cc-safety-net 2.6.19 → 2.7.0

package/dist/chunks/index-hxp3yxf9.js

@@ -1,49 +0,0 @@
-var ka="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Qn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Bo="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ia={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},$o={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...Ia},processedCandidateBytes:{cap:4194304,...Ia},pathEnvironmentExpansion:{cap:64,...Ia},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...$o},trackedHeredocFiles:{cap:64,...$o},controlFlowStates:{cap:64,...$o},wrapperPeelIterations:{cap:20,...$o},derivedCommandShape:$o});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function On(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,v=1){let W=(n.get(u)??0)+v;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var Dh=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ee(n){return ze(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ze(n){return Dh.reduce((u,v)=>u.replace(v,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return hd(n).reduceRight((u,v)=>`${u.slice(0,v.valueStart)}<redacted>${u.slice(v.valueEnd)}`,n)}function A(n){return ze(dt(n))}function Pt(n){return hd(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function hd(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let v=n[u.index-1];if(u.index>0&&v&&!/[\s"'([{]/.test(v))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:Nh(n,W)}]})}function Nh(n,u){if(n.startsWith("$(",u))return Lh(n,u);let v=n[u];if(v==='"'||v==="'"){for(let z=u+1;z<n.length;z++){if(v==='"'&&n[z]==="\\"){z++;continue}if(n[z]===v)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function Lh(n,u){let v=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){v++,z++;continue}if(B!==")")continue;if(v--,v===0)return z+1}return n.length}var Wh={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Fh(n){let u=n.maxLen??200,v=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${v(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(v(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(v(n.segment))}`:void 0,n.cwd?`Working directory: ${W(v(n.cwd))}`:void 0,n.configWarning?`Config warning: ${v(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":Wh[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
-
-`)}function Me(n,u){if(n.decision.kind!=="deny")return;let v=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:v?.command,segment:v?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function te(n={}){return{reason:Bo,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function V(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var Gh={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...Gh[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function ne(n){return Fh({...n,redact:ee})}function _t(n){return ee(n instanceof Error?n.message:String(n))}import{spawnSync as by}from"node:child_process";import{lstatSync as vy,realpathSync as Ey,statSync as Ry}from"node:fs";import{homedir as _y,tmpdir as xy}from"node:os";import{statSync as yy}from"node:fs";import{join as Sy}from"node:path";import{basename as Cd,dirname as zh,isAbsolute as $h,join as Bh,normalize as Uh,resolve as yd}from"node:path";var Hh=256,$i=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function or(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function Na(n,u){return Oa(n,0,u)}function Oa(n,u,v){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let Q=Ma(n,z+2),le=jh(n,z,u);if(le===null){if($i.has(Q))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=Vh(ue,u,v),z=le+1;continue}let X=Ma(n,z+1);if(!X){W+="$",z++;continue}W+=Da(X,v)??`$${X}`,z+=X.length+1}return W}function jh(n,u,v){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,v+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function Vh(n,u,v){let W=n.slice(2,-1),z=Ma(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return Da(z,v)??n;let X=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!X){if($i.has(z))throw new a("pathEnvironmentExpansion");return n}if(!$i.has(z))return n;if(X.endsWith("="))throw new a("pathEnvironmentExpansion");let Q=Da(z,v),le=X.startsWith(":")?Q!==null&&Q!=="":Q!==null;if(X.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(X.endsWith("-")||X.endsWith("?"))return le?Q??"":Oa(B.slice(X.length),u+1,v);return le?Oa(B.slice(X.length),u+1,v):""}function Ma(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let v=u+1;while(/[A-Za-z0-9_]/.test(n[v]??""))v++;return n.slice(u,v)}function Da(n,u){if(!$i.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function Ut(n,u,v){if(!n)return n;let W=v.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){bd(v,B);let X=u.realpath(B);if(X!==null)return Sd(v,n,X,z);let Q=zh(B);if(Q===B||z.length>=Hh)return Sd(v,n,B,z);z.push(Cd(B)),B=Q}}function Sd(n,u,v,W){let z=W.length===0?v:Bh(v,...W.reverse());return n.resolvedPaths.set(u,z),z}function Kh(n,u,v){let W=v.resolvedPaths.get(n);if(W!==void 0)return W;bd(v,n);let z=u.realpath(n);if(z!==null)v.resolvedPaths.set(n,z);return z}function bd(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function gn(n,u,v,W){let z=Ed(n,u,v);if(!z)return"";return Ut(z,v.paths,W).replace(/\\/g,"/")}function vd(n,u,v,W,z){let B=Ed(n,u,v);if(!B)return null;if(z(Cd(B)))return Ut(B,v.paths,W).replace(/\\/g,"/");let X=Kh(B,v.paths,W);return X===null?null:X.replace(/\\/g,"/")}function Ed(n,u,v){let W=v.home,z=Na(n.trim(),v).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?yd(W,z.slice(2)):z,X=pn(B);return Uh($h(X)?X:yd(u,X))}import{spawnSync as qh}from"node:child_process";import{accessSync as Rd,constants as _d,existsSync as Uo,lstatSync as Yh,opendirSync as Zh,readFileSync as Ho,realpathSync as oo,statSync as io}from"node:fs";import{dirname as Ad,isAbsolute as La,join as Mn,resolve as Bi}from"node:path";var Xh=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jh=5000;function Pd(n,u=fy(),v=Jh){let W=Qh(n),z=W===null?null:ey(W);if(W===null||z===null)return null;let B=uy(W,z,u,v);return B===null?null:{recursiveSubmodules:B}}function Qh(n){try{let u=oo(Bi(n));return io(u).isDirectory()?u:null}catch{return null}}function ey(n){let u=dy(n);if(!u)return null;try{let v=Yh(u);if(v.isSymbolicLink()||!v.isFile())return null;let W=Wa(u);if(!W?.commonDir)return null;if(!ry(W.gitDir,u))return null;return kd(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function Wa(n){try{let u=ty(n);if(!u)return null;let v=oo(La(u)?u:Bi(Ad(n),u));if(!io(v).isDirectory())return null;return{gitDir:v,commonDir:ny(v)}}catch{return null}}function ty(n){let u=Ho(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function ny(n){try{let u=Ho(Mn(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let v=oo(La(u)?u:Bi(n,u));return io(v).isDirectory()?v:null}catch{return null}}function ry(n,u){let v=oy(n);return v===null?!1:iy(n,v,u)}function oy(n){let u=Mn(n,"gitdir");if(!Uo(u))return null;let v=Ho(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return v===""?null:v}function iy(n,u,v){try{return sy(La(u)?u:Bi(n,u),v)}catch{return!1}}function sy(n,u){try{let v=io(n),W=io(u);if(v.ino!==0&&W.ino!==0&&v.dev===W.dev&&v.ino===W.ino)return!0}catch{}return xd(oo.native(n))===xd(oo.native(u))}function xd(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),v=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?v.toLowerCase():v}function Td(n){try{return Rd(Mn(n,"objects"),_d.X_OK),Rd(Mn(n,"refs"),_d.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Od(Mn(n,"HEAD")))}catch{return!1}}function Id(n){return Uo(Mn(n,"commondir"))||kd(n,n)}function kd(n,u){return[Mn(u,"config"),Mn(n,"config.worktree")].some(ay)||cy(n)}var wd=1048576;function Od(n){let u=io(n);if(!u.isFile()||u.size>wd)throw Error(`${n} is not a regular file within ${wd} bytes`);return Ho(n,"utf-8")}function ay(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(Od(n))}catch(u){return u.code!=="ENOENT"}}var ly=1e4;function cy(n){let u=[n],v=0;try{while(u.length>0){let W=u.pop(),z=Zh(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(v++,B.isSymbolicLink()||B.isFIFO()||v>ly)return!0;let X=W===n&&B.name==="objects";if(B.isDirectory()&&!X)u.push(Mn(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function dy(n){try{return Fa(oo(n))}catch{return null}}function Fa(n){let u=n;while(!0){let v=Mn(u,".git");if(Uo(v))return v;let W=Ad(u);if(W===u)return null;u=W}}function uy(n,u,v,W){if(my(u))return!0;if(v===null)return!0;let z=qh(v,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:py(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&Md(z.stdout.trim())}function my(n){return[Mn(n.commonDir,"config"),Mn(n.gitDir,"config.worktree")].filter((u)=>Uo(u)).some((u)=>gy(u))}function fy(){return Xh.find((n)=>Uo(n))??null}function jo(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function py(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!jo(u)))}function gy(n){let u;try{u=Ho(n,"utf-8")}catch{return!0}let v="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let X=B.match(/^\[([^\]]+)\]$/);if(X){v=X[1]?.trim().toLowerCase()??"";continue}let Q=B.indexOf("="),le=(Q===-1?B:B.slice(0,Q)).trim().toLowerCase(),ue=Q===-1?"true":B.slice(Q+1).trim();if(hy(v)&&le==="path")return!0;if(v==="submodule"&&le==="recurse")W=Md(ue)}return W}function hy(n){return n==="include"||n.startsWith("includeif ")}function Md(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Dd(n,u){if(n==="")return null;let v=On(),W=Fa(gn(n,n,u,v)),z=W?Cy(W,n,u,v):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Cy(n,u,v,W){try{let z=gn(n,u,v,W),B=yy(n),X=B.isFile()?z:null,Q=B.isFile()?Wa(n):null,le=(B.isDirectory()?[z]:[Q?.gitDir,Q?.commonDir]).flatMap((be)=>be?[so(gn(be,u,v,W))]:[]),ue=[...new Set(B.isDirectory()?[so(n.replace(/\\/g,"/")),...le]:le)];return{entry:so(z),markerFile:X?so(X):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((be)=>{let De=so(Sy(be,"hooks").replace(/\\/g,"/"));return[De,so(gn(De,u,v,W))]}))]}}catch{return null}}function so(n){return process.platform==="win32"?n.toLowerCase():n}var wy={realpath:(n)=>{try{return Ey(n)}catch{return null}},entryKind:(n)=>{try{let u=vy(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return Ry(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return Py({env:new Map(Object.entries(process.env).flatMap(([u,v])=>v===void 0?[]:[[u,v]])),home:pn(process.env.HOME||_y()),tmpdir:xy(),darwinUserTempDir:()=>Ui(n,"",Ay),paths:wy})}function Ay(){if(process.platform!=="darwin")return null;let n=by("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function Py(n,u={}){let v=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(X)=>Ui(v,X,()=>Dd(X,B)),worktreeFacts:(X)=>Ui(W,X,()=>Pd(X)),isGitDirectory:Td,gitDirectoryRedirects:(X)=>Ui(z,X,()=>Id(X)),...u};return B}function Ui(n,u,v){let W=n.get(u);if(W!==void 0)return W;let z=v();return n.set(u,z),z}import{accessSync as Xy,constants as Yd,statSync as Jy}from"node:fs";import{isAbsolute as Ba,relative as Qy,resolve as Zd,sep as eS}from"node:path";import{types as Ty}from"node:util";var Iy=new Set(["applypatch","patch"]),ky=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Oy=new Set(["grep","grepsearch","rg"]),My=new Set(["find","findbyname","glob"]),Dy=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ny=new Set(["command","diff","input","patch","patchtext"]),Nd=new TextEncoder,Ly=new TextDecoder,Wy=/\s/,Fy=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Vo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function $e(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function ji(n){return Dy.has($e(n))}function b(n){let u=$e(n);if(Iy.has(u))return"patch";if(Oy.has(u))return"grep";if(My.has(u))return"glob";if(ky.has(u))return"path";return"unknown"}function de(n){if(!n||typeof n!=="object")return;Vd(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)er();return}if(u.get||u.set)er();let v=u.value;return typeof v==="string"&&v!==""?v:void 0}function zd(n,u){return $d(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function $d(n,u,v,W,z){let B=jd(n,W,z);if(typeof n==="string")return v?[n]:[];if(!B)return[];let X=B.entries.flatMap(([Q,le])=>$d(le,u,B.array?v:u.has(Bd(Q)),W,z+1));return W.ancestors.delete(B.object),X}function Bd(n){return n.replace(/-/g,"_").toLowerCase()}function Ud(n){return Hd(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(zy)}function Hd(n,u,v,W){let z=jd(n,v,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([X,Q])=>Hd(Q,z.array?u:Ny.has(Bd(X)),v,W+1));return v.ancestors.delete(z.object),B}function Gy(n,u,v){if(u.nodes++,n!==null&&typeof n==="object"&&v>Vo.maxDepth||u.nodes>Vo.maxNodes)er();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>Vo.maxStringBytes||u.stringBytes>Vo.maxAggregateStringBytes)er()}function jd(n,u,v){if(Gy(n,u,v),!n||typeof n!=="object")return null;let W=Vd(n);if(u.ancestors.has(n))er();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>Vo.maxKeys)er();let B=z.flatMap((X)=>{let Q=Object.getOwnPropertyDescriptor(n,X);if(!Q||Q.get||Q.set)er();return typeof X==="string"&&Q.enumerable?[[X,Q.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function Vd(n){if(Ty.isProxy(n))er();let u=Array.isArray(n),v=Object.getPrototypeOf(n);if(u&&v!==Array.prototype||!u&&v!==Object.prototype&&v!==null)er();return u}function er(){throw new h}function zy(n){let u=[],v=n.split(/\r?\n/),W=!1,z=!1,B=null,X=null,Q=()=>{z=!1,B=null,X=null};for(let le=0;le<v.length;le++){let ue=v[le]??"";if(ue==="*** Begin Patch"){W=!0,Q();continue}if(ue==="*** End Patch"){W=!1,Q();continue}if(ue.startsWith("@@")){let be=$y(ue);if(z=!0,B=be?.oldLines??null,X=be?.newLines??null,B===0&&X===0)Q();continue}if(z&&B!==null&&X!==null){let be=ue.startsWith(" ")||ue.startsWith("-")?1:0,De=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-be),X=Math.max(0,X-De),B===0&&X===0)Q();continue}if(ue.startsWith("*** ")){Q(),u.push(...Ga(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...Ga(ue));continue}if(ue.startsWith("--- ")){let be=v[le+1]??"";if(!be.startsWith("+++ "))continue;u.push(...$a(Hi(ue.slice(4),!0),Hi(be.slice(4),!0))),le++;continue}if(!W)u.push(...Ga(ue))}return u}function $y(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function Ga(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return Gd(u[1]);let v=/^\*\*\* Move to: (.+)$/.exec(n);if(v?.[1])return Gd(v[1]);if(n.startsWith("diff --git "))return By(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return Fd(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return Fd(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return Yy(B[1]);return[]}function By(n){let u=Uy(n);if(u.length===2&&u[0]&&u[1])return $a(u[0],u[1]);let v=Hy(n);return v?$a(n.slice(v.oldStart,v.oldEnd),n.slice(v.newStart,v.newEnd)):[]}function Uy(n){let u=[],v=0;while(v<n.length&&u.length<2){while(Or(n[v]))v++;if(v>=n.length)break;let W=n[v]==='"'||n[v]==="'"?n[v]:void 0;if(!W){let B=v;while(v<n.length&&!Or(n[v]))v++;u.push(n.slice(B,v));continue}let z=Kd(n,v,W);if(!z)return[];u.push(z.value),v=z.end}while(Or(n[v]))v++;return v===n.length?u:[]}function Hy(n){let u=0;while(u<n.length&&Or(n[u]))u++;let v=n.length;while(v>u&&Or(n[v-1]))v--;let W=0,z=u;while(z<v){if(!Or(n[z])){z++;continue}let B=z;while(z<v&&Or(n[z]))z++;if(B===u||z===v)continue;if(W++,W>Fy)er();if(jy(n,u,B,z,v))return{oldStart:u,oldEnd:B,newStart:z,newEnd:v}}return null}function jy(n,u,v,W,z){if(za(n,u,v,W,z))return!0;let B=Ld(n,"/",u,v),X=Ld(n,"/",W,z);if(B<=u||X<=W)return!1;if(za(n,u,B,W,X))return!1;return za(n,B+1,v,X+1,z)}function za(n,u,v,W,z){if(v-u!==z-W)return!1;for(let B=0;B<v-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function Ld(n,u,v,W){for(let z=v;z<W;z++)if(n[z]===u)return z;return-1}function Or(n){return n!==void 0&&Wy.test(n)}function Kd(n,u,v){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===v)return{value:Ly.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||v==="'"){W.push(...Nd.encode(B)),z+=B.length;continue}let X=n.slice(z+1),Q=/^[0-7]{1,3}/.exec(X)?.[0];if(Q){W.push(Number.parseInt(Q,8)),z+=Q.length+1;continue}W.push(...Nd.encode(Vy(X[0]??""))),z+=2}return null}function Vy(n){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n}function Ky(n){return Ko(Zy(n))}function $a(n,u){if(n==="/dev/null")return Wd(u);if(u==="/dev/null")return Wd(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(Ko);let v=qy(n,u)??(n===u?qd(n):null);return[n,u,...v?[v]:[]].flatMap(Ko)}function Wd(n){let u=qd(n);return[n,...u?[u]:[]].flatMap(Ko)}function qd(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function qy(n,u){let v=n.indexOf("/"),W=u.indexOf("/");if(v<1||W<1)return null;if(n.slice(0,v)===u.slice(0,W))return null;let z=n.slice(v+1);return z===u.slice(W+1)?z:null}function Fd(n){return Ky(Hi(n,!0))}function Yy(n){return Ko(Hi(n,!1))}function Hi(n,u){let v=n.trim(),W=v[0]==='"'||v[0]==="'"?v[0]:void 0;if(W){let z=Kd(v,0,W);if(z&&(u||v.slice(z.end).trim()===""))return z.value}return u?v.split("\t",1)[0]?.trim()??"":v}function Zy(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function Ko(n){return n===""||n==="/dev/null"?[]:[n]}function Gd(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}function Se(n){try{if(!Jy(n).isDirectory())return!1;return Xy(n,Yd.R_OK|Yd.X_OK),!0}catch{return!1}}function It(n,u,v){if(or(n))return;let W=u.flatMap((B)=>Vi(B,v));if(!W[0])return;let z=Vi(Ba(n)?n:Zd(W[0],n),v)[0];if(!z)return;return W.some((B)=>tS(z,B))?z:void 0}function Xd(n,u,v){if(or(n))return;return Vi(Ba(n)?n:Zd(u,n),v)[0]}function mt(n,u){return n.flatMap((v)=>Vi(v,u))[0]}function Vi(n,u){let v=u.realpath(n);if(v===null)return[];return u.isDirectory(v)?[v]:[]}function tS(n,u){let v=Qy(u,n);return v===""||v!==".."&&!v.startsWith(`..${eS}`)&&!Ba(v)}var nS=8388608;async function gt(n){let u=[],v=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(v+=z.byteLength,v>nS)throw rS(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,v).toString("utf-8")}function rS(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,v,W,z){if(v.kind!=="command")return{toolName:n,input:u,route:v,context:W};return{toolName:n,input:u,route:v,context:W,command:z}}var ao=["fail_closed","paranoid_rm","paranoid_interpreters"],Ki={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},qi=["standard","strict","paranoid"];function Jd(n,u){if(!u)return n;return qi.indexOf(u)>qi.indexOf(n)?u:n}function Qd(n){let u=xe(r.level,n);return qi.find((v)=>v===u)}function eu(n,u){return Jd(n,Qd(u))}function oS(n){let u=xe(r.level,n);if(!u)return;let v=Qd(n);if(v)return v;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${qi.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function Fe(n){return ft(xe(r.auditScope,n))==="all"}function Ua(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let v=n.safety?.level??"standard",W=oS(u),z=Jd(v,W),B=Ki[z],X={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},Q={failClosed:z===v?"preset":"environment",paranoidRm:z===v?"preset":"environment",paranoidInterpreters:z===v?"preset":"environment"},le={failClosed:[`policy safety.level=${v}`],paranoidRm:[`policy safety.level=${v}`],paranoidInterpreters:[`policy safety.level=${v}`]};if(z!==v)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)X.failClosed=n.safety.overrides.failClosed,Q.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)X.paranoidRm=n.safety.overrides.paranoidRm,Q.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)X.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,Q.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))X.failClosed=!0,Q.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))X.paranoidRm=!0,X.paranoidInterpreters=!0,Q.paranoidRm="environment",Q.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))X.paranoidRm=!0,Q.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))X.paranoidInterpreters=!0,Q.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:X.failClosed,paranoidRm:X.paranoidRm,paranoidInterpreters:X.paranoidInterpreters,worktreeMode:ue,effectiveLevel:Ua(X),capabilities:{fail_closed:{enabled:X.failClosed,source:Q.failClosed,sources:le.failClosed},paranoid_rm:{enabled:X.paranoidRm,source:Q.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:X.paranoidInterpreters,source:Q.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let v=typeof n==="string"?qo(n,u):xe(n,u);return v==="1"||v?.toLowerCase()==="true"}function qo(n,u){return u.get(n)}function xe(n,u){let v=qo(n.name,u);if(v!==void 0)return v;if(n.legacyName)return qo(n.legacyName,u);return}function At(n,u){return qo(n.name,u)!==void 0||!!n.legacyName&&qo(n.legacyName,u)!==void 0}import{dirname as Wr}from"node:path";import{closeSync as iS,constants as Yo,fstatSync as Ha,fsyncSync as sS,lstatSync as Dn,mkdirSync as tu,openSync as nu,readdirSync as Va,readFileSync as aS,realpathSync as lo,renameSync as lS,rmdirSync as ru,statSync as ja,unlinkSync as Ka,writeFileSync as cS}from"node:fs";import{isAbsolute as ou,join as Mr,normalize as dS,parse as Yi,relative as qa,resolve as Ya,sep as Zi}from"node:path";function Ve(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var uS=Symbol("PolicyFilesystemScope"),mS=Symbol("PolicyFilesystemTarget"),iu=Yo.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[uS]:!0,root:Ya(n),label:u}}function Zo(n,u){let v=dS(u);if(u===""||ou(u)||v===".."||v.startsWith(`..${Zi}`))throw new i(n.label);return{[mS]:!0,scope:n,relativePath:v,path:Mr(n.root,v)}}function s(n,u){return Zo(n,qa(n.root,Ya(u)))}function pe(n,u="rules policy"){let v=Ya(n),W=Yi(v).dir;return Zo(R(W,u),qa(W,v))}function o(n){return ir(n.scope.label,()=>{if(!cn(n))return null;let u=nu(n.path,Yo.O_RDONLY|iu);return au(u,()=>{let v=Ha(u);if(!v.isFile())throw new i(n.scope.label);let W=aS(u,"utf-8"),z=Dn(n.path);if(!z.isFile()||z.isSymbolicLink()||v.dev!==z.dev||v.ino!==z.ino)throw new i(n.scope.label);return cn(n),W})})}function x(n,u,v=384,W){let z=`${n.path}.${Ve()}.tmp`;ir(n.scope.label,()=>{pS(n),cn(n);let B=nu(z,Yo.O_CREAT|Yo.O_EXCL|Yo.O_WRONLY|iu,v),X=au(B,()=>{let Q=Ha(B);if(!Q.isFile())throw new i(n.scope.label);cS(B,u,"utf-8"),sS(B);let le=Ha(B);if(!le.isFile()||le.dev!==Q.dev||le.ino!==Q.ino)throw new i(n.scope.label);return le});cn(n),hS(n,z,X.dev,X.ino),lS(z,n.path),W?.(n.path),cn(n)},()=>yS(z))}function su(n,u){if(n.path===u.path)return!0;return ir(n.scope.label,()=>{if(!cn(n)||!cn(u))return!1;let v=(W)=>Mr(lo(Yi(W).dir),Yi(W).base);return v(n.path)===v(u.path)})}function we(n){let u=ir(n.scope.label,()=>{if(!cn(n,"directory"))return null;let v=Va(n.path);return cn(n,"directory"),v});if(!u)return null;return ir(n.scope.label,()=>{let v=u.map((W)=>{let z=Zo(n.scope,Mr(n.relativePath,W)),B=Dn(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return Xi(Za(n.scope),lo(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return cn(n,"directory"),v})}function q(n){ir(n.scope.label,()=>{if(!cn(n))return;Ka(n.path),cn(n)})}function Ot(n){ir(n.scope.label,()=>{if(!fS(n))return;cu(n),cn(n,"directory")})}function Dt(n){ir(n.scope.label,()=>{if(!cn(n,"directory"))return;ru(n.path),cn(n,"directory")})}function fS(n){return ir(n.scope.label,()=>{if(!cn(n,"directory"))return!1;return lu(n),!0})}function ir(n,u,v){try{return u()}catch(W){if(v?.(),W instanceof i)throw W;throw new i(n)}}function au(n,u){try{return u()}finally{iS(n)}}function cn(n,u="file"){let v=du(n.scope);if(!v)return!1;let W=n.relativePath.split(Zi);for(let z of W.keys()){let B=Mr(n.scope.root,...W.slice(0,z+1)),X=Dn(B,{throwIfNoEntry:!1});if(!X)return!1;if(X.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!X.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!X.isFile():!X.isDirectory()))throw new i(n.scope.label);Xi(v,lo(B),n.scope.label)}return!0}function lu(n){for(let u of Va(n.path)){let v=Zo(n.scope,Mr(n.relativePath,u)),W=Dn(v.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())lu(v)}cn(n,"directory")}function cu(n){for(let u of Va(n.path)){let v=Zo(n.scope,Mr(n.relativePath,u)),W=Dn(v.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){cu(v);continue}if(!W.isFile())throw new i(n.scope.label);Ka(v.path)}ru(n.path)}function pS(n){gS(n.scope);let u=Za(n.scope),v=n.relativePath.split(Zi).slice(0,-1);for(let W of v.keys()){let z=Mr(n.scope.root,...v.slice(0,W+1));if(!Dn(z,{throwIfNoEntry:!1}))tu(z,{mode:448});let B=Dn(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);Xi(u,lo(z),n.scope.label)}}function gS(n){if(Dn(n.root,{throwIfNoEntry:!1})){if(!ja(n.root).isDirectory())throw new i(n.label);return}let u=[],v=n.root;while(!Dn(v,{throwIfNoEntry:!1})){u.unshift(v);let W=Yi(v).dir;if(W===v)throw new i(n.label);v=W}if(!ja(v).isDirectory())throw new i(n.label);for(let W of u){tu(W,{mode:448});let z=Dn(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function du(n){if(!Dn(n.root,{throwIfNoEntry:!1}))return null;if(!ja(n.root).isDirectory())throw new i(n.label);return lo(n.root)}function Za(n){let u=du(n);if(!u)throw new i(n.label);return u}function hS(n,u,v,W){let z=Dn(u);if(!z.isFile()||z.isSymbolicLink()||z.dev!==v||z.ino!==W)throw new i(n.scope.label);Xi(Za(n.scope),lo(u),n.scope.label)}function Xi(n,u,v){let W=qa(n,u);if(W===".."||W.startsWith(`..${Zi}`)||ou(W))throw new i(v)}function yS(n){try{Ka(n)}catch{}}import{dirname as Dr,isAbsolute as ES,join as Nr,relative as RS,resolve as yr,sep as _S}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ce="rulebook.json",Ee=".cc-safety-net/rules";var uu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,SS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,mu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,CS=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),bS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Nt=new RegExp(`^${CS}/(${m.source.slice(1,-1)})/${bS}$`);function vS(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function fu(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(uu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let v=u[3].lastIndexOf("/");if(v<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,v),z=u[3].slice(v+1);if(!W||!mu.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:vS(z),name:z}}function re(n){return SS.test(n)}function fe(n){return mu.test(n)}function T(n){return uu.test(n)}function Lt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var pu="rule.json",Ji="policy.json",gu=".cc-safety-net",xS="rules",wS="CC_SAFETY_NET_HOME",hu="`cc-safety-net rule update`";function AS(n){return yr(n,Ee)}function D(n){return Nr(AS(n),pu)}function S(n){return Nr(yr(n),gu,Ji)}function me(n,u={}){return u.userConfigDir??(u.userConfigPath?Dr(u.userConfigPath):Nr(PS(n),xS))}function PS(n){let u=n.env.get(wS);return u?yr(pn(u)):Nr(n.home,gu)}function K(n,u={}){return Nr(me(n,u),pu)}function p(n,u={}){return Nr(Dr(me(n,u)),Ji)}function L(n,u){let v=On();return Ut(S(u.cwd),n.paths,v)===Ut(yr(p(n,u)),n.paths,v)}function oe(n,u){let v=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=ht(n,u),B=yt(W,u.cwd);return{userConfigPath:v,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,v),projectConfigTarget:s(B,W)}}function ht(n,u){let v=u.userConfigPath?Dr(Dr(yr(u.userConfigPath))):Dr(yr(u.userConfigDir??me(n,u)));return R(v,"user policy")}function yt(n,u){let v=yr(u),W=yr(n),z=RS(v,W);if(z!==".."&&!z.startsWith(`..${_S}`)&&!ES(z))return R(v,"project policy");return R(Dr(Dr(W)),"project policy")}function U(n,u){return Nr(n,u,Ce)}var Pn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,nn=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),yu=new Set(["python","python3","python2","node","ruby","perl"]),Qi=/^python(?:[23](?:\.\d+)*)?$/,Nn=new Set(["awk","gawk","nawk","mawk"]),es=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Su="Rulebook exceeds CC Safety Net's safe validation limits.",Cu="Additional rulebook validation errors were omitted.",Un=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function bu(n){if(Xa(n.allowed_commands,Un.maxAllowedCommands)||Xa(n.rules,Un.maxRules)||Xa(n.tests,Un.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:v}=Un,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>Un.maxStringCodeUnits||B&&z.length>Un.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let X=B.match&&typeof B.match==="object"?B.match:{};for(let Q of[B.block_args,X.command_path,X.any_args,X.exclude_args]){if(!Array.isArray(Q))continue;if(Q.length>Un.maxBlockArgsPerRule||Q.length>v)return!1;v-=Q.length;for(let le of Q)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function Xa(n,u){return Array.isArray(n)&&n.length>u}var Ja=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ke=64,Re="Rule config exceeds CC Safety Net's safe source limit.";function $t(n){return zt(n).toLowerCase()}function zt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function En(n,u){let v=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let X=z[B];if(!X||!/[a-zA-Z]/.test(X))break;let Q=`-${X}`;if(v.add(Q),u?.shortOptsWithValue?.has(Q))break}}return v}var TS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Qa=new Set(["--init-file","--rcfile"]);function el(n,u,v,W){let z=!1,B=0,X=!1,Q=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let be=u.slice(le+1);if(u[0]==="-"&&(be==="c"||be[0]==="-"&&be.endsWith("c")))X=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(v?.startsWith("-")||v?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")X=!0;if(W==="argv"&&ue==="s")Q=u[0]==="-";if(!TS[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:X,stdinMode:Q}}function Rn(n){let u=zt(n[0]??"").toLowerCase(),v=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let Q=v&&n[z+1]!==void 0?z+1:null;return{command:Q===null?null:n[Q]??null,commandIndex:Q,scriptIndex:!v&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!v&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:v?B:null,commandIndex:v?z:null,scriptIndex:!v&&!W&&B!=="-"?z:null,readsStdinAsCommands:!v&&(W||B==="-")};if(B.startsWith("--")){let Q=B.split("=",1)[0]??B;if(u==="bash"&&Qa.has(Q)&&!B.includes("="))z++;continue}let X=el(u,B,n[z+1],"argv");if(X.commandSelected)v=!0;if(X.stdinMode)W=!0;z+=X.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!v}}function Xo(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function ts(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let v of IS(n))Xo(v,u);return u.inSingle||u.inDouble}function IS(n){let u="",v={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let X=n[B];if(!X)break;if(W){if(X===`
-`||X==="\r")u+=X,W=!1,v.escaped=!1;continue}if(X==="#"&&!v.inSingle&&!v.inDouble&&z){W=!0;continue}if(u+=X,!v.inSingle&&!v.inDouble&&!v.escaped)z=/[\s;&|()<>]/.test(X);Xo(X,v)}return u}var tl=new Set(["rm","find","rsync","xargs","parallel"]),kS=new Set(["git","busybox",...tl,...nn,...yu,...Nn]),OS=new Set(["python","node","ruby","perl"]);function qe(n){let u=$t(n);return kS.has(u)||Hn(u)}function Hn(n){return OS.has(MS(n))}function MS(n){let u=zt(n).toLowerCase();return Qi.test(u)?"python":u}var ge={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(DS(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let v=JSON.parse(u),W=vt(v);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:v.rules??[],overrides:v.overrides??{},transparent_wrappers:v.transparent_wrappers??[],...v.command_tools?{command_tools:v.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let v=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":v]}}}function DS(n){return typeof n==="string"?pe(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),an=(n,u)=>({path:n,message:u,kind:"custom"});function Ke(n){let u=new Set;return n.flatMap((v,W)=>{let z=Lr(v)?v.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[an(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var je=`must be one of ${Ja.join(", ")}`,NS=/^[^/]+\/[^/]+$/,LS=["version","rules","overrides","transparent_wrappers","command_tools"],Je=/^[^\s\p{Cc}]{1,256}$/u,Te="non-empty, at most 256 characters, no whitespace or control characters";function vt(n){let u=WS(n);return{errors:he(bt(u,LS,(v)=>v.kind==="custom"),": "," "),sources:VS(n,u)}}function WS(n){if(!Lr(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>ke;return[...n.version===1?[]:[e(["version"],"must be 1")],...FS(n.rules,u),...$S(n.overrides),...US(n.transparent_wrappers),...u?[]:zS(n.rules),...Lr(n.overrides)?Object.keys(n.overrides).filter((v)=>!NS.test(v)).map((v)=>an(["overrides",v],"must use <rulebook-name>/<rule-name>")):[],...HS(n.transparent_wrappers),...jS(n.command_tools)]}function FS(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...vu(n,ke)?[e(["rules"],Re)]:[]];if(u)return[{path:["rules"],message:Re,kind:"limit"}];return n.flatMap((v,W)=>{if(typeof v!=="string")return[e(["rules",W],"must be a rulebook source string"),...GS(v,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return v===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function vu(n,u){let v=Eu(n);return v!==void 0&&!(v<=u)}function GS(n,u){let v=Eu(n);return v!==void 0&&!(v>=u)}function Eu(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function zS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||v==="")return[];if(v.trim()==="")return[an(["rules",W],"must be a non-empty rulebook source string")];let z=fu(v);if(z)return[an(["rules",W],z)];if(u.has(v))return[an(["rules",W],`duplicate rulebook source "${v}"`)];return u.add(v),[]})}function $S(n){if(n===void 0)return[];if(!Lr(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let v=n[u];if(v==="off")return[];if(!Lr(v))return[e(["overrides",u],'must be "off" or an object')];return[...BS(v.reason,["overrides",u,"reason"]),...v.intent===void 0||Ue(v.intent)?[]:[e(["overrides",u,"intent"],je)]]})}function BS(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...vu(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function US(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,v)=>{if(typeof u!=="string")return[e(["transparent_wrappers",v],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",v],"must match command pattern")]})}function HS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[an(["transparent_wrappers",W],`duplicate command "${v}"`)];if(qe(v))return[an(["transparent_wrappers",W],`reserved command "${v}" cannot be a wrapper`)];return u.add(v),[]})}function jS(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,v=(W,z)=>{if(u.has(W))return[an(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return nl(W)?v(W,z):[e(["command_tools",z],`must be a tool name: ${Te}`)];if(!Lr(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...nl(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Te}`)],...W.cwd===void 0||nl(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name: ${Te}`)]];return B.length>0?B:v(W.name,z)})}function nl(n){return typeof n==="string"&&Je.test(n)}function VS(n,u){let v=Lr(n)?n.rules:void 0;if(!Array.isArray(v))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(v.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function bt(n,u,v){let W=n.map((X)=>X.path[1]),z=[...new Set(W.filter((X)=>typeof X==="string"))],B=(X,Q)=>[X.path.length===0?-1:u.indexOf(String(X.path[0])),typeof Q==="number"?Q:z.indexOf(String(Q)),v(X)?0:1];return n.map((X,Q)=>({issue:X,rank:B(X,W[Q])})).sort((X,Q)=>X.rank[0]-Q.rank[0]||X.rank[1]-Q.rank[1]||X.rank[2]-Q.rank[2]).map((X)=>X.issue)}function he(n,u,v){return[...new Set(n.map((W)=>{let z=rl(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?v:u}${W.message}`}))]}function rl(n){return n.map((u,v)=>{if(typeof u==="number")return`[${u}]`;return v===0?String(u):`.${String(u)}`}).join("")}function Ue(n){return Ja.includes(n)}function Lr(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ye(n){let u=YS(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var KS=`required non-empty string up to ${M} characters`,Ru="must be a non-empty array of unique non-empty strings",qS="required non-empty array of non-empty strings";function YS(n){if(!Sr(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!bu(n))return{errors:[Su],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...he(ZS(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>Un.maxValidationErrors?[...u.slice(0,Un.maxValidationErrors),Cu]:u,ruleNames:new Set(Ye(n).map((v)=>v.toLowerCase()))}}function Ye(n){let u=Sr(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((v)=>{let W=Sr(v)?v.name:void 0;return typeof W==="string"?[W]:[]})}function ZS(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],...XS(n.allowed_commands),...JS(n.rules,u),...nC(n.tests),...rC(n),...oC(n)]}function XS(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((v,W)=>typeof v==="string"&&P.test(v)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[an(["allowed_commands",W],`duplicate command "${v}"`)];return u.add(v),[]})]}function JS(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((v,W)=>{if(!Sr(v))return[e(["rules",W],"must be an object")];return u?eC(v,["rules",W]):QS(v,["rules",W])}),...Ke(n)]}function QS(n,u){return[..._u(n.name,u),...xu(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...ns(n.block_args,[...u,"block_args"],"required non-empty array",!1),...wu(n.reason,u),...Au(n.intent,u)]}function eC(n,u){return[..._u(n.name,u),...xu(n.command,u),...wu(n.reason,u),...Au(n.intent,u),...tC(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function _u(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function xu(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function wu(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],KS)]}function Au(n,u){return n===void 0||Ue(n)?[]:[e([...u,"intent"],je)]}function tC(n,u){if(!Sr(n))return[e(u,"required object")];return[...ns(n.command_path,[...u,"command_path"],qS,!1),...n.any_args===void 0?[]:ns(n.any_args,[...u,"any_args"],Ru,!0),...n.exclude_args===void 0?[]:ns(n.exclude_args,[...u,"exclude_args"],Ru,!0)]}function ns(n,u,v,W){if(!Array.isArray(n))return[e(u,v)];let z=n.flatMap((B,X)=>{if(typeof B!=="string")return[e([...u,X],"must be a non-empty string")];return B===""?[an([...u,X],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[an(u,v)]:[],...W&&new Set(n).size!==n.length?[an(u,"must not contain duplicate values")]:[]]}function nC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,v)=>{if(!Sr(u))return[e(["tests",v],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",v,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",v,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",v,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[an(["tests",v,"rule"],"required string for blocked fixtures")]:[]]})}function rC(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ye(n));return[...new Set(n.tests.flatMap((v)=>Sr(v)&&v.expect==="blocked"&&typeof v.rule==="string"?[v.rule]:[]))].filter((v)=>!u.has(v)).map((v)=>an(["tests"],`blocked fixture references unknown rule "${v}"`))}function oC(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((v)=>typeof v==="string"));return n.rules.flatMap((v,W)=>{let z=Sr(v)?v.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[an(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function Sr(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ie(n,u){let v=oe(n,u),W;try{W=su(v.userConfigTarget,v.projectConfigTarget)}catch(Oe){if(Oe instanceof i)return pC(v,Oe.message);throw Oe}let z=f(v.userConfigTarget),B=W?{config:null,errors:[]}:f(v.projectConfigTarget),X=Iu(v.userConfigPath,z.errors),Q=Iu(v.projectConfigPath,B.errors),le=new Set,ue=z.config?ol(z.config,Wr(v.userConfigPath),"user",v.userScope,le):ku(),be=B.config?ol(B.config,Wr(v.projectConfigPath),"project",v.projectScope,le):ku(),De=z.config?.overrides??{},Ie=B.config?.overrides??{};return{rules:[...Tu(ue.rules,De),...Tu(be.rules,Ie)],transparent_wrappers:uC(z.config,B.config),command_tools:mC(z.config,B.config),rulebooks:[...ue.rulebooks,...be.rulebooks],errors:[...X,...Q,...ue.errors,...be.errors],warnings:[...ue.warnings,...be.warnings,...ue.canValidateOverrides?il(De,ue.knownRuleIds,v.userConfigPath):[],...ue.canValidateOverrides?fC(Ie,ue.knownRuleIds,v.projectConfigPath):[],...be.canValidateOverrides?il(Ie,be.knownRuleIds,v.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...v}}function J(n,u){let v=iC(n,u);if(!v)return[];return[...v.scope.errors,...v.scope.warnings,...sC(v.config,v.scope,n)]}function iC(n,u){let v=u??R(Wr(Wr(n)),"rules policy"),W=f(s(v,n)).config;if(!W)return null;return{config:W,scope:ol(W,Wr(n),"project",v)}}function sC(n,u,v){return u.canValidateOverrides?il(n.overrides??{},u.knownRuleIds,v):[]}function ol(n,u,v,W=R(Wr(Wr(u)),v==="user"?"user policy":"project policy"),z=new Set){let B=[],X=[],Q=n.rules.flatMap((ue)=>{let be=lC(ue,u,W);if(be.errors.length>0||!be.rulebook)return B.push(...be.errors),[];let De=be.rulebook;if(z.has(De.name))return X.push(`duplicate active rulebook name "${De.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(De.name),[{rules:aC(De),rulebook:{source:v,spec:ue,name:De.name,version:De.version,rules:De.rules.map((Ie)=>`${De.name}/${Ie.name}`)}}]}),le=Q.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:Q.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:X,canValidateOverrides:B.length===0}}function aC(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function lC(n,u,v){let W=Ze(n),z=U(u,W),B=dC(z,v);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${cC(n)}`]};let X=Pe(B.content);if("problem"in X)return{rulebook:null,errors:[`invalid rulebook ${z}: ${X.problem}; fix that file`]};if(X.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${X.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:X.rulebook,errors:[]}}function Ze(n){return T(n)?j(n).name:n}function cC(n){return T(n)?`run ${hu} to vendor ${n}`:"create that file or remove that source from the rules config"}function dC(n,u){try{return{content:o(s(u,n))}}catch(v){if(v instanceof i)return{error:v.message};throw v}}function Pe(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ye(u)}}catch(v){return{problem:v instanceof Error?v.message:"invalid rulebook"}}}function uC(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function mC(n,u){let v=(n?.command_tools??[]).map(Pu),W=(u?.command_tools??[]).map(Pu);return[...v,...W.filter((z)=>!v.some((B)=>B.name===z.name))]}function Pu(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function Tu(n,u){return n.flatMap((v)=>{let W=u[v.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...v,intent:W.intent??v.intent,reason:W.reason}];return[v]})}function il(n,u,v){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${v}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function fC(n,u,v){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${v}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Iu(n,u){return u.map((v)=>v.startsWith("Unable to access ")?v:`${n}: ${v}`)}function pC(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function ku(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as xC,readFileSync as wC}from"node:fs";var Ou=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],sl=new Set(Ou.map((n)=>n.id)),Y=Ou,gC=new Map(Y.map((n)=>[n.id,n.intent]));function lt(n,u){return{id:n,reason:u,intent:gC.get(n)??"manual_only"}}var al=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],rs={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},hC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],yC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ll=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...yC.flatMap((n)=>hC.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var os=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Mu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],SC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],cl=Mu.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),dl=Mu.flatMap((n)=>SC.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),Jo={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ul=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),ml=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...al,rs,...ll,...cl,...dl,Jo,...ul,...ml,...os].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),is=new Set(os.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),fl=new Set(xt.map((n)=>n.id));import{isAbsolute as pl,join as CC,normalize as bC,sep as ss}from"node:path";var as=process.platform==="win32",Du=/[*?]/;function gl(n){let u=n.trim(),v=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(as?u.replaceAll("\\","/"):u);if(!v)return null;let W=v[1]??"",z=v[2]??"";if(Du.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function Qo(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function hl(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let v=Qo(n.trim(),u);if(!pl(v))return"must be an absolute path or start with ~/";return ei(v,u)}function yl(n,u){let v=Nu(n,u);if(v===null)return"must be a non-empty path string";if(!pl(v))return null;if(ei(v,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var vC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",EC="cannot cover the guard's own configuration";function Nu(n,u){if(typeof n!=="string"||n.trim()==="")return null;let v=n.trim(),W=as?v.replaceAll("\\","/"):v;return Qo(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function Sl(n,u){let v=Nu(n,u);if(v===null)return"must be a non-empty path string";let W=gl(v)?.root??v;if(Du.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!pl(W))return null;if(ei(W,u)!==null)return vC;return RC(W,u)?EC:null}function RC(n,u){let v=ls(n),W=ls(CC(u,".cc-safety-net"));return v===W||v.startsWith(`${W}${ss}`)}function ei(n,u){let v=ls(n),W=ls(u);if(v===W)return"cannot be the home directory";let z=v.endsWith(ss)?v:`${v}${ss}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function ls(n){let u=bC(n);if(as)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(as?3:1)&&u.endsWith(ss))u=u.slice(0,-1);return u}var Lu=30,cs=1,ds=365;function Wu(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Fu=new Set(Y.filter((n)=>n.catastrophic).map((n)=>n.id));function Tt(n,u){if(!n)return null;if(Fu.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let v=u?.effectiveDestructiveCommandRules[n.id];return v&&!v.enabled?null:n}function ln(n,u,v){if(Fu.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??v}function Z(n,u){return Object.freeze(Object.fromEntries(Y.map((v)=>{let W=v.activationCapability?u[v.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[v.id],X=v.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...v.activationCapability?{activationCapability:v.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...v.activationCapability?{activationCapability:v.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...v.activationCapability?{activationCapability:v.activationCapability}:{},...B?{override:B}:{}};return[v.id,Object.freeze(X)]})))}function Gu(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:Z(n,u)})}var zu={standard:0,strict:1,paranoid:2};function se(n,u,v=!1,W=n.safety.level){let z=_C(n,u,W),B=new Set(v?z.map((be)=>be.field):[]),X=(be,De)=>B.has(be)?void 0:De,Q=(be,De)=>Object.fromEntries(Object.entries(De??{}).filter(([Ie])=>!B.has(`${be}.${Ie}`))),le=(be,De)=>De?.filter((Ie)=>!B.has(`${be}.${Ie}`));return{policy:{version:1,safety:{level:X("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...Q("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:X("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:X("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...Q("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:Cl(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:X("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...Q("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:Cl(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:Cl(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((be)=>be.message)}}function Cl(n,u){return[...new Set([...n,...u??[]])]}function _C(n,u,v){let W=u.safety?.level,z=Ki[v];return[...W&&zu[W]<zu[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...ao.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...$u("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...$u("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!is.has(B))),...n.destructive_command_protection.enabled?Bu(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?Bu(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function $u(n,u,v){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&v(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function Bu(n,u){return(u??[]).filter((v)=>!n.includes(v))}var vl=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Lu}};function ju(n,u){let v=OC(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:Qe(S(u.cwd),n.home),z=ve(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),X=v.gui??ae,Q=Object.keys(z.policy).length>0?se(X,z.policy,B,eu(X.safety.level,n.env)):void 0,le=[...v.errors,...W.errors,...z.diagnostics],ue=(v.fallback==="defaults"&&Q?"salvaged":v.fallback)??(v.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),be=z.policy.safety?.level&&Q?.policy.safety.level===z.policy.safety.level?"project":v.levelPresent?"user":"default";return{...Q?ti(Q.policy):v.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:be,weakenings:Q?.weakenings??[],weakeningsIgnored:B}}:{}}}var AC="project policy audit settings are ignored; audit is user scope only";function ve(n,u){if(!Tn(n))return{policy:{},diagnostics:[]};let v=Tn(n.safety)?n.safety:{},W=Tn(n.workflow)?n.workflow:{},z=Tn(n.destructive_command_protection)?n.destructive_command_protection:{},B=Tn(n.secret_protection)?n.secret_protection:{},X={...vl.has(v.level)?{level:v.level}:{},...Tn(v.overrides)?Uu({overrides:Vu(v.overrides,ao,["safety","overrides"],Fr)}):{}},Q={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:us(z.overrides,sl,qu,Fr)}:{},...z.allow_paths!==void 0?{allow_paths:uo(z.allow_paths,hl,u,["destructive_command_protection","allow_paths"],Fr)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:us(B.overrides,fl,Yu,Fr)}:{},...B.deny_paths!==void 0?{deny_paths:uo(B.deny_paths,yl,u,["secret_protection","deny_paths"],Fr)}:{},...B.allow_paths!==void 0?{allow_paths:uo(B.allow_paths,Sl,u,["secret_protection","allow_paths"],Fr)}:{}};return{policy:Uu({safety:X,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:Q,secret_protection:le}),diagnostics:n.audit===void 0?[]:[AC]}}function Vu(n,u,v,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...v,z],El));return[]}))}function Uu(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Fr=()=>{return},El="must be a boolean",Rl="must be an object if provided",Ku=`must be an integer between ${cs} and ${ds}`,qu={path:["destructive_command_protection","overrides"],label:"destructive command"},Yu={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let v=[];return{policy:Zu(n,u,(z)=>{v.push(z)}),issues:v}}function _(n,u){return Zu(n,u,Fr)}function Zu(n,u,v){if(!Tn(n))return v(e([],"Config must be an object")),N();if(n.version!==1)v(e(["version"],"must be 1"));let W=co(n.safety,["safety"],["level","overrides"],v),z=co(W.overrides,["safety","overrides"],ao,v),B=co(n.workflow,["workflow"],["worktree_mode"],v),X=co(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],v),Q=co(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],v),le=co(n.audit,["audit"],["retention_days"],v);return Xu(n,St,[],v),{version:1,safety:{level:PC(W.level,v),overrides:Vu(z,ao,["safety","overrides"],v)},workflow:{worktree_mode:bl(B.worktree_mode,["workflow","worktree_mode"],!1,v)},destructive_command_protection:{enabled:bl(X.enabled,["destructive_command_protection","enabled"],!0,v),overrides:us(X.overrides,sl,qu,v),allow_paths:uo(X.allow_paths,hl,u,["destructive_command_protection","allow_paths"],v)},secret_protection:{enabled:bl(Q.enabled,["secret_protection","enabled"],!0,v),overrides:us(Q.overrides,fl,Yu,v),deny_paths:uo(Q.deny_paths,yl,u,["secret_protection","deny_paths"],v),allow_paths:uo(Q.allow_paths,Sl,u,["secret_protection","allow_paths"],v)},audit:{retention_days:TC(le.retention_days,v)}}}function co(n,u,v,W){if(n===void 0)return{};if(!Tn(n))return W(e(u,Rl)),{};return Xu(n,v,u,W),n}function Xu(n,u,v,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:v,message:z,kind:"unknownKeys"})}function PC(n,u){if(n===void 0)return"standard";if(vl.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function bl(n,u,v,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,El));return v}function TC(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=cs&&n<=ds))u(e(["audit","retention_days"],Ku));return Wu(n)}function us(n,u,v,W){if(n===void 0)return{};if(!Tn(n))return W(e(v.path,Rl)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...v.path,z],message:`unknown ${v.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...v.path,z],'must be "on" or "off"')),[]}))}function uo(n,u,v,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,X)=>{let Q=u(B,v);if(Q===null)return[B];return z(typeof B==="string"?an([...W,X],Q):e([...W,X],Q)),[]})}function Tn(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Xe(n,u){let v=O({safety:et(n.safety)},u),W=Z({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},v.capabilities),z=Object.values(W),B=z.filter((X)=>X.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:v.effectiveLevel,capabilities:v.capabilities,rules:W,counts:{enabled:B.filter((X)=>X.enabled).length,disabled:B.filter((X)=>!X.enabled).length,effectiveCustomizations:z.filter((X)=>X.changesInherited).length}}}function Qe(n,u){if(!xC(n))return{exists:!1,policy:N(),errors:[]};try{let v=wC(n,"utf-8");if(!v.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(v),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${kC(B)}`),fallback:Tn(W)?"salvaged":"defaults"}}catch(v){let W=v instanceof Error?v.message:String(v);return{exists:!0,policy:N(),errors:[`${n}: ${v instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var IC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Rl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[El,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Ku,`not an integer between ${cs} and ${ds}`]]);function kC(n){let u=rl(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let v=IC.get(n.message)??n.message;return u===""?v:`${u}: ${v}`}function OC(n,u){let v=Qe(n,u);if(!v.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Tn(W))return{policy:ti(N()),errors:[]};let z=_(W,u);return{policy:ti(z),gui:z,errors:[],levelPresent:Hu(W)}}if(v.parsed===void 0)return{policy:ti(N()),errors:v.errors,...v.fallback?{fallback:v.fallback}:{}};return{policy:ti(v.policy),gui:v.policy,errors:v.errors,...v.fallback?{fallback:v.fallback}:{},levelPresent:Hu(v.parsed)}}function Hu(n){let u=Tn(n)&&Tn(n.safety)?n.safety:{};return vl.has(u.level)}function Ct(n){let u=Object.entries(n),v=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...is].filter((W)=>!v.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function ti(n){return{safety:et(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function et(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let v=ie(n,u),W=ju(n,u),z={rules:v.rules,transparentWrappers:v.transparent_wrappers,commandTools:v.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...v.userConfig?.overrides,...v.projectConfig?.overrides},X=Object.freeze(Object.fromEntries(z.rules.map((Q)=>{let le=v.rulebooks.find((be)=>be.rules.includes(Q.name)),ue=B[Q.name];return[Q.name,Object.freeze({id:Q.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...LC(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return He(z,MC(v,W),X,W.policyScopes)}function tt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function MC(n,u){let v=NC(u);if(n.errors.length===0&&n.warnings.length===0&&!v)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:WC(n.errors.length>0?DC(n.errors):void 0,n.warnings.length>0?xl(n.warnings.join("; ")):void 0,v)}}function DC(n){return`${xl(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function NC(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function LC(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function He(n,u,v=Object.freeze({}),W){let z=_l(structuredClone(n)),B=W?{policyScopes:_l(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:v,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:v,...B})}function _l(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))_l(u);return Object.freeze(n)}function WC(...n){return xl(n.filter((u)=>!!u).join("; "))}function xl(n){return/[.!?]$/.test(n)?n:`${n}.`}function nt(n){let u=n.effectiveCapabilities,v=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:Gu(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:Ua({failClosed:v,paranoidRm:W,paranoidInterpreters:z}),strict:v,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as ZA,isAbsolute as XA,join as JA,parse as QA,resolve as eP,sep as tP}from"node:path";function ni(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let v=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[v]?.provenance;return W!==void 0&&W!=="literal"}var FC=/^[A-Za-z_][A-Za-z0-9_]*=/;function ms(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function ri(n){let u=ms(n.words[0],"time")?1:0,v=u===1&&ms(n.words[u],"-p")?u+1:u,W=u===1&&ms(n.words[v],"--")?v+1:v,z=ms(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((X)=>!FC.test(X.text));return B?.provenance==="literal"?B.text:void 0}var Cr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function fs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function ps(n,u,v){n.push(v),u.reset()}function gs(n){let u=[];return{parts:u,push:(v,W,z)=>{if(W<=v)return;u.push({raw:n.slice(v,W),span:{start:v,end:W},provenance:z})}}}function wl(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function mo(n,u,v,W,z,B,X){return wl({text:W,raw:n.slice(u,v),span:{start:u,end:v},provenance:z,quoted:B,...X?{parts:X}:{}})}function Al(n,u,v){if(u>=v||Qu(n[u]??""))return null;let W="",z=!1,B=!1,X=u;while(X<v&&!Qu(n[X]??"")){let Q=n[X]??"";if(Q==="'"){z=!0;let le=Ju(n,X+1,v,"'");W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==='"'){z=!0;let le=Ju(n,X+1,v,'"');W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==="\\"){z=!0;let le=n[X+1];if(!le||le===`
-`||le==="\r"){B=!0;break}W+=le,X+=2;continue}if(Q==="`"||n.startsWith("$(",X)||n.startsWith("${",X)||n.startsWith("<(",X)||n.startsWith(">(",X))B=!0;W+=Q,X++}return{delimiter:W,quoted:z,next:X,ambiguous:B}}function Pl(n,u,v,W){let z=[],B=u;for(let X of W){let Q=B,le=!1;while(B<v){let ue=GC(n,B,v);if((X.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===X.delimiter){X.attach({body:X.stripTabs?zC(n.slice(Q,B)):n.slice(Q,B),delimiter:X.delimiter,quotedDelimiter:X.quotedDelimiter,bodySpan:{start:Q,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${X.delimiter} was not found`}),{next:v,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function Ju(n,u,v,W){let z="",B=u;while(B<v&&n[B]!==`
-`&&n[B]!=="\r"){let X=n[B]??"";if(X===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&X==="\\"&&n[B+1]){let Q=n[B+1]??"";z+=["$","`",'"',"\\"].includes(Q)?Q:`\\${Q}`,B+=2;continue}z+=X,B++}return{text:z,next:B,closed:!1}}function Qu(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function GC(n,u,v){let W=u;while(W<v&&n[W]!==`
-`)W++;let z=W>=v?v:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function zC(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var om=new Set(["&&","||","|","|&"]),$C=new Set(["!","do","elif","else","if","then","until","while"]);function im(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=Ss(n,0,n.length,u,W,0),B=[...z.issues,...XC(n,W.quotedExpansionEnd,z.nodes)?[cm]:[],...YC.test(n)?[lm]:[]];return{kind:"program",dialect:"posix",source:n,span:v,status:bs(B,z.limited),issues:B,nodes:z.nodes}}function Ss(n,u,v,W,z,B,X){let Q=[],le=[],ue=fs(),be=[],De=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Oe={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);ps(Q,ue,{kind:"command",dialect:"posix",source:n.slice(Oe.start,Oe.end),span:Oe,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&Q.length===0?n.slice(u,v):Ne.join(" ")})},Ie=u;while(Ie<v){let Oe=n[Ie];if(!Oe)break;if(X&&Oe===X)return De(),rm(Q,le),{nodes:Q,issues:le,next:Ie+1,closed:!0,limited:!1,pendingHeredocs:be};if(ii(Oe)){if(Oe.charCodeAt(0)>127)le.push(lm);if(Oe===`
-`||Oe==="\r"){De();let Et=Oe==="\r"&&n[Ie+1]===`
-`?Ie+2:Ie+1,Rt=Q.at(-1);if(Rt?.kind!=="connector"||!om.has(Rt.operator))Q.push({kind:"connector",operator:n.slice(Ie,Et),span:{start:Ie,end:Et}});if(be.length>0){let Wt=Pl(n,Et,v,be.splice(0));le.push(...Wt.issues),Ie=Wt.next;continue}Ie=Et;continue}Ie++;continue}if(Oe==="#"){while(Ie<v&&n[Ie]!==`
-`&&n[Ie]!=="\r")Ie++;continue}let Ne=ue.start===-1?gb(n,Ie,v):void 0;if(Ne){if(Il(Q,le),B>=W.maxDepth)return fo(Q,le,Ie,"depth-limit",W.maxDepth);if(!Tl(z))return fo(Q,le,Ie,"word-limit",W.maxWords);let Et=Ss(n,Ne.braceIndex+1,v,W,z,B+1,"}"),Rt=Et.next,Wt={start:Ne.braceIndex+1,end:Et.closed?Rt-1:Rt},Be=em(n,Wt,Et);if(Q.push({kind:"function",name:Ne.name,span:{start:Ie,end:Rt},body:Be}),le.push(...Et.issues),Et.pendingHeredocs.length>0||si(Et.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(be.push(...Et.pendingHeredocs),Et.limited)return ys(Q,le,Et.next);if(!Et.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});Ie=Rt;continue}let Le=Cs(n,Ie);if(Le){if(De(),!hm(Q.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});Q.push({kind:"connector",operator:Le,span:{start:Ie,end:Ie+Le.length}}),Ie+=Le.length;continue}if(Oe===")"){De(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Q.push({kind:"unknown",source:Oe,span:{start:Ie,end:Ie+1}}),Ie++;continue}if((Oe==="("||Oe==="{"&&nb(n,Ie,v))&&ue.start===-1){if(Il(Q,le),B>=W.maxDepth)return fo(Q,le,Ie,"depth-limit",W.maxDepth);let Et=Oe==="("?")":"}",Rt=Ss(n,Ie+1,v,W,z,B+1,Et),Wt=Rt.next,Be={start:Ie+1,end:Rt.closed?Wt-1:Wt},Ft=em(n,Be,Rt);if(Q.push({kind:"group",style:Oe==="("?"subshell":"brace",span:{start:Ie,end:Wt},body:Ft}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||si(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(be.push(...Rt.pendingHeredocs),Rt.limited)return ys(Q,le,Rt.next);if(!Rt.closed)le.push({code:Oe==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Oe} group is not closed`});Ie=Wt;continue}let We=(Oe==="<"||Oe===">")&&n[Ie+1]!=="("?jC(n,Ie):null;if(We){let Et=ue.words.at(-1),Rt=Et&&Et.span.end===Ie&&/^[0-9]+$/.test(Et.raw)?Number(Et.raw):void 0;if(Rt!==void 0)ue.words.pop();let Wt=Rt===void 0?Ie:Et?.span.start??Ie;ue.start=ue.start===-1?Ie:ue.start;let Be=Ie+We.length;while(Be<v&&/[ \t]/.test(n[Be]??""))Be++;let Ft=n[Be],kt=Be>Ie+We.length&&Ft==="#",tn=!Ft||ii(Ft)||!!Cs(n,Be)||Ft===X||Ft===")"||kt||(Ft==="<"||Ft===">")&&n[Be+1]!=="(",vn=We==="<<"||We==="<<-",Jt=vn?Al(n,Be,v):void 0,Yt=Jt?{word:mo(n,Be,Jt.next,Jt.delimiter,"literal",Jt.quoted),nested:[],issues:[],next:Jt.next,limited:!1}:!tn?kl(n,Be,v,W,z,B):void 0;if(Yt){if(le.push(...Yt.issues),Yt.limited)return ys(Q,le,Yt.next);if(!Tl(z))return fo(Q,le,Yt.next,"word-limit",W.maxWords)}let yn=Yt?.next??Ie+We.length,Qt={kind:"redirection",operator:We,span:{start:Wt,end:yn},...Rt===void 0?{}:{fd:Rt},...Yt?{target:Yt.word}:{}};if(ue.redirections.push(Qt),vn&&!Jt)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Jt){if(Jt.ambiguous||Jt.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let on=ue.nested;be.push({delimiter:Jt.delimiter,quotedDelimiter:Jt.quoted,stripTabs:We==="<<-",attach:(kn)=>{if(Qt.heredoc=kn,kn.quotedDelimiter)return;let Bn=UC(n,kn.bodySpan.start,kn.bodySpan.end,W,z,B+1);on.push(...Bn.programs),le.push(...Bn.issues)}})}if(!vn&&!Yt)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(Yt)ue.nested.push(...Yt.nested);ue.end=yn,Ie=yn;continue}let Ge=ue.start===-1;if(Ge)Il(Q,le);let st=kl(n,Ie,v,W,z,B);if(le.push(...st.issues),st.limited)return ys(Q,le,st.next);let it=ib(ue.words)?db(n,st.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(it?.limitCode)return fo(Q,le,st.next,it.limitCode,it.limitCode==="word-limit"?W.maxWords:it.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let at=it?.words??[st.word];for(let Et of at){if(!Tl(z))return fo(Q,le,st.next,"word-limit",W.maxWords);ue.words.push(Et)}if(ue.start=ue.start===-1?Ie:ue.start,ue.end=st.next,ue.nested.push(...st.nested),Ge&&ym(st.word))De();Ie=st.next>Ie?st.next:Ie+1}return De(),rm(Q,le),le.push(...hb(be)),{nodes:Q,issues:le,next:Ie,closed:X===void 0,limited:!1,pendingHeredocs:[]}}function em(n,u,v){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:bs(v.issues,v.limited),issues:v.issues,nodes:v.nodes}}function kl(n,u,v,W,z,B){let X="",Q=u,le=!1,ue="literal",be=[],De=[],Ie=!1;while(Q<v){let Oe=n[Q],Ne=(Oe==="<"||Oe===">")&&n[Q+1]==="(";if(!Oe||ii(Oe)||(Oe===";"||Oe==="|"||Oe==="&")&&Cs(n,Q)||(Oe==="<"||Oe===">")&&!Ne)break;if(Oe===")")break;if(Oe==="'"){le=!0;let Ge=n.indexOf("'",Q+1);if(Ge===-1||Ge>=v){X+=n.slice(Q+1,v),De.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Q=v;break}X+=n.slice(Q+1,Ge),Q=Ge+1;continue}if(Oe==='"'){le=!0;let Ge=BC(n,Q,v,W,z,B);if(X+=Ge.text,be.push(...Ge.nested),De.push(...Ge.issues),Ie||=Ge.limited,ue=oi(ue,Ge.provenance),Q=Ge.next,Ie)break;continue}if(n.startsWith("$'",Q)){le=!0;let Ge=QC(n,Q+2,v);if(X+=Ge.text,De.push(...Ge.issues),!Ge.closed)De.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Q=Ge.next;continue}if(Oe==="\\"){let Ge=n[Q+1];if(!Ge){De.push({code:"trailing-escape",message:"escape has no following character"}),Q++;break}if(Ge===`
-`){Q+=2;continue}X+=Ge,Q+=2;continue}if(zr(n,Q))De.push(Gr);let Le=Oe==="$"||Oe==="<"||Oe===">"||Oe==="`"?ai(n,Q,v,W,z,B):null,We=Le?Ml(Le,be,De):dm(n,Q,v,W,z,B,be,De);if(We){if(We.provenance==="variable")X+=n.slice(Q,We.next);if(Ie||=We.limited,ue=oi(ue,We.provenance),Q=We.next,Ie)break;continue}if(Oe==="$"){let Ge=mm(n,Q,v,X,ue);X=Ge.text,ue=Ge.provenance,Q=Ge.next;continue}if(Oe==="*"||Oe==="?"||Oe==="[")ue=oi(ue,"glob");X+=Oe,Q++}return{word:mo(n,u,Q,X,ue,le,ue==="literal"?void 0:tb(n,u,Q)),nested:be,issues:De,next:Q,limited:Ie}}function BC(n,u,v,W,z,B){let X="",Q="literal",le=[],ue=[],be=!1,De=u+1;while(De<v){let Ie=n[De];if(Ie==='"')return{text:X,provenance:Q,nested:le,issues:ue,next:De+1,limited:be};if(Ie==="\\"&&n[De+1]){let Le=n[De+1]??"";if(Le===`
-`){De+=2;continue}if(Le==="\r"&&n[De+2]===`
-`){De+=3;continue}X+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,De+=2;continue}if(zr(n,De))ue.push(Gr);let Oe=ai(n,De,v,W,z,B),Ne=Oe?Ml(Oe,le,ue):dm(n,De,v,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")X+=n.slice(De,Ne.next);if(De=Ne.next,be||=Ne.limited,Q=oi(Q,Ne.provenance),be)return{text:X,provenance:Q,nested:le,issues:ue,next:De,limited:be};continue}if(Ie==="$"){let Le=mm(n,De,v,X,Q);X=Le.text,Q=Le.provenance,De=Le.next;continue}X+=Ie??"",De++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:X,provenance:Q,nested:le,issues:ue,next:v,limited:be}}function ai(n,u,v,W,z,B){let X=am(n,u);if(!X)return null;let{length:Q,closing:le}=X,ue=le==="))",be=le==="`",De=n[u]==="<"||n[u]===">",Ie=Dl(n,u+Q,v,le),Oe=Ie===-1?v:Ie,Ne=Ie===-1?v:Ie+le.length;if(B>=W.maxDepth)return{program:pb(n,u+Q,Oe,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let at=[],Et=[],Rt=!1,Wt=u+Q;while(Wt<Oe){let Be=ai(n,Wt,Oe,W,z,B+1);if(!Be){if(zr(n,Wt))Et.push(Gr);Wt++;continue}if(at.push(...Be.program.nodes),Et.push(...Be.program.issues),Rt||=Be.program.status==="limited",Wt=Be.next,Rt)break}if(Ie===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Oe),span:{start:u+Q,end:Oe},status:bs(Et,Rt),issues:Et,nodes:at},next:Ne,provenance:"arithmetic"}}let Le=Ss(n,u+Q,Oe,W,z,B+1),We=Ie===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+Q)} substitution is not closed`}]:[],Ge=(be||De)&&si(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],st=be&&/\\[\\$`\n]/.test(n.slice(u+Q,Oe))?[JC]:[],it=[...Le.issues,...We,...Ge,...st];return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Oe),span:{start:u+Q,end:Oe},status:bs(it,Le.limited),issues:it,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function UC(n,u,v,W,z,B){let X=[],Q=[],le=u;while(le<v){let ue=n[le];if(ue==="\\"){le+=2;continue}let be=ue==="$"||ue==="`"?ai(n,le,v,W,z,B):null;if(!be){if(zr(n,le))Q.push(Gr);le++;continue}if(X.push(be.program),VC(n,le,be.next)&&KC(be.program))Q.push(Gr);le=be.next}return{programs:X,issues:Q}}function Ml(n,u,v){return u.push(n.program),v.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function Dl(n,u,v,W){if(W==="`"){for(let Q=u;Q<v;Q++){if(n[Q]==="\\"){Q++;continue}if(n[Q]==="`")return Q}return-1}let z={single:!1,double:!1},B=[],X=[];for(let Q=u;Q<v;Q++){let le=n[Q];if((le===`
-`||le==="\r")&&X.length>0){let De=le==="\r"&&n[Q+1]===`
-`?Q+2:Q+1,Ie=Pl(n,De,v,X.splice(0));if(!Ie.terminated)return-1;Q=Ie.next-1;continue}let ue=sm(n,Q,u,v,z);if(ue!==null){Q=ue;continue}if(!z.double&&n.startsWith("$((",Q)){let De=HC(n,Q+3,v);if(De===-1)return-1;Q=De+1;continue}if(W===")"&&!z.double&&le==="<"&&n[Q+1]==="<"&&n[Q+2]!=="<"){let De=n[Q+2]==="-",Ie=Q+(De?3:2);while(Ie<v&&/[ \t]/.test(n[Ie]??""))Ie++;let Oe=Al(n,Ie,v);if(Oe){X.push({delimiter:Oe.delimiter,quotedDelimiter:Oe.quoted,stripTabs:De,attach:()=>{return}}),Q=Oe.next-1;continue}}if(n.startsWith("$(",Q)&&!n.startsWith("$((",Q)){B.push(z),z={single:!1,double:!1},Q++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let be=B.pop();if(be){z=be;continue}return W==="))"&&n[Q+1]!==")"?-1:Q}return-1}function HC(n,u,v){let W=1,z={single:!1,double:!1};for(let B=u;B<v;B++){let X=n[B],Q=sm(n,B,u,v,z);if(Q!==null){B=Q;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(X==="("&&!z.double)W++;if(X!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function sm(n,u,v,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!yb(n,u,v))return null;let X=u;while(X+1<W&&n[X+1]!==`
-`&&n[X+1]!=="\r")X++;return X}function Cs(n,u){let v=n[u];if(v===";")return";";if(v==="&")return n[u+1]==="&"?"&&":"&";if(v==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function jC(n,u){let v=n[u];if(v===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(v!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function ii(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var Gr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function zr(n,u){if(n[u]!=="$")return!1;let v=tm(n,u+1);if(n[v]!=="{")return!1;let W=n[tm(n,v+1)]??"";return W==="|"||ii(W)}function VC(n,u,v){for(let W=n.indexOf("$",u);W!==-1&&W<v;W=n.indexOf("$",W+1))if(zr(n,W))return!0;return!1}function KC(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===Gr.code)}function tm(n,u){let v=u;while(n.startsWith("\\\n",v)||n.startsWith(`\\\r
-`,v))v+=n[v+1]==="\r"?3:2;return v}function am(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var qC=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),YC=/[\v\f\r]/,lm=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),cm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),ZC=/\$\(|`|[<>]\(/g;function XC(n,u,v){let W=Ol(v);return[...n.slice(u).matchAll(ZC)].some((z)=>{let B=u+z.index;return!W.some((X)=>B>=X.start&&B<X.end)})}function Ol(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((v)=>v.heredoc?[v.heredoc.bodySpan]:[]),...u.nested.flatMap((v)=>Ol(v.nodes))];return u.kind==="group"||u.kind==="function"?Ol(u.body.nodes):[]})}var JC=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function dm(n,u,v,W,z,B,X,Q){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=vs(n,u+2,v),ue=le.close===-1?v:le.close+1;if(le.close===-1)Q.push(qC);if(le.quoted&&le.substitutions.length>0||le.continued)Q.push(cm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let be=le.substitutions.some((De)=>{if(zr(n,De))return Q.push(Gr),!1;let Ie=ai(n,De,ue,W,z,B);return Ie!==null&&Ml(Ie,X,Q).limited});return{provenance:"variable",next:ue,limited:be}}function vs(n,u,v){let W=[],z=!1,B=!1,X=1,Q=u;while(Q<v){let le=n[Q];if(le==="$"&&zr(n,Q))W.push(Q);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[Q+1]===`
-`,Q+=le==="\\"?2:1;continue}let ue=am(n,Q);if(ue){W.push(Q);let be=Dl(n,Q+ue.length,v,ue.closing);if(be===-1)break;Q=be+ue.closing.length;continue}if(le==="$"&&n[Q+1]==="{"){X++,Q+=2;continue}if(le==="}"&&--X===0)return{close:Q,substitutions:W,quoted:z,continued:B};Q++}return{close:-1,substitutions:W,quoted:z,continued:B}}function um(n,u,v){if(n[u+1]==="{"){let z=vs(n,u+2,v).close;return z===-1?v:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<v&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function QC(n,u,v){let W="",z=[],B=u;while(B<v){let X=n[B];if(X==="'")return{text:W,next:B+1,closed:!0,issues:z};if(X!=="\\"){W+=X??"",B++;continue}let Q=eb(n,B+1,v);if(W+=Q.text,Q.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Q.invalidCodePoint}`});B=Q.next}return{text:W,next:v,closed:!1,issues:z}}function eb(n,u,v){let W=n[u];if(!W||u>=v)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return hs(n,u+1,v,16,2,u+1);if(W==="u")return hs(n,u+1,v,16,4,u+1);if(W==="U")return hs(n,u+1,v,16,8,u+1);if(/[0-7]/.test(W))return hs(n,u,v,8,3,u+1);return{text:W,next:u+1}}function hs(n,u,v,W,z,B){let X=W===16?/[0-9a-fA-F]/:/[0-7]/,Q="",le=u;while(le<v&&Q.length<z&&X.test(n[le]??""))Q+=n[le],le++;if(!Q)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(Q,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function bs(n,u=!1){if(u)return"limited";if(n.some((v)=>v.code==="invalid-ansi-c-code-point"||v.code==="missing-heredoc-delimiter"||v.code==="ambiguous-heredoc-delimiter"||v.code==="unterminated-heredoc"||v.code==="unsupported-heredoc-context"||v.code==="unsupported-function-substitution"||v.code==="unsupported-backtick-escape"||v.code==="unclosed-parameter-expansion"||v.code==="unsupported-parameter-expansion"||v.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function mm(n,u,v,W,z){let B=um(n,u,v);return{text:W+n.slice(u,B),provenance:oi(z,"variable"),next:B}}function tb(n,u,v){let W=gs(n),z=u,B=!1,X=!1,Q=u;while(Q<v){let le=n[Q];if(le==="\\"&&!B){Q+=2;continue}if(!X&&le==="'"){B=!B,Q++;continue}if(!B&&le==='"'){X=!X,Q++;continue}if(B){Q++;continue}let ue=n.startsWith("$((",Q),be=n.startsWith("$(",Q)&&!ue,De=!X&&(n.startsWith("<(",Q)||n.startsWith(">(",Q)),Ie=le==="`";if(ue||be||De||Ie){let Oe=ue?3:Ie?1:2,Ne=ue?"))":Ie?"`":")",Le=Dl(n,Q+Oe,v,Ne),We=Le===-1?v:Le+Ne.length;W.push(z,Q,"literal"),W.push(Q,We,ue?"arithmetic":"command-substitution"),Q=We,z=We;continue}if(le==="$"){let Oe=um(n,Q,v);if(Oe>Q+1){W.push(z,Q,"literal"),W.push(Q,Oe,"variable"),Q=Oe,z=Oe;continue}}if(!X&&(le==="*"||le==="?"||le==="[")){W.push(z,Q,"literal"),W.push(Q,Q+1,"glob"),Q++,z=Q;continue}Q++}return W.push(z,v,"literal"),W.parts}function oi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function nb(n,u,v){return u+1>=v||ii(n[u+1]??"")||Cs(n,u+1)!==null}var rb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function ib(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let v=sb(n,u);if(v===void 0||v===null)return!1;u=v}return!1}function sb(n,u){let v=n[u]?.text.toLowerCase();if(v==="command")return ab(n,u);if(v==="env")return lb(n,u);if(v==="sudo")return cb(n,u);return}function ab(n,u){if(n[u+1]?.text==="-v")return null;for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return v}return n.length}function lb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(rb.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return v}return n.length}function cb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(ob.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-"))continue;return v}return n.length}function fm(n,u,v,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=pm(n.raw,u,v,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((X)=>gm(X,v));if(B.some((X)=>X===null))return{limited:!0};return{words:[...new Set(B.filter((X)=>X!==null&&X!==""))]}}function db(n,u,v,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=pm(u.raw,v,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let X=B.values.map((Q)=>gm(Q,W));if(X.some((Q)=>Q===null))return;return{words:X.filter((Q)=>Q!==null&&Q!=="").map((Q)=>mo(n,u.span.start,u.span.end,Q,"literal",!1))}}function pm(n,u,v,W,z){let B=[n],X=n.length,Q=0;while(!0){let le=B.findIndex((Oe)=>nm(Oe,z));if(le===-1)break;if(++Q>v)return{limited:"expansions"};let ue=B[le]??"",be=nm(ue,z);if(!be||be.kind==="range")return{limited:"expansions"};let De=be.start+ue.length-be.end,Ie=be.alternatives.reduce((Oe,Ne)=>Oe+De+Ne.length,0);if(X-ue.length+Ie>W)return{limited:"length"};if(B.length-1+be.alternatives.length>u)return{limited:"words"};B.splice(le,1,...ub(ue,be)),X+=Ie-ue.length}return Q===0?void 0:{values:B}}function nm(n,u){let v=[],W,z=null,B=!1;for(let X=0;X<n.length;X++){let Q=n[X];if(B){B=!1;continue}if(Q==="\\"&&z!=="'"){B=!0;continue}if(Q===z){z=null;continue}if(z===null&&(Q==="'"||Q==='"')){z=Q;continue}if(z!==null)continue;if(Q==="{"){v.push({start:X,commas:[]});continue}if(Q===","&&v.length>0){v.at(-1)?.commas.push(X);continue}if(Q!=="}"||v.length===0)continue;let le=v.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:X+1,commas:le.commas}:u&&fb(n.slice(le.start+1,X))?{kind:"range",start:le.start,end:X+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:mb(n,W)}}function ub(n,u){return u.alternatives.map((v)=>`${n.slice(0,u.start)}${v}${n.slice(u.end)}`)}function mb(n,u){let v=[u.start,...u.commas,u.end-1];return v.slice(0,-1).map((W,z)=>n.slice(W+1,v[z+1]))}function fb(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function gm(n,u){let v=`x${n}`,W=kl(v,0,v.length,{maxInputLength:v.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==v.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function pb(n,u,v,W){return{kind:"program",dialect:"posix",source:n.slice(u,v),span:{start:u,end:v},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function fo(n,u,v,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function ys(n,u,v){return{nodes:n,issues:u,next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function Tl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function gb(n,u,v){let W=n.slice(u,v),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function si(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((v)=>v.heredoc)||u.nested.some((v)=>si(v.nodes));return(u.kind==="group"||u.kind==="function")&&si(u.body.nodes)})}function hb(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function hm(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function rm(n,u){let v=n.at(-1);if(v?.kind!=="connector"||!om.has(v.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${v.operator} requires a following command`})}function ym(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&$C.has(n.text)}function Il(n,u){let v=n.at(-1);if(!hm(v))return;if(v?.kind==="command"&&ym(v.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function yb(n,u,v){return u===v||/[\s;&|()]/u.test(n[u-1]??"")}var Cm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object"]),Sb=new Set(["gc","cat","type","cp","mv","rm"]),bm=["-rec","-for","-path","-literalpath","-whatif"],Cb=/^\$env:\w/i,bb=/^(?:\$\{?\w+\}?|~)\\./;function vm(n,u){let v=n.toLowerCase().replaceAll("`","");if(![...Cm].some((z)=>v.includes(z))&&!(v.includes("rm")&&bm.some((z)=>v.includes(z)))&&!v.includes("<#")&&!vb(v))return!1;let W=Fl(n,u);if(Em(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||Wl(W).some(Eb)}function Em(n){return n.nodes.some((u)=>{if(u.kind==="group")return Em(u.body);if(u.kind!=="command")return!1;return u.redirections.some((v)=>v.operator==="<<")})}function vb(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function Eb(n){let u=n[0]==="&"||n[0]==="."?1:0,v=n[u]?.toLowerCase();if(v&&Cm.has(v))return!0;let W=n.slice(u+1);if(v&&Sb.has(v)&&W.some(Rb))return!0;if(v!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return bm.some((X)=>B.startsWith(X))})}function Rb(n){return Cb.test(n)||bb.test(n)}function Fl(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=Gl(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:v,status:Pb(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function Gl(n,u,v,W,z,B=!1){let X=[],Q=[],le=fs(),ue=0,be=!1,De=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Oe={start:le.start,end:le.end};ps(X,le,{kind:"command",dialect:"powershell",source:n.slice(Oe.start,Oe.end),span:Oe,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},Ie=u;while(Ie<v){let Oe=n[Ie];if(!Oe)break;if(B&&Oe==="}")return De(),{nodes:X,issues:Q,next:Ie+1,closed:!0,words:ue,limited:be};let Ne=Ab(n,Ie,v,W.maxDepth);if(Ne){if(Ne.issue)Q.push(Ne.issue);if(Ne.limited)return De(),{nodes:X,issues:Q,next:Ne.next,closed:!1,words:ue,limited:!0};Ie=Ne.next;continue}if(/\s/.test(Oe)){if(Oe==="\r"||Oe===`
-`){De();let Ge=Oe==="\r"&&n[Ie+1]===`
-`?Ie+2:Ie+1;X.push(Nl(n,Ie,Ge)),Ie=Ge;continue}Ie++;continue}let Le=xm(n,Ie);if(Le){De(),X.push(Nl(n,Ie,Ie+Le.length)),Ie+=Le.length;continue}if(Oe==="{"){if(De(),z>=W.maxDepth)return Q.push(_m(W.maxDepth)),{nodes:X,issues:Q,next:v,closed:!1,words:ue,limited:!0};let Ge=Gl(n,Ie+1,v,W,z+1,!0),st=Ge.closed?Ge.next-1:Ge.next,it={kind:"program",dialect:"powershell",source:n.slice(Ie+1,st),span:{start:Ie+1,end:st},status:Ge.limited?"limited":Ge.issues.length>0?"partial":"complete",issues:Ge.issues,nodes:Ge.nodes};if(X.push({kind:"group",style:"brace",span:{start:Ie,end:Ge.next},body:it}),Q.push(...Ge.issues),!Ge.closed)Q.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=Ge.words,be||=Ge.limited,Ie=Ge.next;continue}if(Oe==="}"){De(),X.push(Nl(n,Ie,Ie+1)),Ie++;continue}if(Oe===">"||Oe==="<"){le.start=le.start===-1?Ie:le.start;let Ge=n[Ie+1]===Oe?Ie+2:Ie+1,st=Ge;while(/[ \t]/.test(n[st]??""))st++;let it=st<v?Sm(n,st,v,W,z):void 0,at=it?.next??Ge;if(le.redirections.push({kind:"redirection",operator:n.slice(Ie,Ge),span:{start:Ie,end:at},...it?{target:it.word}:{}}),it)Q.push(...it.issues),le.nested.push(...it.nested),ue+=it.words,be||=it.limited;le.end=at,Ie=at;continue}if(Oe===","){le.start=le.start===-1?Ie:le.start,le.words.push(wl({text:",",raw:",",span:{start:Ie,end:Ie+1},provenance:"literal",quoted:!1})),le.end=++Ie;continue}let We=Sm(n,Ie,v,W,z);if(le.start=le.start===-1?Ie:le.start,le.end=We.next,le.words.push(We.word),Q.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,be||=We.limited,ue>W.maxWords)return Q.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),De(),{nodes:X,issues:Q,next:We.next,closed:!1,words:ue,limited:!0};Ie=We.next>Ie?We.next:Ie+1}return De(),{nodes:X,issues:Q,next:Ie,closed:!B,words:ue,limited:be}}function Sm(n,u,v,W,z){let B="",X="literal",Q=!1,le=[],ue=[],be=0,De=!1,Ie=(Ne)=>{let Le=_b(n,Ne,v,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),be+=Ll(Le.program),De||=Le.program.status==="limited",X="command-substitution",Le.next},Oe=u;while(Oe<v){let Ne=n[Oe];if(!Ne||/\s/.test(Ne)||xm(n,Oe)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let Le=n[Oe+1];if(!Le){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Oe++;break}B+=Le,Oe+=2;continue}if(n.startsWith("$(",Oe)){Oe=Ie(Oe);continue}if(Ne==="'"){Q=!0,Oe++;let Le=!1;while(Oe<n.length){if(n[Oe]==="'"&&n[Oe+1]==="'"){B+="'",Oe+=2;continue}if(n[Oe]==="'"){Le=!0,Oe++;break}B+=n[Oe]??"",Oe++}if(!Le)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Ne==='"'){Q=!0,Oe++;let Le=!1;while(Oe<v){let We=n[Oe];if(We==="`"&&n[Oe+1]){B+=n[Oe+1],Oe+=2;continue}if(We==='"'){Le=!0,Oe++;break}if(n.startsWith("$(",Oe)){Oe=Ie(Oe);continue}if(We==="$")X=n[Oe+1]==="("?"command-substitution":"variable";B+=We??"",Oe++}if(!Le)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")X=n[Oe+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Oe===u)X="variable";B+=Ne,Oe++}return{word:mo(n,u,Oe,B,X,Q,X==="literal"?void 0:xb(n,u,Oe)),next:Oe,issues:le,nested:ue,words:be,limited:De}}function _b(n,u,v,W,z){let B=Rm(n,u+2,v),X=B===-1?v:B,Q=B===-1?v:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:"limited",issues:[_m(W.maxDepth)],nodes:[]},next:Q};let le=Gl(n,u+2,X,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:Q}}function Rm(n,u,v){let W=1,z=!1,B=!1;for(let X=u;X<v;X++){let Q=n[X];if(Q==="`"){X++;continue}if(!B&&Q==="'"){if(z&&n[X+1]==="'"){X++;continue}z=!z;continue}if(!z&&Q==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",X)){W++,X++;continue}if(!B&&Q==="(")W++;if(Q!==")")continue;if(W--,W===0)return X}return-1}function Ll(n){let u=0;for(let v of n.nodes){if(v.kind==="group")u+=Ll(v.body);if(v.kind==="command"){u+=v.words.length;for(let W of v.nested)u+=Ll(W)}}return u}function xb(n,u,v){let W=gs(n),z=u,B=!1,X=u;while(X<v){let Q=n[X];if(Q==="`"){X+=2;continue}if(Q==="'"){if(B&&n[X+1]==="'"){X+=2;continue}B=!B,X++;continue}if(B){X++;continue}if(n.startsWith("$(",X)){let le=Rm(n,X+2,v),ue=le===-1?v:le+1;W.push(z,X,"literal"),W.push(X,ue,"command-substitution"),X=ue,z=ue;continue}if(Q==="$"||Q==="@"&&X===u){let le=wb(n,X+1,v);W.push(z,X,"literal"),W.push(X,le,"variable"),X=le,z=le;continue}X++}return W.push(z,v,"literal"),W.parts}function wb(n,u,v){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=v?v:z+1}let W=u;while(W<v&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function _m(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function Wl(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return Wl(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((v)=>v.target?[v.target]:[])].sort((v,W)=>v.span.start-W.span.start).filter((v)=>v.text!==""&&v.raw!==",").map((v)=>v.text),...u.nested.flatMap(Wl)]})}function xm(n,u){for(let v of["&&","||",";","|"])if(n.startsWith(v,u))return v;return null}function Ab(n,u,v,W){if(n[u]==="#"&&n[u+1]!==">"){let X=u+1;while(X<v&&n[X]!=="\r"&&n[X]!==`
-`)X++;return{next:X,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<v){if(n.startsWith("<#",B)){if(z++,z>W)return{next:v,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:v,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Pb(n,u){if(u)return"limited";if(n.some((v)=>v.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function Nl(n,u,v){return{kind:"connector",operator:n.slice(u,v),span:{start:u,end:v}}}function C(n,u="auto",v=Cr){if(u==="powershell"||u==="auto"&&vm(n.slice(0,v.maxInputLength),v))return Fl(n,v);return im(n,v)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:en(u.map((v)=>v.text))}function po(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function en(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function zl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function rn(n){return n.value.length}function li(n,u,v=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*v)}function _n(n,u){li(n,u)}function $r(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Zt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function $l(n){return n===`
-`||n==="\r"||n==="\u2028"||n==="\u2029"}function Xt(n,u,v){if(u+v.length>rn(n))return!1;for(let W=0;W<v.length;W++)if(ct(n,u+W)!==v[W])return!1;return!0}function sr(n,u,v){return!$r(ct(n,u-1))&&Xt(n,u,v)&&!$r(ct(n,u+v.length))}function ar(n,u){return $r(ct(n,u-1))!==$r(ct(n,u))}function dn(n){return n===`
-`||n===";"||n==="&"||n==="|"}function go(n){return n==="|"||n===";"}function Es(n,u,v){let W=zl(n,v);if(u==="rm")return Tb(W);if(u==="dd")return kb(W);return km(W,!0)}function Rs(n,u,v){let W=zl(n,v);if(u==="rm")return Ob(W);if(u==="reset-hard")return Tm(W,"--ha","rd");if(u==="reset-merge")return Tm(W,"--me","rge");if(u==="clean")return Lb(W);if(u==="checkout")return Fb(W);if(u==="push-force")return Gb(W);if(u==="push-refspec")return zb(W);if(u==="push-delete")return $b(W);if(u==="branch")return Bb(W);if(u==="tag")return jb(W);if(u==="restore")return Vb(W);return km(W,!1)}function Tb(n){let u=!1,v=!1,W=!1,z=-1;for(let B=0;B<=rn(n);B++){let X=ct(n,B);if(!u){let le=ct(n,B+2);if(sr(n,B,"rm")&&Zt(le)&&le!==`
-`)u=!0,B++;continue}let Q=Ib(n,B);if(X===`
-`||Q!==-1){if(u=!1,v=!1,W=!1,z=-1,Q!==-1)B=Q-1;continue}if(X===";"||X==="&"||X==="|"||B===rn(n)){if(z>=0){let le=wm(n,z,B);v||=le.recursive,W||=le.force}if(v&&W)return!0;u=!1,v=!1,W=!1,z=-1;continue}if(Zt(X)){if(z<0)continue;if(Xt(n,z,"--")&&B-z===2){u=!1,v=!1,W=!1,z=-1;continue}let le=wm(n,z,B);if(v||=le.recursive,W||=le.force,v&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function Ib(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(Xt(n,u,String.raw`\n`))return u+2;if(Xt(n,u,String.raw`\x0a`)||Xt(n,u,String.raw`\x0A`))return u+5;if(Xt(n,u,String.raw`\u000a`)||Xt(n,u,String.raw`\u000A`))return u+7;return Xt(n,u,String.raw`\012`)?u+4:-1}function wm(n,u,v){if(Am(n,u,v,"recursive"))return{recursive:!0,force:!1};if(Am(n,u,v,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<v;B++){let X=ct(n,B);W||=X==="r"||X==="R",z||=X==="f"||X==="F"}return{recursive:W,force:z}}function Am(n,u,v,W){let z=v-u-2;if(z<1||z>W.length||!Xt(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function kb(n){let u=!1;for(let v=0;v<rn(n);v++){if(dn(ct(n,v))){u=!1;continue}if(sr(n,v,"dd")){u=!0,v++;continue}if(!u||!sr(n,v,"of")||!Xt(n,v,"of=/dev/"))continue;let W=v+8;if(W<rn(n)&&!Zt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function Ob(n){let u=!1,v=!1,W=!1;for(let z=0;z<=rn(n);){let B=ct(n,z);if(z===rn(n)||dn(B)){u=!1,v=!1,W=!1,z++;continue}let X=Db(n,z);if(X>=0){if(Mb(n,X))return!0;let Q=X,le=!1;while(Zt(ct(n,Q)))le||=ct(n,Q)===`
-`,Q++;if(le)v=!1,W=!1;u=!0,z=Q;continue}if(!u){z++;continue}if(Xt(n,z,"--")&&(z===0||Zt(ct(n,z-1)))&&(!ct(n,z+2)||Zt(ct(n,z+2))||dn(ct(n,z+2)))){u=!1,v=!1,W=!1,z+=2;continue}if(v||=Xt(n,z,"--recursive")&&ar(n,z+11)||Bl(n,z,"recursive"),W||=Xt(n,z,"--force")&&ar(n,z+7)||Bl(n,z,"force"),v&&W)return!0;z++}return!1}function Bl(n,u,v){if(!Xt(n,u,"--"))return!1;let W=0;while(W<=v.length){let z=ct(n,u+W+2);if(!z||Zt(z)||dn(z))break;if(z!==v[W])return!1;W++}return W>0&&ar(n,u+W+2)}function Mb(n,u){let v=u,W=!1,z=!1;while(v<rn(n)){while(Zt(ct(n,v)))v++;let B=v;while(v<rn(n)&&!Zt(ct(n,v)))v++;if(ct(n,B)!=="-"||v-B===2&&Xt(n,B,"--"))return!1;let X=Pm(n,B,"recursive"),Q=Pm(n,B,"force");if(W&&Q||z&&X)return!0;if(W||=X,z||=Q,ct(n,B+1)==="-")continue;let le=Nb(n,B,v);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Pm(n,u,v){return Xt(n,u,`--${v}`)&&ar(n,u+v.length+2)||Bl(n,u,v)}function Db(n,u){if(u>0&&$r(ct(n,u-1)))return-1;let v=u;if(ct(n,v)==="\\")v++;if(ct(n,v)!=="r")return-1;if(v++,ct(n,v)==="\\")v++;if(ct(n,v)!=="m"||!Zt(ct(n,v+1)))return-1;return v+1}function Nb(n,u,v){let W=!1,z=!1,B=!1,X=!1,Q=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q};let le="";for(let ue=u+1;ue<v;ue++){let be=ct(n,ue)??"",De=(be==="r"||be==="f")&&ar(n,ue+1);W||=be==="r",z||=be==="f",B||=be==="r"&&De,X||=be==="f"&&De,Q||=(le==="r"&&be==="f"||le==="f"&&be==="r")&&De,le=be}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q}}function Tm(n,u,v){return di(n,"reset",go,!0,(W)=>ct(n,W)==="-"&&ho(n,W,u,v)?!0:W)}function Lb(n){return di(n,"clean",go,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ho(n,u,"--fo","rce"))return!0;let v=ci(n,u,go);for(let W=u+1;W<v;W++)if(ct(n,W)==="f")return!0;return v-1})}function _s(n,u,v){if(!sr(n,u,"git"))return null;let W=u+3;if(!Zt(ct(n,W)))return{commandEnd:-1,next:W};while(Zt(ct(n,W)))W++;while(W<rn(n)){if(dn(ct(n,W)))return{commandEnd:-1,next:W};let z=ci(n,W,dn);if(sr(n,W,v))return{commandEnd:W+v.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&Xt(n,W,"--"),X=Wb(n,W,z);W=z;while(Zt(ct(n,W)))W++;if(B)return{commandEnd:sr(n,W,v)?W+v.length:-1,next:ci(n,W,dn)};if(!X)continue;if(W>=rn(n)||dn(ct(n,W)))return{commandEnd:-1,next:W};W=ci(n,W,dn);while(Zt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function Wb(n,u,v){for(let W of Pn)if(v-u===W.length&&Xt(n,u,W))return!0;return!1}function Fb(n){return Im(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Gb(n){return di(n,"push",go,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!$r(ct(n,u+2))&&!Xt(n,u+2,"-with-lease"))return!0;let v=Om(n,u,"--fo","rce");if(v>=0&&!Xt(n,v,"-with-lease"))return!0;return u})}function zb(n){return di(n,"push",dn,!1,(u)=>{if(Zt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<rn(n)&&!dn(ct(n,u+2))&&!Zt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function $b(n){return di(n,"push",dn,!1,(u)=>{if(ct(n,u)==="-"&&ho(n,u,"--de","lete"))return!0;if(Zt(ct(n,u))&&ct(n,u+1)===":"&&u+2<rn(n)&&!Zt(ct(n,u+2))&&!dn(ct(n,u+2)))return!0;return u})}function Bb(n){let u=!1,v=!1,W=!1;for(let z=0;z<=rn(n);z++){if(z===rn(n)||dn(ct(n,z))){if(v&&W)return!0;u=!1,v=!1,W=!1;continue}if(!u){let Q=_s(n,z,"branch");if(Q){u=Q.commandEnd>=0,z=Math.max(z,(u?Q.commandEnd:Q.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=ci(n,z,dn),X=Ub(n,z,B);if(v||=X.deletion,W||=X.force,v&&W)return!0;z=B-1}return!1}function Ub(n,u,v){let W=!1,z=!1;for(let B=u;B<v;B++){if(ct(n,B)!=="-")continue;if(ho(n,B,"--de","lete"))W=!0;if(ho(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let X=B+1,Q=!1,le=!1,ue=!1;while(X<v&&Hb(ct(n,X))){let be=ct(n,X);Q||=be==="d"||be==="D",le||=be==="f",ue||=be==="D",X++}if(!ar(n,X))continue;W||=Q,z||=le||ue}return{deletion:W,force:z}}function Hb(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function jb(n){return Im(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Im(n,u){let v=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<rn(n);W++){let z=ct(n,W),B=v[v.length-1];if(!B)return!1;let X=B.escaped;if(B.escaped=!X&&B.quote!=="'"&&z==="\\",!X&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!X&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(v.length===1||!X&&B.quote!=="'")){v.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!X&&!B.quote&&v.length>1&&z==="("){B.depth++;continue}if(!X&&!B.quote&&v.length>1&&z===")"){if(B.depth--,B.depth===0)v.pop();continue}if(Zt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let Q=_s(n,W,u.command);if(Q){B.outerActive=Q.commandEnd>=0&&Zt(ct(n,Q.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?Q.commandEnd:Q.next)-1);continue}}if(B.outerActive&&z==="-"){if(ho(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&ar(n,W+1))return!0;if(go(z))B.outerActive=!1}return!1}function di(n,u,v,W,z){let B=!1;for(let X=0;X<rn(n);X++){let Q=ct(n,X),le=v(Q);if(!B&&!le){let ue=_s(n,X,u);if(ue){B=ue.commandEnd>=0&&(!W||Zt(ct(n,ue.commandEnd))),X=Math.max(X,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(X);if(ue===!0)return!0;for(let be=X;be<=ue;be++)if(v(ct(n,be)))B=!1;X=ue}if(le)B=!1}return!1}function Vb(n){let u=!1;for(let v=0;v<rn(n);v++){if($l(ct(n,v))){if(u)return!0;u=!1;continue}if(!u){let W=_s(n,v,"restore");if(W){u=W.commandEnd>=0,v=Math.max(v,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,v)==="-"&&ct(n,v+1)==="-"&&(Xt(n,v+2,"staged")||Xt(n,v+2,"help")))u=!1}return u}function km(n,u){let v=!1;for(let W=0;W<rn(n);W++){let z=ct(n,W),B=u?$l(z):dn(z);if(v&&Zt(z)&&ct(n,W+1)==="-"&&sr(n,W+2,"delete"))return!0;if(B){v=!1;continue}if(sr(n,W,"find"))v=!0,W+=3}return!1}function ci(n,u,v){let W=u;while(W<rn(n)&&!Zt(ct(n,W))&&!v(ct(n,W)))W++;return W}function Om(n,u,v,W){if(!Xt(n,u,v))return-1;let z=u+v.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return ar(n,z)?z:-1}function ho(n,u,v,W){return Om(n,u,v,W)>=0}function Ln(n,u){li(u,n,2);let v=n.toLowerCase(),W=v.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let X of B){if(X.skipForEchoRg&&z)continue;let Q=X.caseSensitive?n:v;if(X.regex)_n(u,Q);if((X.regex?.test(Q)??!1)||X.scan&&Rs(Q,X.scan,u))return lt("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${X.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Kb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Dm(n,u,v){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;li(v,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return Nm(u.nodes,W,B)}function Nm(n,u,v){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return Nm(W.body.nodes,u,v);if(W.kind==="unknown")return!v.loose.test(W.source);return qb(W,u,v)})}function qb(n,u,v){if(n.nested.some((z)=>v.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!Kb.test(z.text));return n.words.every((z,B)=>z===u||Mm(z.raw,v.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!v.loose.test(z.heredoc.body))&&(!z.target||Mm(z.target.raw,v.anchored,!0)))}function Mm(n,u,v){let W=!1,z=!1;for(let B=0;B<n.length;B++){let X=n[B];if(X==="\\"&&!W){B++;continue}if(!z&&X==="'"){W=!W;continue}if(!W&&X==='"'){z=!z;continue}if(W||X!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!v)return!1}return!0}var Yb="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zb="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xb="This erases or repartitions a disk. Run disk erase and partition commands manually after confirming the target.",Jb="This output redirect overwrites a disk device. Run device writes manually after confirming the target.",Qb="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.",ev=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Lm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,tv=new Set(["diskutil","wipefs","sgdisk","parted"]),nv=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),rv=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,ov=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),iv=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),sv=new Set(["i","b"]),av=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,lv=new Set([">",">|",">>","<>",">&"]),cv=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Wm(n){return n==="dd"||n==="shred"||Lm.test(n)||tv.has(n)}function dv(n,u){let v=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&nv.has(W.toLowerCase())}if(n==="wipefs")return v&&u.some((W)=>rv.test(W));if(n==="sgdisk")return v&&u.some((W)=>W.startsWith("-")&&!uv(W));return n==="parted"&&v&&u.some((W)=>cv.has(W.toLowerCase()))}function uv(n){if(ov.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return sv.has(u[0]??"")||u.every((v)=>iv.has(v))}function Fm(n,u){let v=u.slice(1);if(n==="dd"&&v.some((W)=>/^of=\/dev\/.+/.test(W)&&!ev.has(W)))return lt("dd.device-write",Yb);if(Lm.test(n)&&v.some((W)=>W.startsWith("/dev/")))return lt("mkfs.device",Zb);if(dv(n,v))return lt("disk.erase",Xb);if(n==="shred"&&v.length>0)return lt("shred.target",Qb);return null}function Gm(n){return n.some((u)=>lv.has(u.operator)&&u.target?.provenance==="literal"&&av.test(u.target.text))?lt("redirect.block-device",Jb):null}import{isAbsolute as mv,resolve as zm}from"node:path";function ui(n,u,v,W){let z=mv(n)?zm(n):u?zm(u,n):void 0;if(!z)return;try{return Ut(z,v,W)}catch{return z}}function $m(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}import{isAbsolute as $s,normalize as wE,parse as AE,posix as Af,resolve as jr,sep as tc}from"node:path";import{isAbsolute as fv,join as Bm,normalize as jm,parse as pv,sep as Um}from"node:path";var gv=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],hv=` 	
-`;function mi(n,u){if(Br(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Ul(n.get("TMPDIR")??"",u)}function yo(n,u){if(n.has("TMPDIR"))return Ul(n.get("TMPDIR")??"",u);let v=Hl(n,u);if(v===void 0)return!0;return Ul(v,u)}function Hl(n,u){return Km(n,u,"TMPDIR")}function Ul(n,u){if(!n)return!1;if(Sv(n))return!1;return So(n,u)}function Br(n,u){let v=Km(n,u,"IFS");return v!==void 0&&v!==""&&v!==hv}function So(n,u){let v=xs(n,u.paths);if(v===null)return!1;return Vm(u).some((W)=>br(v,W))}function As(n,u){let v=xs(n,u.paths);if(v===null)return!1;return Vm(u).some((W)=>ws(W)===ws(v))}var Hm=new WeakMap;function Vm(n){let u=Hm.get(n);if(u)return u;let v=yv(n);return Hm.set(n,v),v}function yv(n){let u=gv.map((W)=>xs(W,n.paths)??jm(W)),v=xs(n.tmpdir,n.paths);if(!v)return u;if(process.platform==="win32")return[...u,v];if(process.platform==="darwin"&&Cv(v))return[...u,v];return u}function Sv(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function Km(n,u,v){return n.has(v)?n.get(v):u.env.get(v)}function Cv(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function xs(n,u){try{let v=jm(n);if(!fv(v))return v;let W=pv(v).root,z=v.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let X=0;X<z.length;X++){let Q=Bm(B,z[X]??"");if(u.entryKind(Q)==="missing")return Bm(Q,...z.slice(X+1));let le=u.realpath(Q);if(le===null)return null;B=le}return B}catch{return null}}function br(n,u){let v=ws(n),W=ws(u);if(v===W)return!0;let z=W.endsWith(Um)?W:`${W}${Um}`;return v.startsWith(z)}function ws(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as hE,readdirSync as yE}from"node:fs";import{basename as SE,isAbsolute as bf,join as CE,relative as vf}from"node:path";import{isAbsolute as ef,parse as Tv}from"node:path";import{dirname as bv,isAbsolute as vv,parse as Ev,sep as Rv}from"node:path";function vr(n,u,v){if(or(u))throw Error("Unsupported Windows namespace path");let W=vv(u)?Ev(u).root:"",z=W||n;for(let B of xv(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=bv(z);continue}let X=_v(z,B),Q=v.entryKind(X),le=Q==="symlink"?v.realpath(X):X;if(Q==="missing"||le===null)throw Error(`Cannot resolve path component: ${X}`);z=le}return z}function _v(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${Rv}${u}`}function xv(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var jl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wv=new Set(jl),Av=1024,qm=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ym=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Pv=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ps(n){return wv.has(n)}function Vl(n){return Ps(n)||qm.has(n)||Ym.has(n)||jo(n)}function lr(n,u,v){return v?.has(n)?v.get(n):u.get(n)}function Zm(n,u){let v=lr("GIT_CONFIG_COUNT",n,u);if(v===void 0)return{state:"absent"};if(v==="")return{state:"valid",count:0};if(!/^\d+$/.test(v))return{state:"invalid"};let W=Number(v);return Number.isSafeInteger(W)&&W<=Av?{state:"valid",count:W}:{state:"invalid"}}function Ts(n,u,v){let z=n.match(Pv)?.[1];if(!z||!Vl(z))return null;let B=n.indexOf("=");return{name:z,value:`${lr(z,u,v)??""}${n.slice(B+1)}`}}function Xm(n){return Qm(n,Ym)}function Jm(n){return Qm(n,qm)}function Qm(n,u){if(!n)return!1;for(let v of n.keys())if(u.has(v))return!0;return!1}var nf=/^[A-Za-z_][A-Za-z0-9_]*=/;function Wn(n){if(!nf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function _e(n){let u=new Map,v=0;while(v<n.length){let W=n[v];if(!W)break;let z=Wn(t(W));if(!z)break;u.set(z.name,z.value),v++}return{words:n.slice(v),envAssignments:u}}function rf(n){let u=$t(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function cr(n,u,v,W){if(!rf(Co(n)))return{words:n,envAssignments:new Map,cwd:v,rewritten:!1};let z=new Set(n),B=n,X=new Map,Q=new Map(W??[]),le=[],ue=v;for(let De=0;De<l.wrapperPeelIterations.cap;De++){let Ie=tf(B),Oe=_e(B);for(let[Le,We]of Oe.envAssignments)X.set(Le,We),Q.set(Le,We);if(B=Oe.words,B.length===0)break;while(B.length>0&&Co(B).includes("=")&&!kv(B)){let Le=Ov(Co(B),Q,u.env)??Ts(Co(B),u.env,Q);if(Le)X.set(Le.name,Le.value),Q.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=$t(Co(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=Dv(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=Wv(B,ue,Q,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,Ge]of Le.envAssignments)X.set(We,Ge),Q.set(We,Ge)}if(Ne==="command")B=Fv(B);if(Ne==="builtin")B=B.slice(jn(B,1)==="--"?2:1);if(tf(B)===Ie)break}let be=_e(B);for(let[De,Ie]of be.envAssignments)X.set(De,Ie),Q.set(De,Ie);return{words:be.words,envAssignments:X,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:Iv(be.words,z)}}function Iv(n,u){return n.some((v)=>!u.has(v))}function tf(n){return n.map(t).join(" ")}function Co(n){let u=n[0];return u?t(u):""}function jn(n,u){let v=n[u];return v?t(v):void 0}function kv(n){return nf.test(Co(n))}function Ov(n,u,v){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??v.get("TMPDIR")??""}${n.slice(8)}`}}var Mv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Dv(n,u,v){let W=1,z=v;while(W<n.length){let B=jn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let X=jn(n,W+1);z=X?fi(z,X,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=fi(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=fi(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(Mv.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var Nv=new Set(["-i","-0","--null"]),Lv=new Set(["-u","--unset","-C","--chdir","-P"]);function Wv(n,u,v,W){let z=new Map,B=[],X=u,Q=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:X,envSplitValues:B.length>0?B:void 0});while(Q<n.length){let ue=jn(n,Q);if(!ue)break;if(ue==="--")return le(Q+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let De of v.keys())z.set(De,"");z.set("TMPDIR",""),Q++;continue}if(Nv.has(ue)){Q++;continue}if(ue==="-u"||ue==="--unset"){let De=jn(n,Q+1);if(De!==void 0)z.set(De,"");Q+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),Q++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),Q++;continue}let be=ue==="-S"||ue==="--split-string"?{value:jn(n,Q+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(be){if(be.value!==void 0)B.push(be.value);return X=null,le(Q+be.consumed)}if(Lv.has(ue)){if(ue==="-C"||ue==="--chdir"){let De=jn(n,Q+1);X=De?fi(X,De,W.paths):null}Q+=2;continue}if(ue.startsWith("-u=")){Q++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let De=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);X=fi(X,De,W.paths),Q++;continue}if(ue.startsWith("-P")){Q++;continue}if(ue.startsWith("-")){Q++;continue}if(!Wn(ue))break;while(Q<n.length){let De=Wn(jn(n,Q)??"");if(!De)break;z.set(De.name,De.value),Q++}if(jn(n,Q)==="--")Q++;return le(Q)}return le(Q)}function fi(n,u,v){if(u==="")return null;if(!n&&!ef(u))return null;let W=ef(u)?Tv(u).root:v.realpath(n??"/");if(W===null)return null;try{return vr(W,u,v)}catch{return null}}function Fv(n){if(jn(n,1)==="-v")return[...en(["type"]),...n.slice(2)];let u=1;while(u<n.length){let v=jn(n,u);if(!v)break;if(v==="-p"||v==="-v"||v==="-V"){u++;continue}if(v==="--")return n.slice(u+1);if(v.startsWith("-")&&!v.startsWith("--")&&v.length>1){if(!/^[pvV]+$/.test(v.slice(1)))break;u++;continue}break}return n.slice(u)}var Gv=/['"\\$`{}#]/;function Is(n,u){if(n.some((W)=>Gv.test(W)))return null;let v=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return v.length<=64?v:null}function Er(n,u,v){return ks(n,u,v).tokens}function zv(n){let u=[],v="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((X)=>X.replace(/["']/g,"")).filter((X)=>X.length>0);v+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(v.length>0)u.push(v);v="",W++;continue}v+=z,W++}if(v.length>0)u.push(v);return u}function Rr(n,u,v,W=0){let z=ks(n,u,v),B=(z.envSplitValues??[]).flatMap(zv);if(B.length===0)return z.tokens;let X=[...B,...z.tokens];if(W>=8)return X;return Rr(X,u,v,W+1)}function ks(n,u,v,W){if(!rf(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:v};let z=cr(en(n),u,v,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var Yl=Symbol("adopt-as-operand"),$v=new Set(["env","sudo","command","builtin"]),Bv=new Set(["&&","||","|&","|","&",";"]),Uv=new Set(["<<","<<<",">|"]),of=new Set(["|","|&"]),Hv=/[*@#?$!_-]/,jv=/^\w+(?::\w+)*/,Vv=Object.freeze([]),pi=Object.freeze({kind:"scope",edge:"enter"}),gi=Object.freeze({kind:"scope",edge:"exit"}),Kv=Object.freeze([]),qv=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),hi=new Set(["bash","sh","zsh","dash","ksh"]),Yv=256,df=new WeakMap;function uf(n,u){let v=u.status==="complete"?new Set(ql(u)):new Set,W=Jv(n,v);if(ts(W))return Os("unclosed-quote",W,u);let z={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},B=Ur(u,{source:W,suppressed:v,flags:z,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(z.limited)return Os("structural-limit",W,u);if(z.invalid)return Os("invalid",W,u);let X=Os("complete",W,u,z.assignmentFallbacks);return df.set(X,Object.freeze(B)),X}function Ns(n,u,v,W,z){let B=z.word??((Ne)=>Ne),X={cwd:u,variables:new Map,previous:null},Q=[],le=new Set,ue=null,be=[],De=mf(n),Ie=De.findLastIndex((Ne)=>Ne.kind==="operator"&&of.has(Ne.operator)),Oe=Ie!==-1&&De.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of De.entries()){let We=Oe||Ne<=Ie;if(Le.kind==="scope"){if(Le.edge==="enter"){be.push({state:X,segment:[...Q],shellWords:new Set(le),pipeProducer:ue});continue}let Ge=z.segment(Q,X,ue,null,le,We);if(Ge)return Ge;let st=be.pop();if(st===void 0)throw Error("scope exit without a matching enter");X=st.state,Q=st.segment,le=st.shellWords,ue=st.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let Ge=z.segment(Q,X,ue,Le.operator,le,We);if(Ge)return Ge;X=Zv(Q,X,v,W),ue=Q.length>0&&of.has(Le.operator)?Q:null,Q=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(Q.length-1);if(Le.target===void 0)continue;let Ge=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},X,We);if(Ge===Yl){le.add(Q.length),Q.push(B(Le.target));continue}if(Ge)return Ge;continue}Q.push(B(Le.text))}return z.segment(Q,X,ue,null,le,Oe)}function Ls(n){return mf(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function xn(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(v,W,z,B)=>{let X=u.get(W);if(X===void 0)return v;let Q=z.startsWith(":")?X!=="":!0;if(z.endsWith("-"))return Q?X:xn(B,u);return Q?xn(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(v,W)=>u.get(W)??v).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(v,W)=>u.get(W)??v)}function yi(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function Zv(n,u,v,W){let z=yi(n)?new Map([...u.variables,...Xv(n,u.variables)]):u.variables,B=Er([...n],v),X=zt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!X)return{...u,variables:z};if(X==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:gn(xn(X,z),u.cwd,v,W),variables:z,previous:u.cwd}}function Xv(n,u){return n.flatMap((v)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(v),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],xn(z,u)]]:[]})}function mf(n){return df.get(n)??Vv}function Jv(n,u){return[...u].reduce((v,W)=>v.slice(0,W.start)+" ".repeat(W.end-W.start)+v.slice(W.end),n)}function Os(n,u,v,W=Kv){return Object.freeze({status:n,source:u,program:v,assignmentFallbacks:Object.freeze(W)})}function Ur(n,u){return n.nodes.flatMap((v,W)=>Qv(v,n,W,u)).sort((v,W)=>v.start-W.start).flatMap((v)=>[...v.events])}function Qv(n,u,v,W){if(n.kind==="connector")return[{start:n.span.start,events:[Vn(oE(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Vn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",X=W.source[n.span.end-1]===(B?"}":")"),Q=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[Ms("{"),...Ur(n.body,Q),...X?[Ms("}")]:[]]:[pi,Vn("("),...Ur(n.body,Q),...X?[Vn(")")]:[],gi]}]}let z=lE(n,W.functions);if(z){if(W.depth>=Cr.maxDepth||++W.flags.expansions>Yv)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...sf(n,W),Ms(";"),...Ur(z,{...W,depth:W.depth+1}),Ms(";")]},...af(n,u,v,W)]}return[{start:n.span.start,events:sf(n,W)},...af(n,u,v,W)]}function sf(n,u){return[...n.words.map((v)=>({start:v.span.start,events:pf(v,n,u,!1)})),...n.redirections.map((v)=>({start:v.span.start,events:eE(v,n,u)}))].sort((v,W)=>v.start-W.start).flatMap((v)=>v.events)}function eE(n,u,v){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?pf(n.target,u,v,!0):[],B=z[0],X=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[Zl(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:iE(W),targetOrder:Uv.has(W)?"legacy-segment":"immediate",...X===void 0?{}:{target:X},...n.heredoc&&v.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:hf(u)}:{}}),...X===void 0?z:z.slice(1)]}function af(n,u,v,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let X=B.heredoc;if(!X)return[];let Q=[Zl(X.delimiter),.../[\r\n]/.test(W.source[X.terminatorSpan.end]??"")?[Vn(";")]:[]];if(W.suppressed.has(X.bodySpan))return[{start:X.bodySpan.start,events:Q}];return[{start:X.bodySpan.start,events:[...ff(W.source.slice(X.bodySpan.start,X.bodySpan.end),W),...Q]}]}),...z.some((B)=>!B.heredoc&&B.target)?tE(u,v,W):[]]}function tE(n,u,v){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:ff(v.source.slice(W.span.end,n.span.end),v)}]}function ff(n,u){if(u.depth>=Cr.maxDepth)return u.flags.limited=!0,[];let v=C(n,"posix");if(v.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Ur(v,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function pf(n,u,v,W){let z=[],B={single:!1,double:!1},X="",Q=!1,le=()=>{let ue=Q&&!W?Vn("glob"):X!==""||n.quoted&&z.length===0?Zl(X):void 0;if(ue)z.push(ue);X="",Q=!1};for(let ue of n.parts){if(ue.provenance!=="command-substitution"&&ue.provenance!=="arithmetic"){for(let Oe of Kl(ue.raw,B,v.flags,v.powershell)){if(typeof Oe==="string"){le(),z.push(Vn(Oe));continue}X+=Oe.text,Q||=Oe.glob}continue}let be=u.nested.find((Oe)=>Oe.span.start>=ue.span.start&&Oe.span.end<=ue.span.end);if(B.double){let Oe=v.source.slice(ue.span.start,ue.span.end);X+=Kl(Oe,{single:!1,double:!0},v.flags,v.powershell).map((Le)=>typeof Le==="string"?Le:Le.text).join("");let Ne=be?Ur(be,v).filter((Le)=>Le.kind==="redirection"&&Le.body!==void 0):[];if(Ne.length>0)z.push(pi,...Ne,gi);continue}let De=be?Ur(be,v):[];if(ue.raw.startsWith("`")){X+="${}",le(),z.push(pi,...De,gi);continue}if(ue.raw.startsWith("<(")||ue.raw.startsWith(">(")){le(),z.push(ue.raw.startsWith("<(")?Vn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),pi,...De,...ue.raw.endsWith(")")?[Vn(")")]:[],gi);continue}let Ie=ue.raw.startsWith("$((")?2:1;X+="${}",le(),z.push(...Array.from({length:Ie},()=>Vn("(")),...Ie===1?[pi]:[],...De,...ue.raw.endsWith(")".repeat(Ie))?Array.from({length:Ie},()=>Vn(")")):[],...Ie===1?[gi]:[])}return le(),z}function Kl(n,u,v,W){let z=[],B="",X=!1,Q=0;while(Q<n.length){let le=n[Q]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:X},le),B="",X=!1,Q++;continue}if(W&&le==="`"&&!u.single){B+=n[Q+1]??"",Q+=2;continue}if(u.single&&le==="'"){u.single=!1,Q++;continue}if(u.single){B+=le,Q++;continue}if(u.double){if(le==='"'){u.double=!1,Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,Q+=2;continue}if(le==="$"){let ue=lf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}B+=le,Q++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";X||=ue==="*"||ue==="?",B+=ue,Q+=2;continue}if(le==="$"){let ue=lf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}X||=le==="*"||le==="?",B+=le,Q++}return[...z,{text:B,glob:X}]}function lf(n,u,v,W,z){let B=n[u+1];if(B==="{"){let Q=z?rE(n,u+2):vs(n,u+2,n.length).close;if(Q===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,Q+1);return nE(le,v,W,z),{text:le,next:Q+1}}if(B!==void 0&&Hv.test(B))return{text:`\${${B}}`,next:u+2};let X=(z?jv:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${X}}`,next:u+1+X.length}}function nE(n,u,v,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let X=z.slice(B.length),Q=[":=","="].find((ue)=>X.startsWith(ue));if(!Q)return;let le=Kl(X.slice(Q.length),{...u},v,W);v.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function rE(n,u){let v=1,W=u;while(v>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")v++;if(n[W]==="}")v--;W++}return v===0?W-1:-1}function oE(n){return/^[\r\n]+$/.test(n)?";":n}function Vn(n){return Object.freeze({kind:"operator",operator:n,boundary:Bv.has(n)})}function Ms(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function Zl(n){return Object.freeze({kind:"word",text:n})}function iE(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function bo(n){return qv.has(n)||/^python\d/.test(n)}var sE=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function gf(n,u){let v=u[0];if(v===void 0||!v.startsWith("-"))return u;let W=sE.get(n)?.has(v)??!1;return gf(n,u.slice(W?2:1))}function Ds(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return Ds(n.slice(1));if(u==="uv"&&n[1]==="run")return Ds(n.slice(2));if(!$v.has(u))return[...n];return Ds(gf(u,n.slice(1)))}function hf(n){let u=ri(n),v=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return Ds(v<0?[]:n.words.slice(v).map((W)=>W.text))}function aE(n){let u=hf(n)[0];if(u===void 0)return!1;let v=zt(u).toLowerCase();return bo(v)&&!hi.has(v)}function ql(n){return n.nodes.flatMap((u,v)=>{if(u.kind==="group"||u.kind==="function")return ql(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((Q)=>ql(Q)),z=u.redirections.flatMap((Q)=>Q.heredoc?.quotedDelimiter?[Q.heredoc.bodySpan]:[]);if(aE(u))return[...W,...z];let B=n.nodes[v+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!dE(u))return W;return[...W,...z]})}function lE(n,u){let v=ri(n);return v===void 0?void 0:u.get(v)}function _r(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function cE(n){if(_r(n.words[0],"git"))return _r(n.words[1],"commit");if(!_r(n.words[0],"gh")||!_r(n.words[2],"create"))return!1;return _r(n.words[1],"pr")||_r(n.words[1],"issue")}function dE(n){return(_r(n.words[0],"cat")||_r(n.words[0],"tee")||cE(n))&&!n.words.some(cf)&&!n.redirections.some((v)=>cf(v.target))}function cf(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var tr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Ws="Unsupported heredoc syntax",Si="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function xr(){return{id:"analysis.dynamic-shell-source",reason:Si,intent:"stop_and_explain"}}var yf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Xl=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),uE=new Set([...Xl,"dir_path","glob","glob_pattern","include_pattern"]),mE=new Set([...Xl,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(tr)}}function Sf(n){let u=fE(),v=de(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&v)W.push({usage:"input-candidate",source:v});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,X)=>{let Q=B.findIndex((be)=>be.source===X.source);if(Q!==-1){let be=B[Q];if(!be)return B;return B[Q]={...be,usages:[...be.usages,X.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(X.source,le);return B.push({usages:[X.usage],source:X.source,program:ue,shell:u.getShellSyntax(X.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:pE(n),store:u}}function vo(n,u){return n.commands.find((v)=>v.usages.includes(u))}function dr(n){return vo(n,"declared-command")??vo(n,"input-candidate")}function ur(n,u){if(!n.includes("$"))return n;return Na(n,u)}function fE(){let n=new Map,u=new WeakMap,v=(z,B)=>{let X=`${B}\x00${z}`,Q=n.get(X);if(Q)return Q;let le=C(z,B);return n.set(X,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let X=B??v(z,"posix"),Q=u.get(X);if(Q)return Q;let le=X.status==="limited"?{status:"structural-limit",source:z,program:X,assignmentFallbacks:[]}:uf(z,X);return u.set(X,le),le},getCommandProgram:v,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function pE(n){let u=n.route.kind==="grep"?uE:n.route.kind==="glob"?mE:Xl;return[...zd(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?Ud(n.input):[]]}var gE=new Set(["-S","--suffix"]);function Eo(n,u,v,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return Ns(n,u,v,W,{segment:(B,X)=>z.findSegmentTarget(B,X),redirection:(B,X)=>B.role==="file-write"&&z.isRedirectionTarget(xn(B.target,X.variables),X)?B.target:null})}function Fs(n){let u=[],v=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){v=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){v=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){v=B.slice(2);continue}if(!W&&gE.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return v?{sources:u,destination:v}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Ef(n,u,v,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(ji(n.invocation.toolName))return null;let Q=n.paths.find((le)=>Cf(le,z,u,v,W,u.entries));return Q?{target:Q}:null}if(n.invocation.route.kind!=="command")return null;let B=dr(n);if(!B)return null;let X=Eo(B.shell,z,v,W,{findSegmentTarget:(Q,le)=>xE(Q,le,u,v,W),isRedirectionTarget:(Q,le)=>Cf(Q,le.cwd,u,v,W,u.markerFiles),findMalformedTarget:()=>null});return X?{target:X}:null}function Hr(n,u,v,W,z,B,X=!1){if(!v)return!1;let Q=zs(gn(n,u,z,B)),le=Q.replace(/(\/\.?\*+)+$/,"");if(le!==Q&&le!==""){if(Jl(le,v))return!0;let ue=X||Q.slice(le.length).includes("/."),be=(De)=>ue?Gs(De,le):bE(De,le);if(v.markerFiles.some(be))return!0;return W&&Ql(v).some(be)}if(Jl(Q,v))return!0;return W&&Ql(v).some((ue)=>Gs(ue,Q))}function bE(n,u){let v=vf(u,n);if(v===""||v.startsWith("..")||bf(v))return!1;return!v.split(/[\\/]/)[0]?.startsWith(".")}function vE(n,u,v,W,z){return Hr(n,u,v,!0,W,z)}function EE(n,u,v,W,z){if(!v)return!1;return Jl(zs(gn(n,u,W,z)),v)}function Cf(n,u,v,W,z,B){let X=zs(gn(n,u,W,z));return B.includes(X)||_f(X,v)}function Rf(n,u,v,W,z){if(!v)return!1;return v.hooksDirectories.some((B)=>n.some((X)=>Gs(B,zs(gn(X,u,W,z)))))}function Jl(n,u){return u.entries.includes(n)||u.directories.includes(n)||_f(n,u)}function _f(n,u){return u.hooksDirectories.some((v)=>Gs(n,v))}var RE=50000;function xf(n,u){let v=[...new Set(Ql(n))];if(v.some((z)=>u(SE(z))))return!0;let W=0;while(v.length>0){let z=v.pop()??"",B=_E(z);if(!B)return!0;if(W+=B.length,W>RE)return!0;if(B.some((X)=>u(X.name)))return!0;v.push(...B.filter((X)=>X.isDirectory()).map((X)=>CE(z,X.name)))}return!1}function _E(n){try{let u=hE(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return yE(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function Ql(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function Gs(n,u){let v=vf(u,n);return v===""||!/^\.\.(?:[\\/]|$)/.test(v)&&!bf(v)}function zs(n){return process.platform==="win32"?n.toLowerCase():n}function xE(n,u,v,W,z){if(yi(n))return null;let B=Rr([...n],W);if(zt(B[0]??"").toLowerCase()!=="mv")return null;let X=Fs(B.slice(1)),Q=X.sources.find((le)=>vE(xn(le,u.variables),u.cwd,v,W,z));if(Q)return Q;return X.destination&&EE(xn(X.destination,u.variables),u.cwd,v,W,z)?X.destination:null}var PE=process.platform==="win32",wf=64,TE=16384;function Vr(n,u,v,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!ln(v,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!ln(v,z.id,u.paranoid))return null;return lt(z.id,z.reason)}function Kr(n){let u=fm(n,wf,wf,TE);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:IE(n)}}function IE(n){let u=n.parts.filter((v)=>v.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(v.raw));return u.length>0&&u.every((v)=>kE(n.raw,v.span.start-n.span.start))}function kE(n,u){let v=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&v!=="'"){W=!0;continue}if(v===B){v=null;continue}if(v===null&&(B==="'"||B==='"'))v=B}return v==='"'}function Fn(n){let u=n.environment.home,v=n.environment.paths,W=n.budget??On();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:FE(n.allowPaths,u,v,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function Sn(n,u,v={}){let W=v.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!v.tmpdirWordSplittingProtected&&zE(n))return{kind:"outside_anchored_cwd"};let z=!W&&Pf(n,u.posixShell);if(or(n))return{kind:"outside_anchored_cwd"};if(Ci(n,W))return{kind:"root_or_home_target"};if(DE(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Hr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(NE(n,u.trustTmpdirVar,u.posixShell,z,W,v.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z)return{kind:"dynamic_target"};if(GE(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!v.skipHomeCwd&&HE(B,u.environment.home,u.environment.paths,u.budget))return{kind:"home_cwd_target"};if(!v.skipCwdSelf&&[u.resolvedCwd??B,B].some((X)=>jE(n,u.resolvedCwd??B,u.environment.paths,u.budget,X)))return{kind:"cwd_self_target"};if(VE(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(OE(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function OE(n,u,v){let W=n.trim();if(v||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if($s(W)||W.startsWith("~"))return!1;if(nc(W))return!1;if(Tf(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return So(jr(u.resolvedCwd,W),u.environment)}function ME(n,u,v={}){let{containmentTarget:W,...z}=v;if(Sn(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(WE(B))return!1;if(As(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((X)=>Tf(W??B,X,u.environment.paths,u.budget))}function Ci(n,u=!1){let v=n.trim(),W=Af.normalize(v),z=v.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((X)=>/^\*+$/.test(X)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function DE(n,u,v){let W=n.trim(),z=v?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=$s(z)?z:u.resolvedCwd?jr(u.resolvedCwd,z):null;if(!B)return!1;let X=wn(Ut(B,u.environment.paths,u.budget));if(X===AE(X).root)return!0;return X===wn(Ut(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function wn(n){let u=wE(n);if(PE){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function NE(n,u,v,W,z,B,X,Q){let le=n.trim();if(nc(le))return!1;if(!W&&So(le,Q))return!0;return(u||B&&X)&&v&&!z&&LE(le,v)}function LE(n,u){return["$TMPDIR","${TMPDIR}"].some((v)=>{if(n===v)return!0;if(!n.startsWith(`${v}/`))return!1;return!Pf(n.slice(v.length+1),u)})}function WE(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return Af.normalize(`/${u[1]??""}`)==="/"}function nc(n){return n.split(/[\\/]+/).includes("..")}function FE(n,u,v,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=Qo(z.trim(),u);if(!$s(B))return[];try{let X=Ut(B,v,W);if(ei(X,Ut(u,v,W)))return[];return[wn(X)]}catch{return[]}})}function GE(n,u,v){if(u.allowRoots.length===0)return!1;let W=n.trim();if(nc(W))return!1;let z=v?W:Qo(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,X=$s(z)?z:B?jr(B,z):null;if(!X)return!1;try{let Q=wn(Ut(X,u.environment.paths,u.budget));return u.allowRoots.some((le)=>Q===le||Q.startsWith(le.endsWith(tc)?le:`${le}${tc}`))}catch{return!1}}function zE(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function Pf(n,u=!1){return n.includes("$")||n.includes("`")||$E(n)||u&&BE(n)}function $E(n){let u=!1;for(let v of n){if(u){u=!1;continue}if(v==="\\"){u=!0;continue}if(v==="*"||v==="?"||v==="[")return!0}return!1}function BE(n){let u=!1;for(let v=0;v<n.length;v++){let W=n[v];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&UE(n,v)||(W==="+"||W==="@"||W==="!")&&n[v+1]==="(")return!0}return!1}function UE(n,u){let v=n.indexOf("}",u+1);if(v===-1)return!1;let W=n.slice(u+1,v);return W.includes(",")||W.includes("..")}function HE(n,u,v,W){try{return wn(Ut(n,v,W))===wn(Ut(u,v,W))}catch{try{return wn(n)===wn(u)}catch{return!1}}}function jE(n,u,v,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return wn(Ut(jr(u,n),v,W))===wn(Ut(z,v,W))}catch{try{return wn(jr(u,n))===wn(z)}catch{return!1}}}function VE(n,u,v,W,z,B,X){let Q=v??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return ec(n,u,B,X)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return ec(jr(Q,n),u,B,X)}catch{return!1}if(n.startsWith("../"))return!1;try{return ec(jr(Q,n),u,B,X)}catch{return!1}}function ec(n,u,v,W){try{return If(Ut(n,v,W),Ut(u,v,W))}catch{return!1}}function Tf(n,u,v,W){if(!u)return!1;try{return If(Ut(u,v,W),Ut(n,v,W))}catch{return!0}}function If(n,u){let v=wn(n),W=wn(u);return v.startsWith(`${W}${tc}`)||v===W}function Bs(n,u){let v=u.envAssignments??new Map,W=Hl(v,u.environment),z=u.trustedTmpdirValue??yo(v,u.environment),B=u.allowTmpdirVar??!mi(v,u.environment),X={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??Br(v,u.environment),trustedTmpdirValue:z,budget:u.budget},Q=Fn(X),le=Fn({...X,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),be=u.cwd&&u.environment.paths.realpath(u.cwd),De=ue&&be&&!br(be,ue)?u.cwd:void 0;return n.every((Ie)=>{let Oe=Kr(Ie);if(Oe.unsafeBraceExpansion||Oe.expandedTargets?.length===0)return!1;return(Oe.expandedTargets??[t(Ie)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?De:void 0,We=Le??Ne,Ge={targetIsLiteral:Oe.expandedTargets!==void 0||Oe.targetIsLiteral,tmpdirWordSplittingProtected:Oe.tmpdirWordSplittingProtected};if(!ln(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&Sn(We,Q,Ge).kind==="within_anchored_cwd")return!0;return ME(We,Le?le:Q,{...Ge,containmentTarget:KE(We,W)})})})}function KE(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var Ro="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",bi="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",oc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),qE=new Set(["-p","--print"]),YE=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),ZE=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),XE=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),JE=new Map([["python",new Set(["m"])]]),QE=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),eR=new Set(["always","default","never"]),tR=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),nR=/\\\r?\n/g,kf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,rR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${kf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${kf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],oR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Of(n){return Hs(n).code}function Us(n){return Hs(n).sources}function Mf(n){return oR.get(sc(n))??[]}function Hs(n){let u=sc(n[0]??"");if(!oc.has(u))return{code:null,sources:[],optionsOpen:!1};let v=[],W=[],z=!0;for(let B=1;B<n.length;B++){let X=n[B];if(X===void 0)break;if(X==="--")return Kn(u,v,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(X===""||X==="-"||!X.startsWith("-"))return Kn(u,v,W,z,B,X);if(u==="node"&&qE.has(X)){let De=n[B+1];if(De===void 0)return Kn(u,v,W,z);if(De.startsWith("-"))continue;v.push({tokenIndex:B+1,value:De}),W.push({tokenIndex:B+1,kind:"inline-code",value:De}),B++;continue}if(sR(u,X)){let De=n[B+1];if(De===void 0)return Kn(u,v,W,z);if(v.push({tokenIndex:B+1,value:De}),W.push({tokenIndex:B+1,kind:"inline-code",value:De}),u==="python")return Kn(u,v,W,z);B++;continue}let Q=/^--eval=(.*)$/s.exec(X);if(aR(u)&&Q){let De=Q[1]??"";v.push({tokenIndex:B,value:De}),W.push({tokenIndex:B,kind:"inline-code",value:De});continue}if(u==="node"){let De=iR(X);if(De){if(De.attached){if(z&&=De.value!=="",De.value!=="")W.push({tokenIndex:B,kind:"module-file",value:De.value});continue}let Ie=n[B+1];if(Ie===void 0||Ie.startsWith("-"))return z=!1,Kn(u,v,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:Ie}),B++;continue}}if(u==="python"&&X.startsWith("--check-hash-based-pycs=")||u==="node"&&(X==="--conditions="||X==="--diagnostic-dir="||X==="--title=")||u==="ruby"&&(X==="--disable="||X==="--enable="))return Kn(u,v,W,z);if(QE.get(u)?.has(X)){let De=n[B+1];if(De===void 0||De.startsWith("-")&&!(u==="ruby"&&tR.has(X))||u==="python"&&!eR.has(De))return Kn(u,v,W,z);B++;continue}if(X.startsWith("--"))continue;let le,ue=!1;for(let De=1;De<X.length;De++){let Ie=X[De];if(Ie===void 0)break;if(JE.get(u)?.has(Ie)){let Oe=X.slice(De+1),Ne=Oe||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Oe?B:B+1,kind:"module-file",value:Ne});return Kn(u,v,W,z)}if(YE.get(u)?.has(Ie)){le=X.slice(De+1)||n[B+1],ue=De+1===X.length;break}if(u==="node"&&Ie==="r"){if(z&&=X==="-r",X==="-r"){let Oe=n[B+1];if(z&&=Oe!==void 0&&!Oe.startsWith("-"),z&&Oe!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Oe});B++}break}if(u==="ruby"&&Ie==="r"){let Oe=X.slice(De+1),Ne=Oe||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Oe?B:B+1,kind:"module-file",value:Ne});if(!Oe)B++;break}if(u==="perl"&&(Ie==="M"||Ie==="m")){let Oe=X.slice(De+1);if(!Oe){if(z=!1,De+1===X.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Oe});break}if(ZE.get(u)?.has(Ie)){if(De+1===X.length)B++;break}if(XE.get(u)?.has(Ie)&&De+1<X.length)break}if(le===void 0)continue;let be=ue?B+1:B;if(v.push({tokenIndex:be,value:le}),W.push({tokenIndex:be,kind:"inline-code",value:le}),u==="python")return Kn(u,v,W,z);if(ue)B++}return Kn(u,v,W,z,void 0,void 0,!0)}function Kn(n,u,v,W,z,B,X=!1){let Q=n==="node"?u.slice(-1):u,le=new Set(Q.map((be)=>be.tokenIndex)),ue=v.filter((be)=>be.kind!=="inline-code"||le.has(be.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?Q[0]?.value:Q.map((be)=>be.value).join(`
-`))||null,sources:W?ue:[],optionsOpen:W&&X}}function iR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function ic(n,u){return sc(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function sc(n){let u=zt(n).toLowerCase();return Qi.test(u)?"python":u}function sR(n,u){return oc.get(n)?.has(u)??!1}function aR(n){return oc.get(n)?.has("--eval")??!1}function vi(n,u,v=!1){let W=dR(n,u);if(_n(u,W),rR.some((X)=>Array.from(W.matchAll(X)).some((Q)=>Q.groups?.literal===void 0||Ci(Q.groups.literal,!0))))return!0;if(!rc(W,u))return!1;_n(u,W);let B=cR(W);if(rc(B,u))return!0;if(_n(u,B),!Df.test(B))return!1;return!v||lR(W,u)}function lR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let be=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,De=le+be.length,Ie=De;while(Ie<n.length&&!n.startsWith(be,Ie))Ie+=n[Ie]==="\\"?2:1;if(Ie>=n.length)return!0;z.push({start:De,text:n.slice(De,Ie)}),W.fill(" ",le,Ie+be.length),le=Ie+be.length-1}let B=W.join(""),X=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>Df.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:js(B,ue)}});if(X.some((le)=>ac(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),be=X.some((De)=>le.start>=De.start&&le.start<De.end);return(ue||be)&&rc(le.text,u)})}function js(n,u){let v=1;for(let W=u;W<n.length;W++){if(n[W]==="(")v++;if(n[W]===")")v--;if(v===0)return W}return n.length}function ac(n,u){let v=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))v++;if(")]}".includes(z)&&v--===0)return!1;if(z===","&&v===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var Df=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function cR(n){let u=[],v=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,X=W+B.length;while(X<n.length&&!n.startsWith(B,X))X+=n[X]==="\\"?2:1;if(X>=n.length)break;u.push(n.slice(v,W)," "),W=X+B.length,v=W}return u.push(n.slice(v)),u.join("")}function rc(n,u){if(Es(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(_n(u,n),W.test(n))return!0;if(Es(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(_n(u,n),W.test(n))return!0;if(Es(n,"find",u))return!0;let v=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(_n(u,n),v.some((z)=>Rs(z,W))))}function dR(n,u){return _n(u,n),n.replace(nR,"")}var uR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Nf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mR="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Wf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",fR="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",pR="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",gR={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Wf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Lf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:fR},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Nf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:mR},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Nf}};function Ff(n,u,v){return hR(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,Fn({...v,allowPaths:v.policy?.destructiveCommandAllowPaths}),v.policy)}function hR(n,u,v,W){let z=n.filter((le)=>le.kind==="word"),B=SR(z),X=z[B];if(!X||!uR.has(AR(X.text)))return null;let Q=yR(z.slice(B+1));if(Q.whatIfProtected)return null;if(ln(W,"powershell.remove-item-pipeline-dynamic-target",v.strict)&&u&&(Q.targets.length===0||Q.recursive))return lt("powershell.remove-item-pipeline-dynamic-target",pR);for(let le of Q.targets)if(!or(le.text)&&Ci(Ei(le.text)))return lt(Q.recursive&&Q.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Wf);for(let le of Q.targets)if(v.resolvedCwd&&Hr(Ei(le.text),v.resolvedCwd,v.protectedGitMetadata,Q.recursive,v.environment,v.budget,!0))return lt("powershell.remove-item-git-metadata",y);if(!Q.recursive||!Q.force)return null;if(ln(W,"powershell.remove-item-recursive-force-dynamic-target",v.strict)&&(Q.hasDynamicTarget||Q.targets.length===0))return lt("powershell.remove-item-recursive-force-dynamic-target",Lf);for(let le of Q.targets){let ue=Vr(Sn(Ei(le.text),v),v,W,gR);if(ue)return ue}return null}function yR(n){let u=[],v=!1,W=!1,z=!1,B=!1,X=!1;for(let Q=0;Q<n.length;Q++){let le=n[Q];if(!le||le.kind!=="word")continue;if(CR(le))continue;if(X){u.push(lc(le)),B=B||le.dynamic;continue}if(le.text==="--"){X=!0;continue}let ue=vR(le.text);if(!ue){u.push(lc(le)),B=B||le.dynamic;continue}if(ER(ue.name)){let be=ue.value?bR(ue.value,le):n[++Q];if(be?.kind==="word"){u.push(lc(be)),B=B||be.dynamic;continue}B=!0;continue}if(RR(ue.name)){v=!0;continue}if(_R(ue.name)){W=!0;continue}if(xR(ue.name))z=wR(ue.value)}return{targets:u,recursive:v,force:W,whatIfProtected:z,hasDynamicTarget:B}}function SR(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function lc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function CR(n){return n.kind==="word"&&n.text===","}function Ei(n){let u=n.replace(/\\/g,"/"),v=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return v?`$HOME${u.slice(v[0].length)}`:u}function bR(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function vR(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),v=u.indexOf(":");if(v===-1)return{name:u.toLowerCase()};return{name:u.slice(0,v).toLowerCase(),value:u.slice(v+1)}}function ER(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function RR(n){return"recurse".startsWith(n)}function _R(n){return n.length>=2&&"force".startsWith(n)}function xR(n){return n==="wi"||"whatif".startsWith(n)}function wR(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function AR(n){return n.toLowerCase()}var PR=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),TR=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),IR=new Set(["-o","--output","--query","--subscription"]),kR=new Set;function Gf(n){if(n==="aws")return PR;if(n==="gcloud")return TR;if(n==="az")return IR;return kR}var OR=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),MR=new Set;function zf(n){if(n==="git")return Pn;if(n==="docker")return OR;return MR}function F(n,u){if(n.length===0||u.length===0)return null;let v=$t(n[0]??""),W=En(n);for(let z of u){if(!LR(v,z.command))continue;if(z.match){if(DR(v,n,z.match))return $f(z);continue}if(!WR(v,n,z.subcommand))continue;if(GR(n,new Set(z.block_args),W))return $f(z)}return null}function $f(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function DR(n,u,v){let W=u.slice(1);if(v.exclude_args?.some((z)=>W.includes(z)))return!1;if(v.any_args&&!v.any_args.some((z)=>W.includes(z)))return!1;return NR(W,v.command_path,Gf(n))}function NR(n,u,v){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&v.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function LR(n,u){return n===$t(u)}function WR(n,u,v){if(!v)return!0;return Bf(u,1,v,zf(n))}function Bf(n,u,v,W){let z=!1;for(let B=u;B<n.length;B++){let X=n[B];if(!X)continue;if(z){z=!1;continue}if(X==="--"){let Q=n[B+1];if(Q&&!Q.startsWith("-"))return Q===v;return!1}if(W.has(X)){z=!0;continue}if(X.startsWith("-")){if(!X.includes("=")&&FR(n,B,v,W))return!0;continue}return X===v}return!1}function FR(n,u,v,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return Bf(n,u+2,v,W)}function GR(n,u,v){return n.some((W)=>u.has(W))||[...v].some((W)=>u.has(W))}var zR=new Set(["-e","--source"]),$R=new Set(["-F","-v","--assign","--field-separator"]),Uf=new Set(["-f","--file"]),BR=new Set(["print","printf","return"]),Hf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],UR="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function jf(n,u,v){let W=!1;for(let z of HR(n)){let B=jR(z,v);if(!B)continue;for(let X of B.commands){let Q=u(X);if(Q)return Q;if(X.includes("{}")||/[$`]/.test(X))W=!0}W||=B.dynamic}return W?lt("awk.system-dynamic",UR):null}function dc(n){let u=[],v=!1,W=!1,z=!0,B=!0;for(let X=1;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(z&&Q==="--"){z=!1;continue}if(z&&zR.has(Q)){v=!0;let le=n[X+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:X+1,kind:"inline-code",value:le});X++;continue}if(z&&Q.startsWith("--source=")){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(9)});continue}if(z&&Q.startsWith("-e")&&Q.length>2){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(2)});continue}if(z&&($R.has(Q)||Uf.has(Q))){let le=n[X+1];if(B&&=le!==void 0,Uf.has(Q)){if(W=!0,le!==void 0)u.push({tokenIndex:X+1,kind:"program-file",value:le})}X++;continue}if(z&&(Q.startsWith("-F")||Q.startsWith("-v")&&Q.slice(2).includes("=")))continue;if(z&&Q.startsWith("-f")&&Q.length>2){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(2)});continue}if(z&&(Q.startsWith("--assign=")||Q.startsWith("--field-separator=")))continue;if(z&&Q.startsWith("--file=")){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(7)});continue}if(z&&Q.startsWith("-")&&Q!=="-")continue;if(!v&&!W)u.push({tokenIndex:X,kind:"main-program",value:Q});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function _i(n){return dc(n).sources}function HR(n){return _i(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function jR(n,u){_n(u,n);let v=n.includes("system")?uc(n,u):null,W=VR(n,u);if(!v&&!W)return null;return{dynamic:!!v?.dynamic||!!W?.dynamic,commands:[...v?.commands??[],...W?.commands??[]]}}function uc(n,u){_n(u,n);let v=[],W=!1,z=!1,B=0;while(B<n.length){let X=n[B];if(X==='"'||X==="'"){B=Ks(n,B,X)?.endIndex??B+1;continue}if(X==="#"){B=Vf(n,B+1);continue}if(X==="/"&&Kf(n,B)){B=qf(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let Q=B;if(B+=6,Ri(n[Q-1])||Ri(n[B]))continue;let le=Vs(n,B);if(n[le]!=="(")continue;le=Vs(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let be=Ks(n,le,ue);if(!be){W=!0,z=!0;continue}if(le=Vs(n,be.endIndex),W=!0,n[le]!==")"){z=!0,B=be.endIndex;continue}v.push(be.value),B=le+1}if(!W)return null;return{dynamic:z,commands:v}}function VR(n,u){_n(u,n);let v=[],W=!1,z=!1,B=0,X=0,Q=null,le=null,ue=0;while(B<n.length){let be=n[B];if(!be)break;if(be==='"'||be==="'"){let Oe=Ks(n,B,be);if(Oe&&ue===X)le={...Oe,startIndex:B};ue=Oe?.endIndex??B+1,B=Oe?.endIndex??B+1;continue}if(be==="#"){B=Vf(n,B+1),X=B,Q=null,le=null,ue=B;continue}if(be==="/"&&Kf(n,B)){let Oe=qf(n,B+1);ue=Oe??B+1,B=Oe??B+1;continue}if(`;
-{}`.includes(be)){B++,X=B,Q=null,le=null,ue=B;continue}if(Q===null&&(cc(n,B,"print")||cc(n,B,"printf")))Q=B;if(be!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(be))ue=B+1;B++;continue}let De=n[B+1]==="&"?B+2:B+1,Ie=Vs(n,De);if(cc(n,Ie,"getline")){z=!0;let Oe=YR(X,le,ue);if(W||=Oe===null,Oe!==null)v.push(Oe);ue=De,B=De;continue}if(XR(X,Q)){z=!0;let Oe=qR(n,Ie);if(!Oe){W=!0,ue=De,B=De;continue}if(!KR(n,Oe.endIndex)){W=!0,ue=Oe.endIndex,B=Oe.endIndex;continue}v.push(Oe.value),ue=Oe.endIndex,B=Oe.endIndex;continue}ue=De,B++}if(!z)return null;return{dynamic:W,commands:v}}function Ri(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function Vs(n,u){let v=u;while(/\s/.test(n[v]??""))v++;return v}function KR(n,u){let v=u;while(/[\t\f\v\r ]/.test(n[v]??""))v++;let W=n[v];return!W||`;
-}#`.includes(W)}function Ks(n,u,v){let W="",z=!1;for(let B=u+1;B<n.length;B++){let X=n[B];if(!X)break;if(z){let Q=ZR(n,B);if(!Q)return null;W+=Q.value,B=Q.endIndex,z=!1;continue}if(X==="\\"){z=!0;continue}if(X===v)return{value:W,endIndex:B+1};W+=X}return null}function qR(n,u){let v=n[u];if(v!=='"'&&v!=="'")return null;return Ks(n,u,v)}function YR(n,u,v){if(!u)return null;return u.startIndex>=n&&u.endIndex===v?u.value:null}function ZR(n,u){let v=n[u];if(!v)return null;if(v==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(v)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[v]??v,endIndex:u}}function cc(n,u,v){return n.startsWith(v,u)&&!Ri(n[u-1])&&!Ri(n[u+v.length])}function XR(n,u){return u!==null&&u>=n}function Vf(n,u){let v=n.indexOf(`
-`,u);return v===-1?n.length:v+1}function Kf(n,u){let v=JR(n,u);if(v===-1)return!0;if("{([,;!~=".includes(n[v]??""))return!0;let W=v;while(Ri(n[W-1]))W--;return BR.has(n.slice(W,v+1))}function JR(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function qf(n,u){let v=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="/")return W+1}return null}var QR=new Set(["sudo","env","command","builtin"]),e_=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function qs(n,u){let v=n[0];if(!v||!Yf(zt(v),u))return null;let W=zt(v),z=n[1]==="--"?2:1,B=t_(n,z,W,u),X=B[0];if(X===void 0)return null;return{wrapper:W,tokens:n.slice(X),childIndex:X,alternativeChildIndices:B.slice(1)}}function t_(n,u,v,W){let z=n[1]==="--",B=[];for(let X=u;X<n.length;X++){let Q=n[X];if(!Q)continue;let le=zt(Q)!==v&&n_(Q,W);if(le)B.push(X);if(!le&&es.has($t(Q)))break;if(z)break}return B}function n_(n,u){let v=zt(n),W=$t(n);return W==="git"||v==="busybox"||qr(n)||tl.has(v)||Wm(W)||Yf(v,u)||nn.has(W)||n==="$SHELL"||Hn(W)||Nn.has(W)||u.rules.some((z)=>z.command===v)}function Yf(n,u){return e_.has(n)||u.transparentWrappers.includes(n)}function qr(n){return QR.has(n.toLowerCase())}function Yr(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function qn(n,u){let v=u.policy??{rules:[],transparentWrappers:[]};return Ys([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),v,{iterations:0},!1)}function*Ys(n,u,v,W,z,B,X,Q,le){let ue=ks(n,u,v,B);for(let[Oe,Ne]of ue.envAssignments)B.set(Oe,Ne),z.set(Oe,Ne);let{tokens:be,cwd:De}=ue;if(ue.envSplitValues){let Oe=Is(ue.envSplitValues,be);if(!Oe)throw new a("derivedCommandShape");mc(Q),yield*Ys(Oe,u,De,W,z,B,X,Q,le);return}if(qr(be[0]??""))throw new a("wrapperPeelIterations");let Ie=qs(be,X);if(Ie){for(let Oe of[Ie.childIndex,...Ie.alternativeChildIndices])mc(Q),yield*Ys(Oe===Ie.childIndex?Ie.tokens:be.slice(Oe),u,De,W,new Map(z),new Map(B),X,Q,!0);return}if(o_(be)){mc(Q),yield*Ys(be.slice(1),u,De,W,z,B,X,Q,le);return}yield r_(be,De,W,z,B,le)}function r_(n,u,v,W,z,B){return{tokens:n,cwd:u===null?void 0:u??v,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:zt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function mc(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function o_(n){return zt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function fc(n,u){let v=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;v.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:v}}function mr(n){let u=!1,v=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||pc(W,"recursive")){u=!0;continue}if(W==="-f"||pc(W,"force")){v=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))v=!0}}return u&&v}function Zs(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((v)=>pc(v,"recursive")||/^-[A-Za-z]+$/.test(v)&&/[rR]/.test(v.slice(1)))}function pc(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var i_=["--init-file","--rcfile"],s_=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Gn(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v)continue;if(v==="-c")return Xf(n,u,!0);if(v.startsWith("-")&&v.includes("c")&&!v.startsWith("--")){let W=Xf(n,u,!1);if(W!==null)return W}}return null}var Zf=/^-[cn]+$/;function Yn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!Zf.test(W)))return!1;let v=u.findIndex((W)=>!Zf.test(W));return u.slice(0,v===-1?void 0:v).some((W)=>W.includes("n"))}var a_=/^-[abcefhiklmnprstuvx]+$/;function Xs(n){let u=n.findIndex((B,X)=>X>0&&!a_.test(B)),v=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(v.some((B)=>B.startsWith("+")))return!0;let W=v.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=Gn(n);if(z===null)return v.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function Xf(n,u,v){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!v&&W.startsWith("-"))return null;return W}function Jf(n){let u=zt(n[0]??"").toLowerCase(),v=l_(n,u),W=s_.get(u)??null,z=v.argvSource?.kind!=="absent";return{argvSource:u==="bash"?v.argvSource:null,argvSourceApplies:u==="bash"&&v.interactive&&v.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!v.interactive:W==="ENV"&&v.interactive)}}function l_(n,u){let v=Rn(n),W=v.commandIndex??v.scriptIndex??n.length,z=[],B=!1,X=!0;for(let Q=1;Q<W;Q++){let le=n[Q];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&X?i_.find((Ie)=>le===Ie):void 0){let Ie=n[Q+1];z.push(Ie===void 0?{kind:"absent"}:{kind:"literal",value:Ie}),Q++;continue}let De=le.split("=",1)[0]??le;if(u==="bash"&&Qa.has(De)&&!le.includes("="))Q++;continue}if(u==="bash")X=!1;let ue=el(u,le,n[Q+1],"startup");if(ue.interactive)B=le[0]==="-";Q+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var c_="find -delete permanently removes files. Use -print first to preview.",d_="find -exec rm -rf is dangerous. Use explicit file list instead.",u_=new Set(["-exec","-execdir","-ok","-okdir"]),m_=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function Qf(n,u){let v=n.map(t),W=f_(n,v,u);if(W)return W;if(Js(v,1)&&!C_(n,v,u)){let X=Tt(lt("find.delete",c_),u.policy);if(X)return X}let z=u.budget??On(),B=0;while(B<v.length){let X=v[B],Q=fr(X??"");if(Q>0){B+=Q+1;continue}if(!nr(X)){B++;continue}z.charge("derivedTokens",v.length-B-1);let le=_o(v,B);B=le.nextIndex;let ue=b_(le.tokens,u.environment);if(ue){let Oe=Tt(ue,u.policy);if(Oe)return Oe}let be=X==="-execdir"||X==="-okdir",De=u.analyzeTokens?.(le.tokens,be?null:u.cwd)??null,Ie=De?.id.startsWith("custom.")?De:Tt(De,u.policy);if(Ie)return Ie}return null}function f_(n,u,v){if(!Js(u,1)&&!gc(u,v.environment))return null;let z=xi(n)??en(["."]),B=Fn({...v,allowPaths:v.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let X of z){let Q=Kr(X);for(let le of Q.expandedTargets??[t(X)]){let ue=Sn(le,B,{targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return lt("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!p_(n,B.protectedGitMetadata,v.environment))return lt("find.delete-git-metadata",y)}}if(S_(u)&&B.resolvedCwd&&Rf(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return lt("find.delete-git-metadata",y);return null}function p_(n,u,v){if(!u)return!1;let W=n.map(t),z=[],B=!1,X=xi(n)?.at(-1),Q=X?n.indexOf(X)+1:1;while(Q<W.length){let le=W[Q]??"";if(nr(le)){let ue=_o(W,Q),be=Rr([...ue.tokens],v),De=Zs(be),Ie=nn.has(zt(be[0]??"").toLowerCase()),Oe=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&be.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(De||Ie||Oe||Ne)return!1;B=!0,Q=ue.nextIndex;continue}if(le==="-delete"){B=!0,Q++;continue}if(le==="-name"||le==="-iname"){let ue=n[Q+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(h_(ue.text,le==="-iname"));Q+=2;continue}if(!g_.has(le))return!1;Q+=1+fr(le)}return z.length>0&&!xf(u,(le)=>z.every((ue)=>ue.test(le)))}var g_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function h_(n,u){let v=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${v}$`,u?"isu":"su")}var y_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function gc(n,u){let v=0;while(v<n.length){if(!nr(n[v])){v++;continue}let W=_o(n,v),z=Rr([...W.tokens],u),B=zt(z[0]??"").toLowerCase(),X=nn.has(B)&&y_.test((Gn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||X)&&z.some((le)=>le.includes("{}")))return!0;v=W.nextIndex}return!1}function S_(n){return n.some((u,v)=>{if(!["-name","-iname"].includes(u))return!1;return n[v+1]?.toLowerCase()==="hooks"})}function C_(n,u,v){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=xi(n);return W!==null&&Bs(W,v)}function xi(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},v=1;while(u(v)==="-H"||u(v)==="-P")v++;if(u(v)==="--")v++;let W=[];while(v<n.length){let z=u(v),B=n[v];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),v++}return W.length>0?W:null}function b_(n,u){let v=Er([...n],u);if(v.length===0)return null;let W=zt(v[0]??"");if(W==="busybox"&&v.length>1)v=v.slice(1),W=zt(v[0]??"");if(W==="rm"&&mr(v))return lt("find.exec-rm-recursive-force",d_);return null}function _o(n,u){let v=u+1;while(v<n.length&&n[v]!==";"&&!(n[v]==="+"&&n[v-1]==="{}"))v++;return{tokens:n.slice(u+1,v),nextIndex:Math.min(v+1,n.length)}}function Js(n,u){let v=u;while(v<n.length){let W=n[v];if(!W){v++;continue}if(nr(W)){v=_o(n,v).nextIndex;continue}let z=fr(W);if(z>0){v+=z+1;continue}if(W==="-delete")return!0;v++}return!1}function fr(n){return m_.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function nr(n){return n!==void 0&&u_.has(n)}import{resolve as Xx}from"node:path";function*hc(n){for(let u of n.nodes)yield*v_(u)}function yc(n){return[...hc(n)]}function Mt(n){return yc(n).map((u)=>u.words.map((v)=>v.text))}function wi(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let v=u.nodes[0];if(v?.kind!=="command")return null;if(v.redirections.length>0||v.nested.length>0)return null;if(v.words.some((W)=>W.provenance==="command-substitution"))return null;return v.words.map((W)=>W.text)}function*v_(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*hc(u);return}if(n.kind==="group")yield*hc(n.body)}var E_=5,Sc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function un(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function tp(n,u,v){let W=xo(n,u,v),z=R_(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,X=!1;for(let Q=0;Q<E_;Q++){let{subcommand:le,rest:ue}=In(B),be=le?.toLowerCase();if(!be||!z.has(be))return{blockedReason:W.blockedReason,expanded:X,tokens:B};let De=z.get(be),Ie=P_(De);if(Ie===null||Ie.length===0)return{blockedReason:Sc,expanded:!0,tokens:B};B=["git",...Ie,...ue],X=!0}return{blockedReason:Sc,expanded:!0,tokens:B}}function np(n,u,v){return xo(n,u,v).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function In(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?zt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=Pn.has(z)?2:1}return{subcommand:null,rest:[]}}function R_(n){let u=new Map;for(let v of n){let W=v.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,v.value)}return u}function xo(n,u,v){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?zt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=x_(u,v);return{blockedReason:B.blockedReason,entries:[...B.entries,...__(n,u,v)]}}function __(n,u,v){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let X=Cc(n[z+1]);if(X)W.push(X);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let X=Cc(B.slice(2));if(X)W.push(X);z++;continue}if(B==="--config-env"){let X=ep(n[z+1],u,v);if(X)W.push(X);z+=2;continue}if(B.startsWith("--config-env=")){let X=ep(B.slice(13),u,v);if(X)W.push(X);z++;continue}if(Pn.has(B)){z+=2;continue}z++}return W}function x_(n,u){let v=w_(n,u),W=A_(n,u);return{blockedReason:v===null||W===null?Sc:null,entries:[...v??[],...W??[]]}}function w_(n,u){let v=lr("GIT_CONFIG_PARAMETERS",n,u);if(v===void 0)return[];let W=[],z=wi(v);if(!z)return null;for(let B of z){let X=Cc(B);if(!X)return null;W.push(X)}return W}function A_(n,u){let v=Zm(n,u);if(v.state==="absent")return[];if(v.state==="invalid")return null;let W=[];for(let z=0;z<v.count;z++){let B=lr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),X=lr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||X===void 0)return null;W.push({key:B,value:X})}return W}function Cc(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function ep(n,u,v){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:lr(n.slice(W+1),u,v)}}function P_(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return wi(u)}var T_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",I_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",k_="git checkout --force discards uncommitted changes. Use 'git stash' first.",O_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",M_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",D_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",N_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",L_="git switch --force discards uncommitted changes. Use 'git stash' first.",W_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",F_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",G_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",z_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",$_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",B_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",U_="git push --force destroys remote history. Use --force-with-lease for safer force push.",H_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",j_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",V_="git branch -D force-deletes without merge check. Use -d for safe delete.",K_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",q_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Y_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Z_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",X_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",J_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Q_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",ex=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),tx=new Set(["--recurse-submodules","--track","-t"]),bc=new Set(["-b","-B","-U"]),vc=new Set(["-c","-C"]),nx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Bt(n,u){let v=n.split("=",1)[0]??n;return v.length>=4&&u.startsWith(v)&&v.startsWith("--")&&v.slice(2).length>=2}var wo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function op(n,u){let{subcommand:v,rest:W}=In(n);if(!v)return null;switch(v.toLowerCase()){case"checkout":return wr(rx(W,u));case"switch":return wr(ix(W));case"restore":return wr(ax(W));case"reset":return cx(W);case"clean":return wr(ux(W));case"rm":return wr(mx(W));case"push":return Zr(fx(W));case"branch":return Zr(hx(W));case"stash":return Zr(vx(W));case"worktree":return Zr(Ex(W));case"rebase":return wr(yx(W));case"merge":return wr(Sx(W));case"tag":return Zr(Cx(W));case"reflog":return Zr(bx(W));default:return null}}function wr(n){return n?{...n,localDiscard:!0}:null}function Zr(n){return n?{...n,localDiscard:!1}:null}function rx(n,u){let{index:v,before:W}=un(n),z=En(W,{shortOptsWithValue:bc});if(W.some((Q)=>Bt(Q,"--force"))||z.has("-f"))return lt("git.checkout-force",k_);for(let Q of n){if(Q==="-b"||Q==="-B"||Q==="--orphan")return null;if(Bt(Q,"--pathspec-from-file"))return lt("git.checkout-pathspec-from-file",M_)}if(v!==-1){if(W.some((le)=>!le.startsWith("-")))return lt("git.checkout-ref-path",O_);return lt("git.checkout-double-dash",T_)}let B=sx(n);if(B.length>=2)return lt("git.checkout-ambiguous",D_);let X=B[0];if(X===void 0||z.has("-d")||z.has("-t")||n.some((Q)=>Bt(Q,"--detach")||Bt(Q,"--track")))return null;if(ox(X)||u(X))return lt("git.checkout-double-dash",I_);return null}function ox(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function ix(n){let{before:u}=un(n);if(u.some((W)=>Bt(W,"--discard-changes")))return lt("git.switch-discard-changes",N_);let v=En(u,{shortOptsWithValue:vc});if(u.some((W)=>Bt(W,"--force"))||v.has("-f"))return lt("git.switch-force",L_);return null}function sx(n){let u=[],v=0;while(v<n.length){let W=n[v];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),v++;continue}if(ex.has(W)){v+=2;continue}if(tx.has(W)){let z=n[v+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];v+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}v++}return u}function ax(n){let u=lx(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?lt("git.restore-worktree",F_):lt("git.restore-unstaged",W_)}function lx(n){let u=!1,v=!1,W=!0,z=!1,B=(X)=>{if(!z)W=!1,z=!0;if(X!==void 0)W=X};for(let X=0;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(Q==="--"){u||=X+1<n.length;break}if(Q==="--pathspec-from-file"){u=!0,X++;continue}if(Q.startsWith("--pathspec-from-file=")){u=!0;continue}if(Q==="-h"||Q==="--help"||Q==="--version")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(Q==="--staged"){B();continue}if(Q==="--no-staged"){B();continue}if(Q==="--worktree"){B(!0);continue}if(Q==="--no-worktree"){B(!1);continue}if(Q==="--patch"){v=!0;continue}if(Q==="--no-patch"){v=!1;continue}if(nx.has(Q)){X++;continue}if(Q.startsWith("--"))continue;if(Q==="-"){u=!0;continue}if(!Q.startsWith("-")){u=!0;continue}for(let le=1;le<Q.length;le++){let ue=Q.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){v=!0;continue}if(ue==="s"||ue==="U"){if(le===Q.length-1)X++;break}}}return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function cx(n){let u=null;for(let v of n){if(Bt(v,"--hard")){u=lt("git.reset-hard",G_);break}if(Bt(v,"--merge")){u=lt("git.reset-merge",z_);break}}if(!u)return null;return dx(n)?Zr(u):wr(u)}function dx(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function ux(n){for(let v of n)if(v==="-n"||Bt(v,"--dry-run"))return null;let u=En(n.filter((v)=>v!=="--"));if(n.some((v)=>Bt(v,"--force"))||u.has("-f"))return lt("git.clean-force",$_);return null}function mx(n){let u=!1,v=!1,W=!1;for(let z of un(n).before){if(Bt(z,"--no-force")){u=!1;continue}if(Bt(z,"--force")){u=!0;continue}if(Bt(z,"--no-cached")){v=!1;continue}if(Bt(z,"--cached")){v=!0;continue}if(Bt(z,"--no-dry-run")){W=!1;continue}if(Bt(z,"--dry-run")){W=!0;continue}let B=En([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!v&&!W?lt("git.rm-force",B_):null}function fx(n){let{before:u,after:v}=un(n),W=En(u);if(u.some((X)=>Bt(X,"--mirror")))return lt("git.push-mirror",j_);if(u.some((X)=>Bt(X,"--force"))||W.has("-f")||rp(u,v).some(px))return lt("git.push-force",U_);if(u.some((X)=>Bt(X,"--delete"))||W.has("-d")||rp(u,v).some(gx))return lt("git.push-delete",H_);return null}function rp(n,u){return[...n.filter((v)=>v!==""&&!v.startsWith("-")),...u]}function px(n){return n.startsWith("+")||n.includes(":+")}function gx(n){return n.length>1&&n.startsWith(":")}function hx(n){let{before:u}=un(n),v=En(u),W=v.has("-D")||v.has("-d")||u.some((B)=>Bt(B,"--delete")),z=v.has("-D")||v.has("-f")||u.some((B)=>Bt(B,"--force"));if(W&&z)return lt("git.branch-force-delete",V_);return null}function yx(n){let{before:u}=un(n);return u.some((v)=>Bt(v,"--abort"))?lt("git.rebase-abort",K_):null}function Sx(n){let{before:u}=un(n);return u.some((v)=>Bt(v,"--abort"))?lt("git.merge-abort",q_):null}function Cx(n){let{before:u}=un(n);return En(u).has("-d")||u.some((W)=>Bt(W,"--delete"))?lt("git.tag-delete",Y_):null}function bx(n){return n[0]==="delete"?lt("git.reflog-delete",Z_):null}function vx(n){for(let u of n){if(u==="drop")return lt("git.stash-drop",X_);if(u==="clear")return lt("git.stash-clear",J_)}return null}function Ex(n){let{before:u}=un(n);if(!u.includes("remove"))return null;let W=En(u);if(u.some((z)=>Bt(z,"--force"))||W.has("-f"))return lt("git.worktree-remove-force",Q_);return null}import{isAbsolute as Vx,join as Kx,resolve as qx}from"node:path";var Rc="TMPDIR",_c="IFS",sp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,ap=/^[A-Za-z_][A-Za-z0-9_]*$/,lp=new Set(["export","typeset","declare","readonly"]),Rx=new Set(["builtin","command","time"]),_x=new Set(["do","then","else"]),xx=new Set(["do","then","case"]),ip=new Set(["done","fi","esac"]),wx=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,Ax=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Ao(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function Po(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function cp(n,u,v){let W=Ao(u.shellAssignments,v);return n.map((z)=>{if(!hp(z.text))return t(z);if(z.provenance==="variable")return dp(z.text,W);if(z.provenance==="command-substitution")return Tx(z,v.darwinUserTempDir)??t(z);return z.provenance==="literal"&&wx.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function dp(n,u){return n.replace(Ax,(v,W,z)=>u.get(W??z??"")??v)}var Px=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function Tx(n,u){if(n.provenance!=="command-substitution")return null;let v=n.parts.map((z)=>{if(z.provenance==="command-substitution")return Px.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!v.every((z)=>z!==null))return null;let W=v.join("");return/[\s$`*?[]/.test(W)?null:W}function Zn(n,u){let v=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!v)return null;let W=dp(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function up(n,u){return{env:n,effectiveEnvAssignments:Mx(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function mp(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function xc(n,u){let v=pp(n,u),W=n[0]??"";if(xx.has(W))u.bodyDepth+=1;if(W==="elif"||ip.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(ip.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((Q)=>{u.shellAssignments.delete(Q)}),u.bodyAssignments.clear();v.assignments.filter((Q)=>Q.persists).forEach((Q)=>{if(u.shellAssignments.set(Q.name,Q.value),u.bodyDepth>0)u.bodyAssignments.add(Q.name);wc(u,Q)});let z=v.commandIndex;if(z!==-1&&lp.has(n[z]??""))n.filter((Q)=>ap.test(Q)&&Ec(Q)).forEach((Q)=>{Dx(u,Q)});let B=z===-1?-1:gp(n,z);if(B===-1||n[B]!=="unset")return;let X=Lx(n,B);if(X===null)return;n.slice(X).forEach((Q)=>{if(u.bodyDepth>0){u.shellAssignments.set(Q,"");return}Nx(u,Q)})}function fp(n,u){let v=pp(n,u).assignments;if(v.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return v.forEach((z)=>{W.set(z.name,z.value)}),W}function pp(n,u){let v=_x.has(n[0]??"")?1:0,W=n.findIndex((Q,le)=>le>=v&&!hp(Q)),z=W!==-1&&lp.has(n[gp(n,W)]??""),B=Ox(u);return{assignments:n.flatMap((Q,le)=>{let ue=Ix(Q,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!Ps(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function gp(n,u){let v=u;while(Rx.has(n[v]??"")){v+=1;while(n[v]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[v]??""))return u;v+=1}}return v}function hp(n){return Wn(n)!==null||sp.test(n)}function Ix(n,u,v){return Wn(n)??kx(n,u,v)}function kx(n,u,v){let W=Ts(n,v,u);if(W)return W;let z=n.match(sp)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):v.get(z)??""}${n.slice(B+1)}`}}function Ec(n){return n===Rc||n===_c||Vl(n)}function Ox(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function Mx(n,u){let v=[Rc,_c].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(v.length===0)return u;return new Map([...v,...u??[]])}function wc(n,u){let v=new Map(n.effectiveEnvAssignments??[]);v.set(u.name,u.value),n.effectiveEnvAssignments=v}function Dx(n,u){wc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function Nx(n,u){if(!Ec(u)&&!ap.test(u))return;if(n.shellAssignments.set(u,""),Ps(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!Ec(u)||u===Rc||u===_c||jo(u)){wc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let v=new Map(n.effectiveEnvAssignments);v.delete(u),n.effectiveEnvAssignments=v.size===0?void 0:v}function Lx(n,u){let v=u+1;while(v<n.length){let W=n[v];if(!W)return null;if(W==="--")return v+1;if(W==="-v"){v++;continue}if(W.startsWith("-"))return null;return v}return v}import{dirname as Sp,join as Qs,resolve as Wx}from"node:path";function ea(n,u){return jl.some((v)=>u?.has(v)||n.has(v))}function To(n,u,v){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=v.realpath(Wx(u));if(W===null||!v.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,X=1;while(X<n.length){let Q=n[X];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-"))break;if(Q==="-C"){let le=n[X+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=yp(z,le,v);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,X+=2;continue}if(Q.startsWith("-C")&&Q.length>2){let le=yp(z,Q.slice(2),v);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,X++;continue}if(Q==="--git-dir"||Q==="--work-tree"){B=!0,X+=2;continue}if(Q.startsWith("--git-dir=")||Q.startsWith("--work-tree=")){B=!0,X++;continue}X+=Pn.has(Q)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function yp(n,u,v){try{let W=vr(n,u,v);return v.isDirectory(W)?W:null}catch{return null}}function Ai(n,u){if(u.entryKind(Qs(n,".git"))!=="missing")return n;let v=Sp(n);return v===n?null:Ai(v,u)}function ta(n,u,v,W,z){let B=W.paths,X=Qs(v,".git"),Q=B.isDirectory(X),le=Q&&!W.isGitDirectory(X),ue=Cp(u).filter((be)=>le||be!==v&&br(be,v));return xo(n,W.env,z).entries.some((be)=>be.key.toLowerCase()==="core.worktree")||ue.some((be)=>B.entryKind(Qs(be,"HEAD"))!=="missing"||be!==v&&B.entryKind(Qs(be,".git"))!=="missing")||Q&&W.gitDirectoryRedirects(X)}function Cp(n){let u=Sp(n);return u===n?[n]:[n,...Cp(u)]}function bp(n,u,v){if(!u.localDiscard||!v.worktreeMode||ea(v.environment.env,v.envAssignments))return null;let W=To(n,v.cwd,v.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=v.environment.worktreeFacts(W.gitCwd),B=Ai(W.gitCwd,v.environment.paths);if(!z||B===null||ta(n,W.gitCwd,B,v.environment,v.envAssignments))return null;if(Ac(n,v,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Ac(n,u,v){let{subcommand:W,rest:z}=In(n),B=W?.toLowerCase();if(u.dynamicArguments||Fx(z)||Ux(n,u.environment.env,u.envAssignments,v)||$x(z)||Gx(B,z))return!0;return B==="clean"&&Bx(z)>1}function Fx(n){return n.some((u)=>/[$*?[]/.test(u))}function Gx(n,u){if(n==="checkout"){let{before:v}=un(u),W=En(v,{shortOptsWithValue:bc}),z=v.some((X)=>Bt(X,"--force"))||W.has("-f"),B=W.has("-B")||v.some((X)=>X==="-B"||X.startsWith("-B"));return z&&B}if(n==="switch"){let{before:v}=un(u),W=En(v,{shortOptsWithValue:vc}),z=v.some((X)=>Bt(X,"--force"))||v.some((X)=>Bt(X,"--discard-changes"))||W.has("-f"),B=v.some((X)=>X==="-C"||X.startsWith("-C")||zx(X))||W.has("-C");return z&&B}return!1}function zx(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function $x(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function Bx(n){let u=0;for(let v of n){if(v==="--force"){u++;continue}if(v.startsWith("-")&&!v.startsWith("--")){for(let W of v.slice(1))if(W==="f")u++}}return u}function Ux(n,u,v,W){if(lr("GIT_CONFIG_PARAMETERS",u,v)!==void 0)return!0;let z=xo(n,u,v);if(z.blockedReason!==null)return!0;let B=z.entries.map((Q)=>({key:Q.key.toLowerCase(),value:Q.value}));if(B.some((Q)=>jx(Q.key)))return!0;let X=B.filter((Q)=>Q.key==="submodule.recurse").at(-1);if(X)return X.value===void 0||Hx(X.value);if(Jm(v))return!0;return W.recursiveSubmodules}function Hx(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function jx(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function vp(n,u,v){let W=n.map((le)=>Zn(le,v.shellAssignments??new Map)??t(le)),z=v.environment.paths,B=To(W,v.cwd,z),X=v.originalCwd?z.realpath(qx(v.originalCwd)):null;if(u.id.startsWith("git.push-")||X===null||B.gitCwd===null||B.hasExplicitGitContext||ea(v.environment.env,v.envAssignments))return null;let Q=u.id==="git.worktree-remove-force"?Zx(n,v.shellAssignments,z):Ai(B.gitCwd,z);if(Q===null||u.id!=="git.worktree-remove-force"&&!Yx(Q,B.gitCwd,W,u,v)||!So(Q,v.environment)||As(Q,v.environment)||br(X,Q)||br(Q,X))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function Yx(n,u,v,W,z){let B=z.environment.paths,X=Kx(n,".git");if(B.entryKind(X)!=="present"||ta(v,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(X))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Ac(v,z,le)}function Zx(n,u,v){let W=In(n.map(t)).rest,{before:z,after:B}=un(W.slice(W.indexOf("remove")+1)),X=[...z.filter((be)=>!be.startsWith("-")),...B],Q=X.length===1?X[0]??"":"",le=n.find((be)=>be.text===Q),ue=(le&&Zn(le,u??new Map))??Q;if(!Vx(ue)||/[\s$`*?[]/.test(ue)||v.entryKind(ue)!=="present"||!v.isDirectory(ue))return null;return v.realpath(ue)}var Jx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Qx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function na(n,u){return Ep(n,u)}function Ep(n,u,v){let W=n.map(t),z=tp(W,u.environment.env,u.envAssignments),B=z.blockedReason?Tt(lt("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let X=z.tokens;if((Xm(u.envAssignments)||np(W,u.environment.env,u.envAssignments))&&ew(X))return lt("git.ssh-env",Jx);let Q=op(X,(ue)=>{let be=To(W,u.cwd,u.environment.paths).gitCwd;return be!==null&&u.environment.paths.entryKind(Xx(be,ue))!=="missing"});if(!Q)return null;if(z.expanded||z.blockedReason)return Q;let le=bp(W,Q,u)??vp(n,Q,u);if(!le)return Q;return v?.(le),null}function Rp(n,u){let v=null;return{match:Ep(n,u,(z)=>{v=z}),relaxation:v}}function ew(n){let{subcommand:u,rest:v}=In(n),W=u?.toLowerCase();if(!W)return!1;if(Qx.has(W))return!0;if(W==="archive")return un(v).before.some((z)=>Bt(z,"--remote"));return W==="remote"&&tw(v)}function tw(n){return n.find((u)=>!nw(u))?.toLowerCase()==="update"}function nw(n){return n==="-v"||Bt(n,"--verbose")||Bt(n,"--no-verbose")}import{isAbsolute as kw}from"node:path";function _p(n,u,v,W){let z=n.slice(0,u),B=n.slice(u+v);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function ra(n,u,v){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>v(B).some((X)=>!z.has(W(X))))}var xp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",rw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ow="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",iw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",sw="rm -rf in home directory is dangerous. Change to a project directory first.",wp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:iw},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ow},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:sw},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:xp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:rw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:xp}};function oa(n,u){let v=Fn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=Zs(W),B=lw(n);for(let X of B){let Q=Kr(X.word);if(z&&Q.unsafeBraceExpansion){let le=Tt(Vr({kind:"outside_anchored_cwd"},v,u.policy,wp),u.policy);if(le)return le;continue}for(let le of Q.expandedTargets??[X.text]){let ue=pn(le),be={targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected};if(!z&&v.resolvedCwd&&Hr(ue,v.resolvedCwd,v.protectedGitMetadata,z,v.environment,v.budget))return lt("rm.git-metadata",y);if(!z)continue;for(let De of aw(ue,v,be)){let Ie=Vr(De,v,u.policy,wp),Oe=Tt(Ie,u.policy);if(Oe)return Oe}}}return null}function aw(n,u,v){let W=Sn(n,u,v);if(W.kind==="cwd_self_target")return[W,Sn(n,u,{...v,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=Sn(n,u,{...v,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,Sn(n,u,{...v,skipHomeCwd:!0,skipCwdSelf:!0})]}function lw(n){let u=[],v=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){v=!0;continue}if(v){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Ar={kind:"none"},Xr={kind:"dynamic"},cw=new Set(["<","<<","<<-","<<<","<&","<>"]),Pp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,dw=/^(?:[0-9]+|[@*])$/,uw=Cr.maxWords,Tp=Cr.maxInputLength;function Ip(n){if(!n||zt($t(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),v=u[0]?.text;if(v===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(v==="%s")return W.join("");if(v==="%s\\n"||v===`%s
-`)return`${W.join(`
-`)}
-`;if(v.includes("%")||/\\(?![\\nrt])/.test(v))return;return v.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ia(n){let u=Io(n[1])==="--"?2:1;if(n.length<=u)return Ar;let v=n.slice(u);if(!v.every(Ti))return Xr;return{kind:"literal",source:v.map(t).join(" ")}}function kp(n){let u=Io(n[1])==="--"?2:1,v=n[u],W=Io(v);if(v===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Ar;if(!Ti(v))return Xr;return{kind:"literal",source:W}}function sa(n,u){let v=Lp(n);if(v===-1)return Ar;let W=mw(u);if(!W)return Ar;let z=[],B=W.command?.length??0;for(let X of W.references){let Q=pw(X,n,v,W.ifs);if(!Q)return Xr;if(B+=Q.reduce((le,ue)=>le+ue.length+3,0),z.length+Q.length>uw||B>Tp)return Xr;z.push(...Q)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ae)].filter((X)=>X!==null).join(" ")}}function Op(n,u){let v=Lp(n),W=n.slice(v+1),z=/\bIFS\b/.test(u);if(v===-1||!W.every(Ti)||z)return u;let B=W.map(Io),X="",Q=null,le=0;while(le<u.length){let ue=u[le]??"",be=Q==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(be){let De=be[1]??be[2],Ie=De==="@"||De==="*"?B.slice(1):[B[Number(De)]??""];if(Q!=='"'&&Ie.some((Ne)=>/[*?[]/.test(Ne)))return u;if(X+=Q==='"'?Ie.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(De==="@"?'" "':" "):Ie.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ae(Le):"").join(" ")).join(" "),X.length>Tp)return u;le+=be[0].length;continue}if(ue==="\\"&&Q!=="'"){X+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&Q!=='"'||ue==='"'&&Q!=="'")Q=Q?null:ue;X+=ue,le++}return X}function Mp(n,u,v,W){if(!Rn(n.map(t)).readsStdinAsCommands)return Ar;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&cw.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return Ar;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return Xr;return{kind:"literal",source:z.target.text}}if(!v)return Ar;return W===void 0?Xr:{kind:"literal",source:W}}function pr(n,u,v=new Map){let W=Rn(n.map(t)).scriptIndex;if(W===null)return Ar;let z=n[W],B=z&&u!==void 0?Po(z,u):null;if(B!==null)return{kind:"literal",source:B};let X=Io(z);if(po(z,X))return{kind:"literal",source:X};let Q=z?Zn(z,v):null;return Q===null?Xr:{kind:"literal",source:Q}}var Dp=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Np(n,u,v){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(yc).some((W)=>{let z=cr(W.words,v).words[0];return z!==void 0&&Dp.has(zt($t(t(z))))})}function kc(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],v=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!v)return!1;if(!(u.text==="eval"&&v.quoted&&v.parts.length===3&&v.parts[0]?.raw==='"'&&v.parts[1]?.provenance==="command-substitution"&&v.parts[1].raw.startsWith("$(")&&v.parts[2]?.raw==='"'||u.text==="eval"&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let X=B.words[0]?.text;if(X===void 0||Wn(X)!==null)return!1;let Q=zt($t(X));return!Dp.has(Q)&&!nn.has(Q)&&!qr(Q)}function Lp(n){return Rn(n.map(t)).commandIndex??-1}function mw(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),v=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(v),z=(W?.[3]??v).split(/\s+/).map(fw);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
-`}}function fw(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),v=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??v;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function pw(n,u,v,W){let z=u.slice(v+2);if(n.parameter==="@")return n.quoted?Pc(z):gw(z,W);if(n.parameter==="*"){let Q=Pc(z);if(!Q)return;let le=Q.join(W[0]??"");return n.quoted?[le]:Tc(le,W)}let B=u[v+1+n.parameter];if(B&&!Ti(B))return;let X=Io(B);return n.quoted?[X]:Tc(X,W)}function Pc(n){return n.every(Ti)?n.map(t):void 0}function gw(n,u){let v=Pc(n);if(!v)return;let W=v.map((z)=>Tc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Tc(n,u){if(["*","?","[","]"].some((v)=>n.includes(v)))return;if(u==="")return n===""?[]:[n];if(u===` 	
-`)return n.trim().split(/\s+/).filter(Boolean);if(u.length!==1)return;return u===" "||u==="\t"||u===`
-`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function Ti(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function Io(n){return n?t(n):""}function Ae(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function Oc(n,u){return Ic(C(n,"posix"),u)}function Ii(n){return Oc(n,new Set(Array.from(n.matchAll(Pp)).flatMap((u)=>{let v=u[1]??u[2];return v===void 0?[]:[v]})))}function Ic(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let v=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(Ic(W.body,v))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>Ic(z,v))||Wp(W.words,v))return!0;bw(W,v)}return!1}function Wp(n,u){let v=n.findIndex((X)=>Wn(X.text)===null);if(v===-1)return!1;let W=n[v];if(!W)return!1;if(Pi(W,u))return!0;let z=$t(W.text);if(z==="source"||z==="."){let X=n[v+1]?.text==="--"?v+2:v+1;return Ap(n[X],u)}if(nn.has(z)){let X=n.slice(v),Q=X.map((be)=>be.text),le=Rn(Q),ue=le.commandIndex??le.scriptIndex;return!Yn(Q)&&ue!==null&&Ap(X[ue],u)}let B=hw(n,v,u);if(B===null)return!1;if(B===-1)return!0;return Wp(n.slice(B),u)}function hw(n,u,v){let W=$t(n[u]?.text??"");if(W==="command")return yw(n,u+1);if(W==="exec")return Sw(n,u+1);if(W==="env")return Cw(n,u+1,v);return null}function yw(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return v}return null}function Sw(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(W==="-a"){v++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return v}return null}function Cw(n,u,v){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Pi(n[W+1],v)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Pi(z,v)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(Wn(B))continue;return W}return null}function bw(n,u){if(!n.words.every((v)=>Wn(v.text)!==null))return;for(let v of n.words){let W=Wn(v.text);if(!W)continue;if(Pi(v,u))u.add(W.name)}}function Pi(n,u){if(!n)return!1;return n.parts.filter((v)=>v.provenance==="variable").some((v)=>Array.from(v.raw.matchAll(Pp)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(dw.test(z)||u.has(z))}))}function Ap(n,u){return!!n&&(n.parts.some((v)=>v.provenance!=="literal"&&v.provenance!=="variable")||Pi(n,u))}var Mc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Dc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",vw="__CC_SAFETY_NET_XARGS_INPUT__",aa="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",la="rm",Ew=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Rw=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,_w=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xw=/^(?:[0-9]+|[@*])$/;function zp(n,u){let v=n.map(t),{childStart:W,replacementToken:z}=Jr(v),B=v.slice(W),X=lt("xargs.shell-dynamic",Dc);if(Aw(B,z,u)&&Tt(X,u.policy))return Tt(X,u.policy);for(let Q of qn(B,u)){let le=Q.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Tt(X,u.policy):null;if(ue)return ue;let be=Vp(le,z,Q.wrapperEnvAssignments),De=Q.head==="rm"&&z!==null&&Hp(le,z),Ie=u.analyzeChild(le,{...Yr(Q,u),dynamicInput:be,dynamicSourceInput:De||Bp(le,Q.head,z,Q.wrapperEnvAssignments,be,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:De,shellDynamicMatch:X,dynamicSourceMatch:X,rmDynamicMatch:lt("xargs.rm-recursive-force-dynamic",Mc)});if(Ie)return Ie;let Oe=ww(le,z,u.policy?.rules??[],Tt(X,u.policy));if(Oe)return Oe;if(Q.head==="git"){let Le=z===null?[...le,vw]:le,We=z!==null&&(le.some((st)=>st.includes(z))||Array.from(Q.envAssignments.values()).some((st)=>st.includes(z))),Ge=u.analyzeChild(Le,{...Yr(Q,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(Ge)return Ge}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function ww(n,u,v,W){if(v.length===0)return null;if(u===null){for(let B of v){let X=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],v);if(X)return X}return null}let z=$t(n[0]??"");if(!v.some((B)=>$t(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function $p(n,u,v){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=_p(n,W,u.length,v);return z===null?[]:[z]}function Bp(n,u,v,W,z,B,X){if(nn.has(u)){if(Yn(n))return!1;if(v!==null&&Pw(n,v,X))return!0;let Q=Gn(n);if(!Q){let le=pr(en(n));if(le.kind==="literal")return v!==null&&le.source.includes(v);return le.kind==="none"&&z}if(v!==null&&Q.includes(v)&&!Up(Q,v,X))return!0;if(Ln(Q))return!0;return Tw(Q,v,W)}if(Hn(u))return Fp(n,v,Hs,Mf(u));if(Nn.has(u))return Fp(n,v,dc,Hf);if(u==="eval"){let Q=ia(en(n));if(Q.kind==="dynamic")return!0;if(v!==null)return Q.kind==="literal"&&Q.source.includes(v);return z}if(u==="find")return Iw(n,v,B);if(u==="git"){let Q=In(n);return v===null?Q.subcommand===null:(Q.subcommand?.includes(v)??!1)||Q.subcommand!==null&&wo.has(Q.subcommand.toLowerCase())&&jp(Q.rest,v).some((le)=>le.includes(v))}return!1}function Up(n,u,v){if(v===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Ln(B)===null&&v(B)===null}function Fp(n,u,v,W){let z=v(n);if(u===null)return z.optionsOpen||v([...n,aa]).sources.some((Q)=>Q.value===aa);if(z.sources.some((Q)=>Q.value.includes(u)))return!0;let B=W.flatMap((Q)=>[Q.selector,...Q.valueForm==="attached-only"||Q.valueForm==="attached-or-separate"?[`${Q.selector}${aa}`]:[],...Q.valueForm==="equals-or-separate"?[`${Q.selector}=${aa}`]:[]]),X=new Set(B.flatMap((Q)=>n.flatMap((le)=>$p(le,u,Q))));return ra(z.sources,X,(Q)=>v(n.map((le)=>le.replaceAll(u,Q))).sources)}function Aw(n,u,v){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(qn(n,v),(B)=>B.head)),z=u===null?[...n,la]:n.map((B,X)=>X===0?B:B.replaceAll(u,la));return Array.from(qn(z,v)).some((B)=>B.head===la&&!W.has(la))}function Hp(n,u){return jp(n.slice(1),u).some((v)=>v.includes(u)&&(v.startsWith("-")||v.startsWith(u)))}function jp(n,u){let v=n.findIndex((W)=>W==="--"&&!W.includes(u));return v===-1?n:n.slice(0,v)}function Vp(n,u,v){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(v.values()).some((W)=>W.includes(u))}function Pw(n,u,v){let W=Rn(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!Up(z,u,v)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((X)=>n.some((Q,le)=>{if(le===0||!Q.includes(u))return!1;return $p(Q,u,X).some((be)=>{let De=n.map((Oe,Ne)=>Ne===le?Oe.replaceAll(u,be):Oe),Ie=Rn(De);if(Ie.commandIndex===null&&Ie.scriptIndex===null)return!1;if(W.commandIndex===null&&Ie.commandIndex!==null)return!0;if(W.scriptIndex===null&&Ie.scriptIndex!==null)return!0;if(Ie.commandIndex!==null&&(De[Ie.commandIndex]??"").includes(be))return!0;return Ie.scriptIndex!==null&&(De[Ie.scriptIndex]??"").includes(be)})}))}function Tw(n,u,v){let W=new Set(u===null?[]:Array.from(v).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(Ew))if(Gp(z,W))return!0;for(let z of n.matchAll(Rw))for(let B of(z[1]??"").matchAll(_w))if(Gp(B,W))return!0;return Oc(n,W)}function Gp(n,u){let v=n[1]??n[2];return v!==void 0&&(xw.test(v)||u.has(v))}function Iw(n,u,v){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let X=n[B]??"";if(!W&&!X.startsWith("-")&&X!=="!"&&X!=="("){if(X.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(nr(X)){let le=_o(n,B);B=le.nextIndex-1;for(let ue of qn(le.tokens,{environment:v,cwd:void 0})){let be=Vp(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&Hp(ue.tokens,u)||Bp(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,be,v))return!0}continue}let Q=fr(X);if(Q>0){if(z=Q,X.includes(u))return!0;continue}if(X.includes(u))return!0}return!1}function Jr(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),v=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:v};if(!z.startsWith("-"))return{childStart:W,replacementToken:v};if(z==="-I"){v=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){v=z.slice(2),W++;continue}if(z==="--replace"){v="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);v=B===""?"{}":B,W++;continue}if(z==="-J"){v=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:v}}var ki="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Oi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ow="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Mw="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",da=/\{[^{}\s]*\}/g,Kp=/\{\}|\{-?\d+\}/g,qp=/[\s;&|<>()$`\\"']/,Dw=["e","f","source","file","-e","-f","--source","--file"],Nw=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Lw=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Ww=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Yp=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Fw=new Set(["--workdir","--wd"]),Zp="__CC_SAFETY_NET_PARALLEL_SOURCE__";function zn(n,u){for(let v of n){let W=u(v);if(W)return W}return null}function Qp(n){return zn([...n],(u)=>Ln(u))}function eg(n,u){let v=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=ko(u);if(Ne)return Ne}if(v.length===2&&(v[1]==="--version"||v[1]==="--help"))return null;let z=mg(v),{template:B,jobs:X,runsRemotely:Q,readsCommandsFromInput:le,unsupported:ue,workdir:be,dryRun:De}=z;if(ue){let Ne=ko(u);if(Ne)return Ne;let Le=Qp(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=jw(u);if(Ne)return Ne}if(be!==void 0&&Q){let Ne=ko(u);if(Ne)return Ne}let Ie=Vw(be,u.cwd,u.environment.paths);if(Ie===null){let Ne=ko(u);if(Ne)return Ne}let Oe=Q?{...u,cwd:void 0,originalCwd:void 0}:Ie===null||Ie===void 0||Ie===u.cwd?u:{...u,cwd:Ie};if(De){if([...qn(B,Oe)].flatMap((Le)=>[...Le.envAssignments.values()]).some(Wc)){let Le=ko(u);if(Le)return Le}return null}if(B.length===0){let Ne=X.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=sg(Oe.envAssignments,Oe.cwd,Q);return zn(Ne,(We)=>u.analyzeNested(We,Le))}return zn(qn(B,Oe),(Ne)=>Gw(Ne,z,u,Oe))}function Gw(n,u,v,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:X}=u,Q=n.tokens,le=[...n.envAssignments.values()];if(le.some(dg)){let at=ko(v);if(at)return at}let ue=Qp(le);if(ue)return ue;let be=le.some(jt),De=z||be,Ie=X&&De,Oe=sg(n.envAssignments,n.wrapperCwd,B||Ie),Ne=De?{...Oe,worktreeMode:!1}:Oe,Le=Q.join(" "),We=jt(Le.split(/[ \t\n=]/,1)[0]??""),Ge=!u.quotesCommand&&(We||Q.some((at)=>qp.test(at))),st=We||qp.test(Q[0]??""),it=Ge&&st&&u.jobs.length>0?null:zw(n,u,v,W,Ne,be);if(it||!Ge)return it;return tg(jt(Le)?Le:`${Le} {}`,!We,n,u,v,W,Ne)}function zw(n,u,v,W,z,B){let{jobs:X,templateHasPlaceholder:Q,runsRemotely:le,usesStdin:ue}=u,be=n.tokens,De=Q||B;if(nn.has(n.head)){let Oe=()=>{if(!Q||X.length===0)return null;return zn(X,(We)=>v.analyzeChild(ca(be,We,v.budget),Yr(n,W)))};if(Yn(be))return Oe();if(Xs(be))return xr();let Ne=Gn(be);if(Ne){if(ug(Ne)){let it=Pr(v);if(it)return it;if(X.length===0)return null;return zn(X,(at)=>v.analyzeNested(lg(Ne,at,v.budget),z))}if(jt(Ne))return tg(Ne,!1,n,u,v,W,z);let We=!B&&(!Q||X.length>0)?(X.length>0?X:[void 0]).map((it)=>sa(en(it===void 0?be:Q?be.map((at)=>ag(at,it)):[...be,...it]),Ne)):[];if(We.some((it)=>it.kind==="dynamic")){let it=Pr(v);if(it)return it}let Ge=We.flatMap((it)=>it.kind==="literal"?[it.source]:[]);if(Ge.length>0)return v.budget.charge("derivedTokens",Ge.length),zn(Ge,(it)=>v.analyzeNested(it,z));if(Ii(Ne)){let it=Pr(v);if(it)return it}let st=v.analyzeNested(Ne,z);if(st)return st;if(De)return Pr(v);return null}let Le=pr(en(be));if(Le.kind==="dynamic"||Le.kind==="literal"&&jt(Le.source))return Pr(v)??Oe();if(Le.kind==="literal")return Oe();if(X.length>0){let We=Pr(v);if(We)return We;let Ge=Oe();if(Ge)return Ge;if(Q)return null;let st=X.flatMap((it)=>it[0]===void 0?[]:[it[0]]);return v.budget.charge("derivedTokens",st.length),zn(st,(it)=>v.analyzeNested(it,z))}if(De||ue)return Pr(v)??Oe();return null}if(n.head==="rm"&&mr(be)){if(Q&&X.length>0)return zn(X,(Ne)=>Nc(ca(be,Ne,v.budget,Kp),n.cwd,W));if(X.length>0)return zn(X,(Ne)=>Nc(Jp(be,Ne,v.budget),n.cwd,W));let Oe=Nc(be.flatMap((Ne,Le)=>{if(Le===0||!jt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(Kp,"")]:[]}),n.cwd,W);if(Oe)return Oe;return ig(v)}let Ie=X.length>0?X:[void 0];return zn(Ie,(Oe)=>{let Ne=Oe===void 0?be:Q?ca(be,Oe,v.budget):Jp(be,Oe,v.budget),Le=lt("parallel.shell-dynamic",Oi),We=ue&&n.head==="find"?Hw(Ne,W):null,Ge=rg(Ne,ue,v)??We?.customResult??null,st=$t(n.head),it=ue&&(st==="rm"&&Lc(Ne)||st==="xargs"&&og(Ne)||We?.rmOptions===!0),at=ue&&(it||We?.executedSource===!0||We===null&&ng(Ne,st)),Et=v.analyzeChild(Ne,{...Yr(n,W),worktreeMode:le||ue||De?!1:v.worktreeMode,dynamicInput:ue||De,dynamicRmInput:it,dynamicSourceInput:Ge!==null||at,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:lt("parallel.rm-recursive-force-dynamic",ki)});if(at){let Rt=Tt(Le,v.policy);if(Rt)return Rt}return Et??Ge??F(Ne,v.policy?.rules??[])})}function tg(n,u,v,W,z,B,X){if(W.jobs.length>0)return zn(W.jobs,(ue)=>z.analyzeNested(lg(n,u?ue.map(Ae):ue,z.budget),X));let Q=wi(n);if(Q?.[0]&&$t(Q[0])==="rm"&&mr(Q)){let ue=ig(z);if(ue)return ue}return(Q?z.analyzeChild(Q,{...Yr(v,B),dynamicInput:W.usesStdin,shellDynamicMatch:lt("parallel.shell-dynamic",Oi),rmDynamicMatch:lt("parallel.rm-recursive-force-dynamic",ki)}):null)??z.analyzeNested(n,X)}function ng(n,u){if(jt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(nn.has(u))return Uw(n);if(u==="git")return $w(n);if(u==="find")return!0;if(Nn.has(u))return Xp(n,Dw,_i);if(Hn(u))return Xp(n,Nw,Us);return!1}function Lc(n){let u=n.indexOf("--"),v=n.slice(1,u===-1?void 0:u);if(!n.some(jt))return u===-1;return v.some((z)=>jt(z)&&(z.startsWith("-")||ug(z)))}function $w(n){if(Bw(n))return!0;let u=In(n);if(u.subcommand===null||jt(u.subcommand))return!0;if(!wo.has(u.subcommand.toLowerCase()))return!1;let v=u.rest.indexOf("--"),W=u.rest.slice(0,v===-1?void 0:v);if(!n.some(jt))return v===-1;return W.some(jt)}function Bw(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v||v==="--"||!v.startsWith("-"))return!1;if(v==="-c"||v==="--config-env"){if(jt(n[u+1]??""))return!0;u++;continue}if(v.startsWith("-c")&&v.length>2||v.startsWith("--config-env=")){if(jt(v))return!0;continue}if(jt(v))return!0}return!1}function Uw(n){if(Yn(n))return!1;let u=Gn(n);if(u!==null)return jt(u);let v=pr(en(n));if(v.kind==="literal")return jt(v.source);if(v.kind==="dynamic")return!0;return!n.some(jt)}function Xp(n,u,v){let W=v(n);if(W.some((z)=>jt(z.value)))return!0;if(!n.some(jt))return v([...n,Zp]).some((z)=>z.value===Zp);return ra(W,u,(z)=>v(n.map((B)=>ag(B,[z]))))}function rg(n,u,v){let W=v.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>$t(B.command)===$t(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(jt))return Pr(v);return zn(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function Hw(n,u){let v={customResult:null,executedSource:!n.some(jt),rmOptions:!1},W=!1,z=0,B=null,X=()=>{if(!B?.some(jt))return;for(let Q of qn(B,u))v.executedSource||=ng(Q.tokens,Q.head),v.rmOptions||=Q.head==="rm"&&Lc(Q.tokens)||Q.head==="xargs"&&og(Q.tokens),v.customResult??=rg(Q.tokens,!0,u)};for(let Q of n.slice(1)){if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){v.executedSource||=jt(Q);continue}if(W=!0,B){if(Q===";"||Q==="+"){X(),B=null;continue}B.push(Q);continue}if(z>0){z--;continue}if(nr(Q)){B=[],v.executedSource||=jt(Q);continue}let le=fr(Q);if(le>0){z=le,v.executedSource||=jt(Q);continue}v.executedSource||=jt(Q)}return X(),v}function og(n){let u=n.slice(Jr(n).childStart);return $t(u[0]??"")==="rm"&&Lc(u)}function ua(n,u){return(v)=>Tt(lt(n,u),v.policy)}var Pr=ua("parallel.shell-dynamic",Oi),jw=ua("parallel.command-stream-dynamic",Ow),ko=ua("parallel.command-stream-dynamic",Mw),ig=ua("parallel.rm-recursive-force-dynamic",ki);function Nc(n,u,v){return Tt(oa(en(n),{environment:v.environment,cwd:u,budget:v.budget,originalCwd:v.originalCwd,strict:v.strict,paranoid:v.paranoidRm,allowTmpdirVar:v.allowTmpdirVar,tmpdirWordSplittingUnsafe:Br(v.envAssignments??new Map,v.environment),trustedTmpdirValue:yo(v.envAssignments??new Map,v.environment),protectedGitMetadata:v.protectedGitMetadata,policy:v.policy}),v.policy)}function sg(n,u,v){let W={};if(n)W.envAssignments=n;if(v)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function ag(n,u){return n.replace(da,(v)=>cg(v,u))}function ca(n,u,v,W=da){return v.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let X=cg(B,u);return v.charge("derivedTokens",Math.max(1,Math.ceil(X.length/64))),X}))}function lg(n,u,v){return ca([n],u,v)[0]??""}function Jp(n,u,v){return v.charge("derivedTokens",n.length+u.length),[...n,...u]}function cg(n,u){let v=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(v===void 0)return u[0]??"";let W=Number(v);return u[W>0?W-1:u.length+W]??""}function jt(n){return n.search(da)!==-1}function dg(n){if(Wc(n))return!0;for(let u of n.matchAll(da))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function Wc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function ug(n){return/^\{[^{}\s]*\}$/.test(n)}function Vw(n,u,v){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!kw(n))return null;try{return vr(u??n,n,v)}catch{return null}}function mg(n){let u=1,v=[],W=n.length,z=-1,B=!1,X=!1,Q=!1,le,ue=!1,be=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let at=fc(n,u+1);v.push(...at.templateTokens),W=u+1,z=at.markerIndex;break}if(!Le.startsWith("-")){let at=fc(n,u);v.push(...at.templateTokens),W=u,z=at.markerIndex;break}let We=n[u+1],Ge=Le.indexOf("="),st=Ge===-1?Le:Le.slice(0,Ge),it=Ge===-1?void 0:Le.slice(Ge+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){be||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){be=!0,u+=2;continue}if(st==="--replace"||Le.startsWith("-i")&&Le.length>2){let at=st==="--replace"?it:Le.slice(2);be||=at!==""&&at!=="{}",u++;continue}if(Le==="-a"||Ww.has(st)){be=!0,u+=it===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){X=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){Q=!0,u++;continue}if(st==="--env"){be=!0,u+=it===void 0?2:1;continue}if(Yp.has(st)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=Yp.has(Le)?2:1;continue}if(Fw.has(st)){be=!0;let at=it??We;if(at===void 0||at===":::"||at==="--"){u++;continue}le=at,u+=it===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&it!==void 0){u++;continue}if(Lw.has(Le)){if(We===void 0||We===":::"||We==="--"){be=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}be||=v.some(ue?Wc:dg);let De=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let Ge=n[We];if(Ge===":::"){De.push(Le),Le=[];continue}if(Ge!==void 0)Le.push(Ge)}De.push(Le)}be||=De.length>1;let Ie=Kw(De),Oe=v.some(jt),Ne=v.length===0&&z===-1;return{template:v,jobs:Ie,childStart:W,templateHasPlaceholder:Oe,runsRemotely:B,quotesCommand:X,usesStdin:Q||z===-1,readsCommandsFromInput:Ne,unsupported:be,workdir:le,dryRun:ue}}function Kw(n){if(n.length===0||n.some((v)=>v.length===0))return[];let u=[[]];for(let[v,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let X of u)X.push(B);if(u.length*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let X of W){if((z.length+1)*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,X])}u=z}return u}function fg(n){return mg(n).childStart}var qw="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ma="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Gc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function Fc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function gg(n,u,v,W,z=!1,B){let Q=(ni(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&ln(B,"shell.dynamic-executable",z)?lt("shell.dynamic-executable",qw):null;return Tt(Q,B)??hg(n,u,v,z,B)}function hg(n,u,v,W,z){if(u.length<2)return null;let B=u.flatMap((Q,le)=>Gc(Q)?[le]:[]);if(B.length===0)return null;let X=$t(u[0]?.text??"");if(X==="git"){let Q=ce(n,u),le=Zw(Q);if(ln(z,"shell.dynamic-structure",W)&&B.some((De)=>De<=le))return Tt(lt("shell.dynamic-structure",ma),z);if(Tt(na(Q,{environment:v}),z))return null;let ue=u[le]?.text.toLowerCase(),be=Q.findIndex((De,Ie)=>Ie>le&&t(De)==="--");if(ln(z,"shell.dynamic-structure",W)&&ue&&wo.has(ue)&&B.some((De)=>De>le&&(be===-1||De<be)))return Tt(lt("shell.dynamic-structure",ma),z);return null}if(X==="find")return ln(z,"shell.dynamic-structure",W)&&Xw(u)?Tt(lt("shell.dynamic-structure",ma),z):null;if(X==="rm"){let Q=u.findIndex((ue,be)=>be>0&&t(ue)==="--"),le=mr(u.map(t));return ln(z,"shell.dynamic-structure",W)&&B.some((ue)=>(Q===-1||ue<Q)&&(ue<u.length-1||!le))?Tt(lt("shell.dynamic-structure",ma),z):null}if(X==="xargs")return pg(n,u.slice(Jr(u.map(t)).childStart),"xargs",v,W,z);if(X==="parallel")return pg(n,u.slice(fg(u.map(t))),"parallel",v,W,z);return null}function pg(n,u,v,W,z,B){if(u.length===0)return null;let X=Yw(u,W);if(ni(n,X)){let le=Tt(lt(`${v}.shell-dynamic`,v==="xargs"?Dc:Oi),B);if(le)return le}let Q=hg(n,X,W,z,B);if(Q)return Q;if(X[0]?.text==="rm"&&X.slice(1).some((le)=>Gc(le)&&Fc(le)))return Tt(lt(`${v}.rm-recursive-force-dynamic`,v==="xargs"?Mc:ki),B);return null}function Yw(n,u){let v=cr(n,u),W=v.rewritten?en(v.words.map(t)):v.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function Zw(n){let u=1;while(u<n.length){let v=n[u],W=v?t(v):"";if(Pn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function Xw(n){let u=!1,v=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let X=n[B];if(!X)continue;let Q=Gc(X);if(v>0){v--;continue}if(z){if(X.text===";"||X.text==="+"){z=!1,u=!0,W=!1;continue}if(Q&&(W||Fc(X)))return!0;W=!1;continue}if(!u&&!X.text.startsWith("-")){if(Q&&(B>1||Fc(X)))return!0;continue}if(u=!0,Q)return!0;let le=fr(X.text);if(le>0){v=le;continue}if(nr(X.text))z=!0,W=!0}return!1}function zc(n,u){return n.some((v)=>{if(v.value==="-"&&(v.kind==="main-script"||v.kind==="program-file"))return!0;return!po(u[v.tokenIndex],v.value)})}var yg="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Jw="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Qw="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",eA="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",tA="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",nA="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",rA={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:eA},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:Qw},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:nA},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:yg},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:Jw},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:yg}},oA=/^\/\/?[ck]$/i,Sg=/[&|]+/,iA=/(?:"[^"]*"|[^\s"])+/g,sA=/[\^%!]/,aA=/\\"./s,lA=/(^|\/)[*.]*\*[*.]*$/,cA=/^"?[\\/]+[?.][\\/]/,dA=new Set(["rmdir","rd","del","erase"]),uA=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,mA=/\/s(?!\w)/i,fA=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Cg(n,u){let v=n.map(t),W=v.findIndex((Ie)=>oA.test(Ie));if(W===-1)return null;let z=v.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,X=B.split(Sg).map((Ie)=>{let Oe=Ie.match(iA)??[],Ne=Oe.findIndex((We)=>dA.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Oe.slice(Ne);return{piece:Ie,tokens:Oe,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),Q=X.filter((Ie)=>Ie.recursiveDelete),le=Q.length>0||uA.test(B)&&mA.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((Ie)=>aA.test(Ie))||Q.some((Ie)=>Ie.tokens.some((Oe)=>cA.test(Oe)))))return lt("cmd.recursive-delete-escaped-quote",tA);let ue=Fn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),be=X.reduce((Ie,Oe)=>Ie??(Oe.recursiveDelete?pA(Oe.deleteTokens,ue,u.policy):u.analyzeNested(Oe.piece)),null),De=le&&(Q.length===0||sA.test(B)||fA.test(B)||B.includes('"')&&Sg.test(B));return be??(De?xr():null)}function pA(n,u,v){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??Tt(Vr(Sn(Ei(z.replaceAll('"',"")).replace(lA,"$1*"),u),u,v,rA),v),null)}var gA="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",hA=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,yA=/^-(?:executionpolicy|ep)$/i,SA=/^-(?:command|c)$/i,CA=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,bA="encodedcommand",vA=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,EA=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,RA=/[$`]/,_A="--%";function bg(n,u){let v=n.map(t),W=v.every((B,X)=>X===0||B!==_A&&xA(n[X],B))?Bc(v):void 0;if(W!==void 0)return u(W);if(v.some(wA))return xr();let z=v.join(" ");return vA.test(z)&&EA.test(z)?lt("powershell.nested-recursive-delete-unread",gA):null}function Bc(n){let u=$c(n,1),v=u===void 0?[]:n.slice(u+1);return v.length>0?v.join(" "):void 0}function $c(n,u){let v=n[u]??"";if(SA.test(v))return u;if(hA.test(v))return $c(n,u+1);return yA.test(v)?$c(n,u+2):void 0}function xA(n,u){return n?.provenance==="unknown"?!RA.test(u):po(n,u)}function wA(n){let u=CA.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||bA.startsWith(u))}var AA="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",PA="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",TA=/[efBMT@]/,IA=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function vg(n,u){let v=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],be=ue?t(ue):"";if(B++,!ue)continue;if(z||be==="-"||!be.startsWith("-")){v.push(ue);continue}if(be==="--"){z=!0;continue}if(be.startsWith("--")){if(W||=be==="--del"||be.startsWith("--dele"),!be.includes("=")&&IA.has(be.slice(2)))B++;continue}if(be.slice(1).search(TA)===be.length-2)B++}let X=v.slice(1).filter((ue)=>!kA(t(ue)));if(!W||X.length===0)return null;let Q=Fn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=X.flatMap((ue)=>{let be=Kr(ue);return(be.expandedTargets??[t(ue)]).map((De)=>Sn(De,Q,{targetIsLiteral:be.expandedTargets!==void 0||be.targetIsLiteral,tmpdirWordSplittingProtected:be.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return lt("rm.recursive-force-root-or-home",PA);if(le.includes("git_metadata_target"))return lt("rm.git-metadata",y);if(Bs(X,u))return null;return Tt(lt("rsync.delete",AA),u.policy)}function kA(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Rg=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>oa(n.words,fa(n))},{heads:new Set(["cmd"]),analyze:(n)=>Cg(n.words,{...fa(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Tr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>bg(n.parsedWords,(u)=>Tr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>na(n.words,Uc(n))},{heads:new Set(["find"]),analyze:(n)=>Qf(n.words,{...fa(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>vg(n.words,{...fa(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>zp(n.words,{...Eg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Tr(n.options.analyzeNested(u,v))})},{heads:new Set(["parallel"]),analyze:(n)=>eg(n.words,{...Eg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Tr(n.options.analyzeNested(u,v))})}];function Eg(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Tr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function fa(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Br(n.envAssignments,n.options.environment),trustedTmpdirValue:yo(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function Uc(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function Ag(n){return Rg.find((u)=>u.heads.has(n))?.analyze}function Mo(n,u,v){let W=v.trace;if(n.length===0)return null;let z=v.commandView?.dialect??"posix",B=(ut)=>ut.map((Gt)=>z==="posix"?t(Gt):Gt.text),X=v.child,Q=X!==void 0&&!X.embedded,le=X?.embedded===!0,ue=v.effectiveCwd===null,be=X?X.cwd:ue?void 0:v.effectiveCwd??v.cwd,De=X?X.originalCwd:ue?void 0:v.cwd,Ie=_e(n);if(Ie.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...Ie.envAssignments.keys()],output:B(Ie.words)});let Oe=cr(Ie.words,v.environment,be,new Map([...v.envAssignments??[],...Ie.envAssignments])),Ne=Oe.envSplitValues??[];if(Ne.length>0){let ut=[...Ne,...B(Oe.words)].join(" "),Gt=Ln(ut);if(Gt)return W?.recordSegment({type:"dangerous-text",token:ut,matched:!0,reason:Gt.reason}),Cn(Gt);if(v.strict)return hn(W);let Vt=Is(Ne,B(Oe.words));if(Vt){v.budget.charge("derivedTokens",Vt.length);let fn=v.analyzeNested(Vt.join(" "),{effectiveCwd:Oe.cwd===void 0?v.effectiveCwd:Oe.cwd,envAssignments:new Map([...v.envAssignments??[],...Ie.envAssignments,...Oe.envAssignments])});if(fn)return fn}}let Le=Oe.rewritten?en(B(Oe.words)):ce(z,Oe.words),We=B(Le),Ge={...v,wrapperNormalizationBudget:v.wrapperNormalizationBudget??{iterations:0}};if(W&&Ie.words.length>Le.length){let ut=B(Ie.words);W.recordSegment({type:"leading-tokens-stripped",input:ut,removed:ut.slice(0,ut.length-Le.length),output:We})}let st=new Map([...v.envAssignments??[],...Ie.envAssignments,...Oe.envAssignments]),it=We[0];if(!it)return null;if(qr(it))throw new a("wrapperPeelIterations");let at=$t(it),Et=Oe.cwd===null?void 0:Oe.cwd??be,Rt=Oe.cwd===null?void 0:De,Wt=Oe.cwd===void 0?v.effectiveCwd:Oe.cwd,Be=Oe.cwd===void 0?v.effectiveCwd:null,Ft=X?X.allowTmpdirVar:!mi(st,v.environment),kt=gg(z,Oe.words,v.environment,u===0,v.strict,v.policy);if(kt)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:kt.reason}),Cn(kt);let tn=qs(We,v.policy);if(tn){for(let ut of[tn.childIndex,...tn.alternativeChildIndices]){xg(Ge.wrapperNormalizationBudget);let Gt=Le.slice(ut);W?.recordSegment({type:"transparent-wrapper",wrapper:tn.wrapper,output:B(Gt)});let Vt=Mo(Gt,u,{...Ge,effectiveCwd:Wt,envAssignments:st});if(Vt)return Vt}return null}let vn=le?void 0:at==="eval"?ia(Le):at==="trap"&&!Q?kp(Le):void 0;if(Q&&X&&at==="eval"){if(vn?.kind==="dynamic")return Oo(X,v.policy);if(vn?.kind==="literal"){let ut=v.analyzeNested(vn.source,{effectiveCwd:Wt,envAssignments:st});if(ut)return ut}return Do(X,v.policy)}if(vn?.kind==="dynamic"&&(v.strict||!v.commandView||!kc(v.commandView)))return hn(W);if(vn?.kind==="literal"){W?.recordSegment({type:"recurse",reason:at==="eval"?"shell-eval":"shell-trap",innerCommand:vn.source,depth:u+1});let ut=v.analyzeNested(vn.source,{effectiveCwd:Wt,envAssignments:st,functionDefinitions:v.functionDefinitions});if(ut)return ut}if(Q?nn.has(at):Tg(it,at)){if(Yn(We))return null;if(Xs(We))return hn(W);if(Q&&X){let ut=Gn(We);if(ut){if(X.dynamicSourceInput??X.dynamicInput){let Vt=Oo(X,v.policy);if(Vt)return Vt}if(Ii(ut)){let Vt=Oo(X,v.policy);if(Vt)return Vt}return v.analyzeNested(ut,{effectiveCwd:Wt,envAssignments:st})}let Gt=pr(Le);if(Gt.kind==="dynamic")return Oo(X,v.policy);if(Gt.kind==="literal")return X.dynamicSourceInput?Oo(X,v.policy):null;return X.dynamicSourceInput??X.dynamicInput?Oo(X,v.policy):null}if(le){let ut=Gn(We),Gt=ut?v.analyzeNested(ut,{effectiveCwd:Wt,envAssignments:st}):pr(Le).kind==="dynamic"?hn(W):null;if(Gt)return Gt}if(X===void 0){let ut=NA(We,st,Wt,v,W,u);if(ut)return ut;let Gt=Gn(We);if(Gt){let Go=Rn(We).commandIndex,zo=Go===null?void 0:Le[Go];if(zo&&v.commandView&&Np(zo,v.commandView.nested,v.environment))return hn(W);let Pa=sa(Le,Gt);if(Pa.kind==="dynamic")return hn(W);let Ta=Pa.kind==="literal"?Pa.source:Op(Le,Gt),pd=FA(Ta);W?.recordSegment({type:"shell-wrapper",wrapper:at,innerCommand:pd}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:pd,depth:u+1});let gd=v.analyzeNested(Ta,{effectiveCwd:Wt,envAssignments:st});if(gd)return gd;return Ii(Ta)?hn(W):null}let Vt=pr(Le,v.environment.home,v.strict?void 0:Ao(v.shellAssignments??new Map,{home:v.environment.home,cwd:Be}));if(Vt.kind==="dynamic")return hn(W);if(Vt.kind==="literal")return Mi(Vt.source,Wt,st,v,W,u);let fn=Mp(Le,v.commandView?.redirections??[],v.hasPipelineInput??!1,v.literalShellInput);if(fn.kind==="dynamic")return hn(W);if(fn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:fn.source,depth:u+1}),v.analyzeNested(fn.source,{effectiveCwd:Wt,envAssignments:st})}}if(!X&&(at==="source"||at===".")){let ut=We[1]==="-p"?2:null;if(ut!==null){let zo=v.commandView?Le[ut]:void 0;if(!zo)return null;if(zo.provenance!=="literal")return hn(W)}let Gt=ut===null?1:3,Vt=We[Gt]==="--"?Gt+1:Gt,fn=v.commandView?Le[Vt]:void 0;if(!fn)return null;let Go=_g(fn,v,Be);if(Go!==null)return Mi(Go,Wt,st,v,W,u);if(v.strict||!v.commandView||!kc(v.commandView))return hn(W)}let Yt=Le[0];if(!X&&Yt&&it.includes("/")&&v.literalHeredocFiles?.size){let ut=_g(Yt,v,Be),Gt=ut===null?null:Mi(ut,Wt,st,v,W,u,!1,!0);if(Gt)return Gt}if(Nn.has(at)&&!le){if(!X&&v.strict&&zc(_i(We),Le))return hn(W);let ut=jf(We,(Vt)=>Tr(v.analyzeNested(Vt,{effectiveCwd:Wt,envAssignments:st}))),Gt=Tt(ut,v.policy);if(Gt)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Gt.reason}),Cn(Gt)}if(Hn(at)&&!le){if(!X&&v.strict&&zc(Us(We),Le))return hn(W);let ut=Of(We);if(Q&&X)return MA(at,ut,Wt,st,v,X);if(ut){let Gt=ln(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:at,codeArg:ut,paranoidBlocked:Gt}),Gt){let fn=Tt(lt("interpreter.one-liner-paranoid",bi),v.policy);if(fn)return Cn(fn)}if(ic(at,ut))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:ut,depth:u+1});let Vt=v.analyzeNested(ut,{effectiveCwd:Wt,envAssignments:st});if(Vt&&!Pg(Vt,ut))return Vt;if(vi(ut,void 0,!v.strict)){let fn=Tt(lt("interpreter.dangerous-command",Ro),v.policy);if(fn)return W?.recordSegment({type:"dangerous-text",token:ut,matched:!0,reason:Ro}),Cn(fn)}W=void 0}}if(at==="busybox"&&We.length>1)return xg(Ge.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),Mo(Le.slice(1),u,{...Ge,effectiveCwd:Wt,envAssignments:st});let yn=X?null:Tt(Fm(at,We),v.policy);if(yn)return W?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:yn.reason}),Cn(yn);let Qt=W===Ge.trace?Ge:{...Ge,trace:W},on={words:Le,parsedWords:Oe.words,head:at,cwd:Et,originalCwd:Rt,envAssignments:st,allowTmpdirVar:Ft,dynamicArguments:Oe.words.some((ut)=>ut.provenance==="command-substitution"),depth:u,effectiveCwd:Wt,options:Qt,analyzeChildTokens:(ut,Gt)=>Q&&X?jc(ut,u,Qt,{...X,cwd:Gt??void 0,effectiveCwd:Gt??void 0}):Tr(Mo(en(ut),u+1,{...Qt,child:void 0,commandView:void 0,effectiveCwd:Gt,envAssignments:st}))??F(ut,Qt.policy.rules),analyzeChild:(ut,Gt)=>jc(ut,u,Qt,Gt)},kn=X&&(at==="xargs"||at==="parallel")?void 0:Ag(at);if(at==="rm"||at==="xargs"||at==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:st.has("TMPDIR")||v.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ft});let Bn=W&&at==="git"?Rp(on.words,Uc(on)):void 0,hr=wg(Bn?Bn.match:kn?.(on)??null,v.policy);if(W)GA(on,hr,Bn?.relaxation??null);if(hr)return Cn(hr);if(Q&&X&&(at==="rm"||at==="rmdir")){if(!(at==="rm"&&(mr(We)||X.dynamicRmInput)))return null;return(X.dynamicRmInput?Do(X,v.policy):null)??DA(X,v.policy)}let wa=kn!==void 0&&!$A.has(at),Jn=!X&&!wa&&!es.has(at),Aa=W&&Jn?[]:void 0;if(Jn)for(let ut=1;ut<We.length;ut++){let Gt=We[ut];if(!Gt)continue;Aa?.push(Gt);let Vt=wg(OA(We,ut,u,Qt,Et,Rt,Wt,st),v.policy);if(Vt)return W?.recordSegment({type:"fallback-scan",tokensScanned:Aa??[],embeddedCommandFound:$t(Gt)}),Cn(Vt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:Aa??[]}),le&&X&&!X.wrappedByTransparent)return null;let zi=F(We,v.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:v.policy.rules.length>0,matched:!!zi,reason:zi?.reason}),zi)return Cn(zi);return Q&&X?Do(X,v.policy):null}function jc(n,u,v,W){return Tr(Mo(en(n),u+1,{...v,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function OA(n,u,v,W,z,B,X,Q){for(let le of qn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:Q,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let be=$t(ue);if(Tg(ue,be)||Ag(be)!==void 0&&be!=="xargs"&&be!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let Ie=jc(le.tokens,v,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?X:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!mi(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(Ie)return Ie}return null}function MA(n,u,v,W,z,B){if(!u)return Do(B,z.policy);if(ln(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let Q=Tt(lt("interpreter.one-liner-paranoid",bi),z.policy);if(Q)return Cn(Q)}if(ic(n,u))return Do(B,z.policy);let X=z.analyzeNested(u,{effectiveCwd:v,envAssignments:W});if(X&&!Pg(X,u))return X;if(vi(u,void 0,!z.strict)){let Q=Tt(lt("interpreter.dangerous-command",Ro),z.policy);if(Q)return Cn(Q)}return Do(B,z.policy)}function Pg(n,u){let v=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(Ws)||n.reason===tr)&&!ts(u);return v||W}function Oo(n,u){let v=n.shellDynamicMatch?Tt(n.shellDynamicMatch,u):null;return v?Cn(v):null}function Do(n,u){let v=n.dynamicSourceInput&&n.dynamicSourceMatch?Tt(n.dynamicSourceMatch,u):null;return v?Cn(v):null}function DA(n,u){let v=n.dynamicInput&&n.rmDynamicMatch?Tt(n.rmDynamicMatch,u):null;return v?Cn(v):null}function NA(n,u,v,W,z,B){let X=Jf(n);if(X.argvSource?.kind==="absent")return hn(z);if(X.argvSourceApplies&&X.argvSource){let le=Mi(X.argvSource.value,v,u,W,z,B,!0);if(le)return le}if(!X.envSourceApplies||!X.envName)return null;let Q=u.get(X.envName);if(!Q)return null;return Mi(Q,v,u,W,z,B,!0)}function _g(n,u,v){let W=u.environment.home,z=Po(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Zn(n,Ao(u.shellAssignments??new Map,{home:W,cwd:v}))}var LA=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function Mi(n,u,v,W,z,B,X=!1,Q=!1){if(X&&/[$`*?[\]]/.test(n))return hn(z);let le=ui(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0)return X?hn(z):null;if(Q&&ue.startsWith("#!")&&!LA.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!Q)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v});let be=WA(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v}));return be?.intent==="stop_and_explain"?null:be}function WA(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function FA(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function GA(n,u,v){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!v,reason:u?.reason??v?.originalReason}),v)n.options.trace?.recordSegment({type:v.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:v.originalReason,gitCwd:v.gitCwd})}function xg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Cn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function hn(n){return n?.recordSegment({type:"error",message:Si}),Cn(xr())}function Tg(n,u){return nn.has(u)||n==="$SHELL"||n==="${SHELL}"||nn.has(zt(u))}function wg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Tt(n,u)}var zA=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,$A=new Set(["powershell","pwsh"]),BA=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function UA(n,u){let v=Og(n,u);if(v.length===0)return!1;let W=v[kg(v)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return zA.test(n.join(" "))}function Ig(n,u,v,W,z){if(n.dialect==="powershell"){let it=HA(n.words,z);if(it.kind==="none")return;if(!u||it.kind==="unknown")return null;return Hc(qA(it.target),u,v.paths)}let B=n.words.map(t),X=B.some((it)=>/^CDPATH\+?=/.test(it));if(!UA(B,v))return X?null:void 0;if(!u)return null;let Q=Og(B,v,u),le=kg(Q);if(le===-1||Q[le]!=="cd")return null;let ue=Q.slice(le+1),be=ue.findIndex((it)=>it.length<=1||!it.startsWith("-")||it==="--");if((be===-1?ue:ue.slice(0,be)).some((it)=>!/^-[LP]+$/.test(it)))return null;let Ie=be===-1?[]:ue.slice(be),Oe=Ie[0]==="--"?Ie.slice(1):Ie;if(Oe.length>1)return null;let Ne=Oe[0],Le=W.get("HOME")||v.home;if(Ne===void 0)return Hc(pn(Le),u,v.paths);let We=n.words.find((it)=>it.provenance==="variable"&&it.text===Ne),Ge=n.words.find((it)=>it.text===Ne&&/^~(?:\/|$)/.test(it.raw)),st=We?Zn(We,new Map([...W,["HOME",Le]])):Ge?`${Le}${Ne.slice(1)}`:Ne;if(st===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(st)&&(X||v.env.has("CDPATH")))return null;return Hc(pn(st),u,v.paths)}function Hc(n,u,v){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=vr(u,n,v);return v.isDirectory(W)?W:null}catch{return null}}function HA(n,u){let v=jA(n[0])?1:0,W=n[v];if(!VA(W,v===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!BA.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return KA(n.slice(v+1),u)}function jA(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function VA(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function KA(n,u){let v;for(let W of n){if(W.provenance!=="literal"||v!==void 0)return{kind:"unknown"};v=W.text}if(v!==void 0)return{kind:"target",target:v};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function qA(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function kg(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let v=u+1;while(n[v]?.startsWith("-"))v++;return v}function Og(n,u,v){let W=YA(n);return Er([...W],u,v)}function YA(n){let u=0;while(u<n.length){let v=n[u];if(v!=="{"&&v!=="("&&v!=="$(")break;u++}return n.slice(u)}var nP="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Qr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Xc(n,u,v,W){if(u>=l.recursionDepth.cap)return v.trace?.recordSegment({type:"error",message:Qn}),{reason:Qn,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??v.factStore?.getCommandProgram(n,v.shell??"auto")??C(n,v.shell);if(z.status==="limited")return v.trace?.recordSegment({type:"error",message:Qn}),{reason:Qn,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let ue=z.issues.find((be)=>be.code.includes("heredoc"));if(ue){if(!v.strict)return Zc(n,v);let be=`${Ws}: ${ue.message}`;return v.trace?.recordGlobal({type:"error",message:be}),{reason:be,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return Gg(n,v),{reason:tr,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(v.strict&&z.status==="partial")return Gg(n,v),{reason:tr,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((ue)=>ue.code.includes("quote")))return Zc(n,v);let X=v.cwd,Q=v.effectiveCwd!==void 0?v.effectiveCwd:v.cwd,le=up(v.environment.env,v.envAssignments);return ha(z,u,{...v,rootProgram:z},X,[{effectiveCwd:Q,shellGitContextState:le,literalHeredocFiles:new Map(v.literalHeredocFiles),functionDefinitions:new Map(v.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function ha(n,u,v,W,z){let B=[...z],X,Q,le;for(let[ue,be]of n.nodes.entries()){if(be.kind==="connector"){Q=be.operator;continue}let De=n.nodes[ue+1],Ie=De?.kind==="connector"?De.operator:void 0,Oe=rP(n,ue,be,Q,Ie),Le=Q==="&&"||Q==="||"?X:void 0,We=Q==="&&"?Le?.success??B:Q==="||"?Le?.failure??B:B,Ge=Q==="||"?Le?.success??[]:[],st=Q==="&&"?Le?.failure??[]:[],it={connector:Q,skippedSuccessStates:Ge,skippedFailureStates:st};if(Ir(Ie)&&!Ir(Q))le=it;let at=Ir(Ie)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Ir(Q)?le??it:it,Et=eo(at.connector)||eo(Ie);if(be.kind==="function"){let Jt=We.flatMap((yn)=>{let Qt=to(yn);return Qt.functionDefinitions.set(be.name,be.body),Vc(yn,[Qt],Oe,Ie==="&",eo(Ie))}),Yt=Kc(Jt,[],at.skippedSuccessStates,at.skippedFailureStates,at.connector,Ie);B=Yt.states,X=Yt.conditionalStates,Q=void 0;continue}if(be.kind==="group"){let Jt=[],Yt=[];for(let Qt of We){let on=ha(be.body,u,v,W,[to(Qt)]);if(on.result)return on;if(Jt.push(...Vc(Qt,on.states,Oe,Ie==="&",eo(Ie))),Et)Yt.push(Qt,...Oe?on.states.map((kn)=>pa(Qt,kn)):on.states)}let yn=Kc(Jt,Yt,at.skippedSuccessStates,at.skippedFailureStates,at.connector,Ie);B=yn.states,X=yn.conditionalStates,Q=void 0;continue}if(be.kind!=="command")continue;let Rt=PP(n.nodes[ue-1]),Wt=v.trace?.flattenNested?v.trace.currentSegmentIndex:v.trace?.allocateSegment(),Be=n.nodes[ue-2],Ft=Ir(Q)&&Be?.kind==="command"?Ip(Be)??iP(Be):void 0,kt=[],tn=[];for(let Jt of We){let Yt=sP(be,u,v,W,[to(Jt)]);if(Yt.result)return{result:Yt.result,states:B};let yn=n.dialect==="powershell"?Yt.states:Yt.states.map((Qt)=>pa(Jt,Qt));for(let Qt of yn){let on=to(Qt),kn=cP(be,u,v.trace?{...v,trace:zg(v.trace,Wt)}:v,W,on,Ir(Q),Ft);if(kn)return{result:kn,states:B};let Bn=NP(be,on.functionDefinitions);if(Bn)v.budget.charge("derivedTokens",ya(Bn));let hr=Bn?u+1>=l.recursionDepth.cap?qc(be.displayText,v,[on]):ha(Bn,u+1,v,W,[on]):{result:null,states:MP(be,on).flatMap((Jn)=>TP(be,Qt,Jn,Rt))};if(hr.result)return hr;kt.push(...Vc(Jt,hr.states,Oe,Ie==="&",eo(Ie)));let wa=typeof on.effectiveCwd==="string"&&on.effectiveCwd!==Qt.effectiveCwd&&be.redirections.every((Jn)=>["<",">",">>",">|"].includes(Jn.operator)&&Jn.target?.text==="/dev/null");if(Et&&(Rt||!wa))tn.push(Jt),tn.push(...hr.states.map((Jn)=>Oe?pa(Jt,Jn):Jn))}}let vn=Kc(kt,tn,at.skippedSuccessStates,at.skippedFailureStates,at.connector,Ie);B=vn.states,X=vn.conditionalStates,Q=void 0}return{result:null,states:B}}function rP(n,u,v,W,z){if(v.kind==="group"&&v.style==="subshell")return!0;if(n.dialect==="posix"&&(Ir(W)||Ir(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&v.kind==="group"&&v.style==="brace"&&oP(n,u)}function Vc(n,u,v,W,z){let B=v?u.map((Q)=>pa(n,Q)):[...u],X=z?B.flatMap((Q)=>No(n.literalHeredocFiles,Q.literalHeredocFiles)?[Q]:[{...Q,literalHeredocFiles:new Map(n.literalHeredocFiles)},Q]):B;return W?[n,...X]:X}function pa(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function oP(n,u){let v=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!v||v.kind!=="command")return!0;let W=v.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(aP(v))return!0;return v.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Ir(n){return n==="|"||n==="|&"}function iP(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function eo(n){return n==="&&"||n==="||"}function Kc(n,u,v,W,z,B){let X={success:ga([...v,...n]),failure:ga([...W,...u])},Q=eo(B)?X:void 0;return{states:eo(z)||Q?ga([...X.success,...X.failure]):X.success,conditionalStates:Q}}function zg(n,u,v=n.flattenNested){return{currentSegmentIndex:u,flattenNested:v,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function sP(n,u,v,W,z){let B=n.nested.map((X)=>({program:X,depth:u}));if(n.dialect==="powershell"){let X=lP(n);if(X){if(u+1>=l.recursionDepth.cap)return qc(X,v,z);let Q=C(X,"powershell");if(Q.status==="limited")return qc(X,v,z);if(Q.status!=="complete")return Mg(B,v,W,z);v.budget.charge("derivedTokens",ya(Q)),B.push({program:Q,depth:u+1})}}return Mg(B,v,W,z)}function aP(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function Mg(n,u,v,W){let z=[...W];for(let B of n){let X=[];for(let Q of z){let le=ha(B.program,B.depth,u,v,[to(Q)]);if(le.result)return le;X.push(...le.states)}z=ga(X)}return{result:null,states:z}}function lP(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),v=u?1:0,W=n.words[v];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(v+1),B=z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?1:0,X=z[B];return z.length===B+1&&X?.quoted&&X.provenance==="literal"?X.text:void 0}function ya(n){return n.nodes.reduce((u,v)=>u+(v.kind==="command"?v.words.length+v.nested.reduce((W,z)=>W+ya(z),0):v.kind==="group"||v.kind==="function"?ya(v.body):0),0)}function qc(n,u,v){return u.trace?.recordSegment({type:"error",message:Qn}),{result:{reason:Qn,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...v]}}function cP(n,u,v,W,z,B,X){let Q={...v,environment:{...v.environment,env:z.shellGitContextState.env,paths:hP(v.environment.paths,z.createdDirectories,v.budget)}},le=EP(n,!Q.strict);if(le&&Q.strict)return Q.trace?.recordSegment({type:"error",message:le}),{reason:le,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};$g(n,z,"before-consumer",Q.environment.paths,Q.budget);let ue=ce(n.dialect,n.words),be=ue.map(t),De=n.displayText,Ie=cp(ue,z.shellGitContextState,{home:Q.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:Q.environment.darwinUserTempDir}),Oe=fp(Ie,z.shellGitContextState);if(n.dialect==="powershell"){let Ge=Tt(Ff(n,B,LP(Q,z.effectiveCwd)),Q.policy);if(Q.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!Ge,reason:Ge?.reason}),Ge)return Fg(De,Ge)}let Ne=Tt(Gm(n.redirections),Q.policy);if(Ne)return Q.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Ne.reason}),Fg(De,Ne);if(be.length===1&&be[0]?.includes(" ")&&!ni(n.dialect,n.words)){let Ge=Tt(Ln(be[0]),Q.policy),st=Ge!==null&&!Q.strict&&Dm(n,Q.rootProgram);if(Ge&&!st)return Q.trace?.recordSegment({type:"dangerous-text",token:be[0],matched:!0,reason:Ge.reason}),{reason:Ge.reason,segment:De,ruleId:Ge.id,intent:Ge.intent};Q.trace?.recordSegment({type:"dangerous-text",token:be[0],matched:!1});let it=Dg(n,le,z,Oe,X,Q);if(it)return it;return xc(Ie,z.shellGitContextState),null}let Le=Mo(n.words,u,{...Q,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Oe,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:X,analyzeNested:(Ge,st)=>{let it=st&&Object.hasOwn(st,"effectiveCwd")?st.effectiveCwd:z.effectiveCwd,at=Xc(Ge,u+1,{...Q,effectiveCwd:it,envAssignments:st?.envAssignments??Oe,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:st?.functionDefinitions,worktreeMode:st?.worktreeMode??Q.worktreeMode,shell:st?.shell??Q.shell,trace:Q.trace?zg(Q.trace,Q.trace.currentSegmentIndex,!0):void 0});return at?{reason:at.reason,ruleId:at.ruleId,intent:at.intent}:null}});if(Le)return{...Le,segment:De};let We=Dg(n,le,z,Oe,X,Q);if(We)return We;return xc(Ie,z.shellGitContextState),null}function Dg(n,u,v,W,z,B){let X=RP(n,u,v,W??new Map,B);if(X)return X;if($g(n,v,"after-consumer",B.environment.paths,B.budget),!mP(n))v.literalHeredocFiles.clear();return pP(n,u,v,B.environment.paths,B.budget,B.environment.home),yP(n,v,B.environment.paths,B.budget,B.environment.home),wP(n,v,z,B.environment,B.trace),null}var dP=new Set([">>","<>"]),uP=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function mP(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>uP.test(u.raw))}function $g(n,u,v,W,z){for(let X of n.redirections){if(!(v==="before-consumer"?fP(X):dP.has(X.operator)))continue;Ng(X.target,u,W,z)}if(v!=="before-consumer"||!mn(n.words[0],"tee"))return;let B=Ug(n.words.slice(1));if(!B)return;for(let X of B.operands)Ng(X,u,W,z)}function fP(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function Ng(n,u,v,W){let z=n?.provenance==="literal"?ui(n.text,u.effectiveCwd,v,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function pP(n,u,v,W,z,B){if(u)return;let X=n.redirections.find((Q)=>Q.operator==="<<"||Q.operator==="<<-")?.heredoc;if(!X)return;for(let Q of gP(n,Ao(v.shellGitContextState.shellAssignments,{home:B,cwd:v.effectiveCwd}),B)){let le=ui(Q,v.effectiveCwd,W,z);if(!le||!$m(le))continue;if(!v.literalHeredocFiles.has(le)&&v.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");v.literalHeredocFiles.set(le,X.body)}}function gP(n,u,v){let W=Yc(bP(n.redirections)?.target,u,v),z=W===void 0?[]:[W];if(mn(n.words[0],"cat"))return CP(n.words)?z:[];if(!mn(n.words[0],"tee"))return[];let B=Ug(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let X=B.operands.map((Q)=>Yc(Q,u,v));if(!X.every((Q)=>Q!==void 0))return[];return[...X,...z]}function Yc(n,u,v){if(vP(n))return n.text;if(!n)return;return Po(n,v)??Zn(n,u)??void 0}function hP(n,u,v){if(u.size===0)return n;let W=(z)=>{let B=Ut(z,n,v);return[...u].some((X)=>X===B||X.startsWith(`${B}${tP}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?Ut(z,n,v):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function yP(n,u,v,W,z){if(u.shellGitContextState.bodyDepth>0||!mn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((be)=>Yc(be,u.shellGitContextState.shellAssignments,z));if(!B.every((be)=>be!==void 0))return;let X=B.findIndex((be)=>be==="--"||be==="-"||!be.startsWith("-")),Q=B.slice(0,X);if(X===-1||!Q.every((be)=>/^(?:-[pv]+|--parents|--verbose)$/.test(be)))return;let le=Q.some((be)=>be==="--parents"||/^-v*p/.test(be)),ue=u.effectiveCwd;for(let be of B.slice(B[X]==="--"?X+1:X)){if(be.split(/[\\/]/).includes("..")||!XA(be)&&!ue)continue;let De=Ut(eP(ue??"",be),v,W);if(le?SP(De,v):v.isDirectory(ZA(De))&&Bg(De,v))u.createdDirectories.add(De)}}function SP(n,u){let v=QA(n).root,W=n.slice(v.length).split(/[\\/]+/).filter(Boolean),z=(X)=>JA(v,...W.slice(0,X+1)),B=W.findIndex((X,Q)=>!u.isDirectory(z(Q)));return B===-1||Bg(z(B),u)}function Bg(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function CP(n){let u=!1;for(let v of n.slice(1)){if(u||v.provenance!=="literal")return!1;if(v.text==="--"){u=!0;continue}if(!/^-u+$/.test(v.text))return!1}return!0}function bP(n){let u=n.findLast((v)=>(v.fd??([">",">|",">>",">&"].includes(v.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function Ug(n,u=new Map){let v=[],W=!0,z=!1,B=!1;for(let X of n){if(X.provenance!=="literal"&&Zn(X,u)===null)return;if(W&&mn(X,"--")){W=!1;continue}if(W&&!X.quoted&&X.raw===X.text&&/^-[^-]/.test(X.text)){z||=X.text.slice(1).includes("a"),B||=Array.from(X.text.slice(1)).some((Q)=>Q!=="a"&&Q!=="i");continue}if(W&&!X.quoted&&X.raw===X.text&&X.text.startsWith("--")){z||=X.text==="--append",B||=X.text!=="--append"&&X.text!=="--ignore-interrupts";continue}v.push(X)}return{operands:v,append:z,hasUnsupportedOptions:B}}function vP(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function mn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function Jc(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function EP(n,u){let v=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(v.length===0)return;if(v.length!==1)return Qr;let W=v[0];if(!W?.heredoc)return Qr;let z=/\$\(|`/.test(W.heredoc.body);if(!Jc(W.heredoc)&&(!u||z))return nP;if(W.fd!==void 0&&W.fd!==0)return Qr;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return Qr;let B=n.redirections.some((le)=>le!==W&&Lg(le.target));if(mn(n.words[0],"cat"))return B?Qr:void 0;if(mn(n.words[0],"tee"))return B||n.words.slice(1).some(Lg)?Qr:void 0;let X=n.words[0],Q=n.words[1];if(mn(X,"git")&&(mn(Q,"apply")||mn(Q,"commit")))return;if(mn(X,"gh")&&(mn(Q,"pr")||mn(Q,"issue"))&&mn(n.words[2],"create"))return;return Qr}function Lg(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function RP(n,u,v,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),X=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(xP(n,B,v,W,z))return null;let Q=_P(n,B,z);if(Q!==void 0)return Q?{reason:Q.reason,segment:n.displayText,ruleId:Q.id,intent:Q.intent}:null;let le=Zc(X.length===B.length?X.join(`
-`):n.source,z);return le?{...le,segment:n.displayText}:null}function _P(n,u,v){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!Jc(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=mn(n.words[0],"uv")&&mn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!Hn(B.text))return;let X=z.findIndex((De)=>mn(De,"-"));if(!z.slice(1,X===-1?void 0:X).every((De)=>De.provenance==="literal"&&De.text.startsWith("-")))return;let le=W.heredoc.body,ue=ln(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(v.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let De=Tt(lt("interpreter.one-liner-paranoid",bi),v.policy);if(De)return De}if(!vi(le,void 0,!v.strict))return null;let be=Tt(lt("interpreter.dangerous-command",Ro),v.policy);if(!be)return null;return v.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:be.reason}),be}function xP(n,u,v,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!Jc(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let X=cr(n.words,z.environment,v.effectiveCwd,W),Q=X.words.map(t),le=$t(Q[0]??"");if((X.envSplitValues?.length??0)>0||!nn.has(le)&&!nn.has(zt(le)))return!1;return Yn(Q)}function wP(n,u,v,W,z){let B=Ig(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,v);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var AP=new Set(["fi","done","esac"]);function PP(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function TP(n,u,v,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,X=v.shellGitContextState.bodyDepth,Q=v.compoundBodies;if(X>B)return v.compoundBodies=[...Q.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:Q[B]?.branchCwds??[],hasElse:!1}],[v];let le=B>0?Q[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return v.compoundBodies=[...Q.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,v.effectiveCwd],hasElse:z==="else"}],v.effectiveCwd=le.entryCwd,[v];let ue=le!==void 0&&AP.has(z);if(ue)v.compoundBodies=Q.slice(0,X);return[...new Set([v.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((De)=>{if(De===v.effectiveCwd)return v;let Ie=to(v);return Ie.effectiveCwd=De,Ie})}function IP(n,u){return n.length===u.length&&n.every((v,W)=>{let z=u[W];return z!==void 0&&v.entryCwd===z.entryCwd&&v.hasElse===z.hasElse&&v.branchCwds.length===z.branchCwds.length&&v.branchCwds.every((B,X)=>B===z.branchCwds[X])})}var kP=/^[A-Za-z_][A-Za-z0-9_]*$/,OP=8;function MP(n,u){let v=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||v===void 0||!kP.test(v))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=OP&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(v),[u];return W.map((B)=>{let X=to(u);return X.shellGitContextState.shellAssignments.set(v,B.text),X})}function to(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:mp(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function ga(n){let u=[];for(let v of n){if(!u.some((W)=>DP(W,v)))u.push(v);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function DP(n,u){return n.effectiveCwd===u.effectiveCwd&&IP(n.compoundBodies,u.compoundBodies)&&No(n.shellGitContextState.env,u.shellGitContextState.env)&&No(n.literalHeredocFiles,u.literalHeredocFiles)&&No(n.functionDefinitions,u.functionDefinitions)&&No(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&No(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&Wg(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&Wg(n.createdDirectories,u.createdDirectories)}function Wg(n,u){return n.size===u.size&&[...n].every((v)=>u.has(v))}function No(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([v,W])=>u.get(v)===W&&u.has(v))}function NP(n,u){let v=ri(n);return v===void 0?void 0:u.get(v)}function Fg(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function LP(n,u=n.effectiveCwd){let v=u===null;return{environment:n.environment,cwd:v?void 0:u??n.cwd,originalCwd:v?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function Zc(n,u){let v=Tt(Ln(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!v,reason:v?.reason};if(u.trace?.recordSegment(z,W),!v&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return v?{reason:v.reason,segment:n,ruleId:v.id,intent:v.intent}:null}function Gg(n,u){let v={type:"strict-unparseable",rawCommand:n,reason:tr},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(v);if(W!==void 0)u.trace?.recordSegment(v)}var WP=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Hg(n,u,v,W){let z=Xc(n,0,{...u,...nt(u),budget:u.budget??On(),factStore:W},v);if(!z)return null;return{kind:"deny",reason:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function jg(n,u,v){try{return{decision:n()}}catch(W){let z=FP(W,u,v);if(!z)throw W;return z}}function FP(n,u,v){if(!(n instanceof a)||!WP.has(n.kind))return null;let W=l[n.kind];if(v?.currentSegmentIndex!==void 0)v.recordSegment({type:"error",message:W.reason});if(v?.currentSegmentIndex===void 0)v?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var GP=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),ed=new Set(["cc-safety-net","ccsn"]),zP=new Set(["bunx","npx","pnpx"]),$P=new Set(["pnpm","yarn"]),BP=new Set(["npm","pnpm","yarn"]),UP=new Set(["bun","node"]);function Ca(n,u,v={}){if(ed.has(n))return 0;if(zP.has(n)){if(v.broad)return Qc(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return Sa(u[z])?z+1:null}let W=v.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&BP.has(n)&&v.broad&&u[W]==="exec"){let z=Qc(u.slice(W+1));return z===null?null:W+1+z}if($P.has(n)){if(n==="yarn"&&!v.broad)return null;if(!v.broad)return u[0]==="dlx"&&Sa(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=Qc(u.slice(W+1));return z===null?null:W+1+z}if(UP.has(n)){let z=v.broad&&W!==-1?W:0;if(Vg(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&Vg(u[z+1]))return z+2}return null}function Qc(n){let u=n.findIndex((W)=>Sa(W));if(u===-1)return null;let v=u;while(v<n.length){let W=n[v]??"";if(!W.startsWith("-")&&!Sa(W))break;v++}return v}function Sa(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return ed.has(n);if(u===0)return!1;let v=n.slice(u+1);if(v===""||v.includes("/")||v.includes(":"))return!1;return ed.has(n.slice(0,u))}function Vg(n){let u=n?.replaceAll("\\","/");return[...GP].some((v)=>u===v||u?.endsWith(`/${v}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Kg(n,u,v){let W=dr(n);if(!W)return null;let z=Eo(W.shell,n.invocation.context.executionCwd,u,v,{findSegmentTarget:(B)=>HP(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function HP(n,u){let v=Er([...n],u),W=v.slice(1),z=Ca(zt(v[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((X)=>X!=="-g"&&X!=="--global");return B[0]==="policy"&&B[1]==="apply"?v.join(" "):null}import{dirname as ba}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",jP=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Xg(n,u,v){let W=XP(n.invocation.context,u,v);if(n.invocation.route.kind==="patch")return qg(n.paths,!1,n.invocation.context.executionCwd,W,u,v);let z=dr(n);if(n.invocation.route.kind==="command")return z?Yg(z.shell,n.invocation.context.executionCwd,W,u,v):null;if(n.invocation.route.kind==="unknown"&&z){let B=Yg(z.shell,n.invocation.context.executionCwd,W,u,v);if(B)return B}return qg(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||ji(n.invocation.toolName),n.invocation.context.executionCwd,W,u,v)}function qg(n,u,v,W,z,B){if(u)return null;let X=n.find((Q)=>Di(Q,v,W,z,B));return X?{target:X}:null}function Yg(n,u,v,W,z){let B=Eo(n,u,W,z,{findSegmentTarget:(X,Q)=>VP(X,Q,v,W,z)?.target??null,isRedirectionTarget:(X,Q)=>Di(X,Q.cwd,v,W,z),findMalformedTarget:(X)=>ZP(X,u,v,W,z)?.target??null});return B?{target:B}:null}function VP(n,u,v,W,z){if(yi(n))return null;let B=Rr([...n],W),X=zt(B[0]??"").toLowerCase(),Q=B.slice(1);if(X==="rm"&&KP(Q)){let le=qP(Q).find((ue)=>Zg(xn(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(X==="find"){if(Js(B,1)||gc(B,W)){let ue=(xi(en(B))??en(["."])).find((be)=>{let De=xn(be.text,u.variables);return Di(De,u.cwd,v,W,z)||Zg(De,u.cwd,v,W,z)})?.text;if(ue)return{target:ue}}}if(X==="mv"){let le=Fs(Q).sources.find((ue)=>JP(xn(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(YP(B,X))return null;for(let le of[...n,...B])for(let ue of Jg(le))if(Di(xn(ue,u.variables),u.cwd,v,W,z))return{target:ue};return null}function KP(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function qP(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((v)=>!v.startsWith("-")),...n.slice(u+1)];return n.filter((v)=>!v.startsWith("-"))}function YP(n,u){if(!jP.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((v)=>v.startsWith("-i")||v==="--in-place"||v.startsWith("--in-place="))}function ZP(n,u,v,W,z){for(let B of n.split(/\s+/))for(let X of Jg(B))if(Di(X,u,v,W,z))return{target:X};return null}function Jg(n){let u=n.trim().replace(/^['"]|['"]$/g,""),v=u.indexOf("=");return v===-1||v===u.length-1?[u]:[u,u.slice(v+1)]}function XP(n,u,v){let W=(Q)=>Ni(gn(Q,n.executionCwd,u,v)),z=W(p(u)),B=[W(S(n.executionCwd)),W(S(n.configCwd))],X=new Set(B.map((Q)=>ba(Q)));for(let Q=ba(z);;Q=ba(Q))if(X.add(Q),ba(Q)===Q)break;return{files:new Set([z,...B]),directoriesAndAncestors:X}}function Di(n,u,v,W,z){let B=vd(n,u,W,z,(X)=>Ni(X)===Ji);return B!==null&&v.files.has(Ni(B))}function Zg(n,u,v,W,z){return v.directoriesAndAncestors.has(Ni(gn(n,u,W,z)))}function JP(n,u,v,W,z){let B=Ni(gn(n,u,W,z));return v.files.has(B)||v.directoriesAndAncestors.has(B)}function Ni(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as va,posix as mh,resolve as xa,win32 as QP}from"node:path";import{fileURLToPath as eT}from"node:url";var fh="Access to a sensitive path is not allowed.",ph=new Set(["echo","printf"]),tT=new Set(["find"]),nT=new Set(["!","do","elif","else","if","then","until","while"]),rT=new Set(["-exec","-execdir"]),oT=new Set([";","+"]),iT=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),sT=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),gh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),aT=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),lT=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),id=new Set(["-c","-e","-r","-E","--eval","--exec"]),cT=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),sd=new Set(["grep","rg"]),hh=new Set(["files-with-matches","files-without-match","count","quiet"]),dT=new Set([...hh,"ignore-case","fixed-strings","hidden"]),uT=new Set(["wc",...sd]),mT=new Set(["cd","grep","head","openssl","tail","tailscale"]),fT=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,pT=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),gT=new Set(["commit","merge","notes","stash","tag"]),hT=new Set(["-m","--message"]),yT=new Set(["--grep"]),ST=new Set(["powershell","pwsh"]),Qg=new Set(["jq","gojq","jaq"]),eh="f",th="file",CT="files",bT=new Set(["e","f"]),vT=new Set(["regexp","file"]),ET=new Set(["e","f","A","B","C","m"]),RT=new Set(["regexp","file","after-context","before-context","context","max-count"]),td="__CC_SAFETY_NET_PIPE_INPUT__",rd=/[\w./~@+-]*[./~][\w./~@+-]*/g,_T=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,xT=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,wT=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,nh=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,rh=/\b(?:system|exec|spawn|popen)\s*$/,AT=/\b(?:eval|exec)\s*\(/g,PT=/\b(?:eval|exec)\s*$/,TT=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function oh(n,u,v,W,z,B){for(let X of n){let Q=X.target;if(qI(Q,X.cwd,u?.denyPaths??[],v,W,z))return{target:Q,ruleId:"secret.deny-path"};if(B&&!B.has(Q))continue;let le=VI(Q,X.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(Ih(Q,X.cwd,W,z)))continue;if(ue&&B?.get(Q)==="data")continue;if(ue&&(X.isRedirectionWriteTarget===!0||B?.get(Q)==="write")&&!Q.includes("$")&&!_a(Q,X.cwd,W,z))continue;if(ue&&(X.isCreatedPath===!0||X.isCertificateInput===!0))continue;if(ue&&/\s/.test(Q)&&!Q.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Q)&&!_a(Q,X.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&YI(Q,X.cwd,u?.allowPaths??[],v,W,z))continue;return{target:Q,ruleId:le}}}return null}function yh(n,u,v,W,z={}){let B=ih(n,v,W),X=oh(B,u,n.invocation.context.configCwd,v,W);if(X===null||X.ruleId==="secret.deny-path"||z.strict!==!1)return X;let Q=ih(n,v,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;Q.forEach((Ne)=>Sh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),be=Q.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),De=new Set(be.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),Ie=new Set(be.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Oe=oh(B,u,n.invocation.context.configCwd,v,W,new Map(be.map((Ne)=>[Ne.target,De.has(Ne.target)?"path":Ie.has(Ne.target)?"write":"data"])));return Oe?.ruleId!=="secret.deny-path"&&IT(n,v)?null:Oe}function IT(n,u){let v=dr(n);if(!v)return!1;if(v.program.nodes.some((X)=>X.kind==="command"&&X.nested.length>0))return!1;let W=[];for(let X of Ls(v.shell)){if(X.kind==="operator"&&X.boundary)return!1;if(X.kind==="redirection")return!1;if(X.kind==="operator")continue;W.push(ur(X.text,u))}let z=rr(W);if(z.length===0)return!1;let B=bn(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return v.program.dialect==="powershell"&&(B==="ls"||B==="stat");return ad(B,z.slice(1))}function ad(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((v)=>!v.startsWith("-")||fT.test(v));if(sd.has(n))return kT(n,u);if(n!=="find")return!1;return!u.some((v)=>iT.has(v))}function kT(n,u){let v=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(v.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),X=(ue)=>{let be=v[ue-1]??"";return/^--[^=]+$/.test(be)&&!dT.has(be.slice(2))||B(be)&&be.slice(1).search(W)===be.length-2},Q=v.findIndex((ue,be)=>!ue.startsWith("-")&&!X(be));return(n==="grep"&&Q>=0?v.slice(0,Q):v).some((ue,be)=>{if(X(be))return!1;if(ue.startsWith("--"))return hh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function ih(n,u,v,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((Q)=>({target:Q,cwd:z}));let X=dr(n);return[...X?Fo(X.shell,n.store,W,u,z,v,OT(X)):[],...B==="unknown"?n.paths.map((Q)=>({target:Q,cwd:z})):[]]}function OT(n){return n.program.dialect==="powershell"}function Fo(n,u,v,W,z,B,X=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let Q=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...TI(ur(n.source,W),u,v,W,z,B)],le=(We)=>ur(HT(We,X),W),ue=/[<>=]\(/.test(n.source),be=/\bcoproc\b|\|&/.test(n.source),De=[],Ie=[],Oe=(We)=>({...v,commandHoldsPipe:v.commandHoldsPipe===!0||We||be});Ns(n,z,W,B,{word:le,segment:(We,Ge,st,it,at,Et)=>{if(We.length===0)return null;let Rt=Oe(Et);if(Rt.commandHoldsPipe)De.push(...We);if(Ie.push(bn(Ch(rr(We))[0]??"").toLowerCase()),Q.push(...Wi(We,u,ue||it==="|"||it==="|&"?{...Rt,segmentMayFeedReader:!0}:Rt,W,Ge.cwd,B,at)),st!==null)Q.push(...NT(st,We,u,Rt,W,Ge.cwd,B));return null},redirection:(We,Ge,st)=>{if(We.body!==void 0&&We.consumer!==void 0){let it=Oe(st);Q.push(...bh(We.consumer,[We.body],u,it,W,Ge.cwd,B,(at)=>LT(We.consumer??[],at,u,it,W,Ge.cwd,B)))}if(We.targetOrder==="legacy-segment")return Yl;return Q.push({target:le(We.target),cwd:Ge.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(De.flatMap(Sh)),Le=ue||/\$\(|`/.test(n.source)||!Ie.every((We)=>mT.has(We));return Q.map(({loopVariable:We,...Ge})=>{if(Ge.certificateOutputMayFeedReader===!0&&Le)return{target:Ge.target,cwd:Ge.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?Ge:{...Ge,loopVariable:We}})}function Sh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function Ea(n,u,v,W,z,B,X=!1){let Q=u.getShellSyntax(n,X?u.getCommandProgram(n,"powershell"):void 0);if(Q.status==="structural-limit")throw new E;return Q.status==="complete"?Fo(Q,u,v,W,z,B,X):null}function Wi(n,u,v,W,z,B,X){let Q=(Be)=>({target:Be,cwd:z}),le=n.findIndex((Be)=>!nT.has(Be));if(v.skipMetadataOnlySegments===!0&&le>0)return Wi(n.slice(le),u,v,W,z,B,new Set([...X??[]].map((Be)=>Be-le)));let ue=n[1]??"";if(v.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((Be)=>$n("for",Be)).map((Be)=>({...Q(Be),loopVariable:ue}));if(X?.size){let Be=n.filter((Ft,kt)=>!X.has(kt));if(Qg.has(bn(rr(Be)[0]??"").toLowerCase()))return[...n.filter((Ft,kt)=>X.has(kt)).map(Q),...Wi(Be,u,v,W,z,B)]}let be=UT(n).map(Q),De=rr(n);if(De.length===0)return be;let Ie=De[0]??"",Oe=bn(Ie).toLowerCase(),Ne=De.slice(1),Le=v.segmentMayFeedReader===!0||v.commandHoldsPipe===!0||v.displayOperandsAreCapturedOutput===!0,We=Le&&uT.has(Oe);if(v.skipMetadataOnlySegments===!0&&!We&&ad(Oe,Ne))return be;let Ge=DT(Ie,Oe,Ne);if(Ge)return[...be,...Ge.map(Q)];if(ph.has(Oe))return v.displayOperandsAreCapturedOutput===!0?[...be,...vh(n).map(Q)]:be;if(Oe==="eval")return[...be,...Ea(Ne.join(" "),u,v,W,z,B)??Ne.map(Q)];let st=ST.has($t(Ie))?Bc(De):void 0;if(st!==void 0)B.charge("derivedTokens",De.length);let it=st===void 0?null:Ea(st,u,v,W,z,B,!0);if(it?.length)return[...be,...it];if(Oe==="export")return[...be,...Ne.flatMap((Be)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(Be)?[Be.slice(Be.indexOf("=")+1)]:$n(Oe,Be)).map(Q)];if(Oe==="git")return[...be,...VT(Ne).map(Q)];if(Oe==="gh")return[...be,...od(Oe,Ne,pT).map(Q)];if(Qg.has(Oe))return[...be,...jT(Ne).map(Q)];if(sd.has(Oe))return[...be,...WI(Ne).map(Q)];if(tT.has(Oe))return[...be,...qT(Ne,u,v,W,z,B).map(Q)];if(Oe==="mkdir"||Oe==="touch"){let Be=new Set(n.filter((kt,tn)=>X?.has(tn))),Ft=v.segmentMayFeedReader!==!0&&!(Oe==="touch"&&Ne.some((kt)=>/^(?:--r|-[^-]*r)/.test(kt)));return[...be,...Ne.flatMap((kt)=>$n(Oe,kt).map((tn)=>Ft&&!kt.startsWith("-")&&!Be.has(kt)?{...Q(tn),isCreatedPath:!0}:Q(tn)))]}if(Nn.has(Oe))return[...be,...Ne.flatMap((Be)=>$n("awk",Be)).map(Q),...Ne.flatMap((Be)=>ZT(Be,u,v,W,z,B)),...Ne.flatMap(XT).map(Q)];if(Oe==="curl")return[...be,...Ne.filter((Be,Ft)=>Rh(Be)===null&&Eh(Ne[Ft-1])===null).flatMap((Be)=>$n(Oe,Be)).map(Q),...KT(Ne).map(Q)];if(bo(Oe)){let Be=hi.has(Oe)?Rn([Oe,...Ne]):null;if(Be!==null&&Be.command!==null&&Be.commandIndex!==null){let Ft=u.getShellSyntax(Be.command);if(Ft.status==="structural-limit")throw new E;if(Ft.status==="complete")return[...be,...Fo(Ft,u,v,W,z,B),...Ne.slice(Be.commandIndex).filter((kt)=>!kt.startsWith("-")).map(Q)]}return[...be,...YT(Oe,Ne,u,v,W,z,B)]}let at=(Be,Ft)=>new RegExp(`^--?${Be}=`).test(Ne[Ft]??"")||new RegExp(`^--?${Be}$`).test(Ne[Ft-1]??""),Et=MT(De),Rt=Oe==="openssl"&&Ne[0]==="x509",Wt=Le?{certificateOutputMayFeedReader:!0}:{};return[...be,...Ne.flatMap((Be,Ft)=>$n(Oe,Be).map((kt)=>Et&&at("(?:cert|key)-file",Ft)?{...Q(kt),isCreatedPath:!0,...Wt}:Rt&&at("in",Ft)?{...Q(kt),isCertificateInput:!0,...Wt}:Q(kt)))]}function Ch(n){return bn(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function MT(n){let u=Ch(n);return bn(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function DT(n,u,v){let W=Ca(u,v);if(W===null||v[W]!=="explain")return null;let z=[n,...v.slice(0,W)],B=v.slice(W+1);for(let X=0;X<B.length;X++){let Q=B[X];if(Q==="--json"||Q==="--help"||Q==="-h")continue;if(Q==="--cwd"){let le=B[X+1];if(le&&!le.startsWith("--"))z.push(le);X++;continue}return z}return z}function NT(n,u,v,W,z,B,X){if(zT(u,v,W,z,B,X)){let Q=rr(n),le=ad(bn(Q[0]??"").toLowerCase(),Q.slice(1))?Q.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...vh(n),...le].map((ue)=>({target:ue,cwd:B}))}return bh(u,WT(n),v,W,z,B,X,()=>[])}function LT(n,u,v,W,z,B,X){let Q=rr(n);if(!bo(bn(Q[0]??"").toLowerCase()))return[];return Ea(u,v,W,z,B,X)??[{target:u,cwd:B}]}function bh(n,u,v,W,z,B,X,Q){let le=$T(n);if(le===null)return u.flatMap(Q);return u.flatMap((ue)=>hi.has(le)?Fo(v.getShellSyntax(ue),v,W,z,B,X):Ra(le,ue,v,W,z,B,X))}function vh(n){let u=rr(n);if(u.length===0)return[];let v=bn(u[0]??"").toLowerCase();if(!ph.has(v))return[];let W=u[u[1]==="--"?2:1];if(v==="printf"&&W!==void 0&&!W.startsWith("-")&&!W.replaceAll("%%","").includes("%"))return[ld(W.replaceAll("%%","%"))];return u.slice(1)}function WT(n){let u=rr(n);if(u.length===0)return[];let v=bn(u[0]??"").toLowerCase(),W=u.slice(1);if(v==="echo"){let z=W.findIndex((B)=>!/^-[neE]+$/.test(B));return[(z===-1?[]:W.slice(z)).join(" ")]}if(v==="printf")return FT(W);return[]}function FT(n){let u=n[0];if(u===void 0)return[];let v=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(v===0||n.length===1)return[ld(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/v)},(z,B)=>GT(u,W.slice(B*v,(B+1)*v)))}function GT(n,u){let v=0;return ld(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[v]??"";return v++,z}))}function ld(n){return n.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function zT(n,u,v,W,z,B){let X=rr(n);if(X.length===0||bn(X[0]??"").toLowerCase()!=="xargs")return!1;let Q=Jr(X),le=X.slice(Q.childStart);if(le.length===0)return!1;if(Q.replacementToken==="")return!1;let ue=Q.replacementToken,be=ue===null?[...le,td]:le.map((De)=>De.split(ue).join(td));return Wi(be,u,v,W,z,B).some((De)=>De.target.includes(td))}function $T(n){let u=rr(n);if(u.length===0)return null;let v=bn(u[0]??"").toLowerCase();if(!bo(v))return null;return BT(v,u.slice(1))?v:null}function BT(n,u){let v=cd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(id.has(z)||_h(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(v==="python"&&z==="-m")return!1;if(TT.get(v)?.has(z))W++;continue}return!1}return!0}function cd(n){return/^python\d/.test(n)?"python":n}function UT(n){let u=[];for(let v of n){if(Th(v))continue;let W=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(v);if(W===null)break;if(W[1]!==void 0&&W[1]!=="")u.push(W[1])}return u}var sh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function HT(n,u){if(!u||!sh.test(n))return n;return`~${n.replace(sh,"").replace(/\\/g,"/")}`}function $n(n,u){if(u==="--")return[];let v=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))v.push(u.slice(W+1));if(u.startsWith("-"))return v;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return v;if(n==="zip"&&/\.zip$/i.test(u))return v;return v.push(u),v}function jT(n){let u=-1,v=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!v&&z==="--"){v=!0;continue}if(v||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>$n("jq",B))}return n.flatMap((W,z)=>z===u?[]:$n("jq",W))}function VT(n){let u=[];for(let v=0;v<n.length;v++){let W=n[v]??"";if(W==="--"||!W.startsWith("-"))return[...u,...gT.has(W)?od("git",n.slice(v).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),hT):od("git",n.slice(v),yT)];if(u.push(...$n("git",W)),!Pn.has(W))continue;let z=n[v+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:$n("git",z)),v++}return u}function od(n,u,v){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((X)=>$n(n,X))];if(v.has(B)){z++;continue}if(B.includes("=")&&v.has(B.slice(0,B.indexOf("="))))continue;W.push(...$n(n,B))}return W}function KT(n){return n.flatMap((u,v)=>{let W=Rh(u);if(W!==null)return ah(W.flag,W.value);let z=Eh(n[v-1]);return z===null?[]:ah(z,u)})}function ah(n,u){if(n==="-F"||n==="--form"){let v=u.indexOf("="),W=v===-1?u:u.slice(v+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return nd(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let v=u.indexOf("@"),W=u.indexOf("=");if(v===-1||W!==-1&&W<v)return[];return nd(u.slice(v+1))}return u.startsWith("@")?nd(u.slice(1)):[]}function Eh(n){if(n===void 0)return null;if(gh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function Rh(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let v=n.indexOf("=");if(v===-1)return null;let W=n.slice(0,v);return gh.has(W)?{flag:W,value:n.slice(v+1)}:null}function nd(n){return n===""||n==="-"?[]:[n]}function qT(n,u,v,W,z,B){let X=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),Q=[...n.slice(0,X===-1?n.length:X),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!rT.has(n[le]??""))continue;let ue=n.slice(le+1),be=ue.findIndex((Oe)=>oT.has(Oe)),De=be===-1?ue:ue.slice(0,be),Ie=Wi(De,u,v,W,z,B).map((Oe)=>Oe.target);if(Q.push(...Ie.filter((Oe)=>Oe!=="{}")),!Ie.includes("{}"))continue;Q.push(...n.slice(0,le).flatMap((Oe,Ne,Le)=>{if(!sT.has(Oe))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Q}function YT(n,u,v,W,z,B,X){let Q=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(id.has(ue)||_h(n,ue)){let De=u[le+1];if(De!==void 0)Q.push(...Ra(n,De,v,W,z,B,X)),le++;continue}let be=/^--(?:eval|exec)=(.*)$/.exec(ue);if(be!==null&&be[1]!==void 0){Q.push(...Ra(n,be[1],v,W,z,B,X));continue}if(!ue.startsWith("-"))Q.push({target:ue,cwd:B})}return Q}function _h(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return cT.get(u[u.length-1]??"")?.has(cd(n))??!1}function ZT(n,u,v,W,z,B){if(!n.includes("system"))return[];return uc(n)?.commands.flatMap((X)=>Fo(u.getShellSyntax(X),u,v,W,z,B))??[]}function XT(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function JT(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((v)=>v[2]).filter((v)=>v!==void 0&&v!=="");return[...u,...u.flatMap(ud),...n.match(rd)??[]]}function Ra(n,u,v,W,z,B,X){let Q=(Be)=>({target:Be,cwd:B}),le=vI(n),ue=RI(u,le);if(ue.kind==="unmaskable")return JT(u).map(Q);let be=ue.masked.match(nh)!==null||ue.literals.some((Be)=>rh.test(ue.masked.slice(0,Be.start))),De=ue.masked.match(AT)!==null||ue.literals.some((Be)=>PT.test(ue.masked.slice(0,Be.start))),Ie=W.inlineLiteralsPresumedData===!0&&!hi.has(n),Oe=Ie&&(le==="python"||le==="javascript"),Ne=Ie&&!(PI(ue.masked)||be||De)?[]:ue.literals,Le=Ie?Array.from(ue.masked.matchAll(nh),(Be)=>{let Ft=Be.index+Be[0].length;return{start:Ft,end:js(ue.masked,Ft)}}):[],We=!Ie||Le.some((Be)=>ac(ue.masked,Be.start)&&!sI(ue,Be.start))?ue.literals:ue.literals.filter((Be)=>rh.test(ue.masked.slice(0,Be.start))||Le.some((Ft)=>Be.start>=Ft.start&&Be.start<Ft.end)),Ge=new Set(be?We:[]),st=Oe&&Ne.length>0&&!nI(ue.masked,le==="python"?"#":"//"),it=st?aI(ue.masked):[],at=st?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(Be)=>({name:Be[0],index:Be.index})):[],Et=oI(at),Rt=!rI(ue.masked,at),Wt=at.filter((Be)=>!lh(ue.masked,{start:Be.index,text:Be.name,tokenStart:Be.index,tokenEnd:Be.index+Be.name.length},it,Et,Rt)).reduce((Be,Ft)=>{let kt=Be.get(Ft.name)??[];return kt.push(Ft.index),Be.set(Ft.name,kt)},new Map);return[...Ne.filter((Be)=>Be.text!=="").map((Be)=>{if(!st||Ge.has(Be))return Q(Be.text);if(lh(ue.masked,Be,it,Et,Rt)||lI(ue.masked,Be,it,Wt))return{...Q(Be.text),literalRole:"data"};return SI(ue,Be,it)?{...Q(Be.text),literalRole:"write"}:Q(Be.text)}),...Ne.flatMap((Be)=>ud(Be.text)).map(Q),...Ie?[]:ue.literals.flatMap((Be)=>Be.text.match(rd)??[]).map(Q),...be?We.flatMap((Be)=>Ea(Be.text,v,{...W,commandHoldsPipe:!0},z,B,X)??[Q(Be.text)]):[],...De?ue.literals.flatMap((Be)=>Ra(n,Be.text.replace(/\\(.)/g,(Ft,kt)=>kt==="n"?`
-`:kt),v,W,z,B,X)):[],...Oe?[]:[ue.masked,...ue.comments].flatMap((Be)=>Be.match(rd)??[]).map(Q),...Ie?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Q):[]]}var dd={"(":")","[":"]","{":"}"},xh="and|elif|else|if|in|is|not|of|or|return|while|yield",QT=new RegExp(`(?:^|[^\\w$])(?:${xh})$`),eI=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${xh})\\s*\\(|/\\*`),tI=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function nI(n,u){return eI.test(n)||n.split(`
-`).some((v)=>{let W=v.indexOf(u);return W>=0&&/[()[\]{}]/.test(v.slice(W))})}function rI(n,u){return uI.test(n)||u.some((v)=>{let W=dI.get(v.name),z=v.index+v.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function oI(n){return n.some((u)=>Ah(u.name).some((v)=>tI.test(v)))}var iI=new Set(["cmd","powershell","pwsh"]);function sI(n,u){let v=no(n.masked,u),W=dd[n.masked[v]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,v+1),B=n.masked.slice(v+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(no(n.masked,z+1)))&&!n.literals.some((X)=>X.tokenStart>v&&X.tokenStart<z&&(id.has(X.text)||bo(bn(X.text).toLowerCase())||iI.has(bn(X.text).toLowerCase().replace(/\.exe$/,""))))}function aI(n){let u=[];return n.split("").map((v,W)=>{let z=u.at(-1)??-1;if(v in dd)u.push(W);if(v===")"||v==="]"||v==="}")u.pop();return z})}function lh(n,u,v,W,z){let B=v[u.tokenStart]??-1,X=n[B]??"",Q=Wo(n,u.tokenStart),le=no(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,Q-3),Q+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(X==="["||X==="("))return!1;let ue=n[Q],be=n[le];if(X==="{"&&ue===":")return CI(n,Q);let De=(ue===X||ue===",")&&(be===","||be===dd[X]||X==="{"&&be===":");if(X!=="(")return De&&X!=="";return De&&(z&&cI.test(n.slice(Math.max(0,B-20),B))||(ue===","||be===",")&&bI(n,B))}function lI(n,u,v,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
-`:""}${n.slice(z,u.tokenStart)}`,X=mI.exec(B)?.[1],Q=n[v[u.tokenStart]??-1];if(X===void 0||Q==="("||Q==="[")return!1;let le=no(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(X);return(W.get(X)??[]).every((be)=>be===ue)}var cI=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,dI=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),uI=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,mI=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,fI=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,pI=/^\s*\.\s*write_(?:text|bytes)\s*\(/,gI=/(?:^|[^\w$.])open\s*$/,hI=/^[bt]*[awx][abtwx]*$/,yI=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function SI(n,u,v){let W=v[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Wo(n.masked,u.tokenStart),B=no(n.masked,u.tokenEnd),X=n.masked[B],Q=n.masked.slice(Math.max(0,W-40),W);if(fI.test(Q))return(z===W||n.masked[z]===",")&&(X===","||X===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&pI.test(n.masked.slice(js(n.masked,W+1)+1));if(z!==W||X!==",")return!1;if(yI.test(Q))return!0;if(!gI.test(Q))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&hI.test(le.text)&&/^[,)]/.test(n.masked.slice(no(n.masked,le.tokenEnd)))}function CI(n,u){let v=Wo(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,v-63),v+1))?.[0]??"",z=n[Wo(n,v+1-W.length)];return z==="{"||z===","}function bI(n,u){let v=Wo(n,u),W=n.slice(Math.max(0,v-7),v+1);return!/[\w$)\]]$/.test(W)||QT.test(W)}function vI(n){let u=cd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var EI={python:"#",javascript:"/"};function RI(n,u){if(u==="opaque")return{kind:"unmaskable"};let v={masked:n.split(""),literals:[],comments:[]};return wh(n,0,u,v,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:v.masked.join(""),literals:v.literals,comments:v.comments}}function wh(n,u,v,W,z){let B=0;for(let X=u;X<n.length;X++){let Q=n[X]??"";if(z&&Q==="}"&&B===0)return X;if(z&&Q===EI[v])return null;if(v==="python"&&Q==="#"){let Le=n.slice(X).search(/[\r\n]/),We=Le===-1?n.length:X+Le;W.comments.push(n.slice(X,We)),W.masked.fill(" ",X,We),X=We-1;continue}if(Q==="{")B++;if(Q==="}")B--;if(v==="simple"&&(Q==="`"||Q==="%"||Q==="<")){if(xT.test(n.slice(X)))return null}let le=Q==="'"||Q==='"'||v==="javascript"&&Q==="`"?Q:null;if(le===null)continue;if(le==="`"&&AI(n,X))return null;let ue=v==="python"?xI(n,X):"",be=v==="python"&&n.startsWith(le.repeat(3),X)?le.repeat(3):le,De=X+be.length,Ie=le==="`"||/[fF]/.test(ue),Oe=X-ue.length,Ne=Ie?_I(n,Oe,De,be,v,W):wI(n,De,be);if(Ne===null)return null;if(!Ie){let Le=n.slice(De,Ne);if(v==="simple"&&le==='"'&&wT.test(Le))return null;W.literals.push({start:De,text:Le,tokenStart:Oe,tokenEnd:Ne+be.length}),W.masked.fill(" ",De,Ne)}W.masked.fill(" ",X,De),W.masked.fill(" ",Ne,Ne+be.length),X=Ne+be.length-1}return z?null:n.length}function _I(n,u,v,W,z,B){let X=z==="python"?"{":"${",Q=W==="`"||W.length===3,le="";for(let ue=v;ue<n.length;ue++){let be=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:v,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!Q&&(be===`
-`||be==="\r"))return null;let De=z==="python"&&(be==="{"||be==="}")&&n[ue+1]===be;if(!De&&n.startsWith(X,ue)){let Ne=wh(n,ue+X.length,z,B,!0);if(Ne===null)return null;le+=`${X}}`,B.masked.fill(" ",ue,ue+X.length),B.masked[Ne]=" ",ue=Ne;continue}let Oe=be==="\\"&&!(z==="python"&&n[ue+1]==="{")||De?2:1;le+=n.slice(ue,ue+Oe),B.masked.fill(" ",ue,ue+Oe),ue+=Oe-1}return null}function xI(n,u){return _T.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function wI(n,u,v){let W=v.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
-`||B==="\r"))return null;if(n.startsWith(v,z))return z}return null}function AI(n,u){for(let v=u-1;v>=0;v--){let W=n[v];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function PI(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let v=u[0],W=u.index;if(aT.has(v.toLowerCase()))return!0;let z=Ah(v);if(!z.some((B)=>lT.has(B)))continue;if(z.length>1)return!0;if(n[Wo(n,W)]===".")return!0;if(n[no(n,W+v.length)]==="(")return!0}return!1}function Ah(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Wo(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function no(n,u){for(let v=u;v<n.length;v++)if(!/\s/.test(n[v]??""))return v;return n.length}function TI(n,u,v,W,z,B){return DI(n).flatMap((X)=>{let Q=u.getShellSyntax(X);if(Q.status==="invalid")return[];return[...Fo(Q,u,{...v,displayOperandsAreCapturedOutput:!0},W,z,B),...II(Q,W)?kI(Q,W).map((le)=>({target:le,cwd:z})):[]]})}function II(n,u){let v=Ls(n);for(let W=0;W<v.length;W++){let z=v[W];if(z?.kind!=="word"||bn(ur(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<v.length;B++){let X=v[B];if(X?.kind==="operator")break;if(X?.kind!=="word")continue;let Q=ur(X.text,u);if(Q==="--decode"||!Q.startsWith("--")&&Q.startsWith("-")&&/[dD]/.test(Q))return!0}}return!1}function kI(n,u){return Ls(n).flatMap((v)=>v.kind==="word"?[ur(v.text,u)]:v.kind==="redirection"&&v.target?[ur(v.target,u)]:[]).flatMap(ud)}function ud(n){let u=MI(n);if(u===null)return[];let v=Buffer.from(u,"base64").toString("utf8");if(v===""||OI(v))return[];return Buffer.from(v,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[v]:[]}function OI(n){return Array.from(n).some((u)=>{let v=u.charCodeAt(0);return v<32||v===127})}function MI(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function DI(n){let u=[],v={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(Xo(z,v))continue;if(Ph(n,W,v)){let B=NI(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!v.inSingle&&z==="`"){let B=LI(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function NI(n,u){let v={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(Xo(B,v))continue;if(Ph(n,z,v)){W++,z++;continue}if(!v.inSingle&&!v.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function LI(n,u){let v=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function Ph(n,u,v){return!v.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function WI(n){let u=[],v=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){v.push(ue);continue}let be=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(be!==null){let De=be[1]??"",Ie=be[2];if(De===CT)z=!0;if(vT.has(De))W=!0;if(Ie!==void 0){if(De===th)u.push(Ie);continue}if(RT.has(De)){let Oe=n[le+1];if(De===th&&Oe!==void 0)u.push(Oe);le++}continue}if(ue.startsWith("-")&&ue.length>1){let De=ue.slice(1),Ie="",Oe="";for(let Le=0;Le<De.length;Le++){let We=De[Le]??"";if(bT.has(We))W=!0;if(ET.has(We)){Ie=We,Oe=De.slice(Le+1);break}}if(Ie==="")continue;if(Oe.length>0){if(Ie===eh)u.push(Oe);continue}let Ne=n[le+1];if(Ie===eh&&Ne!==void 0)u.push(Ne);le++;continue}v.push(ue)}let Q=!W&&!z?v.slice(1):v;return[...u,...Q]}function rr(n){let u=n.findIndex((v)=>!Th(v)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(v));return u===-1?[]:n.slice(u)}function Th(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var FI=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),ch=".env.",GI=[".example",".sample",".template",".tpl"],zI=[".env.example.",".env.sample."];function $I(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function BI(n){return n.length>0&&!/\s/.test(n)}function _a(n,u,v,W){let z=Ih(n,u,v,W);return z!==""&&v.paths.entryKind(z)!=="missing"}function Ih(n,u,v,W){try{return Fi(n,u,v,W)}catch(z){if(z instanceof a)throw z;return""}}var UI=/[?&][^?&=/]+=/,HI=new Set(["node_modules","__pycache__"]),jI=[["vendor","bundle"],["vendor","cache"]];function VI(n,u,v,W,z){if($I(n))return null;let B=An(n,u,W,z);if(!B)return null;let X=Kt(B.split("/").pop()??""),Q=Kt(B),le=()=>BI(X)||_a(n,u,W,z),ue=Kt(JI(n,u,W,z));for(let Ie of ll){let Oe=`~/${Ie.suffixParts.join("/")}`;if((uh(Q,Oe)||uh(ue,Oe))&&gr(Ie.id,v))return Ie.id}if(X===".env.defaults"||X.startsWith(ch)&&GI.some((Ie)=>X.endsWith(Ie))||zI.some((Ie)=>X.startsWith(Ie)))return null;let be=KI(B,u,v,W,z);if(be)return be;if(FI.has(X))return null;for(let Ie of al)if(X===Ie.basename&&gr(Ie.id,v))return Ie.id;if(X.startsWith(ch)&&gr(rs.id,v)&&le())return rs.id;for(let Ie of cl)if(X.length>Ie.prefix.length&&X.startsWith(Ie.prefix)){let Oe=X.slice(Ie.prefix.length)[0];if((Oe==="-"||Oe==="_")&&gr(Ie.id,v)&&le())return Ie.id}for(let Ie of dl)if(X.length>Ie.prefix.length&&X.startsWith(Ie.prefix)){if(X.slice(Ie.prefix.length)===Ie.suffix&&gr(Ie.id,v))return Ie.id}if(ZI(Q))return null;if(!X.includes(".")&&Jo.pattern.test(X)&&gr(Jo.id,v))return Jo.id;if(UI.test(n)&&!_a(n,u,W,z))return null;let De=XI(X,v);if(De)return De;return null}function KI(n,u,v,W,z){return os.find((B)=>{if(!gr(B.id,v))return!1;switch(B.id){case"secret.cli.claude-code":return Ht(n,qt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let X=Kt(n).split("/");return Ht(n,qt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||Li(n,"~/.claude.json",u,W,z)||X.at(-1)==="settings.local.json"&&X.at(-2)===".claude"||X.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Ht(n,An("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let X=qt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return Ht(n,X,["auth.json",".credentials.json"])||Lo(n,X,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let X=qt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),Q=Kt(n).split("/").at(-1)??"";return Ht(n,X,["config.toml"])||Q.endsWith(".config.toml")&&Ht(n,X,[Q])}case"secret.cli.gemini":return Ht(n,sn(qt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let X=Kt(n).split("/"),Q=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[sn(qt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return Ht(n,sn(qt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||X.at(-1)==="settings.json"&&X.at(-2)===".gemini"||(Q?.trim()?Li(n,Q,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>Ht(n,An(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let X=qt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return Ht(n,X,["config.json"])||Lo(n,X,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Ht(n,qt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let X=qt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q=qt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return Ht(n,X,["server.token"])||Lo(n,X,["credentials"])||Lo(n,Q,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let X=["config.toml","mcp.json"],Q=Kt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".kimi-code"||Ht(n,qt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),X)||Ht(n,qt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...X,"config.json","config.json.bak"])}case"secret.cli.opencode":{let X=sn(qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),Q=Kt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return Ht(n,X,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Q)&&Ht(n,X,[Q])||ue.some((be)=>Li(n,be,u,W,z))}case"secret.cli.opencode.config":{let X=sn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),Q=W.env.get("ProgramData")?[sn(qt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Kt(n).split("/").at(-1)??"")||Ht(n,X,["config.json"])||(ue?.trim()?Li(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...Q].some((be)=>Ht(n,An(be,u,W,z),le))}case"secret.cli.pi":return Ht(n,qt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return Ht(n,qt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let X=An("~",u,W,z);return[sn(qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),sn(X,".local","share","amp")].some((le)=>Ht(n,le,["secrets.json"]))||Lo(n,sn(X,".amp"),["oauth"])}case"secret.cli.amp.config":{let X=["settings.json","settings.jsonc"],Q=[sn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),sn(An("~",u,W,z),".config","amp")],le=Kt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return Q.some((be)=>Ht(n,be,X))||le.at(-2)===".amp"&&X.includes(le.at(-1)??"")||(ue?.trim()?Li(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let X=sn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),Q=sn(qt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return Ht(n,An("~/.cursor",u,W,z),["auth.json"])||Ht(n,X,["auth.json"])||Kt(n).split("/").at(-1)==="mcp-auth.json"&&ro(Kt(n),Kt(Q))}case"secret.cli.cursor.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".cursor"}case"secret.cli.grok-build":return Ht(n,qt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let X=Kt(n).split("/");return X.at(-1)==="config.toml"&&X.at(-2)===".grok"||Ht(n,qt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||Ht(n,An("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Ht(n,An("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".factory"||Ht(n,An("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),An("~/.local/share",u,W,z)].some((X)=>Ht(n,sn(X,"devin"),["credentials.toml"])||Lo(n,sn(X,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),An("~/.config",u,W,z)].some((X)=>Ht(n,sn(X,"devin"),["config.json"]));default:return!1}})?.id??null}var dh=new WeakMap;function qt(n,u,v,W,z){let B=dh.get(z)??new Map;dh.set(z,B);let X=`${v}\x00${n??""}\x00${u}`,Q=B.get(X);if(Q!==void 0)return Q;let le=An(n?.trim()?n:u,v,W,z);return B.set(X,le),le}function Ht(n,u,v){return v.some((W)=>kh(n,sn(u,W)))}function Lo(n,u,v){return v.some((W)=>ro(Kt(n),Kt(sn(u,W))))}function Li(n,u,v,W,z){return kh(n,An(u,v,W,z))}function kh(n,u){return Kt(n)===Kt(u)}function sn(n,...u){return Xn([n,...u].filter(Boolean).join("/"))}function qI(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Fi(n,u,z,B));return v.some((Q)=>ro(X,Kt(Fi(Q,W,z,B))))}function YI(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Fi(n,u,z,B));if(!X)return!1;let Q=z.env.get("HOME")??z.home,le=Q?Xn(Ut(pn(Q),z.paths,B)):"",ue=Kt(le),be=z.env.get("CC_SAFETY_NET_HOME"),De=Kt(be?Xn(Ut(xa(pn(be)),z.paths,B)):le&&Xn(Ut(`${le}/.cc-safety-net`,z.paths,B)));if(De&&ro(X,De))return!1;return v.some((Ie)=>{let Oe=gl(Ie);if(Oe&&mh.basename(X)!==Kt(Oe.name))return!1;let Ne=Kt(Fi(Oe?.root??Ie,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return ro(X,Ne)&&!(Oe&&X===Ne)})}function ZI(n){let u=n.split("/");return u.some((v)=>HI.has(v))||jI.some(([v,W])=>u.some((z,B)=>z===v&&u[B+1]===W))}function XI(n,u){let v=n.lastIndexOf("."),W=v>0&&v<n.length-1?n.slice(v+1):"";if(W==="")return null;for(let z of ul)if(W===z.extension&&gr(z.id,u))return z.id;for(let z of ml)if(z.pattern.test(W)&&gr(z.id,u))return z.id;return null}function Kt(n){return n.toLowerCase()}function gr(n,u){return!u?.disabledRules?.includes(n)}function An(n,u,v,W){let{home:z,normalized:B}=md(n,v,W);if(!B)return"";if(!z)return B;let X=fd(B,z),Q=va(X)?X:Xn(xa(u,X)),le=Xn(Ut(Q,v.paths,W));if(!ro(le,z)){if(va(X))return le;return le===Q?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function uh(n,u){return n===u||n.startsWith(`${u}/`)}function JI(n,u,v,W){let{home:z,normalized:B}=md(n,v,W);if(!B||!z)return"";let X=fd(B,z),Q=mh.normalize(va(X)?X:Xn(xa(u,X))),le=Xn(pn(v.env.get("HOME")??v.home)),ue=(Ie)=>process.platform==="win32"?Ie.toLowerCase():Ie,be=[z,le].find((Ie)=>Ie!==""&&ro(ue(Q),ue(Ie)));if(be===void 0)return"";let De=Q.slice(be.length);return De?`~${De}`:"~"}function Fi(n,u,v,W){let{home:z,normalized:B}=md(n,v,W);if(!B)return"";let X=z?fd(B,z):B;return Xn(Ut(va(X)?X:xa(u,X),v.paths,W))}function md(n,u,v){let W=u.env.get("HOME")??u.home,z=W?Xn(Ut(pn(W),u.paths,v)):"",B=Xn(pn(QI(ur(n,u))));return{home:z,normalized:B}}function QI(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return eT(n)}catch{return n}}function fd(n,u){if(n==="~")return u;if(n.startsWith("~/"))return sn(u,n.slice(2));return n}function ek(n){if(process.platform==="win32")return!0;return QP.parse(n).root.length>1}function Xn(n){let u=n.trim(),v=(u.includes("\\")&&ek(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(v==="/")return v;return v.replace(/\/+$/g,"")}function ro(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function bn(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,v){super(`CC Safety Net ${n} dependency failed`,{cause:v});this.stage=n;this.evaluation=u}}var tk={findPolicyMutation:Xg,findGitMetadataMutation:Ef,resolveGitMetadata:ik,loadPolicySnapshot:w,findSensitiveTarget:yh,analyzeCommand:Hg,getModes:O},nk=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,rk=["workdir","cwd","working_directory"];function G(n,u){let v={...tk,...u.dependencies},W=lk(n),z=()=>kr("config-load",W,()=>v.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,X=B?.policy.commandTools.find((kt)=>kt.name===n.toolName),Q=X&&W?ok(n,W,X.cwd,u.environment.paths):n;if("decision"in Q)return Q;let le=Q,ue=le===n?{}:{promotedInvocation:le},be=Gi(le)?le.command:W,De=kr("policy-protection",be,()=>Sf(le)),Ie=vo(De,"input-candidate"),Oe=vo(De,"declared-command");if(Gi(le)&&le.command?.trim()&&Oe?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:Qn,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(Ie?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:yf,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=On(),Le=kr("policy-protection",be,()=>v.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=kr("policy-protection",be,()=>v.findPolicyMutation(De,u.environment,Ne));if(We){let kt=be??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:kt,segment:We.target}}}}let Ge=kr("policy-protection",be,()=>Kg(De,u.environment,Ne));if(Ge){let kt=be??Ge.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:kt,segment:Ge.target}}}}let st=kr("policy-protection",be,()=>v.findGitMetadataMutation(De,Le,u.environment,Ne));if(st){let kt=be??st.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:kt,segment:st.target}}}}let it=B??z(),at=it.policy,Et=v.getModes(at,u.environment.env),Rt={level:Et.effectiveLevel,...sk(it),...ue},Wt=at.secretProtection.enabled===!1?null:kr("secret-protection",be,()=>v.findSensitiveTarget(De,at.secretProtection,u.environment,Ne,{strict:Gi(le)||Ie?.program.dialect==="powershell"?Et.strict:void 0}));if(Wt){let kt=be??Wt.target;return{stage:"secret-protection",...Rt,decision:{kind:"deny",reason:fh,intent:"hard_stop",ruleId:Wt.ruleId,evidence:{command:kt,segment:Wt.target}}}}if(!Gi(le))return{stage:"non-command",...Rt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...Mh(be),...Rt};let Be=kr("command-analysis",be,()=>jg(()=>v.analyzeCommand(le.command,{cwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:it,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Et.capabilities,worktreeMode:Et.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},ak(De),De.store),le.command,u.trace)),Ft=le.route.shell==="auto"&&De.store.readsAutoAsPowerShell()?()=>{let kt=u.trace?.branch(),tn={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...kt?{trace:kt.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>it,resolveGitMetadata:()=>Le}}),...ue};return{decision:tn.decision,withItsTrace:()=>(kt?.adopt(),tn)}}:void 0;if(Be.decision){let kt=!Et.strict&&(Be.decision.ruleId==="raw-text.dangerous-command"||Be.decision.reason===Si&&!nk.test(Be.decision.evidence?.segment??"")&&Ln(le.command)===null),tn=kt?Ft?.():void 0;if(tn?.decision.kind==="deny"&&!tn.decision.unverifiedByStandardMode)return tn.withItsTrace();return{stage:"command-analysis",...Rt,..."errorCode"in Be?{errorCode:Be.errorCode}:{},decision:kt?{...Be.decision,unverifiedByStandardMode:!0}:Be.decision}}return Ft?.().withItsTrace()??{stage:"command-analysis",...Rt,decision:{kind:"allow"}}}function ok(n,u,v,W){let z=[...new Set((v?[v]:rk).flatMap((le)=>{let ue=Object.getOwnPropertyDescriptor(n.input,le);return ue?[ue.value]:[]}))],B=z.filter((le)=>typeof le==="string"&&le.trim()!=="");if(z.length>1||B.length!==z.length)return Mh(u);let X=B[0],Q=X===void 0?n.context.configCwd:Xd(X,n.context.configCwd,W);if(!Q){let le=I({directory:"requested",problem:"unusable",cwd:X??""});return{stage:"command-validation",decision:{kind:"deny",reason:le.reason,ruleId:le.ruleId,intent:le.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:Q},u)}function ik(n,u){let v=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(v.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(v.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(v.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(v.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(v.flatMap((W)=>W.hooksDirectories))])})}function sk(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function ak(n){return vo(n,"declared-command")?.program}function lk(n){try{return de(n.input)}catch(u){let v=Gi(n)?n.command:void 0;throw new g("policy-protection",Oh("policy-protection",u instanceof h?void 0:v,u),u)}}function kr(n,u,v){try{return v()}catch(W){throw new g(n,Oh(n,W instanceof h?void 0:u,W),W)}}function Oh(n,u,v){let W=v instanceof H?{reason:tr,ruleId:"analysis.strict-unparseable"}:v instanceof a||v instanceof E?{reason:ka,ruleId:"analysis.limit"}:{reason:Bo,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function Mh(n){let u=V();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Gi(n){return n.route.kind==="command"}
-export{l,a,ee,ze,dt,A,Pt,pt,Me,te,V,I,ne,_t,c,r,ft,Fe,O,k,xe,At,h,$e,b,de,Se,It,mt,gt,d,Ve,i,R,s,pe,o,x,we,q,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,qe,ge,f,e,Ke,je,Je,Te,vt,bt,he,Ue,ye,Ye,ie,J,Ze,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Xe,Qe,Ct,et,w,tt,He,nt,C,t,ce,_e,E,H,y,F,Mt,Ae,rt,ot,g,G};