(e){return nr(Qr(e,!1))}function Qr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=bc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Eh(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function nr(e){return e===""||e==="/dev/null"?[]:[e]}function mc(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function is(e,t,n){if(rt(e))return;let r=t.flatMap((i)=>rs(i,n));if(!r[0])return;let o=rs(os(e)?e:vc(r[0],e),n)[0];if(!o)return;return r.some((i)=>Rh(o,i))?o:void 0}function ss(e,t,n){if(rt(e))return;return rs(os(e)?e:vc(t,e),n)[0]}function _c(e,t,n){return ss(e,t,n)?"outside-workspace":"unusable"}function rs(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Rh(e,t){let n=vh(t,e);return n===""||n!==".."&&!n.startsWith(`..${_h}`)&&!os(n)}function to(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{spawnSync as Xh}from"node:child_process";import{lstatSync as Jh,realpathSync as Qh,statSync as ey}from"node:fs";import{homedir as ty,tmpdir as ny}from"node:os";import{statSync as qh}from"node:fs";import{join as Yh}from"node:path";import{spawnSync as wh}from"node:child_process";import{accessSync as Rc,constants as wc,existsSync as or,lstatSync as xh,opendirSync as Ah,readFileSync as ir,realpathSync as hn,statSync as yn}from"node:fs";import{dirname as Pc,isAbsolute as as,join as Ie,resolve as no}from"node:path";var Ph=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Th=5000;function Tc(e,t=Hh(),n=Th){let r=Ih(e),o=r===null?null:kh(r);if(r===null||o===null)return null;let i=Bh(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Ih(e){try{let t=hn(no(e));return yn(t).isDirectory()?t:null}catch{return null}}function kh(e){let t=$h(e);if(!t)return null;try{let n=xh(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ls(t);if(!r?.commonDir)return null;if(!Mh(r.gitDir,t))return null;return Oc(r.gitDir,r.commonDir)?null:{gitDir:r.gitDir,commonDir:r.commonDir}}catch{return null}}function ls(e){try{let t=Oh(e);if(!t)return null;let n=hn(as(t)?t:no(Pc(e),t));if(!yn(n).isDirectory())return null;return{gitDir:n,commonDir:Dh(n)}}catch{return null}}function Oh(e){let t=ir(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Dh(e){try{let t=ir(Ie(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=hn(as(t)?t:no(e,t));return yn(n).isDirectory()?n:null}catch{return null}}function Mh(e,t){let n=Nh(e);return n===null?!1:Lh(e,n,t)}function Nh(e){let t=Ie(e,"gitdir");if(!or(t))return null;let n=ir(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Lh(e,t,n){try{return Wh(as(t)?t:no(e,t),n)}catch{return!1}}function Wh(e,t){try{let n=yn(e),r=yn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return xc(hn.native(e))===xc(hn.native(t))}function xc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Ic(e){try{return Rc(Ie(e,"objects"),wc.X_OK),Rc(Ie(e,"refs"),wc.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Dc(Ie(e,"HEAD")))}catch{return!1}}function kc(e){return or(Ie(e,"commondir"))||Oc(e,e)}function Oc(e,t){return[Ie(t,"config"),Ie(e,"config.worktree")].some(Gh)||zh(e)}var Ac=1048576;function Dc(e){let t=yn(e);if(!t.isFile()||t.size>Ac)throw Error(`${e} is not a regular file within ${Ac} bytes`);return ir(e,"utf-8")}function Gh(e){try{return/(?:^|[\s\]])worktree\s*=/i.test(Dc(e))}catch(t){return t.code!=="ENOENT"}}var Fh=1e4;function zh(e){let t=[e],n=0;try{while(t.length>0){let r=t.pop(),o=Ah(r);try{for(let i=o.readSync();i!==null;i=o.readSync()){if(n++,i.isSymbolicLink()||i.isFIFO()||n>Fh)return!0;let s=r===e&&i.name==="objects";if(i.isDirectory()&&!s)t.push(Ie(r,i.name))}}finally{o.closeSync()}}return!1}catch(r){return r.code!=="ENOENT"}}function $h(e){try{return cs(hn(e))}catch{return null}}function cs(e){let t=e;while(!0){let n=Ie(t,".git");if(or(n))return n;let r=Pc(t);if(r===t)return null;t=r}}function Bh(e,t,n,r){if(Uh(t))return!0;if(n===null)return!0;let o=wh(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:jh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Mc(o.stdout.trim())}function Uh(e){return[Ie(e.commonDir,"config"),Ie(e.gitDir,"config.worktree")].filter((t)=>or(t)).some((t)=>Vh(t))}function Hh(){return Ph.find((e)=>or(e))??null}function sr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function jh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!sr(t)))}function Vh(e){let t;try{t=ir(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Kh(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Mc(c)}return r}function Kh(e){return e==="include"||e.startsWith("includeif ")}function Mc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Nc(e,t){if(e==="")return null;let n=Te(),r=cs(ue(e,e,t,n)),o=r?Zh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Zh(e,t,n,r){try{let o=ue(e,t,n,r),i=qh(e),s=i.isFile()?o:null,a=i.isFile()?ls(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[Cn(ue(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Cn(e.replace(/\\/g,"/")),...l]:l)];return{entry:Cn(o),markerFile:s?Cn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let f=Cn(Yh(d,"hooks").replace(/\\/g,"/"));return[f,Cn(ue(f,t,n,r))]}))]}}catch{return null}}function Cn(e){return process.platform==="win32"?e.toLowerCase():e}var ry={realpath:(e)=>{try{return Qh(e)}catch{return null}},entryKind:(e)=>{try{let t=Jh(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}catch(t){if(t.code==="ENAMETOOLONG")return"missing";throw t}},isDirectory:(e)=>{try{return ey(e).isDirectory()}catch{return!1}}};function Lc(){let e=new Map;return iy({env:new Map(Object.entries(process.env).flatMap(([t,n])=>n===void 0?[]:[[t,n]])),home:de(process.env.HOME||ty()),tmpdir:ny(),darwinUserTempDir:()=>ro(e,"",oy),paths:ry})}function oy(){if(process.platform!=="darwin")return null;let e=Xh("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),t=e.stdout?.replace(/\n$/,"");return e.status===0&&t?.startsWith("/")?t:null}function iy(e,t={}){let n=new Map,r=new Map,o=new Map,i={...e,gitMetadata:(s)=>ro(n,s,()=>Nc(s,i)),worktreeFacts:(s)=>ro(r,s,()=>Tc(s)),isGitDirectory:Ic,gitDirectoryRedirects:(s)=>ro(o,s,()=>kc(s)),...t};return i}function ro(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Sn=["fail_closed","paranoid_rm","paranoid_interpreters"],oo={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},io=["standard","strict","paranoid"];function Wc(e,t){if(!t)return e;return io.indexOf(t)>io.indexOf(e)?t:e}function Gc(e){let t=so(ee.level,e);return io.find((n)=>n===t)}function Fc(e,t){return Wc(e,Gc(t))}function sy(e){let t=so(ee.level,e);if(!t)return;let n=Gc(e);if(n)return n;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${io.join(", ")}.`);return}function ay(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zc(e){return ay(so(ee.auditScope,e))==="all"}function us(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ms(e={},t){let n=e.safety?.level??"standard",r=sy(t),o=Wc(n,r),i=oo[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(it(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(it(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(it(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(it(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||it(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:us(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function it(e,t){let n=typeof e==="string"?ds(e,t):so(e,t);return n==="1"||n?.toLowerCase()==="true"}function ds(e,t){return t.get(e)}function so(e,t){let n=ds(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ds(e.legacyName,t);return}import{dirname as ho}from"node:path";import{closeSync as ly,constants as $c,fstatSync as cy,fsyncSync as Uk,lstatSync as gs,mkdirSync as Hk,openSync as dy,readdirSync as jk,readFileSync as uy,realpathSync as hs,renameSync as Vk,rmdirSync as Kk,statSync as my,unlinkSync as qk,writeFileSync as Yk}from"node:fs";import{isAbsolute as Bc,join as ys,normalize as fy,parse as ps,relative as Cs,resolve as Ss,sep as bs}from"node:path";function fs(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var py=Symbol("PolicyFilesystemScope"),gy=Symbol("PolicyFilesystemTarget"),hy=$c.O_NOFOLLOW??0;class me extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Wt(e,t){return{[py]:!0,root:Ss(e),label:t}}function Uc(e,t){let n=fy(t);if(t===""||Bc(t)||n===".."||n.startsWith(`..${bs}`))throw new me(e.label);return{[gy]:!0,scope:e,relativePath:n,path:ys(e.root,n)}}function ar(e,t){return Uc(e,Cs(e.root,Ss(t)))}function Hc(e,t="rules policy"){let n=Ss(e),r=ps(n).dir;return Uc(Wt(r,t),Cs(r,n))}function lo(e){return Vc(e.scope.label,()=>{if(!ao(e))return null;let t=dy(e.path,$c.O_RDONLY|hy);return yy(t,()=>{let n=cy(t);if(!n.isFile())throw new me(e.scope.label);let r=uy(t,"utf-8"),o=gs(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new me(e.scope.label);return ao(e),r})})}function jc(e,t){if(e.path===t.path)return!0;return Vc(e.scope.label,()=>{if(!ao(e)||!ao(t))return!1;let n=(r)=>ys(hs(ps(r).dir),ps(r).base);return n(e.path)===n(t.path)})}function Vc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof me)throw r;throw new me(e)}}function yy(e,t){try{return t()}finally{ly(e)}}function ao(e,t="file"){let n=Cy(e.scope);if(!n)return!1;let r=e.relativePath.split(bs);for(let o of r.keys()){let i=ys(e.scope.root,...r.slice(0,o+1)),s=gs(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new me(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new me(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new me(e.scope.label);Sy(n,hs(i),e.scope.label)}return!0}function Cy(e){if(!gs(e.root,{throwIfNoEntry:!1}))return null;if(!my(e.root).isDirectory())throw new me(e.label);return hs(e.root)}function Sy(e,t,n){let r=Cs(e,t);if(r===".."||r.startsWith(`..${bs}`)||Bc(r))throw new me(n)}import{dirname as Ft,isAbsolute as Ry,join as zt,relative as wy,resolve as Ct,sep as xy}from"node:path";var Gt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kc="rulebook.json",qc=".cc-safety-net/rules";var Yc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var by=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ey=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),vy="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Qk=new RegExp(`^${Ey}/(${Gt.source.slice(1,-1)})/${vy}$`);function _y(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zc(e){if(co(e))try{return Es(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Gt.test(e)?null:`Local rulebook sources must be bare names matching ${Gt}: ${e}`}function Es(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!by.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Gt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:_y(o),name:o}}function co(e){return Yc.test(e)}var Xc="rule.json",uo="policy.json",Jc=".cc-safety-net",Ay="rules",Py="CC_SAFETY_NET_HOME",Qc="`cc-safety-net rule update`";function Ty(e){return Ct(e,qc)}function Iy(e){return zt(Ty(e),Xc)}function bn(e){return zt(Ct(e),Jc,uo)}function vs(e,t={}){return t.userConfigDir??(t.userConfigPath?Ft(t.userConfigPath):zt(ky(e),Ay))}function ky(e){let t=e.env.get(Py);return t?Ct(de(t)):zt(e.home,Jc)}function Oy(e,t={}){return zt(vs(e,t),Xc)}function $t(e,t={}){return zt(Ft(vs(e,t)),uo)}function ed(e,t){let n=Te();return W(bn(t.cwd),e.paths,n)===W(Ct($t(e,t)),e.paths,n)}function td(e,t){let n=t.userConfigPath??Oy(e,t),r=t.projectConfigPath??Iy(t.cwd),o=Dy(e,t),i=My(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:ar(o,n),projectConfigTarget:ar(i,r)}}function Dy(e,t){let n=t.userConfigPath?Ft(Ft(Ct(t.userConfigPath))):Ft(Ct(t.userConfigDir??vs(e,t)));return Wt(n,"user policy")}function My(e,t){let n=Ct(t),r=Ct(e),o=wy(n,r);if(o!==".."&&!o.startsWith(`..${xy}`)&&!Ry(o))return Wt(n,"project policy");return Wt(Ft(Ft(r)),"project policy")}function nd(e,t){return zt(e,t,Kc)}var Re=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),St=/^[a-zA-Z][a-zA-Z0-9_-]*$/,bt=256,Q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),rd=new Set(["python","python3","python2","node","ruby","perl"]),mo=/^python(?:[23](?:\.\d+)*)?$/,ke=new Set(["awk","gawk","nawk","mawk"]),fo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var od="Rulebook exceeds CC Safety Net's safe validation limits.",id="Additional rulebook validation errors were omitted.",ze=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function sd(e){if(_s(e.allowed_commands,ze.maxAllowedCommands)||_s(e.rules,ze.maxRules)||_s(e.tests,ze.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ze,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ze.maxStringCodeUnits||i&&o.length>ze.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ze.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function _s(e,t){return Array.isArray(e)&&e.length>t}var Rs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ws=64,xs="Rule config exceeds CC Safety Net's safe source limit.";function N(e){return M(e).toLowerCase()}function M(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function be(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Ny={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},As=new Set(["--init-file","--rcfile"]);function Ps(e,t,n,r){let o=!1,i=0,s=!1,a=!1;for(let l=1;l<t.length;l++){let c=t[l];if(c===void 0)break;if(e==="ksh"&&c==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&c==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&c==="o"&&l+1<t.length)break;if(r==="startup"&&c==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&c==="c")s=!0;if(r==="argv"&&c==="s")a=t[0]==="-";if(!Ny[e]?.includes(c))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a}}function Oe(e){let t=M(e[0]??"").toLowerCase(),n=!1,r=!1;for(let o=1;o<e.length;o++){let i=e[o];if(i===void 0)break;if(i==="--"){let a=n&&e[o+1]!==void 0?o+1:null;return{command:a===null?null:e[a]??null,commandIndex:a,scriptIndex:!n&&!r&&e[o+1]!==void 0?o+1:null,readsStdinAsCommands:!n&&(r||e[o+1]===void 0)}}if(i==="-"||i[0]!=="-"&&i[0]!=="+")return{command:n?i:null,commandIndex:n?o:null,scriptIndex:!n&&!r&&i!=="-"?o:null,readsStdinAsCommands:!n&&(r||i==="-")};if(i.startsWith("--")){let a=i.split("=",1)[0]??i;if(t==="bash"&&As.has(a)&&!i.includes("="))o++;continue}let s=Ps(t,i,e[o+1],"argv");if(s.commandSelected)n=!0;if(s.stdinMode)r=!0;o+=s.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n}}function lr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function po(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Ly(e))lr(n,t);return t.inSingle||t.inDouble}function Ly(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);lr(s,n)}return t}var Ts=new Set(["rm","find","rsync","xargs","parallel"]),Wy=new Set(["git","busybox",...Ts,...Q,...rd,...ke]),Gy=new Set(["python","node","ruby","perl"]);function ad(e){let t=N(e);return Wy.has(t)||$e(t)}function $e(e){return Gy.has(Fy(e))}function Fy(e){let t=M(e).toLowerCase();return mo.test(t)?"python":t}function Os(e){try{let t=lo(zy(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Hy(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[],...n.command_tools?{command_tools:n.command_tools}:{}},errors:[]}}catch(t){if(t instanceof me)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function zy(e){return typeof e==="string"?Hc(e):e}var x=(e,t)=>({path:e,message:t,kind:"typed"}),oe=(e,t)=>({path:e,message:t,kind:"custom"});function ld(e){let t=new Set;return e.flatMap((n,r)=>{let o=Bt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[oe(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Ds=`must be one of ${Rs.join(", ")}`,$y=/^[^/]+\/[^/]+$/,By=["version","rules","overrides","transparent_wrappers","command_tools"],Uy=/^[^\s\p{Cc}]{1,256}$/u,Is="non-empty, at most 256 characters, no whitespace or control characters";function Hy(e){let t=jy(e);return{errors:Ms(tC(t,By,(n)=>n.kind==="custom"),": "," "),sources:eC(e,t)}}function jy(e){if(!Bt(e))return[x([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ws;return[...e.version===1?[]:[x(["version"],"must be 1")],...Vy(e.rules,t),...Yy(e.overrides),...Xy(e.transparent_wrappers),...t?[]:qy(e.rules),...Bt(e.overrides)?Object.keys(e.overrides).filter((n)=>!$y.test(n)).map((n)=>oe(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Jy(e.transparent_wrappers),...Qy(e.command_tools)]}function Vy(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[x(["rules"],"must be an array of rulebook source strings"),...cd(e,ws)?[x(["rules"],xs)]:[]];if(t)return[{path:["rules"],message:xs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[x(["rules",r],"must be a rulebook source string"),...Ky(n,1)?[x(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[x(["rules",r],"must be a non-empty rulebook source string")]:[]})}function cd(e,t){let n=dd(e);return n!==void 0&&!(n<=t)}function Ky(e,t){let n=dd(e);return n!==void 0&&!(n>=t)}function dd(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function qy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[oe(["rules",r],"must be a non-empty rulebook source string")];let o=Zc(n);if(o)return[oe(["rules",r],o)];if(t.has(n))return[oe(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Yy(e){if(e===void 0)return[];if(!Bt(e))return[x(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Bt(n))return[x(["overrides",t],'must be "off" or an object')];return[...Zy(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Ls(n.intent)?[]:[x(["overrides",t,"intent"],Ds)]]})}function Zy(e,t){if(typeof e!=="string")return[x(t,"required non-empty string"),...cd(e,bt)?[x(t,`must be at most ${bt} characters`)]:[]];if(e==="")return[x(t,"required non-empty string")];return e.length>bt?[x(t,`must be at most ${bt} characters`)]:[]}function Xy(e){if(e===void 0)return[];if(!Array.isArray(e))return[x(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[x(["transparent_wrappers",n],"must be a command string")];return St.test(t)?[]:[x(["transparent_wrappers",n],"must match command pattern")]})}function Jy(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!St.test(n))return[];if(t.has(n))return[oe(["transparent_wrappers",r],`duplicate command "${n}"`)];if(ad(n))return[oe(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Qy(e){if(e===void 0)return[];if(!Array.isArray(e))return[x(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let t=new Set,n=(r,o)=>{if(t.has(r))return[oe(["command_tools",o],`duplicate tool "${r}"`)];return t.add(r),[]};return e.flatMap((r,o)=>{if(typeof r==="string")return ks(r)?n(r,o):[x(["command_tools",o],`must be a tool name: ${Is}`)];if(!Bt(r))return[x(["command_tools",o],"must be a tool name or a {name, cwd} object")];let i=[...ks(r.name)?[]:[x(["command_tools",o,"name"],`must be a tool name: ${Is}`)],...r.cwd===void 0||ks(r.cwd)?[]:[x(["command_tools",o,"cwd"],`must be an argument name: ${Is}`)]];return i.length>0?i:n(r.name,o)})}function ks(e){return typeof e==="string"&&Uy.test(e)}function eC(e,t){let n=Bt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function tC(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Ms(e,t,n){return[...new Set(e.map((r)=>{let o=Ns(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Ns(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Ls(e){return Rs.includes(e)}function Bt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function md(e){let t=oC(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var nC=`required non-empty string up to ${bt} characters`,ud="must be a non-empty array of unique non-empty strings",rC="required non-empty array of non-empty strings";function oC(e){if(!Et(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!sd(e))return{errors:[od],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Ms(iC(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ze.maxValidationErrors?[...t.slice(0,ze.maxValidationErrors),id]:t,ruleNames:new Set(fd(e).map((n)=>n.toLowerCase()))}}function fd(e){let t=Et(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Et(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function iC(e,t){return[...typeof e.name==="string"&&Gt.test(e.name)?[]:[x(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[x(["version"],"required non-empty string")],...sC(e.allowed_commands),...aC(e.rules,t),...uC(e.tests),...mC(e),...fC(e)]}function sC(e){if(!Array.isArray(e))return[x(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&St.test(n)?[]:[x(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!St.test(n))return[];if(t.has(n))return[oe(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function aC(e,t){if(!Array.isArray(e))return[x(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!Et(n))return[x(["rules",r],"must be an object")];return t?cC(n,["rules",r]):lC(n,["rules",r])}),...ld(e)]}function lC(e,t){return[...pd(e.name,t),...gd(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&St.test(e.subcommand)?[]:[x([...t,"subcommand"],"must match command pattern")],...go(e.block_args,[...t,"block_args"],"required non-empty array",!1),...hd(e.reason,t),...yd(e.intent,t)]}function cC(e,t){return[...pd(e.name,t),...gd(e.command,t),...hd(e.reason,t),...yd(e.intent,t),...dC(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[x([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[x([...t,"block_args"],"not supported in rulebook_version 2")]]}function pd(e,t){if(typeof e!=="string")return[x([...t,"name"],"required string")];return Gt.test(e)?[]:[x([...t,"name"],"must match rule name pattern")]}function gd(e,t){return typeof e==="string"&&St.test(e)?[]:[x([...t,"command"],"required string matching command pattern")]}function hd(e,t){return typeof e==="string"&&e!==""&&e.length<=bt?[]:[x([...t,"reason"],nC)]}function yd(e,t){return e===void 0||Ls(e)?[]:[x([...t,"intent"],Ds)]}function dC(e,t){if(!Et(e))return[x(t,"required object")];return[...go(e.command_path,[...t,"command_path"],rC,!1),...e.any_args===void 0?[]:go(e.any_args,[...t,"any_args"],ud,!0),...e.exclude_args===void 0?[]:go(e.exclude_args,[...t,"exclude_args"],ud,!0)]}function go(e,t,n,r){if(!Array.isArray(e))return[x(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[x([...t,s],"must be a non-empty string")];return i===""?[oe([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[oe(t,n)]:[],...r&&new Set(e).size!==e.length?[oe(t,"must not contain duplicate values")]:[]]}function uC(e){if(e===void 0)return[];if(!Array.isArray(e))return[x(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!Et(t))return[x(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[x(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[x(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[x(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[oe(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function mC(e){if(!Array.isArray(e.tests))return[];let t=new Set(fd(e));return[...new Set(e.tests.flatMap((n)=>Et(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>oe(["tests"],`blocked fixture references unknown rule "${n}"`))}function fC(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=Et(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[oe(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function Et(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Rd(e,t){let n=td(e,t),r;try{r=jc(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof me)return _C(n,m.message);throw m}let o=Os(n.userConfigTarget),i=r?{config:null,errors:[]}:Os(n.projectConfigTarget),s=vd(n.userConfigPath,o.errors),a=vd(n.projectConfigPath,i.errors),l=new Set,c=o.config?Cd(o.config,ho(n.userConfigPath),"user",n.userScope,l):_d(),d=i.config?Cd(i.config,ho(n.projectConfigPath),"project",n.projectScope,l):_d(),f=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...bd(c.rules,f),...bd(d.rules,u)],transparent_wrappers:bC(o.config,i.config),command_tools:EC(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Ed(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?vC(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Ed(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Cd(e,t,n,r=Wt(ho(ho(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=gC(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let f=d.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:pC(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((u)=>`${f.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function pC(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function gC(e,t,n){let r=hC(e),o=nd(t,r),i=CC(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${yC(e)}`]};let s=SC(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function hC(e){return co(e)?Es(e).name:e}function yC(e){return co(e)?`run ${Qc} to vendor ${e}`:"create that file or remove that source from the rules config"}function CC(e,t){try{return{content:lo(ar(t,e))}}catch(n){if(n instanceof me)return{error:n.message};throw n}}function SC(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:md(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function bC(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function EC(e,t){let n=(e?.command_tools??[]).map(Sd),r=(t?.command_tools??[]).map(Sd);return[...n,...r.filter((o)=>!n.some((i)=>i.name===o.name))]}function Sd(e){if(typeof e==="string")return{name:e};return e.cwd===void 0?{name:e.name}:{name:e.name,cwd:e.cwd}}function bd(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Ed(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function vC(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function vd(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function _C(e,t){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function _d(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as NC,readFileSync as LC}from"node:fs";var wd=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ws=new Set(wd.map((e)=>e.id)),yo=wd,RC=new Map(yo.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:RC.get(e)??"manual_only"}}var Gs=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Co={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},wC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],xC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Fs=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...xC.flatMap((e)=>wC.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var So=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],xd=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],AC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],zs=xd.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),$s=xd.flatMap((e)=>AC.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),cr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Bs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Us=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],PC=[...Gs,Co,...Fs,...zs,...$s,cr,...Bs,...Us,...So].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),bo=new Set(So.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Hs=new Set(PC.map((e)=>e.id));import{isAbsolute as js,join as TC,normalize as IC,sep as Eo}from"node:path";var vo=process.platform==="win32",Ad=/[*?]/;function Vs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(vo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Ad.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function dr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ks(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=dr(e.trim(),t);if(!js(n))return"must be an absolute path or start with ~/";return ur(n,t)}function qs(e,t){let n=Pd(e,t);if(n===null)return"must be a non-empty path string";if(!js(n))return null;if(ur(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var kC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",OC="cannot cover the guard's own configuration";function Pd(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=vo?n.replaceAll("\\","/"):n;return dr(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ys(e,t){let n=Pd(e,t);if(n===null)return"must be a non-empty path string";let r=Vs(n)?.root??n;if(Ad.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!js(r))return null;if(ur(r,t)!==null)return kC;return DC(r,t)?OC:null}function DC(e,t){let n=_o(e),r=_o(TC(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Eo}`)}function ur(e,t){let n=_o(e),r=_o(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Eo)?n:`${n}${Eo}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function _o(e){let t=IC(e);if(vo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(vo?3:1)&&t.endsWith(Eo))t=t.slice(0,-1);return t}var Td=30,Ro=1,wo=365;function Id(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var kd=new Set(yo.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(kd.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ie(e,t,n){if(kd.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Od(e,t){return Object.freeze(Object.fromEntries(yo.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Dd(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Od(e,t)})}var Md={standard:0,strict:1,paranoid:2};function Wd(e,t,n=!1,r=e.safety.level){let o=MC(e,t,r),i=new Set(n?o.map((d)=>d.field):[]),s=(d,f)=>i.has(d)?void 0:f,a=(d,f)=>Object.fromEntries(Object.entries(f??{}).filter(([u])=>!i.has(`${d}.${u}`))),l=(d,f)=>f?.filter((u)=>!i.has(`${d}.${u}`));return{policy:{version:1,safety:{level:s("safety.level",t.safety?.level)??e.safety.level,overrides:{...e.safety.overrides,...a("safety.overrides",t.safety?.overrides)}},workflow:{worktree_mode:s("workflow.worktree_mode",t.workflow?.worktree_mode)??e.workflow.worktree_mode},destructive_command_protection:{enabled:s("destructive_command_protection.enabled",t.destructive_command_protection?.enabled)??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...a("destructive_command_protection.overrides",t.destructive_command_protection?.overrides)},allow_paths:Zs(e.destructive_command_protection.allow_paths,l("destructive_command_protection.allow_paths",t.destructive_command_protection?.allow_paths))},secret_protection:{enabled:s("secret_protection.enabled",t.secret_protection?.enabled)??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...a("secret_protection.overrides",t.secret_protection?.overrides)},deny_paths:Zs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Zs(e.secret_protection.allow_paths,l("secret_protection.allow_paths",t.secret_protection?.allow_paths))},audit:e.audit},weakenings:o.map((d)=>d.message)}}function Zs(e,t){return[...new Set([...e,...t??[]])]}function MC(e,t,n){let r=t.safety?.level,o=oo[n];return[...r&&Md[r]<Md[e.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${e.safety.level} -> ${r}`}]:[],...Sn.flatMap((i)=>t.safety?.overrides?.[i]===!1&&(e.safety.overrides[i]??o[i])?[{field:`safety.overrides.${i}`,message:`project policy disables ${i}`}]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Nd("destructive_command_protection.overrides",t.destructive_command_protection?.overrides,(i)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[i]!=="off"),...Nd("secret_protection.overrides",t.secret_protection?.overrides,(i)=>e.secret_protection.enabled&&(e.secret_protection.overrides[i]==="on"?!0:e.secret_protection.overrides[i]!=="off"&&!bo.has(i))),...e.destructive_command_protection.enabled?Ld(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((i)=>({field:`destructive_command_protection.allow_paths.${i}`,message:`project policy adds destructive allow path: ${i}`})):[],...e.secret_protection.enabled?Ld(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((i)=>({field:`secret_protection.allow_paths.${i}`,message:`project policy adds secret allow path: ${i}`})):[]]}function Nd(e,t,n){return Object.entries(t??{}).flatMap(([r,o])=>o==="off"&&n(r)?[{field:`${e}.${r}`,message:`project policy disables rule ${r}`}]:[])}function Ld(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Js=new Set(["standard","strict","paranoid"]),zd={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Td}};function $d(e,t){let n=VC($t(e,t),e.home),r=ed(e,t)?{exists:!1,policy:Ht(),errors:[]}:Ao(bn(t.cwd),e.home),o=GC(r.parsed,e.home),i=it(ee.projectTightenOnly,e.env),s=n.gui??zd,a=Object.keys(o.policy).length>0?Wd(s,o.policy,i,Fc(s.safety.level,e.env)):void 0,l=[...n.errors,...r.errors,...o.diagnostics],c=(n.fallback==="defaults"&&a?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(l.length>0?"salvaged":void 0),d=o.policy.safety?.level&&a?.policy.safety.level===o.policy.safety.level?"project":n.levelPresent?"user":"default";return{...a?mr(a.policy):n.policy,errors:l,...c?{fallback:c}:{},...r.exists?{policyScopes:{levelScope:d,weakenings:a?.weakenings??[],weakeningsIgnored:i}}:{}}}var WC="project policy audit settings are ignored; audit is user scope only";function GC(e,t){if(!we(e))return{policy:{},diagnostics:[]};let n=we(e.safety)?e.safety:{},r=we(e.workflow)?e.workflow:{},o=we(e.destructive_command_protection)?e.destructive_command_protection:{},i=we(e.secret_protection)?e.secret_protection:{},s={...Js.has(n.level)?{level:n.level}:{},...we(n.overrides)?Gd({overrides:Bd(n.overrides,Sn,["safety","overrides"],Ut)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:xo(o.overrides,Ws,Hd,Ut)}:{},...o.allow_paths!==void 0?{allow_paths:vn(o.allow_paths,Ks,t,["destructive_command_protection","allow_paths"],Ut)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:xo(i.overrides,Hs,jd,Ut)}:{},...i.deny_paths!==void 0?{deny_paths:vn(i.deny_paths,qs,t,["secret_protection","deny_paths"],Ut)}:{},...i.allow_paths!==void 0?{allow_paths:vn(i.allow_paths,Ys,t,["secret_protection","allow_paths"],Ut)}:{}};return{policy:Gd({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[WC]}}function Bd(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(x([...n,o],Qs));return[]}))}function Gd(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Ut=()=>{return},Qs="must be a boolean",ea="must be an object if provided",Ud=`must be an integer between ${Ro} and ${wo}`,Hd={path:["destructive_command_protection","overrides"],label:"destructive command"},jd={path:["secret_protection","overrides"],label:"secret protection"},FC=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function zC(e,t){let n=[];return{policy:Vd(e,t,(o)=>{n.push(o)}),issues:n}}function $C(e,t){return Vd(e,t,Ut)}function Vd(e,t,n){if(!we(e))return n(x([],"Config must be an object")),Ht();if(e.version!==1)n(x(["version"],"must be 1"));let r=En(e.safety,["safety"],["level","overrides"],n),o=En(r.overrides,["safety","overrides"],Sn,n),i=En(e.workflow,["workflow"],["worktree_mode"],n),s=En(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=En(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=En(e.audit,["audit"],["retention_days"],n);return Kd(e,FC,[],n),{version:1,safety:{level:BC(r.level,n),overrides:Bd(o,Sn,["safety","overrides"],n)},workflow:{worktree_mode:Xs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Xs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:xo(s.overrides,Ws,Hd,n),allow_paths:vn(s.allow_paths,Ks,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Xs(a.enabled,["secret_protection","enabled"],!0,n),overrides:xo(a.overrides,Hs,jd,n),deny_paths:vn(a.deny_paths,qs,t,["secret_protection","deny_paths"],n),allow_paths:vn(a.allow_paths,Ys,t,["secret_protection","allow_paths"],n)},audit:{retention_days:UC(l.retention_days,n)}}}function En(e,t,n,r){if(e===void 0)return{};if(!we(e))return r(x(t,ea)),{};return Kd(e,n,t,r),e}function Kd(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function BC(e,t){if(e===void 0)return"standard";if(Js.has(e))return e;return t(x(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Xs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(x(t,Qs));return n}function UC(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ro&&e<=wo))t(x(["audit","retention_days"],Ud));return Id(e)}function xo(e,t,n,r){if(e===void 0)return{};if(!we(e))return r(x(n.path,ea)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(x([...n.path,o],'must be "on" or "off"')),[]}))}function vn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(x(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?oe([...r,s],a):x([...r,s],a)),[]})}function we(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ht(){return structuredClone(zd)}function Ao(e,t){if(!NC(e))return{exists:!1,policy:Ht(),errors:[]};try{let n=LC(e,"utf-8");if(!n.trim())return{exists:!0,policy:Ht(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=zC(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${jC(i)}`),fallback:we(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Ht(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var HC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[ea,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Qs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Ud,`not an integer between ${Ro} and ${wo}`]]);function jC(e){let t=Ns(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=HC.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function VC(e,t){let n=Ao(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!we(r))return{policy:mr(Ht()),errors:[]};let o=$C(r,t);return{policy:mr(o),gui:o,errors:[],levelPresent:Fd(r)}}if(n.parsed===void 0)return{policy:mr(Ht()),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:mr(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Fd(n.parsed)}}function Fd(e){let t=we(e)&&we(e.safety)?e.safety:{};return Js.has(t.level)}function KC(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...bo].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function mr(e){return{safety:qC(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:KC(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function qC(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qd(e,t){let n=Rd(e,t),r=$d(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,commandTools:n.command_tools,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...JC(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return QC(o,YC(n,r),s,r.policyScopes)}function YC(e,t){let n=XC(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:eS(e.errors.length>0?ZC(e.errors):void 0,e.warnings.length>0?na(e.warnings.join("; ")):void 0,n)}}function ZC(e){return`${na(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function XC(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function JC(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function QC(e,t,n=Object.freeze({}),r){let o=ta(structuredClone(e)),i=r?{policyScopes:ta(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function ta(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))ta(t);return Object.freeze(e)}function eS(...e){return na(e.filter((t)=>!!t).join("; "))}function na(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yd(e){let t=e.effectiveCapabilities,n=t.fail_closed.enabled,r=t.paranoid_rm.enabled,o=t.paranoid_interpreters.enabled;return{policy:Dd(e.policySnapshot.policy,t),effectiveCapabilities:t,effectiveLevel:us({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}import{dirname as mA,isAbsolute as fA,join as pA,parse as gA,resolve as hA,sep as yA}from"node:path";function fr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var tS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Po(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function pr(e){let t=Po(e.words[0],"time")?1:0,n=t===1&&Po(e.words[t],"-p")?t+1:t,r=t===1&&Po(e.words[n],"--")?n+1:n,o=Po(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!tS.test(s.text));return i?.provenance==="literal"?i.text:void 0}var vt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function To(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Io(e,t,n){e.push(n),t.reset()}function ko(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ra(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return{kind:"word",...e,parts:t}}function _n(e,t,n,r,o,i,s){return ra({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function oa(e,t,n){if(t>=n||Xd(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xd(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zd(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zd(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ia(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=nS(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?rS(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zd(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xd(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function nS(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function rS(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var nu=new Set(["&&","||","|","|&"]),oS=new Set(["!","do","elif","else","if","then","until","while"]);function ru(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r={wordsUsed:0,maxWords:t.maxWords,quotedExpansionEnd:1/0},o=Mo(e,0,e.length,t,r,0),i=[...o.issues,...pS(e,r.quotedExpansionEnd,o.nodes)?[au]:[],...mS.test(e)?[su]:[]];return{kind:"program",dialect:"posix",source:e,span:n,status:Lo(i,o.limited),issues:i,nodes:o.nodes}}function Mo(e,t,n,r,o,i,s){let a=[],l=[],c=To(),d=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);Io(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return f(),tu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(hr(m)){if(m.charCodeAt(0)>127)l.push(su);if(m===`
 `||m==="\r"){f();let A=m==="\r"&&e[u+1]===`
-`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!Xd.has(P.operator))a.push({kind:"connector",operator:e.slice(u,A),span:{start:u,end:A}});if(d.length>0){let k=Qs(e,A,n,d.splice(0));l.push(...k.issues),u=k.next;continue}u=A;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?_S(e,u,n):void 0;if(p){if(ta(a,l),i>=r.maxDepth)return vn(a,l,u,"depth-limit",r.maxDepth);if(!ea(o))return vn(a,l,u,"word-limit",r.maxWords);let A=To(e,p.braceIndex+1,n,r,o,i+1,"}"),P=A.next,k={start:p.braceIndex+1,end:A.closed?P-1:P},C=Kd(e,k,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:P},body:C}),l.push(...A.issues),A.pendingHeredocs.length>0||pr(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return Po(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let g=Io(e,u);if(g){if(f(),!cu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push({kind:"connector",operator:g,span:{start:u,end:u+g.length}}),u+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&uS(e,u,n))&&c.start===-1){if(ta(a,l),i>=r.maxDepth)return vn(a,l,u,"depth-limit",r.maxDepth);let A=m==="("?")":"}",P=To(e,u+1,n,r,o,i+1,A),k=P.next,C={start:u+1,end:P.closed?k-1:k},O=Kd(e,C,P);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:k},body:O}),l.push(...P.issues),P.pendingHeredocs.length>0||pr(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return Po(a,l,P.next);if(!P.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=k;continue}let h=(m==="<"||m===">")&&e[u+1]!=="("?eS(e,u):null;if(h){let A=c.words.at(-1),P=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(P!==void 0)c.words.pop();let k=P===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let C=u+h.length;while(C<n&&/[ \t]/.test(e[C]??""))C++;let O=e[C],T=C>u+h.length&&O==="#",K=!O||fr(O)||!!Io(e,C)||O===s||O===")"||T||(O==="<"||O===">")&&e[C+1]!=="(",Mt=h==="<<"||h==="<<-",j=Mt?Js(e,C,n):void 0,z=j?{word:En(e,C,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!K?na(e,C,n,r,o,i):void 0;if(z){if(l.push(...z.issues),z.limited)return Po(a,l,z.next);if(!ea(o))return vn(a,l,z.next,"word-limit",r.maxWords)}let de=z?.next??u+h.length,te={kind:"redirection",operator:h,span:{start:k,end:de},...P===void 0?{}:{fd:P},...z?{target:z.word}:{}};if(c.redirections.push(te),Mt&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let ne=c.nested;d.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(Ee)=>{if(te.heredoc=Ee,Ee.quotedDelimiter)return;let tt=JC(e,Ee.bodySpan.start,Ee.bodySpan.end,r,o,i+1);ne.push(...tt.programs),l.push(...tt.issues)}})}if(!Mt&&!z)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(z)c.nested.push(...z.nested);c.end=de,u=de;continue}let y=c.start===-1;if(y)ta(a,l);let b=na(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return Po(a,l,b.next);let S=pS(c.words)?SS(e,b.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return vn(a,l,b.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[b.word];for(let A of E){if(!ea(o))return vn(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&du(b.word))f();u=b.next>u?b.next:u+1}return f(),Zd(a,l),l.push(...wS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Kd(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ko(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function na(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],f=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||fr(m)||(m===";"||m==="|"||m==="&")&&Io(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(m==='"'){l=!0;let y=XC(e,a,n,r,o,i);if(s+=y.text,d.push(...y.nested),f.push(...y.issues),u||=y.limited,c=mr(c,y.provenance),a=y.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let y=lS(e,a+2,n);if(s+=y.text,f.push(...y.issues),!y.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(m==="\\"){let y=e[a+1];if(!y){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
-`){a+=2;continue}s+=y,a+=2;continue}if(Vt(e,a))f.push(jt);let g=m==="$"||m==="<"||m===">"||m==="`"?gr(e,a,n,r,o,i):null,h=g?oa(g,d,f):ru(e,a,n,r,o,i,d,f);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(u||=h.limited,c=mr(c,h.provenance),a=h.next,u)break;continue}if(m==="$"){let y=iu(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(m==="*"||m==="?"||m==="[")c=mr(c,"glob");s+=m,a++}return{word:En(e,t,a,s,c,l,c==="literal"?void 0:dS(e,t,a)),nested:d,issues:f,next:a,limited:u}}function XC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,f=t+1;while(f<n){let u=e[f];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:d};if(u==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
+`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!nu.has(P.operator))a.push({kind:"connector",operator:e.slice(u,A),span:{start:u,end:A}});if(d.length>0){let k=ia(e,A,n,d.splice(0));l.push(...k.issues),u=k.next;continue}u=A;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?OS(e,u,n):void 0;if(p){if(aa(a,l),i>=r.maxDepth)return Rn(a,l,u,"depth-limit",r.maxDepth);if(!sa(o))return Rn(a,l,u,"word-limit",r.maxWords);let A=Mo(e,p.braceIndex+1,n,r,o,i+1,"}"),P=A.next,k={start:p.braceIndex+1,end:A.closed?P-1:P},C=Jd(e,k,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:P},body:C}),l.push(...A.issues),A.pendingHeredocs.length>0||yr(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return Do(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let g=No(e,u);if(g){if(f(),!pu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push({kind:"connector",operator:g,span:{start:u,end:u+g.length}}),u+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&SS(e,u,n))&&c.start===-1){if(aa(a,l),i>=r.maxDepth)return Rn(a,l,u,"depth-limit",r.maxDepth);let A=m==="("?")":"}",P=Mo(e,u+1,n,r,o,i+1,A),k=P.next,C={start:u+1,end:P.closed?k-1:k},O=Jd(e,C,P);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:k},body:O}),l.push(...P.issues),P.pendingHeredocs.length>0||yr(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return Do(a,l,P.next);if(!P.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=k;continue}let h=(m==="<"||m===">")&&e[u+1]!=="("?lS(e,u):null;if(h){let A=c.words.at(-1),P=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(P!==void 0)c.words.pop();let k=P===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let C=u+h.length;while(C<n&&/[ \t]/.test(e[C]??""))C++;let O=e[C],I=C>u+h.length&&O==="#",J=!O||hr(O)||!!No(e,C)||O===s||O===")"||I||(O==="<"||O===">")&&e[C+1]!=="(",Se=h==="<<"||h==="<<-",Y=Se?oa(e,C,n):void 0,j=Y?{word:_n(e,C,Y.next,Y.delimiter,"literal",Y.quoted),nested:[],issues:[],next:Y.next,limited:!1}:!J?la(e,C,n,r,o,i):void 0;if(j){if(l.push(...j.issues),j.limited)return Do(a,l,j.next);if(!sa(o))return Rn(a,l,j.next,"word-limit",r.maxWords)}let fe=j?.next??u+h.length,Z={kind:"redirection",operator:h,span:{start:k,end:fe},...P===void 0?{}:{fd:P},...j?{target:j.word}:{}};if(c.redirections.push(Z),Se&&!Y)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Y){if(Y.ambiguous||Y.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let ne=c.nested;d.push({delimiter:Y.delimiter,quotedDelimiter:Y.quoted,stripTabs:h==="<<-",attach:(Pe)=>{if(Z.heredoc=Pe,Pe.quotedDelimiter)return;let Fe=sS(e,Pe.bodySpan.start,Pe.bodySpan.end,r,o,i+1);ne.push(...Fe.programs),l.push(...Fe.issues)}})}if(!Se&&!j)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(j)c.nested.push(...j.nested);c.end=fe,u=fe;continue}let y=c.start===-1;if(y)aa(a,l);let b=la(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return Do(a,l,b.next);let S=vS(c.words)?AS(e,b.word,o.maxWords-o.wordsUsed,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return Rn(a,l,b.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[b.word];for(let A of E){if(!sa(o))return Rn(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&gu(b.word))f();u=b.next>u?b.next:u+1}return f(),tu(a,l),l.push(...DS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jd(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function la(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],f=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||hr(m)||(m===";"||m==="|"||m==="&")&&No(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(m==='"'){l=!0;let y=iS(e,a,n,r,o,i);if(s+=y.text,d.push(...y.nested),f.push(...y.issues),u||=y.limited,c=gr(c,y.provenance),a=y.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let y=hS(e,a+2,n);if(s+=y.text,f.push(...y.issues),!y.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=y.next;continue}if(m==="\\"){let y=e[a+1];if(!y){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(y===`
+`){a+=2;continue}s+=y,a+=2;continue}if(Vt(e,a))f.push(jt);let g=m==="$"||m==="<"||m===">"||m==="`"?Cr(e,a,n,r,o,i):null,h=g?da(g,d,f):lu(e,a,n,r,o,i,d,f);if(h){if(h.provenance==="variable")s+=e.slice(a,h.next);if(u||=h.limited,c=gr(c,h.provenance),a=h.next,u)break;continue}if(m==="$"){let y=du(e,a,n,s,c);s=y.text,c=y.provenance,a=y.next;continue}if(m==="*"||m==="?"||m==="[")c=gr(c,"glob");s+=m,a++}return{word:_n(e,t,a,s,c,l,c==="literal"?void 0:CS(e,t,a)),nested:d,issues:f,next:a,limited:u}}function iS(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,f=t+1;while(f<n){let u=e[f];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:d};if(u==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
 `){f+=2;continue}if(g==="\r"&&e[f+2]===`
-`){f+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(Vt(e,f))c.push(jt);let m=gr(e,f,n,r,o,i),p=m?oa(m,l,c):ru(e,f,n,r,o,i,l,c);if(p){if(p.provenance!=="command-substitution")s+=e.slice(f,p.next);if(f=p.next,d||=p.limited,a=mr(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:d};continue}if(u==="$"){let g=iu(e,f,n,s,a);s=g.text,a=g.provenance,f=g.next;continue}s+=u??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function gr(e,t,n,r,o,i){let s=eu(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",d=l==="`",f=e[t]==="<"||e[t]===">",u=ia(e,t+a,n,l),m=u===-1?n:u,p=u===-1?n:u+l.length;if(i>=r.maxDepth)return{program:RS(e,t+a,m,"depth-limit"),next:p,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],A=[],P=!1,k=t+a;while(k<m){let C=gr(e,k,m,r,o,i+1);if(!C){if(Vt(e,k))A.push(jt);k++;continue}if(E.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",k=C.next,P)break}if(u===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:ko(A,P),issues:A,nodes:E},next:p,provenance:"arithmetic"}}let g=To(e,t+a,m,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(d||f)&&pr(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],b=d&&/\\[\\$`\n]/.test(e.slice(t+a,m))?[aS]:[],S=[...g.issues,...h,...y,...b];return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:ko(S,g.limited),issues:S,nodes:g.nodes},next:p,provenance:"command-substitution"}}function JC(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let d=c==="$"||c==="`"?gr(e,l,n,r,o,i):null;if(!d){if(Vt(e,l))a.push(jt);l++;continue}if(s.push(d.program),tS(e,l,d.next)&&nS(d.program))a.push(jt);l=d.next}return{programs:s,issues:a}}function oa(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ia(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`){f+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(Vt(e,f))c.push(jt);let m=Cr(e,f,n,r,o,i),p=m?da(m,l,c):lu(e,f,n,r,o,i,l,c);if(p){if(p.provenance!=="command-substitution")s+=e.slice(f,p.next);if(f=p.next,d||=p.limited,a=gr(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:d};continue}if(u==="$"){let g=du(e,f,n,s,a);s=g.text,a=g.provenance,f=g.next;continue}s+=u??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function Cr(e,t,n,r,o,i){let s=iu(e,t);if(!s)return null;let{length:a,closing:l}=s,c=l==="))",d=l==="`",f=e[t]==="<"||e[t]===">",u=ua(e,t+a,n,l),m=u===-1?n:u,p=u===-1?n:u+l.length;if(i>=r.maxDepth)return{program:kS(e,t+a,m,"depth-limit"),next:p,provenance:c?"arithmetic":"command-substitution"};if(c){let E=[],A=[],P=!1,k=t+a;while(k<m){let C=Cr(e,k,m,r,o,i+1);if(!C){if(Vt(e,k))A.push(jt);k++;continue}if(E.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",k=C.next,P)break}if(u===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:Lo(A,P),issues:A,nodes:E},next:p,provenance:"arithmetic"}}let g=Mo(e,t+a,m,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+a)} substitution is not closed`}]:[],y=(d||f)&&yr(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],b=d&&/\\[\\$`\n]/.test(e.slice(t+a,m))?[gS]:[],S=[...g.issues,...h,...y,...b];return{program:{kind:"program",dialect:"posix",source:e.slice(t+a,m),span:{start:t+a,end:m},status:Lo(S,g.limited),issues:S,nodes:g.nodes},next:p,provenance:"command-substitution"}}function sS(e,t,n,r,o,i){let s=[],a=[],l=t;while(l<n){let c=e[l];if(c==="\\"){l+=2;continue}let d=c==="$"||c==="`"?Cr(e,l,n,r,o,i):null;if(!d){if(Vt(e,l))a.push(jt);l++;continue}if(s.push(d.program),cS(e,l,d.next)&&dS(d.program))a.push(jt);l=d.next}return{programs:s,issues:a}}function da(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ua(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o={single:!1,double:!1},i=[],s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let f=l==="\r"&&e[a+1]===`
-`?a+2:a+1,u=Qs(e,f,n,s.splice(0));if(!u.terminated)return-1;a=u.next-1;continue}let c=Qd(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let f=QC(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",u=a+(f?3:2);while(u<n&&/[ \t]/.test(e[u]??""))u++;let m=Js(e,u,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:f,attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let d=i.pop();if(d){o=d;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function QC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Qd(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Qd(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!xS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function Io(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function eS(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function fr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var jt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vt(e,t){if(e[t]!=="$")return!1;let n=qd(e,t+1);if(e[n]!=="{")return!1;let r=e[qd(e,n+1)]??"";return r==="|"||fr(r)}function tS(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Vt(e,r))return!0;return!1}function nS(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===jt.code)}function qd(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
-`,n))n+=e[n+1]==="\r"?3:2;return n}function eu(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var rS=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),oS=/[\v\f\r]/,tu=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),nu=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),iS=/\$\(|`|[<>]\(/g;function sS(e,t,n){let r=ra(n);return[...e.slice(t).matchAll(iS)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function ra(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>ra(n.nodes))];return t.kind==="group"||t.kind==="function"?ra(t.body.nodes):[]})}var aS=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function ru(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=Oo(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(rS);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(nu);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let d=l.substitutions.some((f)=>{if(Vt(e,f))return a.push(jt),!1;let u=gr(e,f,c,r,o,i);return u!==null&&oa(u,s,a).limited});return{provenance:"variable",next:c,limited:d}}function Oo(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Vt(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
-`,a+=l==="\\"?2:1;continue}let c=eu(e,a);if(c){r.push(a);let d=ia(e,a+c.length,n,c.closing);if(d===-1)break;a=d+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function ou(e,t,n){if(e[t+1]==="{"){let o=Oo(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function lS(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=cS(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function cS(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Ao(e,t+1,n,16,2,t+1);if(r==="u")return Ao(e,t+1,n,16,4,t+1);if(r==="U")return Ao(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Ao(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Ao(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ko(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"||n.code==="unsupported-blank"))return"invalid";return e.length>0?"partial":"complete"}function iu(e,t,n,r,o){let i=ou(e,t,n);return{text:r+e.slice(t,i),provenance:mr(o,"variable"),next:i}}function dS(e,t,n){let r=xo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||f||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",g=ia(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=ou(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function mr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function uS(e,t,n){return t+1>=n||fr(e[t+1]??"")||Io(e,t+1)!==null}var mS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),fS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function pS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=gS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function gS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return hS(e,t);if(n==="env")return yS(e,t);if(n==="sudo")return CS(e,t);return}function hS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function yS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(mS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function CS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(fS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function su(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=au(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>lu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function SS(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=au(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>lu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>En(e,t.span.start,t.span.end,a,"literal",!1))}}function au(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Yd(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=Yd(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let f=d.start+c.length-d.end,u=d.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...bS(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function Yd(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&vS(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:ES(e,r)}}function bS(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function ES(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function vS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function lu(e,t){let n=`x${e}`,r=na(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function RS(e,t,n,r){return{kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]}}function vn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Po(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ea(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function _S(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function pr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>pr(n.nodes));return(t.kind==="group"||t.kind==="function")&&pr(t.body.nodes)})}function wS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function cu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Zd(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Xd.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function du(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&ZC.has(e.text)}function ta(e,t){let n=e.at(-1);if(!cu(n))return;if(n?.kind==="command"&&du(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function xS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),AS=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],PS=/^\$env:\w/i,TS=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!IS(n))return!1;let r=ca(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||la(r).some(kS)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function IS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function kS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&AS.has(n)&&r.some(OS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function OS(e){return PS.test(e)||TS.test(e)}function ca(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r=da(e,0,e.length,t,0);return{kind:"program",dialect:"powershell",source:e,span:n,status:WS(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function da(e,t,n,r,o,i=!1){let s=[],a=[],l=_o(),c=0,d=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};wo(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=LS(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`?a+2:a+1,u=ia(e,f,n,s.splice(0));if(!u.terminated)return-1;a=u.next-1;continue}let c=ou(e,a,t,n,o);if(c!==null){a=c;continue}if(!o.double&&e.startsWith("$((",a)){let f=aS(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!o.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",u=a+(f?3:2);while(u<n&&/[ \t]/.test(e[u]??""))u++;let m=oa(e,u,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:f,attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){i.push(o),o={single:!1,double:!1},a++;continue}if(l==="("&&!o.double){i.push(o),o={single:!1,double:!1};continue}if(l!==")"||o.double)continue;let d=i.pop();if(d){o=d;continue}return r==="))"&&e[a+1]!==")"?-1:a}return-1}function aS(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!MS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function No(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function lS(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function hr(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}var jt=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vt(e,t){if(e[t]!=="$")return!1;let n=Qd(e,t+1);if(e[n]!=="{")return!1;let r=e[Qd(e,n+1)]??"";return r==="|"||hr(r)}function cS(e,t,n){for(let r=e.indexOf("$",t);r!==-1&&r<n;r=e.indexOf("$",r+1))if(Vt(e,r))return!0;return!1}function dS(e){return e?.status==="limited"||(e?.issues??[]).some((t)=>t.code===jt.code)}function Qd(e,t){let n=t;while(e.startsWith("\\\n",n)||e.startsWith(`\\\r
+`,n))n+=e[n+1]==="\r"?3:2;return n}function iu(e,t){if(e.startsWith("$((",t))return{length:3,closing:"))"};if(e.startsWith("$(",t)||e.startsWith("<(",t)||e.startsWith(">(",t))return{length:2,closing:")"};return e[t]==="`"?{length:1,closing:"`"}:null}var uS=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),mS=/[\v\f\r]/,su=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),au=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),fS=/\$\(|`|[<>]\(/g;function pS(e,t,n){let r=ca(n);return[...e.slice(t).matchAll(fS)].some((o)=>{let i=t+o.index;return!r.some((s)=>i>=s.start&&i<s.end)})}function ca(e){return e.flatMap((t)=>{if(t.kind==="command")return[...t.redirections.flatMap((n)=>n.heredoc?[n.heredoc.bodySpan]:[]),...t.nested.flatMap((n)=>ca(n.nodes))];return t.kind==="group"||t.kind==="function"?ca(t.body.nodes):[]})}var gS=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function lu(e,t,n,r,o,i,s,a){if(e[t]!=="$"||e[t+1]!=="{")return null;let l=Wo(e,t+2,n),c=l.close===-1?n:l.close+1;if(l.close===-1)a.push(uS);if(l.quoted&&l.substitutions.length>0||l.continued)a.push(au);if(l.quoted)o.quotedExpansionEnd=Math.min(o.quotedExpansionEnd,c);let d=l.substitutions.some((f)=>{if(Vt(e,f))return a.push(jt),!1;let u=Cr(e,f,c,r,o,i);return u!==null&&da(u,s,a).limited});return{provenance:"variable",next:c,limited:d}}function Wo(e,t,n){let r=[],o=!1,i=!1,s=1,a=t;while(a<n){let l=e[a];if(l==="$"&&Vt(e,a))r.push(a);if(l==="\\"||l==="'"||l==='"'){o=!0,i||=l==="\\"&&e[a+1]===`
+`,a+=l==="\\"?2:1;continue}let c=iu(e,a);if(c){r.push(a);let d=ua(e,a+c.length,n,c.closing);if(d===-1)break;a=d+c.closing.length;continue}if(l==="$"&&e[a+1]==="{"){s++,a+=2;continue}if(l==="}"&&--s===0)return{close:a,substitutions:r,quoted:o,continued:i};a++}return{close:-1,substitutions:r,quoted:o,continued:i}}function cu(e,t,n){if(e[t+1]==="{"){let o=Wo(e,t+2,n).close;return o===-1?n:o+1}if(e[t+1]==="$")return t+2;let r=t+1;while(r<n&&/[A-Za-z0-9_?@#!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function hS(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=yS(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function yS(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Oo(e,t+1,n,16,2,t+1);if(r==="u")return Oo(e,t+1,n,16,4,t+1);if(r==="U")return Oo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Oo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Oo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"||n.code==="unsupported-function-substitution"||n.code==="unsupported-backtick-escape"||n.code==="unclosed-parameter-expansion"||n.code==="unsupported-parameter-expansion"||n.code==="unsupported-blank"))return"invalid";return e.length>0?"partial":"complete"}function du(e,t,n,r,o){let i=cu(e,t,n);return{text:r+e.slice(t,i),provenance:gr(o,"variable"),next:i}}function CS(e,t,n){let r=ko(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||f||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",g=ua(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=cu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function gr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function SS(e,t,n){return t+1>=n||hr(e[t+1]??"")||No(e,t+1)!==null}var bS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),ES=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function vS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=_S(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function _S(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return RS(e,t);if(n==="env")return wS(e,t);if(n==="sudo")return xS(e,t);return}function RS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function wS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(bS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function xS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(ES.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function uu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=mu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>fu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function AS(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=mu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>fu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>_n(e,t.span.start,t.span.end,a,"literal",!1))}}function mu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>eu(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=eu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let f=d.start+c.length-d.end,u=d.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...PS(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function eu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&IS(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:TS(e,r)}}function PS(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function TS(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function IS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function fu(e,t){let n=`x${e}`,r=la(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function kS(e,t,n,r){return{kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]}}function Rn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Do(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function sa(e){return e.wordsUsed++,e.wordsUsed<=e.maxWords}function OS(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function yr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>yr(n.nodes));return(t.kind==="group"||t.kind==="function")&&yr(t.body.nodes)})}function DS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function pu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function tu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!nu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function gu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&oS.has(e.text)}function aa(e,t){let n=e.at(-1);if(!pu(n))return;if(n?.kind==="command"&&gu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function MS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var yu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),NS=new Set(["gc","cat","type","cp","mv","rm"]),Cu=["-rec","-for","-path","-literalpath","-whatif"],LS=/^\$env:\w/i,WS=/^(?:\$\{?\w+\}?|~)\\./;function Su(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...yu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Cu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!GS(n))return!1;let r=ga(e,t);if(bu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||pa(r).some(FS)}function bu(e){return e.nodes.some((t)=>{if(t.kind==="group")return bu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function GS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function FS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&yu.has(n))return!0;let r=e.slice(t+1);if(n&&NS.has(n)&&r.some(zS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Cu.some((s)=>i.startsWith(s))})}function zS(e){return LS.test(e)||WS.test(e)}function ga(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return{kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]};let r=ha(e,0,e.length,t,0);return{kind:"program",dialect:"powershell",source:e,span:n,status:jS(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function ha(e,t,n,r,o,i=!1){let s=[],a=[],l=To(),c=0,d=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Io(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=HS(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
 `){f();let y=m==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(sa(e,u,y)),u=y;continue}u++;continue}let g=Cu(e,u);if(g){f(),s.push(sa(e,u,u+g.length)),u+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=da(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,S={kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes};if(s.push({kind:"group",style:"brace",span:{start:u,end:y.next},body:S}),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(m==="}"){f(),s.push(sa(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let S=b<n?uu(e,b,n,r,o):void 0,E=S?.next??y;if(l.redirections.push({kind:"redirection",operator:e.slice(u,y),span:{start:u,end:E},...S?{target:S.word}:{}}),S)a.push(...S.issues),l.nested.push(...S.nested),c+=S.words,d||=S.limited;l.end=E,u=E;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Xs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=uu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return f(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function uu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,f=!1,u=(p)=>{let g=DS(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=aa(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Cu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:En(e,t,m,i,s,a,s==="literal"?void 0:MS(e,t,m)),next:m,issues:l,nested:c,words:d,limited:f}}function DS(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]},next:a};let l=da(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes},next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function aa(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=aa(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=aa(r)}}return t}function MS(e,t,n){let r=xo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=NS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function NS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function la(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return la(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(la)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function LS(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function WS(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function sa(e,t,n){return{kind:"connector",operator:e.slice(t,n),span:{start:t,end:n}}}function ze(e,t="auto",n=bt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return ca(e,n);return Jd(e,n)}function x(e){return e.provenance==="command-substitution"?e.raw:e.text}function Rn(e,t){return e==="posix"?t:X(t.map((n)=>n.text))}function _n(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function X(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function ua(e,t){return{value:e,work:t}}function R(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function ee(e){return e.value.length}function hr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function _e(e,t){hr(e,t)}function Kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function Y(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ma(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function Z(e,t,n){if(t+n.length>ee(e))return!1;for(let r=0;r<n.length;r++)if(R(e,t+r)!==n[r])return!1;return!0}function it(e,t,n){return!Kt(R(e,t-1))&&Z(e,t,n)&&!Kt(R(e,t+n.length))}function st(e,t){return Kt(R(e,t-1))!==Kt(R(e,t))}function ae(e){return e===`
-`||e===";"||e==="&"||e==="|"}function wn(e){return e==="|"||e===";"}function Do(e,t,n){let r=ua(e,n);if(t==="rm")return GS(r);if(t==="dd")return zS(r);return _u(r,!0)}function Mo(e,t,n){let r=ua(e,n);if(t==="rm")return $S(r);if(t==="reset-hard")return vu(r,"--ha","rd");if(t==="reset-merge")return vu(r,"--me","rge");if(t==="clean")return jS(r);if(t==="checkout")return KS(r);if(t==="push-force")return qS(r);if(t==="push-refspec")return YS(r);if(t==="push-delete")return ZS(r);if(t==="branch")return XS(r);if(t==="tag")return eb(r);if(t==="restore")return tb(r);return _u(r,!1)}function GS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=ee(e);i++){let s=R(e,i);if(!t){let l=R(e,i+2);if(it(e,i,"rm")&&Y(l)&&l!==`
-`)t=!0,i++;continue}let a=FS(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===ee(e)){if(o>=0){let l=Su(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(Y(s)){if(o<0)continue;if(Z(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Su(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function FS(e,t){if(R(e,t)!=="\\"||R(e,t-1)==="\\")return-1;if(Z(e,t,String.raw`\n`))return t+2;if(Z(e,t,String.raw`\x0a`)||Z(e,t,String.raw`\x0A`))return t+5;if(Z(e,t,String.raw`\u000a`)||Z(e,t,String.raw`\u000A`))return t+7;return Z(e,t,String.raw`\012`)?t+4:-1}function Su(e,t,n){if(bu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(bu(e,t,n,"force"))return{recursive:!1,force:!0};if(R(e,t)!=="-"||R(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=R(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function bu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Z(e,t,"--"))return!1;for(let i=0;i<o;i++)if(R(e,t+i+2)!==r[i])return!1;return!0}function zS(e){let t=!1;for(let n=0;n<ee(e);n++){if(ae(R(e,n))){t=!1;continue}if(it(e,n,"dd")){t=!0,n++;continue}if(!t||!it(e,n,"of")||!Z(e,n,"of=/dev/"))continue;let r=n+8;if(r<ee(e)&&!Y(R(e,r))&&R(e,r)!=="'"&&R(e,r)!=='"')return!0}return!1}function $S(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ee(e);){let i=R(e,o);if(o===ee(e)||ae(i)){t=!1,n=!1,r=!1,o++;continue}let s=US(e,o);if(s>=0){if(BS(e,s))return!0;let a=s,l=!1;while(Y(R(e,a)))l||=R(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Z(e,o,"--")&&(o===0||Y(R(e,o-1)))&&(!R(e,o+2)||Y(R(e,o+2))||ae(R(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Z(e,o,"--recursive")&&st(e,o+11)||fa(e,o,"recursive"),r||=Z(e,o,"--force")&&st(e,o+7)||fa(e,o,"force"),n&&r)return!0;o++}return!1}function fa(e,t,n){if(!Z(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=R(e,t+r+2);if(!o||Y(o)||ae(o))break;if(o!==n[r])return!1;r++}return r>0&&st(e,t+r+2)}function BS(e,t){let n=t,r=!1,o=!1;while(n<ee(e)){while(Y(R(e,n)))n++;let i=n;while(n<ee(e)&&!Y(R(e,n)))n++;if(R(e,i)!=="-"||n-i===2&&Z(e,i,"--"))return!1;let s=Eu(e,i,"recursive"),a=Eu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,R(e,i+1)==="-")continue;let l=HS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Eu(e,t,n){return Z(e,t,`--${n}`)&&st(e,t+n.length+2)||fa(e,t,n)}function US(e,t){if(t>0&&Kt(R(e,t-1)))return-1;let n=t;if(R(e,n)==="\\")n++;if(R(e,n)!=="r")return-1;if(n++,R(e,n)==="\\")n++;if(R(e,n)!=="m"||!Y(R(e,n+1)))return-1;return n+1}function HS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(R(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=R(e,c)??"",f=(d==="r"||d==="f")&&st(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&f,s||=d==="f"&&f,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&f,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function vu(e,t,n){return Cr(e,"reset",wn,!0,(r)=>R(e,r)==="-"&&xn(e,r,t,n)?!0:r)}function jS(e){return Cr(e,"clean",wn,!0,(t)=>{if(R(e,t)!=="-")return t;if(xn(e,t,"--fo","rce"))return!0;let n=yr(e,t,wn);for(let r=t+1;r<n;r++)if(R(e,r)==="f")return!0;return n-1})}function No(e,t,n){if(!it(e,t,"git"))return null;let r=t+3;if(!Y(R(e,r)))return{commandEnd:-1,next:r};while(Y(R(e,r)))r++;while(r<ee(e)){if(ae(R(e,r)))return{commandEnd:-1,next:r};let o=yr(e,r,ae);if(it(e,r,n))return{commandEnd:r+n.length,next:o};if(R(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Z(e,r,"--"),s=VS(e,r,o);r=o;while(Y(R(e,r)))r++;if(i)return{commandEnd:it(e,r,n)?r+n.length:-1,next:yr(e,r,ae)};if(!s)continue;if(r>=ee(e)||ae(R(e,r)))return{commandEnd:-1,next:r};r=yr(e,r,ae);while(Y(R(e,r)))r++}return{commandEnd:-1,next:r}}function VS(e,t,n){for(let r of ve)if(n-t===r.length&&Z(e,t,r))return!0;return!1}function KS(e){return Ru(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function qS(e){return Cr(e,"push",wn,!0,(t)=>{if(R(e,t)!=="-")return t;if(R(e,t+1)==="f"&&!Kt(R(e,t+2))&&!Z(e,t+2,"-with-lease"))return!0;let n=wu(e,t,"--fo","rce");if(n>=0&&!Z(e,n,"-with-lease"))return!0;return t})}function YS(e){return Cr(e,"push",ae,!1,(t)=>{if(Y(R(e,t))&&R(e,t+1)==="+"&&t+2<ee(e)&&!ae(R(e,t+2))&&!Y(R(e,t+2)))return!0;if(R(e,t)===":"&&R(e,t+1)==="+")return!0;return t})}function ZS(e){return Cr(e,"push",ae,!1,(t)=>{if(R(e,t)==="-"&&xn(e,t,"--de","lete"))return!0;if(Y(R(e,t))&&R(e,t+1)===":"&&t+2<ee(e)&&!Y(R(e,t+2))&&!ae(R(e,t+2)))return!0;return t})}function XS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ee(e);o++){if(o===ee(e)||ae(R(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=No(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||R(e,o)!=="-")continue;let i=yr(e,o,ae),s=JS(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function JS(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(R(e,i)!=="-")continue;if(xn(e,i,"--de","lete"))r=!0;if(xn(e,i,"--fo","rce"))o=!0;if(R(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&QS(R(e,s))){let d=R(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!st(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function QS(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function eb(e){return Ru(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ru(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<ee(e);r++){let o=R(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&R(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(Y(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=No(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&Y(R(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(xn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(R(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&st(e,r+1))return!0;if(wn(o))i.outerActive=!1}return!1}function Cr(e,t,n,r,o){let i=!1;for(let s=0;s<ee(e);s++){let a=R(e,s),l=n(a);if(!i&&!l){let c=No(e,s,t);if(c){i=c.commandEnd>=0&&(!r||Y(R(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(R(e,d)))i=!1;s=c}if(l)i=!1}return!1}function tb(e){let t=!1;for(let n=0;n<ee(e);n++){if(ma(R(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=No(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&R(e,n)==="-"&&R(e,n+1)==="-"&&(Z(e,n+2,"staged")||Z(e,n+2,"help")))t=!1}return t}function _u(e,t){let n=!1;for(let r=0;r<ee(e);r++){let o=R(e,r),i=t?ma(o):ae(o);if(n&&Y(o)&&R(e,r+1)==="-"&&it(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(it(e,r,"find"))n=!0,r+=3}return!1}function yr(e,t,n){let r=t;while(r<ee(e)&&!Y(R(e,r))&&!n(R(e,r)))r++;return r}function wu(e,t,n,r){if(!Z(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&R(e,o)===r[i];i++)o++;return st(e,o)?o:-1}function xn(e,t,n,r){return wu(e,t,n,r)>=0}function De(e,t){hr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)_e(t,a);if((s.regex?.test(a)??!1)||s.scan&&Mo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var nb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Au(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;hr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Pu(t.nodes,r,i)}function Pu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Pu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return rb(r,t,n)})}function rb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!nb.test(o.text));return e.words.every((o,i)=>o===t||xu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||xu(o.target.raw,n.anchored,!0)))}function xu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var ob="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",ib="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",sb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",ab="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",lb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",cb=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Tu=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,db=new Set(["diskutil","wipefs","sgdisk","parted"]),ub=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),mb=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,fb=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),pb=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),gb=new Set(["i","b"]),hb=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,yb=new Set([">",">|",">>","<>",">&"]),Cb=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Iu(e){return e==="dd"||e==="shred"||Tu.test(e)||db.has(e)}function Sb(e,t){let n=t.some((r)=>r.startsWith("/dev/"));if(e==="diskutil"){let r=t.find((o)=>!o.startsWith("-"));return r!==void 0&&ub.has(r.toLowerCase())}if(e==="wipefs")return n&&t.some((r)=>mb.test(r));if(e==="sgdisk")return n&&t.some((r)=>r.startsWith("-")&&!bb(r));return e==="parted"&&n&&t.some((r)=>Cb.has(r.toLowerCase()))}function bb(e){if(fb.has(e.split("=",1)[0]??e))return!0;if(e.startsWith("--"))return!1;let t=e.slice(1).split("");return gb.has(t[0]??"")||t.every((n)=>pb.has(n))}function ku(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)&&!cb.has(r)))return v("dd.device-write",ob);if(Tu.test(e)&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",ib);if(Sb(e,n))return v("disk.erase",sb);if(e==="shred"&&n.length>0)return v("shred.target",lb);return null}function Ou(e){return e.some((t)=>yb.has(t.operator)&&t.target?.provenance==="literal"&&hb.test(t.target.text))?v("redirect.block-device",ab):null}import{isAbsolute as Eb,resolve as Du}from"node:path";function Sr(e,t,n,r){let o=Eb(e)?Du(e):t?Du(t,e):void 0;if(!o)return;try{return W(o,n,r)}catch{return o}}function Mu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var An="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",br="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ga=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),vb=new Set(["-p","--print"]),Rb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),_b=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),wb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),xb=new Map([["python",new Set(["m"])]]),Ab=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Pb=new Set(["always","default","never"]),Tb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Ib=/\\\r?\n/g,kb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Nu(e){return Wo(e).code}function Lo(e){return Wo(e).sources}function Lu(e){return kb.get(ya(e))??[]}function Wo(e){let t=ya(e[0]??"");if(!ga.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return $e(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return $e(t,n,r,o,i,s);if(t==="node"&&vb.has(s)){let f=e[i+1];if(f===void 0)return $e(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(Db(t,s)){let f=e[i+1];if(f===void 0)return $e(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return $e(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Mb(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=Ob(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,$e(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return $e(t,n,r,o);if(Ab.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&Tb.has(s))||t==="python"&&!Pb.has(f))return $e(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let u=s[f];if(u===void 0)break;if(xb.get(t)?.has(u)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return $e(t,n,r,o)}if(Rb.get(t)?.has(u)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(_b.get(t)?.has(u)){if(f+1===s.length)i++;break}if(wb.get(t)?.has(u)&&f+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return $e(t,n,r,o);if(c)i++}return $e(t,n,r,o,void 0,void 0,!0)}function $e(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Ob(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ha(e,t){return ya(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ya(e){let t=M(e).toLowerCase();return so.test(t)?"python":t}function Db(e,t){return ga.get(e)?.has(t)??!1}function Mb(e){return ga.get(e)?.has("--eval")??!1}function Er(e,t,n=!1){let r=Wb(e,t);if(!pa(r,t))return!1;_e(t,r);let o=Lb(r);if(pa(o,t))return!0;if(_e(t,o),!Wu.test(o))return!1;return!n||Nb(r,t)}function Nb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,f=l+d.length,u=f;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:f,text:e.slice(f,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Wu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Go(i,c)}});if(s.some((l)=>Ca(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((f)=>l.start>=f.start&&l.start<f.end);return(c||d)&&pa(l.text,t)})}function Go(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ca(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Wu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Lb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function pa(e,t){if(Do(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(_e(t,e),r.test(e))return!0;if(Do(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(_e(t,e),r.test(e))return!0;if(Do(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(_e(t,e),n.some((o)=>Mo(o,r))))}function Wb(e,t){return _e(t,e),e.replace(Ib,"")}import{lstatSync as ME,readdirSync as NE}from"node:fs";import{basename as LE,isAbsolute as cm,join as WE,relative as dm}from"node:path";import{isAbsolute as Hu,parse as Kb}from"node:path";import{dirname as Gb,isAbsolute as Fb,parse as zb,sep as $b}from"node:path";function Et(e,t,n){if(nt(t))throw Error("Unsupported Windows namespace path");let r=Fb(t)?zb(t).root:"",o=r||e;for(let i of Ub(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Gb(o);continue}let s=Bb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Bb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${$b}${t}`}function Ub(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Sa=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Hb=new Set(Sa),jb=1024,Gu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Fu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Vb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Fo(e){return Hb.has(e)}function ba(e){return Fo(e)||Gu.has(e)||Fu.has(e)||rr(e)}function at(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function zu(e,t){let n=at("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=jb?{state:"valid",count:r}:{state:"invalid"}}function zo(e,t,n){let o=e.match(Vb)?.[1];if(!o||!ba(o))return null;let i=e.indexOf("=");return{name:o,value:`${at(o,t,n)??""}${e.slice(i+1)}`}}function $u(e){return Uu(e,Fu)}function Bu(e){return Uu(e,Gu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Vu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Me(e){if(!Vu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function $o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Me(x(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ku(e){let t=N(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function qt(e,t,n,r){if(!Ku(Pn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<q.wrapperPeelIterations.cap;f++){let u=ju(i),m=$o(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&Pn(i).includes("=")&&!Yb(i)){let g=Zb(Pn(i),a,t.env)??zo(Pn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=N(Pn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Jb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=tE(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=nE(i);if(p==="builtin")i=i.slice(Be(i,1)==="--"?2:1);if(ju(i)===u)break}let d=$o(i);for(let[f,u]of d.envAssignments)s.set(f,u),a.set(f,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:qb(d.words,o)}}function qb(e,t){return e.some((n)=>!t.has(n))}function ju(e){return e.map(x).join(" ")}function Pn(e){let t=e[0];return t?x(t):""}function Be(e,t){let n=e[t];return n?x(n):void 0}function Yb(e){return Vu.test(Pn(e))}function Zb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Xb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Jb(e,t,n){let r=1,o=n;while(r<e.length){let i=Be(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Be(e,r+1);o=s?vr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=vr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=vr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Xb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Qb=new Set(["-i","-0","--null"]),eE=new Set(["-u","--unset","-C","--chdir","-P"]);function tE(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Be(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(Qb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Be(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Be(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(eE.has(c)){if(c==="-C"||c==="--chdir"){let f=Be(e,a+1);s=f?vr(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=vr(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Me(c))break;while(a<e.length){let f=Me(Be(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Be(e,a)==="--")a++;return l(a)}return l(a)}function vr(e,t,n){if(t==="")return null;if(!e&&!Hu(t))return null;let r=Hu(t)?Kb(t).root:n.realpath(e??"/");if(r===null)return null;try{return Et(r,t,n)}catch{return null}}function nE(e){if(Be(e,1)==="-v")return[...X(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Be(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var rE=/['"\\$`{}#]/;function Bo(e,t){if(e.some((r)=>rE.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function vt(e,t,n){return Uo(e,t,n).tokens}function oE(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Rt(e,t,n,r=0){let o=Uo(e,t,n),i=(o.envSplitValues??[]).flatMap(oE);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Rt(s,t,n,r+1)}function Uo(e,t,n,r){if(!Ku(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=qt(X(e),t,n,r);return{tokens:o.words.map(x),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ra=Symbol("adopt-as-operand"),iE=new Set(["env","sudo","command","builtin"]),sE=new Set(["&&","||","|&","|","&",";"]),aE=new Set(["<<","<<<",">|"]),qu=new Set(["|","|&"]),lE=/[*@#?$!_-]/,cE=/^\w+(?::\w+)*/,dE=Object.freeze([]),Rr=Object.freeze({kind:"scope",edge:"enter"}),_r=Object.freeze({kind:"scope",edge:"exit"}),uE=Object.freeze([]),mE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),wr=new Set(["bash","sh","zsh","dash","ksh"]),fE=256,Qu=new WeakMap;function em(e,t){let n=t.status==="complete"?new Set(va(t)):new Set,r=hE(e,n);if(lo(r))return Ho("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Yt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ho("structural-limit",r,t);if(o.invalid)return Ho("invalid",r,t);let s=Ho("complete",r,t,o.assignmentFallbacks);return Qu.set(s,Object.freeze(i)),s}function Ko(e,t,n,r,o){let i=o.word??((p)=>p),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[],f=tm(e),u=f.findLastIndex((p)=>p.kind==="operator"&&qu.has(p.operator)),m=u!==-1&&f.some((p)=>p.kind==="redirection"&&p.operator==="<<"&&p.body===void 0);for(let[p,g]of f.entries()){let h=m||p<=u;if(g.kind==="scope"){if(g.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let y=o.segment(a,s,c,null,l,h);if(y)return y;let b=d.pop();if(b===void 0)throw Error("scope exit without a matching enter");s=b.state,a=b.segment,l=b.shellWords,c=b.pipeProducer;continue}if(g.kind==="operator"){if(!g.boundary)continue;let y=o.segment(a,s,c,g.operator,l,h);if(y)return y;s=pE(a,s,n,r),c=a.length>0&&qu.has(g.operator)?a:null,a=[],l=new Set;continue}if(g.kind==="redirection"){if(g.fd!==void 0)l.add(a.length-1);if(g.target===void 0)continue;let y=o.redirection({operator:g.operator,role:g.role,targetOrder:g.targetOrder,target:g.target,...g.body===void 0?{}:{body:g.body,consumer:g.consumer}},s,h);if(y===Ra){l.add(a.length),a.push(i(g.target));continue}if(y)return y;continue}a.push(i(g.text))}return o.segment(a,s,c,null,l,m)}function qo(e){return tm(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Ce(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Ce(i,t);return a?Ce(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function xr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function pE(e,t,n,r){let o=xr(e)?new Map([...t.variables,...gE(e,t.variables)]):t.variables,i=vt([...e],n),s=M(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:me(Ce(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function gE(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Ce(o,t)]]:[]})}function tm(e){return Qu.get(e)??dE}function hE(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ho(e,t,n,r=uE){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Yt(e,t){return e.nodes.flatMap((n,r)=>yE(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function yE(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ue(vE(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ue(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[jo("{"),...Yt(e.body,a),...s?[jo("}")]:[]]:[Rr,Ue("("),...Yt(e.body,a),...s?[Ue(")")]:[],_r]}]}let o=xE(e,r.functions);if(o){if(r.depth>=bt.maxDepth||++r.flags.expansions>fE)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Yu(e,r),jo(";"),...Yt(o,{...r,depth:r.depth+1}),jo(";")]},...Zu(e,t,n,r)]}return[{start:e.span.start,events:Yu(e,r)},...Zu(e,t,n,r)]}function Yu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:rm(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:CE(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function CE(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?rm(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[_a(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:RE(r),targetOrder:aE.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:im(t)}:{}}),...s===void 0?o:o.slice(1)]}function Zu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[_a(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ue(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...nm(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?SE(t,n,r):[]]}function SE(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:nm(n.source.slice(r.span.end,e.span.end),n)}]}function nm(e,t){if(t.depth>=bt.maxDepth)return t.flags.limited=!0,[];let n=ze(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Yt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function rm(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ue("glob"):s!==""||e.quoted&&o.length===0?_a(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Ea(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(Ue(m));continue}s+=m.text,a||=m.glob}continue}let d=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Ea(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Yt(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Rr,...p,_r);continue}let f=d?Yt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Rr,...f,_r);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ue("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Rr,...f,...c.raw.endsWith(")")?[Ue(")")]:[],_r);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ue("(")),...u===1?[Rr]:[],...f,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ue(")")):[],...u===1?[_r]:[])}return l(),o}function Ea(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Xu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Xu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Xu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?EE(e,t+2):Oo(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return bE(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&lE.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?cE:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function bE(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ea(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function EE(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function vE(e){return/^[\r\n]+$/.test(e)?";":e}function Ue(e){return Object.freeze({kind:"operator",operator:e,boundary:sE.has(e)})}function jo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function _a(e){return Object.freeze({kind:"word",text:e})}function RE(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Tn(e){return mE.has(e)||/^python\d/.test(e)}var _E=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function om(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=_E.get(e)?.has(n)??!1;return om(e,t.slice(r?2:1))}function Vo(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Vo(e.slice(1));if(t==="uv"&&e[1]==="run")return Vo(e.slice(2));if(!iE.has(t))return[...e];return Vo(om(t,e.slice(1)))}function im(e){let t=ur(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Vo(n<0?[]:e.words.slice(n).map((r)=>r.text))}function wE(e){let t=im(e)[0];if(t===void 0)return!1;let n=M(t).toLowerCase();return Tn(n)&&!wr.has(n)}function va(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return va(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>va(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(wE(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!PE(t))return r;return[...r,...o]})}function xE(e,t){let n=ur(e);return n===void 0?void 0:t.get(n)}function _t(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function AE(e){if(_t(e.words[0],"git"))return _t(e.words[1],"commit");if(!_t(e.words[0],"gh")||!_t(e.words[2],"create"))return!1;return _t(e.words[1],"pr")||_t(e.words[1],"issue")}function PE(e){return(_t(e.words[0],"cat")||_t(e.words[0],"tee")||AE(e))&&!e.words.some(Ju)&&!e.redirections.some((n)=>Ju(n.target))}function Ju(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Ze="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Yo="Unsupported heredoc syntax",Ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function wt(){return{id:"analysis.dynamic-shell-source",reason:Ar,intent:"stop_and_explain"}}var sm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var wa=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),TE=new Set([...wa,"dir_path","glob","glob_pattern","include_pattern"]),IE=new Set([...wa,"folder","glob","pattern","patterns"]);class He extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class Zt extends Error{name="UnparseableCommandError";constructor(){super(Ze)}}function am(e){let t=kE(),n=er(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:OE(e),store:t}}function In(e,t){return e.commands.find((n)=>n.usages.includes(t))}function lt(e){return In(e,"declared-command")??In(e,"input-candidate")}function ct(e,t){if(!e.includes("$"))return e;return Vi(e,t)}function kE(){let e=new Map,t=new WeakMap,n=(o,i)=>{let s=`${i}\x00${o}`,a=e.get(s);if(a)return a;let l=ze(o,i);return e.set(s,l),l};return{getShellSyntax:(o,i)=>{if(i&&i.source!==o)throw TypeError("Shell syntax source does not match command program source.");let s=i??n(o,"posix"),a=t.get(s);if(a)return a;let l=s.status==="limited"?{status:"structural-limit",source:o,program:s,assignmentFallbacks:[]}:em(o,s);return t.set(s,l),l},getCommandProgram:n,readsAutoAsPowerShell:()=>[...e].some(([o,i])=>o.startsWith("auto\x00")&&i.dialect==="powershell")}}function OE(e){let t=e.route.kind==="grep"?TE:e.route.kind==="glob"?IE:wa;return[...lc(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?uc(e.input):[]]}var DE=new Set(["-S","--suffix"]);function kn(e,t,n,r,o){if(e.status==="structural-limit")throw new He;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ko(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Ce(i.target,s.variables),s)?i.target:null})}function Zo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&DE.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var we="Git metadata and hooks are protected. Ask the user before modifying them.";function um(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Zr(e.invocation.toolName))return null;let a=e.paths.find((l)=>lm(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=lt(e);if(!i)return null;let s=kn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>UE(a,l,t,n,r),isRedirectionTarget:(a,l)=>lm(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Xt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Jo(me(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(xa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(f)=>c?Xo(f,l):GE(f,l);if(n.markerFiles.some(d))return!0;return r&&Aa(n).some(d)}if(xa(a,n))return!0;return r&&Aa(n).some((c)=>Xo(c,a))}function GE(e,t){let n=dm(t,e);if(n===""||n.startsWith("..")||cm(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function FE(e,t,n,r,o){return Xt(e,t,n,!0,r,o)}function zE(e,t,n,r,o){if(!n)return!1;return xa(Jo(me(e,t,r,o)),n)}function lm(e,t,n,r,o,i){let s=Jo(me(e,t,r,o));return i.includes(s)||fm(s,n)}function mm(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Xo(i,Jo(me(s,t,r,o)))))}function xa(e,t){return t.entries.includes(e)||t.directories.includes(e)||fm(e,t)}function fm(e,t){return t.hooksDirectories.some((n)=>Xo(e,n))}var $E=50000;function pm(e,t){let n=[...new Set(Aa(e))];if(n.some((o)=>t(LE(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=BE(o);if(!i)return!0;if(r+=i.length,r>$E)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>WE(o,s.name)))}return!1}function BE(e){try{let t=ME(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return NE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Xo(e,t){let n=dm(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!cm(n)}function Jo(e){return process.platform==="win32"?e.toLowerCase():e}function UE(e,t,n,r,o){if(xr(e))return null;let i=Rt([...e],r);if(M(i[0]??"").toLowerCase()!=="mv")return null;let s=Zo(i.slice(1)),a=s.sources.find((l)=>FE(Ce(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&zE(Ce(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ni,normalize as XE,parse as JE,posix as vm,resolve as Qt,sep as ka}from"node:path";import{isAbsolute as HE,join as gm,normalize as Cm,parse as jE,sep as hm}from"node:path";var VE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],KE=` 	
-`;function Pr(e,t){if(Jt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Pa(e.get("TMPDIR")??"",t)}function On(e,t){if(e.has("TMPDIR"))return Pa(e.get("TMPDIR")??"",t);let n=Ta(e,t);if(n===void 0)return!0;return Pa(n,t)}function Ta(e,t){return bm(e,t,"TMPDIR")}function Pa(e,t){if(!e)return!1;if(YE(e))return!1;return Dn(e,t)}function Jt(e,t){let n=bm(e,t,"IFS");return n!==void 0&&n!==""&&n!==KE}function Dn(e,t){let n=Qo(e,t.paths);if(n===null)return!1;return Sm(t).some((r)=>xt(n,r))}function ti(e,t){let n=Qo(e,t.paths);if(n===null)return!1;return Sm(t).some((r)=>ei(r)===ei(n))}var ym=new WeakMap;function Sm(e){let t=ym.get(e);if(t)return t;let n=qE(e);return ym.set(e,n),n}function qE(e){let t=VE.map((r)=>Qo(r,e.paths)??Cm(r)),n=Qo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&ZE(n))return[...t,n];return t}function YE(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function bm(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function ZE(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Qo(e,t){try{let n=Cm(e);if(!HE(n))return n;let r=jE(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=gm(i,o[s]??"");if(t.entryKind(a)==="missing")return gm(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function xt(e,t){let n=ei(e),r=ei(t);if(n===r)return!0;let o=r.endsWith(hm)?r:`${r}${hm}`;return n.startsWith(o)}function ei(e){return process.platform==="win32"?e.toLowerCase():e}var QE=process.platform==="win32",Em=64,ev=16384;function en(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Tr(e){let t=su(e,Em,Em,ev);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:tv(e)}}function tv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>nv(e.raw,n.span.start-e.span.start))}function nv(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Xe(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Te();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:lv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function xe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&dv(e))return{kind:"outside_anchored_cwd"};let o=!r&&_m(e,t.posixShell);if(nt(e))return{kind:"outside_anchored_cwd"};if(Oa(e,r))return{kind:"root_or_home_target"};if(ov(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Xt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(iv(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(cv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&pv(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>gv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(hv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(rv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function rv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ni(r)||r.startsWith("~"))return!1;if(Da(r))return!1;if(wm(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Dn(Qt(t.resolvedCwd,r),t.environment)}function Rm(e,t,n={}){let{containmentTarget:r,...o}=n;if(xe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(av(i))return!1;if(ti(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>wm(r??i,s,t.environment.paths,t.budget))}function Oa(e,t=!1){let n=e.trim(),r=vm.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function ov(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ni(o)?o:t.resolvedCwd?Qt(t.resolvedCwd,o):null;if(!i)return!1;let s=Se(W(i,t.environment.paths,t.budget));if(s===JE(s).root)return!0;return s===Se(W(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Se(e){let t=XE(e);if(QE){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function iv(e,t,n,r,o,i,s,a){let l=e.trim();if(Da(l))return!1;if(!r&&Dn(l,a))return!0;return(t||i&&s)&&n&&!o&&sv(l,n)}function sv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!_m(e.slice(n.length+1),t)})}function av(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return vm.normalize(`/${t[1]??""}`)==="/"}function Da(e){return e.split(/[\\/]+/).includes("..")}function lv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=ar(o.trim(),t);if(!ni(i))return[];try{let s=W(i,n,r);if(lr(s,W(t,n,r)))return[];return[Se(s)]}catch{return[]}})}function cv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Da(r))return!1;let o=n?r:ar(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ni(o)?o:i?Qt(i,o):null;if(!s)return!1;try{let a=Se(W(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ka)?l:`${l}${ka}`))}catch{return!1}}function dv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function _m(e,t=!1){return e.includes("$")||e.includes("`")||uv(e)||t&&mv(e)}function uv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function mv(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&fv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function fv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function pv(e,t,n,r){try{return Se(W(e,n,r))===Se(W(t,n,r))}catch{try{return Se(e)===Se(t)}catch{return!1}}}function gv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Se(W(Qt(t,e),n,r))===Se(W(o,n,r))}catch{try{return Se(Qt(t,e))===Se(o)}catch{return!1}}}function hv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ia(Qt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ia(Qt(a,e),t,i,s)}catch{return!1}}function Ia(e,t,n,r){try{return xm(W(e,n,r),W(t,n,r))}catch{return!1}}function wm(e,t,n,r){if(!t)return!1;try{return xm(W(t,n,r),W(e,n,r))}catch{return!0}}function xm(e,t){let n=Se(e),r=Se(t);return n.startsWith(`${r}${ka}`)||n===r}var yv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Am="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Pm="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Tm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Sv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",Ev={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Tm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:we},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Pm},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Sv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Am},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Cv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Am}};function Im(e,t,n){return vv(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,Xe({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function vv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=_v(o),s=o[i];if(!s||!yv.has(Dv(s.text)))return null;let a=Rv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",bv);for(let l of a.targets)if(!nt(l.text)&&Oa(Ir(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Tm);for(let l of a.targets)if(n.resolvedCwd&&Xt(Ir(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",we);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Pm);for(let l of a.targets){let c=en(xe(Ir(l.text),n),n,r,Ev);if(c)return c}return null}function Rv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(wv(l))continue;if(s){t.push(Ma(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Av(l.text);if(!c){t.push(Ma(l)),i=i||l.dynamic;continue}if(Pv(c.name)){let d=c.value?xv(c.value,l):e[++a];if(d?.kind==="word"){t.push(Ma(d)),i=i||d.dynamic;continue}i=!0;continue}if(Tv(c.name)){n=!0;continue}if(Iv(c.name)){r=!0;continue}if(kv(c.name))o=Ov(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function _v(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Ma(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function wv(e){return e.kind==="word"&&e.text===","}function Ir(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function xv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Av(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Pv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function Tv(e){return"recurse".startsWith(e)}function Iv(e){return e.length>=2&&"force".startsWith(e)}function kv(e){return e==="wi"||"whatif".startsWith(e)}function Ov(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Dv(e){return e.toLowerCase()}var Mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Nv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Lv=new Set(["-o","--output","--query","--subscription"]),Wv=new Set;function km(e){if(e==="aws")return Mv;if(e==="gcloud")return Nv;if(e==="az")return Lv;return Wv}var Gv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Fv=new Set;function Om(e){if(e==="git")return ve;if(e==="docker")return Gv;return Fv}function dt(e,t){if(e.length===0||t.length===0)return null;let n=N(e[0]??""),r=ye(e);for(let o of t){if(!Bv(n,o.command))continue;if(o.match){if(zv(n,e,o.match))return Dm(o);continue}if(!Uv(n,e,o.subcommand))continue;if(jv(e,new Set(o.block_args),r))return Dm(o)}return null}function Dm(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function zv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return $v(r,n.command_path,km(e))}function $v(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Bv(e,t){return e===N(t)}function Uv(e,t,n){if(!n)return!0;return Mm(t,1,n,Om(e))}function Mm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Hv(e,i,n,r))return!0;continue}return s===n}return!1}function Hv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Mm(e,t+2,n,r)}function jv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Vv=new Set(["-e","--source"]),Kv=new Set(["-F","-v","--assign","--field-separator"]),Nm=new Set(["-f","--file"]),qv=new Set(["print","printf","return"]),Lm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Yv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Wm(e,t,n){let r=!1;for(let o of Zv(e)){let i=Xv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Yv):null}function La(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Vv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Kv.has(a)||Nm.has(a))){let l=e[s+1];if(i&&=l!==void 0,Nm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Or(e){return La(e).sources}function Zv(e){return Or(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Xv(e,t){_e(t,e);let n=e.includes("system")?Wa(e,t):null,r=Jv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Wa(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=oi(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Gm(e,i+1);continue}if(s==="/"&&Fm(e,i)){i=zm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,kr(e[a-1])||kr(e[i]))continue;let l=ri(e,i);if(e[l]!=="(")continue;l=ri(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=oi(e,l,c);if(!d){r=!0,o=!0;continue}if(l=ri(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Jv(e,t){_e(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let m=oi(e,i,d);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(d==="#"){i=Gm(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Fm(e,i)){let m=zm(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Na(e,i,"print")||Na(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,u=ri(e,f);if(Na(e,u,"getline")){o=!0;let m=tR(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(rR(s,a)){o=!0;let m=eR(e,u);if(!m){r=!0,c=f,i=f;continue}if(!Qv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function kr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function ri(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Qv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function oi(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=nR(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function eR(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return oi(e,t,n)}function tR(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function nR(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Na(e,t,n){return e.startsWith(n,t)&&!kr(e[t-1])&&!kr(e[t+n.length])}function rR(e,t){return t!==null&&t>=e}function Gm(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Fm(e,t){let n=oR(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(kr(e[r-1]))r--;return qv.has(e.slice(r,n+1))}function oR(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function zm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var iR=new Set(["sudo","env","command","builtin"]),sR=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function ii(e,t){let n=e[0];if(!n||!$m(M(n),t))return null;let r=M(n),o=e[1]==="--"?2:1,i=aR(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function aR(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=M(a)!==n&&lR(a,r);if(l)i.push(s);if(!l&&ao.has(N(a)))break;if(o)break}return i}function lR(e,t){let n=M(e),r=N(e);return r==="git"||n==="busybox"||tn(e)||Rs.has(n)||Iu(r)||$m(n,t)||J.has(r)||e==="$SHELL"||Fe(r)||ke.has(r)||t.rules.some((o)=>o.command===n)}function $m(e,t){return sR.has(e)||t.transparentWrappers.includes(e)}function tn(e){return iR.has(e.toLowerCase())}function nn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function je(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return si([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*si(e,t,n,r,o,i,s,a,l){let c=Uo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:d,cwd:f}=c;if(c.envSplitValues){let m=Bo(c.envSplitValues,d);if(!m)throw new F("derivedCommandShape");Ga(a),yield*si(m,t,f,r,o,i,s,a,l);return}if(tn(d[0]??""))throw new F("wrapperPeelIterations");let u=ii(d,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])Ga(a),yield*si(m===u.childIndex?u.tokens:d.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(dR(d)){Ga(a),yield*si(d.slice(1),t,f,r,o,i,s,a,l);return}yield cR(d,f,r,o,i,l)}function cR(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:M(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ga(e){if(e.iterations>=q.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function dR(e){return M(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Fa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ut(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||za(r,"recursive")){t=!0;continue}if(r==="-f"||za(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function ai(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>za(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function za(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var uR=["--init-file","--rcfile"],mR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ne(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Um(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Um(e,t,!1);if(r!==null)return r}}return null}var Bm=/^-[cn]+$/;function Ve(e){let t=e.slice(1);if(t.some((r)=>/^[-+]./.test(r)&&r!=="--"&&!Bm.test(r)))return!1;let n=t.findIndex((r)=>!Bm.test(r));return t.slice(0,n===-1?void 0:n).some((r)=>r.includes("n"))}var fR=/^-[abcefhiklmnprstuvx]+$/;function li(e){let t=e.findIndex((i,s)=>s>0&&!fR.test(i)),n=t===-1||/^[-+]/.test(e[t]??"")?e.slice(1):e.slice(1,t+1);if(n.some((i)=>i.startsWith("+")))return!0;let r=n.filter((i)=>i.startsWith("-")&&!i.startsWith("--")&&i.includes("c"));if(r.length===0)return!1;let o=Ne(e);if(o===null)return n.some((i)=>i.startsWith("-")&&!r.includes(i));return/^[-+]/.test(o)||r.some((i)=>/[oO]/.test(i))}function Um(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Hm(e){let t=M(e[0]??"").toLowerCase(),n=pR(e,t),r=mR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function pR(e,t){let n=Oe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?uR.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Es.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=vs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var gR="find -delete permanently removes files. Use -print first to preview.",hR="find -exec rm -rf is dangerous. Use explicit file list instead.",yR=new Set(["-exec","-execdir","-ok","-okdir"]),CR=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function jm(e,t){let n=e.map(x),r=SR(e,n,t);if(r)return r;if(ci(n,1)&&!wR(e,n,t)){let s=I(v("find.delete",gR),t.policy);if(s)return s}let o=t.budget??Te(),i=0;while(i<n.length){let s=n[i],a=mt(s??"");if(a>0){i+=a+1;continue}if(!Je(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Mn(n,i);i=l.nextIndex;let c=AR(l.tokens,t.environment);if(c){let m=I(c,t.policy);if(m)return m}let d=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?.(l.tokens,d?null:t.cwd)??null,u=f?.id.startsWith("custom.")?f:I(f,t.policy);if(u)return u}return null}function SR(e,t,n){if(!ci(t,1)&&!$a(t,n.environment))return null;let o=Dr(e)??X(["."]),i=Xe({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Tr(s);for(let l of a.expandedTargets??[x(s)]){let c=xe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!bR(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",we)}}if(_R(t)&&i.resolvedCwd&&mm(o.map(x),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",we);return null}function bR(e,t,n){if(!t)return!1;let r=e.map(x),o=[],i=!1,s=Dr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(Je(l)){let c=Mn(r,a),d=Rt([...c.tokens],n),f=ai(d),u=J.has(M(d[0]??"").toLowerCase()),m=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(f||u||m||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(vR(c.text,l==="-iname"));a+=2;continue}if(!ER.has(l))return!1;a+=1+mt(l)}return o.length>0&&!pm(t,(l)=>o.every((c)=>c.test(l)))}var ER=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function vR(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var RR=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function $a(e,t){let n=0;while(n<e.length){if(!Je(e[n])){n++;continue}let r=Mn(e,n),o=Rt([...r.tokens],t),i=M(o[0]??"").toLowerCase(),s=J.has(i)&&RR.test((Ne(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function _R(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function wR(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Dr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ta(o,n.environment),s=n.trustedTmpdirValue??On(o,n.environment),a=n.allowTmpdirVar??!Pr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Jt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Xe(l),d=Xe({...l,cwd:n.originalCwd??n.cwd}),f=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),m=f&&u&&!xt(u,f)?n.cwd:void 0;return r.every((p)=>{let g=Tr(p);if(g.unsafeBraceExpansion)return!1;return(g.expandedTargets??[x(p)]).every((h)=>{let y=/^\.\/*$/.test(h)?m:void 0,b=y??h,S={targetIsLiteral:g.expandedTargets!==void 0||g.targetIsLiteral,tmpdirWordSplittingProtected:g.tmpdirWordSplittingProtected};if(!re(n.policy,"rm.recursive-force-paranoid",n.paranoid??!1)&&!y&&xe(b,c,S).kind==="within_anchored_cwd")return!0;return Rm(b,y?d:c,{...S,containmentTarget:xR(b,i)})})})}function xR(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Dr(e){let t=(o)=>{let i=e[o];return i?x(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function AR(e,t){let n=vt([...e],t);if(n.length===0)return null;let r=M(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=M(n[0]??"");if(r==="rm"&&ut(n))return v("find.exec-rm-recursive-force",hR);return null}function Mn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function ci(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Je(r)){n=Mn(e,n).nextIndex;continue}let o=mt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function mt(e){return CR.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Je(e){return e!==void 0&&yR.has(e)}import{resolve as ew}from"node:path";function Mr(e){let t=ze(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var PR=5,Ba="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function le(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Km(e,t,n){let r=Nn(e,t,n),o=TR(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<PR;a++){let{subcommand:l,rest:c}=Ae(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(d),u=MR(f);if(u===null||u.length===0)return{blockedReason:Ba,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:Ba,expanded:!0,tokens:i}}function qm(e,t,n){return Nn(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ae(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?M(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function TR(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Nn(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?M(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=kR(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...IR(e,t,n)]}}function IR(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ua(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ua(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Vm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Vm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function kR(e,t){let n=OR(e,t),r=DR(e,t);return{blockedReason:n===null||r===null?Ba:null,entries:[...n??[],...r??[]]}}function OR(e,t){let n=at("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Mr(n);if(!o)return null;for(let i of o){let s=Ua(i);if(!s)return null;r.push(s)}return r}function DR(e,t){let n=zu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=at(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=at(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ua(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Vm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:at(e.slice(r+1),t,n)}}function MR(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Mr(t)}var NR="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",LR="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",WR="git checkout --force discards uncommitted changes. Use 'git stash' first.",GR="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",FR="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",zR="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",$R="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",BR="git switch --force discards uncommitted changes. Use 'git stash' first.",UR="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",HR="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",jR="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",VR="git reset --merge can lose uncommitted changes. Use 'git stash' first.",KR="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",qR="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",YR="git push --force destroys remote history. Use --force-with-lease for safer force push.",ZR="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",XR="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",JR="git branch -D force-deletes without merge check. Use -d for safe delete.",QR="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",e_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",t_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",n_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",r_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",o_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",i_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",s_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),a_=new Set(["--recurse-submodules","--track","-t"]),Ha=new Set(["-b","-B","-U"]),ja=new Set(["-c","-C"]),l_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function L(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Ln=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zm(e,t){let{subcommand:n,rest:r}=Ae(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return At(c_(r,t));case"switch":return At(u_(r));case"restore":return At(f_(r));case"reset":return g_(r);case"clean":return At(y_(r));case"rm":return At(C_(r));case"push":return rn(S_(r));case"branch":return rn(v_(r));case"stash":return rn(A_(r));case"worktree":return rn(P_(r));case"rebase":return At(R_(r));case"merge":return At(__(r));case"tag":return rn(w_(r));case"reflog":return rn(x_(r));default:return null}}function At(e){return e?{...e,localDiscard:!0}:null}function rn(e){return e?{...e,localDiscard:!1}:null}function c_(e,t){let{index:n,before:r}=le(e),o=ye(r,{shortOptsWithValue:Ha});if(r.some((a)=>L(a,"--force"))||o.has("-f"))return v("git.checkout-force",WR);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(L(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",FR)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",GR);return v("git.checkout-double-dash",NR)}let i=m_(e);if(i.length>=2)return v("git.checkout-ambiguous",zR);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>L(a,"--detach")||L(a,"--track")))return null;if(d_(s)||t(s))return v("git.checkout-double-dash",LR);return null}function d_(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function u_(e){let{before:t}=le(e);if(t.some((r)=>L(r,"--discard-changes")))return v("git.switch-discard-changes",$R);let n=ye(t,{shortOptsWithValue:ja});if(t.some((r)=>L(r,"--force"))||n.has("-f"))return v("git.switch-force",BR);return null}function m_(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(s_.has(r)){n+=2;continue}if(a_.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function f_(e){let t=p_(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",HR):v("git.restore-unstaged",UR)}function p_(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(l_.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function g_(e){let t=null;for(let n of e){if(L(n,"--hard")){t=v("git.reset-hard",jR);break}if(L(n,"--merge")){t=v("git.reset-merge",VR);break}}if(!t)return null;return h_(e)?rn(t):At(t)}function h_(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function y_(e){for(let n of e)if(n==="-n"||L(n,"--dry-run"))return null;let t=ye(e.filter((n)=>n!=="--"));if(e.some((n)=>L(n,"--force"))||t.has("-f"))return v("git.clean-force",KR);return null}function C_(e){let t=!1,n=!1,r=!1;for(let o of le(e).before){if(L(o,"--no-force")){t=!1;continue}if(L(o,"--force")){t=!0;continue}if(L(o,"--no-cached")){n=!1;continue}if(L(o,"--cached")){n=!0;continue}if(L(o,"--no-dry-run")){r=!1;continue}if(L(o,"--dry-run")){r=!0;continue}let i=ye([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",qR):null}function S_(e){let{before:t,after:n}=le(e),r=ye(t);if(t.some((s)=>L(s,"--mirror")))return v("git.push-mirror",XR);if(t.some((s)=>L(s,"--force"))||r.has("-f")||Ym(t,n).some(b_))return v("git.push-force",YR);if(t.some((s)=>L(s,"--delete"))||r.has("-d")||Ym(t,n).some(E_))return v("git.push-delete",ZR);return null}function Ym(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function b_(e){return e.startsWith("+")||e.includes(":+")}function E_(e){return e.length>1&&e.startsWith(":")}function v_(e){let{before:t}=le(e),n=ye(t),r=n.has("-D")||n.has("-d")||t.some((i)=>L(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>L(i,"--force"));if(r&&o)return v("git.branch-force-delete",JR);return null}function R_(e){let{before:t}=le(e);return t.some((n)=>L(n,"--abort"))?v("git.rebase-abort",QR):null}function __(e){let{before:t}=le(e);return t.some((n)=>L(n,"--abort"))?v("git.merge-abort",e_):null}function w_(e){let{before:t}=le(e);return ye(t).has("-d")||t.some((r)=>L(r,"--delete"))?v("git.tag-delete",t_):null}function x_(e){return e[0]==="delete"?v("git.reflog-delete",n_):null}function A_(e){for(let t of e){if(t==="drop")return v("git.stash-drop",r_);if(t==="clear")return v("git.stash-clear",o_)}return null}function P_(e){let{before:t}=le(e);if(!t.includes("remove"))return null;let r=ye(t);if(t.some((o)=>L(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",i_);return null}import{isAbsolute as Y_,join as Z_,resolve as X_}from"node:path";var Ka="TMPDIR",qa="IFS",Jm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qm=/^[A-Za-z_][A-Za-z0-9_]*$/,ef=new Set(["export","typeset","declare","readonly"]),T_=new Set(["builtin","command","time"]),I_=new Set(["do","then","else"]),k_=new Set(["do","then","case"]),Xm=new Set(["done","fi","esac"]),O_=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function tf(e,t){return e.map((n)=>n.provenance==="variable"&&cf(n.text)?nf(n.text,t.shellAssignments):x(n))}function nf(e,t){return e.replace(O_,(n,r,o)=>t.get(r??o??"")??n)}function Qe(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=nf(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function rf(e,t){return{env:e,effectiveEnvAssignments:L_(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function of(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ya(e,t){let n=af(e,t),r=e[0]??"";if(k_.has(r))t.bodyDepth+=1;if(r==="elif"||Xm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Xm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Za(t,a)});let o=n.commandIndex;if(o!==-1&&ef.has(e[o]??""))e.filter((a)=>Qm.test(a)&&Va(a)).forEach((a)=>{W_(t,a)});let i=o===-1?-1:lf(e,o);if(i===-1||e[i]!=="unset")return;let s=F_(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}G_(t,a)})}function sf(e,t){let n=af(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function af(e,t){let n=I_.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!cf(a)),o=r!==-1&&ef.has(e[lf(e,r)]??""),i=N_(t);return{assignments:e.flatMap((a,l)=>{let c=D_(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Fo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function lf(e,t){let n=t;while(T_.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function cf(e){return Me(e)!==null||Jm.test(e)}function D_(e,t,n){return Me(e)??M_(e,t,n)}function M_(e,t,n){let r=zo(e,n,t);if(r)return r;let o=e.match(Jm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Va(e){return e===Ka||e===qa||ba(e)}function N_(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function L_(e,t){let n=[Ka,qa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Za(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function W_(e,t){Za(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function G_(e,t){if(!Va(t)&&!Qm.test(t))return;if(e.shellAssignments.set(t,""),Fo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Va(t)||t===Ka||t===qa||rr(t)){Za(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function F_(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{dirname as uf,join as di,resolve as z_}from"node:path";function ui(e,t){return Sa.some((n)=>t?.has(n)||e.has(n))}function Wn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(z_(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=df(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=df(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function df(e,t,n){try{let r=Et(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Nr(e,t){if(t.entryKind(di(e,".git"))!=="missing")return e;let n=uf(e);return n===e?null:Nr(n,t)}function mi(e,t,n,r,o){let i=r.paths,s=di(n,".git"),a=i.isDirectory(s),l=a&&!r.isGitDirectory(s),c=mf(t).filter((d)=>l||d!==n&&xt(d,n));return Nn(e,r.env,o).entries.some((d)=>d.key.toLowerCase()==="core.worktree")||c.some((d)=>i.entryKind(di(d,"HEAD"))!=="missing"||d!==n&&i.entryKind(di(d,".git"))!=="missing")||a&&r.gitDirectoryRedirects(s)}function mf(e){let t=uf(e);return t===e?[e]:[e,...mf(t)]}function ff(e,t,n){if(!t.localDiscard||!n.worktreeMode||ui(n.environment.env,n.envAssignments))return null;let r=Wn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd),i=Nr(r.gitCwd,n.environment.paths);if(!o||i===null||mi(e,r.gitCwd,i,n.environment,n.envAssignments))return null;if(Xa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Xa(e,t,n){let{subcommand:r,rest:o}=Ae(e),i=r?.toLowerCase();if(t.dynamicArguments||$_(o)||V_(e,t.environment.env,t.envAssignments,n)||H_(o)||B_(i,o))return!0;return i==="clean"&&j_(o)>1}function $_(e){return e.some((t)=>/[$*?[]/.test(t))}function B_(e,t){if(e==="checkout"){let{before:n}=le(t),r=ye(n,{shortOptsWithValue:Ha}),o=n.some((s)=>L(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=le(t),r=ye(n,{shortOptsWithValue:ja}),o=n.some((s)=>L(s,"--force"))||n.some((s)=>L(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||U_(s))||r.has("-C");return o&&i}return!1}function U_(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function H_(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function j_(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function V_(e,t,n,r){if(at("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Nn(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>q_(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||K_(s.value);if(Bu(n))return!0;return r.recursiveSubmodules}function K_(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function q_(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function pf(e,t,n){let r=e.map((l)=>Qe(l,n.shellAssignments??new Map)??x(l)),o=n.environment.paths,i=Wn(r,n.cwd,o),s=n.originalCwd?o.realpath(X_(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||ui(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Q_(e,n.shellAssignments,o):Nr(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!J_(a,i.gitCwd,r,t,n)||!Dn(a,n.environment)||ti(a,n.environment)||xt(s,a)||xt(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function J_(e,t,n,r,o){let i=o.environment.paths,s=Z_(e,".git");if(i.entryKind(s)!=="present"||mi(n,t,e,o.environment,o.envAssignments))return!1;if(i.isDirectory(s))return!0;if(!r.localDiscard)return!1;let l=o.environment.worktreeFacts(e);return l!==null&&!Xa(n,o,l)}function Q_(e,t,n){let r=Ae(e.map(x)).rest,{before:o,after:i}=le(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Qe(l,t??new Map))??a;if(!Y_(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}var tw="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",nw=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function fi(e,t){return gf(e,t)}function gf(e,t,n){let r=e.map(x),o=Km(r,t.environment.env,t.envAssignments),i=o.blockedReason?I(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if(($u(t.envAssignments)||qm(r,t.environment.env,t.envAssignments))&&rw(s))return v("git.ssh-env",tw);let a=Zm(s,(c)=>{let d=Wn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(ew(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=ff(r,a,t)??pf(e,a,t);if(!l)return a;return n?.(l),null}function hf(e,t){let n=null;return{match:gf(e,t,(o)=>{n=o}),relaxation:n}}function rw(e){let{subcommand:t,rest:n}=Ae(e),r=t?.toLowerCase();if(!r)return!1;if(nw.has(r))return!0;if(r==="archive")return le(n).before.some((o)=>L(o,"--remote"));return r==="remote"&&ow(n)}function ow(e){return e.find((t)=>!iw(t))?.toLowerCase()==="update"}function iw(e){return e==="-v"||L(e,"--verbose")||L(e,"--no-verbose")}import{isAbsolute as Nw}from"node:path";function yf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function pi(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Cf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",sw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",aw="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",lw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",cw="rm -rf in home directory is dangerous. Change to a project directory first.",Sf={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:lw},git_metadata_target:{id:"rm.git-metadata",reason:we},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:aw},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:cw},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Cf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:sw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Cf}};function gi(e,t){let n=Xe({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(x),o=ai(r),i=uw(e);for(let s of i){let a=Tr(s.word);if(o&&a.unsafeBraceExpansion){let l=I(en({kind:"outside_anchored_cwd"},n,t.policy,Sf),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=ue(l),d={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Xt(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",we);if(!o)continue;for(let f of dw(c,n,d)){let u=en(f,n,t.policy,Sf),m=I(u,t.policy);if(m)return m}}}return null}function dw(e,t,n){let r=xe(e,t,n);if(r.kind==="cwd_self_target")return[r,xe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=xe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,xe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function uw(e){let t=[],n=!1;for(let r of e.slice(1)){let o=x(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Pt={kind:"none"},on={kind:"dynamic"},mw=new Set(["<","<<","<<-","<<<","<&","<>"]),Ef=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,fw=/^(?:[0-9]+|[@*])$/,pw=bt.maxWords,vf=bt.maxInputLength;function Rf(e){if(!e||M(N(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?u+2:u+1;s.push(ma(e,u,y)),u=y;continue}u++;continue}let g=_u(e,u);if(g){f(),s.push(ma(e,u,u+g.length)),u+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(vu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=ha(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,S={kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes};if(s.push({kind:"group",style:"brace",span:{start:u,end:y.next},body:S}),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(m==="}"){f(),s.push(ma(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let S=b<n?hu(e,b,n,r,o):void 0,E=S?.next??y;if(l.redirections.push({kind:"redirection",operator:e.slice(u,y),span:{start:u,end:E},...S?{target:S.word}:{}}),S)a.push(...S.issues),l.nested.push(...S.nested),c+=S.words,d||=S.limited;l.end=E,u=E;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(ra({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=hu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return f(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function hu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,f=!1,u=(p)=>{let g=$S(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=fa(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||_u(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:_n(e,t,m,i,s,a,s==="literal"?void 0:BS(e,t,m)),next:m,issues:l,nested:c,words:d,limited:f}}function $S(e,t,n,r,o){let i=Eu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[vu(r.maxDepth)],nodes:[]},next:a};let l=ha(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes},next:a}}function Eu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function fa(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=fa(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=fa(r)}}return t}function BS(e,t,n){let r=ko(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Eu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=US(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function US(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function vu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function pa(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return pa(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(pa)]})}function _u(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function HS(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function jS(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ma(e,t,n){return{kind:"connector",operator:e.slice(t,n),span:{start:t,end:n}}}function Be(e,t="auto",n=vt){if(t==="powershell"||t==="auto"&&Su(e.slice(0,n.maxInputLength),n))return ga(e,n);return ru(e,n)}function R(e){return e.provenance==="command-substitution"?e.raw:e.text}function wn(e,t){return e==="posix"?t:X(t.map((n)=>n.text))}function xn(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function X(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function ya(e,t){return{value:e,work:t}}function _(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function te(e){return e.value.length}function Sr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){Sr(e,t)}function Kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function K(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ca(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function q(e,t,n){if(t+n.length>te(e))return!1;for(let r=0;r<n.length;r++)if(_(e,t+r)!==n[r])return!1;return!0}function st(e,t,n){return!Kt(_(e,t-1))&&q(e,t,n)&&!Kt(_(e,t+n.length))}function at(e,t){return Kt(_(e,t-1))!==Kt(_(e,t))}function se(e){return e===`
+`||e===";"||e==="&"||e==="|"}function An(e){return e==="|"||e===";"}function Go(e,t,n){let r=ya(e,n);if(t==="rm")return VS(r);if(t==="dd")return qS(r);return Tu(r,!0)}function Fo(e,t,n){let r=ya(e,n);if(t==="rm")return YS(r);if(t==="reset-hard")return Au(r,"--ha","rd");if(t==="reset-merge")return Au(r,"--me","rge");if(t==="clean")return QS(r);if(t==="checkout")return tb(r);if(t==="push-force")return nb(r);if(t==="push-refspec")return rb(r);if(t==="push-delete")return ob(r);if(t==="branch")return ib(r);if(t==="tag")return lb(r);if(t==="restore")return cb(r);return Tu(r,!1)}function VS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=te(e);i++){let s=_(e,i);if(!t){let l=_(e,i+2);if(st(e,i,"rm")&&K(l)&&l!==`
+`)t=!0,i++;continue}let a=KS(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===te(e)){if(o>=0){let l=Ru(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(K(s)){if(o<0)continue;if(q(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Ru(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function KS(e,t){if(_(e,t)!=="\\"||_(e,t-1)==="\\")return-1;if(q(e,t,String.raw`\n`))return t+2;if(q(e,t,String.raw`\x0a`)||q(e,t,String.raw`\x0A`))return t+5;if(q(e,t,String.raw`\u000a`)||q(e,t,String.raw`\u000A`))return t+7;return q(e,t,String.raw`\012`)?t+4:-1}function Ru(e,t,n){if(wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(wu(e,t,n,"force"))return{recursive:!1,force:!0};if(_(e,t)!=="-"||_(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=_(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!q(e,t,"--"))return!1;for(let i=0;i<o;i++)if(_(e,t+i+2)!==r[i])return!1;return!0}function qS(e){let t=!1;for(let n=0;n<te(e);n++){if(se(_(e,n))){t=!1;continue}if(st(e,n,"dd")){t=!0,n++;continue}if(!t||!st(e,n,"of")||!q(e,n,"of=/dev/"))continue;let r=n+8;if(r<te(e)&&!K(_(e,r))&&_(e,r)!=="'"&&_(e,r)!=='"')return!0}return!1}function YS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);){let i=_(e,o);if(o===te(e)||se(i)){t=!1,n=!1,r=!1,o++;continue}let s=XS(e,o);if(s>=0){if(ZS(e,s))return!0;let a=s,l=!1;while(K(_(e,a)))l||=_(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(q(e,o,"--")&&(o===0||K(_(e,o-1)))&&(!_(e,o+2)||K(_(e,o+2))||se(_(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=q(e,o,"--recursive")&&at(e,o+11)||Sa(e,o,"recursive"),r||=q(e,o,"--force")&&at(e,o+7)||Sa(e,o,"force"),n&&r)return!0;o++}return!1}function Sa(e,t,n){if(!q(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=_(e,t+r+2);if(!o||K(o)||se(o))break;if(o!==n[r])return!1;r++}return r>0&&at(e,t+r+2)}function ZS(e,t){let n=t,r=!1,o=!1;while(n<te(e)){while(K(_(e,n)))n++;let i=n;while(n<te(e)&&!K(_(e,n)))n++;if(_(e,i)!=="-"||n-i===2&&q(e,i,"--"))return!1;let s=xu(e,i,"recursive"),a=xu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,_(e,i+1)==="-")continue;let l=JS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function xu(e,t,n){return q(e,t,`--${n}`)&&at(e,t+n.length+2)||Sa(e,t,n)}function XS(e,t){if(t>0&&Kt(_(e,t-1)))return-1;let n=t;if(_(e,n)==="\\")n++;if(_(e,n)!=="r")return-1;if(n++,_(e,n)==="\\")n++;if(_(e,n)!=="m"||!K(_(e,n+1)))return-1;return n+1}function JS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(_(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=_(e,c)??"",f=(d==="r"||d==="f")&&at(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&f,s||=d==="f"&&f,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&f,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Au(e,t,n){return Er(e,"reset",An,!0,(r)=>_(e,r)==="-"&&Pn(e,r,t,n)?!0:r)}function QS(e){return Er(e,"clean",An,!0,(t)=>{if(_(e,t)!=="-")return t;if(Pn(e,t,"--fo","rce"))return!0;let n=br(e,t,An);for(let r=t+1;r<n;r++)if(_(e,r)==="f")return!0;return n-1})}function zo(e,t,n){if(!st(e,t,"git"))return null;let r=t+3;if(!K(_(e,r)))return{commandEnd:-1,next:r};while(K(_(e,r)))r++;while(r<te(e)){if(se(_(e,r)))return{commandEnd:-1,next:r};let o=br(e,r,se);if(st(e,r,n))return{commandEnd:r+n.length,next:o};if(_(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&q(e,r,"--"),s=eb(e,r,o);r=o;while(K(_(e,r)))r++;if(i)return{commandEnd:st(e,r,n)?r+n.length:-1,next:br(e,r,se)};if(!s)continue;if(r>=te(e)||se(_(e,r)))return{commandEnd:-1,next:r};r=br(e,r,se);while(K(_(e,r)))r++}return{commandEnd:-1,next:r}}function eb(e,t,n){for(let r of Re)if(n-t===r.length&&q(e,t,r))return!0;return!1}function tb(e){return Pu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function nb(e){return Er(e,"push",An,!0,(t)=>{if(_(e,t)!=="-")return t;if(_(e,t+1)==="f"&&!Kt(_(e,t+2))&&!q(e,t+2,"-with-lease"))return!0;let n=Iu(e,t,"--fo","rce");if(n>=0&&!q(e,n,"-with-lease"))return!0;return t})}function rb(e){return Er(e,"push",se,!1,(t)=>{if(K(_(e,t))&&_(e,t+1)==="+"&&t+2<te(e)&&!se(_(e,t+2))&&!K(_(e,t+2)))return!0;if(_(e,t)===":"&&_(e,t+1)==="+")return!0;return t})}function ob(e){return Er(e,"push",se,!1,(t)=>{if(_(e,t)==="-"&&Pn(e,t,"--de","lete"))return!0;if(K(_(e,t))&&_(e,t+1)===":"&&t+2<te(e)&&!K(_(e,t+2))&&!se(_(e,t+2)))return!0;return t})}function ib(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);o++){if(o===te(e)||se(_(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=zo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||_(e,o)!=="-")continue;let i=br(e,o,se),s=sb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function sb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(_(e,i)!=="-")continue;if(Pn(e,i,"--de","lete"))r=!0;if(Pn(e,i,"--fo","rce"))o=!0;if(_(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&ab(_(e,s))){let d=_(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!at(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function ab(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function lb(e){return Pu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Pu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<te(e);r++){let o=_(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&_(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(K(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=zo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&K(_(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(Pn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(_(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&at(e,r+1))return!0;if(An(o))i.outerActive=!1}return!1}function Er(e,t,n,r,o){let i=!1;for(let s=0;s<te(e);s++){let a=_(e,s),l=n(a);if(!i&&!l){let c=zo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||K(_(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(_(e,d)))i=!1;s=c}if(l)i=!1}return!1}function cb(e){let t=!1;for(let n=0;n<te(e);n++){if(Ca(_(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=zo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&_(e,n)==="-"&&_(e,n+1)==="-"&&(q(e,n+2,"staged")||q(e,n+2,"help")))t=!1}return t}function Tu(e,t){let n=!1;for(let r=0;r<te(e);r++){let o=_(e,r),i=t?Ca(o):se(o);if(n&&K(o)&&_(e,r+1)==="-"&&st(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(st(e,r,"find"))n=!0,r+=3}return!1}function br(e,t,n){let r=t;while(r<te(e)&&!K(_(e,r))&&!n(_(e,r)))r++;return r}function Iu(e,t,n,r){if(!q(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&_(e,o)===r[i];i++)o++;return at(e,o)?o:-1}function Pn(e,t,n,r){return Iu(e,t,n,r)>=0}function De(e,t){Sr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&Fo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var db=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ou(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Sr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Du(t.nodes,r,i)}function Du(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Du(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return ub(r,t,n)})}function ub(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!db.test(o.text));return e.words.every((o,i)=>o===t||ku(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||ku(o.target.raw,n.anchored,!0)))}function ku(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var mb="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",fb="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",pb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",gb="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",hb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",yb=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Mu=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,Cb=new Set(["diskutil","wipefs","sgdisk","parted"]),Sb=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),bb=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,Eb=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),vb=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),_b=new Set(["i","b"]),Rb=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,wb=new Set([">",">|",">>","<>",">&"]),xb=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Nu(e){return e==="dd"||e==="shred"||Mu.test(e)||Cb.has(e)}function Ab(e,t){let n=t.some((r)=>r.startsWith("/dev/"));if(e==="diskutil"){let r=t.find((o)=>!o.startsWith("-"));return r!==void 0&&Sb.has(r.toLowerCase())}if(e==="wipefs")return n&&t.some((r)=>bb.test(r));if(e==="sgdisk")return n&&t.some((r)=>r.startsWith("-")&&!Pb(r));return e==="parted"&&n&&t.some((r)=>xb.has(r.toLowerCase()))}function Pb(e){if(Eb.has(e.split("=",1)[0]??e))return!0;if(e.startsWith("--"))return!1;let t=e.slice(1).split("");return _b.has(t[0]??"")||t.every((n)=>vb.has(n))}function Lu(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)&&!yb.has(r)))return v("dd.device-write",mb);if(Mu.test(e)&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",fb);if(Ab(e,n))return v("disk.erase",pb);if(e==="shred"&&n.length>0)return v("shred.target",hb);return null}function Wu(e){return e.some((t)=>wb.has(t.operator)&&t.target?.provenance==="literal"&&Rb.test(t.target.text))?v("redirect.block-device",gb):null}import{isAbsolute as Tb,resolve as Gu}from"node:path";function vr(e,t,n,r){let o=Tb(e)?Gu(e):t?Gu(t,e):void 0;if(!o)return;try{return W(o,n,r)}catch{return o}}function Fu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var Tn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",_r="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ea=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Ib=new Set(["-p","--print"]),kb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Ob=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Db=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Mb=new Map([["python",new Set(["m"])]]),Nb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Lb=new Set(["always","default","never"]),Wb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Gb=/\\\r?\n/g,Fb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function zu(e){return Bo(e).code}function $o(e){return Bo(e).sources}function $u(e){return Fb.get(_a(e))??[]}function Bo(e){let t=_a(e[0]??"");if(!Ea.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ue(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ue(t,n,r,o,i,s);if(t==="node"&&Ib.has(s)){let f=e[i+1];if(f===void 0)return Ue(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if($b(t,s)){let f=e[i+1];if(f===void 0)return Ue(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return Ue(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Bb(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=zb(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ue(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ue(t,n,r,o);if(Nb.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&Wb.has(s))||t==="python"&&!Lb.has(f))return Ue(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let u=s[f];if(u===void 0)break;if(Mb.get(t)?.has(u)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Ue(t,n,r,o)}if(kb.get(t)?.has(u)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(Ob.get(t)?.has(u)){if(f+1===s.length)i++;break}if(Db.get(t)?.has(u)&&f+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ue(t,n,r,o);if(c)i++}return Ue(t,n,r,o,void 0,void 0,!0)}function Ue(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function zb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function va(e,t){return _a(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function _a(e){let t=M(e).toLowerCase();return mo.test(t)?"python":t}function $b(e,t){return Ea.get(e)?.has(t)??!1}function Bb(e){return Ea.get(e)?.has("--eval")??!1}function Rr(e,t,n=!1){let r=jb(e,t);if(!ba(r,t))return!1;xe(t,r);let o=Hb(r);if(ba(o,t))return!0;if(xe(t,o),!Bu.test(o))return!1;return!n||Ub(r,t)}function Ub(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,f=l+d.length,u=f;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:f,text:e.slice(f,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Bu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Uo(i,c)}});if(s.some((l)=>Ra(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((f)=>l.start>=f.start&&l.start<f.end);return(c||d)&&ba(l.text,t)})}function Uo(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ra(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Bu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Hb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ba(e,t){if(Go(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(Go(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(Go(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>Fo(o,r))))}function jb(e,t){return xe(t,e),e.replace(Gb,"")}import{lstatSync as BE,readdirSync as UE}from"node:fs";import{basename as HE,isAbsolute as pm,join as jE,relative as gm}from"node:path";import{isAbsolute as Yu,parse as tE}from"node:path";import{dirname as Vb,isAbsolute as Kb,parse as qb,sep as Yb}from"node:path";function _t(e,t,n){if(rt(t))throw Error("Unsupported Windows namespace path");let r=Kb(t)?qb(t).root:"",o=r||e;for(let i of Xb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Vb(o);continue}let s=Zb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Zb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Yb}${t}`}function Xb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var wa=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Jb=new Set(wa),Qb=1024,Uu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Hu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),eE=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ho(e){return Jb.has(e)}function xa(e){return Ho(e)||Uu.has(e)||Hu.has(e)||sr(e)}function lt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function ju(e,t){let n=lt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Qb?{state:"valid",count:r}:{state:"invalid"}}function jo(e,t,n){let o=e.match(eE)?.[1];if(!o||!xa(o))return null;let i=e.indexOf("=");return{name:o,value:`${lt(o,t,n)??""}${e.slice(i+1)}`}}function Vu(e){return qu(e,Hu)}function Ku(e){return qu(e,Uu)}function qu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Xu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Me(e){if(!Xu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Vo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Me(R(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ju(e){let t=N(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function qt(e,t,n,r){if(!Ju(In(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let u=Zu(i),m=Vo(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&In(i).includes("=")&&!rE(i)){let g=oE(In(i),a,t.env)??jo(In(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=N(In(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=sE(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=cE(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=dE(i);if(p==="builtin")i=i.slice(He(i,1)==="--"?2:1);if(Zu(i)===u)break}let d=Vo(i);for(let[f,u]of d.envAssignments)s.set(f,u),a.set(f,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:nE(d.words,o)}}function nE(e,t){return e.some((n)=>!t.has(n))}function Zu(e){return e.map(R).join(" ")}function In(e){let t=e[0];return t?R(t):""}function He(e,t){let n=e[t];return n?R(n):void 0}function rE(e){return Xu.test(In(e))}function oE(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var iE=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function sE(e,t,n){let r=1,o=n;while(r<e.length){let i=He(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=He(e,r+1);o=s?wr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=wr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=wr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(iE.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var aE=new Set(["-i","-0","--null"]),lE=new Set(["-u","--unset","-C","--chdir","-P"]);function cE(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=He(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(aE.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=He(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:He(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(lE.has(c)){if(c==="-C"||c==="--chdir"){let f=He(e,a+1);s=f?wr(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=wr(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Me(c))break;while(a<e.length){let f=Me(He(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(He(e,a)==="--")a++;return l(a)}return l(a)}function wr(e,t,n){if(t==="")return null;if(!e&&!Yu(t))return null;let r=Yu(t)?tE(t).root:n.realpath(e??"/");if(r===null)return null;try{return _t(r,t,n)}catch{return null}}function dE(e){if(He(e,1)==="-v")return[...X(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=He(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var uE=/['"\\$`{}#]/;function Ko(e,t){if(e.some((r)=>uE.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Rt(e,t,n){return qo(e,t,n).tokens}function mE(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function wt(e,t,n,r=0){let o=qo(e,t,n),i=(o.envSplitValues??[]).flatMap(mE);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return wt(s,t,n,r+1)}function qo(e,t,n,r){if(!Ju(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=qt(X(e),t,n,r);return{tokens:o.words.map(R),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ta=Symbol("adopt-as-operand"),fE=new Set(["env","sudo","command","builtin"]),pE=new Set(["&&","||","|&","|","&",";"]),gE=new Set(["<<","<<<",">|"]),Qu=new Set(["|","|&"]),hE=/[*@#?$!_-]/,yE=/^\w+(?::\w+)*/,CE=Object.freeze([]),xr=Object.freeze({kind:"scope",edge:"enter"}),Ar=Object.freeze({kind:"scope",edge:"exit"}),SE=Object.freeze([]),bE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Pr=new Set(["bash","sh","zsh","dash","ksh"]),EE=256,om=new WeakMap;function im(e,t){let n=t.status==="complete"?new Set(Pa(t)):new Set,r=RE(e,n);if(po(r))return Yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Yt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Yo("structural-limit",r,t);if(o.invalid)return Yo("invalid",r,t);let s=Yo("complete",r,t,o.assignmentFallbacks);return om.set(s,Object.freeze(i)),s}function Jo(e,t,n,r,o){let i=o.word??((p)=>p),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[],f=sm(e),u=f.findLastIndex((p)=>p.kind==="operator"&&Qu.has(p.operator)),m=u!==-1&&f.some((p)=>p.kind==="redirection"&&p.operator==="<<"&&p.body===void 0);for(let[p,g]of f.entries()){let h=m||p<=u;if(g.kind==="scope"){if(g.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let y=o.segment(a,s,c,null,l,h);if(y)return y;let b=d.pop();if(b===void 0)throw Error("scope exit without a matching enter");s=b.state,a=b.segment,l=b.shellWords,c=b.pipeProducer;continue}if(g.kind==="operator"){if(!g.boundary)continue;let y=o.segment(a,s,c,g.operator,l,h);if(y)return y;s=vE(a,s,n,r),c=a.length>0&&Qu.has(g.operator)?a:null,a=[],l=new Set;continue}if(g.kind==="redirection"){if(g.fd!==void 0)l.add(a.length-1);if(g.target===void 0)continue;let y=o.redirection({operator:g.operator,role:g.role,targetOrder:g.targetOrder,target:g.target,...g.body===void 0?{}:{body:g.body,consumer:g.consumer}},s,h);if(y===Ta){l.add(a.length),a.push(i(g.target));continue}if(y)return y;continue}a.push(i(g.text))}return o.segment(a,s,c,null,l,m)}function Qo(e){return sm(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Ee(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Ee(i,t);return a?Ee(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function vE(e,t,n,r){let o=Tr(e)?new Map([...t.variables,..._E(e,t.variables)]):t.variables,i=Rt([...e],n),s=M(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ue(Ee(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function _E(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Ee(o,t)]]:[]})}function sm(e){return om.get(e)??CE}function RE(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Yo(e,t,n,r=SE){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Yt(e,t){return e.nodes.flatMap((n,r)=>wE(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function wE(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[je(IE(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[je(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Zo("{"),...Yt(e.body,a),...s?[Zo("}")]:[]]:[xr,je("("),...Yt(e.body,a),...s?[je(")")]:[],Ar]}]}let o=ME(e,r.functions);if(o){if(r.depth>=vt.maxDepth||++r.flags.expansions>EE)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...em(e,r),Zo(";"),...Yt(o,{...r,depth:r.depth+1}),Zo(";")]},...tm(e,t,n,r)]}return[{start:e.span.start,events:em(e,r)},...tm(e,t,n,r)]}function em(e,t){return[...e.words.map((n)=>({start:n.span.start,events:lm(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:xE(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function xE(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?lm(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:kE(r),targetOrder:gE.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:dm(t)}:{}}),...s===void 0?o:o.slice(1)]}function tm(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[je(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...am(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?AE(t,n,r):[]]}function AE(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:am(n.source.slice(r.span.end,e.span.end),n)}]}function am(e,t){if(t.depth>=vt.maxDepth)return t.flags.limited=!0,[];let n=Be(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Yt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function lm(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?je("glob"):s!==""||e.quoted&&o.length===0?Ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Aa(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(je(m));continue}s+=m.text,a||=m.glob}continue}let d=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Aa(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Yt(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(xr,...p,Ar);continue}let f=d?Yt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(xr,...f,Ar);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?je("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),xr,...f,...c.raw.endsWith(")")?[je(")")]:[],Ar);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>je("(")),...u===1?[xr]:[],...f,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>je(")")):[],...u===1?[Ar]:[])}return l(),o}function Aa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=nm(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=nm(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function nm(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=o?TE(e,t+2):Wo(e,t+2,e.length).close;if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return PE(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&hE.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?yE:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function PE(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Aa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function TE(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function IE(e){return/^[\r\n]+$/.test(e)?";":e}function je(e){return Object.freeze({kind:"operator",operator:e,boundary:pE.has(e)})}function Zo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Ia(e){return Object.freeze({kind:"word",text:e})}function kE(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function kn(e){return bE.has(e)||/^python\d/.test(e)}var OE=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function cm(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=OE.get(e)?.has(n)??!1;return cm(e,t.slice(r?2:1))}function Xo(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Xo(e.slice(1));if(t==="uv"&&e[1]==="run")return Xo(e.slice(2));if(!fE.has(t))return[...e];return Xo(cm(t,e.slice(1)))}function dm(e){let t=pr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Xo(n<0?[]:e.words.slice(n).map((r)=>r.text))}function DE(e){let t=dm(e)[0];if(t===void 0)return!1;let n=M(t).toLowerCase();return kn(n)&&!Pr.has(n)}function Pa(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Pa(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Pa(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(DE(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!LE(t))return r;return[...r,...o]})}function ME(e,t){let n=pr(e);return n===void 0?void 0:t.get(n)}function xt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function NE(e){if(xt(e.words[0],"git"))return xt(e.words[1],"commit");if(!xt(e.words[0],"gh")||!xt(e.words[2],"create"))return!1;return xt(e.words[1],"pr")||xt(e.words[1],"issue")}function LE(e){return(xt(e.words[0],"cat")||xt(e.words[0],"tee")||NE(e))&&!e.words.some(rm)&&!e.redirections.some((n)=>rm(n.target))}function rm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var et="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ei="Unsupported heredoc syntax",Ir="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function At(){return{id:"analysis.dynamic-shell-source",reason:Ir,intent:"stop_and_explain"}}var um="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var ka=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),WE=new Set([...ka,"dir_path","glob","glob_pattern","include_pattern"]),GE=new Set([...ka,"folder","glob","pattern","patterns"]);class Ve extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class Zt extends Error{name="UnparseableCommandError";constructor(){super(et)}}function mm(e){let t=FE(),n=rr(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:zE(e),store:t}}function On(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ct(e){return On(e,"declared-command")??On(e,"input-candidate")}function dt(e,t){if(!e.includes("$"))return e;return Qi(e,t)}function FE(){let e=new Map,t=new WeakMap,n=(o,i)=>{let s=`${i}\x00${o}`,a=e.get(s);if(a)return a;let l=Be(o,i);return e.set(s,l),l};return{getShellSyntax:(o,i)=>{if(i&&i.source!==o)throw TypeError("Shell syntax source does not match command program source.");let s=i??n(o,"posix"),a=t.get(s);if(a)return a;let l=s.status==="limited"?{status:"structural-limit",source:o,program:s,assignmentFallbacks:[]}:im(o,s);return t.set(s,l),l},getCommandProgram:n,readsAutoAsPowerShell:()=>[...e].some(([o,i])=>o.startsWith("auto\x00")&&i.dialect==="powershell")}}function zE(e){let t=e.route.kind==="grep"?WE:e.route.kind==="glob"?GE:ka;return[...fc(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?hc(e.input):[]]}var $E=new Set(["-S","--suffix"]);function Dn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ve;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Jo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Ee(i.target,s.variables),s)?i.target:null})}function ti(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&$E.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var pe="Git metadata and hooks are protected. Ask the user before modifying them.";function hm(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(eo(e.invocation.toolName))return null;let a=e.paths.find((l)=>fm(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ct(e);if(!i)return null;let s=Dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>XE(a,l,t,n,r),isRedirectionTarget:(a,l)=>fm(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Xt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=ri(ue(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Oa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(f)=>c?ni(f,l):VE(f,l);if(n.markerFiles.some(d))return!0;return r&&Da(n).some(d)}if(Oa(a,n))return!0;return r&&Da(n).some((c)=>ni(c,a))}function VE(e,t){let n=gm(t,e);if(n===""||n.startsWith("..")||pm(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function KE(e,t,n,r,o){return Xt(e,t,n,!0,r,o)}function qE(e,t,n,r,o){if(!n)return!1;return Oa(ri(ue(e,t,r,o)),n)}function fm(e,t,n,r,o,i){let s=ri(ue(e,t,r,o));return i.includes(s)||Cm(s,n)}function ym(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>ni(i,ri(ue(s,t,r,o)))))}function Oa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Cm(e,t)}function Cm(e,t){return t.hooksDirectories.some((n)=>ni(e,n))}var YE=50000;function Sm(e,t){let n=[...new Set(Da(e))];if(n.some((o)=>t(HE(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=ZE(o);if(!i)return!0;if(r+=i.length,r>YE)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>jE(o,s.name)))}return!1}function ZE(e){try{let t=BE(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return UE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Da(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function ni(e,t){let n=gm(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!pm(n)}function ri(e){return process.platform==="win32"?e.toLowerCase():e}function XE(e,t,n,r,o){if(Tr(e))return null;let i=wt([...e],r);if(M(i[0]??"").toLowerCase()!=="mv")return null;let s=ti(i.slice(1)),a=s.sources.find((l)=>KE(Ee(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&qE(Ee(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ai,normalize as iv,parse as sv,posix as Am,resolve as Qt,sep as Wa}from"node:path";import{isAbsolute as JE,join as bm,normalize as _m,parse as QE,sep as Em}from"node:path";var ev=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],tv=` 	
+`;function kr(e,t){if(Jt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Ma(e.get("TMPDIR")??"",t)}function Mn(e,t){if(e.has("TMPDIR"))return Ma(e.get("TMPDIR")??"",t);let n=Na(e,t);if(n===void 0)return!0;return Ma(n,t)}function Na(e,t){return wm(e,t,"TMPDIR")}function Ma(e,t){if(!e)return!1;if(rv(e))return!1;return Nn(e,t)}function Jt(e,t){let n=wm(e,t,"IFS");return n!==void 0&&n!==""&&n!==tv}function Nn(e,t){let n=oi(e,t.paths);if(n===null)return!1;return Rm(t).some((r)=>Pt(n,r))}function si(e,t){let n=oi(e,t.paths);if(n===null)return!1;return Rm(t).some((r)=>ii(r)===ii(n))}var vm=new WeakMap;function Rm(e){let t=vm.get(e);if(t)return t;let n=nv(e);return vm.set(e,n),n}function nv(e){let t=ev.map((r)=>oi(r,e.paths)??_m(r)),n=oi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&ov(n))return[...t,n];return t}function rv(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function wm(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function ov(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function oi(e,t){try{let n=_m(e);if(!JE(n))return n;let r=QE(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=bm(i,o[s]??"");if(t.entryKind(a)==="missing")return bm(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Pt(e,t){let n=ii(e),r=ii(t);if(n===r)return!0;let o=r.endsWith(Em)?r:`${r}${Em}`;return n.startsWith(o)}function ii(e){return process.platform==="win32"?e.toLowerCase():e}var av=process.platform==="win32",xm=64,lv=16384;function en(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!ie(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!ie(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function tn(e){let t=uu(e,xm,xm,lv);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:cv(e)}}function cv(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>dv(e.raw,n.span.start-e.span.start))}function dv(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Ne(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Te();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:yv(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Sv(e))return{kind:"outside_anchored_cwd"};let o=!r&&Pm(e,t.posixShell);if(rt(e))return{kind:"outside_anchored_cwd"};if(Ga(e,r))return{kind:"root_or_home_target"};if(fv(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Xt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(pv(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Cv(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&_v(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>Rv(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(wv(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(uv(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function uv(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ai(r)||r.startsWith("~"))return!1;if(Fa(r))return!1;if(Tm(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Nn(Qt(t.resolvedCwd,r),t.environment)}function mv(e,t,n={}){let{containmentTarget:r,...o}=n;if(ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(hv(i))return!1;if(si(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Tm(r??i,s,t.environment.paths,t.budget))}function Ga(e,t=!1){let n=e.trim(),r=Am.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function fv(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ai(o)?o:t.resolvedCwd?Qt(t.resolvedCwd,o):null;if(!i)return!1;let s=ve(W(i,t.environment.paths,t.budget));if(s===sv(s).root)return!0;return s===ve(W(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ve(e){let t=iv(e);if(av){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function pv(e,t,n,r,o,i,s,a){let l=e.trim();if(Fa(l))return!1;if(!r&&Nn(l,a))return!0;return(t||i&&s)&&n&&!o&&gv(l,n)}function gv(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Pm(e.slice(n.length+1),t)})}function hv(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Am.normalize(`/${t[1]??""}`)==="/"}function Fa(e){return e.split(/[\\/]+/).includes("..")}function yv(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=dr(o.trim(),t);if(!ai(i))return[];try{let s=W(i,n,r);if(ur(s,W(t,n,r)))return[];return[ve(s)]}catch{return[]}})}function Cv(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Fa(r))return!1;let o=n?r:dr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ai(o)?o:i?Qt(i,o):null;if(!s)return!1;try{let a=ve(W(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Wa)?l:`${l}${Wa}`))}catch{return!1}}function Sv(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Pm(e,t=!1){return e.includes("$")||e.includes("`")||bv(e)||t&&Ev(e)}function bv(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function Ev(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&vv(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function vv(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function _v(e,t,n,r){try{return ve(W(e,n,r))===ve(W(t,n,r))}catch{try{return ve(e)===ve(t)}catch{return!1}}}function Rv(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ve(W(Qt(t,e),n,r))===ve(W(o,n,r))}catch{try{return ve(Qt(t,e))===ve(o)}catch{return!1}}}function wv(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return La(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return La(Qt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return La(Qt(a,e),t,i,s)}catch{return!1}}function La(e,t,n,r){try{return Im(W(e,n,r),W(t,n,r))}catch{return!1}}function Tm(e,t,n,r){if(!t)return!1;try{return Im(W(t,n,r),W(e,n,r))}catch{return!0}}function Im(e,t){let n=ve(e),r=ve(t);return n.startsWith(`${r}${Wa}`)||n===r}function li(e,t){let n=t.envAssignments??new Map,r=Na(n,t.environment),o=t.trustedTmpdirValue??Mn(n,t.environment),i=t.allowTmpdirVar??!kr(n,t.environment),s={environment:t.environment,protectedGitMetadata:t.protectedGitMetadata,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,allowTmpdirVar:i&&o&&Boolean(r),allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:t.tmpdirWordSplittingUnsafe??Jt(n,t.environment),trustedTmpdirValue:o,budget:t.budget},a=Ne(s),l=Ne({...s,cwd:t.originalCwd??t.cwd}),c=t.originalCwd&&t.environment.paths.realpath(t.originalCwd),d=t.cwd&&t.environment.paths.realpath(t.cwd),f=c&&d&&!Pt(d,c)?t.cwd:void 0;return e.every((u)=>{let m=tn(u);if(m.unsafeBraceExpansion||m.expandedTargets?.length===0)return!1;return(m.expandedTargets??[R(u)]).every((p)=>{let g=/^\.\/*$/.test(p)?f:void 0,h=g??p,y={targetIsLiteral:m.expandedTargets!==void 0||m.targetIsLiteral,tmpdirWordSplittingProtected:m.tmpdirWordSplittingProtected};if(!ie(t.policy,"rm.recursive-force-paranoid",t.paranoid??!1)&&!g&&ge(h,a,y).kind==="within_anchored_cwd")return!0;return mv(h,g?l:a,{...y,containmentTarget:xv(h,r)})})})}function xv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}var Av=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),km="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Pv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Om="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Dm="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Tv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Iv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",kv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Dm},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Om},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Tv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:km},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:Pv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:km}};function Mm(e,t,n){return Ov(e.words.map((r)=>({kind:"word",text:r.text,dynamic:r.provenance!=="literal"})),t,Ne({...n,allowPaths:n.policy?.destructiveCommandAllowPaths}),n.policy)}function Ov(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=Mv(o),s=o[i];if(!s||!Av.has(Uv(s.text)))return null;let a=Dv(o.slice(i+1));if(a.whatIfProtected)return null;if(ie(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",Iv);for(let l of a.targets)if(!rt(l.text)&&Ga(Or(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Dm);for(let l of a.targets)if(n.resolvedCwd&&Xt(Or(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",pe);if(!a.recursive||!a.force)return null;if(ie(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Om);for(let l of a.targets){let c=en(ge(Or(l.text),n),n,r,kv);if(c)return c}return null}function Dv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Nv(l))continue;if(s){t.push(za(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Wv(l.text);if(!c){t.push(za(l)),i=i||l.dynamic;continue}if(Gv(c.name)){let d=c.value?Lv(c.value,l):e[++a];if(d?.kind==="word"){t.push(za(d)),i=i||d.dynamic;continue}i=!0;continue}if(Fv(c.name)){n=!0;continue}if(zv(c.name)){r=!0;continue}if($v(c.name))o=Bv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function Mv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function za(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Nv(e){return e.kind==="word"&&e.text===","}function Or(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function Lv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Wv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Gv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function Fv(e){return"recurse".startsWith(e)}function zv(e){return e.length>=2&&"force".startsWith(e)}function $v(e){return e==="wi"||"whatif".startsWith(e)}function Bv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Uv(e){return e.toLowerCase()}var Hv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),jv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Vv=new Set(["-o","--output","--query","--subscription"]),Kv=new Set;function Nm(e){if(e==="aws")return Hv;if(e==="gcloud")return jv;if(e==="az")return Vv;return Kv}var qv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Yv=new Set;function Lm(e){if(e==="git")return Re;if(e==="docker")return qv;return Yv}function ut(e,t){if(e.length===0||t.length===0)return null;let n=N(e[0]??""),r=be(e);for(let o of t){if(!Jv(n,o.command))continue;if(o.match){if(Zv(n,e,o.match))return Wm(o);continue}if(!Qv(n,e,o.subcommand))continue;if(t_(e,new Set(o.block_args),r))return Wm(o)}return null}function Wm(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function Zv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Xv(r,n.command_path,Nm(e))}function Xv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Jv(e,t){return e===N(t)}function Qv(e,t,n){if(!n)return!0;return Gm(t,1,n,Lm(e))}function Gm(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&e_(e,i,n,r))return!0;continue}return s===n}return!1}function e_(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Gm(e,t+2,n,r)}function t_(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var n_=new Set(["-e","--source"]),r_=new Set(["-F","-v","--assign","--field-separator"]),Fm=new Set(["-f","--file"]),o_=new Set(["print","printf","return"]),zm=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],i_="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function $m(e,t,n){let r=!1;for(let o of s_(e)){let i=a_(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",i_):null}function Ba(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&n_.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(r_.has(a)||Fm.has(a))){let l=e[s+1];if(i&&=l!==void 0,Fm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Mr(e){return Ba(e).sources}function s_(e){return Mr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function a_(e,t){xe(t,e);let n=e.includes("system")?Ua(e,t):null,r=l_(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ua(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=di(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Bm(e,i+1);continue}if(s==="/"&&Um(e,i)){i=Hm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Dr(e[a-1])||Dr(e[i]))continue;let l=ci(e,i);if(e[l]!=="(")continue;l=ci(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=di(e,l,c);if(!d){r=!0,o=!0;continue}if(l=ci(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function l_(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let m=di(e,i,d);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(d==="#"){i=Bm(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Um(e,i)){let m=Hm(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&($a(e,i,"print")||$a(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,u=ci(e,f);if($a(e,u,"getline")){o=!0;let m=u_(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(f_(s,a)){o=!0;let m=d_(e,u);if(!m){r=!0,c=f,i=f;continue}if(!c_(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function Dr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function ci(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function c_(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function di(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=m_(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function d_(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return di(e,t,n)}function u_(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function m_(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function $a(e,t,n){return e.startsWith(n,t)&&!Dr(e[t-1])&&!Dr(e[t+n.length])}function f_(e,t){return t!==null&&t>=e}function Bm(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Um(e,t){let n=p_(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Dr(e[r-1]))r--;return o_.has(e.slice(r,n+1))}function p_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Hm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var g_=new Set(["sudo","env","command","builtin"]),h_=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function ui(e,t){let n=e[0];if(!n||!jm(M(n),t))return null;let r=M(n),o=e[1]==="--"?2:1,i=y_(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function y_(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=M(a)!==n&&C_(a,r);if(l)i.push(s);if(!l&&fo.has(N(a)))break;if(o)break}return i}function C_(e,t){let n=M(e),r=N(e);return r==="git"||n==="busybox"||nn(e)||Ts.has(n)||Nu(r)||jm(n,t)||Q.has(r)||e==="$SHELL"||$e(r)||ke.has(r)||t.rules.some((o)=>o.command===n)}function jm(e,t){return h_.has(e)||t.transparentWrappers.includes(e)}function nn(e){return g_.has(e.toLowerCase())}function rn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Ke(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return mi([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*mi(e,t,n,r,o,i,s,a,l){let c=qo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:d,cwd:f}=c;if(c.envSplitValues){let m=Ko(c.envSplitValues,d);if(!m)throw new G("derivedCommandShape");Ha(a),yield*mi(m,t,f,r,o,i,s,a,l);return}if(nn(d[0]??""))throw new G("wrapperPeelIterations");let u=ui(d,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])Ha(a),yield*mi(m===u.childIndex?u.tokens:d.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(b_(d)){Ha(a),yield*mi(d.slice(1),t,f,r,o,i,s,a,l);return}yield S_(d,f,r,o,i,l)}function S_(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:M(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ha(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new G("wrapperPeelIterations");e.iterations++}function b_(e){return M(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ja(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function mt(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Va(r,"recursive")){t=!0;continue}if(r==="-f"||Va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function fi(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var E_=["--init-file","--rcfile"],v_=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Le(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Km(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Km(e,t,!1);if(r!==null)return r}}return null}var Vm=/^-[cn]+$/;function qe(e){let t=e.slice(1);if(t.some((r)=>/^[-+]./.test(r)&&r!=="--"&&!Vm.test(r)))return!1;let n=t.findIndex((r)=>!Vm.test(r));return t.slice(0,n===-1?void 0:n).some((r)=>r.includes("n"))}var __=/^-[abcefhiklmnprstuvx]+$/;function pi(e){let t=e.findIndex((i,s)=>s>0&&!__.test(i)),n=t===-1||/^[-+]/.test(e[t]??"")?e.slice(1):e.slice(1,t+1);if(n.some((i)=>i.startsWith("+")))return!0;let r=n.filter((i)=>i.startsWith("-")&&!i.startsWith("--")&&i.includes("c"));if(r.length===0)return!1;let o=Le(e);if(o===null)return n.some((i)=>i.startsWith("-")&&!r.includes(i));return/^[-+]/.test(o)||r.some((i)=>/[oO]/.test(i))}function Km(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function qm(e){let t=M(e[0]??"").toLowerCase(),n=R_(e,t),r=v_.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function R_(e,t){let n=Oe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?E_.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&As.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Ps(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var w_="find -delete permanently removes files. Use -print first to preview.",x_="find -exec rm -rf is dangerous. Use explicit file list instead.",A_=new Set(["-exec","-execdir","-ok","-okdir"]),P_=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Ym(e,t){let n=e.map(R),r=T_(e,n,t);if(r)return r;if(gi(n,1)&&!N_(e,n,t)){let s=T(v("find.delete",w_),t.policy);if(s)return s}let o=t.budget??Te(),i=0;while(i<n.length){let s=n[i],a=ft(s??"");if(a>0){i+=a+1;continue}if(!tt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Ln(n,i);i=l.nextIndex;let c=L_(l.tokens,t.environment);if(c){let m=T(c,t.policy);if(m)return m}let d=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?.(l.tokens,d?null:t.cwd)??null,u=f?.id.startsWith("custom.")?f:T(f,t.policy);if(u)return u}return null}function T_(e,t,n){if(!gi(t,1)&&!Ka(t,n.environment))return null;let o=Nr(e)??X(["."]),i=Ne({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=tn(s);for(let l of a.expandedTargets??[R(s)]){let c=ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!I_(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",pe)}}if(M_(t)&&i.resolvedCwd&&ym(o.map(R),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",pe);return null}function I_(e,t,n){if(!t)return!1;let r=e.map(R),o=[],i=!1,s=Nr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(tt(l)){let c=Ln(r,a),d=wt([...c.tokens],n),f=fi(d),u=Q.has(M(d[0]??"").toLowerCase()),m=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(f||u||m||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(O_(c.text,l==="-iname"));a+=2;continue}if(!k_.has(l))return!1;a+=1+ft(l)}return o.length>0&&!Sm(t,(l)=>o.every((c)=>c.test(l)))}var k_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function O_(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var D_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ka(e,t){let n=0;while(n<e.length){if(!tt(e[n])){n++;continue}let r=Ln(e,n),o=wt([...r.tokens],t),i=M(o[0]??"").toLowerCase(),s=Q.has(i)&&D_.test((Le(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function M_(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function N_(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Nr(e);return r!==null&&li(r,n)}function Nr(e){let t=(o)=>{let i=e[o];return i?R(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function L_(e,t){let n=Rt([...e],t);if(n.length===0)return null;let r=M(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=M(n[0]??"");if(r==="rm"&&mt(n))return v("find.exec-rm-recursive-force",x_);return null}function Ln(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function gi(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(tt(r)){n=Ln(e,n).nextIndex;continue}let o=ft(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ft(e){return P_.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function tt(e){return e!==void 0&&A_.has(e)}import{resolve as mw}from"node:path";function Lr(e){let t=Be(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var W_=5,qa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ae(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Xm(e,t,n){let r=Wn(e,t,n),o=G_(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<W_;a++){let{subcommand:l,rest:c}=Ae(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(d),u=U_(f);if(u===null||u.length===0)return{blockedReason:qa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:qa,expanded:!0,tokens:i}}function Jm(e,t,n){return Wn(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ae(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?M(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Re.has(o)?2:1}return{subcommand:null,rest:[]}}function G_(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Wn(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?M(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=z_(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...F_(e,t,n)]}}function F_(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ya(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ya(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Zm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Zm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Re.has(i)){o+=2;continue}o++}return r}function z_(e,t){let n=$_(e,t),r=B_(e,t);return{blockedReason:n===null||r===null?qa:null,entries:[...n??[],...r??[]]}}function $_(e,t){let n=lt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Lr(n);if(!o)return null;for(let i of o){let s=Ya(i);if(!s)return null;r.push(s)}return r}function B_(e,t){let n=ju(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=lt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=lt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ya(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Zm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:lt(e.slice(r+1),t,n)}}function U_(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Lr(t)}var H_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",j_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",V_="git checkout --force discards uncommitted changes. Use 'git stash' first.",K_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",q_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Y_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Z_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",X_="git switch --force discards uncommitted changes. Use 'git stash' first.",J_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Q_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",eR="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",tR="git reset --merge can lose uncommitted changes. Use 'git stash' first.",nR="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",rR="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",oR="git push --force destroys remote history. Use --force-with-lease for safer force push.",iR="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",sR="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",aR="git branch -D force-deletes without merge check. Use -d for safe delete.",lR="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",cR="git merge --abort discards merge conflict resolutions. Use 'git status' first.",dR="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",uR="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",mR="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",fR="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",pR="git worktree remove --force can delete uncommitted changes. Remove --force flag.",gR=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),hR=new Set(["--recurse-submodules","--track","-t"]),Za=new Set(["-b","-B","-U"]),Xa=new Set(["-c","-C"]),yR=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function L(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function ef(e,t){let{subcommand:n,rest:r}=Ae(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Tt(CR(r,t));case"switch":return Tt(bR(r));case"restore":return Tt(vR(r));case"reset":return RR(r);case"clean":return Tt(xR(r));case"rm":return Tt(AR(r));case"push":return on(PR(r));case"branch":return on(kR(r));case"stash":return on(LR(r));case"worktree":return on(WR(r));case"rebase":return Tt(OR(r));case"merge":return Tt(DR(r));case"tag":return on(MR(r));case"reflog":return on(NR(r));default:return null}}function Tt(e){return e?{...e,localDiscard:!0}:null}function on(e){return e?{...e,localDiscard:!1}:null}function CR(e,t){let{index:n,before:r}=ae(e),o=be(r,{shortOptsWithValue:Za});if(r.some((a)=>L(a,"--force"))||o.has("-f"))return v("git.checkout-force",V_);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(L(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",q_)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",K_);return v("git.checkout-double-dash",H_)}let i=ER(e);if(i.length>=2)return v("git.checkout-ambiguous",Y_);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>L(a,"--detach")||L(a,"--track")))return null;if(SR(s)||t(s))return v("git.checkout-double-dash",j_);return null}function SR(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function bR(e){let{before:t}=ae(e);if(t.some((r)=>L(r,"--discard-changes")))return v("git.switch-discard-changes",Z_);let n=be(t,{shortOptsWithValue:Xa});if(t.some((r)=>L(r,"--force"))||n.has("-f"))return v("git.switch-force",X_);return null}function ER(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(gR.has(r)){n+=2;continue}if(hR.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function vR(e){let t=_R(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",Q_):v("git.restore-unstaged",J_)}function _R(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(yR.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function RR(e){let t=null;for(let n of e){if(L(n,"--hard")){t=v("git.reset-hard",eR);break}if(L(n,"--merge")){t=v("git.reset-merge",tR);break}}if(!t)return null;return wR(e)?on(t):Tt(t)}function wR(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function xR(e){for(let n of e)if(n==="-n"||L(n,"--dry-run"))return null;let t=be(e.filter((n)=>n!=="--"));if(e.some((n)=>L(n,"--force"))||t.has("-f"))return v("git.clean-force",nR);return null}function AR(e){let t=!1,n=!1,r=!1;for(let o of ae(e).before){if(L(o,"--no-force")){t=!1;continue}if(L(o,"--force")){t=!0;continue}if(L(o,"--no-cached")){n=!1;continue}if(L(o,"--cached")){n=!0;continue}if(L(o,"--no-dry-run")){r=!1;continue}if(L(o,"--dry-run")){r=!0;continue}let i=be([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",rR):null}function PR(e){let{before:t,after:n}=ae(e),r=be(t);if(t.some((s)=>L(s,"--mirror")))return v("git.push-mirror",sR);if(t.some((s)=>L(s,"--force"))||r.has("-f")||Qm(t,n).some(TR))return v("git.push-force",oR);if(t.some((s)=>L(s,"--delete"))||r.has("-d")||Qm(t,n).some(IR))return v("git.push-delete",iR);return null}function Qm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function TR(e){return e.startsWith("+")||e.includes(":+")}function IR(e){return e.length>1&&e.startsWith(":")}function kR(e){let{before:t}=ae(e),n=be(t),r=n.has("-D")||n.has("-d")||t.some((i)=>L(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>L(i,"--force"));if(r&&o)return v("git.branch-force-delete",aR);return null}function OR(e){let{before:t}=ae(e);return t.some((n)=>L(n,"--abort"))?v("git.rebase-abort",lR):null}function DR(e){let{before:t}=ae(e);return t.some((n)=>L(n,"--abort"))?v("git.merge-abort",cR):null}function MR(e){let{before:t}=ae(e);return be(t).has("-d")||t.some((r)=>L(r,"--delete"))?v("git.tag-delete",dR):null}function NR(e){return e[0]==="delete"?v("git.reflog-delete",uR):null}function LR(e){for(let t of e){if(t==="drop")return v("git.stash-drop",mR);if(t==="clear")return v("git.stash-clear",fR)}return null}function WR(e){let{before:t}=ae(e);if(!t.includes("remove"))return null;let r=be(t);if(t.some((o)=>L(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",pR);return null}import{isAbsolute as aw,join as lw,resolve as cw}from"node:path";var Qa="TMPDIR",el="IFS",nf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rf=/^[A-Za-z_][A-Za-z0-9_]*$/,of=new Set(["export","typeset","declare","readonly"]),GR=new Set(["builtin","command","time"]),FR=new Set(["do","then","else"]),zR=new Set(["do","then","case"]),tf=new Set(["done","fi","esac"]),$R=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,BR=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Fn(e,t){return new Map([["HOME",t.home],...typeof t.cwd==="string"?[["PWD",t.cwd]]:[],...e])}function zn(e,t){return e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.raw.startsWith("~/")?`${t}${e.raw.slice(1)}`:null}function sf(e,t,n){let r=Fn(t.shellAssignments,n);return e.map((o)=>{if(!ff(o.text))return R(o);if(o.provenance==="variable")return af(o.text,r);if(o.provenance==="command-substitution")return HR(o,n.darwinUserTempDir)??R(o);return o.provenance==="literal"&&$R.test(o.raw)?o.text.replace("=~",`=${r.get("HOME")}`):R(o)})}function af(e,t){return e.replace(BR,(n,r,o)=>t.get(r??o??"")??n)}var UR=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function HR(e,t){if(e.provenance!=="command-substitution")return null;let n=e.parts.map((o)=>{if(o.provenance==="command-substitution")return UR.has(o.raw)?t():null;return o.provenance==="literal"&&!/[$`\\']/.test(o.raw)?o.raw.replaceAll('"',""):null});if(!n.every((o)=>o!==null))return null;let r=n.join("");return/[\s$`*?[]/.test(r)?null:r}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=af(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function lf(e,t){return{env:e,effectiveEnvAssignments:qR(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function cf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function tl(e,t){let n=uf(e,t),r=e[0]??"";if(zR.has(r))t.bodyDepth+=1;if(r==="elif"||tf.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(tf.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);nl(t,a)});let o=n.commandIndex;if(o!==-1&&of.has(e[o]??""))e.filter((a)=>rf.test(a)&&Ja(a)).forEach((a)=>{YR(t,a)});let i=o===-1?-1:mf(e,o);if(i===-1||e[i]!=="unset")return;let s=XR(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}ZR(t,a)})}function df(e,t){let n=uf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function uf(e,t){let n=FR.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!ff(a)),o=r!==-1&&of.has(e[mf(e,r)]??""),i=KR(t);return{assignments:e.flatMap((a,l)=>{let c=jR(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Ho(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function mf(e,t){let n=t;while(GR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function ff(e){return Me(e)!==null||nf.test(e)}function jR(e,t,n){return Me(e)??VR(e,t,n)}function VR(e,t,n){let r=jo(e,n,t);if(r)return r;let o=e.match(nf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ja(e){return e===Qa||e===el||xa(e)}function KR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function qR(e,t){let n=[Qa,el].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function nl(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function YR(e,t){nl(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function ZR(e,t){if(!Ja(t)&&!rf.test(t))return;if(e.shellAssignments.set(t,""),Ho(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ja(t)||t===Qa||t===el||sr(t)){nl(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function XR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{dirname as gf,join as hi,resolve as JR}from"node:path";function yi(e,t){return wa.some((n)=>t?.has(n)||e.has(n))}function $n(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(JR(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=pf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=pf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Re.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function pf(e,t,n){try{let r=_t(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Wr(e,t){if(t.entryKind(hi(e,".git"))!=="missing")return e;let n=gf(e);return n===e?null:Wr(n,t)}function Ci(e,t,n,r,o){let i=r.paths,s=hi(n,".git"),a=i.isDirectory(s),l=a&&!r.isGitDirectory(s),c=hf(t).filter((d)=>l||d!==n&&Pt(d,n));return Wn(e,r.env,o).entries.some((d)=>d.key.toLowerCase()==="core.worktree")||c.some((d)=>i.entryKind(hi(d,"HEAD"))!=="missing"||d!==n&&i.entryKind(hi(d,".git"))!=="missing")||a&&r.gitDirectoryRedirects(s)}function hf(e){let t=gf(e);return t===e?[e]:[e,...hf(t)]}function yf(e,t,n){if(!t.localDiscard||!n.worktreeMode||yi(n.environment.env,n.envAssignments))return null;let r=$n(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd),i=Wr(r.gitCwd,n.environment.paths);if(!o||i===null||Ci(e,r.gitCwd,i,n.environment,n.envAssignments))return null;if(rl(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function rl(e,t,n){let{subcommand:r,rest:o}=Ae(e),i=r?.toLowerCase();if(t.dynamicArguments||QR(o)||ow(e,t.environment.env,t.envAssignments,n)||nw(o)||ew(i,o))return!0;return i==="clean"&&rw(o)>1}function QR(e){return e.some((t)=>/[$*?[]/.test(t))}function ew(e,t){if(e==="checkout"){let{before:n}=ae(t),r=be(n,{shortOptsWithValue:Za}),o=n.some((s)=>L(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ae(t),r=be(n,{shortOptsWithValue:Xa}),o=n.some((s)=>L(s,"--force"))||n.some((s)=>L(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||tw(s))||r.has("-C");return o&&i}return!1}function tw(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function nw(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function rw(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ow(e,t,n,r){if(lt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Wn(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>sw(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||iw(s.value);if(Ku(n))return!0;return r.recursiveSubmodules}function iw(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function sw(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Cf(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??R(l)),o=n.environment.paths,i=$n(r,n.cwd,o),s=n.originalCwd?o.realpath(cw(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||yi(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?uw(e,n.shellAssignments,o):Wr(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!dw(a,i.gitCwd,r,t,n)||!Nn(a,n.environment)||si(a,n.environment)||Pt(s,a)||Pt(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function dw(e,t,n,r,o){let i=o.environment.paths,s=lw(e,".git");if(i.entryKind(s)!=="present"||Ci(n,t,e,o.environment,o.envAssignments))return!1;if(i.isDirectory(s))return!0;if(!r.localDiscard)return!1;let l=o.environment.worktreeFacts(e);return l!==null&&!rl(n,o,l)}function uw(e,t,n){let r=Ae(e.map(R)).rest,{before:o,after:i}=ae(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!aw(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}var fw="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",pw=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Si(e,t){return Sf(e,t)}function Sf(e,t,n){let r=e.map(R),o=Xm(r,t.environment.env,t.envAssignments),i=o.blockedReason?T(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Vu(t.envAssignments)||Jm(r,t.environment.env,t.envAssignments))&&gw(s))return v("git.ssh-env",fw);let a=ef(s,(c)=>{let d=$n(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(mw(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=yf(r,a,t)??Cf(e,a,t);if(!l)return a;return n?.(l),null}function bf(e,t){let n=null;return{match:Sf(e,t,(o)=>{n=o}),relaxation:n}}function gw(e){let{subcommand:t,rest:n}=Ae(e),r=t?.toLowerCase();if(!r)return!1;if(pw.has(r))return!0;if(r==="archive")return ae(n).before.some((o)=>L(o,"--remote"));return r==="remote"&&hw(n)}function hw(e){return e.find((t)=>!yw(t))?.toLowerCase()==="update"}function yw(e){return e==="-v"||L(e,"--verbose")||L(e,"--no-verbose")}import{isAbsolute as Kw}from"node:path";function Ef(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function bi(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var vf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Sw="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",bw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Ew="rm -rf in home directory is dangerous. Change to a project directory first.",_f={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:bw},git_metadata_target:{id:"rm.git-metadata",reason:pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Sw},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Ew},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:vf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Cw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:vf}};function Ei(e,t){let n=Ne({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(R),o=fi(r),i=_w(e);for(let s of i){let a=tn(s.word);if(o&&a.unsafeBraceExpansion){let l=T(en({kind:"outside_anchored_cwd"},n,t.policy,_f),t.policy);if(l)return l;continue}for(let l of a.expandedTargets??[s.text]){let c=de(l),d={targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected};if(!o&&n.resolvedCwd&&Xt(c,n.resolvedCwd,n.protectedGitMetadata,o,n.environment,n.budget))return v("rm.git-metadata",pe);if(!o)continue;for(let f of vw(c,n,d)){let u=en(f,n,t.policy,_f),m=T(u,t.policy);if(m)return m}}}return null}function vw(e,t,n){let r=ge(e,t,n);if(r.kind==="cwd_self_target")return[r,ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function _w(e){let t=[],n=!1;for(let r of e.slice(1)){let o=R(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var It={kind:"none"},sn={kind:"dynamic"},Rw=new Set(["<","<<","<<-","<<<","<&","<>"]),wf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,ww=/^(?:[0-9]+|[@*])$/,xw=vt.maxWords,xf=vt.maxInputLength;function Af(e){if(!e||M(N(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function hi(e){let t=Gn(e[1])==="--"?2:1;if(e.length<=t)return Pt;let n=e.slice(t);if(!n.every(Wr))return on;return{kind:"literal",source:n.map(x).join(" ")}}function _f(e){let t=Gn(e[1])==="--"?2:1,n=e[t],r=Gn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Pt;if(!Wr(n))return on;return{kind:"literal",source:r}}function yi(e,t){let n=Af(e);if(n===-1)return Pt;let r=hw(t);if(!r)return Pt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Cw(s,e,n,r.ifs);if(!a)return on;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>pw||i>vf)return on;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Ci)].filter((s)=>s!==null).join(" ")}}function wf(e,t){let n=Af(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Wr)||o)return t;let i=r.map(Gn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let f=d[1]??d[2],u=f==="@"||f==="*"?i.slice(1):[i[Number(f)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(f==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?Ci(g):"").join(" ")).join(" "),s.length>vf)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function xf(e,t,n,r){if(!Oe(e.map(x)).readsStdinAsCommands)return Pt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&mw.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Pt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return on;return{kind:"literal",source:o.target.text}}if(!n)return Pt;return r===void 0?on:{kind:"literal",source:r}}function ft(e,t=new Map){let n=Oe(e.map(x)).scriptIndex;if(n===null)return Pt;let r=e[n],o=Gn(r);if(_n(r,o))return{kind:"literal",source:o};let i=r?Qe(r,t):null;return i===null?on:{kind:"literal",source:i}}var gw=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function tl(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Me(s)!==null)return!1;let a=M(N(s));return!gw.has(a)&&!J.has(a)&&!tn(a)}function Af(e){return Oe(e.map(x)).commandIndex??-1}function hw(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(yw);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function yw(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Cw(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ja(o):Sw(o,r);if(e.parameter==="*"){let a=Ja(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Qa(l,r)}let i=t[n+1+e.parameter];if(i&&!Wr(i))return;let s=Gn(i);return e.quoted?[s]:Qa(s,r)}function Ja(e){return e.every(Wr)?e.map(x):void 0}function Sw(e,t){let n=Ja(e);if(!n)return;let r=n.map((o)=>Qa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Qa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function vi(e){let t=Bn(e[1])==="--"?2:1;if(e.length<=t)return It;let n=e.slice(t);if(!n.every(Fr))return sn;return{kind:"literal",source:n.map(R).join(" ")}}function Pf(e){let t=Bn(e[1])==="--"?2:1,n=e[t],r=Bn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return It;if(!Fr(n))return sn;return{kind:"literal",source:r}}function _i(e,t){let n=kf(e);if(n===-1)return It;let r=Pw(t);if(!r)return It;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Iw(s,e,n,r.ifs);if(!a)return sn;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>xw||i>xf)return sn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Ri)].filter((s)=>s!==null).join(" ")}}function Tf(e,t){let n=kf(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(Fr)||o)return t;let i=r.map(Bn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let f=d[1]??d[2],u=f==="@"||f==="*"?i.slice(1):[i[Number(f)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(f==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?Ri(g):"").join(" ")).join(" "),s.length>xf)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function If(e,t,n,r){if(!Oe(e.map(R)).readsStdinAsCommands)return It;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Rw.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return It;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return sn;return{kind:"literal",source:o.target.text}}if(!n)return It;return r===void 0?sn:{kind:"literal",source:r}}function pt(e,t,n=new Map){let r=Oe(e.map(R)).scriptIndex;if(r===null)return It;let o=e[r],i=o&&t!==void 0?zn(o,t):null;if(i!==null)return{kind:"literal",source:i};let s=Bn(o);if(xn(o,s))return{kind:"literal",source:s};let a=o?Ye(o,n):null;return a===null?sn:{kind:"literal",source:a}}var Aw=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function al(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Me(s)!==null)return!1;let a=M(N(s));return!Aw.has(a)&&!Q.has(a)&&!nn(a)}function kf(e){return Oe(e.map(R)).commandIndex??-1}function Pw(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Tw);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function Tw(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Iw(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ol(o):kw(o,r);if(e.parameter==="*"){let a=ol(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:il(l,r)}let i=t[n+1+e.parameter];if(i&&!Fr(i))return;let s=Bn(i);return e.quoted?[s]:il(s,r)}function ol(e){return e.every(Fr)?e.map(R):void 0}function kw(e,t){let n=ol(e);if(!n)return;let r=n.map((o)=>il(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function il(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Wr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(x(e)):e.provenance==="literal"}function Gn(e){return e?x(e):""}function Ci(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function nl(e,t){return el(ze(e,"posix"),t)}function Gr(e){return nl(e,new Set(Array.from(e.matchAll(Ef)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function el(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(el(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>el(o,n))||Pf(r.words,n))return!0;_w(r,n)}return!1}function Pf(e,t){let n=e.findIndex((s)=>Me(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Lr(r,t))return!0;let o=N(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return bf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=s.map((d)=>d.text),l=Oe(a),c=l.commandIndex??l.scriptIndex;return!Ve(a)&&c!==null&&bf(s[c],t)}let i=bw(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Pf(e.slice(i),t)}function bw(e,t,n){let r=N(e[t]?.text??"");if(r==="command")return Ew(e,t+1);if(r==="exec")return vw(e,t+1);if(r==="env")return Rw(e,t+1,n);return null}function Ew(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function vw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Rw(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Lr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Lr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Me(i))continue;return r}return null}function _w(e,t){if(!e.words.every((n)=>Me(n.text)!==null))return;for(let n of e.words){let r=Me(n.text);if(!r)continue;if(Lr(n,t))t.add(r.name)}}function Lr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Ef)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(fw.test(o)||t.has(o))}))}function bf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Lr(e,t))}var rl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ol="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",ww="__CC_SAFETY_NET_XARGS_INPUT__",Si="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",bi="rm",xw=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Aw=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Pw=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Tw=/^(?:[0-9]+|[@*])$/;function kf(e,t){let n=e.map(x),{childStart:r,replacementToken:o}=sn(n),i=n.slice(r),s=v("xargs.shell-dynamic",ol);if(kw(i,o,t)&&I(s,t.policy))return I(s,t.policy);for(let a of je(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?I(s,t.policy):null;if(c)return c;let d=Wf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Nf(l,o),u=t.analyzeChild(l,{...nn(a,t),dynamicInput:d,dynamicSourceInput:f||Df(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",rl)});if(u)return u;let m=Iw(l,o,t.policy?.rules??[],I(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,ww]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...nn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=dt(l,t.policy?.rules??[]);if(p)return p}return null}function Iw(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=dt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=N(e[0]??"");if(!n.some((i)=>N(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Of(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=yf(e,r,t.length,n);return o===null?[]:[o]}function Df(e,t,n,r,o,i,s){if(J.has(t)){if(Ve(e))return!1;if(n!==null&&Ow(e,n,s))return!0;let a=Ne(e);if(!a){let l=ft(X(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Mf(a,n,s))return!0;if(De(a))return!0;return Dw(a,n,r)}if(Fe(t))return Tf(e,n,Wo,Lu(t));if(ke.has(t))return Tf(e,n,La,Lm);if(t==="eval"){let a=hi(X(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Mw(e,n,i);if(t==="git"){let a=Ae(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Ln.has(a.subcommand.toLowerCase())&&Lf(a.rest,n).some((l)=>l.includes(n))}return!1}function Mf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return De(i)===null&&n(i)===null}function Tf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Si]).sources.some((a)=>a.value===Si);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Si}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Si}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Of(l,t,a))));return pi(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function kw(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(je(e,n),(i)=>i.head)),o=t===null?[...e,bi]:e.map((i,s)=>s===0?i:i.replaceAll(t,bi));return Array.from(je(o,n)).some((i)=>i.head===bi&&!r.has(bi))}function Nf(e,t){return Lf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Lf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Wf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Ow(e,t,n){let r=Oe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Mf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Of(a,t,s).some((d)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,d):m),u=Oe(f);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(f[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(f[u.scriptIndex]??"").includes(d)})}))}function Dw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(xw))if(If(o,r))return!0;for(let o of e.matchAll(Aw))for(let i of(o[1]??"").matchAll(Pw))if(If(i,r))return!0;return nl(e,r)}function If(e,t){let n=e[1]??e[2];return n!==void 0&&(Tw.test(n)||t.has(n))}function Mw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Je(s)){let l=Mn(e,i);i=l.nextIndex-1;for(let c of je(l.tokens,{environment:n,cwd:void 0})){let d=Wf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Nf(c.tokens,t)||Df(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=mt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function sn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Fr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",zr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Lw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Ww="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",vi=/\{[^{}\s]*\}/g,Gf=/\{\}|\{-?\d+\}/g,Ff=/[\s;&|<>()$`\\"']/,Gw=["e","f","source","file","-e","-f","--source","--file"],Fw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],zw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),$w=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),zf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Bw=new Set(["--workdir","--wd"]),$f="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Le(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Hf(e){return Le([...e],(t)=>De(t))}function jf(e,t){let n=e.map(x);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Fn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=rp(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:f}=o;if(c){let p=Fn(t);if(p)return p;let g=Hf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=Yw(t);if(p)return p}if(d!==void 0&&a){let p=Fn(t);if(p)return p}let u=Zw(d,t.cwd,t.environment.paths);if(u===null){let p=Fn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(f){if([...je(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(al)){let g=Fn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Xf(m.envAssignments,m.cwd,a);return Le(p,(h)=>t.analyzeNested(h,g))}return Le(je(i,m),(p)=>Uw(p,o,t,m))}function Uw(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(tp)){let E=Fn(n);if(E)return E}let c=Hf(l);if(c)return c;let d=l.some(B),f=o||d,u=s&&f,m=Xf(e.envAssignments,e.wrapperCwd,i||u),p=f?{...m,worktreeMode:!1}:m,g=a.join(" "),h=B(g.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>Ff.test(E))),b=h||Ff.test(a[0]??""),S=y&&b&&t.jobs.length>0?null:Hw(e,t,n,r,p,d);if(S||!y)return S;return Vf(B(g)?g:`${g} {}`,!h,e,t,n,r,p)}function Hw(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,d=e.tokens,f=a||i;if(J.has(e.head)){let m=()=>{if(!a||s.length===0)return null;return Le(s,(h)=>n.analyzeChild(Ei(d,h,n.budget),nn(e,r)))};if(Ve(d))return m();if(li(d))return wt();let p=Ne(d);if(p){if(np(p)){let S=Tt(n);if(S)return S;if(s.length===0)return null;return Le(s,(E)=>n.analyzeNested(Qf(p,E,n.budget),o))}if(B(p))return Vf(p,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((S)=>yi(X(S===void 0?d:a?d.map((E)=>Jf(E,S)):[...d,...S]),p)):[];if(h.some((S)=>S.kind==="dynamic")){let S=Tt(n);if(S)return S}let y=h.flatMap((S)=>S.kind==="literal"?[S.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),Le(y,(S)=>n.analyzeNested(S,o));if(Gr(p)){let S=Tt(n);if(S)return S}let b=n.analyzeNested(p,o);if(b)return b;if(f)return Tt(n);return null}let g=ft(X(d));if(g.kind==="dynamic"||g.kind==="literal"&&B(g.source))return Tt(n)??m();if(g.kind==="literal")return m();if(s.length>0){let h=Tt(n);if(h)return h;let y=m();if(y)return y;if(a)return null;let b=s.flatMap((S)=>S[0]===void 0?[]:[S[0]]);return n.budget.charge("derivedTokens",b.length),Le(b,(S)=>n.analyzeNested(S,o))}if(f||c)return Tt(n)??m();return null}if(e.head==="rm"&&ut(d)){if(a&&s.length>0)return Le(s,(p)=>il(Ei(d,p,n.budget,Gf),e.cwd,r));if(s.length>0)return Le(s,(p)=>il(Uf(d,p,n.budget),e.cwd,r));let m=il(d.flatMap((p,g)=>{if(g===0||!B(p))return[p];return p.startsWith("-")?[p.replace(Gf,"")]:[]}),e.cwd,r);if(m)return m;return Zf(n)}let u=s.length>0?s:[void 0];return Le(u,(m)=>{let p=m===void 0?d:a?Ei(d,m,n.budget):Uf(d,m,n.budget),g=v("parallel.shell-dynamic",zr),h=c&&e.head==="find"?qw(p,r):null,y=qf(p,c,n)??h?.customResult??null,b=N(e.head),S=c&&(b==="rm"&&sl(p)||b==="xargs"&&Yf(p)||h?.rmOptions===!0),E=c&&(S||h?.executedSource===!0||h===null&&Kf(p,b)),A=n.analyzeChild(p,{...nn(e,r),worktreeMode:l||c||f?!1:n.worktreeMode,dynamicInput:c||f,dynamicRmInput:S,dynamicSourceInput:y!==null||E,shellDynamicMatch:g,dynamicSourceMatch:g,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Fr)});if(E){let P=I(g,n.policy);if(P)return P}return A??y??dt(p,n.policy?.rules??[])})}function Vf(e,t,n,r,o,i,s){if(r.jobs.length>0)return Le(r.jobs,(c)=>o.analyzeNested(Qf(e,t?c.map(Ci):c,o.budget),s));let a=Mr(e);if(a?.[0]&&N(a[0])==="rm"&&ut(a)){let c=Zf(o);if(c)return c}return(a?o.analyzeChild(a,{...nn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",zr),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",Fr)}):null)??o.analyzeNested(e,s)}function Kf(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return Kw(e);if(t==="git")return jw(e);if(t==="find")return!0;if(ke.has(t))return Bf(e,Gw,Or);if(Fe(t))return Bf(e,Fw,Lo);return!1}function sl(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||np(o)))}function jw(e){if(Vw(e))return!0;let t=Ae(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!Ln.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function Vw(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function Kw(e){if(Ve(e))return!1;let t=Ne(e);if(t!==null)return B(t);let n=ft(X(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function Bf(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,$f]).some((o)=>o.value===$f);return pi(r,t,(o)=>n(e.map((i)=>Jf(i,[o]))))}function qf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>N(i.command)===N(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return Tt(n);return Le(o,(i)=>dt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function qw(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of je(i,t))n.executedSource||=Kf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&sl(a.tokens)||a.head==="xargs"&&Yf(a.tokens),n.customResult??=qf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Je(a)){i=[],n.executedSource||=B(a);continue}let l=mt(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function Yf(e){let t=e.slice(sn(e).childStart);return N(t[0]??"")==="rm"&&sl(t)}function Ri(e,t){return(n)=>I(v(e,t),n.policy)}var Tt=Ri("parallel.shell-dynamic",zr),Yw=Ri("parallel.command-stream-dynamic",Lw),Fn=Ri("parallel.command-stream-dynamic",Ww),Zf=Ri("parallel.rm-recursive-force-dynamic",Fr);function il(e,t,n){return I(gi(X(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:On(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Xf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Jf(e,t){return e.replace(vi,(n)=>ep(n,t))}function Ei(e,t,n,r=vi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=ep(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Qf(e,t,n){return Ei([e],t,n)[0]??""}function Uf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function ep(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(vi)!==-1}function tp(e){if(al(e))return!0;for(let t of e.matchAll(vi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function al(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function np(e){return/^\{[^{}\s]*\}$/.test(e)}function Zw(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Nw(e))return null;try{return Et(t??e,e,n)}catch{return null}}function rp(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,d=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Fa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Fa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=g.indexOf("="),b=y===-1?g:g.slice(0,y),S=y===-1?void 0:g.slice(y+1);if(g==="--dry-run"){c=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){d||=(g==="-I"?h:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){d=!0,t+=2;continue}if(b==="--replace"||g.startsWith("-i")&&g.length>2){let E=b==="--replace"?S:g.slice(2);d||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||$w.has(b)){d=!0,t+=S===void 0?2:1;continue}if(g==="-q"||g==="--quote"){s=!0,t++;continue}if(g==="--pipe"||g==="--pipepart"){a=!0,t++;continue}if(b==="--env"){d=!0,t+=S===void 0?2:1;continue}if(zf.has(b)||g.startsWith("-S")&&g.length>2){i=!0,t+=zf.has(g)?2:1;continue}if(Bw.has(b)){d=!0;let E=S??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=S===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&S!==void 0){t++;continue}if(zw.has(g)){if(h===void 0||h===":::"||h==="--"){d=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}d||=n.some(c?al:tp);let f=[];if(o!==-1){let g=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){f.push(g),g=[];continue}if(y!==void 0)g.push(y)}f.push(g)}d||=f.length>1;let u=Xw(f),m=n.some(B),p=n.length===0&&o===-1;return{template:n,jobs:u,childStart:r,templateHasPlaceholder:m,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:p,unsupported:d,workdir:l,dryRun:c}}function Xw(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>q.derivedTokens.cap)throw new F("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>q.derivedTokens.cap)throw new F("derivedTokens");o.push([...i,s])}t=o}return t}function op(e){return rp(e).childStart}var Jw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",_i="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function cl(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ll(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function sp(e,t,n,r,o=!1,i){let a=(dr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",Jw):null;return I(a,i)??ap(e,t,n,o,i)}function ap(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>cl(a)?[l]:[]);if(i.length===0)return null;let s=N(t[0]?.text??"");if(s==="git"){let a=Rn(e,t),l=ex(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return I(v("shell.dynamic-structure",_i),o);if(I(fi(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((f,u)=>u>l&&x(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&Ln.has(c)&&i.some((f)=>f>l&&(d===-1||f<d)))return I(v("shell.dynamic-structure",_i),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&tx(t)?I(v("shell.dynamic-structure",_i),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&x(c)==="--"),l=ut(t.map(x));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?I(v("shell.dynamic-structure",_i),o):null}if(s==="xargs")return ip(e,t.slice(sn(t.map(x)).childStart),"xargs",n,r,o);if(s==="parallel")return ip(e,t.slice(op(t.map(x))),"parallel",n,r,o);return null}function ip(e,t,n,r,o,i){if(t.length===0)return null;let s=Qw(t,r);if(dr(e,s)){let l=I(v(`${n}.shell-dynamic`,n==="xargs"?ol:zr),i);if(l)return l}let a=ap(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>cl(l)&&ll(l)))return I(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?rl:Fr),i);return null}function Qw(e,t){let n=qt(e,t),r=n.rewritten?X(n.words.map(x)):n.words,o=r[0];return o&&x(o)==="busybox"?r.slice(1):r}function ex(e){let t=1;while(t<e.length){let n=e[t],r=n?x(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function tx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=cl(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ll(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ll(s)))return!0;continue}if(t=!0,a)return!0;let l=mt(s.text);if(l>0){n=l;continue}if(Je(s.text))o=!0,r=!0}return!1}function dl(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!_n(t[n.tokenIndex],n.value)})}var lp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nx="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",rx="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",ox="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",ix="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",sx="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",ax={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:ox},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:we},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:rx},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:sx},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:lp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:nx},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:lp}},lx=/^\/\/?[ck]$/i,cp=/[&|]+/,cx=/(?:"[^"]*"|[^\s"])+/g,dx=/[\^%!]/,ux=/\\"./s,mx=/(^|\/)[*.]*\*[*.]*$/,fx=/^"?[\\/]+[?.][\\/]/,px=new Set(["rmdir","rd","del","erase"]),gx=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,hx=/\/s(?!\w)/i,yx=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function dp(e,t){let n=e.map(x),r=n.findIndex((u)=>lx.test(u));if(r===-1)return null;let o=n.slice(r+1).join(" "),i=/^".*"$/s.test(o)?o.slice(1,-1):o,s=i.split(cp).map((u)=>{let m=u.match(cx)??[],p=m.findIndex((h)=>px.has(h.replace(/^@/,"").toLowerCase())),g=p===-1?[]:m.slice(p);return{piece:u,tokens:m,deleteTokens:g,recursiveDelete:g.slice(1).some((h)=>h.startsWith("/")&&h.toLowerCase().split("/").includes("s"))}}),a=s.filter((u)=>u.recursiveDelete),l=a.length>0||gx.test(i)&&hx.test(i);if(l&&(i.includes("\\\"")||t.gitBashEscapesBodyQuotes&&i.includes('"')||t.powerShellRawWords.some((u)=>ux.test(u))||a.some((u)=>u.tokens.some((m)=>fx.test(m)))))return v("cmd.recursive-delete-escaped-quote",ix);let c=Xe({...t,allowPaths:t.policy?.destructiveCommandAllowPaths}),d=s.reduce((u,m)=>u??(m.recursiveDelete?Cx(m.deleteTokens,c,t.policy):t.analyzeNested(m.piece)),null),f=l&&(a.length===0||dx.test(i)||yx.test(i)||i.includes('"')&&cp.test(i));return d??(f?wt():null)}function Cx(e,t,n){return e.slice(1).filter((r)=>!r.startsWith("/")).reduce((r,o)=>r??I(en(xe(Ir(o.replaceAll('"',"")).replace(mx,"$1*"),t),t,n,ax),n),null)}var Sx="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",bx=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,Ex=/^-(?:executionpolicy|ep)$/i,vx=/^-(?:command|c)$/i,Rx=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,_x="encodedcommand",wx=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,xx=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Ax=/[$`]/,Px="--%";function up(e,t){let n=e.map(x),r=n.every((i,s)=>s===0||i!==Px&&Tx(e[s],i))?ml(n):void 0;if(r!==void 0)return t(r);if(n.some(Ix))return wt();let o=n.join(" ");return wx.test(o)&&xx.test(o)?v("powershell.nested-recursive-delete-unread",Sx):null}function ml(e){let t=ul(e,1),n=t===void 0?[]:e.slice(t+1);return n.length>0?n.join(" "):void 0}function ul(e,t){let n=e[t]??"";if(vx.test(n))return t;if(bx.test(n))return ul(e,t+1);return Ex.test(n)?ul(e,t+2):void 0}function Tx(e,t){return e?.provenance==="unknown"?!Ax.test(t):_n(e,t)}function Ix(e){let t=Rx.exec(e)?.[1]?.toLowerCase();return t!==void 0&&(t==="ec"||_x.startsWith(t))}var fp=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>gi(e.words,fl(e))},{heads:new Set(["cmd"]),analyze:(e)=>dp(e.words,{...fl(e),powerShellRawWords:e.options.commandView?.dialect==="powershell"?e.options.commandView.words.map((t)=>t.raw):[],gitBashEscapesBodyQuotes:e.options.commandView?.dialect!=="powershell",analyzeNested:(t)=>It(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(e)=>up(e.parsedWords,(t)=>It(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(e)=>fi(e.words,pl(e))},{heads:new Set(["find"]),analyze:(e)=>jm(e.words,{...fl(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["xargs"]),analyze:(e)=>kf(e.words,{...mp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>It(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>jf(e.words,{...mp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>It(e.options.analyzeNested(t,n))})}];function mp(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function It(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function fl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(e.envAssignments,e.options.environment),trustedTmpdirValue:On(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function pl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function hp(e){return fp.find((t)=>t.heads.has(e))?.analyze}function $n(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((D)=>o==="posix"?x(D):D.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,u=$o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=qt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let w=[...p,...i(m.words)].join(" "),D=De(w);if(D)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:D.reason}),ge(D);if(n.strict)return pe(r);let U=Bo(p,i(m.words));if(U){n.budget.charge("derivedTokens",U.length);let se=n.analyzeNested(U.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(se)return se}}let g=m.rewritten?X(i(m.words)):Rn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let w=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),S=h[0];if(!S)return null;if(tn(S))throw new F("wrapperPeelIterations");let E=N(S),A=m.cwd===null?void 0:m.cwd??d,P=m.cwd===null?void 0:f,k=m.cwd===void 0?n.effectiveCwd:m.cwd,C=s?s.allowTmpdirVar:!Pr(b,n.environment),O=sp(o,m.words,n.environment,t===0,n.strict,n.policy);if(O)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:O.reason}),ge(O);let T=ii(h,n.policy);if(T){for(let w of[T.childIndex,...T.alternativeChildIndices]){pp(y.wrapperNormalizationBudget);let D=g.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:T.wrapper,output:i(D)});let U=$n(D,t,{...y,effectiveCwd:k,envAssignments:b});if(U)return U}return null}let K=l?void 0:E==="eval"?hi(g):E==="trap"&&!a?_f(g):void 0;if(a&&s&&E==="eval"){if(K?.kind==="dynamic")return zn(s,n.policy);if(K?.kind==="literal"){let w=n.analyzeNested(K.source,{effectiveCwd:k,envAssignments:b});if(w)return w}return Bn(s,n.policy)}if(K?.kind==="dynamic"&&(n.strict||!n.commandView||!tl(n.commandView)))return pe(r);if(K?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:K.source,depth:t+1});let w=n.analyzeNested(K.source,{effectiveCwd:k,envAssignments:b,functionDefinitions:n.functionDefinitions});if(w)return w}if(a?J.has(E):Cp(S,E)){if(Ve(h))return null;if(li(h))return pe(r);if(a&&s){let w=Ne(h);if(w){if(s.dynamicSourceInput??s.dynamicInput){let U=zn(s,n.policy);if(U)return U}if(Gr(w)){let U=zn(s,n.policy);if(U)return U}return n.analyzeNested(w,{effectiveCwd:k,envAssignments:b})}let D=ft(g);if(D.kind==="dynamic")return zn(s,n.policy);if(D.kind==="literal")return s.dynamicSourceInput?zn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?zn(s,n.policy):null}if(l){let w=Ne(h),D=w?n.analyzeNested(w,{effectiveCwd:k,envAssignments:b}):ft(g).kind==="dynamic"?pe(r):null;if(D)return D}if(s===void 0){let w=Mx(h,b,k,n,r,t);if(w)return w;let D=Ne(h);if(D){let fn=yi(g,D);if(fn.kind==="dynamic")return pe(r);let zi=fn.kind==="literal"?fn.source:wf(g,D),jl=Nx(zi);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:jl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:jl,depth:t+1});let Vl=n.analyzeNested(zi,{effectiveCwd:k,envAssignments:b});if(Vl)return Vl;return Gr(zi)?pe(r):null}let U=ft(g,n.strict?void 0:n.shellAssignments);if(U.kind==="dynamic")return pe(r);if(U.kind==="literal")return wi(U.source,k,b,n,r,t);let se=xf(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(se.kind==="dynamic")return pe(r);if(se.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:se.source,depth:t+1}),n.analyzeNested(se.source,{effectiveCwd:k,envAssignments:b})}}if(!s&&(E==="source"||E===".")){let w=h[1]==="-p"?2:null;if(w!==null){let fn=n.commandView?g[w]:void 0;if(!fn)return null;if(fn.provenance!=="literal")return pe(r)}let D=w===null?1:3,U=h[D]==="--"?D+1:D,se=n.commandView?g[U]:void 0;if(!se)return null;if(se.provenance==="literal")return wi(se.text,k,b,n,r,t);if(n.strict||!n.commandView||!tl(n.commandView))return pe(r)}if(ke.has(E)&&!l){if(!s&&n.strict&&dl(Or(h),g))return pe(r);let w=Wm(h,(U)=>It(n.analyzeNested(U,{effectiveCwd:k,envAssignments:b}))),D=I(w,n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:D.reason}),ge(D)}if(Fe(E)&&!l){if(!s&&n.strict&&dl(Lo(h),g))return pe(r);let w=Nu(h);if(a&&s)return Ox(E,w,k,b,n,s);if(w){let D=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:w,paranoidBlocked:D}),D){let se=I(v("interpreter.one-liner-paranoid",br),n.policy);if(se)return ge(se)}if(ha(E,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let U=n.analyzeNested(w,{effectiveCwd:k,envAssignments:b});if(U&&!yp(U,w))return U;if(Er(w,void 0,!n.strict)){let se=I(v("interpreter.dangerous-command",An),n.policy);if(se)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:An}),ge(se)}r=void 0}}if(E==="busybox"&&h.length>1)return pp(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),$n(g.slice(1),t,{...y,effectiveCwd:k,envAssignments:b});let j=s?null:I(ku(E,h),n.policy);if(j)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:j.reason}),ge(j);let z=r===y.trace?y:{...y,trace:r},de={words:g,parsedWords:m.words,head:E,cwd:A,originalCwd:P,envAssignments:b,allowTmpdirVar:C,dynamicArguments:m.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:k,options:z,analyzeChildTokens:(w,D)=>a&&s?hl(w,t,z,{...s,cwd:D??void 0,effectiveCwd:D??void 0}):It($n(X(w),t+1,{...z,child:void 0,commandView:void 0,effectiveCwd:D,envAssignments:b}))??dt(w,z.policy.rules),analyzeChild:(w,D)=>hl(w,t,z,D)},te=s&&(E==="xargs"||E==="parallel")?void 0:hp(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:C});let ne=r&&E==="git"?hf(de.words,pl(de)):void 0,Ee=gp(ne?ne.match:te?.(de)??null,n.policy);if(r)Lx(de,Ee,ne?.relaxation??null);if(Ee)return ge(Ee);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(ut(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Bn(s,n.policy):null)??Dx(s,n.policy)}let tt=te!==void 0&&!Gx.has(E),Nt=!s&&!tt&&!ao.has(E),Kn=r&&Nt?[]:void 0;if(Nt)for(let w=1;w<h.length;w++){let D=h[w];if(!D)continue;Kn?.push(D);let U=gp(kx(h,w,t,z,A,P,k,b),n.policy);if(U)return r?.recordSegment({type:"fallback-scan",tokensScanned:Kn??[],embeddedCommandFound:N(D)}),ge(U)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Kn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Pe=dt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Pe,reason:Pe?.reason}),Pe)return ge(Pe);return a&&s?Bn(s,n.policy):null}function hl(e,t,n,r){return It($n(X(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function kx(e,t,n,r,o,i,s,a){for(let l of je(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=N(c);if(Cp(c,d)||hp(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=hl(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!Pr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function Ox(e,t,n,r,o,i){if(!t)return Bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=I(v("interpreter.one-liner-paranoid",br),o.policy);if(a)return ge(a)}if(ha(e,t))return Bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!yp(s,t))return s;if(Er(t,void 0,!o.strict)){let a=I(v("interpreter.dangerous-command",An),o.policy);if(a)return ge(a)}return Bn(i,o.policy)}function yp(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Yo)||e.reason===Ze)&&!lo(t);return n||r}function zn(e,t){let n=e.shellDynamicMatch?I(e.shellDynamicMatch,t):null;return n?ge(n):null}function Bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?I(e.dynamicSourceMatch,t):null;return n?ge(n):null}function Dx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?I(e.rmDynamicMatch,t):null;return n?ge(n):null}function Mx(e,t,n,r,o,i){let s=Hm(e);if(s.argvSource?.kind==="absent")return pe(o);if(s.argvSourceApplies&&s.argvSource){let l=wi(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return wi(a,n,t,r,o,i,!0)}function wi(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return pe(o);let a=Sr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?pe(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Nx(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Lx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function pp(e){if(e.iterations>=q.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function ge(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function pe(e){return e?.recordSegment({type:"error",message:Ar}),ge(wt())}function Cp(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(M(t))}function gp(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:I(e,t)}var Wx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Gx=new Set(["powershell","pwsh"]),Fx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function zx(e,t){let n=Ep(e,t);if(n.length===0)return!1;let r=n[bp(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Wx.test(e.join(" "))}function Sp(e,t,n,r,o){if(e.dialect==="powershell"){let S=$x(e.words,o);if(S.kind==="none")return;if(!t||S.kind==="unknown")return null;return gl(jx(S.target),t,n.paths)}let i=e.words.map(x),s=i.some((S)=>/^CDPATH\+?=/.test(S));if(!zx(i,n))return s?null:void 0;if(!t)return null;let a=Ep(i,n,t),l=bp(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((S)=>S.length<=1||!S.startsWith("-")||S==="--");if((d===-1?c:c.slice(0,d)).some((S)=>!/^-[LP]+$/.test(S)))return null;let u=d===-1?[]:c.slice(d),m=u[0]==="--"?u.slice(1):u;if(m.length>1)return null;let p=m[0],g=r.get("HOME")||n.home;if(p===void 0)return gl(ue(g),t,n.paths);let h=e.words.find((S)=>S.provenance==="variable"&&S.text===p),y=e.words.find((S)=>S.text===p&&/^~(?:\/|$)/.test(S.raw)),b=h?Qe(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return gl(ue(b),t,n.paths)}function gl(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=Et(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function $x(e,t){let n=Bx(e[0])?1:0,r=e[n];if(!Ux(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Fx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Hx(e.slice(n+1),t)}function Bx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Ux(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Hx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function jx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function bp(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Ep(e,t,n){let r=Vx(e);return vt([...r],t,n)}function Vx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Qx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",an="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function vl(e,t,n,r){if(t>=q.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:qe}),{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??ze(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:qe}),{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return El(e,n);let d=`${Yo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Pp(e,n),{reason:Ze,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Pp(e,n),{reason:Ze,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return El(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=rf(n.environment.env,n.envAssignments);return Pi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Pi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let f=e.nodes[c+1],u=f?.kind==="connector"?f.operator:void 0,m=eA(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],S={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(kt(u)&&!kt(a))l=S;let E=kt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:kt(a)?l??S:S,A=ln(E.connector)||ln(u);if(d.kind==="function"){let j=h.flatMap((de)=>{let te=cn(de);return te.functionDefinitions.set(d.name,d.body),yl(de,[te],m,u==="&",ln(u))}),z=Cl(j,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=z.states,s=z.conditionalStates,a=void 0;continue}if(d.kind==="group"){let j=[],z=[];for(let te of h){let ne=Pi(d.body,t,n,r,[cn(te)]);if(ne.result)return ne;if(j.push(...yl(te,ne.states,m,u==="&",ln(u))),A)z.push(te,...m?ne.states.map((Ee)=>xi(te,Ee)):ne.states)}let de=Cl(j,z,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=de.states,s=de.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let P=RA(e.nodes[c-1]),k=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],O=kt(a)&&C?.kind==="command"?Rf(C)??nA(C):void 0,T=[],K=[];for(let j of h){let z=rA(d,t,n,r,[cn(j)]);if(z.result)return{result:z.result,states:i};let de=e.dialect==="powershell"?z.states:z.states.map((te)=>xi(j,te));for(let te of de){let ne=cn(te),Ee=sA(d,t,n.trace?{...n,trace:Tp(n.trace,k)}:n,r,ne,kt(a),O);if(Ee)return{result:Ee,states:i};let tt=IA(d,ne.functionDefinitions);if(tt)n.budget.charge("derivedTokens",Ti(tt));let Nt=tt?t+1>=q.recursionDepth.cap?Sl(d.displayText,n,[ne]):Pi(tt,t+1,n,r,[ne]):{result:null,states:PA(d,ne).flatMap((Pe)=>_A(d,te,Pe,P))};if(Nt.result)return Nt;T.push(...yl(j,Nt.states,m,u==="&",ln(u)));let Kn=typeof ne.effectiveCwd==="string"&&ne.effectiveCwd!==te.effectiveCwd&&d.redirections.every((Pe)=>["<",">",">>",">|"].includes(Pe.operator)&&Pe.target?.text==="/dev/null");if(A&&(P||!Kn))K.push(j),K.push(...Nt.states.map((Pe)=>m?xi(j,Pe):Pe))}}let Mt=Cl(T,K,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=Mt.states,s=Mt.conditionalStates,a=void 0}return{result:null,states:i}}function eA(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(kt(r)||kt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&tA(e,t)}function yl(e,t,n,r,o){let i=n?t.map((a)=>xi(e,a)):[...t],s=o?i.flatMap((a)=>Un(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function xi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function tA(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(oA(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function kt(e){return e==="|"||e==="|&"}function nA(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function ln(e){return e==="&&"||e==="||"}function Cl(e,t,n,r,o,i){let s={success:Ai([...n,...e]),failure:Ai([...r,...t])},a=ln(i)?s:void 0;return{states:ln(o)||a?Ai([...s.success,...s.failure]):s.success,conditionalStates:a}}function Tp(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,branch:e.branch,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function rA(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=iA(e);if(s){if(t+1>=q.recursionDepth.cap)return Sl(s,n,o);let a=ze(s,"powershell");if(a.status==="limited")return Sl(s,n,o);if(a.status!=="complete")return vp(i,n,r,o);n.budget.charge("derivedTokens",Ti(a)),i.push({program:a,depth:t+1})}}return vp(i,n,r,o)}function oA(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function vp(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Pi(i.program,i.depth,t,n,[cn(a)]);if(l.result)return l;s.push(...l.states)}o=Ai(s)}return{result:null,states:o}}function iA(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Ti(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Ti(o),0):n.kind==="group"||n.kind==="function"?Ti(n.body):0),0)}function Sl(e,t,n){return t.trace?.recordSegment({type:"error",message:qe}),{result:{reason:qe,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function sA(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:uA(n.environment.paths,o.createdDirectories,n.budget)}},l=yA(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Ip(e,o,"before-consumer",a.environment.paths,a.budget);let c=Rn(e.dialect,e.words),d=c.map(x),f=e.displayText,u=tf(c,o.shellGitContextState),m=sf(u,o.shellGitContextState);if(e.dialect==="powershell"){let y=I(Im(e,i,kA(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!y,reason:y?.reason}),y)return Ap(f,y)}let p=I(Ou(e.redirections),a.policy);if(p)return a.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:p.reason}),Ap(f,p);if(d.length===1&&d[0]?.includes(" ")&&!dr(e.dialect,e.words)){let y=I(De(d[0]),a.policy),b=y!==null&&!a.strict&&Au(e,a.rootProgram);if(y&&!b)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:y.reason}),{reason:y.reason,segment:f,ruleId:y.id,intent:y.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let S=Rp(e,l,o,m,s,a);if(S)return S;return Ya(u,o.shellGitContextState),null}let g=$n(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(y,b)=>{let S=b&&Object.hasOwn(b,"effectiveCwd")?b.effectiveCwd:o.effectiveCwd,E=vl(y,t+1,{...a,effectiveCwd:S,envAssignments:b?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:b?.functionDefinitions,worktreeMode:b?.worktreeMode??a.worktreeMode,shell:b?.shell??a.shell,trace:a.trace?Tp(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:f};let h=Rp(e,l,o,m,s,a);if(h)return h;return Ya(u,o.shellGitContextState),null}function Rp(e,t,n,r,o,i){let s=CA(e,t,n,r??new Map,i);if(s)return s;return Ip(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),cA(e,t,n,i.environment.paths,i.budget),mA(e,n,i.environment.paths,i.budget),EA(e,n,o,i.environment,i.trace),null}var aA=new Set([">>","<>"]);function Ip(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?lA(s):aA.has(s.operator)))continue;_p(s.target,t,r,o)}if(n!=="before-consumer"||!ce(e.words[0],"tee"))return;let i=Op(e.words.slice(1));if(!i)return;for(let s of i.operands)_p(s,t,r,o)}function lA(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function _p(e,t,n,r){let o=e?.provenance==="literal"?Sr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function cA(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of dA(e,n.shellGitContextState.shellAssignments)){let a=Sr(s,n.effectiveCwd,r,o);if(!a||!Mu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=q.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function dA(e,t){let n=bl(gA(e.redirections)?.target,t),r=n===void 0?[]:[n];if(ce(e.words[0],"cat"))return pA(e.words)?r:[];if(!ce(e.words[0],"tee"))return[];let o=Op(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>bl(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function bl(e,t){if(hA(e))return e.text;return(e&&Qe(e,t))??void 0}function uA(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=W(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${Jx}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?W(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function mA(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!ce(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>bl(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!qx(c)&&!l)continue;let d=W(Xx(l??"",c),n,r);if(a?fA(d,n):n.isDirectory(Kx(d))&&kp(d,n))t.createdDirectories.add(d)}}function fA(e,t){let n=Zx(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>Yx(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||kp(o(i),t)}function kp(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function pA(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function gA(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Op(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Qe(s,t)===null)return;if(r&&ce(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function hA(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function ce(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Rl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function yA(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return an;let r=n[0];if(!r?.heredoc)return an;let o=/\$\(|`/.test(r.heredoc.body);if(!Rl(r.heredoc)&&(!t||o))return Qx;if(r.fd!==void 0&&r.fd!==0)return an;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return an;let i=e.redirections.some((l)=>l!==r&&wp(l.target));if(ce(e.words[0],"cat"))return i?an:void 0;if(ce(e.words[0],"tee"))return i||e.words.slice(1).some(wp)?an:void 0;let s=e.words[0],a=e.words[1];if(ce(s,"git")&&(ce(a,"apply")||ce(a,"commit")))return;if(ce(s,"gh")&&(ce(a,"pr")||ce(a,"issue"))&&ce(e.words[2],"create"))return;return an}function wp(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function CA(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(bA(e,i,n,r,o))return null;let a=SA(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=El(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function SA(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Rl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=ce(e.words[0],"uv")&&ce(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Fe(i.text))return;let s=o.findIndex((f)=>ce(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=I(v("interpreter.one-liner-paranoid",br),n.policy);if(f)return f}if(!Er(l,void 0,!n.strict))return null;let d=I(v("interpreter.dangerous-command",An),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function bA(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Rl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=qt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(x),l=N(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(M(l)))return!1;return Ve(a)}function EA(e,t,n,r,o){let i=Sp(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(x).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var vA=new Set(["fi","done","esac"]);function RA(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function _A(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&vA.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((f)=>{if(f===n.effectiveCwd)return n;let u=cn(n);return u.effectiveCwd=f,u})}function wA(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var xA=/^[A-Za-z_][A-Za-z0-9_]*$/,AA=8;function PA(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!xA.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=AA&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=cn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function cn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:of(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function Ai(e){let t=[];for(let n of e){if(!t.some((r)=>TA(r,n)))t.push(n);if(t.length>q.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function TA(e,t){return e.effectiveCwd===t.effectiveCwd&&wA(e.compoundBodies,t.compoundBodies)&&Un(e.shellGitContextState.env,t.shellGitContextState.env)&&Un(e.literalHeredocFiles,t.literalHeredocFiles)&&Un(e.functionDefinitions,t.functionDefinitions)&&Un(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Un(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&xp(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&xp(e.createdDirectories,t.createdDirectories)}function xp(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Un(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function IA(e,t){let n=ur(e);return n===void 0?void 0:t.get(n)}function Ap(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function kA(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function El(e,t){let n=I(De(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Pp(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Ze},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var OA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Dp(e,t,n,r){let o=vl(e,0,{...t,...Hd(t),budget:t.budget??Te(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function Mp(e,t,n){try{return{decision:e()}}catch(r){let o=DA(r,t,n);if(!o)throw r;return o}}function DA(e,t,n){if(!(e instanceof F)||!OA.has(e.kind))return null;let r=q[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var MA=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),wl=new Set(["cc-safety-net","ccsn"]),NA=new Set(["bunx","npx","pnpx"]),LA=new Set(["pnpm","yarn"]),WA=new Set(["npm","pnpm","yarn"]),GA=new Set(["bun","node"]);function ki(e,t,n={}){if(wl.has(e))return 0;if(NA.has(e)){if(n.broad)return _l(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Ii(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&WA.has(e)&&n.broad&&t[r]==="exec"){let o=_l(t.slice(r+1));return o===null?null:r+1+o}if(LA.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Ii(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=_l(t.slice(r+1));return o===null?null:r+1+o}if(GA.has(e)){let o=n.broad&&r!==-1?r:0;if(Np(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Np(t[o+1]))return o+2}return null}function _l(e){let t=e.findIndex((r)=>Ii(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Ii(r))break;n++}return n}function Ii(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return wl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return wl.has(e.slice(0,t))}function Np(e){let t=e?.replaceAll("\\","/");return[...MA].some((n)=>t===n||t?.endsWith(`/${n}`))}var Lp="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Wp(e,t,n){let r=lt(e);if(!r)return null;let o=kn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>FA(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function FA(e,t){let n=vt([...e],t),r=n.slice(1),o=ki(M(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as Oi}from"node:path";var $p="This path contains the protected policy config and you must not modify or delete it.",zA=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Bp(e,t,n){let r=VA(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Gp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=lt(e);if(e.invocation.route.kind==="command")return o?Fp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Fp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Gp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Zr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Gp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>$r(a,n,r,o,i));return s?{target:s}:null}function Fp(e,t,n,r,o){let i=kn(e,t,r,o,{findSegmentTarget:(s,a)=>$A(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>$r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>jA(s,t,n,r,o)?.target??null});return i?{target:i}:null}function $A(e,t,n,r,o){if(xr(e))return null;let i=Rt([...e],r),s=M(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&BA(a)){let l=UA(a).find((c)=>zp(Ce(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(ci(i,1)||$a(i,r)){let c=(Dr(X(i))??X(["."])).find((d)=>{let f=Ce(d.text,t.variables);return $r(f,t.cwd,n,r,o)||zp(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Zo(a).sources.find((c)=>KA(Ce(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(HA(i,s))return null;for(let l of[...e,...i])for(let c of Up(l))if($r(Ce(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function BA(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function UA(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function HA(e,t){if(!zA.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function jA(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Up(i))if($r(s,t,n,r,o))return{target:s};return null}function Up(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function VA(e,t,n){let r=(a)=>Br(me(a,e.executionCwd,t,n)),o=r($t(t)),i=[r(Cn(e.executionCwd)),r(Cn(e.configCwd))],s=new Set(i.map((a)=>Oi(a)));for(let a=Oi(o);;a=Oi(a))if(s.add(a),Oi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function $r(e,t,n,r,o){let i=tc(e,t,r,o,(s)=>Br(s)===io);return i!==null&&n.files.has(Br(i))}function zp(e,t,n,r,o){return n.directoriesAndAncestors.has(Br(me(e,t,r,o)))}function KA(e,t,n,r,o){let i=Br(me(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Br(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as Di,posix as ng,resolve as Wi,win32 as qA}from"node:path";import{fileURLToPath as YA}from"node:url";var rg="Access to a sensitive path is not allowed.",og=new Set(["echo","printf"]),ZA=new Set(["find"]),XA=new Set(["!","do","elif","else","if","then","until","while"]),JA=new Set(["-exec","-execdir"]),QA=new Set([";","+"]),eP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),tP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ig=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),nP=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),rP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Il=new Set(["-c","-e","-r","-E","--eval","--exec"]),oP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),kl=new Set(["grep","rg"]),sg=new Set(["files-with-matches","files-without-match","count","quiet"]),iP=new Set([...sg,"ignore-case","fixed-strings","hidden"]),sP=new Set(["wc",...kl]),aP=new Set(["cd","grep","head","openssl","tail","tailscale"]),lP=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,cP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),dP=new Set(["commit","merge","notes","stash","tag"]),uP=new Set(["-m","--message"]),mP=new Set(["--grep"]),fP=new Set(["powershell","pwsh"]),Hp=new Set(["jq","gojq","jaq"]),jp="f",Vp="file",pP="files",gP=new Set(["e","f"]),hP=new Set(["regexp","file"]),yP=new Set(["e","f","A","B","C","m"]),CP=new Set(["regexp","file","after-context","before-context","context","max-count"]),xl="__CC_SAFETY_NET_PIPE_INPUT__",Pl=/[\w./~@+-]*[./~][\w./~@+-]*/g,SP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,bP=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,EP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Kp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,qp=/\b(?:system|exec|spawn|popen)\s*$/,vP=/\b(?:eval|exec)\s*\(/g,RP=/\b(?:eval|exec)\s*$/,_P=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Yp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(HT(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=BT(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(bg(a,s.cwd,r,o)))continue;if(c&&i?.get(a)==="data")continue;if(c&&(s.isRedirectionWriteTarget===!0||i?.get(a)==="write")&&!a.includes("$")&&!Li(a,s.cwd,r,o))continue;if(c&&(s.isCreatedPath===!0||s.isCertificateInput===!0))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Li(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&jT(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function ag(e,t,n,r,o={}){let i=Zp(e,n,r),s=Yp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Zp(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),l=new Map;a.forEach((p)=>lg(p.target).forEach((g)=>l.set(g,(l.get(g)??new Set).add(p.loopVariable))));let c=(p,g)=>(l.get(p)?.size??0)>(l.get(p)?.has(g)?1:0),d=a.filter(({loopVariable:p})=>p===void 0||c(p,p)||c("!",p)),f=new Set(d.filter((p)=>p.literalRole===void 0).map((p)=>p.target)),u=new Set(d.filter((p)=>p.literalRole==="write").map((p)=>p.target)),m=Yp(i,t,e.invocation.context.configCwd,n,r,new Map(d.map((p)=>[p.target,f.has(p.target)?"path":u.has(p.target)?"write":"data"])));return m?.ruleId!=="secret.deny-path"&&wP(e,n)?null:m}function wP(e,t){let n=lt(e);if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of qo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ct(s.text,t))}let o=et(r);if(o.length===0)return!1;let i=he(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Ol(i,o.slice(1))}function Ol(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e==="wc")return t.every((n)=>!n.startsWith("-")||lP.test(n));if(kl.has(e))return xP(e,t);if(e!=="find")return!1;return!t.some((n)=>eP.has(n))}function xP(e,t){let n=t.includes("--")?t.slice(0,t.indexOf("--")):t;if(n.some((c)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(c)||/^-[^-]*f/.test(c)))return!1;let r=e==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,o=e==="rg"?/[clq]/:/[Lclq]/,i=(c)=>/^-[^-]/.test(c),s=(c)=>{let d=n[c-1]??"";return/^--[^=]+$/.test(d)&&!iP.has(d.slice(2))||i(d)&&d.slice(1).search(r)===d.length-2},a=n.findIndex((c,d)=>!c.startsWith("-")&&!s(d));return(e==="grep"&&a>=0?n.slice(0,a):n).some((c,d)=>{if(s(d))return!1;if(c.startsWith("--"))return sg.has(c.slice(2));return i(c)&&o.test(c.slice(1).split(r)[0]??"")})}function Zp(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=lt(e);return[...s?Vn(s.shell,e.store,r,t,o,n,AP(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function AP(e){return e.program.dialect==="powershell"}function Vn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new He;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw new Zt;let a=[...e.assignmentFallbacks.map((h)=>({target:h,cwd:o})),..._T(ct(e.source,r),t,n,r,o,i)],l=(h)=>ct(FP(h,s),r),c=/[<>=]\(/.test(e.source),d=/\bcoproc\b|\|&/.test(e.source),f=[],u=[],m=(h)=>({...n,commandHoldsPipe:n.commandHoldsPipe===!0||h||d});Ko(e,o,r,i,{word:l,segment:(h,y,b,S,E,A)=>{if(h.length===0)return null;let P=m(A);if(P.commandHoldsPipe)f.push(...h);if(u.push(he(cg(et(h))[0]??"").toLowerCase()),a.push(...Hr(h,t,c||S==="|"||S==="|&"?{...P,segmentMayFeedReader:!0}:P,r,y.cwd,i,E)),b!==null)a.push(...IP(b,h,t,P,r,y.cwd,i));return null},redirection:(h,y,b)=>{if(h.body!==void 0&&h.consumer!==void 0){let S=m(b);a.push(...dg(h.consumer,[h.body],t,S,r,y.cwd,i,(E)=>kP(h.consumer??[],E,t,S,r,y.cwd,i)))}if(h.targetOrder==="legacy-segment")return Ra;return a.push({target:l(h.target),cwd:y.cwd,...h.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let p=new Set(f.flatMap(lg)),g=c||/\$\(|`/.test(e.source)||!u.every((h)=>aP.has(h));return a.map(({loopVariable:h,...y})=>{if(y.certificateOutputMayFeedReader===!0&&g)return{target:y.target,cwd:y.cwd};return h===void 0||c||p.has(h)||p.has("!")?y:{...y,loopVariable:h}})}function lg(e){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(e)?[e]:[],...Array.from(e.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(t)=>t[1]??t[2]??"")]}function Mi(e,t,n,r,o,i,s=!1){let a=t.getShellSyntax(e,s?t.getCommandProgram(e,"powershell"):void 0);if(a.status==="structural-limit")throw new He;return a.status==="complete"?Vn(a,t,n,r,o,i,s):null}function Hr(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:o}),l=e.findIndex((C)=>!XA.has(C));if(n.skipMetadataOnlySegments===!0&&l>0)return Hr(e.slice(l),t,n,r,o,i,new Set([...s??[]].map((C)=>C-l)));let c=e[1]??"";if(n.skipMetadataOnlySegments===!0&&e[0]==="for"&&e[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(c))return e.slice(3).flatMap((C)=>We("for",C)).map((C)=>({...a(C),loopVariable:c}));if(s?.size){let C=e.filter((O,T)=>!s.has(T));if(Hp.has(he(et(C)[0]??"").toLowerCase()))return[...e.filter((O,T)=>s.has(T)).map(a),...Hr(C,t,n,r,o,i)]}let d=GP(e).map(a),f=et(e);if(f.length===0)return d;let u=f[0]??"",m=he(u).toLowerCase(),p=f.slice(1),g=n.segmentMayFeedReader===!0||n.commandHoldsPipe===!0||n.displayOperandsAreCapturedOutput===!0,h=g&&sP.has(m);if(n.skipMetadataOnlySegments===!0&&!h&&Ol(m,p))return d;let y=TP(u,m,p);if(y)return[...d,...y.map(a)];if(og.has(m))return n.displayOperandsAreCapturedOutput===!0?[...d,...ug(e).map(a)]:d;if(m==="eval")return[...d,...Mi(p.join(" "),t,n,r,o,i)??p.map(a)];let b=fP.has(N(u))?ml(f):void 0;if(b!==void 0)i.charge("derivedTokens",f.length);let S=b===void 0?null:Mi(b,t,n,r,o,i,!0);if(S?.length)return[...d,...S];if(m==="export")return[...d,...p.flatMap((C)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(C)?[C.slice(C.indexOf("=")+1)]:We(m,C)).map(a)];if(m==="git")return[...d,...$P(p).map(a)];if(m==="gh")return[...d,...Tl(m,p,cP).map(a)];if(Hp.has(m))return[...d,...zP(p).map(a)];if(kl.has(m))return[...d,...OT(p).map(a)];if(ZA.has(m))return[...d,...UP(p,t,n,r,o,i).map(a)];if(m==="mkdir"||m==="touch"){let C=new Set(e.filter((T,K)=>s?.has(K))),O=n.segmentMayFeedReader!==!0&&!(m==="touch"&&p.some((T)=>/^(?:--r|-[^-]*r)/.test(T)));return[...d,...p.flatMap((T)=>We(m,T).map((K)=>O&&!T.startsWith("-")&&!C.has(T)?{...a(K),isCreatedPath:!0}:a(K)))]}if(ke.has(m))return[...d,...p.flatMap((C)=>We("awk",C)).map(a),...p.flatMap((C)=>jP(C,t,n,r,o,i)),...p.flatMap(VP).map(a)];if(m==="curl")return[...d,...p.filter((C,O)=>fg(C)===null&&mg(p[O-1])===null).flatMap((C)=>We(m,C)).map(a),...BP(p).map(a)];if(Tn(m)){let C=wr.has(m)?Oe([m,...p]):null;if(C!==null&&C.command!==null&&C.commandIndex!==null){let O=t.getShellSyntax(C.command);if(O.status==="structural-limit")throw new He;if(O.status==="complete")return[...d,...Vn(O,t,n,r,o,i),...p.slice(C.commandIndex).filter((T)=>!T.startsWith("-")).map(a)]}return[...d,...HP(m,p,t,n,r,o,i)]}let E=(C,O)=>new RegExp(`^--?${C}=`).test(p[O]??"")||new RegExp(`^--?${C}$`).test(p[O-1]??""),A=PP(f),P=m==="openssl"&&p[0]==="x509",k=g?{certificateOutputMayFeedReader:!0}:{};return[...d,...p.flatMap((C,O)=>We(m,C).map((T)=>A&&E("(?:cert|key)-file",O)?{...a(T),isCreatedPath:!0,...k}:P&&E("in",O)?{...a(T),isCertificateInput:!0,...k}:a(T)))]}function cg(e){return he(e[0]??"").toLowerCase()==="timeout"?e.slice(2):e}function PP(e){let t=cg(e);return he(t[0]??"").toLowerCase()==="tailscale"&&t[1]==="cert"}function TP(e,t,n){let r=ki(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function IP(e,t,n,r,o,i,s){if(NP(t,n,r,o,i,s)){let a=et(e),l=Ol(he(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...ug(e),...l].map((c)=>({target:c,cwd:i}))}return dg(t,OP(e),n,r,o,i,s,()=>[])}function kP(e,t,n,r,o,i,s){let a=et(e);if(!Tn(he(a[0]??"").toLowerCase()))return[];return Mi(t,n,r,o,i,s)??[{target:t,cwd:i}]}function dg(e,t,n,r,o,i,s,a){let l=LP(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>wr.has(l)?Vn(n.getShellSyntax(c),n,r,o,i,s):Ni(l,c,n,r,o,i,s))}function ug(e){let t=et(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase();if(!og.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Dl(r.replaceAll("%%","%"))];return t.slice(1)}function OP(e){let t=et(e);if(t.length===0)return[];let n=he(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return DP(r);return[]}function DP(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Dl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>MP(t,r.slice(i*n,(i+1)*n)))}function MP(e,t){let n=0;return Dl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Dl(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function NP(e,t,n,r,o,i){let s=et(e);if(s.length===0||he(s[0]??"").toLowerCase()!=="xargs")return!1;let a=sn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,xl]:l.map((f)=>f.split(c).join(xl));return Hr(d,t,n,r,o,i).some((f)=>f.target.includes(xl))}function LP(e){let t=et(e);if(t.length===0)return null;let n=he(t[0]??"").toLowerCase();if(!Tn(n))return null;return WP(n,t.slice(1))?n:null}function WP(e,t){let n=Ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Il.has(o)||pg(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(_P.get(n)?.has(o))r++;continue}return!1}return!0}function Ml(e){return/^python\d/.test(e)?"python":e}function GP(e){let t=[];for(let n of e){if(Sg(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Xp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function FP(e,t){if(!t||!Xp.test(e))return e;return`~${e.replace(Xp,"").replace(/\\/g,"/")}`}function We(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function zP(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>We("jq",i))}return e.flatMap((r,o)=>o===t?[]:We("jq",r))}function $P(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...dP.has(r)?Tl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),uP):Tl("git",e.slice(n),mP)];if(t.push(...We("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:We("git",o)),n++}return t}function Tl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>We(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...We(e,i))}return r}function BP(e){return e.flatMap((t,n)=>{let r=fg(t);if(r!==null)return Jp(r.flag,r.value);let o=mg(e[n-1]);return o===null?[]:Jp(o,t)})}function Jp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Al(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Al(t.slice(n+1))}return t.startsWith("@")?Al(t.slice(1)):[]}function mg(e){if(e===void 0)return null;if(ig.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function fg(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ig.has(r)?{flag:r,value:e.slice(n+1)}:null}function Al(e){return e===""||e==="-"?[]:[e]}function UP(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!JA.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>QA.has(m)),f=d===-1?c:c.slice(0,d),u=Hr(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!tP.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function HP(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Il.has(c)||pg(e,c)){let f=t[l+1];if(f!==void 0)a.push(...Ni(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...Ni(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function pg(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return oP.get(t[t.length-1]??"")?.has(Ml(e))??!1}function jP(e,t,n,r,o,i){if(!e.includes("system"))return[];return Wa(e)?.commands.flatMap((s)=>Vn(t.getShellSyntax(s),t,n,r,o,i))??[]}function VP(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function KP(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ll),...e.match(Pl)??[]]}function Ni(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:i}),l=hT(e),c=CT(t,l);if(c.kind==="unmaskable")return KP(t).map(a);let d=c.masked.match(Kp)!==null||c.literals.some((C)=>qp.test(c.masked.slice(0,C.start))),f=c.masked.match(vP)!==null||c.literals.some((C)=>RP.test(c.masked.slice(0,C.start))),u=r.inlineLiteralsPresumedData===!0&&!wr.has(e),m=u&&(l==="python"||l==="javascript"),p=u&&!(RT(c.masked)||d||f)?[]:c.literals,g=u?Array.from(c.masked.matchAll(Kp),(C)=>{let O=C.index+C[0].length;return{start:O,end:Go(c.masked,O)}}):[],h=!u||g.some((C)=>Ca(c.masked,C.start)&&!tT(c,C.start))?c.literals:c.literals.filter((C)=>qp.test(c.masked.slice(0,C.start))||g.some((O)=>C.start>=O.start&&C.start<O.end)),y=new Set(d?h:[]),b=m&&p.length>0&&!XP(c.masked,l==="python"?"#":"//"),S=b?nT(c.masked):[],E=b?Array.from(c.masked.matchAll(/[A-Za-z_$][\w$]*/g),(C)=>({name:C[0],index:C.index})):[],A=QP(E),P=!JP(c.masked,E),k=E.filter((C)=>!Qp(c.masked,{start:C.index,text:C.name,tokenStart:C.index,tokenEnd:C.index+C.name.length},S,A,P)).reduce((C,O)=>{let T=C.get(O.name)??[];return T.push(O.index),C.set(O.name,T)},new Map);return[...p.filter((C)=>C.text!=="").map((C)=>{if(!b||y.has(C))return a(C.text);if(Qp(c.masked,C,S,A,P)||rT(c.masked,C,S,k))return{...a(C.text),literalRole:"data"};return fT(c,C,S)?{...a(C.text),literalRole:"write"}:a(C.text)}),...p.flatMap((C)=>Ll(C.text)).map(a),...u?[]:c.literals.flatMap((C)=>C.text.match(Pl)??[]).map(a),...d?h.flatMap((C)=>Mi(C.text,n,{...r,commandHoldsPipe:!0},o,i,s)??[a(C.text)]):[],...f?c.literals.flatMap((C)=>Ni(e,C.text.replace(/\\(.)/g,(O,T)=>T==="n"?`
-`:T),n,r,o,i,s)):[],...m?[]:(c.masked.match(Pl)??[]).map(a),...u?(t.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(a):[]]}var Nl={"(":")","[":"]","{":"}"},gg="and|elif|else|if|in|is|not|of|or|return|while|yield",qP=new RegExp(`(?:^|[^\\w$])(?:${gg})$`),YP=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${gg})\\s*\\(|/\\*`),ZP=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function XP(e,t){return YP.test(e)||e.split(`
-`).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function JP(e,t){return sT.test(e)||t.some((n)=>{let r=iT.get(n.name),o=n.index+n.name.length;return r!==void 0&&!r.test(e.slice(o,o+40))})}function QP(e){return e.some((t)=>yg(t.name).some((n)=>ZP.test(n)))}var eT=new Set(["cmd","powershell","pwsh"]);function tT(e,t){let n=dn(e.masked,t),r=Nl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice(dn(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Il.has(s.text)||Tn(he(s.text).toLowerCase())||eT.has(he(s.text).toLowerCase().replace(/\.exe$/,""))))}function nT(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in Nl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function Qp(e,t,n,r,o){let i=n[t.tokenStart]??-1,s=e[i]??"",a=jn(e,t.tokenStart),l=dn(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,a-3),a+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(l,l+8)))return!0;if(r&&(s==="["||s==="("))return!1;let c=e[a],d=e[l];if(s==="{"&&c===":")return pT(e,a);let f=(c===s||c===",")&&(d===","||d===Nl[s]||s==="{"&&d===":");if(s!=="(")return f&&s!=="";return f&&(o&&oT.test(e.slice(Math.max(0,i-20),i))||(c===","||d===",")&&gT(e,i))}function rT(e,t,n,r){let o=Math.max(0,t.tokenStart-80),i=`${o===0?`
-`:""}${e.slice(o,t.tokenStart)}`,s=aT.exec(i)?.[1],a=e[n[t.tokenStart]??-1];if(s===void 0||a==="("||a==="[")return!1;let l=dn(e,t.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(e.slice(t.tokenEnd,l)))return!1;let c=t.tokenStart-i.length+i.lastIndexOf(s);return(r.get(s)??[]).every((d)=>d===c)}var oT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,iT=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),sT=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,aT=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,lT=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,cT=/^\s*\.\s*write_(?:text|bytes)\s*\(/,dT=/(?:^|[^\w$.])open\s*$/,uT=/^[bt]*[awx][abtwx]*$/,mT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function fT(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=jn(e.masked,t.tokenStart),i=dn(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(lT.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&cT.test(e.masked.slice(Go(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(mT.test(a))return!0;if(!dT.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&uT.test(l.text)&&/^[,)]/.test(e.masked.slice(dn(e.masked,l.tokenEnd)))}function pT(e,t){let n=jn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[jn(e,n+1-r.length)];return o==="{"||o===","}function gT(e,t){let n=jn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||qP.test(r)}function hT(e){let t=Ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var yT={python:"#",javascript:"/"};function CT(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return hg(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function hg(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===yT[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(bP.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&vT(e,s))return null;let c=n==="python"?bT(e,s):"",d=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+d.length,u=l==="`"||/[fF]/.test(c),m=s-c.length,p=u?ST(e,m,f,d,n,r):ET(e,f,d);if(p===null)return null;if(!u){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&EP.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+d.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+d.length),s=p+d.length-1}return o?null:e.length}function ST(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let d=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(d===`
-`||d==="\r"))return null;let f=o==="python"&&(d==="{"||d==="}")&&e[c+1]===d;if(!f&&e.startsWith(s,c)){let p=hg(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=d==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function bT(e,t){return SP.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ET(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
-`||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function vT(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function RT(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(nP.has(n.toLowerCase()))return!0;let o=yg(n);if(!o.some((i)=>rP.has(i)))continue;if(o.length>1)return!0;if(e[jn(e,r)]===".")return!0;if(e[dn(e,r+n.length)]==="(")return!0}return!1}function yg(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function jn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function dn(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function _T(e,t,n,r,o,i){return TT(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Vn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...wT(a,r)?xT(a,r).map((l)=>({target:l,cwd:o})):[]]})}function wT(e,t){let n=qo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||he(ct(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ct(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xT(e,t){return qo(e).flatMap((n)=>n.kind==="word"?[ct(n.text,t)]:n.kind==="redirection"&&n.target?[ct(n.target,t)]:[]).flatMap(Ll)}function Ll(e){let t=PT(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||AT(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function AT(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function PT(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function TT(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(ir(o,n))continue;if(Cg(e,r,n)){let i=IT(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=kT(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function IT(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(ir(i,n))continue;if(Cg(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function kT(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cg(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function OT(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===pP)o=!0;if(hP.has(f))r=!0;if(u!==void 0){if(f===Vp)t.push(u);continue}if(CP.has(f)){let m=e[l+1];if(f===Vp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(gP.has(h))r=!0;if(yP.has(h)){u=h,m=f.slice(g+1);break}}if(u==="")continue;if(m.length>0){if(u===jp)t.push(m);continue}let p=e[l+1];if(u===jp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function et(e){let t=e.findIndex((n)=>!Sg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Sg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var DT=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),MT=".env.",NT=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),LT=[".env.example.",".env.sample."];function WT(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function GT(e){return e.length>0&&!/\s/.test(e)}function Li(e,t,n,r){let o=bg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function bg(e,t,n,r){try{return jr(e,t,n,r)}catch(o){if(o instanceof F)throw o;return""}}var FT=/[?&][^?&=/]+=/,zT=new Set(["node_modules","__pycache__"]),$T=[["vendor","bundle"],["vendor","cache"]];function BT(e,t,n,r,o){if(WT(e))return null;let i=be(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>GT(s)||Li(e,t,r,o),c=H(qT(e,t,r,o));for(let u of Ds){let m=`~/${u.suffixParts.join("/")}`;if((tg(a,m)||tg(c,m))&&pt(u.id,n))return u.id}if(NT.has(s)||LT.some((u)=>s.startsWith(u)))return null;let d=UT(i,t,n,r,o);if(d)return d;if(DT.has(s))return null;for(let u of Os)if(s===u.basename&&pt(u.id,n))return u.id;if(s.startsWith(MT)&&pt(fo.id,n)&&l())return fo.id;for(let u of Ms)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&pt(u.id,n)&&l())return u.id}for(let u of Ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&pt(u.id,n))return u.id}if(VT(a))return null;if(!s.includes(".")&&sr.pattern.test(s)&&pt(sr.id,n))return sr.id;if(FT.test(e)&&!Li(e,t,r,o))return null;let f=KT(s,n);if(f)return f;return null}function UT(e,t,n,r,o){return po.find((i)=>{if(!pt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return G(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return G(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ur(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return G(e,be("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return G(e,s,["auth.json",".credentials.json"])||Hn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return G(e,s,["config.toml"])||a.endsWith(".config.toml")&&G(e,s,[a])}case"secret.cli.gemini":return G(e,oe(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[oe(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return G(e,oe(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ur(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>G(e,be(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return G(e,s,["config.json"])||Hn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return G(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return G(e,s,["server.token"])||Hn(e,s,["credentials"])||Hn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||G(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||G(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=oe(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return G(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&G(e,s,[a])||c.some((d)=>Ur(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[oe(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||G(e,s,["config.json"])||(c?.trim()?Ur(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>G(e,be(d,t,r,o),l))}case"secret.cli.pi":return G(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return G(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=be("~",t,r,o);return[oe(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),oe(s,".local","share","amp")].some((l)=>G(e,l,["secrets.json"]))||Hn(e,oe(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),oe(be("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>G(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ur(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=oe(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=oe(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return G(e,be("~/.cursor",t,r,o),["auth.json"])||G(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&un(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return G(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||G(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||G(e,be("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return G(e,be("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||G(e,be("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),be("~/.local/share",t,r,o)].some((s)=>G(e,oe(s,"devin"),["credentials.toml"])||Hn(e,oe(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),be("~/.config",t,r,o)].some((s)=>G(e,oe(s,"devin"),["config.json"]));default:return!1}})?.id??null}var eg=new WeakMap;function V(e,t,n,r,o){let i=eg.get(o)??new Map;eg.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=be(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function G(e,t,n){return n.some((r)=>Eg(e,oe(t,r)))}function Hn(e,t,n){return n.some((r)=>un(H(e),H(oe(t,r))))}function Ur(e,t,n,r,o){return Eg(e,be(t,n,r,o))}function Eg(e,t){return H(e)===H(t)}function oe(e,...t){return Ke([e,...t].filter(Boolean).join("/"))}function HT(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(jr(e,t,o,i));return n.some((a)=>un(s,H(jr(a,r,o,i))))}function jT(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(jr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ke(W(ue(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=H(d?Ke(W(Wi(ue(d)),o.paths,i)):l&&Ke(W(`${l}/.cc-safety-net`,o.paths,i)));if(f&&un(s,f))return!1;return n.some((u)=>{let m=zs(u);if(m&&ng.basename(s)!==H(m.name))return!1;let p=H(jr(m?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return un(s,p)&&!(m&&s===p)})}function VT(e){let t=e.split("/");return t.some((n)=>zT.has(n))||$T.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function KT(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ls)if(r===o.extension&&pt(o.id,t))return o.id;for(let o of Ws)if(o.pattern.test(r)&&pt(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function pt(e,t){return!t?.disabledRules?.includes(e)}function be(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i)return"";if(!o)return i;let s=Gl(i,o),a=Di(s)?s:Ke(Wi(t,s)),l=Ke(W(a,n.paths,r));if(!un(l,o)){if(Di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function tg(e,t){return e===t||e.startsWith(`${t}/`)}function qT(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i||!o)return"";let s=Gl(i,o),a=ng.normalize(Di(s)?s:Ke(Wi(t,s))),l=Ke(ue(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&un(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function jr(e,t,n,r){let{home:o,normalized:i}=Wl(e,n,r);if(!i)return"";let s=o?Gl(i,o):i;return Ke(W(Di(s)?s:Wi(t,s),n.paths,r))}function Wl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ke(W(ue(r),t.paths,n)):"",i=Ke(ue(YT(ct(e,t))));return{home:o,normalized:i}}function YT(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return YA(e)}catch{return e}}function Gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return oe(t,e.slice(2));return e}function ZT(e){if(process.platform==="win32")return!0;return qA.parse(e).root.length>1}function Ke(e){let t=e.trim(),n=(t.includes("\\")&&ZT(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function un(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function he(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class mn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var XT={findPolicyMutation:Bp,findGitMetadataMutation:um,resolveGitMetadata:tI,loadPolicySnapshot:Ud,findSensitiveTarget:ag,analyzeCommand:Dp,getModes:ss},JT=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,QT=["workdir","cwd","working_directory"];function Fl(e,t){let n={...XT,...t.dependencies},r=oI(e),o=()=>Ot("config-load",r,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),i=e.route.kind==="unknown"&&r?o():void 0,s=i?.policy.commandTools.find((T)=>T.name===e.toolName),a=s&&r?eI(e,r,s.cwd,t.environment.paths):e;if("decision"in a)return a;let l=a,c=l===e?{}:{promotedInvocation:l},d=Vr(l)?l.command:r,f=Ot("policy-protection",d,()=>am(l)),u=In(f,"input-candidate"),m=In(f,"declared-command");if(Vr(l)&&l.command?.trim()&&m?.program.status==="limited")return{stage:"command-analysis",...c,decision:{kind:"deny",reason:qe,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:l.command,segment:l.command}}};if(u?.program.status==="limited")return{stage:"command-validation",...c,decision:{kind:"deny",reason:sm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let p=Te(),g=Ot("policy-protection",d,()=>n.resolveGitMetadata([l.context.executionCwd,l.context.configCwd],t.environment)),h=Ot("policy-protection",d,()=>n.findPolicyMutation(f,t.environment,p));if(h){let T=d??h.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:$p,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:T,segment:h.target}}}}let y=Ot("policy-protection",d,()=>Wp(f,t.environment,p));if(y){let T=d??y.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:Lp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:T,segment:y.target}}}}let b=Ot("policy-protection",d,()=>n.findGitMetadataMutation(f,g,t.environment,p));if(b){let T=d??b.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:we,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:T,segment:b.target}}}}let S=i??o(),E=S.policy,A=n.getModes(E,t.environment.env),P={level:A.effectiveLevel,...nI(S),...c},k=E.secretProtection.enabled===!1?null:Ot("secret-protection",d,()=>n.findSensitiveTarget(f,E.secretProtection,t.environment,p,{strict:Vr(l)||u?.program.dialect==="powershell"?A.strict:void 0}));if(k){let T=d??k.target;return{stage:"secret-protection",...P,decision:{kind:"deny",reason:rg,intent:"hard_stop",ruleId:k.ruleId,evidence:{command:T,segment:k.target}}}}if(!Vr(l))return{stage:"non-command",...P,decision:{kind:"allow"}};if(!l.command||l.command.trim()==="")return{...Gi("command-validation",d),...P};let C=Ot("command-analysis",d,()=>Mp(()=>n.analyzeCommand(l.command,{cwd:l.context.executionCwd,shell:l.route.shell,policySnapshot:S,environment:t.environment,protectedGitMetadata:g,effectiveCapabilities:A.capabilities,worktreeMode:A.worktreeMode,budget:p,...t.trace?{trace:t.trace}:{}},rI(f),f.store),l.command,t.trace)),O=l.route.shell==="auto"&&f.store.readsAutoAsPowerShell()?()=>{let T=t.trace?.branch(),K={...Fl({...l,route:{kind:"command",shell:"posix"}},{...t,...T?{trace:T.trace}:{},dependencies:{...t.dependencies,loadPolicySnapshot:()=>S,resolveGitMetadata:()=>g}}),...c};return{decision:K.decision,withItsTrace:()=>(T?.adopt(),K)}}:void 0;if(C.decision){let T=!A.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===Ar&&!JT.test(C.decision.evidence?.segment??"")&&De(l.command)===null),K=T?O?.():void 0;if(K?.decision.kind==="deny"&&!K.decision.unverifiedByStandardMode)return K.withItsTrace();return{stage:"command-analysis",...P,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:T?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return O?.().withItsTrace()??{stage:"command-analysis",...P,decision:{kind:"allow"}}}function eI(e,t,n,r){let o=[...new Set((n?[n]:QT).flatMap((l)=>{let c=Object.getOwnPropertyDescriptor(e.input,l);return c?[c.value]:[]}))],i=o.filter((l)=>typeof l==="string"&&l.trim()!=="");if(o.length>1||i.length!==o.length)return Gi("command-validation",t);let s=i[0],a=s===void 0?e.context.configCwd:Qi(s,e.context.configCwd,r);if(!a){let l=Xn({directory:"requested",problem:"unusable",cwd:s??""});return{stage:"command-validation",decision:{kind:"deny",reason:l.reason,ruleId:l.ruleId,intent:l.intent,evidence:{command:t,segment:t}}}}return Xr(e.toolName,e.input,{kind:"command",shell:"auto"},{configCwd:e.context.configCwd,executionCwd:a},t)}function tI(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function nI(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function rI(e){return In(e,"declared-command")?.program}function oI(e){try{return er(e.input)}catch(t){let n=Vr(e)?e.command:void 0;throw new mn("policy-protection",Gi("policy-protection",t instanceof rt?void 0:n,t),t)}}function Ot(e,t,n){try{return n()}catch(r){throw new mn(e,Gi(e,r instanceof rt?void 0:t,r),r)}}function Gi(e,t,n){let r=n instanceof Zt?{reason:Ze,ruleId:"analysis.strict-unparseable"}:n instanceof F||n instanceof He?{reason:Bi,ruleId:"analysis.limit"}:{reason:Yn,ruleId:"analysis.failed-closed"};return{stage:e,decision:{kind:"deny",...r,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Vr(e){return e.route.kind==="command"}import{appendFileSync as yI,mkdirSync as CI}from"node:fs";import{isAbsolute as SI,join as Bl}from"node:path";import{lstatSync as Rg,readdirSync as iI,readFileSync as sI,rmdirSync as aI,statSync as _g,unlinkSync as lI,utimesSync as cI,writeFileSync as dI}from"node:fs";import{join as Kr}from"node:path";function vg(e,t={}){return vo($t(e,t),e.home).policy.audit.retention_days}var $l=86400000,uI=".last-prune",mI=/^\d{4}-\d{2}$/,fI=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,wg=(e)=>Math.floor(e/$l);function Ag(e,t,n=()=>new Date){try{let r=n().getTime();if(!_g(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Kr(t,uI),i=_g(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&wg(i)===wg(r))return;let s=r-vg(e)*$l,a=new Date(r).toISOString().slice(0,7);for(let l of zl(t)){if(l.isDirectory()){pI(Kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))gI(Kr(t,l.name),s)}dI(o,"",{mode:384}),cI(o,r/1000,r/1000)}catch{}}function pI(e,t,n){for(let r of zl(e)){if(!r.isDirectory()||!mI.test(r.name))continue;let o=Kr(e,r.name);for(let i of zl(o)){if(!i.isFile())continue;let s=fI.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+$l;if(!Number.isFinite(a)||a>=t)continue;Pg(Kr(o,i.name))}if(r.name!==n)xg(o)}xg(e)}function gI(e,t){try{let n=Rg(e);if(n.mtimeMs>=t)return;let r=sI(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(hI);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Rg(e).mtimeMs!==n.mtimeMs)return;Pg(e)}catch{}}function hI(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function zl(e){try{return iI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Pg(e){try{lI(e)}catch{}}function xg(e){try{aI(e)}catch{}}var bI="2.6.13",EI=1e4,vI=2000,RI=256,_I=32768;function wI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function xI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ul(e,t,n,r,o,i,s={}){let a=wI(t);if(!a)return;let l=PI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Fi(gt(n),s.failureStage?Number.POSITIVE_INFINITY:EI),f=Fi(gt(r),vI),u=s.toolName?Fi(gt(s.toolName),RI):void 0,m=i===null?void 0:Fi(gt(i),_I),p=Bl(l,xI(m?.value??null),c.slice(0,7));CI(p,{recursive:!0,mode:448});let g=Bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??as)(),v:bI,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};yI(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Ag(e,l,s.now)}catch{}}function Fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function AI(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&SI(n)?n:null}function PI(e){let t=AI(e);return t?Bl(t,".cc-safety-net","logs"):null}function Ig(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Tg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Tg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Tg(e){return"command"in e?e.command??"":""}function kg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ul(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Og(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ul(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Mg(e,t,n){try{let r=Fl(t,{environment:e,...n.guard});return Dg(e,t,r,n),r}catch(r){if(!(r instanceof mn))throw r;throw Dg(e,t,r.evaluation,n,!(r.cause instanceof rt),{stage:r.stage,errorCode:TI(r.cause)}),r}}function Dg(e,t,n,r,o=!0,i){kg(e,Ig(n.promotedInvocation??t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function TI(e){if(e instanceof F)return q[e.kind].errorCode;if(e instanceof rt)return"tool-input-limit";if(e instanceof He)return"structural-shell-syntax-limit";if(e instanceof Zt)return"unparseable-command";return"unexpected-error"}function Dt(e,t={}){return{malformed:!0,denial:Zn(t),cwd:e}}function Hl(e,t){return{malformed:!0,denial:Xn(e,t),cwd:e.cwd}}function Ng(e,t={}){return(n,r)=>{try{return II(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Zn())}}}function II(e,t,n,r){let o=kc();if(n.cancelled?.(t))return n.block(Zn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Og(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=ql(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Mg(o,i,{guard:{auditAllowed:Nc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof mn))throw l;if(ot(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Zl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Lg="exec",kI=new Set(["auto","gateway"]);function Wg(e){e.on("before_tool_call",OI(e),{matcher:[Lg],priority:50})}function OI(e,t={}){return Ng({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>DI(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>NI(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function DI(e,t,n,r){if(!e||typeof e!=="object")return Dt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Dt(null);if(o!==Lg)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Dt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Dt(null,{toolName:o});if(s.host!==void 0&&!kI.has(s.host))return Dt(null,{command:a,toolName:o});let l=MI(n,t.agentId);if(!l)return Dt(null,{command:a,toolName:o});let c=Ji(".",[l],r);if(!c)return Hl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let d=s.workdir;if(d!==void 0&&(typeof d!=="string"||d.trim()===""))return Dt(c,{command:a,toolName:o});let f=typeof d==="string"?d:".",u=Ji(f,[c],r);if(!u)return Hl({directory:"requested",problem:Cc(f,c,r),cwd:f},{command:a,toolName:o});return Xr(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:u},a)}function MI(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function NI(e){return{block:!0,blockReason:Yl(e)}}var RG={...Kl,register:Wg};export{RG as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Fr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(R(e)):e.provenance==="literal"}function Bn(e){return e?R(e):""}function Ri(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function ll(e,t){return sl(Be(e,"posix"),t)}function zr(e){return ll(e,new Set(Array.from(e.matchAll(wf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function sl(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(sl(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>sl(o,n))||Of(r.words,n))return!0;Lw(r,n)}return!1}function Of(e,t){let n=e.findIndex((s)=>Me(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Gr(r,t))return!0;let o=N(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Rf(e[s],t)}if(Q.has(o)){let s=e.slice(n),a=s.map((d)=>d.text),l=Oe(a),c=l.commandIndex??l.scriptIndex;return!qe(a)&&c!==null&&Rf(s[c],t)}let i=Ow(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Of(e.slice(i),t)}function Ow(e,t,n){let r=N(e[t]?.text??"");if(r==="command")return Dw(e,t+1);if(r==="exec")return Mw(e,t+1);if(r==="env")return Nw(e,t+1,n);return null}function Dw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Mw(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Nw(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Gr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Gr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Me(i))continue;return r}return null}function Lw(e,t){if(!e.words.every((n)=>Me(n.text)!==null))return;for(let n of e.words){let r=Me(n.text);if(!r)continue;if(Gr(n,t))t.add(r.name)}}function Gr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(wf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(ww.test(o)||t.has(o))}))}function Rf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Gr(e,t))}var cl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",dl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Ww="__CC_SAFETY_NET_XARGS_INPUT__",wi="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",xi="rm",Gw=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Fw=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,zw=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,$w=/^(?:[0-9]+|[@*])$/;function Nf(e,t){let n=e.map(R),{childStart:r,replacementToken:o}=an(n),i=n.slice(r),s=v("xargs.shell-dynamic",dl);if(Uw(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of Ke(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=$f(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Ff(l,o),u=t.analyzeChild(l,{...rn(a,t),dynamicInput:d,dynamicSourceInput:f||Wf(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",cl)});if(u)return u;let m=Bw(l,o,t.policy?.rules??[],T(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,Ww]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...rn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=ut(l,t.policy?.rules??[]);if(p)return p}return null}function Bw(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=ut([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=N(e[0]??"");if(!n.some((i)=>N(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Lf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Ef(e,r,t.length,n);return o===null?[]:[o]}function Wf(e,t,n,r,o,i,s){if(Q.has(t)){if(qe(e))return!1;if(n!==null&&Hw(e,n,s))return!0;let a=Le(e);if(!a){let l=pt(X(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Gf(a,n,s))return!0;if(De(a))return!0;return jw(a,n,r)}if($e(t))return Df(e,n,Bo,$u(t));if(ke.has(t))return Df(e,n,Ba,zm);if(t==="eval"){let a=vi(X(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Vw(e,n,i);if(t==="git"){let a=Ae(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Gn.has(a.subcommand.toLowerCase())&&zf(a.rest,n).some((l)=>l.includes(n))}return!1}function Gf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return De(i)===null&&n(i)===null}function Df(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,wi]).sources.some((a)=>a.value===wi);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${wi}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${wi}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Lf(l,t,a))));return bi(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Uw(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Ke(e,n),(i)=>i.head)),o=t===null?[...e,xi]:e.map((i,s)=>s===0?i:i.replaceAll(t,xi));return Array.from(Ke(o,n)).some((i)=>i.head===xi&&!r.has(xi))}function Ff(e,t){return zf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function zf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function $f(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Hw(e,t,n){let r=Oe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Gf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Lf(a,t,s).some((d)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,d):m),u=Oe(f);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(f[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(f[u.scriptIndex]??"").includes(d)})}))}function jw(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Gw))if(Mf(o,r))return!0;for(let o of e.matchAll(Fw))for(let i of(o[1]??"").matchAll(zw))if(Mf(i,r))return!0;return ll(e,r)}function Mf(e,t){let n=e[1]??e[2];return n!==void 0&&($w.test(n)||t.has(n))}function Vw(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(tt(s)){let l=Ln(e,i);i=l.nextIndex-1;for(let c of Ke(l.tokens,{environment:n,cwd:void 0})){let d=$f(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Ff(c.tokens,t)||Wf(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=ft(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function an(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var $r="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Br="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",qw="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Yw="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Pi=/\{[^{}\s]*\}/g,Bf=/\{\}|\{-?\d+\}/g,Uf=/[\s;&|<>()$`\\"']/,Zw=["e","f","source","file","-e","-f","--source","--file"],Xw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Jw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Qw=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Hf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),ex=new Set(["--workdir","--wd"]),jf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function We(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function qf(e){return We([...e],(t)=>De(t))}function Yf(e,t){let n=e.map(R);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Un(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=ap(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:f}=o;if(c){let p=Un(t);if(p)return p;let g=qf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=ax(t);if(p)return p}if(d!==void 0&&a){let p=Un(t);if(p)return p}let u=lx(d,t.cwd,t.environment.paths);if(u===null){let p=Un(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(f){if([...Ke(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(fl)){let g=Un(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=tp(m.envAssignments,m.cwd,a);return We(p,(h)=>t.analyzeNested(h,g))}return We(Ke(i,m),(p)=>tx(p,o,t,m))}function tx(e,t,n,r){let{templateHasPlaceholder:o,runsRemotely:i,usesStdin:s}=t,a=e.tokens,l=[...e.envAssignments.values()];if(l.some(ip)){let E=Un(n);if(E)return E}let c=qf(l);if(c)return c;let d=l.some(z),f=o||d,u=s&&f,m=tp(e.envAssignments,e.wrapperCwd,i||u),p=f?{...m,worktreeMode:!1}:m,g=a.join(" "),h=z(g.split(/[ \t\n=]/,1)[0]??""),y=!t.quotesCommand&&(h||a.some((E)=>Uf.test(E))),b=h||Uf.test(a[0]??""),S=y&&b&&t.jobs.length>0?null:nx(e,t,n,r,p,d);if(S||!y)return S;return Zf(z(g)?g:`${g} {}`,!h,e,t,n,r,p)}function nx(e,t,n,r,o,i){let{jobs:s,templateHasPlaceholder:a,runsRemotely:l,usesStdin:c}=t,d=e.tokens,f=a||i;if(Q.has(e.head)){let m=()=>{if(!a||s.length===0)return null;return We(s,(h)=>n.analyzeChild(Ai(d,h,n.budget),rn(e,r)))};if(qe(d))return m();if(pi(d))return At();let p=Le(d);if(p){if(sp(p)){let S=kt(n);if(S)return S;if(s.length===0)return null;return We(s,(E)=>n.analyzeNested(rp(p,E,n.budget),o))}if(z(p))return Zf(p,!1,e,t,n,r,o);let h=!i&&(!a||s.length>0)?(s.length>0?s:[void 0]).map((S)=>_i(X(S===void 0?d:a?d.map((E)=>np(E,S)):[...d,...S]),p)):[];if(h.some((S)=>S.kind==="dynamic")){let S=kt(n);if(S)return S}let y=h.flatMap((S)=>S.kind==="literal"?[S.source]:[]);if(y.length>0)return n.budget.charge("derivedTokens",y.length),We(y,(S)=>n.analyzeNested(S,o));if(zr(p)){let S=kt(n);if(S)return S}let b=n.analyzeNested(p,o);if(b)return b;if(f)return kt(n);return null}let g=pt(X(d));if(g.kind==="dynamic"||g.kind==="literal"&&z(g.source))return kt(n)??m();if(g.kind==="literal")return m();if(s.length>0){let h=kt(n);if(h)return h;let y=m();if(y)return y;if(a)return null;let b=s.flatMap((S)=>S[0]===void 0?[]:[S[0]]);return n.budget.charge("derivedTokens",b.length),We(b,(S)=>n.analyzeNested(S,o))}if(f||c)return kt(n)??m();return null}if(e.head==="rm"&&mt(d)){if(a&&s.length>0)return We(s,(p)=>ul(Ai(d,p,n.budget,Bf),e.cwd,r));if(s.length>0)return We(s,(p)=>ul(Kf(d,p,n.budget),e.cwd,r));let m=ul(d.flatMap((p,g)=>{if(g===0||!z(p))return[p];return p.startsWith("-")?[p.replace(Bf,"")]:[]}),e.cwd,r);if(m)return m;return ep(n)}let u=s.length>0?s:[void 0];return We(u,(m)=>{let p=m===void 0?d:a?Ai(d,m,n.budget):Kf(d,m,n.budget),g=v("parallel.shell-dynamic",Br),h=c&&e.head==="find"?sx(p,r):null,y=Jf(p,c,n)??h?.customResult??null,b=N(e.head),S=c&&(b==="rm"&&ml(p)||b==="xargs"&&Qf(p)||h?.rmOptions===!0),E=c&&(S||h?.executedSource===!0||h===null&&Xf(p,b)),A=n.analyzeChild(p,{...rn(e,r),worktreeMode:l||c||f?!1:n.worktreeMode,dynamicInput:c||f,dynamicRmInput:S,dynamicSourceInput:y!==null||E,shellDynamicMatch:g,dynamicSourceMatch:g,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",$r)});if(E){let P=T(g,n.policy);if(P)return P}return A??y??ut(p,n.policy?.rules??[])})}function Zf(e,t,n,r,o,i,s){if(r.jobs.length>0)return We(r.jobs,(c)=>o.analyzeNested(rp(e,t?c.map(Ri):c,o.budget),s));let a=Lr(e);if(a?.[0]&&N(a[0])==="rm"&&mt(a)){let c=ep(o);if(c)return c}return(a?o.analyzeChild(a,{...rn(n,i),dynamicInput:r.usesStdin,shellDynamicMatch:v("parallel.shell-dynamic",Br),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",$r)}):null)??o.analyzeNested(e,s)}function Xf(e,t){if(z(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Q.has(t))return ix(e);if(t==="git")return rx(e);if(t==="find")return!0;if(ke.has(t))return Vf(e,Zw,Mr);if($e(t))return Vf(e,Xw,$o);return!1}function ml(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(z))return t===-1;return n.some((o)=>z(o)&&(o.startsWith("-")||sp(o)))}function rx(e){if(ox(e))return!0;let t=Ae(e);if(t.subcommand===null||z(t.subcommand))return!0;if(!Gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(z))return n===-1;return r.some(z)}function ox(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(z(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(z(n))return!0;continue}if(z(n))return!0}return!1}function ix(e){if(qe(e))return!1;let t=Le(e);if(t!==null)return z(t);let n=pt(X(e));if(n.kind==="literal")return z(n.source);if(n.kind==="dynamic")return!0;return!e.some(z)}function Vf(e,t,n){let r=n(e);if(r.some((o)=>z(o.value)))return!0;if(!e.some(z))return n([...e,jf]).some((o)=>o.value===jf);return bi(r,t,(o)=>n(e.map((i)=>np(i,[o]))))}function Jf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>N(i.command)===N(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(z))return kt(n);return We(o,(i)=>ut([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function sx(e,t){let n={customResult:null,executedSource:!e.some(z),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(z))return;for(let a of Ke(i,t))n.executedSource||=Xf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&ml(a.tokens)||a.head==="xargs"&&Qf(a.tokens),n.customResult??=Jf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=z(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(tt(a)){i=[],n.executedSource||=z(a);continue}let l=ft(a);if(l>0){o=l,n.executedSource||=z(a);continue}n.executedSource||=z(a)}return s(),n}function Qf(e){let t=e.slice(an(e).childStart);return N(t[0]??"")==="rm"&&ml(t)}function Ti(e,t){return(n)=>T(v(e,t),n.policy)}var kt=Ti("parallel.shell-dynamic",Br),ax=Ti("parallel.command-stream-dynamic",qw),Un=Ti("parallel.command-stream-dynamic",Yw),ep=Ti("parallel.rm-recursive-force-dynamic",$r);function ul(e,t,n){return T(Ei(X(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Mn(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function tp(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function np(e,t){return e.replace(Pi,(n)=>op(n,t))}function Ai(e,t,n,r=Pi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=op(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function rp(e,t,n){return Ai([e],t,n)[0]??""}function Kf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function op(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function z(e){return e.search(Pi)!==-1}function ip(e){if(fl(e))return!0;for(let t of e.matchAll(Pi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function fl(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function sp(e){return/^\{[^{}\s]*\}$/.test(e)}function lx(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Kw(e))return null;try{return _t(t??e,e,n)}catch{return null}}function ap(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=!1,d=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=ja(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=ja(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],y=g.indexOf("="),b=y===-1?g:g.slice(0,y),S=y===-1?void 0:g.slice(y+1);if(g==="--dry-run"){c=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){d||=(g==="-I"?h:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){d=!0,t+=2;continue}if(b==="--replace"||g.startsWith("-i")&&g.length>2){let E=b==="--replace"?S:g.slice(2);d||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||Qw.has(b)){d=!0,t+=S===void 0?2:1;continue}if(g==="-q"||g==="--quote"){s=!0,t++;continue}if(g==="--pipe"||g==="--pipepart"){a=!0,t++;continue}if(b==="--env"){d=!0,t+=S===void 0?2:1;continue}if(Hf.has(b)||g.startsWith("-S")&&g.length>2){i=!0,t+=Hf.has(g)?2:1;continue}if(ex.has(b)){d=!0;let E=S??h;if(E===void 0||E===":::"||E==="--"){t++;continue}l=E,t+=S===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&S!==void 0){t++;continue}if(Jw.has(g)){if(h===void 0||h===":::"||h==="--"){d=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}d||=n.some(c?fl:ip);let f=[];if(o!==-1){let g=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){f.push(g),g=[];continue}if(y!==void 0)g.push(y)}f.push(g)}d||=f.length>1;let u=cx(f),m=n.some(z),p=n.length===0&&o===-1;return{template:n,jobs:u,childStart:r,templateHasPlaceholder:m,runsRemotely:i,quotesCommand:s,usesStdin:a||o===-1,readsCommandsFromInput:p,unsupported:d,workdir:l,dryRun:c}}function cx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new G("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new G("derivedTokens");o.push([...i,s])}t=o}return t}function lp(e){return ap(e).childStart}var dx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ii="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function gl(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function pl(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function dp(e,t,n,r,o=!1,i){let a=(fr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ie(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",dx):null;return T(a,i)??up(e,t,n,o,i)}function up(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>gl(a)?[l]:[]);if(i.length===0)return null;let s=N(t[0]?.text??"");if(s==="git"){let a=wn(e,t),l=mx(a);if(ie(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return T(v("shell.dynamic-structure",Ii),o);if(T(Si(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((f,u)=>u>l&&R(f)==="--");if(ie(o,"shell.dynamic-structure",r)&&c&&Gn.has(c)&&i.some((f)=>f>l&&(d===-1||f<d)))return T(v("shell.dynamic-structure",Ii),o);return null}if(s==="find")return ie(o,"shell.dynamic-structure",r)&&fx(t)?T(v("shell.dynamic-structure",Ii),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&R(c)==="--"),l=mt(t.map(R));return ie(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(v("shell.dynamic-structure",Ii),o):null}if(s==="xargs")return cp(e,t.slice(an(t.map(R)).childStart),"xargs",n,r,o);if(s==="parallel")return cp(e,t.slice(lp(t.map(R))),"parallel",n,r,o);return null}function cp(e,t,n,r,o,i){if(t.length===0)return null;let s=ux(t,r);if(fr(e,s)){let l=T(v(`${n}.shell-dynamic`,n==="xargs"?dl:Br),i);if(l)return l}let a=up(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>gl(l)&&pl(l)))return T(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?cl:$r),i);return null}function ux(e,t){let n=qt(e,t),r=n.rewritten?X(n.words.map(R)):n.words,o=r[0];return o&&R(o)==="busybox"?r.slice(1):r}function mx(e){let t=1;while(t<e.length){let n=e[t],r=n?R(n):"";if(Re.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function fx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=gl(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||pl(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||pl(s)))return!0;continue}if(t=!0,a)return!0;let l=ft(s.text);if(l>0){n=l;continue}if(tt(s.text))o=!0,r=!0}return!1}function hl(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!xn(t[n.tokenIndex],n.value)})}var mp="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",px="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",gx="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",hx="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",yx="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",Cx="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",Sx={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:hx},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:pe},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:gx},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:Cx},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:mp},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:px},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:mp}},bx=/^\/\/?[ck]$/i,fp=/[&|]+/,Ex=/(?:"[^"]*"|[^\s"])+/g,vx=/[\^%!]/,_x=/\\"./s,Rx=/(^|\/)[*.]*\*[*.]*$/,wx=/^"?[\\/]+[?.][\\/]/,xx=new Set(["rmdir","rd","del","erase"]),Ax=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,Px=/\/s(?!\w)/i,Tx=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function pp(e,t){let n=e.map(R),r=n.findIndex((u)=>bx.test(u));if(r===-1)return null;let o=n.slice(r+1).join(" "),i=/^".*"$/s.test(o)?o.slice(1,-1):o,s=i.split(fp).map((u)=>{let m=u.match(Ex)??[],p=m.findIndex((h)=>xx.has(h.replace(/^@/,"").toLowerCase())),g=p===-1?[]:m.slice(p);return{piece:u,tokens:m,deleteTokens:g,recursiveDelete:g.slice(1).some((h)=>h.startsWith("/")&&h.toLowerCase().split("/").includes("s"))}}),a=s.filter((u)=>u.recursiveDelete),l=a.length>0||Ax.test(i)&&Px.test(i);if(l&&(i.includes("\\\"")||t.gitBashEscapesBodyQuotes&&i.includes('"')||t.powerShellRawWords.some((u)=>_x.test(u))||a.some((u)=>u.tokens.some((m)=>wx.test(m)))))return v("cmd.recursive-delete-escaped-quote",yx);let c=Ne({...t,allowPaths:t.policy?.destructiveCommandAllowPaths}),d=s.reduce((u,m)=>u??(m.recursiveDelete?Ix(m.deleteTokens,c,t.policy):t.analyzeNested(m.piece)),null),f=l&&(a.length===0||vx.test(i)||Tx.test(i)||i.includes('"')&&fp.test(i));return d??(f?At():null)}function Ix(e,t,n){return e.slice(1).filter((r)=>!r.startsWith("/")).reduce((r,o)=>r??T(en(ge(Or(o.replaceAll('"',"")).replace(Rx,"$1*"),t),t,n,Sx),n),null)}var kx="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",Ox=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,Dx=/^-(?:executionpolicy|ep)$/i,Mx=/^-(?:command|c)$/i,Nx=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,Lx="encodedcommand",Wx=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,Gx=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,Fx=/[$`]/,zx="--%";function gp(e,t){let n=e.map(R),r=n.every((i,s)=>s===0||i!==zx&&$x(e[s],i))?Cl(n):void 0;if(r!==void 0)return t(r);if(n.some(Bx))return At();let o=n.join(" ");return Wx.test(o)&&Gx.test(o)?v("powershell.nested-recursive-delete-unread",kx):null}function Cl(e){let t=yl(e,1),n=t===void 0?[]:e.slice(t+1);return n.length>0?n.join(" "):void 0}function yl(e,t){let n=e[t]??"";if(Mx.test(n))return t;if(Ox.test(n))return yl(e,t+1);return Dx.test(n)?yl(e,t+2):void 0}function $x(e,t){return e?.provenance==="unknown"?!Fx.test(t):xn(e,t)}function Bx(e){let t=Nx.exec(e)?.[1]?.toLowerCase();return t!==void 0&&(t==="ec"||Lx.startsWith(t))}var Ux="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",Hx="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",jx=/[efBMT@]/,Vx=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function hp(e,t){let n=[],r=!1,o=!1,i=1;while(i<e.length){let c=e[i],d=c?R(c):"";if(i++,!c)continue;if(o||d==="-"||!d.startsWith("-")){n.push(c);continue}if(d==="--"){o=!0;continue}if(d.startsWith("--")){if(r||=d==="--del"||d.startsWith("--dele"),!d.includes("=")&&Vx.has(d.slice(2)))i++;continue}if(d.slice(1).search(jx)===d.length-2)i++}let s=n.slice(1).filter((c)=>!Kx(R(c)));if(!r||s.length===0)return null;let a=Ne({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),l=s.flatMap((c)=>{let d=tn(c);return(d.expandedTargets??[R(c)]).map((f)=>ge(f,a,{targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}).kind)});if(l.includes("root_or_home_target"))return v("rm.recursive-force-root-or-home",Hx);if(l.includes("git_metadata_target"))return v("rm.git-metadata",pe);if(li(s,t))return null;return T(v("rsync.delete",Ux),t.policy)}function Kx(e){return!/[$`]/.test(e)&&/^[^/]*:/.test(e)}var Cp=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ei(e.words,ki(e))},{heads:new Set(["cmd"]),analyze:(e)=>pp(e.words,{...ki(e),powerShellRawWords:e.options.commandView?.dialect==="powershell"?e.options.commandView.words.map((t)=>t.raw):[],gitBashEscapesBodyQuotes:e.options.commandView?.dialect!=="powershell",analyzeNested:(t)=>Ot(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(e)=>gp(e.parsedWords,(t)=>Ot(e.options.analyzeNested(t,{effectiveCwd:e.effectiveCwd,envAssignments:e.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(e)=>Si(e.words,Sl(e))},{heads:new Set(["find"]),analyze:(e)=>Ym(e.words,{...ki(e),envAssignments:e.envAssignments,analyzeTokens:e.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(e)=>hp(e.words,{...ki(e),envAssignments:e.envAssignments})},{heads:new Set(["xargs"]),analyze:(e)=>Nf(e.words,{...yp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ot(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Yf(e.words,{...yp(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ot(e.options.analyzeNested(t,n))})}];function yp(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ot(e){return e?{id:e.ruleId,reason:e.reason,intent:e.intent??"manual_only"}:null}function ki(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Jt(e.envAssignments,e.options.environment),trustedTmpdirValue:Mn(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget}}function Sl(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function vp(e){return Cp.find((t)=>t.heads.has(e))?.analyze}function jn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((D)=>o==="posix"?R(D):D.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,u=Vo(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=qt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let w=[...p,...i(m.words)].join(" "),D=De(w);if(D)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:D.reason}),ye(D);if(n.strict)return he(r);let B=Ko(p,i(m.words));if(B){n.budget.charge("derivedTokens",B.length);let ce=n.analyzeNested(B.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(ce)return ce}}let g=m.rewritten?X(i(m.words)):wn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let w=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),S=h[0];if(!S)return null;if(nn(S))throw new G("wrapperPeelIterations");let E=N(S),A=m.cwd===null?void 0:m.cwd??d,P=m.cwd===null?void 0:f,k=m.cwd===void 0?n.effectiveCwd:m.cwd,C=m.cwd===void 0?n.effectiveCwd:null,O=s?s.allowTmpdirVar:!kr(b,n.environment),I=dp(o,m.words,n.environment,t===0,n.strict,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:I.reason}),ye(I);let J=ui(h,n.policy);if(J){for(let w of[J.childIndex,...J.alternativeChildIndices]){bp(y.wrapperNormalizationBudget);let D=g.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:J.wrapper,output:i(D)});let B=jn(D,t,{...y,effectiveCwd:k,envAssignments:b});if(B)return B}return null}let Se=l?void 0:E==="eval"?vi(g):E==="trap"&&!a?Pf(g):void 0;if(a&&s&&E==="eval"){if(Se?.kind==="dynamic")return Hn(s,n.policy);if(Se?.kind==="literal"){let w=n.analyzeNested(Se.source,{effectiveCwd:k,envAssignments:b});if(w)return w}return Vn(s,n.policy)}if(Se?.kind==="dynamic"&&(n.strict||!n.commandView||!al(n.commandView)))return he(r);if(Se?.kind==="literal"){r?.recordSegment({type:"recurse",reason:E==="eval"?"shell-eval":"shell-trap",innerCommand:Se.source,depth:t+1});let w=n.analyzeNested(Se.source,{effectiveCwd:k,envAssignments:b,functionDefinitions:n.functionDefinitions});if(w)return w}if(a?Q.has(E):Rp(S,E)){if(qe(h))return null;if(pi(h))return he(r);if(a&&s){let w=Le(h);if(w){if(s.dynamicSourceInput??s.dynamicInput){let B=Hn(s,n.policy);if(B)return B}if(zr(w)){let B=Hn(s,n.policy);if(B)return B}return n.analyzeNested(w,{effectiveCwd:k,envAssignments:b})}let D=pt(g);if(D.kind==="dynamic")return Hn(s,n.policy);if(D.kind==="literal")return s.dynamicSourceInput?Hn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Hn(s,n.policy):null}if(l){let w=Le(h),D=w?n.analyzeNested(w,{effectiveCwd:k,envAssignments:b}):pt(g).kind==="dynamic"?he(r):null;if(D)return D}if(s===void 0){let w=Xx(h,b,k,n,r,t);if(w)return w;let D=Le(h);if(D){let pn=_i(g,D);if(pn.kind==="dynamic")return he(r);let gn=pn.kind==="literal"?pn.source:Tf(g,D),Zl=eA(gn);r?.recordSegment({type:"shell-wrapper",wrapper:E,innerCommand:Zl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Zl,depth:t+1});let Xl=n.analyzeNested(gn,{effectiveCwd:k,envAssignments:b});if(Xl)return Xl;return zr(gn)?he(r):null}let B=pt(g,n.environment.home,n.strict?void 0:Fn(n.shellAssignments??new Map,{home:n.environment.home,cwd:C}));if(B.kind==="dynamic")return he(r);if(B.kind==="literal")return Ur(B.source,k,b,n,r,t);let ce=If(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ce.kind==="dynamic")return he(r);if(ce.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ce.source,depth:t+1}),n.analyzeNested(ce.source,{effectiveCwd:k,envAssignments:b})}}if(!s&&(E==="source"||E===".")){let w=h[1]==="-p"?2:null;if(w!==null){let gn=n.commandView?g[w]:void 0;if(!gn)return null;if(gn.provenance!=="literal")return he(r)}let D=w===null?1:3,B=h[D]==="--"?D+1:D,ce=n.commandView?g[B]:void 0;if(!ce)return null;let pn=Sp(ce,n,C);if(pn!==null)return Ur(pn,k,b,n,r,t);if(n.strict||!n.commandView||!al(n.commandView))return he(r)}let j=g[0];if(!s&&j&&S.includes("/")&&n.literalHeredocFiles?.size){let w=Sp(j,n,C),D=w===null?null:Ur(w,k,b,n,r,t,!1,!0);if(D)return D}if(ke.has(E)&&!l){if(!s&&n.strict&&hl(Mr(h),g))return he(r);let w=$m(h,(B)=>Ot(n.analyzeNested(B,{effectiveCwd:k,envAssignments:b}))),D=T(w,n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:D.reason}),ye(D)}if($e(E)&&!l){if(!s&&n.strict&&hl($o(h),g))return he(r);let w=zu(h);if(a&&s)return Yx(E,w,k,b,n,s);if(w){let D=ie(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:E,codeArg:w,paranoidBlocked:D}),D){let ce=T(v("interpreter.one-liner-paranoid",_r),n.policy);if(ce)return ye(ce)}if(va(E,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let B=n.analyzeNested(w,{effectiveCwd:k,envAssignments:b});if(B&&!_p(B,w))return B;if(Rr(w,void 0,!n.strict)){let ce=T(v("interpreter.dangerous-command",Tn),n.policy);if(ce)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:Tn}),ye(ce)}r=void 0}}if(E==="busybox"&&h.length>1)return bp(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),jn(g.slice(1),t,{...y,effectiveCwd:k,envAssignments:b});let fe=s?null:T(Lu(E,h),n.policy);if(fe)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:fe.reason}),ye(fe);let Z=r===y.trace?y:{...y,trace:r},ne={words:g,parsedWords:m.words,head:E,cwd:A,originalCwd:P,envAssignments:b,allowTmpdirVar:O,dynamicArguments:m.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:k,options:Z,analyzeChildTokens:(w,D)=>a&&s?El(w,t,Z,{...s,cwd:D??void 0,effectiveCwd:D??void 0}):Ot(jn(X(w),t+1,{...Z,child:void 0,commandView:void 0,effectiveCwd:D,envAssignments:b}))??ut(w,Z.policy.rules),analyzeChild:(w,D)=>El(w,t,Z,D)},Pe=s&&(E==="xargs"||E==="parallel")?void 0:vp(E);if(E==="rm"||E==="xargs"||E==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:O});let Fe=r&&E==="git"?bf(ne.words,Sl(ne)):void 0,ht=Ep(Fe?Fe.match:Pe?.(ne)??null,n.policy);if(r)tA(ne,ht,Fe?.relaxation??null);if(ht)return ye(ht);if(a&&s&&(E==="rm"||E==="rmdir")){if(!(E==="rm"&&(mt(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Vn(s,n.policy):null)??Zx(s,n.policy)}let Vi=Pe!==void 0&&!rA.has(E),Xe=!s&&!Vi&&!fo.has(E),Ki=r&&Xe?[]:void 0;if(Xe)for(let w=1;w<h.length;w++){let D=h[w];if(!D)continue;Ki?.push(D);let B=Ep(qx(h,w,t,Z,A,P,k,b),n.policy);if(B)return r?.recordSegment({type:"fallback-scan",tokensScanned:Ki??[],embeddedCommandFound:N(D)}),ye(B)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Ki??[]}),l&&s&&!s.wrappedByTransparent)return null;let Xr=ut(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Xr,reason:Xr?.reason}),Xr)return ye(Xr);return a&&s?Vn(s,n.policy):null}function El(e,t,n,r){return Ot(jn(X(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function qx(e,t,n,r,o,i,s,a){for(let l of Ke(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=N(c);if(Rp(c,d)||vp(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=El(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!kr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function Yx(e,t,n,r,o,i){if(!t)return Vn(i,o.policy);if(ie(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(v("interpreter.one-liner-paranoid",_r),o.policy);if(a)return ye(a)}if(va(e,t))return Vn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!_p(s,t))return s;if(Rr(t,void 0,!o.strict)){let a=T(v("interpreter.dangerous-command",Tn),o.policy);if(a)return ye(a)}return Vn(i,o.policy)}function _p(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(ei)||e.reason===et)&&!po(t);return n||r}function Hn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?ye(n):null}function Vn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?ye(n):null}function Zx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?ye(n):null}function Xx(e,t,n,r,o,i){let s=qm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Ur(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ur(a,n,t,r,o,i,!0)}function Sp(e,t,n){let r=t.environment.home,o=zn(e,r);if(o!==null)return o;if(e.provenance==="literal")return e.text;return t.strict?null:Ye(e,Fn(t.shellAssignments??new Map,{home:r,cwd:n}))}var Jx=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function Ur(e,t,n,r,o,i,s=!1,a=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let l=vr(e,t,r.environment.paths,r.budget),c=l?r.literalHeredocFiles?.get(l):void 0;if(c===void 0)return s?he(o):null;if(a&&c.startsWith("#!")&&!Jx.test(c))return null;if(r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:c,depth:i+1}),!a)return r.analyzeNested(c,{effectiveCwd:t,envAssignments:n});let d=Qx(()=>r.analyzeNested(c,{effectiveCwd:t,envAssignments:n}));return d?.intent==="stop_and_explain"?null:d}function Qx(e){try{return e()}catch(t){if(t instanceof G)return null;throw t}}function eA(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function tA(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function bp(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new G("wrapperPeelIterations");e.iterations++}function ye(e){return{reason:e.reason,ruleId:e.id,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:Ir}),ye(At())}function Rp(e,t){return Q.has(t)||e==="$SHELL"||e==="${SHELL}"||Q.has(M(t))}function Ep(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var nA=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,rA=new Set(["powershell","pwsh"]),oA=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function iA(e,t){let n=Ap(e,t);if(n.length===0)return!1;let r=n[xp(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return nA.test(e.join(" "))}function wp(e,t,n,r,o){if(e.dialect==="powershell"){let S=sA(e.words,o);if(S.kind==="none")return;if(!t||S.kind==="unknown")return null;return bl(dA(S.target),t,n.paths)}let i=e.words.map(R),s=i.some((S)=>/^CDPATH\+?=/.test(S));if(!iA(i,n))return s?null:void 0;if(!t)return null;let a=Ap(i,n,t),l=xp(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((S)=>S.length<=1||!S.startsWith("-")||S==="--");if((d===-1?c:c.slice(0,d)).some((S)=>!/^-[LP]+$/.test(S)))return null;let u=d===-1?[]:c.slice(d),m=u[0]==="--"?u.slice(1):u;if(m.length>1)return null;let p=m[0],g=r.get("HOME")||n.home;if(p===void 0)return bl(de(g),t,n.paths);let h=e.words.find((S)=>S.provenance==="variable"&&S.text===p),y=e.words.find((S)=>S.text===p&&/^~(?:\/|$)/.test(S.raw)),b=h?Ye(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return bl(de(b),t,n.paths)}function bl(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=_t(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function sA(e,t){let n=aA(e[0])?1:0,r=e[n];if(!lA(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!oA.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return cA(e.slice(n+1),t)}function aA(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function lA(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function cA(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function dA(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function xp(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Ap(e,t,n){let r=uA(e);return Rt([...r],t,n)}function uA(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var CA="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",ln="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Al(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Je}),{reason:Je,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Be(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Je}),{reason:Je,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return xl(e,n);let d=`${ei}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Mp(e,n),{reason:et,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Mp(e,n),{reason:et,segment:e,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return xl(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=lf(n.environment.env,n.envAssignments);return Mi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Mi(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let f=e.nodes[c+1],u=f?.kind==="connector"?f.operator:void 0,m=SA(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],S={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(Dt(u)&&!Dt(a))l=S;let E=Dt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Dt(a)?l??S:S,A=cn(E.connector)||cn(u);if(d.kind==="function"){let Y=h.flatMap((fe)=>{let Z=dn(fe);return Z.functionDefinitions.set(d.name,d.body),vl(fe,[Z],m,u==="&",cn(u))}),j=_l(Y,[],E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=j.states,s=j.conditionalStates,a=void 0;continue}if(d.kind==="group"){let Y=[],j=[];for(let Z of h){let ne=Mi(d.body,t,n,r,[dn(Z)]);if(ne.result)return ne;if(Y.push(...vl(Z,ne.states,m,u==="&",cn(u))),A)j.push(Z,...m?ne.states.map((Pe)=>Oi(Z,Pe)):ne.states)}let fe=_l(Y,j,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=fe.states,s=fe.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let P=HA(e.nodes[c-1]),k=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],O=Dt(a)&&C?.kind==="command"?Af(C)??EA(C):void 0,I=[],J=[];for(let Y of h){let j=vA(d,t,n,r,[dn(Y)]);if(j.result)return{result:j.result,states:i};let fe=e.dialect==="powershell"?j.states:j.states.map((Z)=>Oi(Y,Z));for(let Z of fe){let ne=dn(Z),Pe=wA(d,t,n.trace?{...n,trace:Np(n.trace,k)}:n,r,ne,Dt(a),O);if(Pe)return{result:Pe,states:i};let Fe=XA(d,ne.functionDefinitions);if(Fe)n.budget.charge("derivedTokens",Ni(Fe));let ht=Fe?t+1>=V.recursionDepth.cap?Rl(d.displayText,n,[ne]):Mi(Fe,t+1,n,r,[ne]):{result:null,states:YA(d,ne).flatMap((Xe)=>jA(d,Z,Xe,P))};if(ht.result)return ht;I.push(...vl(Y,ht.states,m,u==="&",cn(u)));let Vi=typeof ne.effectiveCwd==="string"&&ne.effectiveCwd!==Z.effectiveCwd&&d.redirections.every((Xe)=>["<",">",">>",">|"].includes(Xe.operator)&&Xe.target?.text==="/dev/null");if(A&&(P||!Vi))J.push(Y),J.push(...ht.states.map((Xe)=>m?Oi(Y,Xe):Xe))}}let Se=_l(I,J,E.skippedSuccessStates,E.skippedFailureStates,E.connector,u);i=Se.states,s=Se.conditionalStates,a=void 0}return{result:null,states:i}}function SA(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Dt(r)||Dt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&bA(e,t)}function vl(e,t,n,r,o){let i=n?t.map((a)=>Oi(e,a)):[...t],s=o?i.flatMap((a)=>Kn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function Oi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function bA(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(_A(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Dt(e){return e==="|"||e==="|&"}function EA(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function cn(e){return e==="&&"||e==="||"}function _l(e,t,n,r,o,i){let s={success:Di([...n,...e]),failure:Di([...r,...t])},a=cn(i)?s:void 0;return{states:cn(o)||a?Di([...s.success,...s.failure]):s.success,conditionalStates:a}}function Np(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,branch:e.branch,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function vA(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=RA(e);if(s){if(t+1>=V.recursionDepth.cap)return Rl(s,n,o);let a=Be(s,"powershell");if(a.status==="limited")return Rl(s,n,o);if(a.status!=="complete")return Pp(i,n,r,o);n.budget.charge("derivedTokens",Ni(a)),i.push({program:a,depth:t+1})}}return Pp(i,n,r,o)}function _A(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Pp(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Mi(i.program,i.depth,t,n,[dn(a)]);if(l.result)return l;s.push(...l.states)}o=Di(s)}return{result:null,states:o}}function RA(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Ni(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Ni(o),0):n.kind==="group"||n.kind==="function"?Ni(n.body):0),0)}function Rl(e,t,n){return t.trace?.recordSegment({type:"error",message:Je}),{result:{reason:Je,segment:e,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...n]}}function wA(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:OA(n.environment.paths,o.createdDirectories,n.budget)}},l=GA(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};Lp(e,o,"before-consumer",a.environment.paths,a.budget);let c=wn(e.dialect,e.words),d=c.map(R),f=e.displayText,u=sf(c,o.shellGitContextState,{home:a.environment.home,cwd:o.effectiveCwd,darwinUserTempDir:a.environment.darwinUserTempDir}),m=df(u,o.shellGitContextState);if(e.dialect==="powershell"){let y=T(Mm(e,i,JA(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!y,reason:y?.reason}),y)return Dp(f,y)}let p=T(Wu(e.redirections),a.policy);if(p)return a.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:p.reason}),Dp(f,p);if(d.length===1&&d[0]?.includes(" ")&&!fr(e.dialect,e.words)){let y=T(De(d[0]),a.policy),b=y!==null&&!a.strict&&Ou(e,a.rootProgram);if(y&&!b)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:y.reason}),{reason:y.reason,segment:f,ruleId:y.id,intent:y.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let S=Tp(e,l,o,m,s,a);if(S)return S;return tl(u,o.shellGitContextState),null}let g=jn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(y,b)=>{let S=b&&Object.hasOwn(b,"effectiveCwd")?b.effectiveCwd:o.effectiveCwd,E=Al(y,t+1,{...a,effectiveCwd:S,envAssignments:b?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:b?.functionDefinitions,worktreeMode:b?.worktreeMode??a.worktreeMode,shell:b?.shell??a.shell,trace:a.trace?Np(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:f};let h=Tp(e,l,o,m,s,a);if(h)return h;return tl(u,o.shellGitContextState),null}function Tp(e,t,n,r,o,i){let s=FA(e,t,n,r??new Map,i);if(s)return s;if(Lp(e,n,"after-consumer",i.environment.paths,i.budget),!PA(e))n.literalHeredocFiles.clear();return IA(e,t,n,i.environment.paths,i.budget,i.environment.home),DA(e,n,i.environment.paths,i.budget,i.environment.home),BA(e,n,o,i.environment,i.trace),null}var xA=new Set([">>","<>"]),AA=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function PA(e){return e.nested.length===0&&e.redirections.length===0&&e.words.length>0&&e.words.every((t)=>AA.test(t.raw))}function Lp(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?TA(s):xA.has(s.operator)))continue;Ip(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Gp(e.words.slice(1));if(!i)return;for(let s of i.operands)Ip(s,t,r,o)}function TA(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Ip(e,t,n,r){let o=e?.provenance==="literal"?vr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function IA(e,t,n,r,o,i){if(t)return;let s=e.redirections.find((a)=>a.operator==="<<"||a.operator==="<<-")?.heredoc;if(!s)return;for(let a of kA(e,Fn(n.shellGitContextState.shellAssignments,{home:i,cwd:n.effectiveCwd}),i)){let l=vr(a,n.effectiveCwd,r,o);if(!l||!Fu(l))continue;if(!n.literalHeredocFiles.has(l)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new G("trackedHeredocFiles");n.literalHeredocFiles.set(l,s.body)}}function kA(e,t,n){let r=wl(LA(e.redirections)?.target,t,n),o=r===void 0?[]:[r];if(le(e.words[0],"cat"))return NA(e.words)?o:[];if(!le(e.words[0],"tee"))return[];let i=Gp(e.words.slice(1),t);if(!i||i.append||i.hasUnsupportedOptions)return[];let s=i.operands.map((a)=>wl(a,t,n));if(!s.every((a)=>a!==void 0))return[];return[...s,...o]}function wl(e,t,n){if(WA(e))return e.text;if(!e)return;return zn(e,n)??Ye(e,t)??void 0}function OA(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=W(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${yA}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?W(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function DA(e,t,n,r,o){if(t.shellGitContextState.bodyDepth>0||!le(e.words[0],"mkdir"))return;let i=e.words.slice(1).map((d)=>wl(d,t.shellGitContextState.shellAssignments,o));if(!i.every((d)=>d!==void 0))return;let s=i.findIndex((d)=>d==="--"||d==="-"||!d.startsWith("-")),a=i.slice(0,s);if(s===-1||!a.every((d)=>/^(?:-[pv]+|--parents|--verbose)$/.test(d)))return;let l=a.some((d)=>d==="--parents"||/^-v*p/.test(d)),c=t.effectiveCwd;for(let d of i.slice(i[s]==="--"?s+1:s)){if(d.split(/[\\/]/).includes("..")||!fA(d)&&!c)continue;let f=W(hA(c??"",d),n,r);if(l?MA(f,n):n.isDirectory(mA(f))&&Wp(f,n))t.createdDirectories.add(f)}}function MA(e,t){let n=gA(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>pA(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||Wp(o(i),t)}function Wp(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function NA(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function LA(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Gp(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&le(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function WA(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Pl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function GA(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return ln;let r=n[0];if(!r?.heredoc)return ln;let o=/\$\(|`/.test(r.heredoc.body);if(!Pl(r.heredoc)&&(!t||o))return CA;if(r.fd!==void 0&&r.fd!==0)return ln;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return ln;let i=e.redirections.some((l)=>l!==r&&kp(l.target));if(le(e.words[0],"cat"))return i?ln:void 0;if(le(e.words[0],"tee"))return i||e.words.slice(1).some(kp)?ln:void 0;let s=e.words[0],a=e.words[1];if(le(s,"git")&&(le(a,"apply")||le(a,"commit")))return;if(le(s,"gh")&&(le(a,"pr")||le(a,"issue"))&&le(e.words[2],"create"))return;return ln}function kp(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function FA(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if($A(e,i,n,r,o))return null;let a=zA(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=xl(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function zA(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Pl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!$e(i.text))return;let s=o.findIndex((f)=>le(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=ie(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=T(v("interpreter.one-liner-paranoid",_r),n.policy);if(f)return f}if(!Rr(l,void 0,!n.strict))return null;let d=T(v("interpreter.dangerous-command",Tn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function $A(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Pl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=qt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(R),l=N(a[0]??"");if((s.envSplitValues?.length??0)>0||!Q.has(l)&&!Q.has(M(l)))return!1;return qe(a)}function BA(e,t,n,r,o){let i=wp(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(R).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var UA=new Set(["fi","done","esac"]);function HA(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function jA(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&UA.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((f)=>{if(f===n.effectiveCwd)return n;let u=dn(n);return u.effectiveCwd=f,u})}function VA(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var KA=/^[A-Za-z_][A-Za-z0-9_]*$/,qA=8;function YA(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!KA.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=qA&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=dn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function dn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:cf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function Di(e){let t=[];for(let n of e){if(!t.some((r)=>ZA(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new G("controlFlowStates")}return t}function ZA(e,t){return e.effectiveCwd===t.effectiveCwd&&VA(e.compoundBodies,t.compoundBodies)&&Kn(e.shellGitContextState.env,t.shellGitContextState.env)&&Kn(e.literalHeredocFiles,t.literalHeredocFiles)&&Kn(e.functionDefinitions,t.functionDefinitions)&&Kn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Kn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Op(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Op(e.createdDirectories,t.createdDirectories)}function Op(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Kn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function XA(e,t){let n=pr(e);return n===void 0?void 0:t.get(n)}function Dp(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function JA(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function xl(e,t){let n=T(De(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Mp(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:et},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var QA=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Fp(e,t,n,r){let o=Al(e,0,{...t,...Yd(t),budget:t.budget??Te(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",ruleId:o.ruleId,evidence:{command:e,segment:o.segment}}}function zp(e,t,n){try{return{decision:e()}}catch(r){let o=eP(r,t,n);if(!o)throw r;return o}}function eP(e,t,n){if(!(e instanceof G)||!QA.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var tP=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Il=new Set(["cc-safety-net","ccsn"]),nP=new Set(["bunx","npx","pnpx"]),rP=new Set(["pnpm","yarn"]),oP=new Set(["npm","pnpm","yarn"]),iP=new Set(["bun","node"]);function Wi(e,t,n={}){if(Il.has(e))return 0;if(nP.has(e)){if(n.broad)return Tl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&oP.has(e)&&n.broad&&t[r]==="exec"){let o=Tl(t.slice(r+1));return o===null?null:r+1+o}if(rP.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Tl(t.slice(r+1));return o===null?null:r+1+o}if(iP.has(e)){let o=n.broad&&r!==-1?r:0;if($p(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&$p(t[o+1]))return o+2}return null}function Tl(e){let t=e.findIndex((r)=>Li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Li(r))break;n++}return n}function Li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Il.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Il.has(e.slice(0,t))}function $p(e){let t=e?.replaceAll("\\","/");return[...tP].some((n)=>t===n||t?.endsWith(`/${n}`))}var Bp="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Up(e,t,n){let r=ct(e);if(!r)return null;let o=Dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>sP(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function sP(e,t){let n=Rt([...e],t),r=n.slice(1),o=Wi(M(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as Gi}from"node:path";var Kp="This path contains the protected policy config and you must not modify or delete it.",aP=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function qp(e,t,n){let r=fP(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Hp(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ct(e);if(e.invocation.route.kind==="command")return o?jp(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=jp(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Hp(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||eo(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Hp(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Hr(a,n,r,o,i));return s?{target:s}:null}function jp(e,t,n,r,o){let i=Dn(e,t,r,o,{findSegmentTarget:(s,a)=>lP(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Hr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>mP(s,t,n,r,o)?.target??null});return i?{target:i}:null}function lP(e,t,n,r,o){if(Tr(e))return null;let i=wt([...e],r),s=M(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&cP(a)){let l=dP(a).find((c)=>Vp(Ee(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(gi(i,1)||Ka(i,r)){let c=(Nr(X(i))??X(["."])).find((d)=>{let f=Ee(d.text,t.variables);return Hr(f,t.cwd,n,r,o)||Vp(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=ti(a).sources.find((c)=>pP(Ee(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(uP(i,s))return null;for(let l of[...e,...i])for(let c of Yp(l))if(Hr(Ee(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function cP(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function dP(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function uP(e,t){if(!aP.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function mP(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Yp(i))if(Hr(s,t,n,r,o))return{target:s};return null}function Yp(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function fP(e,t,n){let r=(a)=>jr(ue(a,e.executionCwd,t,n)),o=r($t(t)),i=[r(bn(e.executionCwd)),r(bn(e.configCwd))],s=new Set(i.map((a)=>Gi(a)));for(let a=Gi(o);;a=Gi(a))if(s.add(a),Gi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Hr(e,t,n,r,o){let i=sc(e,t,r,o,(s)=>jr(s)===uo);return i!==null&&n.files.has(jr(i))}function Vp(e,t,n,r,o){return n.directoriesAndAncestors.has(jr(ue(e,t,r,o)))}function pP(e,t,n,r,o){let i=jr(ue(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function jr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as Fi,posix as lg,resolve as Ui,win32 as gP}from"node:path";import{fileURLToPath as hP}from"node:url";var cg="Access to a sensitive path is not allowed.",dg=new Set(["echo","printf"]),yP=new Set(["find"]),CP=new Set(["!","do","elif","else","if","then","until","while"]),SP=new Set(["-exec","-execdir"]),bP=new Set([";","+"]),EP=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),vP=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ug=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),_P=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),RP=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Nl=new Set(["-c","-e","-r","-E","--eval","--exec"]),wP=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Ll=new Set(["grep","rg"]),mg=new Set(["files-with-matches","files-without-match","count","quiet"]),xP=new Set([...mg,"ignore-case","fixed-strings","hidden"]),AP=new Set(["wc",...Ll]),PP=new Set(["cd","grep","head","openssl","tail","tailscale"]),TP=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,IP=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),kP=new Set(["commit","merge","notes","stash","tag"]),OP=new Set(["-m","--message"]),DP=new Set(["--grep"]),MP=new Set(["powershell","pwsh"]),Zp=new Set(["jq","gojq","jaq"]),Xp="f",Jp="file",NP="files",LP=new Set(["e","f"]),WP=new Set(["regexp","file"]),GP=new Set(["e","f","A","B","C","m"]),FP=new Set(["regexp","file","after-context","before-context","context","max-count"]),kl="__CC_SAFETY_NET_PIPE_INPUT__",Dl=/[\w./~@+-]*[./~][\w./~@+-]*/g,zP=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,$P=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,BP=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Qp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,eg=/\b(?:system|exec|spawn|popen)\s*$/,UP=/\b(?:eval|exec)\s*\(/g,HP=/\b(?:eval|exec)\s*$/,jP=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function tg(e,t,n,r,o,i){for(let s of e){let a=s.target;if(uI(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=cI(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(xg(a,s.cwd,r,o)))continue;if(c&&i?.get(a)==="data")continue;if(c&&(s.isRedirectionWriteTarget===!0||i?.get(a)==="write")&&!a.includes("$")&&!Bi(a,s.cwd,r,o))continue;if(c&&(s.isCreatedPath===!0||s.isCertificateInput===!0))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Bi(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&mI(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function fg(e,t,n,r,o={}){let i=ng(e,n,r),s=tg(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=ng(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),l=new Map;a.forEach((p)=>pg(p.target).forEach((g)=>l.set(g,(l.get(g)??new Set).add(p.loopVariable))));let c=(p,g)=>(l.get(p)?.size??0)>(l.get(p)?.has(g)?1:0),d=a.filter(({loopVariable:p})=>p===void 0||c(p,p)||c("!",p)),f=new Set(d.filter((p)=>p.literalRole===void 0).map((p)=>p.target)),u=new Set(d.filter((p)=>p.literalRole==="write").map((p)=>p.target)),m=tg(i,t,e.invocation.context.configCwd,n,r,new Map(d.map((p)=>[p.target,f.has(p.target)?"path":u.has(p.target)?"write":"data"])));return m?.ruleId!=="secret.deny-path"&&VP(e,n)?null:m}function VP(e,t){let n=ct(e);if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Qo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(dt(s.text,t))}let o=nt(r);if(o.length===0)return!1;let i=Ce(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Wl(i,o.slice(1))}function Wl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e==="wc")return t.every((n)=>!n.startsWith("-")||TP.test(n));if(Ll.has(e))return KP(e,t);if(e!=="find")return!1;return!t.some((n)=>EP.has(n))}function KP(e,t){let n=t.includes("--")?t.slice(0,t.indexOf("--")):t;if(n.some((c)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(c)||/^-[^-]*f/.test(c)))return!1;let r=e==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,o=e==="rg"?/[clq]/:/[Lclq]/,i=(c)=>/^-[^-]/.test(c),s=(c)=>{let d=n[c-1]??"";return/^--[^=]+$/.test(d)&&!xP.has(d.slice(2))||i(d)&&d.slice(1).search(r)===d.length-2},a=n.findIndex((c,d)=>!c.startsWith("-")&&!s(d));return(e==="grep"&&a>=0?n.slice(0,a):n).some((c,d)=>{if(s(d))return!1;if(c.startsWith("--"))return mg.has(c.slice(2));return i(c)&&o.test(c.slice(1).split(r)[0]??"")})}function ng(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ct(e);return[...s?Zn(s.shell,e.store,r,t,o,n,qP(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function qP(e){return e.program.dialect==="powershell"}function Zn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ve;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw new Zt;let a=[...e.assignmentFallbacks.map((h)=>({target:h,cwd:o})),...jT(dt(e.source,r),t,n,r,o,i)],l=(h)=>dt(sT(h,s),r),c=/[<>=]\(/.test(e.source),d=/\bcoproc\b|\|&/.test(e.source),f=[],u=[],m=(h)=>({...n,commandHoldsPipe:n.commandHoldsPipe===!0||h||d});Jo(e,o,r,i,{word:l,segment:(h,y,b,S,E,A)=>{if(h.length===0)return null;let P=m(A);if(P.commandHoldsPipe)f.push(...h);if(u.push(Ce(gg(nt(h))[0]??"").toLowerCase()),a.push(...Kr(h,t,c||S==="|"||S==="|&"?{...P,segmentMayFeedReader:!0}:P,r,y.cwd,i,E)),b!==null)a.push(...XP(b,h,t,P,r,y.cwd,i));return null},redirection:(h,y,b)=>{if(h.body!==void 0&&h.consumer!==void 0){let S=m(b);a.push(...hg(h.consumer,[h.body],t,S,r,y.cwd,i,(E)=>JP(h.consumer??[],E,t,S,r,y.cwd,i)))}if(h.targetOrder==="legacy-segment")return Ta;return a.push({target:l(h.target),cwd:y.cwd,...h.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let p=new Set(f.flatMap(pg)),g=c||/\$\(|`/.test(e.source)||!u.every((h)=>PP.has(h));return a.map(({loopVariable:h,...y})=>{if(y.certificateOutputMayFeedReader===!0&&g)return{target:y.target,cwd:y.cwd};return h===void 0||c||p.has(h)||p.has("!")?y:{...y,loopVariable:h}})}function pg(e){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(e)?[e]:[],...Array.from(e.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(t)=>t[1]??t[2]??"")]}function zi(e,t,n,r,o,i,s=!1){let a=t.getShellSyntax(e,s?t.getCommandProgram(e,"powershell"):void 0);if(a.status==="structural-limit")throw new Ve;return a.status==="complete"?Zn(a,t,n,r,o,i,s):null}function Kr(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:o}),l=e.findIndex((C)=>!CP.has(C));if(n.skipMetadataOnlySegments===!0&&l>0)return Kr(e.slice(l),t,n,r,o,i,new Set([...s??[]].map((C)=>C-l)));let c=e[1]??"";if(n.skipMetadataOnlySegments===!0&&e[0]==="for"&&e[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(c))return e.slice(3).flatMap((C)=>Ge("for",C)).map((C)=>({...a(C),loopVariable:c}));if(s?.size){let C=e.filter((O,I)=>!s.has(I));if(Zp.has(Ce(nt(C)[0]??"").toLowerCase()))return[...e.filter((O,I)=>s.has(I)).map(a),...Kr(C,t,n,r,o,i)]}let d=iT(e).map(a),f=nt(e);if(f.length===0)return d;let u=f[0]??"",m=Ce(u).toLowerCase(),p=f.slice(1),g=n.segmentMayFeedReader===!0||n.commandHoldsPipe===!0||n.displayOperandsAreCapturedOutput===!0,h=g&&AP.has(m);if(n.skipMetadataOnlySegments===!0&&!h&&Wl(m,p))return d;let y=ZP(u,m,p);if(y)return[...d,...y.map(a)];if(dg.has(m))return n.displayOperandsAreCapturedOutput===!0?[...d,...yg(e).map(a)]:d;if(m==="eval")return[...d,...zi(p.join(" "),t,n,r,o,i)??p.map(a)];let b=MP.has(N(u))?Cl(f):void 0;if(b!==void 0)i.charge("derivedTokens",f.length);let S=b===void 0?null:zi(b,t,n,r,o,i,!0);if(S?.length)return[...d,...S];if(m==="export")return[...d,...p.flatMap((C)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(C)?[C.slice(C.indexOf("=")+1)]:Ge(m,C)).map(a)];if(m==="git")return[...d,...lT(p).map(a)];if(m==="gh")return[...d,...Ml(m,p,IP).map(a)];if(Zp.has(m))return[...d,...aT(p).map(a)];if(Ll.has(m))return[...d,...QT(p).map(a)];if(yP.has(m))return[...d,...dT(p,t,n,r,o,i).map(a)];if(m==="mkdir"||m==="touch"){let C=new Set(e.filter((I,J)=>s?.has(J))),O=n.segmentMayFeedReader!==!0&&!(m==="touch"&&p.some((I)=>/^(?:--r|-[^-]*r)/.test(I)));return[...d,...p.flatMap((I)=>Ge(m,I).map((J)=>O&&!I.startsWith("-")&&!C.has(I)?{...a(J),isCreatedPath:!0}:a(J)))]}if(ke.has(m))return[...d,...p.flatMap((C)=>Ge("awk",C)).map(a),...p.flatMap((C)=>mT(C,t,n,r,o,i)),...p.flatMap(fT).map(a)];if(m==="curl")return[...d,...p.filter((C,O)=>Sg(C)===null&&Cg(p[O-1])===null).flatMap((C)=>Ge(m,C)).map(a),...cT(p).map(a)];if(kn(m)){let C=Pr.has(m)?Oe([m,...p]):null;if(C!==null&&C.command!==null&&C.commandIndex!==null){let O=t.getShellSyntax(C.command);if(O.status==="structural-limit")throw new Ve;if(O.status==="complete")return[...d,...Zn(O,t,n,r,o,i),...p.slice(C.commandIndex).filter((I)=>!I.startsWith("-")).map(a)]}return[...d,...uT(m,p,t,n,r,o,i)]}let E=(C,O)=>new RegExp(`^--?${C}=`).test(p[O]??"")||new RegExp(`^--?${C}$`).test(p[O-1]??""),A=YP(f),P=m==="openssl"&&p[0]==="x509",k=g?{certificateOutputMayFeedReader:!0}:{};return[...d,...p.flatMap((C,O)=>Ge(m,C).map((I)=>A&&E("(?:cert|key)-file",O)?{...a(I),isCreatedPath:!0,...k}:P&&E("in",O)?{...a(I),isCertificateInput:!0,...k}:a(I)))]}function gg(e){return Ce(e[0]??"").toLowerCase()==="timeout"?e.slice(2):e}function YP(e){let t=gg(e);return Ce(t[0]??"").toLowerCase()==="tailscale"&&t[1]==="cert"}function ZP(e,t,n){let r=Wi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function XP(e,t,n,r,o,i,s){if(nT(t,n,r,o,i,s)){let a=nt(e),l=Wl(Ce(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...yg(e),...l].map((c)=>({target:c,cwd:i}))}return hg(t,QP(e),n,r,o,i,s,()=>[])}function JP(e,t,n,r,o,i,s){let a=nt(e);if(!kn(Ce(a[0]??"").toLowerCase()))return[];return zi(t,n,r,o,i,s)??[{target:t,cwd:i}]}function hg(e,t,n,r,o,i,s,a){let l=rT(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Pr.has(l)?Zn(n.getShellSyntax(c),n,r,o,i,s):$i(l,c,n,r,o,i,s))}function yg(e){let t=nt(e);if(t.length===0)return[];let n=Ce(t[0]??"").toLowerCase();if(!dg.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Gl(r.replaceAll("%%","%"))];return t.slice(1)}function QP(e){let t=nt(e);if(t.length===0)return[];let n=Ce(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return eT(r);return[]}function eT(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Gl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>tT(t,r.slice(i*n,(i+1)*n)))}function tT(e,t){let n=0;return Gl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Gl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function nT(e,t,n,r,o,i){let s=nt(e);if(s.length===0||Ce(s[0]??"").toLowerCase()!=="xargs")return!1;let a=an(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,kl]:l.map((f)=>f.split(c).join(kl));return Kr(d,t,n,r,o,i).some((f)=>f.target.includes(kl))}function rT(e){let t=nt(e);if(t.length===0)return null;let n=Ce(t[0]??"").toLowerCase();if(!kn(n))return null;return oT(n,t.slice(1))?n:null}function oT(e,t){let n=Fl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Nl.has(o)||bg(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(jP.get(n)?.has(o))r++;continue}return!1}return!0}function Fl(e){return/^python\d/.test(e)?"python":e}function iT(e){let t=[];for(let n of e){if(wg(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var rg=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function sT(e,t){if(!t||!rg.test(e))return e;return`~${e.replace(rg,"").replace(/\\/g,"/")}`}function Ge(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1&&!t.slice(0,r).includes("?"))n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function aT(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ge("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ge("jq",r))}function lT(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...kP.has(r)?Ml("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),OP):Ml("git",e.slice(n),DP)];if(t.push(...Ge("git",r)),!Re.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ge("git",o)),n++}return t}function Ml(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ge(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ge(e,i))}return r}function cT(e){return e.flatMap((t,n)=>{let r=Sg(t);if(r!==null)return og(r.flag,r.value);let o=Cg(e[n-1]);return o===null?[]:og(o,t)})}function og(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ol(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ol(t.slice(n+1))}return t.startsWith("@")?Ol(t.slice(1)):[]}function Cg(e){if(e===void 0)return null;if(ug.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Sg(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ug.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ol(e){return e===""||e==="-"?[]:[e]}function dT(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!SP.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>bP.has(m)),f=d===-1?c:c.slice(0,d),u=Kr(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!vP.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uT(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Nl.has(c)||bg(e,c)){let f=t[l+1];if(f!==void 0)a.push(...$i(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...$i(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bg(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return wP.get(t[t.length-1]??"")?.has(Fl(e))??!1}function mT(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ua(e)?.commands.flatMap((s)=>Zn(t.getShellSyntax(s),t,n,r,o,i))??[]}function fT(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function pT(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap($l),...e.match(Dl)??[]]}function $i(e,t,n,r,o,i,s){let a=(C)=>({target:C,cwd:i}),l=WT(e),c=FT(t,l);if(c.kind==="unmaskable")return pT(t).map(a);let d=c.masked.match(Qp)!==null||c.literals.some((C)=>eg.test(c.masked.slice(0,C.start))),f=c.masked.match(UP)!==null||c.literals.some((C)=>HP.test(c.masked.slice(0,C.start))),u=r.inlineLiteralsPresumedData===!0&&!Pr.has(e),m=u&&(l==="python"||l==="javascript"),p=u&&!(HT(c.masked)||d||f)?[]:c.literals,g=u?Array.from(c.masked.matchAll(Qp),(C)=>{let O=C.index+C[0].length;return{start:O,end:Uo(c.masked,O)}}):[],h=!u||g.some((C)=>Ra(c.masked,C.start)&&!vT(c,C.start))?c.literals:c.literals.filter((C)=>eg.test(c.masked.slice(0,C.start))||g.some((O)=>C.start>=O.start&&C.start<O.end)),y=new Set(d?h:[]),b=m&&p.length>0&&!CT(c.masked,l==="python"?"#":"//"),S=b?_T(c.masked):[],E=b?Array.from(c.masked.matchAll(/[A-Za-z_$][\w$]*/g),(C)=>({name:C[0],index:C.index})):[],A=bT(E),P=!ST(c.masked,E),k=E.filter((C)=>!ig(c.masked,{start:C.index,text:C.name,tokenStart:C.index,tokenEnd:C.index+C.name.length},S,A,P)).reduce((C,O)=>{let I=C.get(O.name)??[];return I.push(O.index),C.set(O.name,I)},new Map);return[...p.filter((C)=>C.text!=="").map((C)=>{if(!b||y.has(C))return a(C.text);if(ig(c.masked,C,S,A,P)||RT(c.masked,C,S,k))return{...a(C.text),literalRole:"data"};return MT(c,C,S)?{...a(C.text),literalRole:"write"}:a(C.text)}),...p.flatMap((C)=>$l(C.text)).map(a),...u?[]:c.literals.flatMap((C)=>C.text.match(Dl)??[]).map(a),...d?h.flatMap((C)=>zi(C.text,n,{...r,commandHoldsPipe:!0},o,i,s)??[a(C.text)]):[],...f?c.literals.flatMap((C)=>$i(e,C.text.replace(/\\(.)/g,(O,I)=>I==="n"?`
+`:I),n,r,o,i,s)):[],...m?[]:(c.masked.match(Dl)??[]).map(a),...u?(t.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(a):[]]}var zl={"(":")","[":"]","{":"}"},Eg="and|elif|else|if|in|is|not|of|or|return|while|yield",gT=new RegExp(`(?:^|[^\\w$])(?:${Eg})$`),hT=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${Eg})\\s*\\(|/\\*`),yT=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function CT(e,t){return hT.test(e)||e.split(`
+`).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function ST(e,t){return AT.test(e)||t.some((n)=>{let r=xT.get(n.name),o=n.index+n.name.length;return r!==void 0&&!r.test(e.slice(o,o+40))})}function bT(e){return e.some((t)=>_g(t.name).some((n)=>yT.test(n)))}var ET=new Set(["cmd","powershell","pwsh"]);function vT(e,t){let n=un(e.masked,t),r=zl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice(un(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Nl.has(s.text)||kn(Ce(s.text).toLowerCase())||ET.has(Ce(s.text).toLowerCase().replace(/\.exe$/,""))))}function _T(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in zl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function ig(e,t,n,r,o){let i=n[t.tokenStart]??-1,s=e[i]??"",a=Yn(e,t.tokenStart),l=un(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,a-3),a+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(l,l+8)))return!0;if(r&&(s==="["||s==="("))return!1;let c=e[a],d=e[l];if(s==="{"&&c===":")return NT(e,a);let f=(c===s||c===",")&&(d===","||d===zl[s]||s==="{"&&d===":");if(s!=="(")return f&&s!=="";return f&&(o&&wT.test(e.slice(Math.max(0,i-20),i))||(c===","||d===",")&&LT(e,i))}function RT(e,t,n,r){let o=Math.max(0,t.tokenStart-80),i=`${o===0?`
+`:""}${e.slice(o,t.tokenStart)}`,s=PT.exec(i)?.[1],a=e[n[t.tokenStart]??-1];if(s===void 0||a==="("||a==="[")return!1;let l=un(e,t.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(e.slice(t.tokenEnd,l)))return!1;let c=t.tokenStart-i.length+i.lastIndexOf(s);return(r.get(s)??[]).every((d)=>d===c)}var wT=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,xT=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),AT=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,PT=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,TT=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,IT=/^\s*\.\s*write_(?:text|bytes)\s*\(/,kT=/(?:^|[^\w$.])open\s*$/,OT=/^[bt]*[awx][abtwx]*$/,DT=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function MT(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=Yn(e.masked,t.tokenStart),i=un(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(TT.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&IT.test(e.masked.slice(Uo(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(DT.test(a))return!0;if(!kT.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&OT.test(l.text)&&/^[,)]/.test(e.masked.slice(un(e.masked,l.tokenEnd)))}function NT(e,t){let n=Yn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[Yn(e,n+1-r.length)];return o==="{"||o===","}function LT(e,t){let n=Yn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||gT.test(r)}function WT(e){let t=Fl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var GT={python:"#",javascript:"/"};function FT(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return vg(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function vg(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===GT[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if($P.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&UT(e,s))return null;let c=n==="python"?$T(e,s):"",d=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+d.length,u=l==="`"||/[fF]/.test(c),m=s-c.length,p=u?zT(e,m,f,d,n,r):BT(e,f,d);if(p===null)return null;if(!u){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&BP.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+d.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+d.length),s=p+d.length-1}return o?null:e.length}function zT(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let d=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(d===`
+`||d==="\r"))return null;let f=o==="python"&&(d==="{"||d==="}")&&e[c+1]===d;if(!f&&e.startsWith(s,c)){let p=vg(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=d==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function $T(e,t){return zP.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function BT(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
+`||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function UT(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function HT(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(_P.has(n.toLowerCase()))return!0;let o=_g(n);if(!o.some((i)=>RP.has(i)))continue;if(o.length>1)return!0;if(e[Yn(e,r)]===".")return!0;if(e[un(e,r+n.length)]==="(")return!0}return!1}function _g(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function Yn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function un(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function jT(e,t,n,r,o,i){return ZT(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Zn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...VT(a,r)?KT(a,r).map((l)=>({target:l,cwd:o})):[]]})}function VT(e,t){let n=Qo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ce(dt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=dt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function KT(e,t){return Qo(e).flatMap((n)=>n.kind==="word"?[dt(n.text,t)]:n.kind==="redirection"&&n.target?[dt(n.target,t)]:[]).flatMap($l)}function $l(e){let t=YT(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||qT(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function qT(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function YT(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function ZT(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(lr(o,n))continue;if(Rg(e,r,n)){let i=XT(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=JT(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function XT(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(lr(i,n))continue;if(Rg(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function JT(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Rg(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function QT(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===NP)o=!0;if(WP.has(f))r=!0;if(u!==void 0){if(f===Jp)t.push(u);continue}if(FP.has(f)){let m=e[l+1];if(f===Jp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(LP.has(h))r=!0;if(GP.has(h)){u=h,m=f.slice(g+1);break}}if(u==="")continue;if(m.length>0){if(u===Xp)t.push(m);continue}let p=e[l+1];if(u===Xp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function nt(e){let t=e.findIndex((n)=>!wg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function wg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var eI=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),tI=".env.",nI=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),rI=[".env.example.",".env.sample."];function oI(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function iI(e){return e.length>0&&!/\s/.test(e)}function Bi(e,t,n,r){let o=xg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function xg(e,t,n,r){try{return qr(e,t,n,r)}catch(o){if(o instanceof G)throw o;return""}}var sI=/[?&][^?&=/]+=/,aI=new Set(["node_modules","__pycache__"]),lI=[["vendor","bundle"],["vendor","cache"]];function cI(e,t,n,r,o){if(oI(e))return null;let i=_e(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>iI(s)||Bi(e,t,r,o),c=U(gI(e,t,r,o));for(let u of Fs){let m=`~/${u.suffixParts.join("/")}`;if((ag(a,m)||ag(c,m))&&gt(u.id,n))return u.id}if(nI.has(s)||rI.some((u)=>s.startsWith(u)))return null;let d=dI(i,t,n,r,o);if(d)return d;if(eI.has(s))return null;for(let u of Gs)if(s===u.basename&&gt(u.id,n))return u.id;if(s.startsWith(tI)&&gt(Co.id,n)&&l())return Co.id;for(let u of zs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&gt(u.id,n)&&l())return u.id}for(let u of $s)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&gt(u.id,n))return u.id}if(fI(a))return null;if(!s.includes(".")&&cr.pattern.test(s)&&gt(cr.id,n))return cr.id;if(sI.test(e)&&!Bi(e,t,r,o))return null;let f=pI(s,n);if(f)return f;return null}function dI(e,t,n,r,o){return So.find((i)=>{if(!gt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,_e("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||qn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,re(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[re(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,re(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,_e(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||qn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||qn(e,s,["credentials"])||qn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=re(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((d)=>Vr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=re(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[re(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>F(e,_e(d,t,r,o),l))}case"secret.cli.pi":return F(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=_e("~",t,r,o);return[re(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),re(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||qn(e,re(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[re(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),re(_e("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>F(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=re(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=re(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,_e("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&mn(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,_e("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return F(e,_e("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||F(e,_e("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),_e("~/.local/share",t,r,o)].some((s)=>F(e,re(s,"devin"),["credentials.toml"])||qn(e,re(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),_e("~/.config",t,r,o)].some((s)=>F(e,re(s,"devin"),["config.json"]));default:return!1}})?.id??null}var sg=new WeakMap;function H(e,t,n,r,o){let i=sg.get(o)??new Map;sg.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=_e(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>Ag(e,re(t,r)))}function qn(e,t,n){return n.some((r)=>mn(U(e),U(re(t,r))))}function Vr(e,t,n,r,o){return Ag(e,_e(t,n,r,o))}function Ag(e,t){return U(e)===U(t)}function re(e,...t){return Ze([e,...t].filter(Boolean).join("/"))}function uI(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(qr(e,t,o,i));return n.some((a)=>mn(s,U(qr(a,r,o,i))))}function mI(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(qr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ze(W(de(a),o.paths,i)):"",c=U(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=U(d?Ze(W(Ui(de(d)),o.paths,i)):l&&Ze(W(`${l}/.cc-safety-net`,o.paths,i)));if(f&&mn(s,f))return!1;return n.some((u)=>{let m=Vs(u);if(m&&lg.basename(s)!==U(m.name))return!1;let p=U(qr(m?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return mn(s,p)&&!(m&&s===p)})}function fI(e){let t=e.split("/");return t.some((n)=>aI.has(n))||lI.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function pI(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Bs)if(r===o.extension&&gt(o.id,t))return o.id;for(let o of Us)if(o.pattern.test(r)&&gt(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function gt(e,t){return!t?.disabledRules?.includes(e)}function _e(e,t,n,r){let{home:o,normalized:i}=Bl(e,n,r);if(!i)return"";if(!o)return i;let s=Ul(i,o),a=Fi(s)?s:Ze(Ui(t,s)),l=Ze(W(a,n.paths,r));if(!mn(l,o)){if(Fi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function ag(e,t){return e===t||e.startsWith(`${t}/`)}function gI(e,t,n,r){let{home:o,normalized:i}=Bl(e,n,r);if(!i||!o)return"";let s=Ul(i,o),a=lg.normalize(Fi(s)?s:Ze(Ui(t,s))),l=Ze(de(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&mn(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function qr(e,t,n,r){let{home:o,normalized:i}=Bl(e,n,r);if(!i)return"";let s=o?Ul(i,o):i;return Ze(W(Fi(s)?s:Ui(t,s),n.paths,r))}function Bl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ze(W(de(r),t.paths,n)):"",i=Ze(de(hI(dt(e,t))));return{home:o,normalized:i}}function hI(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return hP(e)}catch{return e}}function Ul(e,t){if(e==="~")return t;if(e.startsWith("~/"))return re(t,e.slice(2));return e}function yI(e){if(process.platform==="win32")return!0;return gP.parse(e).root.length>1}function Ze(e){let t=e.trim(),n=(t.includes("\\")&&yI(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function mn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ce(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class fn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var CI={findPolicyMutation:qp,findGitMetadataMutation:hm,resolveGitMetadata:vI,loadPolicySnapshot:qd,findSensitiveTarget:fg,analyzeCommand:Fp,getModes:ms},SI=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,bI=["workdir","cwd","working_directory"];function Hl(e,t){let n={...CI,...t.dependencies},r=wI(e),o=()=>Mt("config-load",r,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),i=e.route.kind==="unknown"&&r?o():void 0,s=i?.policy.commandTools.find((I)=>I.name===e.toolName),a=s&&r?EI(e,r,s.cwd,t.environment.paths):e;if("decision"in a)return a;let l=a,c=l===e?{}:{promotedInvocation:l},d=Yr(l)?l.command:r,f=Mt("policy-protection",d,()=>mm(l)),u=On(f,"input-candidate"),m=On(f,"declared-command");if(Yr(l)&&l.command?.trim()&&m?.program.status==="limited")return{stage:"command-analysis",...c,decision:{kind:"deny",reason:Je,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:l.command,segment:l.command}}};if(u?.program.status==="limited")return{stage:"command-validation",...c,decision:{kind:"deny",reason:um,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let p=Te(),g=Mt("policy-protection",d,()=>n.resolveGitMetadata([l.context.executionCwd,l.context.configCwd],t.environment)),h=Mt("policy-protection",d,()=>n.findPolicyMutation(f,t.environment,p));if(h){let I=d??h.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:Kp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:I,segment:h.target}}}}let y=Mt("policy-protection",d,()=>Up(f,t.environment,p));if(y){let I=d??y.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:Bp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:I,segment:y.target}}}}let b=Mt("policy-protection",d,()=>n.findGitMetadataMutation(f,g,t.environment,p));if(b){let I=d??b.target;return{stage:"policy-protection",...c,decision:{kind:"deny",reason:pe,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:I,segment:b.target}}}}let S=i??o(),E=S.policy,A=n.getModes(E,t.environment.env),P={level:A.effectiveLevel,..._I(S),...c},k=E.secretProtection.enabled===!1?null:Mt("secret-protection",d,()=>n.findSensitiveTarget(f,E.secretProtection,t.environment,p,{strict:Yr(l)||u?.program.dialect==="powershell"?A.strict:void 0}));if(k){let I=d??k.target;return{stage:"secret-protection",...P,decision:{kind:"deny",reason:cg,intent:"hard_stop",ruleId:k.ruleId,evidence:{command:I,segment:k.target}}}}if(!Yr(l))return{stage:"non-command",...P,decision:{kind:"allow"}};if(!l.command||l.command.trim()==="")return{...Hi("command-validation",d),...P};let C=Mt("command-analysis",d,()=>zp(()=>n.analyzeCommand(l.command,{cwd:l.context.executionCwd,shell:l.route.shell,policySnapshot:S,environment:t.environment,protectedGitMetadata:g,effectiveCapabilities:A.capabilities,worktreeMode:A.worktreeMode,budget:p,...t.trace?{trace:t.trace}:{}},RI(f),f.store),l.command,t.trace)),O=l.route.shell==="auto"&&f.store.readsAutoAsPowerShell()?()=>{let I=t.trace?.branch(),J={...Hl({...l,route:{kind:"command",shell:"posix"}},{...t,...I?{trace:I.trace}:{},dependencies:{...t.dependencies,loadPolicySnapshot:()=>S,resolveGitMetadata:()=>g}}),...c};return{decision:J.decision,withItsTrace:()=>(I?.adopt(),J)}}:void 0;if(C.decision){let I=!A.strict&&(C.decision.ruleId==="raw-text.dangerous-command"||C.decision.reason===Ir&&!SI.test(C.decision.evidence?.segment??"")&&De(l.command)===null),J=I?O?.():void 0;if(J?.decision.kind==="deny"&&!J.decision.unverifiedByStandardMode)return J.withItsTrace();return{stage:"command-analysis",...P,..."errorCode"in C?{errorCode:C.errorCode}:{},decision:I?{...C.decision,unverifiedByStandardMode:!0}:C.decision}}return O?.().withItsTrace()??{stage:"command-analysis",...P,decision:{kind:"allow"}}}function EI(e,t,n,r){let o=[...new Set((n?[n]:bI).flatMap((l)=>{let c=Object.getOwnPropertyDescriptor(e.input,l);return c?[c.value]:[]}))],i=o.filter((l)=>typeof l==="string"&&l.trim()!=="");if(o.length>1||i.length!==o.length)return Hi("command-validation",t);let s=i[0],a=s===void 0?e.context.configCwd:ss(s,e.context.configCwd,r);if(!a){let l=er({directory:"requested",problem:"unusable",cwd:s??""});return{stage:"command-validation",decision:{kind:"deny",reason:l.reason,ruleId:l.ruleId,intent:l.intent,evidence:{command:t,segment:t}}}}return to(e.toolName,e.input,{kind:"command",shell:"auto"},{configCwd:e.context.configCwd,executionCwd:a},t)}function vI(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function _I(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function RI(e){return On(e,"declared-command")?.program}function wI(e){try{return rr(e.input)}catch(t){let n=Yr(e)?e.command:void 0;throw new fn("policy-protection",Hi("policy-protection",t instanceof ot?void 0:n,t),t)}}function Mt(e,t,n){try{return n()}catch(r){throw new fn(e,Hi(e,r instanceof ot?void 0:t,r),r)}}function Hi(e,t,n){let r=n instanceof Zt?{reason:et,ruleId:"analysis.strict-unparseable"}:n instanceof G||n instanceof Ve?{reason:Yi,ruleId:"analysis.limit"}:{reason:Jn,ruleId:"analysis.failed-closed"};return{stage:e,decision:{kind:"deny",...r,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Yr(e){return e.route.kind==="command"}import{appendFileSync as GI,mkdirSync as FI}from"node:fs";import{isAbsolute as zI,join as Kl}from"node:path";import{lstatSync as Tg,readdirSync as xI,readFileSync as AI,rmdirSync as PI,statSync as Ig,unlinkSync as TI,utimesSync as II,writeFileSync as kI}from"node:fs";import{join as Zr}from"node:path";function Pg(e,t={}){return Ao($t(e,t),e.home).policy.audit.retention_days}var Vl=86400000,OI=".last-prune",DI=/^\d{4}-\d{2}$/,MI=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,kg=(e)=>Math.floor(e/Vl);function Dg(e,t,n=()=>new Date){try{let r=n().getTime();if(!Ig(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Zr(t,OI),i=Ig(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&kg(i)===kg(r))return;let s=r-Pg(e)*Vl,a=new Date(r).toISOString().slice(0,7);for(let l of jl(t)){if(l.isDirectory()){NI(Zr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))LI(Zr(t,l.name),s)}kI(o,"",{mode:384}),II(o,r/1000,r/1000)}catch{}}function NI(e,t,n){for(let r of jl(e)){if(!r.isDirectory()||!DI.test(r.name))continue;let o=Zr(e,r.name);for(let i of jl(o)){if(!i.isFile())continue;let s=MI.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Vl;if(!Number.isFinite(a)||a>=t)continue;Mg(Zr(o,i.name))}if(r.name!==n)Og(o)}Og(e)}function LI(e,t){try{let n=Tg(e);if(n.mtimeMs>=t)return;let r=AI(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(WI);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Tg(e).mtimeMs!==n.mtimeMs)return;Mg(e)}catch{}}function WI(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function jl(e){try{return xI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Mg(e){try{TI(e)}catch{}}function Og(e){try{PI(e)}catch{}}var $I="2.6.15",BI=1e4,UI=2000,HI=256,jI=32768;function VI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function KI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ql(e,t,n,r,o,i,s={}){let a=VI(t);if(!a)return;let l=YI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=ji(yt(n),s.failureStage?Number.POSITIVE_INFINITY:BI),f=ji(yt(r),UI),u=s.toolName?ji(yt(s.toolName),HI):void 0,m=i===null?void 0:ji(yt(i),jI),p=Kl(l,KI(m?.value??null),c.slice(0,7));FI(p,{recursive:!0,mode:448});let g=Kl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??fs)(),v:$I,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};GI(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Dg(e,l,s.now)}catch{}}function ji(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function qI(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&zI(n)?n:null}function YI(e){let t=qI(e);return t?Kl(t,".cc-safety-net","logs"):null}function Lg(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ng(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ng(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ng(e){return"command"in e?e.command??"":""}function Wg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ql(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Gg(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ql(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function zg(e,t,n){try{let r=Hl(t,{environment:e,...n.guard});return Fg(e,t,r,n),r}catch(r){if(!(r instanceof fn))throw r;throw Fg(e,t,r.evaluation,n,!(r.cause instanceof ot),{stage:r.stage,errorCode:ZI(r.cause)}),r}}function Fg(e,t,n,r,o=!0,i){Wg(e,Lg(n.promotedInvocation??t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function ZI(e){if(e instanceof G)return V[e.kind].errorCode;if(e instanceof ot)return"tool-input-limit";if(e instanceof Ve)return"structural-shell-syntax-limit";if(e instanceof Zt)return"unparseable-command";return"unexpected-error"}function Nt(e,t={}){return{malformed:!0,denial:Qn(t),cwd:e}}function Yl(e,t){return{malformed:!0,denial:er(e,t),cwd:e.cwd}}function $g(e,t={}){return(n,r)=>{try{return XI(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Qn())}}}function XI(e,t,n,r){let o=Lc();if(n.cancelled?.(t))return n.block(Qn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Gg(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=Ql(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=zg(o,i,{guard:{auditAllowed:zc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof fn))throw l;if(it(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${tc(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Bg="exec",JI=new Set(["auto","gateway"]);function Ug(e){e.on("before_tool_call",QI(e),{matcher:[Bg],priority:50})}function QI(e,t={}){return $g({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>ek(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>nk(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function ek(e,t,n,r){if(!e||typeof e!=="object")return Nt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Nt(null);if(o!==Bg)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Nt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Nt(null,{toolName:o});if(s.host!==void 0&&!JI.has(s.host))return Nt(null,{command:a,toolName:o});let l=tk(n,t.agentId);if(!l)return Nt(null,{command:a,toolName:o});let c=is(".",[l],r);if(!c)return Yl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let d=s.workdir;if(d!==void 0&&(typeof d!=="string"||d.trim()===""))return Nt(c,{command:a,toolName:o});let f=typeof d==="string"?d:".",u=is(f,[c],r);if(!u)return Yl({directory:"requested",problem:_c(f,c,r),cwd:f},{command:a,toolName:o});return to(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:u},a)}function tk(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function nk(e){return{block:!0,blockReason:ec(e)}}var JG={...Jl,register:Ug};export{JG as default};