cc-safety-net 2.7.1 → 2.7.2

package/dist/chunks/index-3xe319mt.js

@@ -0,0 +1,53 @@
+var Wa="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",tr="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Jo="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var La={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},po={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...La},processedCandidateBytes:{cap:4194304,...La},pathEnvironmentExpansion:{cap:64,...La},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...po},trackedHeredocFiles:{cap:64,...po},scriptFiles:{cap:64,...po},controlFlowStates:{cap:64,...po},wrapperPeelIterations:{cap:20,...po},derivedCommandShape:po});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function _n(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,v=1){let W=(n.get(u)??0)+v;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var ay=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ee(n){return Ve(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ve(n){return ay.reduce((u,v)=>u.replace(v,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return Ad(n).reduceRight((u,v)=>`${u.slice(0,v.valueStart)}<redacted>${u.slice(v.valueEnd)}`,n)}function A(n){return Ve(dt(n))}function Pt(n){return Ad(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function Ad(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let v=n[u.index-1];if(u.index>0&&v&&!/[\s"'([{]/.test(v))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:ly(n,W)}]})}function ly(n,u){if(n.startsWith("$(",u))return cy(n,u);let v=n[u];if(v==='"'||v==="'"){for(let z=u+1;z<n.length;z++){if(v==='"'&&n[z]==="\\"){z++;continue}if(n[z]===v)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function cy(n,u){let v=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){v++,z++;continue}if(B!==")")continue;if(v--,v===0)return z+1}return n.length}var dy={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function uy(n){let u=n.maxLen??200,v=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${v(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(v(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(v(n.segment))}`:void 0,n.cwd?`Working directory: ${W(v(n.cwd))}`:void 0,n.configWarning?`Config warning: ${v(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":dy[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
+
+`)}function Fe(n,u){if(n.decision.kind!=="deny")return;let v=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:v?.command,segment:v?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function te(n={}){return{reason:Jo,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function V(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var my={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...my[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function ne(n){return uy({...n,redact:ee})}function _t(n){return ee(n instanceof Error?n.message:String(n))}import{spawnSync as qy}from"node:child_process";import{lstatSync as Ky,realpathSync as Yy,statSync as Zy}from"node:fs";import{isAbsolute as Xy}from"node:path";import{homedir as Qy,tmpdir as Jy}from"node:os";import{statSync as Hy}from"node:fs";import{join as jy}from"node:path";import{basename as Id,dirname as fy,isAbsolute as py,join as gy,normalize as hy,resolve as Pd}from"node:path";var yy=256,Zi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Sn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function cr(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function $a(n,u){return Fa(n,0,u)}function Fa(n,u,v){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let Q=Ga(n,z+2),le=Sy(n,z,u);if(le===null){if(Zi.has(Q))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=Cy(ue,u,v),z=le+1;continue}let X=Ga(n,z+1);if(!X){W+="$",z++;continue}W+=za(X,v)??`$${X}`,z+=X.length+1}return W}function Sy(n,u,v){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,v+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function Cy(n,u,v){let W=n.slice(2,-1),z=Ga(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return za(z,v)??n;let X=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!X){if(Zi.has(z))throw new a("pathEnvironmentExpansion");return n}if(!Zi.has(z))return n;if(X.endsWith("="))throw new a("pathEnvironmentExpansion");let Q=za(z,v),le=X.startsWith(":")?Q!==null&&Q!=="":Q!==null;if(X.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(X.endsWith("-")||X.endsWith("?"))return le?Q??"":Fa(B.slice(X.length),u+1,v);return le?Fa(B.slice(X.length),u+1,v):""}function Ga(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let v=u+1;while(/[A-Za-z0-9_]/.test(n[v]??""))v++;return n.slice(u,v)}function za(n,u){if(!Zi.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function Ht(n,u,v){if(!n)return n;let W=v.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){kd(v,B);let X=u.realpath(B);if(X!==null)return Td(v,n,X,z);let Q=fy(B);if(Q===B||z.length>=yy)return Td(v,n,B,z);z.push(Id(B)),B=Q}}function Td(n,u,v,W){let z=W.length===0?v:gy(v,...W.reverse());return n.resolvedPaths.set(u,z),z}function by(n,u,v){let W=v.resolvedPaths.get(n);if(W!==void 0)return W;kd(v,n);let z=u.realpath(n);if(z!==null)v.resolvedPaths.set(n,z);return z}function kd(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function Cn(n,u,v,W){let z=Md(n,u,v);if(!z)return"";return Ht(z,v.paths,W).replace(/\\/g,"/")}function Od(n,u,v,W,z){let B=Md(n,u,v);if(!B)return null;if(z(Id(B)))return Ht(B,v.paths,W).replace(/\\/g,"/");let X=by(B,v.paths,W);return X===null?null:X.replace(/\\/g,"/")}function Md(n,u,v){let W=v.home,z=$a(n.trim(),v).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?Pd(W,z.slice(2)):z,X=Sn(B);return hy(py(X)?X:Pd(u,X))}import{spawnSync as Ey}from"node:child_process";import{accessSync as Dd,constants as Nd,existsSync as ei,lstatSync as vy,opendirSync as Ry,readFileSync as ti,realpathSync as go,statSync as ho}from"node:fs";import{dirname as Fd,isAbsolute as Ba,join as Gn,resolve as Xi}from"node:path";var wy=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],_y=5000;function Gd(n,u=zy(),v=_y){let W=xy(n),z=W===null?null:Ay(W);if(W===null||z===null)return null;let B=Fy(W,z,u,v);return B===null?null:{recursiveSubmodules:B}}function xy(n){try{let u=go(Xi(n));return ho(u).isDirectory()?u:null}catch{return null}}function Ay(n){let u=Wy(n);if(!u)return null;try{let v=vy(u);if(v.isSymbolicLink()||!v.isFile())return null;let W=Ua(u);if(!W?.commonDir)return null;if(!Iy(W.gitDir,u))return null;return Bd(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function Ua(n){try{let u=Py(n);if(!u)return null;let v=go(Ba(u)?u:Xi(Fd(n),u));if(!ho(v).isDirectory())return null;return{gitDir:v,commonDir:Ty(v)}}catch{return null}}function Py(n){let u=ti(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function Ty(n){try{let u=ti(Gn(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let v=go(Ba(u)?u:Xi(n,u));return ho(v).isDirectory()?v:null}catch{return null}}function Iy(n,u){let v=ky(n);return v===null?!1:Oy(n,v,u)}function ky(n){let u=Gn(n,"gitdir");if(!ei(u))return null;let v=ti(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return v===""?null:v}function Oy(n,u,v){try{return My(Ba(u)?u:Xi(n,u),v)}catch{return!1}}function My(n,u){try{let v=ho(n),W=ho(u);if(v.ino!==0&&W.ino!==0&&v.dev===W.dev&&v.ino===W.ino)return!0}catch{}return Ld(go.native(n))===Ld(go.native(u))}function Ld(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),v=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?v.toLowerCase():v}function zd(n){try{return Dd(Gn(n,"objects"),Nd.X_OK),Dd(Gn(n,"refs"),Nd.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Ud(Gn(n,"HEAD")))}catch{return!1}}function $d(n){return ei(Gn(n,"commondir"))||Bd(n,n)}function Bd(n,u){return[Gn(u,"config"),Gn(n,"config.worktree")].some(Dy)||Ly(n)}var Wd=1048576;function Ud(n){let u=ho(n);if(!u.isFile()||u.size>Wd)throw Error(`${n} is not a regular file within ${Wd} bytes`);return ti(n,"utf-8")}function Dy(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(Ud(n))}catch(u){return u.code!=="ENOENT"}}var Ny=1e4;function Ly(n){let u=[n],v=0;try{while(u.length>0){let W=u.pop(),z=Ry(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(v++,B.isSymbolicLink()||B.isFIFO()||v>Ny)return!0;let X=W===n&&B.name==="objects";if(B.isDirectory()&&!X)u.push(Gn(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function Wy(n){try{return Ha(go(n))}catch{return null}}function Ha(n){let u=n;while(!0){let v=Gn(u,".git");if(ei(v))return v;let W=Fd(u);if(W===u)return null;u=W}}function Fy(n,u,v,W){if(Gy(u))return!0;if(v===null)return!0;let z=Ey(v,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:$y(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&Hd(z.stdout.trim())}function Gy(n){return[Gn(n.commonDir,"config"),Gn(n.gitDir,"config.worktree")].filter((u)=>ei(u)).some((u)=>By(u))}function zy(){return wy.find((n)=>ei(n))??null}function ni(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function $y(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!ni(u)))}function By(n){let u;try{u=ti(n,"utf-8")}catch{return!0}let v="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let X=B.match(/^\[([^\]]+)\]$/);if(X){v=X[1]?.trim().toLowerCase()??"";continue}let Q=B.indexOf("="),le=(Q===-1?B:B.slice(0,Q)).trim().toLowerCase(),ue=Q===-1?"true":B.slice(Q+1).trim();if(Uy(v)&&le==="path")return!0;if(v==="submodule"&&le==="recurse")W=Hd(ue)}return W}function Uy(n){return n==="include"||n.startsWith("includeif ")}function Hd(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function jd(n,u){if(n==="")return null;let v=_n(),W=Ha(Cn(n,n,u,v)),z=W?Vy(W,n,u,v):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Vy(n,u,v,W){try{let z=Cn(n,u,v,W),B=Hy(n),X=B.isFile()?z:null,Q=B.isFile()?Ua(n):null,le=(B.isDirectory()?[z]:[Q?.gitDir,Q?.commonDir]).flatMap((be)=>be?[yo(Cn(be,u,v,W))]:[]),ue=[...new Set(B.isDirectory()?[yo(n.replace(/\\/g,"/")),...le]:le)];return{entry:yo(z),markerFile:X?yo(X):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((be)=>{let Oe=yo(jy(be,"hooks").replace(/\\/g,"/"));return[Oe,yo(Cn(Oe,u,v,W))]}))]}}catch{return null}}function yo(n){return process.platform==="win32"?n.toLowerCase():n}var eS={realpath:(n)=>{try{let u=Yy(n);return Xy(u)?u:null}catch{return null}},entryKind:(n)=>{try{let u=Ky(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return Zy(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return nS({env:new Map(Object.entries(process.env).flatMap(([u,v])=>v===void 0?[]:[[u,v]])),home:Sn(process.env.HOME||Qy()),tmpdir:Jy(),darwinUserTempDir:()=>Qi(n,"",tS),paths:eS})}function tS(){if(process.platform!=="darwin")return null;let n=qy("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function nS(n,u={}){let v=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(X)=>Qi(v,X,()=>jd(X,B)),worktreeFacts:(X)=>Qi(W,X,()=>Gd(X)),isGitDirectory:zd,gitDirectoryRedirects:(X)=>Qi(z,X,()=>$d(X)),...u};return B}function Qi(n,u,v){let W=n.get(u);if(W!==void 0)return W;let z=v();return n.set(u,z),z}var So=["fail_closed","paranoid_rm","paranoid_interpreters"],Ji={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},es=["standard","strict","paranoid"];function Vd(n,u){if(!u)return n;return es.indexOf(u)>es.indexOf(n)?u:n}function qd(n){let u=xe(r.level,n);return es.find((v)=>v===u)}function Kd(n,u){return Vd(n,qd(u))}function rS(n){let u=xe(r.level,n);if(!u)return;let v=qd(n);if(v)return v;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${es.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function $e(n){return ft(xe(r.auditScope,n))==="all"}function ja(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let v=n.safety?.level??"standard",W=rS(u),z=Vd(v,W),B=Ji[z],X={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},Q={failClosed:z===v?"preset":"environment",paranoidRm:z===v?"preset":"environment",paranoidInterpreters:z===v?"preset":"environment"},le={failClosed:[`policy safety.level=${v}`],paranoidRm:[`policy safety.level=${v}`],paranoidInterpreters:[`policy safety.level=${v}`]};if(z!==v)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)X.failClosed=n.safety.overrides.failClosed,Q.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)X.paranoidRm=n.safety.overrides.paranoidRm,Q.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)X.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,Q.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))X.failClosed=!0,Q.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))X.paranoidRm=!0,X.paranoidInterpreters=!0,Q.paranoidRm="environment",Q.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))X.paranoidRm=!0,Q.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))X.paranoidInterpreters=!0,Q.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:X.failClosed,paranoidRm:X.paranoidRm,paranoidInterpreters:X.paranoidInterpreters,worktreeMode:ue,effectiveLevel:ja(X),capabilities:{fail_closed:{enabled:X.failClosed,source:Q.failClosed,sources:le.failClosed},paranoid_rm:{enabled:X.paranoidRm,source:Q.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:X.paranoidInterpreters,source:Q.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let v=typeof n==="string"?ri(n,u):xe(n,u);return v==="1"||v?.toLowerCase()==="true"}function ri(n,u){return u.get(n)}function xe(n,u){let v=ri(n.name,u);if(v!==void 0)return v;if(n.legacyName)return ri(n.legacyName,u);return}function At(n,u){return ri(n.name,u)!==void 0||!!n.legacyName&&ri(n.legacyName,u)!==void 0}import{types as oS}from"node:util";var iS=new Set(["applypatch","patch"]),sS=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),aS=new Set(["grep","grepsearch","rg"]),lS=new Set(["find","findbyname","glob"]),cS=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),dS=new Set(["command","diff","input","patch","patchtext"]),Yd=new TextEncoder,uS=new TextDecoder,mS=/\s/,fS=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var oi=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function je(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function ns(n){return cS.has(je(n))}function b(n){let u=je(n);if(iS.has(u))return"patch";if(aS.has(u))return"grep";if(lS.has(u))return"glob";if(sS.has(u))return"path";return"unknown"}function de(n){if(!n||typeof n!=="object")return;su(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)nr();return}if(u.get||u.set)nr();let v=u.value;return typeof v==="string"&&v!==""?v:void 0}function eu(n,u){return tu(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function tu(n,u,v,W,z){let B=iu(n,W,z);if(typeof n==="string")return v?[n]:[];if(!B)return[];let X=B.entries.flatMap(([Q,le])=>tu(le,u,B.array?v:u.has(nu(Q)),W,z+1));return W.ancestors.delete(B.object),X}function nu(n){return n.replace(/-/g,"_").toLowerCase()}function ru(n){return ou(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(gS)}function ou(n,u,v,W){let z=iu(n,v,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([X,Q])=>ou(Q,z.array?u:dS.has(nu(X)),v,W+1));return v.ancestors.delete(z.object),B}function pS(n,u,v){if(u.nodes++,n!==null&&typeof n==="object"&&v>oi.maxDepth||u.nodes>oi.maxNodes)nr();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>oi.maxStringBytes||u.stringBytes>oi.maxAggregateStringBytes)nr()}function iu(n,u,v){if(pS(n,u,v),!n||typeof n!=="object")return null;let W=su(n);if(u.ancestors.has(n))nr();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>oi.maxKeys)nr();let B=z.flatMap((X)=>{let Q=Object.getOwnPropertyDescriptor(n,X);if(!Q||Q.get||Q.set)nr();return typeof X==="string"&&Q.enumerable?[[X,Q.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function su(n){if(oS.isProxy(n))nr();let u=Array.isArray(n),v=Object.getPrototypeOf(n);if(u&&v!==Array.prototype||!u&&v!==Object.prototype&&v!==null)nr();return u}function nr(){throw new h}function gS(n){let u=[],v=n.split(/\r?\n/),W=!1,z=!1,B=null,X=null,Q=()=>{z=!1,B=null,X=null};for(let le=0;le<v.length;le++){let ue=v[le]??"";if(ue==="*** Begin Patch"){W=!0,Q();continue}if(ue==="*** End Patch"){W=!1,Q();continue}if(ue.startsWith("@@")){let be=hS(ue);if(z=!0,B=be?.oldLines??null,X=be?.newLines??null,B===0&&X===0)Q();continue}if(z&&B!==null&&X!==null){let be=ue.startsWith(" ")||ue.startsWith("-")?1:0,Oe=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-be),X=Math.max(0,X-Oe),B===0&&X===0)Q();continue}if(ue.startsWith("*** ")){Q(),u.push(...Va(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...Va(ue));continue}if(ue.startsWith("--- ")){let be=v[le+1]??"";if(!be.startsWith("+++ "))continue;u.push(...Ka(ts(ue.slice(4),!0),ts(be.slice(4),!0))),le++;continue}if(!W)u.push(...Va(ue))}return u}function hS(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function Va(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return Jd(u[1]);let v=/^\*\*\* Move to: (.+)$/.exec(n);if(v?.[1])return Jd(v[1]);if(n.startsWith("diff --git "))return yS(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return Qd(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return Qd(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return wS(B[1]);return[]}function yS(n){let u=SS(n);if(u.length===2&&u[0]&&u[1])return Ka(u[0],u[1]);let v=CS(n);return v?Ka(n.slice(v.oldStart,v.oldEnd),n.slice(v.newStart,v.newEnd)):[]}function SS(n){let u=[],v=0;while(v<n.length&&u.length<2){while(Wr(n[v]))v++;if(v>=n.length)break;let W=n[v]==='"'||n[v]==="'"?n[v]:void 0;if(!W){let B=v;while(v<n.length&&!Wr(n[v]))v++;u.push(n.slice(B,v));continue}let z=au(n,v,W);if(!z)return[];u.push(z.value),v=z.end}while(Wr(n[v]))v++;return v===n.length?u:[]}function CS(n){let u=0;while(u<n.length&&Wr(n[u]))u++;let v=n.length;while(v>u&&Wr(n[v-1]))v--;let W=0,z=u;while(z<v){if(!Wr(n[z])){z++;continue}let B=z;while(z<v&&Wr(n[z]))z++;if(B===u||z===v)continue;if(W++,W>fS)nr();if(bS(n,u,B,z,v))return{oldStart:u,oldEnd:B,newStart:z,newEnd:v}}return null}function bS(n,u,v,W,z){if(qa(n,u,v,W,z))return!0;let B=Zd(n,"/",u,v),X=Zd(n,"/",W,z);if(B<=u||X<=W)return!1;if(qa(n,u,B,W,X))return!1;return qa(n,B+1,v,X+1,z)}function qa(n,u,v,W,z){if(v-u!==z-W)return!1;for(let B=0;B<v-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function Zd(n,u,v,W){for(let z=v;z<W;z++)if(n[z]===u)return z;return-1}function Wr(n){return n!==void 0&&mS.test(n)}function au(n,u,v){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===v)return{value:uS.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||v==="'"){W.push(...Yd.encode(B)),z+=B.length;continue}let X=n.slice(z+1),Q=/^[0-7]{1,3}/.exec(X)?.[0];if(Q){W.push(Number.parseInt(Q,8)),z+=Q.length+1;continue}W.push(...Yd.encode(ES(X[0]??""))),z+=2}return null}function ES(n){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n}function vS(n){return ii(_S(n))}function Ka(n,u){if(n==="/dev/null")return Xd(u);if(u==="/dev/null")return Xd(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(ii);let v=RS(n,u)??(n===u?lu(n):null);return[n,u,...v?[v]:[]].flatMap(ii)}function Xd(n){let u=lu(n);return[n,...u?[u]:[]].flatMap(ii)}function lu(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function RS(n,u){let v=n.indexOf("/"),W=u.indexOf("/");if(v<1||W<1)return null;if(n.slice(0,v)===u.slice(0,W))return null;let z=n.slice(v+1);return z===u.slice(W+1)?z:null}function Qd(n){return vS(ts(n,!0))}function wS(n){return ii(ts(n,!1))}function ts(n,u){let v=n.trim(),W=v[0]==='"'||v[0]==="'"?v[0]:void 0;if(W){let z=au(v,0,W);if(z&&(u||v.slice(z.end).trim()===""))return z.value}return u?v.split("\t",1)[0]?.trim()??"":v}function _S(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function ii(n){return n===""||n==="/dev/null"?[]:[n]}function Jd(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}import{accessSync as xS,constants as cu,statSync as AS}from"node:fs";import{isAbsolute as Ya,relative as PS,resolve as du,sep as TS}from"node:path";function Se(n){try{if(!AS(n).isDirectory())return!1;return xS(n,cu.R_OK|cu.X_OK),!0}catch{return!1}}function It(n,u,v){if(cr(n))return;let W=u.flatMap((B)=>rs(B,v));if(!W[0])return;let z=rs(Ya(n)?n:du(W[0],n),v)[0];if(!z)return;return W.some((B)=>IS(z,B))?z:void 0}function uu(n,u,v){if(cr(n))return;return rs(Ya(n)?n:du(u,n),v)[0]}function mt(n,u){return n.flatMap((v)=>rs(v,u))[0]}function rs(n,u){let v=u.realpath(n);if(v===null)return[];return u.isDirectory(v)?[v]:[]}function IS(n,u){let v=PS(u,n);return v===""||v!==".."&&!v.startsWith(`..${TS}`)&&!Ya(v)}var kS=8388608;async function gt(n){let u=[],v=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(v+=z.byteLength,v>kS)throw OS(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,v).toString("utf-8")}function OS(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,v,W,z){if(v.kind!=="command")return{toolName:n,input:u,route:v,context:W};return{toolName:n,input:u,route:v,context:W,command:z}}import{dirname as Br}from"node:path";import{closeSync as MS,constants as si,fstatSync as Za,fsyncSync as DS,lstatSync as zn,mkdirSync as mu,openSync as fu,readdirSync as Qa,readFileSync as NS,realpathSync as Co,renameSync as LS,rmdirSync as pu,statSync as Xa,unlinkSync as Ja,writeFileSync as WS}from"node:fs";import{isAbsolute as gu,join as Fr,normalize as FS,parse as os,relative as el,resolve as tl,sep as is}from"node:path";function qe(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var GS=Symbol("PolicyFilesystemScope"),zS=Symbol("PolicyFilesystemTarget"),hu=si.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[GS]:!0,root:tl(n),label:u}}function ai(n,u){let v=FS(u);if(u===""||gu(u)||v===".."||v.startsWith(`..${is}`))throw new i(n.label);return{[zS]:!0,scope:n,relativePath:v,path:Fr(n.root,v)}}function s(n,u){return ai(n,el(n.root,tl(u)))}function pe(n,u="rules policy"){let v=tl(n),W=os(v).dir;return ai(R(W,u),el(W,v))}function o(n){return dr(n.scope.label,()=>{if(!fn(n))return null;let u=fu(n.path,si.O_RDONLY|hu);return Su(u,()=>{let v=Za(u);if(!v.isFile())throw new i(n.scope.label);let W=NS(u,"utf-8"),z=zn(n.path);if(!z.isFile()||z.isSymbolicLink()||v.dev!==z.dev||v.ino!==z.ino)throw new i(n.scope.label);return fn(n),W})})}function x(n,u,v=384,W){let z=`${n.path}.${qe()}.tmp`;dr(n.scope.label,()=>{BS(n),fn(n);let B=fu(z,si.O_CREAT|si.O_EXCL|si.O_WRONLY|hu,v),X=Su(B,()=>{let Q=Za(B);if(!Q.isFile())throw new i(n.scope.label);WS(B,u,"utf-8"),DS(B);let le=Za(B);if(!le.isFile()||le.dev!==Q.dev||le.ino!==Q.ino)throw new i(n.scope.label);return le});fn(n),HS(n,z,X.dev,X.ino),LS(z,n.path),W?.(n.path),fn(n)},()=>jS(z))}function yu(n,u){if(n.path===u.path)return!0;return dr(n.scope.label,()=>{if(!fn(n)||!fn(u))return!1;let v=(W)=>Fr(Co(os(W).dir),os(W).base);return v(n.path)===v(u.path)})}function we(n){let u=dr(n.scope.label,()=>{if(!fn(n,"directory"))return null;let v=Qa(n.path);return fn(n,"directory"),v});if(!u)return null;return dr(n.scope.label,()=>{let v=u.map((W)=>{let z=ai(n.scope,Fr(n.relativePath,W)),B=zn(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return ss(nl(n.scope),Co(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return fn(n,"directory"),v})}function q(n){dr(n.scope.label,()=>{if(!fn(n))return;Ja(n.path),fn(n)})}function Ot(n){dr(n.scope.label,()=>{if(!$S(n))return;bu(n),fn(n,"directory")})}function Dt(n){dr(n.scope.label,()=>{if(!fn(n,"directory"))return;pu(n.path),fn(n,"directory")})}function $S(n){return dr(n.scope.label,()=>{if(!fn(n,"directory"))return!1;return Cu(n),!0})}function dr(n,u,v){try{return u()}catch(W){if(v?.(),W instanceof i)throw W;throw new i(n)}}function Su(n,u){try{return u()}finally{MS(n)}}function fn(n,u="file"){let v=Eu(n.scope);if(!v)return!1;let W=n.relativePath.split(is);for(let z of W.keys()){let B=Fr(n.scope.root,...W.slice(0,z+1)),X=zn(B,{throwIfNoEntry:!1});if(!X)return!1;if(X.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!X.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!X.isFile():!X.isDirectory()))throw new i(n.scope.label);ss(v,Co(B),n.scope.label)}return!0}function Cu(n){for(let u of Qa(n.path)){let v=ai(n.scope,Fr(n.relativePath,u)),W=zn(v.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())Cu(v)}fn(n,"directory")}function bu(n){for(let u of Qa(n.path)){let v=ai(n.scope,Fr(n.relativePath,u)),W=zn(v.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){bu(v);continue}if(!W.isFile())throw new i(n.scope.label);Ja(v.path)}pu(n.path)}function BS(n){US(n.scope);let u=nl(n.scope),v=n.relativePath.split(is).slice(0,-1);for(let W of v.keys()){let z=Fr(n.scope.root,...v.slice(0,W+1));if(!zn(z,{throwIfNoEntry:!1}))mu(z,{mode:448});let B=zn(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);ss(u,Co(z),n.scope.label)}}function US(n){if(zn(n.root,{throwIfNoEntry:!1})){if(!Xa(n.root).isDirectory())throw new i(n.label);return}let u=[],v=n.root;while(!zn(v,{throwIfNoEntry:!1})){u.unshift(v);let W=os(v).dir;if(W===v)throw new i(n.label);v=W}if(!Xa(v).isDirectory())throw new i(n.label);for(let W of u){mu(W,{mode:448});let z=zn(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function Eu(n){if(!zn(n.root,{throwIfNoEntry:!1}))return null;if(!Xa(n.root).isDirectory())throw new i(n.label);return Co(n.root)}function nl(n){let u=Eu(n);if(!u)throw new i(n.label);return u}function HS(n,u,v,W){let z=zn(u);if(!z.isFile()||z.isSymbolicLink()||z.dev!==v||z.ino!==W)throw new i(n.scope.label);ss(nl(n.scope),Co(u),n.scope.label)}function ss(n,u,v){let W=el(n,u);if(W===".."||W.startsWith(`..${is}`)||gu(W))throw new i(v)}function jS(n){try{Ja(n)}catch{}}import{dirname as Gr,isAbsolute as ZS,join as zr,relative as XS,resolve as Rr,sep as QS}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ce="rulebook.json",Ee=".cc-safety-net/rules";var vu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,VS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Ru=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,qS=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),KS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Nt=new RegExp(`^${qS}/(${m.source.slice(1,-1)})/${KS}$`);function YS(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function wu(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(vu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let v=u[3].lastIndexOf("/");if(v<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,v),z=u[3].slice(v+1);if(!W||!Ru.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:YS(z),name:z}}function re(n){return VS.test(n)}function fe(n){return Ru.test(n)}function T(n){return vu.test(n)}function Lt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var _u="rule.json",as="policy.json",xu=".cc-safety-net",JS="rules",eC="CC_SAFETY_NET_HOME",Au="`cc-safety-net rule update`";function tC(n){return Rr(n,Ee)}function D(n){return zr(tC(n),_u)}function S(n){return zr(Rr(n),xu,as)}function me(n,u={}){return u.userConfigDir??(u.userConfigPath?Gr(u.userConfigPath):zr(nC(n),JS))}function nC(n){let u=n.env.get(eC);return u?Rr(Sn(u)):zr(n.home,xu)}function K(n,u={}){return zr(me(n,u),_u)}function p(n,u={}){return zr(Gr(me(n,u)),as)}function L(n,u){let v=_n();return Ht(S(u.cwd),n.paths,v)===Ht(Rr(p(n,u)),n.paths,v)}function oe(n,u){let v=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=ht(n,u),B=yt(W,u.cwd);return{userConfigPath:v,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,v),projectConfigTarget:s(B,W)}}function ht(n,u){let v=u.userConfigPath?Gr(Gr(Rr(u.userConfigPath))):Gr(Rr(u.userConfigDir??me(n,u)));return R(v,"user policy")}function yt(n,u){let v=Rr(u),W=Rr(n),z=XS(v,W);if(z!==".."&&!z.startsWith(`..${QS}`)&&!ZS(z))return R(v,"project policy");return R(Gr(Gr(W)),"project policy")}function U(n,u){return zr(n,u,Ce)}var Dn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,tn=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Pu=new Set(["python","python3","python2","node","ruby","perl"]),ls=/^python(?:[23](?:\.\d+)*)?$/,$n=new Set(["awk","gawk","nawk","mawk"]),cs=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]),ds=new Set(["curl","wget","aria2c","http","https","xh","xhs","httpie","fetch","lwp-request","nc","ncat","netcat","socat","telnet"]);var Tu="Rulebook exceeds CC Safety Net's safe validation limits.",Iu="Additional rulebook validation errors were omitted.",Vn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ku(n){if(rl(n.allowed_commands,Vn.maxAllowedCommands)||rl(n.rules,Vn.maxRules)||rl(n.tests,Vn.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:v}=Vn,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>Vn.maxStringCodeUnits||B&&z.length>Vn.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let X=B.match&&typeof B.match==="object"?B.match:{};for(let Q of[B.block_args,X.command_path,X.any_args,X.exclude_args]){if(!Array.isArray(Q))continue;if(Q.length>Vn.maxBlockArgsPerRule||Q.length>v)return!1;v-=Q.length;for(let le of Q)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function rl(n,u){return Array.isArray(n)&&n.length>u}var ol=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ke=64,Re="Rule config exceeds CC Safety Net's safe source limit.";function $t(n){return Wt(n).toLowerCase()}function Wt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function xn(n,u){let v=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let X=z[B];if(!X||!/[a-zA-Z]/.test(X))break;let Q=`-${X}`;if(v.add(Q),u?.shortOptsWithValue?.has(Q))break}}return v}var rC={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},il=new Set(["--init-file","--rcfile"]);function sl(n,u,v,W){let z=!1,B=0,X=!1,Q=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let be=u.slice(le+1);if(u[0]==="-"&&(be==="c"||be[0]==="-"&&be.endsWith("c")))X=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(v?.startsWith("-")||v?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")X=!0;if(W==="argv"&&ue==="s")Q=u[0]==="-";if(!rC[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:X,stdinMode:Q}}function An(n){let u=Wt(n[0]??"").toLowerCase(),v=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let Q=v&&n[z+1]!==void 0?z+1:null;return{command:Q===null?null:n[Q]??null,commandIndex:Q,scriptIndex:!v&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!v&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:v?B:null,commandIndex:v?z:null,scriptIndex:!v&&!W&&B!=="-"?z:null,readsStdinAsCommands:!v&&(W||B==="-")};if(B.startsWith("--")){let Q=B.split("=",1)[0]??B;if(u==="bash"&&il.has(Q)&&!B.includes("="))z++;continue}let X=sl(u,B,n[z+1],"argv");if(X.commandSelected)v=!0;if(X.stdinMode)W=!0;z+=X.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!v}}function li(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function us(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let v of oC(n))li(v,u);return u.inSingle||u.inDouble}function oC(n){let u="",v={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let X=n[B];if(!X)break;if(W){if(X===`
+`||X==="\r")u+=X,W=!1,v.escaped=!1;continue}if(X==="#"&&!v.inSingle&&!v.inDouble&&z){W=!0;continue}if(u+=X,!v.inSingle&&!v.inDouble&&!v.escaped)z=/[\s;&|()<>]/.test(X);li(X,v)}return u}var al=new Set(["rm","find","rsync","xargs","parallel"]),iC=new Set(["git","busybox",...al,...tn,...Pu,...$n]),sC=new Set(["python","node","ruby","perl"]);function Ke(n){let u=$t(n);return iC.has(u)||Nn(u)}function Nn(n){return sC.has(aC(n))}function aC(n){let u=Wt(n).toLowerCase();return ls.test(u)?"python":u}var ge={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(lC(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let v=JSON.parse(u),W=vt(v);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:v.rules??[],overrides:v.overrides??{},transparent_wrappers:v.transparent_wrappers??[],...v.command_tools?{command_tools:v.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let v=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":v]}}}function lC(n){return typeof n==="string"?pe(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),cn=(n,u)=>({path:n,message:u,kind:"custom"});function Je(n){let u=new Set;return n.flatMap((v,W)=>{let z=$r(v)?v.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[cn(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var Ue=`must be one of ${ol.join(", ")}`,cC=/^[^/]+\/[^/]+$/,dC=["version","rules","overrides","transparent_wrappers","command_tools"],Ye=/^[^\s\p{Cc}]{1,256}$/u,Te="non-empty, at most 256 characters, no whitespace or control characters";function vt(n){let u=uC(n);return{errors:he(bt(u,dC,(v)=>v.kind==="custom"),": "," "),sources:bC(n,u)}}function uC(n){if(!$r(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>ke;return[...n.version===1?[]:[e(["version"],"must be 1")],...mC(n.rules,u),...gC(n.overrides),...yC(n.transparent_wrappers),...u?[]:pC(n.rules),...$r(n.overrides)?Object.keys(n.overrides).filter((v)=>!cC.test(v)).map((v)=>cn(["overrides",v],"must use <rulebook-name>/<rule-name>")):[],...SC(n.transparent_wrappers),...CC(n.command_tools)]}function mC(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...Ou(n,ke)?[e(["rules"],Re)]:[]];if(u)return[{path:["rules"],message:Re,kind:"limit"}];return n.flatMap((v,W)=>{if(typeof v!=="string")return[e(["rules",W],"must be a rulebook source string"),...fC(v,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return v===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function Ou(n,u){let v=Mu(n);return v!==void 0&&!(v<=u)}function fC(n,u){let v=Mu(n);return v!==void 0&&!(v>=u)}function Mu(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function pC(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||v==="")return[];if(v.trim()==="")return[cn(["rules",W],"must be a non-empty rulebook source string")];let z=wu(v);if(z)return[cn(["rules",W],z)];if(u.has(v))return[cn(["rules",W],`duplicate rulebook source "${v}"`)];return u.add(v),[]})}function gC(n){if(n===void 0)return[];if(!$r(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let v=n[u];if(v==="off")return[];if(!$r(v))return[e(["overrides",u],'must be "off" or an object')];return[...hC(v.reason,["overrides",u,"reason"]),...v.intent===void 0||He(v.intent)?[]:[e(["overrides",u,"intent"],Ue)]]})}function hC(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...Ou(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function yC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,v)=>{if(typeof u!=="string")return[e(["transparent_wrappers",v],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",v],"must match command pattern")]})}function SC(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[cn(["transparent_wrappers",W],`duplicate command "${v}"`)];if(Ke(v))return[cn(["transparent_wrappers",W],`reserved command "${v}" cannot be a wrapper`)];return u.add(v),[]})}function CC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,v=(W,z)=>{if(u.has(W))return[cn(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return ll(W)?v(W,z):[e(["command_tools",z],`must be a tool name: ${Te}`)];if(!$r(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...ll(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Te}`)],...W.cwd===void 0||ll(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name: ${Te}`)]];return B.length>0?B:v(W.name,z)})}function ll(n){return typeof n==="string"&&Ye.test(n)}function bC(n,u){let v=$r(n)?n.rules:void 0;if(!Array.isArray(v))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(v.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function bt(n,u,v){let W=n.map((X)=>X.path[1]),z=[...new Set(W.filter((X)=>typeof X==="string"))],B=(X,Q)=>[X.path.length===0?-1:u.indexOf(String(X.path[0])),typeof Q==="number"?Q:z.indexOf(String(Q)),v(X)?0:1];return n.map((X,Q)=>({issue:X,rank:B(X,W[Q])})).sort((X,Q)=>X.rank[0]-Q.rank[0]||X.rank[1]-Q.rank[1]||X.rank[2]-Q.rank[2]).map((X)=>X.issue)}function he(n,u,v){return[...new Set(n.map((W)=>{let z=cl(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?v:u}${W.message}`}))]}function cl(n){return n.map((u,v)=>{if(typeof u==="number")return`[${u}]`;return v===0?String(u):`.${String(u)}`}).join("")}function He(n){return ol.includes(n)}function $r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ye(n){let u=RC(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var EC=`required non-empty string up to ${M} characters`,Du="must be a non-empty array of unique non-empty strings",vC="required non-empty array of non-empty strings";function RC(n){if(!wr(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ku(n))return{errors:[Tu],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...he(wC(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>Vn.maxValidationErrors?[...u.slice(0,Vn.maxValidationErrors),Iu]:u,ruleNames:new Set(Ze(n).map((v)=>v.toLowerCase()))}}function Ze(n){let u=wr(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((v)=>{let W=wr(v)?v.name:void 0;return typeof W==="string"?[W]:[]})}function wC(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],..._C(n.allowed_commands),...xC(n.rules,u),...IC(n.tests),...kC(n),...OC(n)]}function _C(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((v,W)=>typeof v==="string"&&P.test(v)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[cn(["allowed_commands",W],`duplicate command "${v}"`)];return u.add(v),[]})]}function xC(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((v,W)=>{if(!wr(v))return[e(["rules",W],"must be an object")];return u?PC(v,["rules",W]):AC(v,["rules",W])}),...Je(n)]}function AC(n,u){return[...Nu(n.name,u),...Lu(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...ms(n.block_args,[...u,"block_args"],"required non-empty array",!1),...Wu(n.reason,u),...Fu(n.intent,u)]}function PC(n,u){return[...Nu(n.name,u),...Lu(n.command,u),...Wu(n.reason,u),...Fu(n.intent,u),...TC(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function Nu(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function Lu(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function Wu(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],EC)]}function Fu(n,u){return n===void 0||He(n)?[]:[e([...u,"intent"],Ue)]}function TC(n,u){if(!wr(n))return[e(u,"required object")];return[...ms(n.command_path,[...u,"command_path"],vC,!1),...n.any_args===void 0?[]:ms(n.any_args,[...u,"any_args"],Du,!0),...n.exclude_args===void 0?[]:ms(n.exclude_args,[...u,"exclude_args"],Du,!0)]}function ms(n,u,v,W){if(!Array.isArray(n))return[e(u,v)];let z=n.flatMap((B,X)=>{if(typeof B!=="string")return[e([...u,X],"must be a non-empty string")];return B===""?[cn([...u,X],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[cn(u,v)]:[],...W&&new Set(n).size!==n.length?[cn(u,"must not contain duplicate values")]:[]]}function IC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,v)=>{if(!wr(u))return[e(["tests",v],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",v,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",v,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",v,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[cn(["tests",v,"rule"],"required string for blocked fixtures")]:[]]})}function kC(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ze(n));return[...new Set(n.tests.flatMap((v)=>wr(v)&&v.expect==="blocked"&&typeof v.rule==="string"?[v.rule]:[]))].filter((v)=>!u.has(v)).map((v)=>cn(["tests"],`blocked fixture references unknown rule "${v}"`))}function OC(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((v)=>typeof v==="string"));return n.rules.flatMap((v,W)=>{let z=wr(v)?v.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[cn(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function wr(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ie(n,u){let v=oe(n,u),W;try{W=yu(v.userConfigTarget,v.projectConfigTarget)}catch(Me){if(Me instanceof i)return BC(v,Me.message);throw Me}let z=f(v.userConfigTarget),B=W?{config:null,errors:[]}:f(v.projectConfigTarget),X=$u(v.userConfigPath,z.errors),Q=$u(v.projectConfigPath,B.errors),le=new Set,ue=z.config?dl(z.config,Br(v.userConfigPath),"user",v.userScope,le):Bu(),be=B.config?dl(B.config,Br(v.projectConfigPath),"project",v.projectScope,le):Bu(),Oe=z.config?.overrides??{},De=B.config?.overrides??{};return{rules:[...zu(ue.rules,Oe),...zu(be.rules,De)],transparent_wrappers:GC(z.config,B.config),command_tools:zC(z.config,B.config),rulebooks:[...ue.rulebooks,...be.rulebooks],errors:[...X,...Q,...ue.errors,...be.errors],warnings:[...ue.warnings,...be.warnings,...ue.canValidateOverrides?ul(Oe,ue.knownRuleIds,v.userConfigPath):[],...ue.canValidateOverrides?$C(De,ue.knownRuleIds,v.projectConfigPath):[],...be.canValidateOverrides?ul(De,be.knownRuleIds,v.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...v}}function J(n,u){let v=MC(n,u);if(!v)return[];return[...v.scope.errors,...v.scope.warnings,...DC(v.config,v.scope,n)]}function MC(n,u){let v=u??R(Br(Br(n)),"rules policy"),W=f(s(v,n)).config;if(!W)return null;return{config:W,scope:dl(W,Br(n),"project",v)}}function DC(n,u,v){return u.canValidateOverrides?ul(n.overrides??{},u.knownRuleIds,v):[]}function dl(n,u,v,W=R(Br(Br(u)),v==="user"?"user policy":"project policy"),z=new Set){let B=[],X=[],Q=n.rules.flatMap((ue)=>{let be=LC(ue,u,W);if(be.errors.length>0||!be.rulebook)return B.push(...be.errors),[];let Oe=be.rulebook;if(z.has(Oe.name))return X.push(`duplicate active rulebook name "${Oe.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(Oe.name),[{rules:NC(Oe),rulebook:{source:v,spec:ue,name:Oe.name,version:Oe.version,rules:Oe.rules.map((De)=>`${Oe.name}/${De.name}`)}}]}),le=Q.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:Q.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:X,canValidateOverrides:B.length===0}}function NC(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function LC(n,u,v){let W=Xe(n),z=U(u,W),B=FC(z,v);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${WC(n)}`]};let X=Pe(B.content);if("problem"in X)return{rulebook:null,errors:[`invalid rulebook ${z}: ${X.problem}; fix that file`]};if(X.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${X.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:X.rulebook,errors:[]}}function Xe(n){return T(n)?j(n).name:n}function WC(n){return T(n)?`run ${Au} to vendor ${n}`:"create that file or remove that source from the rules config"}function FC(n,u){try{return{content:o(s(u,n))}}catch(v){if(v instanceof i)return{error:v.message};throw v}}function Pe(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ye(u)}}catch(v){return{problem:v instanceof Error?v.message:"invalid rulebook"}}}function GC(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function zC(n,u){let v=(n?.command_tools??[]).map(Gu),W=(u?.command_tools??[]).map(Gu);return[...v,...W.filter((z)=>!v.some((B)=>B.name===z.name))]}function Gu(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function zu(n,u){return n.flatMap((v)=>{let W=u[v.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...v,intent:W.intent??v.intent,reason:W.reason}];return[v]})}function ul(n,u,v){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${v}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function $C(n,u,v){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${v}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function $u(n,u){return u.map((v)=>v.startsWith("Unable to access ")?v:`${n}: ${v}`)}function BC(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function Bu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as JC,readFileSync as eb}from"node:fs";var Uu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"network.cloud-metadata",category:"Network",label:"Cloud metadata endpoint",description:"Blocks HTTP clients, raw socket tools, and code interpreters naming a cloud metadata host (169.254.169.254, fd00:ec2::254, 169.254.170.2, 169.254.170.23, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200).",example:"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",intent:"manual_only"},{id:"network.upload-remote",category:"Network",label:"Data upload to a remote host",description:"Blocks curl and wget requests that send a body or upload a file unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]).",example:"curl -T backup.tar https://uploads.example.com/",intent:"manual_only"},{id:"unshare.user-namespace",category:"Execution",label:"unshare user namespace",description:"Blocks unshare creating a user namespace: -U/--user, -r/--map-root-user, -c/--map-current-user, --map-user(s), --map-group(s), or --map-auto.",example:"unshare -r id",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ml=new Set(Uu.map((n)=>n.id)),Y=Uu,UC=new Map(Y.map((n)=>[n.id,n.intent]));function st(n,u){return{id:n,reason:u,intent:UC.get(n)??"manual_only"}}var fl=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],fs={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},HC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],jC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],pl=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...jC.flatMap((n)=>HC.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var ps=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Hu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],VC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],gl=Hu.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),hl=Hu.flatMap((n)=>VC.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),ci={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},yl=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),Sl=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...fl,fs,...pl,...gl,...hl,ci,...yl,...Sl,...ps].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),gs=new Set(ps.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),Cl=new Set(xt.map((n)=>n.id));import{isAbsolute as bl,join as qC,normalize as KC,sep as hs}from"node:path";var ys=process.platform==="win32",ju=/[*?]/;function El(n){let u=n.trim(),v=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(ys?u.replaceAll("\\","/"):u);if(!v)return null;let W=v[1]??"",z=v[2]??"";if(ju.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function di(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function vl(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let v=di(n.trim(),u);if(!bl(v))return"must be an absolute path or start with ~/";return ui(v,u)}function Rl(n,u){let v=Vu(n,u);if(v===null)return"must be a non-empty path string";if(!bl(v))return null;if(ui(v,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var YC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ZC="cannot cover the guard's own configuration";function Vu(n,u){if(typeof n!=="string"||n.trim()==="")return null;let v=n.trim(),W=ys?v.replaceAll("\\","/"):v;return di(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function wl(n,u){let v=Vu(n,u);if(v===null)return"must be a non-empty path string";let W=El(v)?.root??v;if(ju.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bl(W))return null;if(ui(W,u)!==null)return YC;return XC(W,u)?ZC:null}function XC(n,u){let v=Ss(n),W=Ss(qC(u,".cc-safety-net"));return v===W||v.startsWith(`${W}${hs}`)}function ui(n,u){let v=Ss(n),W=Ss(u);if(v===W)return"cannot be the home directory";let z=v.endsWith(hs)?v:`${v}${hs}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function Ss(n){let u=KC(n);if(ys)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(ys?3:1)&&u.endsWith(hs))u=u.slice(0,-1);return u}var qu=30,Cs=1,bs=365;function Ku(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Yu=new Set(Y.filter((n)=>n.catastrophic).map((n)=>n.id));function Ft(n,u){if(!n)return null;if(Yu.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let v=u?.effectiveDestructiveCommandRules[n.id];return v&&!v.enabled?null:n}function dn(n,u,v){if(Yu.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??v}function Z(n,u){return Object.freeze(Object.fromEntries(Y.map((v)=>{let W=v.activationCapability?u[v.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[v.id],X=v.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...v.activationCapability?{activationCapability:v.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...v.activationCapability?{activationCapability:v.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...v.activationCapability?{activationCapability:v.activationCapability}:{},...B?{override:B}:{}};return[v.id,Object.freeze(X)]})))}function Zu(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:Z(n,u)})}var Xu={standard:0,strict:1,paranoid:2};function se(n,u,v=!1,W=n.safety.level){let z=QC(n,u,W),B=new Set(v?z.map((be)=>be.field):[]),X=(be,Oe)=>B.has(be)?void 0:Oe,Q=(be,Oe)=>Object.fromEntries(Object.entries(Oe??{}).filter(([De])=>!B.has(`${be}.${De}`))),le=(be,Oe)=>Oe?.filter((De)=>!B.has(`${be}.${De}`));return{policy:{version:1,safety:{level:X("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...Q("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:X("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:X("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...Q("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:_l(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:X("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...Q("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:_l(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:_l(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((be)=>be.message)}}function _l(n,u){return[...new Set([...n,...u??[]])]}function QC(n,u,v){let W=u.safety?.level,z=Ji[v];return[...W&&Xu[W]<Xu[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...So.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Qu("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...Qu("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!gs.has(B))),...n.destructive_command_protection.enabled?Ju(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?Ju(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function Qu(n,u,v){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&v(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function Ju(n,u){return(u??[]).filter((v)=>!n.includes(v))}var Al=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:qu}};function nm(n,u){let v=sb(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:et(S(u.cwd),n.home),z=ve(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),X=v.gui??ae,Q=Object.keys(z.policy).length>0?se(X,z.policy,B,Kd(X.safety.level,n.env)):void 0,le=[...v.errors,...W.errors,...z.diagnostics],ue=(v.fallback==="defaults"&&Q?"salvaged":v.fallback)??(v.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),be=z.policy.safety?.level&&Q?.policy.safety.level===z.policy.safety.level?"project":v.levelPresent?"user":"default";return{...Q?mi(Q.policy):v.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:be,weakenings:Q?.weakenings??[],weakeningsIgnored:B}}:{}}}var tb="project policy audit settings are ignored; audit is user scope only";function ve(n,u){if(!Ln(n))return{policy:{},diagnostics:[]};let v=Ln(n.safety)?n.safety:{},W=Ln(n.workflow)?n.workflow:{},z=Ln(n.destructive_command_protection)?n.destructive_command_protection:{},B=Ln(n.secret_protection)?n.secret_protection:{},X={...Al.has(v.level)?{level:v.level}:{},...Ln(v.overrides)?em({overrides:rm(v.overrides,So,["safety","overrides"],Ur)}):{}},Q={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:Es(z.overrides,ml,im,Ur)}:{},...z.allow_paths!==void 0?{allow_paths:Eo(z.allow_paths,vl,u,["destructive_command_protection","allow_paths"],Ur)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:Es(B.overrides,Cl,sm,Ur)}:{},...B.deny_paths!==void 0?{deny_paths:Eo(B.deny_paths,Rl,u,["secret_protection","deny_paths"],Ur)}:{},...B.allow_paths!==void 0?{allow_paths:Eo(B.allow_paths,wl,u,["secret_protection","allow_paths"],Ur)}:{}};return{policy:em({safety:X,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:Q,secret_protection:le}),diagnostics:n.audit===void 0?[]:[tb]}}function rm(n,u,v,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...v,z],Pl));return[]}))}function em(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Ur=()=>{return},Pl="must be a boolean",Tl="must be an object if provided",om=`must be an integer between ${Cs} and ${bs}`,im={path:["destructive_command_protection","overrides"],label:"destructive command"},sm={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let v=[];return{policy:am(n,u,(z)=>{v.push(z)}),issues:v}}function _(n,u){return am(n,u,Ur)}function am(n,u,v){if(!Ln(n))return v(e([],"Config must be an object")),N();if(n.version!==1)v(e(["version"],"must be 1"));let W=bo(n.safety,["safety"],["level","overrides"],v),z=bo(W.overrides,["safety","overrides"],So,v),B=bo(n.workflow,["workflow"],["worktree_mode"],v),X=bo(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],v),Q=bo(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],v),le=bo(n.audit,["audit"],["retention_days"],v);return lm(n,St,[],v),{version:1,safety:{level:nb(W.level,v),overrides:rm(z,So,["safety","overrides"],v)},workflow:{worktree_mode:xl(B.worktree_mode,["workflow","worktree_mode"],!1,v)},destructive_command_protection:{enabled:xl(X.enabled,["destructive_command_protection","enabled"],!0,v),overrides:Es(X.overrides,ml,im,v),allow_paths:Eo(X.allow_paths,vl,u,["destructive_command_protection","allow_paths"],v)},secret_protection:{enabled:xl(Q.enabled,["secret_protection","enabled"],!0,v),overrides:Es(Q.overrides,Cl,sm,v),deny_paths:Eo(Q.deny_paths,Rl,u,["secret_protection","deny_paths"],v),allow_paths:Eo(Q.allow_paths,wl,u,["secret_protection","allow_paths"],v)},audit:{retention_days:rb(le.retention_days,v)}}}function bo(n,u,v,W){if(n===void 0)return{};if(!Ln(n))return W(e(u,Tl)),{};return lm(n,v,u,W),n}function lm(n,u,v,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:v,message:z,kind:"unknownKeys"})}function nb(n,u){if(n===void 0)return"standard";if(Al.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function xl(n,u,v,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,Pl));return v}function rb(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=Cs&&n<=bs))u(e(["audit","retention_days"],om));return Ku(n)}function Es(n,u,v,W){if(n===void 0)return{};if(!Ln(n))return W(e(v.path,Tl)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...v.path,z],message:`unknown ${v.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...v.path,z],'must be "on" or "off"')),[]}))}function Eo(n,u,v,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,X)=>{let Q=u(B,v);if(Q===null)return[B];return z(typeof B==="string"?cn([...W,X],Q):e([...W,X],Q)),[]})}function Ln(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Qe(n,u){let v=O({safety:tt(n.safety)},u),W=Z({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},v.capabilities),z=Object.values(W),B=z.filter((X)=>X.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:v.effectiveLevel,capabilities:v.capabilities,rules:W,counts:{enabled:B.filter((X)=>X.enabled).length,disabled:B.filter((X)=>!X.enabled).length,effectiveCustomizations:z.filter((X)=>X.changesInherited).length}}}function et(n,u){if(!JC(n))return{exists:!1,policy:N(),errors:[]};try{let v=eb(n,"utf-8");if(!v.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(v),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${ib(B)}`),fallback:Ln(W)?"salvaged":"defaults"}}catch(v){let W=v instanceof Error?v.message:String(v);return{exists:!0,policy:N(),errors:[`${n}: ${v instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var ob=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Tl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Pl,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[om,`not an integer between ${Cs} and ${bs}`]]);function ib(n){let u=cl(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let v=ob.get(n.message)??n.message;return u===""?v:`${u}: ${v}`}function sb(n,u){let v=et(n,u);if(!v.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ln(W))return{policy:mi(N()),errors:[]};let z=_(W,u);return{policy:mi(z),gui:z,errors:[],levelPresent:tm(W)}}if(v.parsed===void 0)return{policy:mi(N()),errors:v.errors,...v.fallback?{fallback:v.fallback}:{}};return{policy:mi(v.policy),gui:v.policy,errors:v.errors,...v.fallback?{fallback:v.fallback}:{},levelPresent:tm(v.parsed)}}function tm(n){let u=Ln(n)&&Ln(n.safety)?n.safety:{};return Al.has(u.level)}function Ct(n){let u=Object.entries(n),v=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...gs].filter((W)=>!v.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function mi(n){return{safety:tt(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function tt(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let v=ie(n,u),W=nm(n,u),z={rules:v.rules,transparentWrappers:v.transparent_wrappers,commandTools:v.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...v.userConfig?.overrides,...v.projectConfig?.overrides},X=Object.freeze(Object.fromEntries(z.rules.map((Q)=>{let le=v.rulebooks.find((be)=>be.rules.includes(Q.name)),ue=B[Q.name];return[Q.name,Object.freeze({id:Q.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...db(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return Ge(z,ab(v,W),X,W.policyScopes)}function nt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function ab(n,u){let v=cb(u);if(n.errors.length===0&&n.warnings.length===0&&!v)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:ub(n.errors.length>0?lb(n.errors):void 0,n.warnings.length>0?kl(n.warnings.join("; ")):void 0,v)}}function lb(n){return`${kl(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function cb(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function db(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function Ge(n,u,v=Object.freeze({}),W){let z=Il(structuredClone(n)),B=W?{policyScopes:Il(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:v,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:v,...B})}function Il(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))Il(u);return Object.freeze(n)}function ub(...n){return kl(n.filter((u)=>!!u).join("; "))}function kl(n){return/[.!?]$/.test(n)?n:`${n}.`}function _e(n){let u=n.effectiveCapabilities,v=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:Zu(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:ja({failClosed:v,paranoidRm:W,paranoidInterpreters:z}),strict:v,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as jP,isAbsolute as VP,join as dh,parse as qP,resolve as KP,sep as YP}from"node:path";function fi(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let v=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[v]?.provenance;return W!==void 0&&W!=="literal"}var mb=/^[A-Za-z_][A-Za-z0-9_]*=/;function vs(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function pi(n){let u=vs(n.words[0],"time")?1:0,v=u===1&&vs(n.words[u],"-p")?u+1:u,W=u===1&&vs(n.words[v],"--")?v+1:v,z=vs(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((X)=>!mb.test(X.text));return B?.provenance==="literal"?B.text:void 0}var _r=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Rs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function ws(n,u,v){n.push(v),u.reset()}function _s(n){let u=[];return{parts:u,push:(v,W,z)=>{if(W<=v)return;u.push({raw:n.slice(v,W),span:{start:v,end:W},provenance:z})}}}function Ol(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function vo(n,u,v,W,z,B,X){return Ol({text:W,raw:n.slice(u,v),span:{start:u,end:v},provenance:z,quoted:B,...X?{parts:X}:{}})}function Ml(n,u,v){if(u>=v||dm(n[u]??""))return null;let W="",z=!1,B=!1,X=u;while(X<v&&!dm(n[X]??"")){let Q=n[X]??"";if(Q==="'"){z=!0;let le=cm(n,X+1,v,"'");W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==='"'){z=!0;let le=cm(n,X+1,v,'"');W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==="\\"){z=!0;let le=n[X+1];if(!le||le===`
+`||le==="\r"){B=!0;break}W+=le,X+=2;continue}if(Q==="`"||n.startsWith("$(",X)||n.startsWith("${",X)||n.startsWith("<(",X)||n.startsWith(">(",X))B=!0;W+=Q,X++}return{delimiter:W,quoted:z,next:X,ambiguous:B}}function Dl(n,u,v,W){let z=[],B=u;for(let X of W){let Q=B,le=!1;while(B<v){let ue=fb(n,B,v);if((X.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===X.delimiter){X.attach({body:X.stripTabs?pb(n.slice(Q,B)):n.slice(Q,B),delimiter:X.delimiter,quotedDelimiter:X.quotedDelimiter,bodySpan:{start:Q,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${X.delimiter} was not found`}),{next:v,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function cm(n,u,v,W){let z="",B=u;while(B<v&&n[B]!==`
+`&&n[B]!=="\r"){let X=n[B]??"";if(X===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&X==="\\"&&n[B+1]){let Q=n[B+1]??"";z+=["$","`",'"',"\\"].includes(Q)?Q:`\\${Q}`,B+=2;continue}z+=X,B++}return{text:z,next:B,closed:!1}}function dm(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function fb(n,u,v){let W=u;while(W<v&&n[W]!==`
+`)W++;let z=W>=v?v:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function pb(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var gm=new Set(["&&","||","|","|&"]),gb=new Set(["!","do","elif","else","if","then","until","while"]);function hm(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=Ps(n,0,n.length,u,W,0),B=[...z.issues,..._b(n,W.quotedExpansionEnd,z.nodes)?[bm]:[],...Rb.test(n)?[Cm]:[]];return{kind:"program",dialect:"posix",source:n,span:v,status:Is(B,z.limited),issues:B,nodes:z.nodes}}function Ps(n,u,v,W,z,B,X){let Q=[],le=[],ue=Rs(),be=[],Oe=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Me={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);ws(Q,ue,{kind:"command",dialect:"posix",source:n.slice(Me.start,Me.end),span:Me,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&Q.length===0?n.slice(u,v):Ne.join(" ")})},De=u;while(De<v){let Me=n[De];if(!Me)break;if(X&&Me===X)return Oe(),pm(Q,le),{nodes:Q,issues:le,next:De+1,closed:!0,limited:!1,pendingHeredocs:be};if(hi(Me)){if(Me.charCodeAt(0)>127)le.push(Cm);if(Me===`
+`||Me==="\r"){Oe();let Rt=Me==="\r"&&n[De+1]===`
+`?De+2:De+1,Tt=Q.at(-1);if(Tt?.kind!=="connector"||!gm.has(Tt.operator))Q.push({kind:"connector",operator:n.slice(De,Rt),span:{start:De,end:Rt}});if(be.length>0){let kt=Dl(n,Rt,v,be.splice(0));le.push(...kt.issues),De=kt.next;continue}De=Rt;continue}De++;continue}if(Me==="\\"&&n[De+1]===`
+`){De+=2;continue}if(Me==="#"){while(De<v&&n[De]!==`
+`&&n[De]!=="\r")De++;continue}let Ne=ue.start===-1?Ub(n,De,v):void 0;if(Ne){if(Ll(Q,le),B>=W.maxDepth)return Ro(Q,le,De,"depth-limit",W.maxDepth);if(!Nl(z))return Ro(Q,le,De,"word-limit",W.maxWords);let Rt=Ps(n,Ne.braceIndex+1,v,W,z,B+1,"}"),Tt=Rt.next,kt={start:Ne.braceIndex+1,end:Rt.closed?Tt-1:Tt},lt=um(n,kt,Rt);if(Q.push({kind:"function",name:Ne.name,span:{start:De,end:Tt},body:lt}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||yi(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(be.push(...Rt.pendingHeredocs),Rt.limited)return As(Q,le,Rt.next);if(!Rt.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});De=Tt;continue}let Le=Ts(n,De);if(Le){if(Oe(),!Am(Q.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});Q.push({kind:"connector",operator:Le,span:{start:De,end:De+Le.length}}),De+=Le.length;continue}if(Me===")"){Oe(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Q.push({kind:"unknown",source:Me,span:{start:De,end:De+1}}),De++;continue}if((Me==="("||Me==="{"&&Ib(n,De,v))&&ue.start===-1){if(Ll(Q,le),B>=W.maxDepth)return Ro(Q,le,De,"depth-limit",W.maxDepth);let Rt=Me==="("?")":"}",Tt=Ps(n,De+1,v,W,z,B+1,Rt),kt=Tt.next,lt={start:De+1,end:Tt.closed?kt-1:kt},jt=um(n,lt,Tt);if(Q.push({kind:"group",style:Me==="("?"subshell":"brace",span:{start:De,end:kt},body:jt}),le.push(...Tt.issues),Tt.pendingHeredocs.length>0||yi(Tt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(be.push(...Tt.pendingHeredocs),Tt.limited)return As(Q,le,Tt.next);if(!Tt.closed)le.push({code:Me==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Me} group is not closed`});De=kt;continue}let We=(Me==="<"||Me===">")&&n[De+1]!=="("?Cb(n,De):null;if(We){let Rt=ue.words.at(-1),Tt=Rt&&Rt.span.end===De&&/^[0-9]+$/.test(Rt.raw)?Number(Rt.raw):void 0;if(Tt!==void 0)ue.words.pop();let kt=Tt===void 0?De:Rt?.span.start??De;ue.start=ue.start===-1?De:ue.start;let lt=De+We.length;while(lt<v&&/[ \t]/.test(n[lt]??""))lt++;let jt=n[lt],Bt=lt>De+We.length&&jt==="#",sn=!jt||hi(jt)||!!Ts(n,lt)||jt===X||jt===")"||Bt||(jt==="<"||jt===">")&&n[lt+1]!=="(",yn=We==="<<"||We==="<<-",ut=yn?Ml(n,lt,v):void 0,Gt=ut?{word:vo(n,lt,ut.next,ut.delimiter,"literal",ut.quoted),nested:[],issues:[],next:ut.next,limited:!1}:!sn?Wl(n,lt,v,W,z,B):void 0;if(Gt){if(le.push(...Gt.issues),Gt.limited)return As(Q,le,Gt.next);if(!Nl(z))return Ro(Q,le,Gt.next,"word-limit",W.maxWords)}let Xt=Gt?.next??De+We.length,rn={kind:"redirection",operator:We,span:{start:kt,end:Xt},...Tt===void 0?{}:{fd:Tt},...Gt?{target:Gt.word}:{}};if(ue.redirections.push(rn),yn&&!ut)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(ut){if(ut.ambiguous||ut.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let un=ue.nested;be.push({delimiter:ut.delimiter,quotedDelimiter:ut.quoted,stripTabs:We==="<<-",attach:(En)=>{if(rn.heredoc=En,En.quotedDelimiter)return;let on=yb(n,En.bodySpan.start,En.bodySpan.end,W,z,B+1);un.push(...on.programs),le.push(...on.issues)}})}if(!yn&&!Gt)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(Gt)ue.nested.push(...Gt.nested);ue.end=Xt,De=Xt;continue}let it=ue.start===-1;if(it)Ll(Q,le);let Be=Wl(n,De,v,W,z,B);if(le.push(...Be.issues),Be.limited)return As(Q,le,Be.next);let ze=Mb(ue.words)?Fb(n,Be.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(ze?.limitCode)return Ro(Q,le,Be.next,ze.limitCode,ze.limitCode==="word-limit"?W.maxWords:ze.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let at=ze?.words??[Be.word];for(let Rt of at){if(!Nl(z))return Ro(Q,le,Be.next,"word-limit",W.maxWords);ue.words.push(Rt)}if(ue.start=ue.start===-1?De:ue.start,ue.end=Be.next,ue.nested.push(...Be.nested),it&&Pm(Be.word))Oe();De=Be.next>De?Be.next:De+1}return Oe(),pm(Q,le),le.push(...Hb(be)),{nodes:Q,issues:le,next:De,closed:X===void 0,limited:!1,pendingHeredocs:[]}}function um(n,u,v){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:Is(v.issues,v.limited),issues:v.issues,nodes:v.nodes}}function Wl(n,u,v,W,z,B){let X="",Q=u,le=!1,ue="literal",be=[],Oe=[],De=!1;while(Q<v){let Me=n[Q],Ne=(Me==="<"||Me===">")&&n[Q+1]==="(";if(!Me||hi(Me)||(Me===";"||Me==="|"||Me==="&")&&Ts(n,Q)||(Me==="<"||Me===">")&&!Ne)break;if(Me===")")break;if(Me==="'"){le=!0;let it=n.indexOf("'",Q+1);if(it===-1||it>=v){X+=n.slice(Q+1,v),Oe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Q=v;break}X+=n.slice(Q+1,it),Q=it+1;continue}if(Me==='"'){le=!0;let it=hb(n,Q,v,W,z,B);if(X+=it.text,be.push(...it.nested),Oe.push(...it.issues),De||=it.limited,ue=gi(ue,it.provenance),Q=it.next,De)break;continue}if(n.startsWith("$'",Q)){le=!0;let it=Ab(n,Q+2,v);if(X+=it.text,Oe.push(...it.issues),!it.closed)Oe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Q=it.next;continue}if(Me==="\\"){let it=n[Q+1];if(!it){Oe.push({code:"trailing-escape",message:"escape has no following character"}),Q++;break}if(it===`
+`){Q+=2;continue}X+=it,Q+=2;continue}if(jr(n,Q))Oe.push(Hr);let Le=Me==="$"||Me==="<"||Me===">"||Me==="`"?Si(n,Q,v,W,z,B):null,We=Le?Gl(Le,be,Oe):Em(n,Q,v,W,z,B,be,Oe);if(We){if(We.provenance==="variable")X+=n.slice(Q,We.next);if(De||=We.limited,ue=gi(ue,We.provenance),Q=We.next,De)break;continue}if(Me==="$"){let it=Rm(n,Q,v,X,ue);X=it.text,ue=it.provenance,Q=it.next;continue}if(Me==="*"||Me==="?"||Me==="[")ue=gi(ue,"glob");X+=Me,Q++}return{word:vo(n,u,Q,X,ue,le,ue==="literal"?void 0:Tb(n,u,Q)),nested:be,issues:Oe,next:Q,limited:De}}function hb(n,u,v,W,z,B){let X="",Q="literal",le=[],ue=[],be=!1,Oe=u+1;while(Oe<v){let De=n[Oe];if(De==='"')return{text:X,provenance:Q,nested:le,issues:ue,next:Oe+1,limited:be};if(De==="\\"&&n[Oe+1]){let Le=n[Oe+1]??"";if(Le===`
+`){Oe+=2;continue}if(Le==="\r"&&n[Oe+2]===`
+`){Oe+=3;continue}X+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,Oe+=2;continue}if(jr(n,Oe))ue.push(Hr);let Me=Si(n,Oe,v,W,z,B),Ne=Me?Gl(Me,le,ue):Em(n,Oe,v,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")X+=n.slice(Oe,Ne.next);if(Oe=Ne.next,be||=Ne.limited,Q=gi(Q,Ne.provenance),be)return{text:X,provenance:Q,nested:le,issues:ue,next:Oe,limited:be};continue}if(De==="$"){let Le=Rm(n,Oe,v,X,Q);X=Le.text,Q=Le.provenance,Oe=Le.next;continue}X+=De??"",Oe++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:X,provenance:Q,nested:le,issues:ue,next:v,limited:be}}function Si(n,u,v,W,z,B){let X=Sm(n,u);if(!X)return null;let{length:Q,closing:le}=X,ue=le==="))",be=le==="`",Oe=n[u]==="<"||n[u]===">",De=zl(n,u+Q,v,le),Me=De===-1?v:De,Ne=De===-1?v:De+le.length;if(B>=W.maxDepth)return{program:Bb(n,u+Q,Me,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let at=[],Rt=[],Tt=!1,kt=u+Q;while(kt<Me){let lt=Si(n,kt,Me,W,z,B+1);if(!lt){if(jr(n,kt))Rt.push(Hr);kt++;continue}if(at.push(...lt.program.nodes),Rt.push(...lt.program.issues),Tt||=lt.program.status==="limited",kt=lt.next,Tt)break}if(De===-1)Rt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Me),span:{start:u+Q,end:Me},status:Is(Rt,Tt),issues:Rt,nodes:at},next:Ne,provenance:"arithmetic"}}let Le=Ps(n,u+Q,Me,W,z,B+1),We=De===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+Q)} substitution is not closed`}]:[],it=(be||Oe)&&yi(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],Be=be&&/\\[\\$`\n]/.test(n.slice(u+Q,Me))?[xb]:[],ze=[...Le.issues,...We,...it,...Be];return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Me),span:{start:u+Q,end:Me},status:Is(ze,Le.limited),issues:ze,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function yb(n,u,v,W,z,B){let X=[],Q=[],le=u;while(le<v){let ue=n[le];if(ue==="\\"){le+=2;continue}let be=ue==="$"||ue==="`"?Si(n,le,v,W,z,B):null;if(!be){if(jr(n,le))Q.push(Hr);le++;continue}if(X.push(be.program),bb(n,le,be.next)&&Eb(be.program))Q.push(Hr);le=be.next}return{programs:X,issues:Q}}function Gl(n,u,v){return u.push(n.program),v.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function zl(n,u,v,W){if(W==="`"){for(let Q=u;Q<v;Q++){if(n[Q]==="\\"){Q++;continue}if(n[Q]==="`")return Q}return-1}let z={single:!1,double:!1},B=[],X=[];for(let Q=u;Q<v;Q++){let le=n[Q];if((le===`
+`||le==="\r")&&X.length>0){let Oe=le==="\r"&&n[Q+1]===`
+`?Q+2:Q+1,De=Dl(n,Oe,v,X.splice(0));if(!De.terminated)return-1;Q=De.next-1;continue}let ue=ym(n,Q,u,v,z);if(ue!==null){Q=ue;continue}if(!z.double&&n.startsWith("$((",Q)){let Oe=Sb(n,Q+3,v);if(Oe===-1)return-1;Q=Oe+1;continue}if(W===")"&&!z.double&&le==="<"&&n[Q+1]==="<"&&n[Q+2]!=="<"){let Oe=n[Q+2]==="-",De=Q+(Oe?3:2);while(De<v&&/[ \t]/.test(n[De]??""))De++;let Me=Ml(n,De,v);if(Me){X.push({delimiter:Me.delimiter,quotedDelimiter:Me.quoted,stripTabs:Oe,attach:()=>{return}}),Q=Me.next-1;continue}}if(n.startsWith("$(",Q)&&!n.startsWith("$((",Q)){B.push(z),z={single:!1,double:!1},Q++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let be=B.pop();if(be){z=be;continue}return W==="))"&&n[Q+1]!==")"?-1:Q}return-1}function Sb(n,u,v){let W=1,z={single:!1,double:!1};for(let B=u;B<v;B++){let X=n[B],Q=ym(n,B,u,v,z);if(Q!==null){B=Q;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(X==="("&&!z.double)W++;if(X!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function ym(n,u,v,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!jb(n,u,v))return null;let X=u;while(X+1<W&&n[X+1]!==`
+`&&n[X+1]!=="\r")X++;return X}function Ts(n,u){let v=n[u];if(v===";")return";";if(v==="&")return n[u+1]==="&"?"&&":"&";if(v==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function Cb(n,u){let v=n[u];if(v===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(v!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function hi(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var Hr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function jr(n,u){if(n[u]!=="$")return!1;let v=mm(n,u+1);if(n[v]!=="{")return!1;let W=n[mm(n,v+1)]??"";return W==="|"||hi(W)}function bb(n,u,v){for(let W=n.indexOf("$",u);W!==-1&&W<v;W=n.indexOf("$",W+1))if(jr(n,W))return!0;return!1}function Eb(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===Hr.code)}function mm(n,u){let v=u;while(n.startsWith("\\\n",v)||n.startsWith(`\\\r
+`,v))v+=n[v+1]==="\r"?3:2;return v}function Sm(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var vb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Rb=/[\v\f\r]/,Cm=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),bm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),wb=/\$\(|`|[<>]\(/g;function _b(n,u,v){let W=Fl(v);return[...n.slice(u).matchAll(wb)].some((z)=>{let B=u+z.index;return!W.some((X)=>B>=X.start&&B<X.end)})}function Fl(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((v)=>v.heredoc?[v.heredoc.bodySpan]:[]),...u.nested.flatMap((v)=>Fl(v.nodes))];return u.kind==="group"||u.kind==="function"?Fl(u.body.nodes):[]})}var xb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Em(n,u,v,W,z,B,X,Q){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=ks(n,u+2,v),ue=le.close===-1?v:le.close+1;if(le.close===-1)Q.push(vb);if(le.quoted&&le.substitutions.length>0||le.continued)Q.push(bm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let be=le.substitutions.some((Oe)=>{if(jr(n,Oe))return Q.push(Hr),!1;let De=Si(n,Oe,ue,W,z,B);return De!==null&&Gl(De,X,Q).limited});return{provenance:"variable",next:ue,limited:be}}function ks(n,u,v){let W=[],z=!1,B=!1,X=1,Q=u;while(Q<v){let le=n[Q];if(le==="$"&&jr(n,Q))W.push(Q);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[Q+1]===`
+`,Q+=le==="\\"?2:1;continue}let ue=Sm(n,Q);if(ue){W.push(Q);let be=zl(n,Q+ue.length,v,ue.closing);if(be===-1)break;Q=be+ue.closing.length;continue}if(le==="$"&&n[Q+1]==="{"){X++,Q+=2;continue}if(le==="}"&&--X===0)return{close:Q,substitutions:W,quoted:z,continued:B};Q++}return{close:-1,substitutions:W,quoted:z,continued:B}}function vm(n,u,v){if(n[u+1]==="{"){let z=ks(n,u+2,v).close;return z===-1?v:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<v&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function Ab(n,u,v){let W="",z=[],B=u;while(B<v){let X=n[B];if(X==="'")return{text:W,next:B+1,closed:!0,issues:z};if(X!=="\\"){W+=X??"",B++;continue}let Q=Pb(n,B+1,v);if(W+=Q.text,Q.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Q.invalidCodePoint}`});B=Q.next}return{text:W,next:v,closed:!1,issues:z}}function Pb(n,u,v){let W=n[u];if(!W||u>=v)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return xs(n,u+1,v,16,2,u+1);if(W==="u")return xs(n,u+1,v,16,4,u+1);if(W==="U")return xs(n,u+1,v,16,8,u+1);if(/[0-7]/.test(W))return xs(n,u,v,8,3,u+1);return{text:W,next:u+1}}function xs(n,u,v,W,z,B){let X=W===16?/[0-9a-fA-F]/:/[0-7]/,Q="",le=u;while(le<v&&Q.length<z&&X.test(n[le]??""))Q+=n[le],le++;if(!Q)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(Q,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function Is(n,u=!1){if(u)return"limited";if(n.some((v)=>v.code==="invalid-ansi-c-code-point"||v.code==="missing-heredoc-delimiter"||v.code==="ambiguous-heredoc-delimiter"||v.code==="unterminated-heredoc"||v.code==="unsupported-heredoc-context"||v.code==="unsupported-function-substitution"||v.code==="unsupported-backtick-escape"||v.code==="unclosed-parameter-expansion"||v.code==="unsupported-parameter-expansion"||v.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function Rm(n,u,v,W,z){let B=vm(n,u,v);return{text:W+n.slice(u,B),provenance:gi(z,"variable"),next:B}}function Tb(n,u,v){let W=_s(n),z=u,B=!1,X=!1,Q=u;while(Q<v){let le=n[Q];if(le==="\\"&&!B){Q+=2;continue}if(!X&&le==="'"){B=!B,Q++;continue}if(!B&&le==='"'){X=!X,Q++;continue}if(B){Q++;continue}let ue=n.startsWith("$((",Q),be=n.startsWith("$(",Q)&&!ue,Oe=!X&&(n.startsWith("<(",Q)||n.startsWith(">(",Q)),De=le==="`";if(ue||be||Oe||De){let Me=ue?3:De?1:2,Ne=ue?"))":De?"`":")",Le=zl(n,Q+Me,v,Ne),We=Le===-1?v:Le+Ne.length;W.push(z,Q,"literal"),W.push(Q,We,ue?"arithmetic":"command-substitution"),Q=We,z=We;continue}if(le==="$"){let Me=vm(n,Q,v);if(Me>Q+1){W.push(z,Q,"literal"),W.push(Q,Me,"variable"),Q=Me,z=Me;continue}}if(!X&&(le==="*"||le==="?"||le==="[")){W.push(z,Q,"literal"),W.push(Q,Q+1,"glob"),Q++,z=Q;continue}Q++}return W.push(z,v,"literal"),W.parts}function gi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function Ib(n,u,v){return u+1>=v||hi(n[u+1]??"")||Ts(n,u+1)!==null}var kb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let v=Db(n,u);if(v===void 0||v===null)return!1;u=v}return!1}function Db(n,u){let v=n[u]?.text.toLowerCase();if(v==="command")return Nb(n,u);if(v==="env")return Lb(n,u);if(v==="sudo")return Wb(n,u);return}function Nb(n,u){if(n[u+1]?.text==="-v")return null;for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return v}return n.length}function Lb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(kb.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return v}return n.length}function Wb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(Ob.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-"))continue;return v}return n.length}function wm(n,u,v,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=_m(n.raw,u,v,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((X)=>xm(X,v));if(B.some((X)=>X===null))return{limited:!0};return{words:[...new Set(B.filter((X)=>X!==null&&X!==""))]}}function Fb(n,u,v,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=_m(u.raw,v,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let X=B.values.map((Q)=>xm(Q,W));if(X.some((Q)=>Q===null))return;return{words:X.filter((Q)=>Q!==null&&Q!=="").map((Q)=>vo(n,u.span.start,u.span.end,Q,"literal",!1))}}function _m(n,u,v,W,z){let B=[n],X=n.length,Q=0;while(!0){let le=B.findIndex((Me)=>fm(Me,z));if(le===-1)break;if(++Q>v)return{limited:"expansions"};let ue=B[le]??"",be=fm(ue,z);if(!be||be.kind==="range")return{limited:"expansions"};let Oe=be.start+ue.length-be.end,De=be.alternatives.reduce((Me,Ne)=>Me+Oe+Ne.length,0);if(X-ue.length+De>W)return{limited:"length"};if(B.length-1+be.alternatives.length>u)return{limited:"words"};B.splice(le,1,...Gb(ue,be)),X+=De-ue.length}return Q===0?void 0:{values:B}}function fm(n,u){let v=[],W,z=null,B=!1;for(let X=0;X<n.length;X++){let Q=n[X];if(B){B=!1;continue}if(Q==="\\"&&z!=="'"){B=!0;continue}if(Q===z){z=null;continue}if(z===null&&(Q==="'"||Q==='"')){z=Q;continue}if(z!==null)continue;if(Q==="{"){v.push({start:X,commas:[]});continue}if(Q===","&&v.length>0){v.at(-1)?.commas.push(X);continue}if(Q!=="}"||v.length===0)continue;let le=v.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:X+1,commas:le.commas}:u&&$b(n.slice(le.start+1,X))?{kind:"range",start:le.start,end:X+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:zb(n,W)}}function Gb(n,u){return u.alternatives.map((v)=>`${n.slice(0,u.start)}${v}${n.slice(u.end)}`)}function zb(n,u){let v=[u.start,...u.commas,u.end-1];return v.slice(0,-1).map((W,z)=>n.slice(W+1,v[z+1]))}function $b(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function xm(n,u){let v=`x${n}`,W=Wl(v,0,v.length,{maxInputLength:v.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==v.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function Bb(n,u,v,W){return{kind:"program",dialect:"posix",source:n.slice(u,v),span:{start:u,end:v},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function Ro(n,u,v,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function As(n,u,v){return{nodes:n,issues:u,next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function Nl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function Ub(n,u,v){let W=n.slice(u,v),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function yi(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((v)=>v.heredoc)||u.nested.some((v)=>yi(v.nodes));return(u.kind==="group"||u.kind==="function")&&yi(u.body.nodes)})}function Hb(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function Am(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function pm(n,u){let v=n.at(-1);if(v?.kind!=="connector"||!gm.has(v.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${v.operator} requires a following command`})}function Pm(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&gb.has(n.text)}function Ll(n,u){let v=n.at(-1);if(!Am(v))return;if(v?.kind==="command"&&Pm(v.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function jb(n,u,v){return u===v||/[\s;&|()]/u.test(n[u-1]??"")}var Im=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object","iex","invoke-expression"]),Vb=new Set(["gc","cat","type","cp","mv","rm"]),km=["-rec","-for","-path","-literalpath","-whatif"],qb=/^\$env:\w/i,Kb=/^(?:\$\{?\w+\}?|~)\\./;function Om(n,u){let v=n.toLowerCase().replaceAll("`","");if(![...Im].some((z)=>v.includes(z))&&!(v.includes("rm")&&km.some((z)=>v.includes(z)))&&!v.includes("<#")&&!Yb(v))return!1;let W=Hl(n,u);if(Mm(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||Ul(W).some(Zb)}function Mm(n){return n.nodes.some((u)=>{if(u.kind==="group")return Mm(u.body);if(u.kind!=="command")return!1;return u.redirections.some((v)=>v.operator==="<<")})}function Yb(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function Zb(n){let u=n[0]==="&"||n[0]==="."?1:0,v=n[u]?.toLowerCase();if(v&&Im.has(v))return!0;let W=n.slice(u+1);if(v&&Vb.has(v)&&W.some(Xb))return!0;if(v!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return km.some((X)=>B.startsWith(X))})}function Xb(n){return qb.test(n)||Kb.test(n)}function Hl(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=jl(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:v,status:nE(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function jl(n,u,v,W,z,B=!1){let X=[],Q=[],le=Rs(),ue=0,be=!1,Oe=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Me={start:le.start,end:le.end};ws(X,le,{kind:"command",dialect:"powershell",source:n.slice(Me.start,Me.end),span:Me,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},De=u;while(De<v){let Me=n[De];if(!Me)break;if(B&&Me==="}")return Oe(),{nodes:X,issues:Q,next:De+1,closed:!0,words:ue,limited:be};let Ne=tE(n,De,v,W.maxDepth);if(Ne){if(Ne.issue)Q.push(Ne.issue);if(Ne.limited)return Oe(),{nodes:X,issues:Q,next:Ne.next,closed:!1,words:ue,limited:!0};De=Ne.next;continue}if(/\s/.test(Me)){if(Me==="\r"||Me===`
+`){Oe();let it=Me==="\r"&&n[De+1]===`
+`?De+2:De+1;X.push($l(n,De,it)),De=it;continue}De++;continue}let Le=Lm(n,De);if(Le){Oe(),X.push($l(n,De,De+Le.length)),De+=Le.length;continue}if(Me==="{"){if(Oe(),z>=W.maxDepth)return Q.push(Nm(W.maxDepth)),{nodes:X,issues:Q,next:v,closed:!1,words:ue,limited:!0};let it=jl(n,De+1,v,W,z+1,!0),Be=it.closed?it.next-1:it.next,ze={kind:"program",dialect:"powershell",source:n.slice(De+1,Be),span:{start:De+1,end:Be},status:it.limited?"limited":it.issues.length>0?"partial":"complete",issues:it.issues,nodes:it.nodes};if(X.push({kind:"group",style:"brace",span:{start:De,end:it.next},body:ze}),Q.push(...it.issues),!it.closed)Q.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=it.words,be||=it.limited,De=it.next;continue}if(Me==="}"){Oe(),X.push($l(n,De,De+1)),De++;continue}if(Me===">"||Me==="<"){le.start=le.start===-1?De:le.start;let it=n[De+1]===Me?De+2:De+1,Be=it;while(/[ \t]/.test(n[Be]??""))Be++;let ze=Be<v?Tm(n,Be,v,W,z):void 0,at=ze?.next??it;if(le.redirections.push({kind:"redirection",operator:n.slice(De,it),span:{start:De,end:at},...ze?{target:ze.word}:{}}),ze)Q.push(...ze.issues),le.nested.push(...ze.nested),ue+=ze.words,be||=ze.limited;le.end=at,De=at;continue}if(Me===","){le.start=le.start===-1?De:le.start,le.words.push(Ol({text:",",raw:",",span:{start:De,end:De+1},provenance:"literal",quoted:!1})),le.end=++De;continue}let We=Tm(n,De,v,W,z);if(le.start=le.start===-1?De:le.start,le.end=We.next,le.words.push(We.word),Q.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,be||=We.limited,ue>W.maxWords)return Q.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),Oe(),{nodes:X,issues:Q,next:We.next,closed:!1,words:ue,limited:!0};De=We.next>De?We.next:De+1}return Oe(),{nodes:X,issues:Q,next:De,closed:!B,words:ue,limited:be}}function Tm(n,u,v,W,z){let B="",X="literal",Q=!1,le=[],ue=[],be=0,Oe=!1,De=(Ne)=>{let Le=Qb(n,Ne,v,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),be+=Bl(Le.program),Oe||=Le.program.status==="limited",X="command-substitution",Le.next},Me=u;while(Me<v){let Ne=n[Me];if(!Ne||/\s/.test(Ne)||Lm(n,Me)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let Le=n[Me+1];if(!Le){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Me++;break}B+=Le,Me+=2;continue}if(n.startsWith("$(",Me)){Me=De(Me);continue}if(Ne==="'"){Q=!0,Me++;let Le=!1;while(Me<n.length){if(n[Me]==="'"&&n[Me+1]==="'"){B+="'",Me+=2;continue}if(n[Me]==="'"){Le=!0,Me++;break}B+=n[Me]??"",Me++}if(!Le)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Ne==='"'){Q=!0,Me++;let Le=!1;while(Me<v){let We=n[Me];if(We==="`"&&n[Me+1]){B+=n[Me+1],Me+=2;continue}if(We==='"'){Le=!0,Me++;break}if(n.startsWith("$(",Me)){Me=De(Me);continue}if(We==="$")X=n[Me+1]==="("?"command-substitution":"variable";B+=We??"",Me++}if(!Le)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")X=n[Me+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Me===u)X="variable";B+=Ne,Me++}return{word:vo(n,u,Me,B,X,Q,X==="literal"?void 0:Jb(n,u,Me)),next:Me,issues:le,nested:ue,words:be,limited:Oe}}function Qb(n,u,v,W,z){let B=Dm(n,u+2,v),X=B===-1?v:B,Q=B===-1?v:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:"limited",issues:[Nm(W.maxDepth)],nodes:[]},next:Q};let le=jl(n,u+2,X,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:Q}}function Dm(n,u,v){let W=1,z=!1,B=!1;for(let X=u;X<v;X++){let Q=n[X];if(Q==="`"){X++;continue}if(!B&&Q==="'"){if(z&&n[X+1]==="'"){X++;continue}z=!z;continue}if(!z&&Q==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",X)){W++,X++;continue}if(!B&&Q==="(")W++;if(Q!==")")continue;if(W--,W===0)return X}return-1}function Bl(n){let u=0;for(let v of n.nodes){if(v.kind==="group")u+=Bl(v.body);if(v.kind==="command"){u+=v.words.length;for(let W of v.nested)u+=Bl(W)}}return u}function Jb(n,u,v){let W=_s(n),z=u,B=!1,X=u;while(X<v){let Q=n[X];if(Q==="`"){X+=2;continue}if(Q==="'"){if(B&&n[X+1]==="'"){X+=2;continue}B=!B,X++;continue}if(B){X++;continue}if(n.startsWith("$(",X)){let le=Dm(n,X+2,v),ue=le===-1?v:le+1;W.push(z,X,"literal"),W.push(X,ue,"command-substitution"),X=ue,z=ue;continue}if(Q==="$"||Q==="@"&&X===u){let le=eE(n,X+1,v);W.push(z,X,"literal"),W.push(X,le,"variable"),X=le,z=le;continue}X++}return W.push(z,v,"literal"),W.parts}function eE(n,u,v){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=v?v:z+1}let W=u;while(W<v&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function Nm(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function Ul(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return Ul(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((v)=>v.target?[v.target]:[])].sort((v,W)=>v.span.start-W.span.start).filter((v)=>v.text!==""&&v.raw!==",").map((v)=>v.text),...u.nested.flatMap(Ul)]})}function Lm(n,u){for(let v of["&&","||",";","|"])if(n.startsWith(v,u))return v;return null}function tE(n,u,v,W){if(n[u]==="#"&&n[u+1]!==">"){let X=u+1;while(X<v&&n[X]!=="\r"&&n[X]!==`
+`)X++;return{next:X,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<v){if(n.startsWith("<#",B)){if(z++,z>W)return{next:v,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:v,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function nE(n,u){if(u)return"limited";if(n.some((v)=>v.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function $l(n,u,v){return{kind:"connector",operator:n.slice(u,v),span:{start:u,end:v}}}function C(n,u="auto",v=_r){if(u==="powershell"||u==="auto"&&Om(n.slice(0,v.maxInputLength),v))return Hl(n,v);return hm(n,v)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:en(u.map((v)=>v.text))}function wo(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function en(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Vl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function nn(n){return n.value.length}function Ci(n,u,v=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*v)}function Pn(n,u){Ci(n,u)}function Vr(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Qt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function ql(n){return n===`
+`||n==="\r"||n==="\u2028"||n==="\u2029"}function Jt(n,u,v){if(u+v.length>nn(n))return!1;for(let W=0;W<v.length;W++)if(ct(n,u+W)!==v[W])return!1;return!0}function ur(n,u,v){return!Vr(ct(n,u-1))&&Jt(n,u,v)&&!Vr(ct(n,u+v.length))}function mr(n,u){return Vr(ct(n,u-1))!==Vr(ct(n,u))}function pn(n){return n===`
+`||n===";"||n==="&"||n==="|"}function _o(n){return n==="|"||n===";"}function Os(n,u,v){let W=Vl(n,v);if(u==="rm")return rE(W);if(u==="dd")return iE(W);return Bm(W,!0)}function Ms(n,u,v){let W=Vl(n,v);if(u==="rm")return sE(W);if(u==="reset-hard")return zm(W,"--ha","rd");if(u==="reset-merge")return zm(W,"--me","rge");if(u==="clean")return dE(W);if(u==="checkout")return mE(W);if(u==="push-force")return fE(W);if(u==="push-refspec")return pE(W);if(u==="push-delete")return gE(W);if(u==="branch")return hE(W);if(u==="tag")return CE(W);if(u==="restore")return bE(W);return Bm(W,!1)}function rE(n){let u=!1,v=!1,W=!1,z=-1;for(let B=0;B<=nn(n);B++){let X=ct(n,B);if(!u){let le=ct(n,B+2);if(ur(n,B,"rm")&&Qt(le)&&le!==`
+`)u=!0,B++;continue}let Q=oE(n,B);if(X===`
+`||Q!==-1){if(u=!1,v=!1,W=!1,z=-1,Q!==-1)B=Q-1;continue}if(X===";"||X==="&"||X==="|"||B===nn(n)){if(z>=0){let le=Wm(n,z,B);v||=le.recursive,W||=le.force}if(v&&W)return!0;u=!1,v=!1,W=!1,z=-1;continue}if(Qt(X)){if(z<0)continue;if(Jt(n,z,"--")&&B-z===2){u=!1,v=!1,W=!1,z=-1;continue}let le=Wm(n,z,B);if(v||=le.recursive,W||=le.force,v&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function oE(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(Jt(n,u,String.raw`\n`))return u+2;if(Jt(n,u,String.raw`\x0a`)||Jt(n,u,String.raw`\x0A`))return u+5;if(Jt(n,u,String.raw`\u000a`)||Jt(n,u,String.raw`\u000A`))return u+7;return Jt(n,u,String.raw`\012`)?u+4:-1}function Wm(n,u,v){if(Fm(n,u,v,"recursive"))return{recursive:!0,force:!1};if(Fm(n,u,v,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<v;B++){let X=ct(n,B);W||=X==="r"||X==="R",z||=X==="f"||X==="F"}return{recursive:W,force:z}}function Fm(n,u,v,W){let z=v-u-2;if(z<1||z>W.length||!Jt(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function iE(n){let u=!1;for(let v=0;v<nn(n);v++){if(pn(ct(n,v))){u=!1;continue}if(ur(n,v,"dd")){u=!0,v++;continue}if(!u||!ur(n,v,"of")||!Jt(n,v,"of=/dev/"))continue;let W=v+8;if(W<nn(n)&&!Qt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function sE(n){let u=!1,v=!1,W=!1;for(let z=0;z<=nn(n);){let B=ct(n,z);if(z===nn(n)||pn(B)){u=!1,v=!1,W=!1,z++;continue}let X=lE(n,z);if(X>=0){if(aE(n,X))return!0;let Q=X,le=!1;while(Qt(ct(n,Q)))le||=ct(n,Q)===`
+`,Q++;if(le)v=!1,W=!1;u=!0,z=Q;continue}if(!u){z++;continue}if(Jt(n,z,"--")&&(z===0||Qt(ct(n,z-1)))&&(!ct(n,z+2)||Qt(ct(n,z+2))||pn(ct(n,z+2)))){u=!1,v=!1,W=!1,z+=2;continue}if(v||=Jt(n,z,"--recursive")&&mr(n,z+11)||Kl(n,z,"recursive"),W||=Jt(n,z,"--force")&&mr(n,z+7)||Kl(n,z,"force"),v&&W)return!0;z++}return!1}function Kl(n,u,v){if(!Jt(n,u,"--"))return!1;let W=0;while(W<=v.length){let z=ct(n,u+W+2);if(!z||Qt(z)||pn(z))break;if(z!==v[W])return!1;W++}return W>0&&mr(n,u+W+2)}function aE(n,u){let v=u,W=!1,z=!1;while(v<nn(n)){while(Qt(ct(n,v)))v++;let B=v;while(v<nn(n)&&!Qt(ct(n,v)))v++;if(ct(n,B)!=="-"||v-B===2&&Jt(n,B,"--"))return!1;let X=Gm(n,B,"recursive"),Q=Gm(n,B,"force");if(W&&Q||z&&X)return!0;if(W||=X,z||=Q,ct(n,B+1)==="-")continue;let le=cE(n,B,v);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Gm(n,u,v){return Jt(n,u,`--${v}`)&&mr(n,u+v.length+2)||Kl(n,u,v)}function lE(n,u){if(u>0&&Vr(ct(n,u-1)))return-1;let v=u;if(ct(n,v)==="\\")v++;if(ct(n,v)!=="r")return-1;if(v++,ct(n,v)==="\\")v++;if(ct(n,v)!=="m"||!Qt(ct(n,v+1)))return-1;return v+1}function cE(n,u,v){let W=!1,z=!1,B=!1,X=!1,Q=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q};let le="";for(let ue=u+1;ue<v;ue++){let be=ct(n,ue)??"",Oe=(be==="r"||be==="f")&&mr(n,ue+1);W||=be==="r",z||=be==="f",B||=be==="r"&&Oe,X||=be==="f"&&Oe,Q||=(le==="r"&&be==="f"||le==="f"&&be==="r")&&Oe,le=be}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q}}function zm(n,u,v){return Ei(n,"reset",_o,!0,(W)=>ct(n,W)==="-"&&xo(n,W,u,v)?!0:W)}function dE(n){return Ei(n,"clean",_o,!0,(u)=>{if(ct(n,u)!=="-")return u;if(xo(n,u,"--fo","rce"))return!0;let v=bi(n,u,_o);for(let W=u+1;W<v;W++)if(ct(n,W)==="f")return!0;return v-1})}function Ds(n,u,v){if(!ur(n,u,"git"))return null;let W=u+3;if(!Qt(ct(n,W)))return{commandEnd:-1,next:W};while(Qt(ct(n,W)))W++;while(W<nn(n)){if(pn(ct(n,W)))return{commandEnd:-1,next:W};let z=bi(n,W,pn);if(ur(n,W,v))return{commandEnd:W+v.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&Jt(n,W,"--"),X=uE(n,W,z);W=z;while(Qt(ct(n,W)))W++;if(B)return{commandEnd:ur(n,W,v)?W+v.length:-1,next:bi(n,W,pn)};if(!X)continue;if(W>=nn(n)||pn(ct(n,W)))return{commandEnd:-1,next:W};W=bi(n,W,pn);while(Qt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function uE(n,u,v){for(let W of Dn)if(v-u===W.length&&Jt(n,u,W))return!0;return!1}function mE(n){return $m(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function fE(n){return Ei(n,"push",_o,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!Vr(ct(n,u+2))&&!Jt(n,u+2,"-with-lease"))return!0;let v=Um(n,u,"--fo","rce");if(v>=0&&!Jt(n,v,"-with-lease"))return!0;return u})}function pE(n){return Ei(n,"push",pn,!1,(u)=>{if(Qt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<nn(n)&&!pn(ct(n,u+2))&&!Qt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function gE(n){return Ei(n,"push",pn,!1,(u)=>{if(ct(n,u)==="-"&&xo(n,u,"--de","lete"))return!0;if(Qt(ct(n,u))&&ct(n,u+1)===":"&&u+2<nn(n)&&!Qt(ct(n,u+2))&&!pn(ct(n,u+2)))return!0;return u})}function hE(n){let u=!1,v=!1,W=!1;for(let z=0;z<=nn(n);z++){if(z===nn(n)||pn(ct(n,z))){if(v&&W)return!0;u=!1,v=!1,W=!1;continue}if(!u){let Q=Ds(n,z,"branch");if(Q){u=Q.commandEnd>=0,z=Math.max(z,(u?Q.commandEnd:Q.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=bi(n,z,pn),X=yE(n,z,B);if(v||=X.deletion,W||=X.force,v&&W)return!0;z=B-1}return!1}function yE(n,u,v){let W=!1,z=!1;for(let B=u;B<v;B++){if(ct(n,B)!=="-")continue;if(xo(n,B,"--de","lete"))W=!0;if(xo(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let X=B+1,Q=!1,le=!1,ue=!1;while(X<v&&SE(ct(n,X))){let be=ct(n,X);Q||=be==="d"||be==="D",le||=be==="f",ue||=be==="D",X++}if(!mr(n,X))continue;W||=Q,z||=le||ue}return{deletion:W,force:z}}function SE(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function CE(n){return $m(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function $m(n,u){let v=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<nn(n);W++){let z=ct(n,W),B=v[v.length-1];if(!B)return!1;let X=B.escaped;if(B.escaped=!X&&B.quote!=="'"&&z==="\\",!X&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!X&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(v.length===1||!X&&B.quote!=="'")){v.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!X&&!B.quote&&v.length>1&&z==="("){B.depth++;continue}if(!X&&!B.quote&&v.length>1&&z===")"){if(B.depth--,B.depth===0)v.pop();continue}if(Qt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let Q=Ds(n,W,u.command);if(Q){B.outerActive=Q.commandEnd>=0&&Qt(ct(n,Q.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?Q.commandEnd:Q.next)-1);continue}}if(B.outerActive&&z==="-"){if(xo(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&mr(n,W+1))return!0;if(_o(z))B.outerActive=!1}return!1}function Ei(n,u,v,W,z){let B=!1;for(let X=0;X<nn(n);X++){let Q=ct(n,X),le=v(Q);if(!B&&!le){let ue=Ds(n,X,u);if(ue){B=ue.commandEnd>=0&&(!W||Qt(ct(n,ue.commandEnd))),X=Math.max(X,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(X);if(ue===!0)return!0;for(let be=X;be<=ue;be++)if(v(ct(n,be)))B=!1;X=ue}if(le)B=!1}return!1}function bE(n){let u=!1;for(let v=0;v<nn(n);v++){if(ql(ct(n,v))){if(u)return!0;u=!1;continue}if(!u){let W=Ds(n,v,"restore");if(W){u=W.commandEnd>=0,v=Math.max(v,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,v)==="-"&&ct(n,v+1)==="-"&&(Jt(n,v+2,"staged")||Jt(n,v+2,"help")))u=!1}return u}function Bm(n,u){let v=!1;for(let W=0;W<nn(n);W++){let z=ct(n,W),B=u?ql(z):pn(z);if(v&&Qt(z)&&ct(n,W+1)==="-"&&ur(n,W+2,"delete"))return!0;if(B){v=!1;continue}if(ur(n,W,"find"))v=!0,W+=3}return!1}function bi(n,u,v){let W=u;while(W<nn(n)&&!Qt(ct(n,W))&&!v(ct(n,W)))W++;return W}function Um(n,u,v,W){if(!Jt(n,u,v))return-1;let z=u+v.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return mr(n,z)?z:-1}function xo(n,u,v,W){return Um(n,u,v,W)>=0}function Bn(n,u){Ci(u,n,2);let v=n.toLowerCase(),W=v.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let X of B){if(X.skipForEchoRg&&z)continue;let Q=X.caseSensitive?n:v;if(X.regex)Pn(u,Q);if((X.regex?.test(Q)??!1)||X.scan&&Ms(Q,X.scan,u))return st("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${X.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var EE=/^[A-Za-z_][A-Za-z0-9_]*=/;function jm(n,u,v){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;Ci(v,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return Vm(u.nodes,W,B)}function Vm(n,u,v){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return Vm(W.body.nodes,u,v);if(W.kind==="unknown")return!v.loose.test(W.source);return vE(W,u,v)})}function vE(n,u,v){if(n.nested.some((z)=>v.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!EE.test(z.text));return n.words.every((z,B)=>z===u||Hm(z.raw,v.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!v.loose.test(z.heredoc.body))&&(!z.target||Hm(z.target.raw,v.anchored,!0)))}function Hm(n,u,v){let W=!1,z=!1;for(let B=0;B<n.length;B++){let X=n[B];if(X==="\\"&&!W){B++;continue}if(!z&&X==="'"){W=!W;continue}if(!W&&X==='"'){z=!z;continue}if(W||X!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!v)return!1}return!0}var RE="dd writing to a /dev device can destroy a disk or partition. Ask the user to run device writes manually after confirming the target.",wE="mkfs formatting a /dev device erases everything on it. Ask the user to run the format manually after confirming the target.",_E="This erases or repartitions a disk. Ask the user to run disk erase and partition commands manually after confirming the target.",xE="This output redirect overwrites a disk device. Ask the user to run device writes manually after confirming the target.",AE="shred permanently destroys the given target. Use rm for ordinary deletes, or ask the user to run shred manually.",PE=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),qm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,TE=new Set(["diskutil","wipefs","sgdisk","parted"]),IE=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),kE=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,OE=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),ME=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),DE=new Set(["i","b"]),NE=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,LE=new Set([">",">|",">>","<>",">&"]),WE=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Km(n){return n==="dd"||n==="shred"||qm.test(n)||TE.has(n)}function FE(n,u){let v=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&IE.has(W.toLowerCase())}if(n==="wipefs")return v&&u.some((W)=>kE.test(W));if(n==="sgdisk")return v&&u.some((W)=>W.startsWith("-")&&!GE(W));return n==="parted"&&v&&u.some((W)=>WE.has(W.toLowerCase()))}function GE(n){if(OE.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return DE.has(u[0]??"")||u.every((v)=>ME.has(v))}function Ym(n,u){let v=u.slice(1);if(n==="dd"&&v.some((W)=>/^of=\/dev\/.+/.test(W)&&!PE.has(W)))return st("dd.device-write",RE);if(qm.test(n)&&v.some((W)=>W.startsWith("/dev/")))return st("mkfs.device",wE);if(FE(n,v))return st("disk.erase",_E);if(n==="shred"&&v.length>0)return st("shred.target",AE);return null}function Zm(n){return n.some((u)=>LE.has(u.operator)&&u.target?.provenance==="literal"&&NE.test(u.target.text))?st("redirect.block-device",xE):null}import{readFileSync as zE,statSync as $E}from"node:fs";import{isAbsolute as BE,resolve as Xm}from"node:path";function xr(n,u,v,W){let z=BE(n)?Xm(n):u?Xm(u,n):void 0;if(!z)return;try{return Ht(z,v,W)}catch{return z}}function Yl(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}var Qm=262144;function Jm(n){if(!Yl(n))return null;try{let u=$E(n,{throwIfNoEntry:!1});if(!u?.isFile()||u.size>Qm)return null;let v=zE(n);return v.length>Qm||v.includes(0)?null:{text:v.toString("utf8").replaceAll(`\r
+`,`
+`),bytes:v.length}}catch{return null}}import{isAbsolute as Ys,normalize as nR,parse as rR,posix as Gf,resolve as Jr,sep as lc}from"node:path";import{isAbsolute as UE,join as ef,normalize as rf,parse as HE,sep as tf}from"node:path";var jE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],VE=` 	
+`;function vi(n,u){if(qr(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Zl(n.get("TMPDIR")??"",u)}function Ao(n,u){if(n.has("TMPDIR"))return Zl(n.get("TMPDIR")??"",u);let v=Xl(n,u);if(v===void 0)return!0;return Zl(v,u)}function Xl(n,u){return sf(n,u,"TMPDIR")}function Zl(n,u){if(!n)return!1;if(KE(n))return!1;return Po(n,u)}function qr(n,u){let v=sf(n,u,"IFS");return v!==void 0&&v!==""&&v!==VE}function Po(n,u){let v=Ns(n,u.paths);if(v===null)return!1;return of(u).some((W)=>Ar(v,W))}function Ws(n,u){let v=Ns(n,u.paths);if(v===null)return!1;return of(u).some((W)=>Ls(W)===Ls(v))}var nf=new WeakMap;function of(n){let u=nf.get(n);if(u)return u;let v=qE(n);return nf.set(n,v),v}function qE(n){let u=jE.map((W)=>Ns(W,n.paths)??rf(W)),v=Ns(n.tmpdir,n.paths);if(!v)return u;if(process.platform==="win32")return[...u,v];if(process.platform==="darwin"&&YE(v))return[...u,v];return u}function KE(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function sf(n,u,v){return n.has(v)?n.get(v):u.env.get(v)}function YE(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function Ns(n,u){try{let v=rf(n);if(!UE(v))return v;let W=HE(v).root,z=v.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let X=0;X<z.length;X++){let Q=ef(B,z[X]??"");if(u.entryKind(Q)==="missing")return ef(Q,...z.slice(X+1));let le=u.realpath(Q);if(le===null)return null;B=le}return B}catch{return null}}function Ar(n,u){let v=Ls(n),W=Ls(u);if(v===W)return!0;let z=W.endsWith(tf)?W:`${W}${tf}`;return v.startsWith(z)}function Ls(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as Vv,readdirSync as qv}from"node:fs";import{basename as Kv,isAbsolute as Of,join as Yv,relative as Mf}from"node:path";import{isAbsolute as ff,parse as iv}from"node:path";import{dirname as ZE,isAbsolute as XE,parse as QE,sep as JE}from"node:path";function Pr(n,u,v){if(cr(u))throw Error("Unsupported Windows namespace path");let W=XE(u)?QE(u).root:"",z=W||n;for(let B of tv(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=ZE(z);continue}let X=ev(z,B),Q=v.entryKind(X),le=Q==="symlink"?v.realpath(X):X;if(Q==="missing"||le===null)throw Error(`Cannot resolve path component: ${X}`);z=le}return z}function ev(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${JE}${u}`}function tv(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var Ql=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],nv=new Set(Ql),rv=1024,af=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),lf=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),ov=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Fs(n){return nv.has(n)}function Jl(n){return Fs(n)||af.has(n)||lf.has(n)||ni(n)}function fr(n,u,v){return v?.has(n)?v.get(n):u.get(n)}function cf(n,u){let v=fr("GIT_CONFIG_COUNT",n,u);if(v===void 0)return{state:"absent"};if(v==="")return{state:"valid",count:0};if(!/^\d+$/.test(v))return{state:"invalid"};let W=Number(v);return Number.isSafeInteger(W)&&W<=rv?{state:"valid",count:W}:{state:"invalid"}}function Gs(n,u,v){let z=n.match(ov)?.[1];if(!z||!Jl(z))return null;let B=n.indexOf("=");return{name:z,value:`${fr(z,u,v)??""}${n.slice(B+1)}`}}function df(n){return mf(n,lf)}function uf(n){return mf(n,af)}function mf(n,u){if(!n)return!1;for(let v of n.keys())if(u.has(v))return!0;return!1}var gf=/^[A-Za-z_][A-Za-z0-9_]*=/;function Tn(n){if(!gf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function Ae(n){let u=new Map,v=0;while(v<n.length){let W=n[v];if(!W)break;let z=Tn(t(W));if(!z)break;u.set(z.name,z.value),v++}return{words:n.slice(v),envAssignments:u}}function hf(n){let u=$t(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function pr(n,u,v,W){if(!hf(To(n)))return{words:n,envAssignments:new Map,cwd:v,rewritten:!1};let z=new Set(n),B=n,X=new Map,Q=new Map(W??[]),le=[],ue=v;for(let Oe=0;Oe<l.wrapperPeelIterations.cap;Oe++){let De=pf(B),Me=Ae(B);for(let[Le,We]of Me.envAssignments)X.set(Le,We),Q.set(Le,We);if(B=Me.words,B.length===0)break;while(B.length>0&&To(B).includes("=")&&!av(B)){let Le=lv(To(B),Q,u.env)??Gs(To(B),u.env,Q);if(Le)X.set(Le.name,Le.value),Q.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=$t(To(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=dv(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=fv(B,ue,Q,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,it]of Le.envAssignments)X.set(We,it),Q.set(We,it)}if(Ne==="command")B=pv(B);if(Ne==="builtin")B=B.slice(qn(B,1)==="--"?2:1);if(pf(B)===De)break}let be=Ae(B);for(let[Oe,De]of be.envAssignments)X.set(Oe,De),Q.set(Oe,De);return{words:be.words,envAssignments:X,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:sv(be.words,z)}}function sv(n,u){return n.some((v)=>!u.has(v))}function pf(n){return n.map(t).join(" ")}function To(n){let u=n[0];return u?t(u):""}function qn(n,u){let v=n[u];return v?t(v):void 0}function av(n){return gf.test(To(n))}function lv(n,u,v){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??v.get("TMPDIR")??""}${n.slice(8)}`}}var cv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function dv(n,u,v){let W=1,z=v;while(W<n.length){let B=qn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let X=qn(n,W+1);z=X?Ri(z,X,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=Ri(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=Ri(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(cv.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var uv=new Set(["-i","-0","--null"]),mv=new Set(["-u","--unset","-C","--chdir","-P"]);function fv(n,u,v,W){let z=new Map,B=[],X=u,Q=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:X,envSplitValues:B.length>0?B:void 0});while(Q<n.length){let ue=qn(n,Q);if(!ue)break;if(ue==="--")return le(Q+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let Oe of v.keys())z.set(Oe,"");z.set("TMPDIR",""),Q++;continue}if(uv.has(ue)){Q++;continue}if(ue==="-u"||ue==="--unset"){let Oe=qn(n,Q+1);if(Oe!==void 0)z.set(Oe,"");Q+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),Q++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),Q++;continue}let be=ue==="-S"||ue==="--split-string"?{value:qn(n,Q+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(be){if(be.value!==void 0)B.push(be.value);return X=null,le(Q+be.consumed)}if(mv.has(ue)){if(ue==="-C"||ue==="--chdir"){let Oe=qn(n,Q+1);X=Oe?Ri(X,Oe,W.paths):null}Q+=2;continue}if(ue.startsWith("-u=")){Q++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let Oe=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);X=Ri(X,Oe,W.paths),Q++;continue}if(ue.startsWith("-P")){Q++;continue}if(ue.startsWith("-")){Q++;continue}if(!Tn(ue))break;while(Q<n.length){let Oe=Tn(qn(n,Q)??"");if(!Oe)break;z.set(Oe.name,Oe.value),Q++}if(qn(n,Q)==="--")Q++;return le(Q)}return le(Q)}function Ri(n,u,v){if(u==="")return null;if(!n&&!ff(u))return null;let W=ff(u)?iv(u).root:v.realpath(n??"/");if(W===null)return null;try{return Pr(W,u,v)}catch{return null}}function pv(n){if(qn(n,1)==="-v")return[...en(["type"]),...n.slice(2)];let u=1;while(u<n.length){let v=qn(n,u);if(!v)break;if(v==="-p"||v==="-v"||v==="-V"){u++;continue}if(v==="--")return n.slice(u+1);if(v.startsWith("-")&&!v.startsWith("--")&&v.length>1){if(!/^[pvV]+$/.test(v.slice(1)))break;u++;continue}break}return n.slice(u)}var gv=/['"\\$`{}#]/;function Kr(n,u){if(n.some((W)=>gv.test(W)))return null;let v=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return v.length<=64?v:null}function rr(n,u,v){return Yr(n,u,v).tokens}function hv(n){let u=[],v="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((X)=>X.replace(/["']/g,"")).filter((X)=>X.length>0);v+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(v.length>0)u.push(v);v="",W++;continue}v+=z,W++}if(v.length>0)u.push(v);return u}function Tr(n,u,v,W=0){let z=Yr(n,u,v),B=(z.envSplitValues??[]).flatMap(hv);if(B.length===0)return z.tokens;let X=[...B,...z.tokens];if(W>=8)return X;return Tr(X,u,v,W+1)}function Yr(n,u,v,W){if(!hf(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:v};let z=pr(en(n),u,v,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var nc=Symbol("adopt-as-operand"),yv=new Set(["env","sudo","command","builtin"]),Sv=new Set(["&&","||","|&","|","&",";"]),Cv=new Set(["<<","<<<",">|"]),yf=new Set(["|","|&"]),bv=/[*@#?$!_-]/,Ev=/^\w+(?::\w+)*/,vv=Object.freeze([]),wi=Object.freeze({kind:"scope",edge:"enter"}),_i=Object.freeze({kind:"scope",edge:"exit"}),Rv=Object.freeze([]),wv=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),xi=new Set(["bash","sh","zsh","dash","ksh"]),_v=256,vf=new WeakMap;function Rf(n,u){let v=u.status==="complete"?new Set(tc(u)):new Set,W=Pv(n,v);if(us(W))return zs("unclosed-quote",W,u);let z={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},B=Zr(u,{source:W,suppressed:v,flags:z,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(z.limited)return zs("structural-limit",W,u);if(z.invalid)return zs("invalid",W,u);let X=zs("complete",W,u,z.assignmentFallbacks);return vf.set(X,Object.freeze(B)),X}function Us(n,u,v,W,z){let B=z.word??((Ne)=>Ne),X={cwd:u,variables:new Map,previous:null},Q=[],le=new Set,ue=null,be=[],Oe=wf(n),De=Oe.findLastIndex((Ne)=>Ne.kind==="operator"&&yf.has(Ne.operator)),Me=De!==-1&&Oe.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of Oe.entries()){let We=Me||Ne<=De;if(Le.kind==="scope"){if(Le.edge==="enter"){be.push({state:X,segment:[...Q],shellWords:new Set(le),pipeProducer:ue});continue}let it=z.segment(Q,X,ue,null,le,We);if(it)return it;let Be=be.pop();if(Be===void 0)throw Error("scope exit without a matching enter");X=Be.state,Q=Be.segment,le=Be.shellWords,ue=Be.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let it=z.segment(Q,X,ue,Le.operator,le,We);if(it)return it;X=xv(Q,X,v,W),ue=Q.length>0&&yf.has(Le.operator)?Q:null,Q=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(Q.length-1);if(Le.target===void 0)continue;let it=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},X,We);if(it===nc){le.add(Q.length),Q.push(B(Le.target));continue}if(it)return it;continue}Q.push(B(Le.text))}return z.segment(Q,X,ue,null,le,Me)}function Hs(n){return wf(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function In(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(v,W,z,B)=>{let X=u.get(W);if(X===void 0)return v;let Q=z.startsWith(":")?X!=="":!0;if(z.endsWith("-"))return Q?X:In(B,u);return Q?In(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(v,W)=>u.get(W)??v).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(v,W)=>u.get(W)??v)}function Ai(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function xv(n,u,v,W){let z=Ai(n)?new Map([...u.variables,...Av(n,u.variables)]):u.variables,B=rr([...n],v),X=Wt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!X)return{...u,variables:z};if(X==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:Cn(In(X,z),u.cwd,v,W),variables:z,previous:u.cwd}}function Av(n,u){return n.flatMap((v)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(v),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],In(z,u)]]:[]})}function wf(n){return vf.get(n)??vv}function Pv(n,u){return[...u].reduce((v,W)=>v.slice(0,W.start)+" ".repeat(W.end-W.start)+v.slice(W.end),n)}function zs(n,u,v,W=Rv){return Object.freeze({status:n,source:u,program:v,assignmentFallbacks:Object.freeze(W)})}function Zr(n,u){return n.nodes.flatMap((v,W)=>Tv(v,n,W,u)).sort((v,W)=>v.start-W.start).flatMap((v)=>[...v.events])}function Tv(n,u,v,W){if(n.kind==="connector")return[{start:n.span.start,events:[Kn(Dv(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Kn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",X=W.source[n.span.end-1]===(B?"}":")"),Q=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[$s("{"),...Zr(n.body,Q),...X?[$s("}")]:[]]:[wi,Kn("("),...Zr(n.body,Q),...X?[Kn(")")]:[],_i]}]}let z=Fv(n,W.functions);if(z){if(W.depth>=_r.maxDepth||++W.flags.expansions>_v)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...Sf(n,W),$s(";"),...Zr(z,{...W,depth:W.depth+1}),$s(";")]},...Cf(n,u,v,W)]}return[{start:n.span.start,events:Sf(n,W)},...Cf(n,u,v,W)]}function Sf(n,u){return[...n.words.map((v)=>({start:v.span.start,events:xf(v,n,u,!1)})),...n.redirections.map((v)=>({start:v.span.start,events:Iv(v,n,u)}))].sort((v,W)=>v.start-W.start).flatMap((v)=>v.events)}function Iv(n,u,v){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?xf(n.target,u,v,!0):[],B=z[0],X=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[rc(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:Nv(W),targetOrder:Cv.has(W)?"legacy-segment":"immediate",...X===void 0?{}:{target:X},...n.heredoc&&v.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:Pf(u)}:{}}),...X===void 0?z:z.slice(1)]}function Cf(n,u,v,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let X=B.heredoc;if(!X)return[];let Q=[rc(X.delimiter),.../[\r\n]/.test(W.source[X.terminatorSpan.end]??"")?[Kn(";")]:[]];if(W.suppressed.has(X.bodySpan))return[{start:X.bodySpan.start,events:Q}];return[{start:X.bodySpan.start,events:[..._f(W.source.slice(X.bodySpan.start,X.bodySpan.end),W),...Q]}]}),...z.some((B)=>!B.heredoc&&B.target)?kv(u,v,W):[]]}function kv(n,u,v){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:_f(v.source.slice(W.span.end,n.span.end),v)}]}function _f(n,u){if(u.depth>=_r.maxDepth)return u.flags.limited=!0,[];let v=C(n,"posix");if(v.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Zr(v,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function xf(n,u,v,W){let z=[],B={single:!1,double:!1},X="",Q=!1,le=()=>{let ue=Q&&!W?Kn("glob"):X!==""||n.quoted&&z.length===0?rc(X):void 0;if(ue)z.push(ue);X="",Q=!1};for(let ue of n.parts){if(ue.provenance!=="command-substitution"&&ue.provenance!=="arithmetic"){for(let Me of ec(ue.raw,B,v.flags,v.powershell)){if(typeof Me==="string"){le(),z.push(Kn(Me));continue}X+=Me.text,Q||=Me.glob}continue}let be=u.nested.find((Me)=>Me.span.start>=ue.span.start&&Me.span.end<=ue.span.end);if(B.double){let Me=v.source.slice(ue.span.start,ue.span.end);X+=ec(Me,{single:!1,double:!0},v.flags,v.powershell).map((Le)=>typeof Le==="string"?Le:Le.text).join("");let Ne=be?Zr(be,v).filter((Le)=>Le.kind==="redirection"&&Le.body!==void 0):[];if(Ne.length>0)z.push(wi,...Ne,_i);continue}let Oe=be?Zr(be,v):[];if(ue.raw.startsWith("`")){X+="${}",le(),z.push(wi,...Oe,_i);continue}if(ue.raw.startsWith("<(")||ue.raw.startsWith(">(")){le(),z.push(ue.raw.startsWith("<(")?Kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),wi,...Oe,...ue.raw.endsWith(")")?[Kn(")")]:[],_i);continue}let De=ue.raw.startsWith("$((")?2:1;X+="${}",le(),z.push(...Array.from({length:De},()=>Kn("(")),...De===1?[wi]:[],...Oe,...ue.raw.endsWith(")".repeat(De))?Array.from({length:De},()=>Kn(")")):[],...De===1?[_i]:[])}return le(),z}function ec(n,u,v,W){let z=[],B="",X=!1,Q=0;while(Q<n.length){let le=n[Q]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:X},le),B="",X=!1,Q++;continue}if(W&&le==="`"&&!u.single){B+=n[Q+1]??"",Q+=2;continue}if(u.single&&le==="'"){u.single=!1,Q++;continue}if(u.single){B+=le,Q++;continue}if(u.double){if(le==='"'){u.double=!1,Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,Q+=2;continue}if(le==="$"){let ue=bf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}B+=le,Q++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";X||=ue==="*"||ue==="?",B+=ue,Q+=2;continue}if(le==="$"){let ue=bf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}X||=le==="*"||le==="?",B+=le,Q++}return[...z,{text:B,glob:X}]}function bf(n,u,v,W,z){let B=n[u+1];if(B==="{"){let Q=z?Mv(n,u+2):ks(n,u+2,n.length).close;if(Q===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,Q+1);return Ov(le,v,W,z),{text:le,next:Q+1}}if(B!==void 0&&bv.test(B))return{text:`\${${B}}`,next:u+2};let X=(z?Ev:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${X}}`,next:u+1+X.length}}function Ov(n,u,v,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let X=z.slice(B.length),Q=[":=","="].find((ue)=>X.startsWith(ue));if(!Q)return;let le=ec(X.slice(Q.length),{...u},v,W);v.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function Mv(n,u){let v=1,W=u;while(v>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")v++;if(n[W]==="}")v--;W++}return v===0?W-1:-1}function Dv(n){return/^[\r\n]+$/.test(n)?";":n}function Kn(n){return Object.freeze({kind:"operator",operator:n,boundary:Sv.has(n)})}function $s(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function rc(n){return Object.freeze({kind:"word",text:n})}function Nv(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function Io(n){return wv.has(n)||/^python\d/.test(n)}var Lv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Af(n,u){let v=u[0];if(v===void 0||!v.startsWith("-"))return u;let W=Lv.get(n)?.has(v)??!1;return Af(n,u.slice(W?2:1))}function Bs(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return Bs(n.slice(1));if(u==="uv"&&n[1]==="run")return Bs(n.slice(2));if(!yv.has(u))return[...n];return Bs(Af(u,n.slice(1)))}function Pf(n){let u=pi(n),v=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return Bs(v<0?[]:n.words.slice(v).map((W)=>W.text))}function Wv(n){let u=Pf(n)[0];if(u===void 0)return!1;let v=Wt(u).toLowerCase();return Io(v)&&!xi.has(v)}function tc(n){return n.nodes.flatMap((u,v)=>{if(u.kind==="group"||u.kind==="function")return tc(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((Q)=>tc(Q)),z=u.redirections.flatMap((Q)=>Q.heredoc?.quotedDelimiter?[Q.heredoc.bodySpan]:[]);if(Wv(u))return[...W,...z];let B=n.nodes[v+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!zv(u))return W;return[...W,...z]})}function Fv(n,u){let v=pi(n);return v===void 0?void 0:u.get(v)}function Ir(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function Gv(n){if(Ir(n.words[0],"git"))return Ir(n.words[1],"commit");if(!Ir(n.words[0],"gh")||!Ir(n.words[2],"create"))return!1;return Ir(n.words[1],"pr")||Ir(n.words[1],"issue")}function zv(n){return(Ir(n.words[0],"cat")||Ir(n.words[0],"tee")||Gv(n))&&!n.words.some(Ef)&&!n.redirections.some((v)=>Ef(v.target))}function Ef(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var or="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",js="Unsupported heredoc syntax",Xr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function ir(){return{id:"analysis.dynamic-shell-source",reason:Xr,intent:"stop_and_explain"}}var Tf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var oc=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),$v=new Set([...oc,"dir_path","glob","glob_pattern","include_pattern"]),Bv=new Set([...oc,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(or)}}function If(n){let u=Uv(),v=de(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&v)W.push({usage:"input-candidate",source:v});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,X)=>{let Q=B.findIndex((be)=>be.source===X.source);if(Q!==-1){let be=B[Q];if(!be)return B;return B[Q]={...be,usages:[...be.usages,X.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(X.source,le);return B.push({usages:[X.usage],source:X.source,program:ue,shell:u.getShellSyntax(X.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:Hv(n),store:u}}function ko(n,u){return n.commands.find((v)=>v.usages.includes(u))}function gr(n){return ko(n,"declared-command")??ko(n,"input-candidate")}function hr(n,u){if(!n.includes("$"))return n;return $a(n,u)}function Uv(){let n=new Map,u=new WeakMap,v=(z,B)=>{let X=`${B}\x00${z}`,Q=n.get(X);if(Q)return Q;let le=C(z,B);return n.set(X,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let X=B??v(z,"posix"),Q=u.get(X);if(Q)return Q;let le=X.status==="limited"?{status:"structural-limit",source:z,program:X,assignmentFallbacks:[]}:Rf(z,X);return u.set(X,le),le},getCommandProgram:v,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function Hv(n){let u=n.route.kind==="grep"?$v:n.route.kind==="glob"?Bv:oc;return[...eu(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?ru(n.input):[]]}var jv=new Set(["-S","--suffix"]);function Oo(n,u,v,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return Us(n,u,v,W,{segment:(B,X)=>z.findSegmentTarget(B,X),redirection:(B,X)=>B.role==="file-write"&&z.isRedirectionTarget(In(B.target,X.variables),X)?B.target:null})}function Vs(n){let u=[],v=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){v=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){v=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){v=B.slice(2);continue}if(!W&&jv.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return v?{sources:u,destination:v}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Df(n,u,v,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(ns(n.invocation.toolName))return null;let Q=n.paths.find((le)=>kf(le,z,u,v,W,u.entries));return Q?{target:Q}:null}if(n.invocation.route.kind!=="command")return null;let B=gr(n);if(!B)return null;let X=Oo(B.shell,z,v,W,{findSegmentTarget:(Q,le)=>tR(Q,le,u,v,W),isRedirectionTarget:(Q,le)=>kf(Q,le.cwd,u,v,W,u.markerFiles),findMalformedTarget:()=>null});return X?{target:X}:null}function Qr(n,u,v,W,z,B,X=!1){if(!v)return!1;let Q=Ks(Cn(n,u,z,B)),le=Q.replace(/(\/\.?\*+)+$/,"");if(le!==Q&&le!==""){if(ic(le,v))return!0;let ue=X||Q.slice(le.length).includes("/."),be=(Oe)=>ue?qs(Oe,le):Zv(Oe,le);if(v.markerFiles.some(be))return!0;return W&&sc(v).some(be)}if(ic(Q,v))return!0;return W&&sc(v).some((ue)=>qs(ue,Q))}function Zv(n,u){let v=Mf(u,n);if(v===""||v.startsWith("..")||Of(v))return!1;return!v.split(/[\\/]/)[0]?.startsWith(".")}function Xv(n,u,v,W,z){return Qr(n,u,v,!0,W,z)}function Qv(n,u,v,W,z){if(!v)return!1;return ic(Ks(Cn(n,u,W,z)),v)}function kf(n,u,v,W,z,B){let X=Ks(Cn(n,u,W,z));return B.includes(X)||Lf(X,v)}function Nf(n,u,v,W,z){if(!v)return!1;return v.hooksDirectories.some((B)=>n.some((X)=>qs(B,Ks(Cn(X,u,W,z)))))}function ic(n,u){return u.entries.includes(n)||u.directories.includes(n)||Lf(n,u)}function Lf(n,u){return u.hooksDirectories.some((v)=>qs(n,v))}var Jv=50000;function Wf(n,u){let v=[...new Set(sc(n))];if(v.some((z)=>u(Kv(z))))return!0;let W=0;while(v.length>0){let z=v.pop()??"",B=eR(z);if(!B)return!0;if(W+=B.length,W>Jv)return!0;if(B.some((X)=>u(X.name)))return!0;v.push(...B.filter((X)=>X.isDirectory()).map((X)=>Yv(z,X.name)))}return!1}function eR(n){try{let u=Vv(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return qv(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function sc(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function qs(n,u){let v=Mf(u,n);return v===""||!/^\.\.(?:[\\/]|$)/.test(v)&&!Of(v)}function Ks(n){return process.platform==="win32"?n.toLowerCase():n}function tR(n,u,v,W,z){if(Ai(n))return null;let B=Tr([...n],W);if(Wt(B[0]??"").toLowerCase()!=="mv")return null;let X=Vs(B.slice(1)),Q=X.sources.find((le)=>Xv(In(le,u.variables),u.cwd,v,W,z));if(Q)return Q;return X.destination&&Qv(In(X.destination,u.variables),u.cwd,v,W,z)?X.destination:null}var oR=process.platform==="win32",Ff=64,iR=16384;function cc(n,u,v,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!dn(v,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!dn(v,z.id,u.paranoid))return null;return st(z.id,z.reason)}function Mo(n,u,v,W,z={}){return sR(n,u,z).map((B)=>Ft(cc(B,u,v,W),v)).find((B)=>B!==null)??null}function sR(n,u,v){let W=sr(n,u,v);if(W.kind==="cwd_self_target")return[W,sr(n,u,{...v,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=sr(n,u,{...v,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,sr(n,u,{...v,skipHomeCwd:!0,skipCwdSelf:!0})]}function eo(n){let u=wm(n,Ff,Ff,iR);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:aR(n)}}function aR(n){let u=n.parts.filter((v)=>v.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(v.raw));return u.length>0&&u.every((v)=>lR(n.raw,v.span.start-n.span.start))}function lR(n,u){let v=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&v!=="'"){W=!0;continue}if(v===B){v=null;continue}if(v===null&&(B==="'"||B==='"'))v=B}return v==='"'}function Un(n){let u=n.environment.home,v=n.environment.paths,W=n.budget??_n();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:gR(n.allowPaths,u,v,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function sr(n,u,v={}){let W=v.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!v.tmpdirWordSplittingProtected&&yR(n))return{kind:"outside_anchored_cwd"};let z=!W&&zf(n,u.posixShell);if(cr(n))return{kind:"outside_anchored_cwd"};if(Pi(n,W))return{kind:"root_or_home_target"};if(uR(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Qr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(mR(n,u.trustTmpdirVar,u.posixShell,z,W,v.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z)return{kind:"dynamic_target"};if(hR(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!v.skipHomeCwd&&[B,u.resolvedCwd??B].some((X)=>ER(X,u.environment.home,u.environment.paths,u.budget)))return{kind:"home_cwd_target"};if(!v.skipCwdSelf&&[u.resolvedCwd??B,B].some((X)=>vR(n,u.resolvedCwd??B,u.environment.paths,u.budget,X)))return{kind:"cwd_self_target"};if(RR(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(cR(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function cR(n,u,v){let W=n.trim();if(v||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if(Ys(W)||W.startsWith("~"))return!1;if(dc(W))return!1;if($f(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return Po(Jr(u.resolvedCwd,W),u.environment)}function dR(n,u,v={}){let{containmentTarget:W,...z}=v;if(sr(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(pR(B))return!1;if(Ws(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((X)=>$f(W??B,X,u.environment.paths,u.budget))}function Pi(n,u=!1){let v=n.trim(),W=Gf.normalize(v),z=v.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((X)=>/^\*+$/.test(X)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function uR(n,u,v){let W=n.trim(),z=v?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=Ys(z)?z:u.resolvedCwd?Jr(u.resolvedCwd,z):null;if(!B)return!1;let X=kn(Ht(B,u.environment.paths,u.budget));if(X===rR(X).root)return!0;return X===kn(Ht(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function kn(n){let u=nR(n);if(oR){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function mR(n,u,v,W,z,B,X,Q){let le=n.trim();if(dc(le))return!1;if(!W&&Po(le,Q))return!0;return(u||B&&X)&&v&&!z&&fR(le,v)}function fR(n,u){return["$TMPDIR","${TMPDIR}"].some((v)=>{if(n===v)return!0;if(!n.startsWith(`${v}/`))return!1;return!zf(n.slice(v.length+1),u)})}function pR(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return Gf.normalize(`/${u[1]??""}`)==="/"}function dc(n){return n.split(/[\\/]+/).includes("..")}function gR(n,u,v,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=di(z.trim(),u);if(!Ys(B))return[];try{let X=Ht(B,v,W);if(ui(X,Ht(u,v,W)))return[];return[kn(X)]}catch{return[]}})}function hR(n,u,v){if(u.allowRoots.length===0)return!1;let W=n.trim();if(dc(W))return!1;let z=v?W:di(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,X=Ys(z)?z:B?Jr(B,z):null;if(!X)return!1;try{let Q=kn(Ht(X,u.environment.paths,u.budget));return u.allowRoots.some((le)=>Q===le||Q.startsWith(le.endsWith(lc)?le:`${le}${lc}`))}catch{return!1}}function yR(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function zf(n,u=!1){return n.includes("$")||n.includes("`")||SR(n)||u&&CR(n)}function SR(n){let u=!1;for(let v of n){if(u){u=!1;continue}if(v==="\\"){u=!0;continue}if(v==="*"||v==="?"||v==="[")return!0}return!1}function CR(n){let u=!1;for(let v=0;v<n.length;v++){let W=n[v];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&bR(n,v)||(W==="+"||W==="@"||W==="!")&&n[v+1]==="(")return!0}return!1}function bR(n,u){let v=n.indexOf("}",u+1);if(v===-1)return!1;let W=n.slice(u+1,v);return W.includes(",")||W.includes("..")}function ER(n,u,v,W){try{return kn(Ht(n,v,W))===kn(Ht(u,v,W))}catch{try{return kn(n)===kn(u)}catch{return!1}}}function vR(n,u,v,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return kn(Ht(Jr(u,n),v,W))===kn(Ht(z,v,W))}catch{try{return kn(Jr(u,n))===kn(z)}catch{return!1}}}function RR(n,u,v,W,z,B,X){let Q=v??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return ac(n,u,B,X)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return ac(Jr(Q,n),u,B,X)}catch{return!1}if(n.startsWith("../"))return!1;try{return ac(Jr(Q,n),u,B,X)}catch{return!1}}function ac(n,u,v,W){try{return Bf(Ht(n,v,W),Ht(u,v,W))}catch{return!1}}function $f(n,u,v,W){if(!u)return!1;try{return Bf(Ht(u,v,W),Ht(n,v,W))}catch{return!0}}function Bf(n,u){let v=kn(n),W=kn(u);return v.startsWith(`${W}${lc}`)||v===W}function Zs(n,u){let v=u.envAssignments??new Map,W=Xl(v,u.environment),z=u.trustedTmpdirValue??Ao(v,u.environment),B=u.allowTmpdirVar??!vi(v,u.environment),X={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??qr(v,u.environment),trustedTmpdirValue:z,budget:u.budget},Q=Un(X),le=Un({...X,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),be=u.cwd&&u.environment.paths.realpath(u.cwd),Oe=ue&&be&&!Ar(be,ue)?u.cwd:void 0;return n.every((De)=>{let Me=eo(De);if(Me.unsafeBraceExpansion||Me.expandedTargets?.length===0)return!1;return(Me.expandedTargets??[t(De)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?Oe:void 0,We=Le??Ne,it={targetIsLiteral:Me.expandedTargets!==void 0||Me.targetIsLiteral,tmpdirWordSplittingProtected:Me.tmpdirWordSplittingProtected};if(!dn(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&sr(We,Q,it).kind==="within_anchored_cwd")return!0;return dR(We,Le?le:Q,{...it,containmentTarget:wR(We,W)})})})}function wR(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var Do="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Ti="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",mc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),_R=new Set(["-p","--print"]),xR=new Map([["node",new Set(["-c","--check"])],["ruby",new Set(["-c"])]]),AR=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),PR=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),TR=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),IR=new Map([["python",new Set(["m"])]]),kR=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),OR=new Set(["always","default","never"]),MR=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DR=/\\\r?\n/g,Uf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,NR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${Uf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${Uf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],LR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Hf(n){return Qs(n).code}function Xs(n){return Qs(n).sources}function jf(n){return LR.get(Js(n))??[]}function Qs(n){let u=Js(n[0]??"");if(!mc.has(u))return{code:null,sources:[],optionsOpen:!1};let v=[],W=[],z=!0;for(let B=1;B<n.length;B++){let X=n[B];if(X===void 0)break;if(X==="--")return Yn(u,v,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(X===""||X==="-"||!X.startsWith("-"))return Yn(u,v,W,z,B,X);if(u==="node"&&_R.has(X)){let Oe=n[B+1];if(Oe===void 0)return Yn(u,v,W,z);if(Oe.startsWith("-"))continue;v.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),B++;continue}if(FR(u,X)){let Oe=n[B+1];if(Oe===void 0)return Yn(u,v,W,z);if(v.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),u==="python")return Yn(u,v,W,z);B++;continue}let Q=/^--eval=(.*)$/s.exec(X);if(GR(u)&&Q){let Oe=Q[1]??"";v.push({tokenIndex:B,value:Oe}),W.push({tokenIndex:B,kind:"inline-code",value:Oe});continue}if(u==="node"){let Oe=WR(X);if(Oe){if(Oe.attached){if(z&&=Oe.value!=="",Oe.value!=="")W.push({tokenIndex:B,kind:"module-file",value:Oe.value});continue}let De=n[B+1];if(De===void 0||De.startsWith("-"))return z=!1,Yn(u,v,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:De}),B++;continue}}if(u==="python"&&X.startsWith("--check-hash-based-pycs=")||u==="node"&&(X==="--conditions="||X==="--diagnostic-dir="||X==="--title=")||u==="ruby"&&(X==="--disable="||X==="--enable="))return Yn(u,v,W,z);if(kR.get(u)?.has(X)){let Oe=n[B+1];if(Oe===void 0||Oe.startsWith("-")&&!(u==="ruby"&&MR.has(X))||u==="python"&&!OR.has(Oe))return Yn(u,v,W,z);B++;continue}if(X.startsWith("--"))continue;let le,ue=!1;for(let Oe=1;Oe<X.length;Oe++){let De=X[Oe];if(De===void 0)break;if(IR.get(u)?.has(De)){let Me=X.slice(Oe+1),Ne=Me||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});return Yn(u,v,W,z)}if(AR.get(u)?.has(De)){le=X.slice(Oe+1)||n[B+1],ue=Oe+1===X.length;break}if(u==="node"&&De==="r"){if(z&&=X==="-r",X==="-r"){let Me=n[B+1];if(z&&=Me!==void 0&&!Me.startsWith("-"),z&&Me!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Me});B++}break}if(u==="ruby"&&De==="r"){let Me=X.slice(Oe+1),Ne=Me||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});if(!Me)B++;break}if(u==="perl"&&(De==="M"||De==="m")){let Me=X.slice(Oe+1);if(!Me){if(z=!1,Oe+1===X.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Me});break}if(PR.get(u)?.has(De)){if(Oe+1===X.length)B++;break}if(TR.get(u)?.has(De)&&Oe+1<X.length)break}if(le===void 0)continue;let be=ue?B+1:B;if(v.push({tokenIndex:be,value:le}),W.push({tokenIndex:be,kind:"inline-code",value:le}),u==="python")return Yn(u,v,W,z);if(ue)B++}return Yn(u,v,W,z,void 0,void 0,!0)}function Yn(n,u,v,W,z,B,X=!1){let Q=n==="node"?u.slice(-1):u,le=new Set(Q.map((be)=>be.tokenIndex)),ue=v.filter((be)=>be.kind!=="inline-code"||le.has(be.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?Q[0]?.value:Q.map((be)=>be.value).join(`
+`))||null,sources:W?ue:[],optionsOpen:W&&X}}function WR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function fc(n){let u=xR.get(Js(n[0]??"")),v=n.findIndex((W,z)=>z>0&&(W==="-"||!W.startsWith("-")));return u!==void 0&&n.slice(1,v===-1?void 0:v).some((W)=>u.has(W))}function pc(n,u){return Js(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function Js(n){let u=Wt(n).toLowerCase();return ls.test(u)?"python":u}function FR(n,u){return mc.get(n)?.has(u)??!1}function GR(n){return mc.get(n)?.has("--eval")??!1}function Ii(n,u,v=!1){let W=BR(n,u);if(Pn(u,W),NR.some((X)=>Array.from(W.matchAll(X)).some((Q)=>Q.groups?.literal===void 0||Pi(Q.groups.literal,!0))))return!0;if(!uc(W,u))return!1;Pn(u,W);let B=$R(W);if(uc(B,u))return!0;if(Pn(u,B),!Vf.test(B))return!1;return!v||zR(W,u)}function zR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let be=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,Oe=le+be.length,De=Oe;while(De<n.length&&!n.startsWith(be,De))De+=n[De]==="\\"?2:1;if(De>=n.length)return!0;z.push({start:Oe,text:n.slice(Oe,De)}),W.fill(" ",le,De+be.length),le=De+be.length-1}let B=W.join(""),X=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>Vf.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:ea(B,ue)}});if(X.some((le)=>gc(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),be=X.some((Oe)=>le.start>=Oe.start&&le.start<Oe.end);return(ue||be)&&uc(le.text,u)})}function ea(n,u){let v=1;for(let W=u;W<n.length;W++){if(n[W]==="(")v++;if(n[W]===")")v--;if(v===0)return W}return n.length}function gc(n,u){let v=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))v++;if(")]}".includes(z)&&v--===0)return!1;if(z===","&&v===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var Vf=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function $R(n){let u=[],v=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,X=W+B.length;while(X<n.length&&!n.startsWith(B,X))X+=n[X]==="\\"?2:1;if(X>=n.length)break;u.push(n.slice(v,W)," "),W=X+B.length,v=W}return u.push(n.slice(v)),u.join("")}function uc(n,u){if(Os(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Pn(u,n),W.test(n))return!0;if(Os(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Pn(u,n),W.test(n))return!0;if(Os(n,"find",u))return!0;let v=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(Pn(u,n),v.some((z)=>Ms(z,W))))}function BR(n,u){return Pn(u,n),n.replace(DR,"")}var UR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),qf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",HR="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Kf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Yf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",jR="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",VR="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",qR={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Yf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Kf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:jR},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:qf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:HR},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:qf}};function Zf(n,u,v){return KR(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,Un({...v,allowPaths:v.policy?.destructiveCommandAllowPaths}),v.policy)}function KR(n,u,v,W){let z=n.filter((le)=>le.kind==="word"),B=ZR(z),X=z[B];if(!X||!UR.has(iw(X.text)))return null;let Q=YR(z.slice(B+1));if(Q.whatIfProtected)return null;if(dn(W,"powershell.remove-item-pipeline-dynamic-target",v.strict)&&u&&(Q.targets.length===0||Q.recursive))return st("powershell.remove-item-pipeline-dynamic-target",VR);for(let le of Q.targets)if(!cr(le.text)&&Pi(ki(le.text)))return st(Q.recursive&&Q.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Yf);for(let le of Q.targets)if(v.resolvedCwd&&Qr(ki(le.text),v.resolvedCwd,v.protectedGitMetadata,Q.recursive,v.environment,v.budget,!0))return st("powershell.remove-item-git-metadata",y);if(!Q.recursive||!Q.force)return null;if(dn(W,"powershell.remove-item-recursive-force-dynamic-target",v.strict)&&(Q.hasDynamicTarget||Q.targets.length===0))return st("powershell.remove-item-recursive-force-dynamic-target",Kf);for(let le of Q.targets){let ue=Mo(ki(le.text),v,W,qR);if(ue)return ue}return null}function YR(n){let u=[],v=!1,W=!1,z=!1,B=!1,X=!1;for(let Q=0;Q<n.length;Q++){let le=n[Q];if(!le||le.kind!=="word")continue;if(XR(le))continue;if(X){u.push(hc(le)),B=B||le.dynamic;continue}if(le.text==="--"){X=!0;continue}let ue=JR(le.text);if(!ue){u.push(hc(le)),B=B||le.dynamic;continue}if(ew(ue.name)){let be=ue.value?QR(ue.value,le):n[++Q];if(be?.kind==="word"){u.push(hc(be)),B=B||be.dynamic;continue}B=!0;continue}if(tw(ue.name)){v=!0;continue}if(nw(ue.name)){W=!0;continue}if(rw(ue.name))z=ow(ue.value)}return{targets:u,recursive:v,force:W,whatIfProtected:z,hasDynamicTarget:B}}function ZR(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function hc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function XR(n){return n.kind==="word"&&n.text===","}function ki(n){let u=n.replace(/\\/g,"/"),v=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return v?`$HOME${u.slice(v[0].length)}`:u}function QR(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function JR(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),v=u.indexOf(":");if(v===-1)return{name:u.toLowerCase()};return{name:u.slice(0,v).toLowerCase(),value:u.slice(v+1)}}function ew(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function tw(n){return"recurse".startsWith(n)}function nw(n){return n.length>=2&&"force".startsWith(n)}function rw(n){return n==="wi"||"whatif".startsWith(n)}function ow(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function iw(n){return n.toLowerCase()}import{sep as _P}from"node:path";var sw=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),aw=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),lw=new Set(["-o","--output","--query","--subscription"]),cw=new Set;function Xf(n){if(n==="aws")return sw;if(n==="gcloud")return aw;if(n==="az")return lw;return cw}var dw=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),uw=new Set;function Qf(n){if(n==="git")return Dn;if(n==="docker")return dw;return uw}function F(n,u){if(n.length===0||u.length===0)return null;let v=$t(n[0]??""),W=xn(n);for(let z of u){if(!pw(v,z.command))continue;if(z.match){if(mw(v,n,z.match))return Jf(z);continue}if(!gw(v,n,z.subcommand))continue;if(yw(n,new Set(z.block_args),W))return Jf(z)}return null}function Jf(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function mw(n,u,v){let W=u.slice(1);if(v.exclude_args?.some((z)=>W.includes(z)))return!1;if(v.any_args&&!v.any_args.some((z)=>W.includes(z)))return!1;return fw(W,v.command_path,Xf(n))}function fw(n,u,v){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&v.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function pw(n,u){return n===$t(u)}function gw(n,u,v){if(!v)return!0;return ep(u,1,v,Qf(n))}function ep(n,u,v,W){let z=!1;for(let B=u;B<n.length;B++){let X=n[B];if(!X)continue;if(z){z=!1;continue}if(X==="--"){let Q=n[B+1];if(Q&&!Q.startsWith("-"))return Q===v;return!1}if(W.has(X)){z=!0;continue}if(X.startsWith("-")){if(!X.includes("=")&&hw(n,B,v,W))return!0;continue}return X===v}return!1}function hw(n,u,v,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return ep(n,u+2,v,W)}function yw(n,u,v){return n.some((W)=>u.has(W))||[...v].some((W)=>u.has(W))}var Sw=new Set(["-e","--source"]),Cw=new Set(["-F","-v","--assign","--field-separator"]),tp=new Set(["-f","--file"]),bw=new Set(["print","printf","return"]),np=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Ew="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function rp(n,u,v){let W=!1;for(let z of vw(n)){let B=Rw(z,v);if(!B)continue;for(let X of B.commands){let Q=u(X);if(Q)return Q;if(X.includes("{}")||/[$`]/.test(X))W=!0}W||=B.dynamic}return W?st("awk.system-dynamic",Ew):null}function Sc(n){let u=[],v=!1,W=!1,z=!0,B=!0;for(let X=1;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(z&&Q==="--"){z=!1;continue}if(z&&Sw.has(Q)){v=!0;let le=n[X+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:X+1,kind:"inline-code",value:le});X++;continue}if(z&&Q.startsWith("--source=")){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(9)});continue}if(z&&Q.startsWith("-e")&&Q.length>2){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(2)});continue}if(z&&(Cw.has(Q)||tp.has(Q))){let le=n[X+1];if(B&&=le!==void 0,tp.has(Q)){if(W=!0,le!==void 0)u.push({tokenIndex:X+1,kind:"program-file",value:le})}X++;continue}if(z&&(Q.startsWith("-F")||Q.startsWith("-v")&&Q.slice(2).includes("=")))continue;if(z&&Q.startsWith("-f")&&Q.length>2){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(2)});continue}if(z&&(Q.startsWith("--assign=")||Q.startsWith("--field-separator=")))continue;if(z&&Q.startsWith("--file=")){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(7)});continue}if(z&&Q.startsWith("-")&&Q!=="-")continue;if(!v&&!W)u.push({tokenIndex:X,kind:"main-program",value:Q});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function Mi(n){return Sc(n).sources}function vw(n){return Mi(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function Rw(n,u){Pn(u,n);let v=n.includes("system")?Cc(n,u):null,W=ww(n,u);if(!v&&!W)return null;return{dynamic:!!v?.dynamic||!!W?.dynamic,commands:[...v?.commands??[],...W?.commands??[]]}}function Cc(n,u){Pn(u,n);let v=[],W=!1,z=!1,B=0;while(B<n.length){let X=n[B];if(X==='"'||X==="'"){B=na(n,B,X)?.endIndex??B+1;continue}if(X==="#"){B=op(n,B+1);continue}if(X==="/"&&ip(n,B)){B=sp(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let Q=B;if(B+=6,Oi(n[Q-1])||Oi(n[B]))continue;let le=ta(n,B);if(n[le]!=="(")continue;le=ta(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let be=na(n,le,ue);if(!be){W=!0,z=!0;continue}if(le=ta(n,be.endIndex),W=!0,n[le]!==")"){z=!0,B=be.endIndex;continue}v.push(be.value),B=le+1}if(!W)return null;return{dynamic:z,commands:v}}function ww(n,u){Pn(u,n);let v=[],W=!1,z=!1,B=0,X=0,Q=null,le=null,ue=0;while(B<n.length){let be=n[B];if(!be)break;if(be==='"'||be==="'"){let Me=na(n,B,be);if(Me&&ue===X)le={...Me,startIndex:B};ue=Me?.endIndex??B+1,B=Me?.endIndex??B+1;continue}if(be==="#"){B=op(n,B+1),X=B,Q=null,le=null,ue=B;continue}if(be==="/"&&ip(n,B)){let Me=sp(n,B+1);ue=Me??B+1,B=Me??B+1;continue}if(`;
+{}`.includes(be)){B++,X=B,Q=null,le=null,ue=B;continue}if(Q===null&&(yc(n,B,"print")||yc(n,B,"printf")))Q=B;if(be!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(be))ue=B+1;B++;continue}let Oe=n[B+1]==="&"?B+2:B+1,De=ta(n,Oe);if(yc(n,De,"getline")){z=!0;let Me=Aw(X,le,ue);if(W||=Me===null,Me!==null)v.push(Me);ue=Oe,B=Oe;continue}if(Tw(X,Q)){z=!0;let Me=xw(n,De);if(!Me){W=!0,ue=Oe,B=Oe;continue}if(!_w(n,Me.endIndex)){W=!0,ue=Me.endIndex,B=Me.endIndex;continue}v.push(Me.value),ue=Me.endIndex,B=Me.endIndex;continue}ue=Oe,B++}if(!z)return null;return{dynamic:W,commands:v}}function Oi(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function ta(n,u){let v=u;while(/\s/.test(n[v]??""))v++;return v}function _w(n,u){let v=u;while(/[\t\f\v\r ]/.test(n[v]??""))v++;let W=n[v];return!W||`;
+}#`.includes(W)}function na(n,u,v){let W="",z=!1;for(let B=u+1;B<n.length;B++){let X=n[B];if(!X)break;if(z){let Q=Pw(n,B);if(!Q)return null;W+=Q.value,B=Q.endIndex,z=!1;continue}if(X==="\\"){z=!0;continue}if(X===v)return{value:W,endIndex:B+1};W+=X}return null}function xw(n,u){let v=n[u];if(v!=='"'&&v!=="'")return null;return na(n,u,v)}function Aw(n,u,v){if(!u)return null;return u.startIndex>=n&&u.endIndex===v?u.value:null}function Pw(n,u){let v=n[u];if(!v)return null;if(v==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(v)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[v]??v,endIndex:u}}function yc(n,u,v){return n.startsWith(v,u)&&!Oi(n[u-1])&&!Oi(n[u+v.length])}function Tw(n,u){return u!==null&&u>=n}function op(n,u){let v=n.indexOf(`
+`,u);return v===-1?n.length:v+1}function ip(n,u){let v=Iw(n,u);if(v===-1)return!0;if("{([,;!~=".includes(n[v]??""))return!0;let W=v;while(Oi(n[W-1]))W--;return bw.has(n.slice(W,v+1))}function Iw(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function sp(n,u){let v=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="/")return W+1}return null}var kw=new Set(["sudo","env","command","builtin"]),ap=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function lp(n){return ap.has(n)}function ra(n,u){let v=n[0];if(!v||!cp(Wt(v),u))return null;let W=Wt(v),z=n[1]==="--"?2:1,B=Ow(n,z,W,u),X=B[0];if(X===void 0)return null;return{wrapper:W,tokens:n.slice(X),childIndex:X,alternativeChildIndices:B.slice(1)}}function Ow(n,u,v,W){let z=n[1]==="--",B=[];for(let X=u;X<n.length;X++){let Q=n[X];if(!Q)continue;let le=Wt(Q)!==v&&Mw(Q,W);if(le)B.push(X);if(!le&&cs.has($t(Q)))break;if(z)break}return B}function Mw(n,u){let v=Wt(n),W=$t(n);return W==="git"||W==="unshare"||v==="busybox"||to(n)||al.has(v)||Km(W)||ds.has(W)||cp(v,u)||tn.has(W)||n==="$SHELL"||Nn(W)||$n.has(W)||u.rules.some((z)=>z.command===v)}function cp(n,u){return ap.has(n)||u.transparentWrappers.includes(n)}function to(n){return kw.has(n.toLowerCase())}function no(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function Zn(n,u){let v=u.policy??{rules:[],transparentWrappers:[]};return oa([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),v,{iterations:0},!1)}function*oa(n,u,v,W,z,B,X,Q,le){let ue=Yr(n,u,v,B);for(let[Me,Ne]of ue.envAssignments)B.set(Me,Ne),z.set(Me,Ne);let{tokens:be,cwd:Oe}=ue;if(ue.envSplitValues){let Me=Kr(ue.envSplitValues,be);if(!Me)throw new a("derivedCommandShape");bc(Q),yield*oa(Me,u,Oe,W,z,B,X,Q,le);return}if(to(be[0]??""))throw new a("wrapperPeelIterations");let De=ra(be,X);if(De){for(let Me of[De.childIndex,...De.alternativeChildIndices])bc(Q),yield*oa(Me===De.childIndex?De.tokens:be.slice(Me),u,Oe,W,new Map(z),new Map(B),X,Q,!0);return}if(Nw(be)){bc(Q),yield*oa(be.slice(1),u,Oe,W,z,B,X,Q,le);return}yield Dw(be,Oe,W,z,B,le)}function Dw(n,u,v,W,z,B){return{tokens:n,cwd:u===null?void 0:u??v,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:Wt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function bc(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Nw(n){return Wt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function Ec(n,u){let v=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;v.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:v}}function yr(n){let u=!1,v=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||vc(W,"recursive")){u=!0;continue}if(W==="-f"||vc(W,"force")){v=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))v=!0}}return u&&v}function ia(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((v)=>vc(v,"recursive")||/^-[A-Za-z]+$/.test(v)&&/[rR]/.test(v.slice(1)))}function vc(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var Lw=["--init-file","--rcfile"],Ww=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Hn(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v)continue;if(v==="-c")return up(n,u,!0);if(v.startsWith("-")&&v.includes("c")&&!v.startsWith("--")){let W=up(n,u,!1);if(W!==null)return W}}return null}var dp=/^-[cn]+$/;function Xn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!dp.test(W)))return!1;let v=u.findIndex((W)=>!dp.test(W));return u.slice(0,v===-1?void 0:v).some((W)=>W.includes("n"))}var Fw=/^-[abcefhiklmnprstuvx]+$/;function sa(n){let u=n.findIndex((B,X)=>X>0&&!Fw.test(B)),v=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(v.some((B)=>B.startsWith("+")))return!0;let W=v.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=Hn(n);if(z===null)return v.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function up(n,u,v){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!v&&W.startsWith("-"))return null;return W}function mp(n){let u=Wt(n[0]??"").toLowerCase(),v=Gw(n,u),W=Ww.get(u)??null,z=v.argvSource?.kind!=="absent";return{argvSource:u==="bash"?v.argvSource:null,argvSourceApplies:u==="bash"&&v.interactive&&v.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!v.interactive:W==="ENV"&&v.interactive)}}function Gw(n,u){let v=An(n),W=v.commandIndex??v.scriptIndex??n.length,z=[],B=!1,X=!0;for(let Q=1;Q<W;Q++){let le=n[Q];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&X?Lw.find((De)=>le===De):void 0){let De=n[Q+1];z.push(De===void 0?{kind:"absent"}:{kind:"literal",value:De}),Q++;continue}let Oe=le.split("=",1)[0]??le;if(u==="bash"&&il.has(Oe)&&!le.includes("="))Q++;continue}if(u==="bash")X=!1;let ue=sl(u,le,n[Q+1],"startup");if(ue.interactive)B=le[0]==="-";Q+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var zw="find -delete permanently removes files. Use -print first to preview.",$w="find -exec rm -rf is dangerous. Use explicit file list instead.",Bw=new Set(["-exec","-execdir","-ok","-okdir"]),Uw=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function fp(n,u){let v=n.map(t),W=Hw(n,v,u);if(W)return W;if(aa(v,1)&&!Zw(n,v,u)){let X=Ft(st("find.delete",zw),u.policy);if(X)return X}let z=u.budget??_n(),B=0;while(B<v.length){let X=v[B],Q=Sr(X??"");if(Q>0){B+=Q+1;continue}if(!ar(X)){B++;continue}z.charge("derivedTokens",v.length-B-1);let le=No(v,B);B=le.nextIndex;let ue=Xw(le.tokens,u.environment);if(ue){let Me=Ft(ue,u.policy);if(Me)return Me}let be=X==="-execdir"||X==="-okdir",Oe=u.analyzeTokens?.(le.tokens,be?null:u.cwd)??null,De=Oe?.id.startsWith("custom.")?Oe:Ft(Oe,u.policy);if(De)return De}return null}function Hw(n,u,v){if(!aa(u,1)&&!Rc(u,v.environment))return null;let z=Di(n)??en(["."]),B=Un({...v,allowPaths:v.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let X of z){let Q=eo(X);for(let le of Q.expandedTargets??[t(X)]){let ue=sr(le,B,{targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return st("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!jw(n,B.protectedGitMetadata,v.environment))return st("find.delete-git-metadata",y)}}if(Yw(u)&&B.resolvedCwd&&Nf(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return st("find.delete-git-metadata",y);return null}function jw(n,u,v){if(!u)return!1;let W=n.map(t),z=[],B=!1,X=Di(n)?.at(-1),Q=X?n.indexOf(X)+1:1;while(Q<W.length){let le=W[Q]??"";if(ar(le)){let ue=No(W,Q),be=Tr([...ue.tokens],v),Oe=ia(be),De=tn.has(Wt(be[0]??"").toLowerCase()),Me=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&be.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(Oe||De||Me||Ne)return!1;B=!0,Q=ue.nextIndex;continue}if(le==="-delete"){B=!0,Q++;continue}if(le==="-name"||le==="-iname"){let ue=n[Q+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(qw(ue.text,le==="-iname"));Q+=2;continue}if(!Vw.has(le))return!1;Q+=1+Sr(le)}return z.length>0&&!Wf(u,(le)=>z.every((ue)=>ue.test(le)))}var Vw=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function qw(n,u){let v=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${v}$`,u?"isu":"su")}var Kw=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Rc(n,u){let v=0;while(v<n.length){if(!ar(n[v])){v++;continue}let W=No(n,v),z=Tr([...W.tokens],u),B=Wt(z[0]??"").toLowerCase(),X=tn.has(B)&&Kw.test((Hn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||X)&&z.some((le)=>le.includes("{}")))return!0;v=W.nextIndex}return!1}function Yw(n){return n.some((u,v)=>{if(!["-name","-iname"].includes(u))return!1;return n[v+1]?.toLowerCase()==="hooks"})}function Zw(n,u,v){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=Di(n);return W!==null&&Zs(W,v)}function Di(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},v=1;while(u(v)==="-H"||u(v)==="-P")v++;if(u(v)==="--")v++;let W=[];while(v<n.length){let z=u(v),B=n[v];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),v++}return W.length>0?W:null}function Xw(n,u){let v=rr([...n],u);if(v.length===0)return null;let W=Wt(v[0]??"");if(W==="busybox"&&v.length>1)v=v.slice(1),W=Wt(v[0]??"");if(W==="rm"&&yr(v))return st("find.exec-rm-recursive-force",$w);return null}function No(n,u){let v=u+1;while(v<n.length&&n[v]!==";"&&!(n[v]==="+"&&n[v-1]==="{}"))v++;return{tokens:n.slice(u+1,v),nextIndex:Math.min(v+1,n.length)}}function aa(n,u){let v=u;while(v<n.length){let W=n[v];if(!W){v++;continue}if(ar(W)){v=No(n,v).nextIndex;continue}let z=Sr(W);if(z>0){v+=z+1;continue}if(W==="-delete")return!0;v++}return!1}function Sr(n){return Uw.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function ar(n){return n!==void 0&&Bw.has(n)}import{resolve as Px}from"node:path";function*wc(n){for(let u of n.nodes)yield*Qw(u)}function _c(n){return[...wc(n)]}function Mt(n){return _c(n).map((u)=>u.words.map((v)=>v.text))}function Ni(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let v=u.nodes[0];if(v?.kind!=="command")return null;if(v.redirections.length>0||v.nested.length>0)return null;if(v.words.some((W)=>W.provenance==="command-substitution"))return null;return v.words.map((W)=>W.text)}function*Qw(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*wc(u);return}if(n.kind==="group")yield*wc(n.body)}var Jw=5,xc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function gn(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function gp(n,u,v){let W=Lo(n,u,v),z=e_(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,X=!1;for(let Q=0;Q<Jw;Q++){let{subcommand:le,rest:ue}=Wn(B),be=le?.toLowerCase();if(!be||!z.has(be))return{blockedReason:W.blockedReason,expanded:X,tokens:B};let Oe=z.get(be),De=i_(Oe);if(De===null||De.length===0)return{blockedReason:xc,expanded:!0,tokens:B};B=["git",...De,...ue],X=!0}return{blockedReason:xc,expanded:!0,tokens:B}}function hp(n,u,v){return Lo(n,u,v).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function Wn(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?Wt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=Dn.has(z)?2:1}return{subcommand:null,rest:[]}}function e_(n){let u=new Map;for(let v of n){let W=v.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,v.value)}return u}function Lo(n,u,v){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?Wt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=n_(u,v);return{blockedReason:B.blockedReason,entries:[...B.entries,...t_(n,u,v)]}}function t_(n,u,v){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let X=Ac(n[z+1]);if(X)W.push(X);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let X=Ac(B.slice(2));if(X)W.push(X);z++;continue}if(B==="--config-env"){let X=pp(n[z+1],u,v);if(X)W.push(X);z+=2;continue}if(B.startsWith("--config-env=")){let X=pp(B.slice(13),u,v);if(X)W.push(X);z++;continue}if(Dn.has(B)){z+=2;continue}z++}return W}function n_(n,u){let v=r_(n,u),W=o_(n,u);return{blockedReason:v===null||W===null?xc:null,entries:[...v??[],...W??[]]}}function r_(n,u){let v=fr("GIT_CONFIG_PARAMETERS",n,u);if(v===void 0)return[];let W=[],z=Ni(v);if(!z)return null;for(let B of z){let X=Ac(B);if(!X)return null;W.push(X)}return W}function o_(n,u){let v=cf(n,u);if(v.state==="absent")return[];if(v.state==="invalid")return null;let W=[];for(let z=0;z<v.count;z++){let B=fr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),X=fr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||X===void 0)return null;W.push({key:B,value:X})}return W}function Ac(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function pp(n,u,v){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:fr(n.slice(W+1),u,v)}}function i_(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return Ni(u)}var s_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",a_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",l_="git checkout --force discards uncommitted changes. Use 'git stash' first.",c_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",d_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",u_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",m_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",f_="git switch --force discards uncommitted changes. Use 'git stash' first.",p_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",g_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",h_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",y_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",S_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",C_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",b_="git push --force destroys remote history. Use --force-with-lease for safer force push.",E_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",v_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",R_="git branch -D force-deletes without merge check. Use -d for safe delete.",w_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",__="git merge --abort discards merge conflict resolutions. Use 'git status' first.",x_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",A_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",P_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",T_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",I_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",k_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),O_=new Set(["--recurse-submodules","--track","-t"]),Pc=new Set(["-b","-B","-U"]),Tc=new Set(["-c","-C"]),M_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ut(n,u){let v=n.split("=",1)[0]??n;return v.length>=4&&u.startsWith(v)&&v.startsWith("--")&&v.slice(2).length>=2}var Wo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Sp(n,u){let{subcommand:v,rest:W}=Wn(n);if(!v)return null;switch(v.toLowerCase()){case"checkout":return kr(D_(W,u));case"switch":return kr(L_(W));case"restore":return kr(F_(W));case"reset":return z_(W);case"clean":return kr(B_(W));case"rm":return kr(U_(W));case"push":return ro(H_(W));case"branch":return ro(q_(W));case"stash":return ro(Q_(W));case"worktree":return ro(J_(W));case"rebase":return kr(K_(W));case"merge":return kr(Y_(W));case"tag":return ro(Z_(W));case"reflog":return ro(X_(W));default:return null}}function kr(n){return n?{...n,localDiscard:!0}:null}function ro(n){return n?{...n,localDiscard:!1}:null}function D_(n,u){let{index:v,before:W}=gn(n),z=xn(W,{shortOptsWithValue:Pc});if(W.some((Q)=>Ut(Q,"--force"))||z.has("-f"))return st("git.checkout-force",l_);for(let Q of n){if(Q==="-b"||Q==="-B"||Q==="--orphan")return null;if(Ut(Q,"--pathspec-from-file"))return st("git.checkout-pathspec-from-file",d_)}if(v!==-1){if(W.some((le)=>!le.startsWith("-")))return st("git.checkout-ref-path",c_);return st("git.checkout-double-dash",s_)}let B=W_(n);if(B.length>=2)return st("git.checkout-ambiguous",u_);let X=B[0];if(X===void 0||z.has("-d")||z.has("-t")||n.some((Q)=>Ut(Q,"--detach")||Ut(Q,"--track")))return null;if(N_(X)||u(X))return st("git.checkout-double-dash",a_);return null}function N_(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function L_(n){let{before:u}=gn(n);if(u.some((W)=>Ut(W,"--discard-changes")))return st("git.switch-discard-changes",m_);let v=xn(u,{shortOptsWithValue:Tc});if(u.some((W)=>Ut(W,"--force"))||v.has("-f"))return st("git.switch-force",f_);return null}function W_(n){let u=[],v=0;while(v<n.length){let W=n[v];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),v++;continue}if(k_.has(W)){v+=2;continue}if(O_.has(W)){let z=n[v+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];v+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}v++}return u}function F_(n){let u=G_(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?st("git.restore-worktree",g_):st("git.restore-unstaged",p_)}function G_(n){let u=!1,v=!1,W=!0,z=!1,B=(X)=>{if(!z)W=!1,z=!0;if(X!==void 0)W=X};for(let X=0;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(Q==="--"){u||=X+1<n.length;break}if(Q==="--pathspec-from-file"){u=!0,X++;continue}if(Q.startsWith("--pathspec-from-file=")){u=!0;continue}if(Q==="-h"||Q==="--help"||Q==="--version")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(Q==="--staged"){B();continue}if(Q==="--no-staged"){B();continue}if(Q==="--worktree"){B(!0);continue}if(Q==="--no-worktree"){B(!1);continue}if(Q==="--patch"){v=!0;continue}if(Q==="--no-patch"){v=!1;continue}if(M_.has(Q)){X++;continue}if(Q.startsWith("--"))continue;if(Q==="-"){u=!0;continue}if(!Q.startsWith("-")){u=!0;continue}for(let le=1;le<Q.length;le++){let ue=Q.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){v=!0;continue}if(ue==="s"||ue==="U"){if(le===Q.length-1)X++;break}}}return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function z_(n){let u=null;for(let v of n){if(Ut(v,"--hard")){u=st("git.reset-hard",h_);break}if(Ut(v,"--merge")){u=st("git.reset-merge",y_);break}}if(!u)return null;return $_(n)?ro(u):kr(u)}function $_(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function B_(n){for(let v of n)if(v==="-n"||Ut(v,"--dry-run"))return null;let u=xn(n.filter((v)=>v!=="--"));if(n.some((v)=>Ut(v,"--force"))||u.has("-f"))return st("git.clean-force",S_);return null}function U_(n){let u=!1,v=!1,W=!1;for(let z of gn(n).before){if(Ut(z,"--no-force")){u=!1;continue}if(Ut(z,"--force")){u=!0;continue}if(Ut(z,"--no-cached")){v=!1;continue}if(Ut(z,"--cached")){v=!0;continue}if(Ut(z,"--no-dry-run")){W=!1;continue}if(Ut(z,"--dry-run")){W=!0;continue}let B=xn([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!v&&!W?st("git.rm-force",C_):null}function H_(n){let{before:u,after:v}=gn(n),W=xn(u);if(u.some((X)=>Ut(X,"--mirror")))return st("git.push-mirror",v_);if(u.some((X)=>Ut(X,"--force"))||W.has("-f")||yp(u,v).some(j_))return st("git.push-force",b_);if(u.some((X)=>Ut(X,"--delete"))||W.has("-d")||yp(u,v).some(V_))return st("git.push-delete",E_);return null}function yp(n,u){return[...n.filter((v)=>v!==""&&!v.startsWith("-")),...u]}function j_(n){return n.startsWith("+")||n.includes(":+")}function V_(n){return n.length>1&&n.startsWith(":")}function q_(n){let{before:u}=gn(n),v=xn(u),W=v.has("-D")||v.has("-d")||u.some((B)=>Ut(B,"--delete")),z=v.has("-D")||v.has("-f")||u.some((B)=>Ut(B,"--force"));if(W&&z)return st("git.branch-force-delete",R_);return null}function K_(n){let{before:u}=gn(n);return u.some((v)=>Ut(v,"--abort"))?st("git.rebase-abort",w_):null}function Y_(n){let{before:u}=gn(n);return u.some((v)=>Ut(v,"--abort"))?st("git.merge-abort",__):null}function Z_(n){let{before:u}=gn(n);return xn(u).has("-d")||u.some((W)=>Ut(W,"--delete"))?st("git.tag-delete",x_):null}function X_(n){return n[0]==="delete"?st("git.reflog-delete",A_):null}function Q_(n){for(let u of n){if(u==="drop")return st("git.stash-drop",P_);if(u==="clear")return st("git.stash-clear",T_)}return null}function J_(n){let{before:u}=gn(n);if(!u.includes("remove"))return null;let W=xn(u);if(u.some((z)=>Ut(z,"--force"))||W.has("-f"))return st("git.worktree-remove-force",I_);return null}import{isAbsolute as Rx,join as wx,resolve as _x}from"node:path";var kc="TMPDIR",Oc="IFS",bp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Ep=/^[A-Za-z_][A-Za-z0-9_]*$/,vp=new Set(["export","typeset","declare","readonly"]),ex=new Set(["builtin","command","time"]),tx=new Set(["do","then","else"]),nx=new Set(["do","then","case"]),Cp=new Set(["done","fi","esac"]),rx=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,ox=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Fo(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function Go(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function Rp(n,u,v){let W=Fo(u.shellAssignments,v);return n.map((z)=>{if(!Ip(z.text))return t(z);if(z.provenance==="variable")return wp(z.text,W);if(z.provenance==="command-substitution")return sx(z,v.darwinUserTempDir)??t(z);return z.provenance==="literal"&&rx.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function wp(n,u){return n.replace(ox,(v,W,z)=>u.get(W??z??"")??v)}var ix=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function sx(n,u){if(n.provenance!=="command-substitution")return null;let v=n.parts.map((z)=>{if(z.provenance==="command-substitution")return ix.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!v.every((z)=>z!==null))return null;let W=v.join("");return/[\s$`*?[]/.test(W)?null:W}function Qn(n,u){let v=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!v)return null;let W=wp(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function _p(n,u){return{env:n,effectiveEnvAssignments:dx(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function xp(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function Mc(n,u){let v=Pp(n,u),W=n[0]??"";if(nx.has(W))u.bodyDepth+=1;if(W==="elif"||Cp.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(Cp.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((Q)=>{u.shellAssignments.delete(Q)}),u.bodyAssignments.clear();v.assignments.filter((Q)=>Q.persists).forEach((Q)=>{if(u.shellAssignments.set(Q.name,Q.value),u.bodyDepth>0)u.bodyAssignments.add(Q.name);Dc(u,Q)});let z=v.commandIndex;if(z!==-1&&vp.has(n[z]??""))n.filter((Q)=>Ep.test(Q)&&Ic(Q)).forEach((Q)=>{ux(u,Q)});let B=z===-1?-1:Tp(n,z);if(B===-1||n[B]!=="unset")return;let X=fx(n,B);if(X===null)return;n.slice(X).forEach((Q)=>{if(u.bodyDepth>0){u.shellAssignments.set(Q,"");return}mx(u,Q)})}function Ap(n,u){let v=Pp(n,u).assignments;if(v.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return v.forEach((z)=>{W.set(z.name,z.value)}),W}function Pp(n,u){let v=tx.has(n[0]??"")?1:0,W=n.findIndex((Q,le)=>le>=v&&!Ip(Q)),z=W!==-1&&vp.has(n[Tp(n,W)]??""),B=cx(u);return{assignments:n.flatMap((Q,le)=>{let ue=ax(Q,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!Fs(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function Tp(n,u){let v=u;while(ex.has(n[v]??"")){v+=1;while(n[v]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[v]??""))return u;v+=1}}return v}function Ip(n){return Tn(n)!==null||bp.test(n)}function ax(n,u,v){return Tn(n)??lx(n,u,v)}function lx(n,u,v){let W=Gs(n,v,u);if(W)return W;let z=n.match(bp)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):v.get(z)??""}${n.slice(B+1)}`}}function Ic(n){return n===kc||n===Oc||Jl(n)}function cx(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function dx(n,u){let v=[kc,Oc].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(v.length===0)return u;return new Map([...v,...u??[]])}function Dc(n,u){let v=new Map(n.effectiveEnvAssignments??[]);v.set(u.name,u.value),n.effectiveEnvAssignments=v}function ux(n,u){Dc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function mx(n,u){if(!Ic(u)&&!Ep.test(u))return;if(n.shellAssignments.set(u,""),Fs(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!Ic(u)||u===kc||u===Oc||ni(u)){Dc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let v=new Map(n.effectiveEnvAssignments);v.delete(u),n.effectiveEnvAssignments=v.size===0?void 0:v}function fx(n,u){let v=u+1;while(v<n.length){let W=n[v];if(!W)return null;if(W==="--")return v+1;if(W==="-v"){v++;continue}if(W.startsWith("-"))return null;return v}return v}import{dirname as Op,join as la,resolve as px}from"node:path";function ca(n,u){return Ql.some((v)=>u?.has(v)||n.has(v))}function zo(n,u,v){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=v.realpath(px(u));if(W===null||!v.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,X=1;while(X<n.length){let Q=n[X];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-"))break;if(Q==="-C"){let le=n[X+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=kp(z,le,v);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,X+=2;continue}if(Q.startsWith("-C")&&Q.length>2){let le=kp(z,Q.slice(2),v);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,X++;continue}if(Q==="--git-dir"||Q==="--work-tree"){B=!0,X+=2;continue}if(Q.startsWith("--git-dir=")||Q.startsWith("--work-tree=")){B=!0,X++;continue}X+=Dn.has(Q)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function kp(n,u,v){try{let W=Pr(n,u,v);return v.isDirectory(W)?W:null}catch{return null}}function Li(n,u){if(u.entryKind(la(n,".git"))!=="missing")return n;let v=Op(n);return v===n?null:Li(v,u)}function da(n,u,v,W,z){let B=W.paths,X=la(v,".git"),Q=B.isDirectory(X),le=Q&&!W.isGitDirectory(X),ue=Mp(u).filter((be)=>le||be!==v&&Ar(be,v));return Lo(n,W.env,z).entries.some((be)=>be.key.toLowerCase()==="core.worktree")||ue.some((be)=>B.entryKind(la(be,"HEAD"))!=="missing"||be!==v&&B.entryKind(la(be,".git"))!=="missing")||Q&&W.gitDirectoryRedirects(X)}function Mp(n){let u=Op(n);return u===n?[n]:[n,...Mp(u)]}function Dp(n,u,v){if(!u.localDiscard||!v.worktreeMode||ca(v.environment.env,v.envAssignments))return null;let W=zo(n,v.cwd,v.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=v.environment.worktreeFacts(W.gitCwd),B=Li(W.gitCwd,v.environment.paths);if(!z||B===null||da(n,W.gitCwd,B,v.environment,v.envAssignments))return null;if(Nc(n,v,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Nc(n,u,v){let{subcommand:W,rest:z}=Wn(n),B=W?.toLowerCase();if(u.dynamicArguments||gx(z)||bx(n,u.environment.env,u.envAssignments,v)||Sx(z)||hx(B,z))return!0;return B==="clean"&&Cx(z)>1}function gx(n){return n.some((u)=>/[$*?[]/.test(u))}function hx(n,u){if(n==="checkout"){let{before:v}=gn(u),W=xn(v,{shortOptsWithValue:Pc}),z=v.some((X)=>Ut(X,"--force"))||W.has("-f"),B=W.has("-B")||v.some((X)=>X==="-B"||X.startsWith("-B"));return z&&B}if(n==="switch"){let{before:v}=gn(u),W=xn(v,{shortOptsWithValue:Tc}),z=v.some((X)=>Ut(X,"--force"))||v.some((X)=>Ut(X,"--discard-changes"))||W.has("-f"),B=v.some((X)=>X==="-C"||X.startsWith("-C")||yx(X))||W.has("-C");return z&&B}return!1}function yx(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function Sx(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function Cx(n){let u=0;for(let v of n){if(v==="--force"){u++;continue}if(v.startsWith("-")&&!v.startsWith("--")){for(let W of v.slice(1))if(W==="f")u++}}return u}function bx(n,u,v,W){if(fr("GIT_CONFIG_PARAMETERS",u,v)!==void 0)return!0;let z=Lo(n,u,v);if(z.blockedReason!==null)return!0;let B=z.entries.map((Q)=>({key:Q.key.toLowerCase(),value:Q.value}));if(B.some((Q)=>vx(Q.key)))return!0;let X=B.filter((Q)=>Q.key==="submodule.recurse").at(-1);if(X)return X.value===void 0||Ex(X.value);if(uf(v))return!0;return W.recursiveSubmodules}function Ex(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function vx(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function Np(n,u,v){let W=n.map((le)=>Qn(le,v.shellAssignments??new Map)??t(le)),z=v.environment.paths,B=zo(W,v.cwd,z),X=v.originalCwd?z.realpath(_x(v.originalCwd)):null;if(u.id.startsWith("git.push-")||X===null||B.gitCwd===null||B.hasExplicitGitContext||ca(v.environment.env,v.envAssignments))return null;let Q=u.id==="git.worktree-remove-force"?Ax(n,v.shellAssignments,z):Li(B.gitCwd,z);if(Q===null||u.id!=="git.worktree-remove-force"&&!xx(Q,B.gitCwd,W,u,v)||!Po(Q,v.environment)||Ws(Q,v.environment)||Ar(X,Q)||Ar(Q,X))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function xx(n,u,v,W,z){let B=z.environment.paths,X=wx(n,".git");if(B.entryKind(X)!=="present"||da(v,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(X))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Nc(v,z,le)}function Ax(n,u,v){let W=Wn(n.map(t)).rest,{before:z,after:B}=gn(W.slice(W.indexOf("remove")+1)),X=[...z.filter((be)=>!be.startsWith("-")),...B],Q=X.length===1?X[0]??"":"",le=n.find((be)=>be.text===Q),ue=(le&&Qn(le,u??new Map))??Q;if(!Rx(ue)||/[\s$`*?[]/.test(ue)||v.entryKind(ue)!=="present"||!v.isDirectory(ue))return null;return v.realpath(ue)}var Tx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Ix=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ua(n,u){return Lp(n,u)}function Lp(n,u,v){let W=n.map(t),z=gp(W,u.environment.env,u.envAssignments),B=z.blockedReason?Ft(st("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let X=z.tokens;if((df(u.envAssignments)||hp(W,u.environment.env,u.envAssignments))&&kx(X))return st("git.ssh-env",Tx);let Q=Sp(X,(ue)=>{let be=zo(W,u.cwd,u.environment.paths).gitCwd;return be!==null&&u.environment.paths.entryKind(Px(be,ue))!=="missing"});if(!Q)return null;if(z.expanded||z.blockedReason)return Q;let le=Dp(W,Q,u)??Np(n,Q,u);if(!le)return Q;return v?.(le),null}function Wp(n,u){let v=null;return{match:Lp(n,u,(z)=>{v=z}),relaxation:v}}function kx(n){let{subcommand:u,rest:v}=Wn(n),W=u?.toLowerCase();if(!W)return!1;if(Ix.has(W))return!0;if(W==="archive")return gn(v).before.some((z)=>Ut(z,"--remote"));return W==="remote"&&Ox(v)}function Ox(n){return n.find((u)=>!Mx(u))?.toLowerCase()==="update"}function Mx(n){return n==="-v"||Ut(n,"--verbose")||Ut(n,"--no-verbose")}import{isAbsolute as cA}from"node:path";function Fp(n,u,v,W){let z=n.slice(0,u),B=n.slice(u+v);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function ma(n,u,v){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>v(B).some((X)=>!z.has(W(X))))}var Gp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Dx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Lx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Wx="rm -rf in home directory is dangerous. Change to a project directory first.",zp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Lx},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Nx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Wx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Gp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Dx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Gp}};function fa(n,u){let v=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=ia(W),B=Fx(n);for(let X of B){let Q=eo(X.word);if(z&&Q.unsafeBraceExpansion){let le=Ft(cc({kind:"outside_anchored_cwd"},v,u.policy,zp),u.policy);if(le)return le;continue}for(let le of Q.expandedTargets??[X.text]){let ue=Sn(le),be={targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected};if(!z&&v.resolvedCwd&&Qr(ue,v.resolvedCwd,v.protectedGitMetadata,z,v.environment,v.budget))return st("rm.git-metadata",y);if(!z)continue;let Oe=Mo(ue,v,u.policy,zp,be);if(Oe)return Oe}}return null}function Fx(n){let u=[],v=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){v=!0;continue}if(v){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Or={kind:"none"},oo={kind:"dynamic"},Bp=new Set(["<","<<","<<-","<<<","<&","<>"]),Up=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Gx=/^(?:[0-9]+|[@*])$/,zx=_r.maxWords,Hp=_r.maxInputLength;function jp(n){if(!n||Wt($t(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),v=u[0]?.text;if(v===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(v==="%s")return W.join("");if(v==="%s\\n"||v===`%s
+`)return`${W.join(`
+`)}
+`;if(v.includes("%")||/\\(?![\\nrt])/.test(v))return;return v.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ga(n){let u=$o(n[1])==="--"?2:1;if(n.length<=u)return Or;let v=n.slice(u);if(!v.every(Gi))return oo;return{kind:"literal",source:v.map(t).join(" ")}}function Vp(n){let u=$o(n[1])==="--"?2:1,v=n[u],W=$o(v);if(v===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Or;if(!Gi(v))return oo;return{kind:"literal",source:W}}function ha(n,u){let v=Xp(n);if(v===-1)return Or;let W=Hx(u);if(!W)return Or;let z=[],B=W.command?.length??0;for(let X of W.references){let Q=Vx(X,n,v,W.ifs);if(!Q)return oo;if(B+=Q.reduce((le,ue)=>le+ue.length+3,0),z.length+Q.length>zx||B>Hp)return oo;z.push(...Q)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ie)].filter((X)=>X!==null).join(" ")}}function qp(n,u){let v=Xp(n),W=n.slice(v+1),z=/\bIFS\b/.test(u);if(v===-1||!W.every(Gi)||z)return u;let B=W.map($o),X="",Q=null,le=0;while(le<u.length){let ue=u[le]??"",be=Q==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(be){let Oe=be[1]??be[2],De=Oe==="@"||Oe==="*"?B.slice(1):[B[Number(Oe)]??""];if(Q!=='"'&&De.some((Ne)=>/[*?[]/.test(Ne)))return u;if(X+=Q==='"'?De.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(Oe==="@"?'" "':" "):De.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ie(Le):"").join(" ")).join(" "),X.length>Hp)return u;le+=be[0].length;continue}if(ue==="\\"&&Q!=="'"){X+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&Q!=='"'||ue==='"'&&Q!=="'")Q=Q?null:ue;X+=ue,le++}return X}function Bo(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function Kp(n,u,v,W){if(!An(n.map(t)).readsStdinAsCommands)return Or;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&Bp.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return z.heredoc&&Bo(z.heredoc)?{kind:"literal",source:z.heredoc.body}:Or;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return oo;return{kind:"literal",source:z.target.text}}if(!v)return Or;return W===void 0?oo:{kind:"literal",source:W}}function Yp(n){return n.some((u)=>(u.fd===void 0||u.fd===0)&&Bp.has(u.operator)&&u.operator!=="<&"&&(u.heredoc!==void 0?Bo(u.heredoc):u.target?.provenance==="literal"&&!$x.has(u.target.text)))}function Cr(n,u,v=new Map){let W=An(n.map(t)).scriptIndex;if(W===null)return Or;let z=n[W],B=z&&u!==void 0?Go(z,u):null;if(B!==null)return{kind:"literal",source:B};let X=$o(z);if(wo(z,X))return{kind:"literal",source:X};let Q=z?Qn(z,v):null;return Q===null?oo:{kind:"literal",source:Q}}var $x=new Set(["/dev/stdin","/dev/fd/0","/proc/self/fd/0"]),Zp=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Fi(n,u,v){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(_c).some((W)=>ya(W,v))}var Bx=new Set(["irm","iwr","invoke-restmethod","invoke-webrequest"]);function pa(n,u){let v=$t(n);return Zp.has(v)||u==="powershell"&&Bx.has(v)}function ya(n,u){let v=pr(n.words,u).words.map(t),W=v[0];if(W===void 0)return!1;if(pa(W,n.dialect))return!0;return lp($t(W))&&v.slice(1).some((z)=>!Ux(z)&&pa(z,n.dialect))}function Ux(n){return n.includes("/")&&!n.startsWith("/")}function Gc(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],v=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!v)return!1;if(!(u.text==="eval"&&v.quoted&&v.parts.length===3&&v.parts[0]?.raw==='"'&&v.parts[1]?.provenance==="command-substitution"&&v.parts[1].raw.startsWith("$(")&&v.parts[2]?.raw==='"'||u.text==="eval"&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let X=B.words[0]?.text;if(X===void 0||Tn(X)!==null)return!1;let Q=Wt($t(X));return!Zp.has(Q)&&!tn.has(Q)&&!to(Q)}function Xp(n){return An(n.map(t)).commandIndex??-1}function Hx(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),v=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(v),z=(W?.[3]??v).split(/\s+/).map(jx);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
+`}}function jx(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),v=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??v;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function Vx(n,u,v,W){let z=u.slice(v+2);if(n.parameter==="@")return n.quoted?Lc(z):qx(z,W);if(n.parameter==="*"){let Q=Lc(z);if(!Q)return;let le=Q.join(W[0]??"");return n.quoted?[le]:Wc(le,W)}let B=u[v+1+n.parameter];if(B&&!Gi(B))return;let X=$o(B);return n.quoted?[X]:Wc(X,W)}function Lc(n){return n.every(Gi)?n.map(t):void 0}function qx(n,u){let v=Lc(n);if(!v)return;let W=v.map((z)=>Wc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Wc(n,u){if(["*","?","[","]"].some((v)=>n.includes(v)))return;if(u==="")return n===""?[]:[n];if(u===` 	
+`)return n.trim().split(/\s+/).filter(Boolean);if(u.length!==1)return;return u===" "||u==="\t"||u===`
+`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function Gi(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function $o(n){return n?t(n):""}function Ie(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function zc(n,u){return Fc(C(n,"posix"),u)}function zi(n){return zc(n,new Set(Array.from(n.matchAll(Up)).flatMap((u)=>{let v=u[1]??u[2];return v===void 0?[]:[v]})))}function Fc(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let v=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(Fc(W.body,v))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>Fc(z,v))||Qp(W.words,v))return!0;Qx(W,v)}return!1}function Qp(n,u){let v=n.findIndex((X)=>Tn(X.text)===null);if(v===-1)return!1;let W=n[v];if(!W)return!1;if(Wi(W,u))return!0;let z=$t(W.text);if(z==="source"||z==="."){let X=n[v+1]?.text==="--"?v+2:v+1;return $p(n[X],u)}if(tn.has(z)){let X=n.slice(v),Q=X.map((be)=>be.text),le=An(Q),ue=le.commandIndex??le.scriptIndex;return!Xn(Q)&&ue!==null&&$p(X[ue],u)}let B=Kx(n,v,u);if(B===null)return!1;if(B===-1)return!0;return Qp(n.slice(B),u)}function Kx(n,u,v){let W=$t(n[u]?.text??"");if(W==="command")return Yx(n,u+1);if(W==="exec")return Zx(n,u+1);if(W==="env")return Xx(n,u+1,v);return null}function Yx(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return v}return null}function Zx(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(W==="-a"){v++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return v}return null}function Xx(n,u,v){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Wi(n[W+1],v)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Wi(z,v)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(Tn(B))continue;return W}return null}function Qx(n,u){if(!n.words.every((v)=>Tn(v.text)!==null))return;for(let v of n.words){let W=Tn(v.text);if(!W)continue;if(Wi(v,u))u.add(W.name)}}function Wi(n,u){if(!n)return!1;return n.parts.filter((v)=>v.provenance==="variable").some((v)=>Array.from(v.raw.matchAll(Up)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(Gx.test(z)||u.has(z))}))}function $p(n,u){return!!n&&(n.parts.some((v)=>v.provenance!=="literal"&&v.provenance!=="variable")||Wi(n,u))}var $c="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Bc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Jx="__CC_SAFETY_NET_XARGS_INPUT__",Sa="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ca="rm",eA=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tA=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,nA=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rA=/^(?:[0-9]+|[@*])$/;function tg(n,u){let v=n.map(t),{childStart:W,replacementToken:z}=io(v),B=v.slice(W),X=st("xargs.shell-dynamic",Bc);if(iA(B,z,u)&&Ft(X,u.policy))return Ft(X,u.policy);for(let Q of Zn(B,u)){let le=Q.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Ft(X,u.policy):null;if(ue)return ue;let be=ag(le,z,Q.wrapperEnvAssignments),Oe=Q.head==="rm"&&z!==null&&ig(le,z),De=u.analyzeChild(le,{...no(Q,u),dynamicInput:be,dynamicSourceInput:Oe||rg(le,Q.head,z,Q.wrapperEnvAssignments,be,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:Oe,shellDynamicMatch:X,dynamicSourceMatch:X,rmDynamicMatch:st("xargs.rm-recursive-force-dynamic",$c)});if(De)return De;let Me=oA(le,z,u.policy?.rules??[],Ft(X,u.policy));if(Me)return Me;if(Q.head==="git"){let Le=z===null?[...le,Jx]:le,We=z!==null&&(le.some((Be)=>Be.includes(z))||Array.from(Q.envAssignments.values()).some((Be)=>Be.includes(z))),it=u.analyzeChild(Le,{...no(Q,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(it)return it}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function oA(n,u,v,W){if(v.length===0)return null;if(u===null){for(let B of v){let X=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],v);if(X)return X}return null}let z=$t(n[0]??"");if(!v.some((B)=>$t(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function ng(n,u,v){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=Fp(n,W,u.length,v);return z===null?[]:[z]}function rg(n,u,v,W,z,B,X){if(tn.has(u)){if(Xn(n))return!1;if(v!==null&&sA(n,v,X))return!0;let Q=Hn(n);if(!Q){let le=Cr(en(n));if(le.kind==="literal")return v!==null&&le.source.includes(v);return le.kind==="none"&&z}if(v!==null&&Q.includes(v)&&!og(Q,v,X))return!0;if(Bn(Q))return!0;return aA(Q,v,W)}if(Nn(u))return Jp(n,v,Qs,jf(u));if($n.has(u))return Jp(n,v,Sc,np);if(u==="eval"){let Q=ga(en(n));if(Q.kind==="dynamic")return!0;if(v!==null)return Q.kind==="literal"&&Q.source.includes(v);return z}if(u==="find")return lA(n,v,B);if(u==="git"){let Q=Wn(n);return v===null?Q.subcommand===null:(Q.subcommand?.includes(v)??!1)||Q.subcommand!==null&&Wo.has(Q.subcommand.toLowerCase())&&sg(Q.rest,v).some((le)=>le.includes(v))}return!1}function og(n,u,v){if(v===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Bn(B)===null&&v(B)===null}function Jp(n,u,v,W){let z=v(n);if(u===null)return z.optionsOpen||v([...n,Sa]).sources.some((Q)=>Q.value===Sa);if(z.sources.some((Q)=>Q.value.includes(u)))return!0;let B=W.flatMap((Q)=>[Q.selector,...Q.valueForm==="attached-only"||Q.valueForm==="attached-or-separate"?[`${Q.selector}${Sa}`]:[],...Q.valueForm==="equals-or-separate"?[`${Q.selector}=${Sa}`]:[]]),X=new Set(B.flatMap((Q)=>n.flatMap((le)=>ng(le,u,Q))));return ma(z.sources,X,(Q)=>v(n.map((le)=>le.replaceAll(u,Q))).sources)}function iA(n,u,v){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(Zn(n,v),(B)=>B.head)),z=u===null?[...n,Ca]:n.map((B,X)=>X===0?B:B.replaceAll(u,Ca));return Array.from(Zn(z,v)).some((B)=>B.head===Ca&&!W.has(Ca))}function ig(n,u){return sg(n.slice(1),u).some((v)=>v.includes(u)&&(v.startsWith("-")||v.startsWith(u)))}function sg(n,u){let v=n.findIndex((W)=>W==="--"&&!W.includes(u));return v===-1?n:n.slice(0,v)}function ag(n,u,v){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(v.values()).some((W)=>W.includes(u))}function sA(n,u,v){let W=An(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!og(z,u,v)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((X)=>n.some((Q,le)=>{if(le===0||!Q.includes(u))return!1;return ng(Q,u,X).some((be)=>{let Oe=n.map((Me,Ne)=>Ne===le?Me.replaceAll(u,be):Me),De=An(Oe);if(De.commandIndex===null&&De.scriptIndex===null)return!1;if(W.commandIndex===null&&De.commandIndex!==null)return!0;if(W.scriptIndex===null&&De.scriptIndex!==null)return!0;if(De.commandIndex!==null&&(Oe[De.commandIndex]??"").includes(be))return!0;return De.scriptIndex!==null&&(Oe[De.scriptIndex]??"").includes(be)})}))}function aA(n,u,v){let W=new Set(u===null?[]:Array.from(v).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(eA))if(eg(z,W))return!0;for(let z of n.matchAll(tA))for(let B of(z[1]??"").matchAll(nA))if(eg(B,W))return!0;return zc(n,W)}function eg(n,u){let v=n[1]??n[2];return v!==void 0&&(rA.test(v)||u.has(v))}function lA(n,u,v){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let X=n[B]??"";if(!W&&!X.startsWith("-")&&X!=="!"&&X!=="("){if(X.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(ar(X)){let le=No(n,B);B=le.nextIndex-1;for(let ue of Zn(le.tokens,{environment:v,cwd:void 0})){let be=ag(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&ig(ue.tokens,u)||rg(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,be,v))return!0}continue}let Q=Sr(X);if(Q>0){if(z=Q,X.includes(u))return!0;continue}if(X.includes(u))return!0}return!1}function io(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),v=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:v};if(!z.startsWith("-"))return{childStart:W,replacementToken:v};if(z==="-I"){v=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){v=z.slice(2),W++;continue}if(z==="--replace"){v="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);v=B===""?"{}":B,W++;continue}if(z==="-J"){v=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:v}}var $i="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Bi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",dA="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",uA="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ea=/\{[^{}\s]*\}/g,lg=/\{\}|\{-?\d+\}/g,cg=/[\s;&|<>()$`\\"']/,mA=["e","f","source","file","-e","-f","--source","--file"],fA=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],pA=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),gA=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),dg=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),hA=new Set(["--workdir","--wd"]),ug="__CC_SAFETY_NET_PARALLEL_SOURCE__";function jn(n,u){for(let v of n){let W=u(v);if(W)return W}return null}function pg(n){return jn([...n],(u)=>Bn(u))}function gg(n,u){let v=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=Uo(u);if(Ne)return Ne}if(v.length===2&&(v[1]==="--version"||v[1]==="--help"))return null;let z=Ag(v),{template:B,jobs:X,runsRemotely:Q,readsCommandsFromInput:le,unsupported:ue,workdir:be,dryRun:Oe}=z;if(ue){let Ne=Uo(u);if(Ne)return Ne;let Le=pg(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=RA(u);if(Ne)return Ne}if(be!==void 0&&Q){let Ne=Uo(u);if(Ne)return Ne}let De=wA(be,u.cwd,u.environment.paths);if(De===null){let Ne=Uo(u);if(Ne)return Ne}let Me=Q?{...u,cwd:void 0,originalCwd:void 0}:De===null||De===void 0||De===u.cwd?u:{...u,cwd:De};if(Oe){if([...Zn(B,Me)].flatMap((Le)=>[...Le.envAssignments.values()]).some(jc)){let Le=Uo(u);if(Le)return Le}return null}if(B.length===0){let Ne=X.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=Eg(Me.envAssignments,Me.cwd,Q);return jn(Ne,(We)=>u.analyzeNested(We,Le))}return jn(Zn(B,Me),(Ne)=>yA(Ne,z,u,Me))}function yA(n,u,v,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:X}=u,Q=n.tokens,le=[...n.envAssignments.values()];if(le.some(_g)){let at=Uo(v);if(at)return at}let ue=pg(le);if(ue)return ue;let be=le.some(qt),Oe=z||be,De=X&&Oe,Me=Eg(n.envAssignments,n.wrapperCwd,B||De),Ne=Oe?{...Me,worktreeMode:!1}:Me,Le=Q.join(" "),We=qt(Le.split(/[ \t\n=]/,1)[0]??""),it=!u.quotesCommand&&(We||Q.some((at)=>cg.test(at))),Be=We||cg.test(Q[0]??""),ze=it&&Be&&u.jobs.length>0?null:SA(n,u,v,W,Ne,be);if(ze||!it)return ze;return hg(qt(Le)?Le:`${Le} {}`,!We,n,u,v,W,Ne)}function SA(n,u,v,W,z,B){let{jobs:X,templateHasPlaceholder:Q,runsRemotely:le,usesStdin:ue}=u,be=n.tokens,Oe=Q||B;if(tn.has(n.head)){let Me=()=>{if(!Q||X.length===0)return null;return jn(X,(We)=>v.analyzeChild(ba(be,We,v.budget),no(n,W)))};if(Xn(be))return Me();if(sa(be))return ir();let Ne=Hn(be);if(Ne){if(xg(Ne)){let ze=Mr(v);if(ze)return ze;if(X.length===0)return null;return jn(X,(at)=>v.analyzeNested(Rg(Ne,at,v.budget),z))}if(qt(Ne))return hg(Ne,!1,n,u,v,W,z);let We=!B&&(!Q||X.length>0)?(X.length>0?X:[void 0]).map((ze)=>ha(en(ze===void 0?be:Q?be.map((at)=>vg(at,ze)):[...be,...ze]),Ne)):[];if(We.some((ze)=>ze.kind==="dynamic")){let ze=Mr(v);if(ze)return ze}let it=We.flatMap((ze)=>ze.kind==="literal"?[ze.source]:[]);if(it.length>0)return v.budget.charge("derivedTokens",it.length),jn(it,(ze)=>v.analyzeNested(ze,z));if(zi(Ne)){let ze=Mr(v);if(ze)return ze}let Be=v.analyzeNested(Ne,z);if(Be)return Be;if(Oe)return Mr(v);return null}let Le=Cr(en(be));if(Le.kind==="dynamic"||Le.kind==="literal"&&qt(Le.source))return Mr(v)??Me();if(Le.kind==="literal")return Me();if(X.length>0){let We=Mr(v);if(We)return We;let it=Me();if(it)return it;if(Q)return null;let Be=X.flatMap((ze)=>ze[0]===void 0?[]:[ze[0]]);return v.budget.charge("derivedTokens",Be.length),jn(Be,(ze)=>v.analyzeNested(ze,z))}if(Oe||ue)return Mr(v)??Me();return null}if(n.head==="rm"&&yr(be)){if(Q&&X.length>0)return jn(X,(Ne)=>Uc(ba(be,Ne,v.budget,lg),n.cwd,W));if(X.length>0)return jn(X,(Ne)=>Uc(fg(be,Ne,v.budget),n.cwd,W));let Me=Uc(be.flatMap((Ne,Le)=>{if(Le===0||!qt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(lg,"")]:[]}),n.cwd,W);if(Me)return Me;return bg(v)}let De=X.length>0?X:[void 0];return jn(De,(Me)=>{let Ne=Me===void 0?be:Q?ba(be,Me,v.budget):fg(be,Me,v.budget),Le=st("parallel.shell-dynamic",Bi),We=ue&&n.head==="find"?vA(Ne,W):null,it=Sg(Ne,ue,v)??We?.customResult??null,Be=$t(n.head),ze=ue&&(Be==="rm"&&Hc(Ne)||Be==="xargs"&&Cg(Ne)||We?.rmOptions===!0),at=ue&&(ze||We?.executedSource===!0||We===null&&yg(Ne,Be)),Rt=v.analyzeChild(Ne,{...no(n,W),worktreeMode:le||ue||Oe?!1:v.worktreeMode,dynamicInput:ue||Oe,dynamicRmInput:ze,dynamicSourceInput:it!==null||at,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",$i)});if(at){let Tt=Ft(Le,v.policy);if(Tt)return Tt}return Rt??it??F(Ne,v.policy?.rules??[])})}function hg(n,u,v,W,z,B,X){if(W.jobs.length>0)return jn(W.jobs,(ue)=>z.analyzeNested(Rg(n,u?ue.map(Ie):ue,z.budget),X));let Q=Ni(n);if(Q?.[0]&&$t(Q[0])==="rm"&&yr(Q)){let ue=bg(z);if(ue)return ue}return(Q?z.analyzeChild(Q,{...no(v,B),dynamicInput:W.usesStdin,shellDynamicMatch:st("parallel.shell-dynamic",Bi),rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",$i)}):null)??z.analyzeNested(n,X)}function yg(n,u){if(qt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(tn.has(u))return EA(n);if(u==="git")return CA(n);if(u==="find")return!0;if($n.has(u))return mg(n,mA,Mi);if(Nn(u))return mg(n,fA,Xs);return!1}function Hc(n){let u=n.indexOf("--"),v=n.slice(1,u===-1?void 0:u);if(!n.some(qt))return u===-1;return v.some((z)=>qt(z)&&(z.startsWith("-")||xg(z)))}function CA(n){if(bA(n))return!0;let u=Wn(n);if(u.subcommand===null||qt(u.subcommand))return!0;if(!Wo.has(u.subcommand.toLowerCase()))return!1;let v=u.rest.indexOf("--"),W=u.rest.slice(0,v===-1?void 0:v);if(!n.some(qt))return v===-1;return W.some(qt)}function bA(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v||v==="--"||!v.startsWith("-"))return!1;if(v==="-c"||v==="--config-env"){if(qt(n[u+1]??""))return!0;u++;continue}if(v.startsWith("-c")&&v.length>2||v.startsWith("--config-env=")){if(qt(v))return!0;continue}if(qt(v))return!0}return!1}function EA(n){if(Xn(n))return!1;let u=Hn(n);if(u!==null)return qt(u);let v=Cr(en(n));if(v.kind==="literal")return qt(v.source);if(v.kind==="dynamic")return!0;return!n.some(qt)}function mg(n,u,v){let W=v(n);if(W.some((z)=>qt(z.value)))return!0;if(!n.some(qt))return v([...n,ug]).some((z)=>z.value===ug);return ma(W,u,(z)=>v(n.map((B)=>vg(B,[z]))))}function Sg(n,u,v){let W=v.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>$t(B.command)===$t(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(qt))return Mr(v);return jn(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function vA(n,u){let v={customResult:null,executedSource:!n.some(qt),rmOptions:!1},W=!1,z=0,B=null,X=()=>{if(!B?.some(qt))return;for(let Q of Zn(B,u))v.executedSource||=yg(Q.tokens,Q.head),v.rmOptions||=Q.head==="rm"&&Hc(Q.tokens)||Q.head==="xargs"&&Cg(Q.tokens),v.customResult??=Sg(Q.tokens,!0,u)};for(let Q of n.slice(1)){if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){v.executedSource||=qt(Q);continue}if(W=!0,B){if(Q===";"||Q==="+"){X(),B=null;continue}B.push(Q);continue}if(z>0){z--;continue}if(ar(Q)){B=[],v.executedSource||=qt(Q);continue}let le=Sr(Q);if(le>0){z=le,v.executedSource||=qt(Q);continue}v.executedSource||=qt(Q)}return X(),v}function Cg(n){let u=n.slice(io(n).childStart);return $t(u[0]??"")==="rm"&&Hc(u)}function va(n,u){return(v)=>Ft(st(n,u),v.policy)}var Mr=va("parallel.shell-dynamic",Bi),RA=va("parallel.command-stream-dynamic",dA),Uo=va("parallel.command-stream-dynamic",uA),bg=va("parallel.rm-recursive-force-dynamic",$i);function Uc(n,u,v){return Ft(fa(en(n),{environment:v.environment,cwd:u,budget:v.budget,originalCwd:v.originalCwd,strict:v.strict,paranoid:v.paranoidRm,allowTmpdirVar:v.allowTmpdirVar,tmpdirWordSplittingUnsafe:qr(v.envAssignments??new Map,v.environment),trustedTmpdirValue:Ao(v.envAssignments??new Map,v.environment),protectedGitMetadata:v.protectedGitMetadata,policy:v.policy}),v.policy)}function Eg(n,u,v){let W={};if(n)W.envAssignments=n;if(v)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function vg(n,u){return n.replace(Ea,(v)=>wg(v,u))}function ba(n,u,v,W=Ea){return v.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let X=wg(B,u);return v.charge("derivedTokens",Math.max(1,Math.ceil(X.length/64))),X}))}function Rg(n,u,v){return ba([n],u,v)[0]??""}function fg(n,u,v){return v.charge("derivedTokens",n.length+u.length),[...n,...u]}function wg(n,u){let v=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(v===void 0)return u[0]??"";let W=Number(v);return u[W>0?W-1:u.length+W]??""}function qt(n){return n.search(Ea)!==-1}function _g(n){if(jc(n))return!0;for(let u of n.matchAll(Ea))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function jc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function xg(n){return/^\{[^{}\s]*\}$/.test(n)}function wA(n,u,v){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!cA(n))return null;try{return Pr(u??n,n,v)}catch{return null}}function Ag(n){let u=1,v=[],W=n.length,z=-1,B=!1,X=!1,Q=!1,le,ue=!1,be=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let at=Ec(n,u+1);v.push(...at.templateTokens),W=u+1,z=at.markerIndex;break}if(!Le.startsWith("-")){let at=Ec(n,u);v.push(...at.templateTokens),W=u,z=at.markerIndex;break}let We=n[u+1],it=Le.indexOf("="),Be=it===-1?Le:Le.slice(0,it),ze=it===-1?void 0:Le.slice(it+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){be||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){be=!0,u+=2;continue}if(Be==="--replace"||Le.startsWith("-i")&&Le.length>2){let at=Be==="--replace"?ze:Le.slice(2);be||=at!==""&&at!=="{}",u++;continue}if(Le==="-a"||gA.has(Be)){be=!0,u+=ze===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){X=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){Q=!0,u++;continue}if(Be==="--env"){be=!0,u+=ze===void 0?2:1;continue}if(dg.has(Be)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=dg.has(Le)?2:1;continue}if(hA.has(Be)){be=!0;let at=ze??We;if(at===void 0||at===":::"||at==="--"){u++;continue}le=at,u+=ze===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&ze!==void 0){u++;continue}if(pA.has(Le)){if(We===void 0||We===":::"||We==="--"){be=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}be||=v.some(ue?jc:_g);let Oe=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let it=n[We];if(it===":::"){Oe.push(Le),Le=[];continue}if(it!==void 0)Le.push(it)}Oe.push(Le)}be||=Oe.length>1;let De=_A(Oe),Me=v.some(qt),Ne=v.length===0&&z===-1;return{template:v,jobs:De,childStart:W,templateHasPlaceholder:Me,runsRemotely:B,quotesCommand:X,usesStdin:Q||z===-1,readsCommandsFromInput:Ne,unsupported:be,workdir:le,dryRun:ue}}function _A(n){if(n.length===0||n.some((v)=>v.length===0))return[];let u=[[]];for(let[v,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let X of u)X.push(B);if(u.length*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let X of W){if((z.length+1)*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,X])}u=z}return u}function Pg(n){return Ag(n).childStart}var xA="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ra="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function qc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function Vc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ig(n,u,v,W,z=!1,B){let Q=(fi(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&dn(B,"shell.dynamic-executable",z)?st("shell.dynamic-executable",xA):null;return Ft(Q,B)??kg(n,u,v,z,B)}function kg(n,u,v,W,z){if(u.length<2)return null;let B=u.flatMap((Q,le)=>qc(Q)?[le]:[]);if(B.length===0)return null;let X=$t(u[0]?.text??"");if(X==="git"){let Q=ce(n,u),le=PA(Q);if(dn(z,"shell.dynamic-structure",W)&&B.some((Oe)=>Oe<=le))return Ft(st("shell.dynamic-structure",Ra),z);if(Ft(ua(Q,{environment:v}),z))return null;let ue=u[le]?.text.toLowerCase(),be=Q.findIndex((Oe,De)=>De>le&&t(Oe)==="--");if(dn(z,"shell.dynamic-structure",W)&&ue&&Wo.has(ue)&&B.some((Oe)=>Oe>le&&(be===-1||Oe<be)))return Ft(st("shell.dynamic-structure",Ra),z);return null}if(X==="find")return dn(z,"shell.dynamic-structure",W)&&TA(u)?Ft(st("shell.dynamic-structure",Ra),z):null;if(X==="rm"){let Q=u.findIndex((ue,be)=>be>0&&t(ue)==="--"),le=yr(u.map(t));return dn(z,"shell.dynamic-structure",W)&&B.some((ue)=>(Q===-1||ue<Q)&&(ue<u.length-1||!le))?Ft(st("shell.dynamic-structure",Ra),z):null}if(X==="xargs")return Tg(n,u.slice(io(u.map(t)).childStart),"xargs",v,W,z);if(X==="parallel")return Tg(n,u.slice(Pg(u.map(t))),"parallel",v,W,z);return null}function Tg(n,u,v,W,z,B){if(u.length===0)return null;let X=AA(u,W);if(fi(n,X)){let le=Ft(st(`${v}.shell-dynamic`,v==="xargs"?Bc:Bi),B);if(le)return le}let Q=kg(n,X,W,z,B);if(Q)return Q;if(X[0]?.text==="rm"&&X.slice(1).some((le)=>qc(le)&&Vc(le)))return Ft(st(`${v}.rm-recursive-force-dynamic`,v==="xargs"?$c:$i),B);return null}function AA(n,u){let v=pr(n,u),W=v.rewritten?en(v.words.map(t)):v.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function PA(n){let u=1;while(u<n.length){let v=n[u],W=v?t(v):"";if(Dn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function TA(n){let u=!1,v=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let X=n[B];if(!X)continue;let Q=qc(X);if(v>0){v--;continue}if(z){if(X.text===";"||X.text==="+"){z=!1,u=!0,W=!1;continue}if(Q&&(W||Vc(X)))return!0;W=!1;continue}if(!u&&!X.text.startsWith("-")){if(Q&&(B>1||Vc(X)))return!0;continue}if(u=!0,Q)return!0;let le=Sr(X.text);if(le>0){v=le;continue}if(ar(X.text))z=!0,W=!0}return!1}function Kc(n,u){return n.some((v)=>{if(v.value==="-"&&(v.kind==="main-script"||v.kind==="program-file"))return!0;return!wo(u[v.tokenIndex],v.value)})}var IA="unshare creating a user namespace grants root inside it, a common step toward privilege escalation. Ask the user to run it manually if it is needed.",kA=/^--(?:user|map-root-user|map-current-user|map-auto|map-subids|map-(?:user|group)s?|owner|mount-binfmt|load-interp)(?:=|$)/,OA=/[Urcl]/,MA=/[RwSGl]/,DA=new Set(["--propagation","--setgroups","--root","--wd","--setuid","--setgid","--map-user","--map-group","--map-users","--map-groups","--owner","--whitelist-env","--load-interp"]);function Og(n){let u=n.slice(1).search(MA);return u===-1?n.length:u+1}function NA(n){return DA.has(n)||/^-[^-]/.test(n)&&Og(n)===n.length-1}function LA(n){return n.startsWith("--")?kA.test(n):OA.test(n.slice(1,Og(n)+1))}function Mg(n,u){if(n!=="unshare")return null;let v=u.slice(1),W=(B)=>NA(v[B-1]??""),z=v.findIndex((B,X)=>!W(X)&&(B==="--"||!B.startsWith("-")));return v.slice(0,z===-1?void 0:z).some((B,X)=>!W(X)&&LA(B))?st("unshare.user-namespace",IA):null}var WA="This reaches a cloud metadata endpoint, which hands out instance credentials. Ask the user to run metadata requests manually if they are needed.",FA="This uploads data to a remote host, which can send local files or secrets off the machine. Send it to localhost instead, or ask the user to run the upload manually if it is needed.",GA=/(?<![\w.-])(?:169\.254\.169\.254|169\.254\.170\.23|169\.254\.170\.2|100\.100\.100\.200|metadata\.google\.internal|metadata\.goog)(?![\w-]|\.[\w-])|(?<![\w:])fd00:ec2::(?:254|23)(?![\w:])/i,Yc=new Set(["xargs","find"]),Dg=(n)=>new Map(Object.entries(n).flatMap(([u,v])=>v.map((W)=>[W,u]))),Ng=new Map([["curl",Dg({data:["-d","--data","--data-ascii","--data-binary","--data-raw","--data-urlencode","--json"],upload:["-F","--form","--form-string","-T","--upload-file"],url:["--url","-x","--proxy","--preproxy"],source:["-K","--config"],local:["--unix-socket","--abstract-unix-socket"],get:["-G","--get"],value:[..."ACDEHPQUXYbcehmortuwyz".split("").map((n)=>`-${n}`),"--output","--output-dir","--header","--proxy-header","--request","--user-agent","--user","--proxy-user","--max-time","--connect-timeout","--write-out","--cookie","--cookie-jar","--referer","--retry","--retry-delay","--retry-max-time","--cert","--key","--cacert","--capath","--range","--resolve","--connect-to","--limit-rate","--oauth2-bearer","--dump-header","--continue-at","--time-cond","--interface","--max-filesize","--max-redirs","--noproxy","--url-query","--aws-sigv4","--variable","--stderr","--trace","--trace-ascii"]})],["wget",Dg({upload:["--post-data","--post-file","--body-data","--body-file"],source:["-i","--input-file"],value:[..."ABDIOPQRTUXaelotw".split("").map((n)=>`-${n}`),"--output-document","--output-file","--append-output","--header","--user-agent","--method","--timeout","--tries","--user","--password","--directory-prefix","--execute","--wait","--referer","--load-cookies","--save-cookies","--ca-certificate","--certificate","--private-key"]})]]),zA=/^(?:localhost|[a-z\d-]+(?:\.[a-z\d-]+)*\.localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\])$/;function Wg(n,u){if($A(n,u))return st("network.cloud-metadata",WA);return UA(n,u)?st("network.upload-remote",FA):null}function $A(n,u){return(Yc.has(n)?u.slice(1).some(Lg):Lg(n))&&u.some((W,z)=>!BA(u[z-1],W)&&GA.test(W))}function Lg(n){let u=Zc(n);return ds.has(u)||Nn(u)}function BA(n,u){return n==="--noproxy"||u.startsWith("--noproxy=")}function UA(n,u){let v=Yc.has(n)?u.findIndex((Me,Ne)=>Ne>0&&Ng.has(Zc(Me))):0,W=Ng.get(Zc(u[v]??n));if(v<0||W===void 0)return!1;let z=u.slice(v+1),B=z.findIndex((Me)=>Me===";"||Me==="+"),X=B<0||!Yc.has(n)?z:z.slice(0,B),Q=new Set,le=[],ue=(Me,Ne)=>{if(Q.add(Me),Me==="url"&&Ne!=="")le.push(Ne);if(Me==="source")le.push("")},be=0,Oe=!1;while(be<X.length){let Me=X[be]??"";if(be++,Oe||!Me.startsWith("-")||Me==="-"){le.push(Me);continue}if(Me==="--"){Oe=!0;continue}if(Me.startsWith("--")){let Be=Me.indexOf("="),ze=W.get(Be<0?Me:Me.slice(0,Be));if(ze===void 0)continue;let at=ze!=="get",Rt=Be>=0?Me.slice(Be+1):at?X[be]??"":"";if(at&&Be<0)be++;ue(ze,Rt);continue}let Ne=Me.slice(1).split(""),Le=Ne.findIndex((Be)=>{let ze=W.get(`-${Be}`);return ze!==void 0&&ze!=="get"});if((Le<0?Ne:Ne.slice(0,Le)).some((Be)=>W.get(`-${Be}`)==="get"))Q.add("get");if(Le<0)continue;let We=W.get(`-${Me[Le+1]}`)??"value",it=Me.slice(Le+2);if(it==="")be++;ue(We,it===""?X[be-1]??"":it)}return(Q.has("upload")||Q.has("data")&&!Q.has("get"))&&!Q.has("local")&&!(le.length>0&&le.every(HA))}function Zc(n){return $t(Wt(n))}function HA(n){let u=n.replace(/^[a-z][a-z\d+.-]*:\/\//i,"").split(/[/?#]/)[0]??"",v=u.slice(u.lastIndexOf("@")+1).toLowerCase(),W=v.startsWith("[")?v.slice(0,v.indexOf("]")+1):v.split(":")[0];return zA.test(W??"")}var Fg="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",jA="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",VA="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",qA="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",KA="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",YA="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",ZA={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:qA},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:VA},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:YA},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Fg},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:jA},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Fg}},XA=/^\/\/?[ck]$/i,Gg=/[&|]+/,QA=/(?:"[^"]*"|[^\s"])+/g,JA=/[\^%!]/,eP=/\\"./s,tP=/(^|\/)[*.]*\*[*.]*$/,nP=/^"?[\\/]+[?.][\\/]/,rP=new Set(["rmdir","rd","del","erase"]),oP=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,iP=/\/s(?!\w)/i,sP=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function zg(n,u){let v=n.map(t),W=v.findIndex((De)=>XA.test(De));if(W===-1)return null;let z=v.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,X=B.split(Gg).map((De)=>{let Me=De.match(QA)??[],Ne=Me.findIndex((We)=>rP.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Me.slice(Ne);return{piece:De,tokens:Me,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),Q=X.filter((De)=>De.recursiveDelete),le=Q.length>0||oP.test(B)&&iP.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((De)=>eP.test(De))||Q.some((De)=>De.tokens.some((Me)=>nP.test(Me)))))return st("cmd.recursive-delete-escaped-quote",KA);let ue=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),be=X.reduce((De,Me)=>De??(Me.recursiveDelete?aP(Me.deleteTokens,ue,u.policy):u.analyzeNested(Me.piece)),null),Oe=le&&(Q.length===0||JA.test(B)||sP.test(B)||B.includes('"')&&Gg.test(B));return be??(Oe?ir():null)}function aP(n,u,v){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??Mo(ki(z.replaceAll('"',"")).replace(tP,"$1*"),u,v,ZA),null)}var lP="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",cP=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,dP=/^-(?:executionpolicy|ep)$/i,uP=/^-(?:command|c)$/i,mP=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,fP="encodedcommand",pP=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,gP=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,hP=/[$`]/,yP="--%";function $g(n,u){let v=n.map(t),W=v.every((B,X)=>X===0||B!==yP&&SP(n[X],B))?Qc(v):void 0;if(W!==void 0)return u(W);if(v.some(CP))return ir();let z=v.join(" ");return pP.test(z)&&gP.test(z)?st("powershell.nested-recursive-delete-unread",lP):null}function Qc(n){let u=Xc(n,1),v=u===void 0?[]:n.slice(u+1);return v.length>0?v.join(" "):void 0}function Xc(n,u){let v=n[u]??"";if(uP.test(v))return u;if(cP.test(v))return Xc(n,u+1);return dP.test(v)?Xc(n,u+2):void 0}function SP(n,u){return n?.provenance==="unknown"?!hP.test(u):wo(n,u)}function CP(n){let u=mP.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||fP.startsWith(u))}var bP="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",EP="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",vP=/[efBMT@]/,RP=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function Bg(n,u){let v=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],be=ue?t(ue):"";if(B++,!ue)continue;if(z||be==="-"||!be.startsWith("-")){v.push(ue);continue}if(be==="--"){z=!0;continue}if(be.startsWith("--")){if(W||=be==="--del"||be.startsWith("--dele"),!be.includes("=")&&RP.has(be.slice(2)))B++;continue}if(be.slice(1).search(vP)===be.length-2)B++}let X=v.slice(1).filter((ue)=>!wP(t(ue)));if(!W||X.length===0)return null;let Q=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=X.flatMap((ue)=>{let be=eo(ue);return(be.expandedTargets??[t(ue)]).map((Oe)=>sr(Oe,Q,{targetIsLiteral:be.expandedTargets!==void 0||be.targetIsLiteral,tmpdirWordSplittingProtected:be.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return st("rm.recursive-force-root-or-home",EP);if(le.includes("git_metadata_target"))return st("rm.git-metadata",y);if(Zs(X,u))return null;return Ft(st("rsync.delete",bP),u.policy)}function wP(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Hg=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>fa(n.words,wa(n))},{heads:new Set(["cmd"]),analyze:(n)=>zg(n.words,{...wa(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Dr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>$g(n.parsedWords,(u)=>Dr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>ua(n.words,Jc(n))},{heads:new Set(["find"]),analyze:(n)=>fp(n.words,{...wa(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>Bg(n.words,{...wa(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>tg(n.words,{...Ug(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Dr(n.options.analyzeNested(u,v))})},{heads:new Set(["parallel"]),analyze:(n)=>gg(n.words,{...Ug(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Dr(n.options.analyzeNested(u,v))})}];function Ug(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Dr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function wa(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:qr(n.envAssignments,n.options.environment),trustedTmpdirValue:Ao(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function Jc(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function Kg(n){return Hg.find((u)=>u.heads.has(n))?.analyze}function jo(n,u,v){let W=v.trace;if(n.length===0)return null;let z=v.commandView?.dialect??"posix",B=(Et)=>Et.map((zt)=>z==="posix"?t(zt):zt.text),X=v.child,Q=X!==void 0&&!X.embedded,le=X?.embedded===!0,ue=v.effectiveCwd===null,be=X?X.cwd:ue?void 0:v.effectiveCwd??v.cwd,Oe=X?X.originalCwd:ue?void 0:v.cwd,De=Ae(n);if(De.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...De.envAssignments.keys()],output:B(De.words)});let Me=pr(De.words,v.environment,be,new Map([...v.envAssignments??[],...De.envAssignments])),Ne=Me.envSplitValues??[];if(Ne.length>0){let Et=[...Ne,...B(Me.words)].join(" "),zt=Bn(Et);if(zt)return W?.recordSegment({type:"dangerous-text",token:Et,matched:!0,reason:zt.reason}),Rn(zt);if(v.strict)return bn(W);let Zt=Kr(Ne,B(Me.words));if(Zt){v.budget.charge("derivedTokens",Zt.length);let Fn=v.analyzeNested(Zt.join(" "),{effectiveCwd:Me.cwd===void 0?v.effectiveCwd:Me.cwd,envAssignments:new Map([...v.envAssignments??[],...De.envAssignments,...Me.envAssignments])});if(Fn)return Fn}}let Le=Me.rewritten?en(B(Me.words)):ce(z,Me.words),We=B(Le),it={...v,wrapperNormalizationBudget:v.wrapperNormalizationBudget??{iterations:0}};if(W&&De.words.length>Le.length){let Et=B(De.words);W.recordSegment({type:"leading-tokens-stripped",input:Et,removed:Et.slice(0,Et.length-Le.length),output:We})}let Be=new Map([...v.envAssignments??[],...De.envAssignments,...Me.envAssignments]),ze=We[0];if(!ze)return null;if(to(ze))throw new a("wrapperPeelIterations");let at=$t(ze),Rt=Me.cwd===null?void 0:Me.cwd??be,Tt=Me.cwd===null?void 0:Oe,kt=Me.cwd===void 0?v.effectiveCwd:Me.cwd,lt=Me.cwd===void 0?v.effectiveCwd:null,jt=X?X.allowTmpdirVar:!vi(Be,v.environment),Bt=Ig(z,Me.words,v.environment,u===0,v.strict,v.policy);if(Bt)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Bt.reason}),Rn(Bt);let sn=ra(We,v.policy);if(sn){for(let Et of[sn.childIndex,...sn.alternativeChildIndices]){Vg(it.wrapperNormalizationBudget);let zt=Le.slice(Et);W?.recordSegment({type:"transparent-wrapper",wrapper:sn.wrapper,output:B(zt)});let Zt=jo(zt,u,{...it,effectiveCwd:kt,envAssignments:Be});if(Zt)return Zt}return null}let yn=le?void 0:at==="eval"?ga(Le):at==="trap"&&!Q?Vp(Le):void 0;if(Q&&X&&at==="eval"){if(yn?.kind==="dynamic")return Ho(X,v.policy);if(yn?.kind==="literal"){let Et=v.analyzeNested(yn.source,{effectiveCwd:kt,envAssignments:Be});if(Et)return Et}return Vo(X,v.policy)}if(yn?.kind==="dynamic"&&(v.strict||!v.commandView||!Gc(v.commandView)))return bn(W);if(yn?.kind==="literal"){W?.recordSegment({type:"recurse",reason:at==="eval"?"shell-eval":"shell-trap",innerCommand:yn.source,depth:u+1});let Et=v.analyzeNested(yn.source,{effectiveCwd:kt,envAssignments:Be,functionDefinitions:v.functionDefinitions});if(Et)return Et}if(Q?tn.has(at):Qg(ze,at)){if(Xn(We))return null;if(sa(We))return bn(W);if(Q&&X){let Et=Hn(We);if(Et){if(X.dynamicSourceInput??X.dynamicInput){let Zt=Ho(X,v.policy);if(Zt)return Zt}if(zi(Et)){let Zt=Ho(X,v.policy);if(Zt)return Zt}return v.analyzeNested(Et,{effectiveCwd:kt,envAssignments:Be})}let zt=Cr(Le);if(zt.kind==="dynamic")return Ho(X,v.policy);if(zt.kind==="literal")return X.dynamicSourceInput?Ho(X,v.policy):null;return X.dynamicSourceInput??X.dynamicInput?Ho(X,v.policy):null}if(le){let Et=Hn(We),zt=Et?v.analyzeNested(Et,{effectiveCwd:kt,envAssignments:Be}):Cr(Le).kind==="dynamic"?bn(W):null;if(zt)return zt}if(X===void 0){let Et=TP(We,Be,kt,v,W,u);if(Et)return Et;let zt=Hn(We);if(zt){let vn=An(We).commandIndex,ln=vn===null?void 0:Le[vn];if(ln&&v.commandView&&Fi(ln,v.commandView.nested,v.environment))return bn(W);let er=ha(Le,zt);if(er.kind==="dynamic")return bn(W);let lr=er.kind==="literal"?er.source:qp(Le,zt),_d=MP(lr);W?.recordSegment({type:"shell-wrapper",wrapper:at,innerCommand:_d}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:_d,depth:u+1});let xd=v.analyzeNested(lr,{effectiveCwd:kt,envAssignments:Be});if(xd)return xd;return zi(lr)?bn(W):null}let Zt=Cr(Le,v.environment.home,v.strict?void 0:Fo(v.shellAssignments??new Map,{home:v.environment.home,cwd:lt}));if(Zt.kind==="dynamic")return bn(W);if(Zt.kind==="literal")return Ui(Zt.source,kt,Be,v,W,u);let Fn=Kp(Le,v.commandView?.redirections??[],v.hasPipelineInput??!1,v.literalShellInput);if(Fn.kind==="dynamic")return bn(W);if(Fn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Fn.source,depth:u+1}),v.analyzeNested(Fn.source,{effectiveCwd:kt,envAssignments:Be})}}if(!X&&(at==="source"||at===".")){let Et=We[1]==="-p"?2:null;if(Et!==null){let ln=v.commandView?Le[Et]:void 0;if(!ln)return null;if(ln.provenance!=="literal")return bn(W)}let zt=Et===null?1:3,Zt=We[zt]==="--"?zt+1:zt,Fn=v.commandView?Le[Zt]:void 0;if(!Fn)return null;let vn=jg(Fn,v,lt);if(vn!==null)return Ui(vn,kt,Be,v,W,u);if(v.strict||!v.commandView||!Gc(v.commandView))return bn(W)}let Gt=Le[0];if(!X&&Gt&&ze.includes("/")){let Et=jg(Gt,v,lt),zt=Et===null?null:Ui(Et,kt,Be,v,W,u,!1,!0);if(zt)return zt}if($n.has(at)&&!le){if(!X&&v.strict&&Kc(Mi(We),Le))return bn(W);let Et=rp(We,(Zt)=>Dr(v.analyzeNested(Zt,{effectiveCwd:kt,envAssignments:Be}))),zt=Ft(Et,v.policy);if(zt)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:zt.reason}),Rn(zt)}if(Nn(at)&&!le){let Et=Xs(We),zt=v.remotePipelineInput===!0&&!Yp(v.commandView?.redirections??[])&&!fc(We)&&Et.every((ln)=>ln.kind==="main-script"&&ln.value==="-"),Zt=Et.some((ln)=>{let er=Le[ln.tokenIndex];return ln.kind!=="module-file"&&er!==void 0&&v.commandView!==void 0&&Fi(er,v.commandView.nested,v.environment)}),Fn=!fc(We)&&Et.some((ln)=>ln.kind==="main-script"&&Le[ln.tokenIndex]?.provenance==="literal"&&v.downloadedPaths?.has(xr(ln.value,kt,v.environment.paths,v.budget)??""));if(!X&&(zt||Zt||Fn||v.strict&&Kc(Et,Le)))return bn(W);let vn=Hf(We);if(Q&&X)return AP(at,vn,kt,Be,v,X);if(vn){let ln=dn(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:at,codeArg:vn,paranoidBlocked:ln}),ln){let lr=Ft(st("interpreter.one-liner-paranoid",Ti),v.policy);if(lr)return Rn(lr)}if(pc(at,vn))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:vn,depth:u+1});let er=v.analyzeNested(vn,{effectiveCwd:kt,envAssignments:Be});if(er&&!Yg(er,vn))return er;if(Ii(vn,void 0,!v.strict)){let lr=Ft(st("interpreter.dangerous-command",Do),v.policy);if(lr)return W?.recordSegment({type:"dangerous-text",token:vn,matched:!0,reason:Do}),Rn(lr)}W=void 0}}if(at==="busybox"&&We.length>1)return Vg(it.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),jo(Le.slice(1),u,{...it,effectiveCwd:kt,envAssignments:Be});let Xt=X?void 0:[["analyzer/device.ts:analyzeDeviceCommandMatch",Ym(at,We)],["analyzer/network.ts:analyzeNetworkCommandMatch",Wg(at,We)],["analyzer/namespace.ts:analyzeNamespaceCommandMatch",Mg(at,We)]].map(([Et,zt])=>({rule:Et,match:Ft(zt,v.policy)})).find((Et)=>Et.match);if(Xt?.match)return W?.recordSegment({type:"rule-check",rule:Xt.rule,matched:!0,reason:Xt.match.reason}),Rn(Xt.match);let rn=W===it.trace?it:{...it,trace:W},un={words:Le,parsedWords:Me.words,head:at,cwd:Rt,originalCwd:Tt,envAssignments:Be,allowTmpdirVar:jt,dynamicArguments:Me.words.some((Et)=>Et.provenance==="command-substitution"),depth:u,effectiveCwd:kt,options:rn,analyzeChildTokens:(Et,zt)=>Q&&X?td(Et,u,rn,{...X,cwd:zt??void 0,effectiveCwd:zt??void 0}):Dr(jo(en(Et),u+1,{...rn,child:void 0,commandView:void 0,effectiveCwd:zt,envAssignments:Be}))??F(Et,rn.policy.rules),analyzeChild:(Et,zt)=>td(Et,u,rn,zt)},En=X&&(at==="xargs"||at==="parallel")?void 0:Kg(at);if(at==="rm"||at==="xargs"||at==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:Be.has("TMPDIR")||v.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:jt});let on=W&&at==="git"?Wp(un.words,Jc(un)):void 0,mn=qg(on?on.match:En?.(un)??null,v.policy);if(W)DP(un,mn,on?.relaxation??null);if(mn)return Rn(mn);if(Q&&X&&(at==="rm"||at==="rmdir")){if(!(at==="rm"&&(yr(We)||X.dynamicRmInput)))return null;return(X.dynamicRmInput?Vo(X,v.policy):null)??PP(X,v.policy)}let mo=En!==void 0&&!LP.has(at),Lr=!X&&!mo&&!cs.has(at),vr=W&&Lr?[]:void 0;if(Lr)for(let Et=1;Et<We.length;Et++){let zt=We[Et];if(!zt)continue;vr?.push(zt);let Zt=qg(xP(We,Et,u,rn,Rt,Tt,kt,Be),v.policy);if(Zt)return W?.recordSegment({type:"fallback-scan",tokensScanned:vr??[],embeddedCommandFound:$t(zt)}),Rn(Zt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:vr??[]}),le&&X&&!X.wrappedByTransparent)return null;let fo=F(We,v.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:v.policy.rules.length>0,matched:!!fo,reason:fo?.reason}),fo)return Rn(fo);return Q&&X?Vo(X,v.policy):null}function td(n,u,v,W){return Dr(jo(en(n),u+1,{...v,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function xP(n,u,v,W,z,B,X,Q){for(let le of Zn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:Q,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let be=$t(ue);if(Qg(ue,be)||Kg(be)!==void 0&&be!=="xargs"&&be!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let De=td(le.tokens,v,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?X:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!vi(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(De)return De}return null}function AP(n,u,v,W,z,B){if(!u)return Vo(B,z.policy);if(dn(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let Q=Ft(st("interpreter.one-liner-paranoid",Ti),z.policy);if(Q)return Rn(Q)}if(pc(n,u))return Vo(B,z.policy);let X=z.analyzeNested(u,{effectiveCwd:v,envAssignments:W});if(X&&!Yg(X,u))return X;if(Ii(u,void 0,!z.strict)){let Q=Ft(st("interpreter.dangerous-command",Do),z.policy);if(Q)return Rn(Q)}return Vo(B,z.policy)}function Yg(n,u){let v=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(js)||n.reason===or)&&!us(u);return v||W}function Ho(n,u){let v=n.shellDynamicMatch?Ft(n.shellDynamicMatch,u):null;return v?Rn(v):null}function Vo(n,u){let v=n.dynamicSourceInput&&n.dynamicSourceMatch?Ft(n.dynamicSourceMatch,u):null;return v?Rn(v):null}function PP(n,u){let v=n.dynamicInput&&n.rmDynamicMatch?Ft(n.rmDynamicMatch,u):null;return v?Rn(v):null}function TP(n,u,v,W,z,B){let X=mp(n);if(X.argvSource?.kind==="absent")return bn(z);if(X.argvSourceApplies&&X.argvSource){let le=Ui(X.argvSource.value,v,u,W,z,B,!0);if(le)return le}if(!X.envSourceApplies||!X.envName)return null;let Q=u.get(X.envName);if(!Q)return null;return Ui(Q,v,u,W,z,B,!0)}function jg(n,u,v){let W=u.environment.home,z=Go(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Qn(n,Fo(u.shellAssignments??new Map,{home:W,cwd:v}))}var Zg=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function Ui(n,u,v,W,z,B,X=!1,Q=!1){if(X&&/[$`*?[\]]/.test(n))return bn(z);let le=xr(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0&&(X||le&&W.downloadedPaths?.has(le)))return bn(z);if(ue===void 0)return le?kP(n,le,u,v,W,z,Q):null;if(Q&&ue.startsWith("#!")&&!Zg.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!Q)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v});let be=Xg(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v}));return be?.intent==="stop_and_explain"?null:be}var IP=/^(?:analysis|raw-text)\.|^(?!custom\.).*dynamic|^interpreter\.one-liner-paranoid$/;function kP(n,u,v,W,z,B,X){if([...z.writtenPaths??[]].some((Ne)=>u===Ne||u.startsWith(`${Ne}${_P}`)))return null;let le=z.scriptReads??{},ue=le.budget??=_n(),be=(Ne)=>Xg(()=>{if(Ne)OP(ue);ue.charge("scriptFiles");let Le=Jm(u);if(Le===null)return null;if(X&&Le.text.startsWith("#!")&&!Zg.test(Le.text))return null;if(!Ne)B?.recordSegment({type:"script-file",path:n,bytes:Le.bytes});let We=z.analyzeNested(Le.text,{effectiveCwd:v,envAssignments:W,scriptBudget:ue,withoutUncertainCapabilities:Ne,untraced:!0});if(!We||We.scriptLocation)return We;let it=We.sourceOffset===void 0?"":`:${Le.text.slice(0,We.sourceOffset).split(`
+`).length}`;return{...We,scriptLocation:`${n}${it}`}}),Oe=(Ne)=>Ne&&!IP.test(Ne.ruleId)?Ne:null,De=be(),Me=z.strict||z.paranoidInterpreters;return Oe(De)??(Me&&De?Oe(be(!0)):null)}function OP(n){let u=n.counters.get("scriptFiles");if(n.counters.clear(),u!==void 0)n.counters.set("scriptFiles",u)}function Xg(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function MP(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function DP(n,u,v){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!v,reason:u?.reason??v?.originalReason}),v)n.options.trace?.recordSegment({type:v.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:v.originalReason,gitCwd:v.gitCwd})}function Vg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Rn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function bn(n){return n?.recordSegment({type:"error",message:Xr}),Rn(ir())}function Qg(n,u){return tn.has(u)||n==="$SHELL"||n==="${SHELL}"||tn.has(Wt(u))}function qg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Ft(n,u)}var NP=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,LP=new Set(["powershell","pwsh"]),WP=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function FP(n,u){let v=th(n,u);if(v.length===0)return!1;let W=v[eh(v)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return NP.test(n.join(" "))}function Jg(n,u,v,W,z){if(n.dialect==="powershell"){let ze=GP(n.words,z);if(ze.kind==="none")return;if(!u||ze.kind==="unknown")return null;return ed(UP(ze.target),u,v.paths)}let B=n.words.map(t),X=B.some((ze)=>/^CDPATH\+?=/.test(ze));if(!FP(B,v))return X?null:void 0;if(!u)return null;let Q=th(B,v,u),le=eh(Q);if(le===-1||Q[le]!=="cd")return null;let ue=Q.slice(le+1),be=ue.findIndex((ze)=>ze.length<=1||!ze.startsWith("-")||ze==="--");if((be===-1?ue:ue.slice(0,be)).some((ze)=>!/^-[LP]+$/.test(ze)))return null;let De=be===-1?[]:ue.slice(be),Me=De[0]==="--"?De.slice(1):De;if(Me.length>1)return null;let Ne=Me[0],Le=W.get("HOME")||v.home;if(Ne===void 0)return ed(Sn(Le),u,v.paths);let We=n.words.find((ze)=>ze.provenance==="variable"&&ze.text===Ne),it=n.words.find((ze)=>ze.text===Ne&&/^~(?:\/|$)/.test(ze.raw)),Be=We?Qn(We,new Map([...W,["HOME",Le]])):it?`${Le}${Ne.slice(1)}`:Ne;if(Be===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(Be)&&(X||v.env.has("CDPATH")))return null;return ed(Sn(Be),u,v.paths)}function ed(n,u,v){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=Pr(u,n,v);return v.isDirectory(W)?W:null}catch{return null}}function GP(n,u){let v=zP(n[0])?1:0,W=n[v];if(!$P(W,v===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!WP.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return BP(n.slice(v+1),u)}function zP(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function $P(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function BP(n,u){let v;for(let W of n){if(W.provenance!=="literal"||v!==void 0)return{kind:"unknown"};v=W.text}if(v!==void 0)return{kind:"target",target:v};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function UP(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function eh(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let v=u+1;while(n[v]?.startsWith("-"))v++;return v}function th(n,u,v){let W=HP(n);return rr([...W],u,v)}function HP(n){let u=0;while(u<n.length){let v=n[u];if(v!=="{"&&v!=="("&&v!=="$(")break;u++}return n.slice(u)}var ZP="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",so="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ld(n,u,v,W){if(u>=l.recursionDepth.cap)return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??v.factStore?.getCommandProgram(n,v.shell??"auto")??C(n,v.shell);if(z.status==="limited")return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let be=z.issues.find((Oe)=>Oe.code.includes("heredoc"));if(be){if(!v.strict)return ad(n,v);let Oe=`${js}: ${be.message}`;return v.trace?.recordGlobal({type:"error",message:Oe}),{reason:Oe,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return ch(n,v),{reason:or,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(v.strict&&z.status==="partial")return ch(n,v),{reason:or,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((be)=>be.code.includes("quote")))return ad(n,v);let X=v.cwd,Q=v.effectiveCwd!==void 0?v.effectiveCwd:v.cwd,le=_p(v.environment.env,v.envAssignments),ue={...v,rootProgram:z,writtenPaths:v.writtenPaths??new Set,downloadedPaths:v.downloadedPaths??new Set,scriptReads:v.scriptReads??{}};return Aa(z,u,ue,X,[{effectiveCwd:Q,shellGitContextState:le,literalHeredocFiles:new Map(v.literalHeredocFiles),functionDefinitions:new Map(v.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Aa(n,u,v,W,z){let B=[...z],X,Q,le,ue=!1;for(let[be,Oe]of n.nodes.entries()){if(Oe.kind==="connector"){Q=Oe.operator;continue}let De=br(Q)&&ue;ue=De||Oe.kind==="command"&&(ya(Oe,v.environment)||Oe.dialect==="powershell"&&mh(Oe.words));let Me=n.nodes[be+1],Ne=Me?.kind==="connector"?Me.operator:void 0,Le=XP(n,be,Oe,Q,Ne),it=Q==="&&"||Q==="||"?X:void 0,Be=Q==="&&"?it?.success??B:Q==="||"?it?.failure??B:B,ze=Q==="||"?it?.success??[]:[],at=Q==="&&"?it?.failure??[]:[],Rt={connector:Q,skippedSuccessStates:ze,skippedFailureStates:at};if(br(Ne)&&!br(Q))le=Rt;let Tt=br(Ne)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:br(Q)?le??Rt:Rt,kt=ao(Tt.connector)||ao(Ne);if(Oe.kind==="function"){let rn=Be.flatMap((En)=>{let on=lo(En);return on.functionDefinitions.set(Oe.name,Oe.body),nd(En,[on],Le,Ne==="&",ao(Ne))}),un=rd(rn,[],Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=un.states,X=un.conditionalStates,Q=void 0;continue}if(Oe.kind==="group"){let rn=[],un=[];for(let on of Be){let mn=Aa(Oe.body,u,v,W,[lo(on)]);if(mn.result)return mn;if(rn.push(...nd(on,mn.states,Le,Ne==="&",ao(Ne))),kt)un.push(on,...Le?mn.states.map((mo)=>_a(on,mo)):mn.states)}let En=rd(rn,un,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=En.states,X=En.conditionalStates,Q=void 0;continue}if(Oe.kind!=="command")continue;let lt=TT(n.nodes[be-1]),jt=v.trace?.flattenNested?v.trace.currentSegmentIndex:v.trace?.allocateSegment(),Bt=n.nodes[be-2],sn=br(Q)&&Bt?.kind==="command"?Bt:void 0,yn=sn?jp(sn)??JP(sn):void 0,ut=[],Gt=[];for(let rn of Be){let un=eT(Oe,u,v,W,[lo(rn)]);if(un.result)return{result:un.result,states:B};let En=n.dialect==="powershell"?un.states:un.states.map((on)=>_a(rn,on));for(let on of En){let mn=lo(on),mo=oT(Oe,u,v.trace?{...v,trace:uh(v.trace,jt)}:v,W,mn,br(Q),yn,De);if(mo)return{result:{...mo,sourceOffset:Oe.span.start},states:B};let Lr=LT(Oe,mn.functionDefinitions);if(Lr)v.budget.charge("derivedTokens",Pa(Lr));let vr=Lr?u+1>=l.recursionDepth.cap?id(Oe.displayText,v,[mn]):Aa(Lr,u+1,v,W,[mn]):{result:null,states:DT(Oe,mn).flatMap((Et)=>IT(Oe,on,Et,lt))};if(vr.result)return vr;ut.push(...nd(rn,vr.states,Le,Ne==="&",ao(Ne)));let fo=typeof mn.effectiveCwd==="string"&&mn.effectiveCwd!==on.effectiveCwd&&Oe.redirections.every((Et)=>["<",">",">>",">|"].includes(Et.operator)&&Et.target?.text==="/dev/null");if(kt&&(lt||!fo))Gt.push(rn),Gt.push(...vr.states.map((Et)=>Le?_a(rn,Et):Et))}}let Xt=rd(ut,Gt,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=Xt.states,X=Xt.conditionalStates,Q=void 0}return{result:null,states:B}}function XP(n,u,v,W,z){if(v.kind==="group"&&v.style==="subshell")return!0;if(n.dialect==="posix"&&(br(W)||br(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&v.kind==="group"&&v.style==="brace"&&QP(n,u)}function nd(n,u,v,W,z){let B=v?u.map((Q)=>_a(n,Q)):[...u],X=z?B.flatMap((Q)=>qo(n.literalHeredocFiles,Q.literalHeredocFiles)?[Q]:[{...Q,literalHeredocFiles:new Map(n.literalHeredocFiles)},Q]):B;return W?[n,...X]:X}function _a(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function QP(n,u){let v=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!v||v.kind!=="command")return!0;let W=v.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(tT(v))return!0;return v.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function br(n){return n==="|"||n==="|&"}function JP(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function ao(n){return n==="&&"||n==="||"}function rd(n,u,v,W,z,B){let X={success:xa([...v,...n]),failure:xa([...W,...u])},Q=ao(B)?X:void 0;return{states:ao(z)||Q?xa([...X.success,...X.failure]):X.success,conditionalStates:Q}}function uh(n,u,v=n.flattenNested){return{currentSegmentIndex:u,flattenNested:v,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function eT(n,u,v,W,z){let B=n.nested.map((X)=>({program:X,depth:u}));if(n.dialect==="powershell"){let X=nT(n);if(X){if(u+1>=l.recursionDepth.cap)return id(X,v,z);let Q=C(X,"powershell");if(Q.status==="limited")return id(X,v,z);if(Q.status!=="complete")return nh(B,v,W,z);v.budget.charge("derivedTokens",Pa(Q)),B.push({program:Q,depth:u+1})}}return nh(B,v,W,z)}function tT(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function nh(n,u,v,W){let z=[...W];for(let B of n){let X=[];for(let Q of z){let le=Aa(B.program,B.depth,u,v,[lo(Q)]);if(le.result)return le;X.push(...le.states)}z=xa(X)}return{result:null,states:z}}function nT(n){let u=fh(n),v=u?.[0];return u?.length===1&&v?.quoted&&v.provenance==="literal"?v.text:void 0}function rT(n,u,v){let W=fh(n);if(!W)return!1;return u||W.some((z)=>Fi(z,n.nested,v))||mh(W)}function mh(n){return n.some((u)=>/\.Download(?:String|Data)\(/i.test(u.raw)||!u.quoted&&pa(/^(?:\$?\(|[&.\s])*([^\s()]*)/.exec(u.raw)?.[1]??"","powershell"))}function fh(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),v=u?1:0,W=n.words[v];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(v+1);return z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?z.slice(1):z}function Pa(n){return n.nodes.reduce((u,v)=>u+(v.kind==="command"?v.words.length+v.nested.reduce((W,z)=>W+Pa(z),0):v.kind==="group"||v.kind==="function"?Pa(v.body):0),0)}function id(n,u,v){return u.trace?.recordSegment({type:"error",message:tr}),{result:{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...v]}}function oT(n,u,v,W,z,B,X,Q){let le={...v,environment:{...v.environment,env:z.shellGitContextState.env,paths:yT(v.environment.paths,z.createdDirectories,v.budget)}},ue=RT(n,!le.strict);if(ue&&le.strict)return le.trace?.recordSegment({type:"error",message:ue}),{reason:ue,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};mT(n,z,le),pT(n,z,le),ph(n,z,"before-consumer",le.environment.paths,le.budget);let be=ce(n.dialect,n.words),Oe=be.map(t),De=n.displayText,Me=Rp(be,z.shellGitContextState,{home:le.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:le.environment.darwinUserTempDir}),Ne=Ap(Me,z.shellGitContextState);if(n.dialect==="powershell"){let Be=Ft(Zf(n,B,WT(le,z.effectiveCwd)),le.policy);if(le.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!Be,reason:Be?.reason}),Be)return od(De,Be);if(rT(n,Q,le.environment))return le.trace?.recordSegment({type:"error",message:Xr}),od(De,ir())}let Le=Ft(Zm(n.redirections),le.policy);if(Le)return le.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Le.reason}),od(De,Le);if(Oe.length===1&&Oe[0]?.includes(" ")&&!fi(n.dialect,n.words)){let Be=Ft(Bn(Oe[0]),le.policy),ze=Be!==null&&!le.strict&&jm(n,le.rootProgram);if(Be&&!ze)return le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!0,reason:Be.reason}),{reason:Be.reason,segment:De,ruleId:Be.id,intent:Be.intent};le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!1});let at=rh(n,ue,z,Ne,X,le);if(at)return at;return Mc(Me,z.shellGitContextState),null}let We=jo(n.words,u,{...le,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Ne,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:X,remotePipelineInput:Q,analyzeNested:(Be,ze)=>{let at=ze&&Object.hasOwn(ze,"effectiveCwd")?ze.effectiveCwd:z.effectiveCwd,Rt=ld(Be,u+1,{...le,...ze?.withoutUncertainCapabilities?_e({...le,effectiveCapabilities:{...le.effectiveCapabilities,fail_closed:{...le.effectiveCapabilities.fail_closed,enabled:!1},paranoid_interpreters:{...le.effectiveCapabilities.paranoid_interpreters,enabled:!1}}}):{},budget:ze?.scriptBudget??le.budget,effectiveCwd:at,envAssignments:ze?.envAssignments??Ne,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:ze?.functionDefinitions,worktreeMode:ze?.worktreeMode??le.worktreeMode,shell:ze?.shell??le.shell,trace:le.trace&&!ze?.untraced?uh(le.trace,le.trace.currentSegmentIndex,!0):void 0});return Rt?{reason:Rt.reason,ruleId:Rt.ruleId,intent:Rt.intent,sourceOffset:Rt.sourceOffset,scriptLocation:Rt.scriptLocation}:null}});if(We)return{...We,segment:De};let it=rh(n,ue,z,Ne,X,le);if(it)return it;return Mc(Me,z.shellGitContextState),null}function rh(n,u,v,W,z,B){let X=wT(n,u,v,W??new Map,B);if(X)return X;if(ph(n,v,"after-consumer",B.environment.paths,B.budget),!aT(n))v.literalHeredocFiles.clear();return gT(n,u,v,B.environment.paths,B.budget,B.environment.home),ST(n,v,B.environment.paths,B.budget,B.environment.home),AT(n,v,z,B.environment,B.trace),null}var iT=new Set([">>","<>"]),sT=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function aT(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>sT.test(u.raw))}var lT=new Set(["cp","mv","install","ln","sed","curl","wget","tee"]),cT=new Set(["cp","mv","install","ln"]),dT=/^-[^-]*i|^--in-place/,oh=/^(?:-t|--target-directory=?)(.*)$/;function uT(n){let u=n.findIndex((Oe)=>lT.has(Wt(Oe.text))),v=Wt(n[u]?.text??""),W=n.slice(u+1).filter((Oe)=>Oe.provenance==="literal").map((Oe)=>Oe.text);if(u===-1)return[];if(v==="sed")return W.some((Oe)=>dT.test(Oe))?W:[];if(!cT.has(v))return W;let z=W.findIndex((Oe)=>oh.test(Oe)),B=W[z]?.match(oh)?.[1],X=z!==-1&&!B,Q=X?W[z+1]:B,le=W.filter((Oe,De)=>!Oe.startsWith("-")&&!(X&&De===z+1)),ue=Q??le.at(-1);if(ue===void 0)return[];return[...Q===void 0?le.slice(1):[Q],...le.map((Oe)=>dh(ue,Wt(Oe)))]}function mT(n,u,v){let W=v.writtenPaths;if(!W)return;let B=[...n.redirections.flatMap((X)=>X.operator.includes(">")&&X.target?[X.target]:[]).filter((X)=>X.provenance==="literal").map((X)=>X.text),...uT(n.words)].flatMap((X)=>[X,X.slice(X.indexOf("=")+1),Wt(X.split(/[?#]/)[0]??"")]);for(let X of new Set(B.filter(Boolean))){let Q=xr(X,u.effectiveCwd,v.environment.paths,v.budget);if(Q)W.add(Q)}}var ih=new Map([["curl",/^(?:-[^-o]*o|--output(?:=|$))(.*)/],["wget",/^(?:-[^-O]*O|--output-document(?:=|$))(.*)/]]);function fT(n){let u=n.findIndex((W)=>ih.has(Wt(W.text))),v=ih.get(Wt(n[u]?.text??""));return n.slice(u+1).flatMap((W,z,B)=>{let X=W.provenance==="literal"?v?.exec(W.text)?.[1]:void 0,Q=B[z+1];if(X)return[X];return X===""&&Q?.provenance==="literal"?[Q.text]:[]})}function pT(n,u,v){let W=ya(n,v.environment),z=[...n.redirections.filter(gh).flatMap((B)=>B.target?.provenance==="literal"?[B.target.text]:[]),...W?fT(n.words):[]];for(let B of z.filter((X)=>X!=="-")){let X=xr(B,u.effectiveCwd,v.environment.paths,v.budget);if(X&&W)v.downloadedPaths?.add(X);if(X&&!W)v.downloadedPaths?.delete(X)}}function ph(n,u,v,W,z){for(let X of n.redirections){if(!(v==="before-consumer"?gh(X):iT.has(X.operator)))continue;sh(X.target,u,W,z)}if(v!=="before-consumer"||!hn(n.words[0],"tee"))return;let B=yh(n.words.slice(1));if(!B)return;for(let X of B.operands)sh(X,u,W,z)}function gh(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function sh(n,u,v,W){let z=n?.provenance==="literal"?xr(n.text,u.effectiveCwd,v,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function gT(n,u,v,W,z,B){if(u)return;let X=n.redirections.find((Q)=>Q.operator==="<<"||Q.operator==="<<-")?.heredoc;if(!X)return;for(let Q of hT(n,Fo(v.shellGitContextState.shellAssignments,{home:B,cwd:v.effectiveCwd}),B)){let le=xr(Q,v.effectiveCwd,W,z);if(!le||!Yl(le))continue;if(!v.literalHeredocFiles.has(le)&&v.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");v.literalHeredocFiles.set(le,X.body)}}function hT(n,u,v){let W=sd(ET(n.redirections)?.target,u,v),z=W===void 0?[]:[W];if(hn(n.words[0],"cat"))return bT(n.words)?z:[];if(!hn(n.words[0],"tee"))return[];let B=yh(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let X=B.operands.map((Q)=>sd(Q,u,v));if(!X.every((Q)=>Q!==void 0))return[];return[...X,...z]}function sd(n,u,v){if(vT(n))return n.text;if(!n)return;return Go(n,v)??Qn(n,u)??void 0}function yT(n,u,v){if(u.size===0)return n;let W=(z)=>{let B=Ht(z,n,v);return[...u].some((X)=>X===B||X.startsWith(`${B}${YP}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?Ht(z,n,v):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function ST(n,u,v,W,z){if(u.shellGitContextState.bodyDepth>0||!hn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((be)=>sd(be,u.shellGitContextState.shellAssignments,z));if(!B.every((be)=>be!==void 0))return;let X=B.findIndex((be)=>be==="--"||be==="-"||!be.startsWith("-")),Q=B.slice(0,X);if(X===-1||!Q.every((be)=>/^(?:-[pv]+|--parents|--verbose)$/.test(be)))return;let le=Q.some((be)=>be==="--parents"||/^-v*p/.test(be)),ue=u.effectiveCwd;for(let be of B.slice(B[X]==="--"?X+1:X)){if(be.split(/[\\/]/).includes("..")||!VP(be)&&!ue)continue;let Oe=Ht(KP(ue??"",be),v,W);if(le?CT(Oe,v):v.isDirectory(jP(Oe))&&hh(Oe,v))u.createdDirectories.add(Oe)}}function CT(n,u){let v=qP(n).root,W=n.slice(v.length).split(/[\\/]+/).filter(Boolean),z=(X)=>dh(v,...W.slice(0,X+1)),B=W.findIndex((X,Q)=>!u.isDirectory(z(Q)));return B===-1||hh(z(B),u)}function hh(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function bT(n){let u=!1;for(let v of n.slice(1)){if(u||v.provenance!=="literal")return!1;if(v.text==="--"){u=!0;continue}if(!/^-u+$/.test(v.text))return!1}return!0}function ET(n){let u=n.findLast((v)=>(v.fd??([">",">|",">>",">&"].includes(v.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function yh(n,u=new Map){let v=[],W=!0,z=!1,B=!1;for(let X of n){if(X.provenance!=="literal"&&Qn(X,u)===null)return;if(W&&hn(X,"--")){W=!1;continue}if(W&&!X.quoted&&X.raw===X.text&&/^-[^-]/.test(X.text)){z||=X.text.slice(1).includes("a"),B||=Array.from(X.text.slice(1)).some((Q)=>Q!=="a"&&Q!=="i");continue}if(W&&!X.quoted&&X.raw===X.text&&X.text.startsWith("--")){z||=X.text==="--append",B||=X.text!=="--append"&&X.text!=="--ignore-interrupts";continue}v.push(X)}return{operands:v,append:z,hasUnsupportedOptions:B}}function vT(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function hn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function RT(n,u){let v=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(v.length===0)return;if(v.length!==1)return so;let W=v[0];if(!W?.heredoc)return so;let z=/\$\(|`/.test(W.heredoc.body);if(!Bo(W.heredoc)&&(!u||z))return ZP;if(W.fd!==void 0&&W.fd!==0)return so;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return so;let B=n.redirections.some((le)=>le!==W&&ah(le.target));if(hn(n.words[0],"cat"))return B?so:void 0;if(hn(n.words[0],"tee"))return B||n.words.slice(1).some(ah)?so:void 0;let X=n.words[0],Q=n.words[1];if(hn(X,"git")&&(hn(Q,"apply")||hn(Q,"commit")))return;if(hn(X,"gh")&&(hn(Q,"pr")||hn(Q,"issue"))&&hn(n.words[2],"create"))return;return so}function ah(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function wT(n,u,v,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),X=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(xT(n,B,v,W,z))return null;let Q=_T(n,B,z);if(Q!==void 0)return Q?{reason:Q.reason,segment:n.displayText,ruleId:Q.id,intent:Q.intent}:null;let le=ad(X.length===B.length?X.join(`
+`):n.source,z);return le?{...le,segment:n.displayText}:null}function _T(n,u,v){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!Bo(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=hn(n.words[0],"uv")&&hn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!Nn(B.text))return;let X=z.findIndex((Oe)=>hn(Oe,"-"));if(!z.slice(1,X===-1?void 0:X).every((Oe)=>Oe.provenance==="literal"&&Oe.text.startsWith("-")))return;let le=W.heredoc.body,ue=dn(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(v.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let Oe=Ft(st("interpreter.one-liner-paranoid",Ti),v.policy);if(Oe)return Oe}if(!Ii(le,void 0,!v.strict))return null;let be=Ft(st("interpreter.dangerous-command",Do),v.policy);if(!be)return null;return v.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:be.reason}),be}function xT(n,u,v,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!Bo(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let X=pr(n.words,z.environment,v.effectiveCwd,W),Q=X.words.map(t),le=$t(Q[0]??"");if((X.envSplitValues?.length??0)>0||!tn.has(le)&&!tn.has(Wt(le)))return!1;return Xn(Q)}function AT(n,u,v,W,z){let B=Jg(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,v);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var PT=new Set(["fi","done","esac"]);function TT(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function IT(n,u,v,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,X=v.shellGitContextState.bodyDepth,Q=v.compoundBodies;if(X>B)return v.compoundBodies=[...Q.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:Q[B]?.branchCwds??[],hasElse:!1}],[v];let le=B>0?Q[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return v.compoundBodies=[...Q.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,v.effectiveCwd],hasElse:z==="else"}],v.effectiveCwd=le.entryCwd,[v];let ue=le!==void 0&&PT.has(z);if(ue)v.compoundBodies=Q.slice(0,X);return[...new Set([v.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((Oe)=>{if(Oe===v.effectiveCwd)return v;let De=lo(v);return De.effectiveCwd=Oe,De})}function kT(n,u){return n.length===u.length&&n.every((v,W)=>{let z=u[W];return z!==void 0&&v.entryCwd===z.entryCwd&&v.hasElse===z.hasElse&&v.branchCwds.length===z.branchCwds.length&&v.branchCwds.every((B,X)=>B===z.branchCwds[X])})}var OT=/^[A-Za-z_][A-Za-z0-9_]*$/,MT=8;function DT(n,u){let v=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||v===void 0||!OT.test(v))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=MT&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(v),[u];return W.map((B)=>{let X=lo(u);return X.shellGitContextState.shellAssignments.set(v,B.text),X})}function lo(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:xp(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function xa(n){let u=[];for(let v of n){if(!u.some((W)=>NT(W,v)))u.push(v);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function NT(n,u){return n.effectiveCwd===u.effectiveCwd&&kT(n.compoundBodies,u.compoundBodies)&&qo(n.shellGitContextState.env,u.shellGitContextState.env)&&qo(n.literalHeredocFiles,u.literalHeredocFiles)&&qo(n.functionDefinitions,u.functionDefinitions)&&qo(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&qo(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&lh(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&lh(n.createdDirectories,u.createdDirectories)}function lh(n,u){return n.size===u.size&&[...n].every((v)=>u.has(v))}function qo(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([v,W])=>u.get(v)===W&&u.has(v))}function LT(n,u){let v=pi(n);return v===void 0?void 0:u.get(v)}function od(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function WT(n,u=n.effectiveCwd){let v=u===null;return{environment:n.environment,cwd:v?void 0:u??n.cwd,originalCwd:v?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function ad(n,u){let v=Ft(Bn(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!v,reason:v?.reason};if(u.trace?.recordSegment(z,W),!v&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return v?{reason:v.reason,segment:n,ruleId:v.id,intent:v.intent}:null}function ch(n,u){let v={type:"strict-unparseable",rawCommand:n,reason:or},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(v);if(W!==void 0)u.trace?.recordSegment(v)}var FT=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sh(n,u,v,W){let z=ld(n,0,{...u,..._e(u),budget:u.budget??_n(),factStore:W},v);if(!z)return null;return{kind:"deny",reason:z.scriptLocation?`${z.scriptLocation}: ${z.reason}`:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function Ch(n,u,v){try{return{decision:n()}}catch(W){let z=GT(W,u,v);if(!z)throw W;return z}}function GT(n,u,v){if(!(n instanceof a)||!FT.has(n.kind))return null;let W=l[n.kind];if(v?.currentSegmentIndex!==void 0)v.recordSegment({type:"error",message:W.reason});if(v?.currentSegmentIndex===void 0)v?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var zT=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),dd=new Set(["cc-safety-net","ccsn"]),$T=new Set(["bunx","npx","pnpx"]),BT=new Set(["pnpm","yarn"]),UT=new Set(["npm","pnpm","yarn"]),HT=new Set(["bun","node"]);function Ia(n,u,v={}){if(dd.has(n))return 0;if($T.has(n)){if(v.broad)return cd(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return Ta(u[z])?z+1:null}let W=v.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&UT.has(n)&&v.broad&&u[W]==="exec"){let z=cd(u.slice(W+1));return z===null?null:W+1+z}if(BT.has(n)){if(n==="yarn"&&!v.broad)return null;if(!v.broad)return u[0]==="dlx"&&Ta(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=cd(u.slice(W+1));return z===null?null:W+1+z}if(HT.has(n)){let z=v.broad&&W!==-1?W:0;if(bh(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&bh(u[z+1]))return z+2}return null}function cd(n){let u=n.findIndex((W)=>Ta(W));if(u===-1)return null;let v=u;while(v<n.length){let W=n[v]??"";if(!W.startsWith("-")&&!Ta(W))break;v++}return v}function Ta(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return dd.has(n);if(u===0)return!1;let v=n.slice(u+1);if(v===""||v.includes("/")||v.includes(":"))return!1;return dd.has(n.slice(0,u))}function bh(n){let u=n?.replaceAll("\\","/");return[...zT].some((v)=>u===v||u?.endsWith(`/${v}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Eh(n,u,v){let W=gr(n);if(!W)return null;let z=Oo(W.shell,n.invocation.context.executionCwd,u,v,{findSegmentTarget:(B)=>jT(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function jT(n,u){let v=rr([...n],u),W=v.slice(1),z=Ia(Wt(v[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((X)=>X!=="-g"&&X!=="--global");return B[0]==="policy"&&B[1]==="apply"?v.join(" "):null}import{dirname as ka}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",VT=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function _h(n,u,v){let W=QT(n.invocation.context,u,v);if(n.invocation.route.kind==="patch")return vh(n.paths,!1,n.invocation.context.executionCwd,W,u,v);let z=gr(n);if(n.invocation.route.kind==="command")return z?Rh(z.shell,n.invocation.context.executionCwd,W,u,v):null;if(n.invocation.route.kind==="unknown"&&z){let B=Rh(z.shell,n.invocation.context.executionCwd,W,u,v);if(B)return B}return vh(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||ns(n.invocation.toolName),n.invocation.context.executionCwd,W,u,v)}function vh(n,u,v,W,z,B){if(u)return null;let X=n.find((Q)=>Hi(Q,v,W,z,B));return X?{target:X}:null}function Rh(n,u,v,W,z){let B=Oo(n,u,W,z,{findSegmentTarget:(X,Q)=>qT(X,Q,v,W,z)?.target??null,isRedirectionTarget:(X,Q)=>Hi(X,Q.cwd,v,W,z),findMalformedTarget:(X)=>XT(X,u,v,W,z)?.target??null});return B?{target:B}:null}function qT(n,u,v,W,z){if(Ai(n))return null;let B=Tr([...n],W),X=Wt(B[0]??"").toLowerCase(),Q=B.slice(1);if(X==="rm"&&KT(Q)){let le=YT(Q).find((ue)=>wh(In(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(X==="find"){if(aa(B,1)||Rc(B,W)){let ue=(Di(en(B))??en(["."])).find((be)=>{let Oe=In(be.text,u.variables);return Hi(Oe,u.cwd,v,W,z)||wh(Oe,u.cwd,v,W,z)})?.text;if(ue)return{target:ue}}}if(X==="mv"){let le=Vs(Q).sources.find((ue)=>JT(In(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(ZT(B,X))return null;for(let le of[...n,...B])for(let ue of xh(le))if(Hi(In(ue,u.variables),u.cwd,v,W,z))return{target:ue};return null}function KT(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function YT(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((v)=>!v.startsWith("-")),...n.slice(u+1)];return n.filter((v)=>!v.startsWith("-"))}function ZT(n,u){if(!VT.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((v)=>v.startsWith("-i")||v==="--in-place"||v.startsWith("--in-place="))}function XT(n,u,v,W,z){for(let B of n.split(/\s+/))for(let X of xh(B))if(Hi(X,u,v,W,z))return{target:X};return null}function xh(n){let u=n.trim().replace(/^['"]|['"]$/g,""),v=u.indexOf("=");return v===-1||v===u.length-1?[u]:[u,u.slice(v+1)]}function QT(n,u,v){let W=(Q)=>ji(Cn(Q,n.executionCwd,u,v)),z=W(p(u)),B=[W(S(n.executionCwd)),W(S(n.configCwd))],X=new Set(B.map((Q)=>ka(Q)));for(let Q=ka(z);;Q=ka(Q))if(X.add(Q),ka(Q)===Q)break;return{files:new Set([z,...B]),directoriesAndAncestors:X}}function Hi(n,u,v,W,z){let B=Od(n,u,W,z,(X)=>ji(X)===as);return B!==null&&v.files.has(ji(B))}function wh(n,u,v,W,z){return v.directoriesAndAncestors.has(ji(Cn(n,u,W,z)))}function JT(n,u,v,W,z){let B=ji(Cn(n,u,W,z));return v.files.has(B)||v.directoriesAndAncestors.has(B)}function ji(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as Oa,posix as zh,resolve as Na,win32 as eI}from"node:path";import{fileURLToPath as tI}from"node:url";var $h="Access to a sensitive path is not allowed.",Bh=new Set(["echo","printf"]),nI=new Set(["find"]),rI=new Set(["!","do","elif","else","if","then","until","while"]),oI=new Set(["-exec","-execdir"]),iI=new Set([";","+"]),sI=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),aI=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Uh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),lI=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),cI=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),gd=new Set(["-c","-e","-r","-E","--eval","--exec"]),dI=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),hd=new Set(["grep","rg"]),Hh=new Set(["files-with-matches","files-without-match","count","quiet"]),uI=new Set([...Hh,"ignore-case","fixed-strings","hidden"]),mI=new Set(["wc",...hd]),fI=new Set(["cd","grep","head","openssl","tail","tailscale"]),pI=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,gI=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),hI=new Set(["commit","merge","notes","stash","tag"]),yI=new Set(["-m","--message"]),SI=new Set(["--grep"]),CI=new Set(["powershell","pwsh"]),Ah=new Set(["jq","gojq","jaq"]),Ph="f",Th="file",bI="files",EI=new Set(["e","f"]),vI=new Set(["regexp","file"]),RI=new Set(["e","f","A","B","C","m"]),wI=new Set(["regexp","file","after-context","before-context","context","max-count"]),ud="__CC_SAFETY_NET_PIPE_INPUT__",fd=/[\w./~@+-]*[./~][\w./~@+-]*/g,_I=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,xI=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,AI=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Ih=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,kh=/\b(?:system|exec|spawn|popen)\s*$/,PI=/\b(?:eval|exec)\s*\(/g,TI=/\b(?:eval|exec)\s*$/,II=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Oh(n,u,v,W,z,B){for(let X of n){let Q=X.target;if(Yk(Q,X.cwd,u?.denyPaths??[],v,W,z))return{target:Q,ruleId:"secret.deny-path"};if(B&&!B.has(Q))continue;let le=qk(Q,X.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(ry(Q,X.cwd,W,z)))continue;if(ue&&B?.get(Q)==="data")continue;if(ue&&(X.isRedirectionWriteTarget===!0||B?.get(Q)==="write")&&!Q.includes("$")&&!Da(Q,X.cwd,W,z))continue;if(ue&&(X.isCreatedPath===!0||X.isCertificateInput===!0))continue;if(ue&&/\s/.test(Q)&&!Q.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Q)&&!Da(Q,X.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&Zk(Q,X.cwd,u?.allowPaths??[],v,W,z))continue;return{target:Q,ruleId:le}}}return null}function jh(n,u,v,W,z={}){let B=Mh(n,v,W),X=Oh(B,u,n.invocation.context.configCwd,v,W);if(X===null||X.ruleId==="secret.deny-path"||z.strict!==!1)return X;let Q=Mh(n,v,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;Q.forEach((Ne)=>Vh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),be=Q.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),Oe=new Set(be.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),De=new Set(be.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Me=Oh(B,u,n.invocation.context.configCwd,v,W,new Map(be.map((Ne)=>[Ne.target,Oe.has(Ne.target)?"path":De.has(Ne.target)?"write":"data"])));return Me?.ruleId!=="secret.deny-path"&&kI(n,v)?null:Me}function kI(n,u){let v=gr(n);if(!v)return!1;if(v.program.nodes.some((X)=>X.kind==="command"&&X.nested.length>0))return!1;let W=[];for(let X of Hs(v.shell)){if(X.kind==="operator"&&X.boundary)return!1;if(X.kind==="redirection")return!1;if(X.kind==="operator")continue;W.push(hr(X.text,u))}let z=yd(W,u);if(z===null||z.length===0)return!1;let B=wn(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return v.program.dialect==="powershell"&&(B==="ls"||B==="stat");return Sd(B,z.slice(1))}function Xo(n,u){return yd(n,u)??rr(n,u)}function yd(n,u){let v=Yr(n,u);if(v.envSplitValues===void 0)return v.tokens;let W=Kr(v.envSplitValues,v.tokens);return W===null?null:yd(W,u)}function Sd(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((v)=>!v.startsWith("-")||pI.test(v));if(hd.has(n))return OI(n,u);if(n!=="find")return!1;return!u.some((v)=>sI.has(v))}function OI(n,u){let v=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(v.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),X=(ue)=>{let be=v[ue-1]??"";return/^--[^=]+$/.test(be)&&!uI.has(be.slice(2))||B(be)&&be.slice(1).search(W)===be.length-2},Q=v.findIndex((ue,be)=>!ue.startsWith("-")&&!X(be));return(n==="grep"&&Q>=0?v.slice(0,Q):v).some((ue,be)=>{if(X(be))return!1;if(ue.startsWith("--"))return Hh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function Mh(n,u,v,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((Q)=>({target:Q,cwd:z}));let X=gr(n);return[...X?Qo(X.shell,n.store,W,u,z,v,MI(X)):[],...B==="unknown"?n.paths.map((Q)=>({target:Q,cwd:z})):[]]}function MI(n){return n.program.dialect==="powershell"}function Qo(n,u,v,W,z,B,X=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let Q=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...Tk(hr(n.source,W),u,v,W,z,B)],le=(We)=>hr(HI(We,X),W),ue=/[<>=]\(/.test(n.source),be=/\bcoproc\b|\|&/.test(n.source),Oe=[],De=[],Me=(We)=>({...v,commandHoldsPipe:v.commandHoldsPipe===!0||We||be});Us(n,z,W,B,{word:le,segment:(We,it,Be,ze,at,Rt)=>{if(We.length===0)return null;let Tt=Me(Rt);if(Tt.commandHoldsPipe)Oe.push(...We);if(De.push(wn(qh(Xo(We,W))[0]??"").toLowerCase()),Q.push(...Yo(We,u,ue||ze==="|"||ze==="|&"?{...Tt,segmentMayFeedReader:!0}:Tt,W,it.cwd,B,at)),Be!==null)Q.push(...LI(Be,We,u,Tt,W,it.cwd,B));return null},redirection:(We,it,Be)=>{if(We.body!==void 0&&We.consumer!==void 0){let ze=Me(Be);Q.push(...Kh(We.consumer,[We.body],u,ze,W,it.cwd,B,(at)=>WI(We.consumer??[],at,u,ze,W,it.cwd,B)))}if(We.targetOrder==="legacy-segment")return nc;return Q.push({target:le(We.target),cwd:it.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(Oe.flatMap(Vh)),Le=ue||/\$\(|`/.test(n.source)||!De.every((We)=>fI.has(We));return Q.map(({loopVariable:We,...it})=>{if(it.certificateOutputMayFeedReader===!0&&Le)return{target:it.target,cwd:it.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?it:{...it,loopVariable:We}})}function Vh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function qi(n,u,v,W,z,B,X=!1){let Q=u.getShellSyntax(n,X?u.getCommandProgram(n,"powershell"):void 0);if(Q.status==="structural-limit")throw new E;return Q.status==="complete"?Qo(Q,u,v,W,z,B,X):null}function Yo(n,u,v,W,z,B,X){let Q=(ut)=>({target:ut,cwd:z}),le=n.findIndex((ut)=>!rI.has(ut));if(v.skipMetadataOnlySegments===!0&&le>0)return Yo(n.slice(le),u,v,W,z,B,new Set([...X??[]].map((ut)=>ut-le)));let ue=n[1]??"";if(v.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((ut)=>Mn("for",ut)).map((ut)=>({...Q(ut),loopVariable:ue}));if(X?.size){let ut=n.filter((Gt,Xt)=>!X.has(Xt));if(Ah.has(wn(Xo(ut,W)[0]??"").toLowerCase()))return[...n.filter((Gt,Xt)=>X.has(Xt)).map(Q),...Yo(ut,u,v,W,z,B)]}let be=Yr(n,W,z),Oe=typeof be.cwd==="string"?be.cwd:z,De=new Set(n.filter((ut,Gt)=>X?.has(Gt))),Me=(ut)=>({target:ut,cwd:De.has(ut)?z:Oe}),Ne=be.tokens,Le=be.envSplitValues??[],We=[...n.slice(0,n.length-Ne.length).filter((ut)=>!Fk(ut)&&Tn(ut)===null&&!Le.includes(ut)).flatMap((ut)=>Mn("",ut)).map(Q),...[...be.envAssignments.values()].filter((ut)=>ut!=="").map(Me)];if(Le.length>0){let ut=Kr(Le,Ne);if(ut!==null)return[...We,...Yo(ut,u,v,W,z,B,new Set([...X??[]].map((Gt)=>Gt+ut.length-n.length)))];return[...We,...Le.flatMap((Gt)=>qi(Gt,u,v,W,Oe,B)??[Me(Gt)]),...Ne.flatMap((Gt)=>Mn("",Gt)).map(Me)]}if(Ne.length===0)return We;let it=Ne[0]??"",Be=wn(it).toLowerCase(),ze=Ne.slice(1),at=v.segmentMayFeedReader===!0||v.commandHoldsPipe===!0||v.displayOperandsAreCapturedOutput===!0,Rt=at&&mI.has(Be);if(v.skipMetadataOnlySegments===!0&&!Rt&&Sd(Be,ze))return We;let Tt=NI(it,Be,ze);if(Tt)return[...We,...Tt.map(Me)];if(Bh.has(Be))return v.displayOperandsAreCapturedOutput===!0?[...We,...Yh(Ne).map(Me)]:We;if(Be==="eval")return[...We,...qi(ze.join(" "),u,v,W,Oe,B)??ze.map(Me)];let kt=CI.has($t(it))?Qc(Ne):void 0;if(kt!==void 0)B.charge("derivedTokens",Ne.length);let lt=kt===void 0?null:qi(kt,u,v,W,Oe,B,!0);if(lt?.length)return[...We,...lt];if(Be==="export")return[...We,...ze.flatMap((ut)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ut)?[ut.slice(ut.indexOf("=")+1)]:Mn(Be,ut)).map(Me)];if(Be==="git")return[...We,...VI(ze).map(Me)];if(Be==="gh")return[...We,...pd(Be,ze,gI).map(Me)];if(Ah.has(Be))return[...We,...jI(ze).map(Me)];if(hd.has(Be))return[...We,...Wk(ze).map(Me)];if(nI.has(Be))return[...We,...KI(ze,u,v,W,Oe,B).map(Me)];if(Be==="mkdir"||Be==="touch"){let ut=v.segmentMayFeedReader!==!0&&!(Be==="touch"&&ze.some((Gt)=>/^(?:--r|-[^-]*r)/.test(Gt)));return[...We,...ze.flatMap((Gt)=>Mn(Be,Gt).map((Xt)=>ut&&!Gt.startsWith("-")&&!De.has(Gt)?{...Me(Xt),isCreatedPath:!0}:Me(Xt)))]}if($n.has(Be))return[...We,...ze.flatMap((ut)=>Mn("awk",ut)).map(Me),...ze.flatMap((ut)=>ZI(ut,u,v,W,Oe,B)),...ze.flatMap(XI).map(Me)];if(Be==="curl")return[...We,...ze.filter((ut,Gt)=>Xh(ut)===null&&Zh(ze[Gt-1])===null).flatMap((ut)=>Mn(Be,ut)).map(Me),...qI(ze).map(Me)];if(Io(Be)){let ut=xi.has(Be)?An([Be,...ze]):null;if(ut!==null&&ut.command!==null&&ut.commandIndex!==null){let Gt=u.getShellSyntax(ut.command);if(Gt.status==="structural-limit")throw new E;if(Gt.status==="complete")return[...We,...Qo(Gt,u,v,W,Oe,B),...ze.slice(ut.commandIndex).filter((Xt)=>!Xt.startsWith("-")).map(Me)]}return[...We,...YI(Be,ze,u,v,W,Oe,B)]}let jt=(ut,Gt)=>new RegExp(`^--?${ut}=`).test(ze[Gt]??"")||new RegExp(`^--?${ut}$`).test(ze[Gt-1]??""),Bt=DI(Ne),sn=Be==="openssl"&&ze[0]==="x509",yn=at?{certificateOutputMayFeedReader:!0}:{};return[...We,...ze.flatMap((ut,Gt)=>Mn(Be,ut).map((Xt)=>Bt&&jt("(?:cert|key)-file",Gt)?{...Me(Xt),isCreatedPath:!0,...yn}:sn&&jt("in",Gt)?{...Me(Xt),isCertificateInput:!0,...yn}:Me(Xt)))]}function qh(n){return wn(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function DI(n){let u=qh(n);return wn(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function NI(n,u,v){let W=Ia(u,v);if(W===null||v[W]!=="explain")return null;let z=[n,...v.slice(0,W)],B=v.slice(W+1);for(let X=0;X<B.length;X++){let Q=B[X];if(Q==="--json"||Q==="--help"||Q==="-h")continue;if(Q==="--cwd"){let le=B[X+1];if(le&&!le.startsWith("--"))z.push(le);X++;continue}return z}return z}function LI(n,u,v,W,z,B,X){let Q=Xo(n,z);if($I(u,v,W,z,B,X)){let le=Sd(wn(Q[0]??"").toLowerCase(),Q.slice(1))?Q.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...Yh(Q),...le].map((ue)=>({target:ue,cwd:B}))}return Kh(u,FI(Q),v,W,z,B,X,()=>[])}function WI(n,u,v,W,z,B,X){let Q=Xo(n,z);if(!Io(wn(Q[0]??"").toLowerCase()))return[];return qi(u,v,W,z,B,X)??[{target:u,cwd:B}]}function Kh(n,u,v,W,z,B,X,Q){let le=BI(n,z);if(le===null)return u.flatMap(Q);return u.flatMap((ue)=>xi.has(le)?Qo(v.getShellSyntax(ue),v,W,z,B,X):Ma(le,ue,v,W,z,B,X))}function Yh(n){let u=wn(n[0]??"").toLowerCase();if(!Bh.has(u))return[];let v=n[n[1]==="--"?2:1];if(u==="printf"&&v!==void 0&&!v.startsWith("-")&&!v.replaceAll("%%","").includes("%"))return[Cd(v.replaceAll("%%","%"))];return n.slice(1)}function FI(n){let u=wn(n[0]??"").toLowerCase(),v=n.slice(1);if(u==="echo"){let W=v.findIndex((z)=>!/^-[neE]+$/.test(z));return[(W===-1?[]:v.slice(W)).join(" ")]}if(u==="printf")return GI(v);return[]}function GI(n){let u=n[0];if(u===void 0)return[];let v=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(v===0||n.length===1)return[Cd(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/v)},(z,B)=>zI(u,W.slice(B*v,(B+1)*v)))}function zI(n,u){let v=0;return Cd(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[v]??"";return v++,z}))}function Cd(n){return n.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function $I(n,u,v,W,z,B){let X=Xo(n,W);if(X.length===0||wn(X[0]??"").toLowerCase()!=="xargs")return!1;let Q=io(X),le=X.slice(Q.childStart);if(le.length===0)return!1;if(Q.replacementToken==="")return!1;let ue=Q.replacementToken,be=ue===null?[...le,ud]:le.map((Oe)=>Oe.split(ue).join(ud));return Yo(be,u,v,W,z,B).some((Oe)=>Oe.target.includes(ud))}function BI(n,u){let v=Xo(n,u);if(v.length===0)return null;let W=wn(v[0]??"").toLowerCase();if(!Io(W))return null;return UI(W,v.slice(1))?W:null}function UI(n,u){let v=bd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(gd.has(z)||Qh(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(v==="python"&&z==="-m")return!1;if(II.get(v)?.has(z))W++;continue}return!1}return!0}function bd(n){return/^python\d/.test(n)?"python":n}var Dh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function HI(n,u){if(!u||!Dh.test(n))return n;return`~${n.replace(Dh,"").replace(/\\/g,"/")}`}function Mn(n,u){if(u==="--")return[];let v=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))v.push(u.slice(W+1));if(u.startsWith("-"))return v;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return v;if(n==="zip"&&/\.zip$/i.test(u))return v;return v.push(u),v}function jI(n){let u=-1,v=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!v&&z==="--"){v=!0;continue}if(v||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>Mn("jq",B))}return n.flatMap((W,z)=>z===u?[]:Mn("jq",W))}function VI(n){let u=[];for(let v=0;v<n.length;v++){let W=n[v]??"";if(W==="--"||!W.startsWith("-"))return[...u,...hI.has(W)?pd("git",n.slice(v).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),yI):pd("git",n.slice(v),SI)];if(u.push(...Mn("git",W)),!Dn.has(W))continue;let z=n[v+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:Mn("git",z)),v++}return u}function pd(n,u,v){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((X)=>Mn(n,X))];if(v.has(B)){z++;continue}if(B.includes("=")&&v.has(B.slice(0,B.indexOf("="))))continue;W.push(...Mn(n,B))}return W}function qI(n){return n.flatMap((u,v)=>{let W=Xh(u);if(W!==null)return Nh(W.flag,W.value);let z=Zh(n[v-1]);return z===null?[]:Nh(z,u)})}function Nh(n,u){if(n==="-F"||n==="--form"){let v=u.indexOf("="),W=v===-1?u:u.slice(v+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return md(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let v=u.indexOf("@"),W=u.indexOf("=");if(v===-1||W!==-1&&W<v)return[];return md(u.slice(v+1))}return u.startsWith("@")?md(u.slice(1)):[]}function Zh(n){if(n===void 0)return null;if(Uh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function Xh(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let v=n.indexOf("=");if(v===-1)return null;let W=n.slice(0,v);return Uh.has(W)?{flag:W,value:n.slice(v+1)}:null}function md(n){return n===""||n==="-"?[]:[n]}function KI(n,u,v,W,z,B){let X=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),Q=[...n.slice(0,X===-1?n.length:X),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!oI.has(n[le]??""))continue;let ue=n.slice(le+1),be=ue.findIndex((Me)=>iI.has(Me)),Oe=be===-1?ue:ue.slice(0,be),De=Yo(Oe,u,v,W,z,B).map((Me)=>Me.target);if(Q.push(...De.filter((Me)=>Me!=="{}")),!De.includes("{}"))continue;Q.push(...n.slice(0,le).flatMap((Me,Ne,Le)=>{if(!aI.has(Me))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Q}function YI(n,u,v,W,z,B,X){let Q=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(gd.has(ue)||Qh(n,ue)){let Oe=u[le+1];if(Oe!==void 0)Q.push(...Ma(n,Oe,v,W,z,B,X)),le++;continue}let be=/^--(?:eval|exec)=(.*)$/.exec(ue);if(be!==null&&be[1]!==void 0){Q.push(...Ma(n,be[1],v,W,z,B,X));continue}if(!ue.startsWith("-"))Q.push({target:ue,cwd:B})}return Q}function Qh(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return dI.get(u[u.length-1]??"")?.has(bd(n))??!1}function ZI(n,u,v,W,z,B){if(!n.includes("system"))return[];return Cc(n)?.commands.flatMap((X)=>Qo(u.getShellSyntax(X),u,v,W,z,B))??[]}function XI(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function QI(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((v)=>v[2]).filter((v)=>v!==void 0&&v!=="");return[...u,...u.flatMap(vd),...n.match(fd)??[]]}function Ma(n,u,v,W,z,B,X){let Q=(lt)=>({target:lt,cwd:B}),le=Ek(n),ue=Rk(u,le);if(ue.kind==="unmaskable")return QI(u).map(Q);let be=ue.masked.match(Ih)!==null||ue.literals.some((lt)=>kh.test(ue.masked.slice(0,lt.start))),Oe=ue.masked.match(PI)!==null||ue.literals.some((lt)=>TI.test(ue.masked.slice(0,lt.start))),De=W.inlineLiteralsPresumedData===!0&&!xi.has(n),Me=De&&(le==="python"||le==="javascript"),Ne=De&&!(Pk(ue.masked)||be||Oe)?[]:ue.literals,Le=De?Array.from(ue.masked.matchAll(Ih),(lt)=>{let jt=lt.index+lt[0].length;return{start:jt,end:ea(ue.masked,jt)}}):[],We=!De||Le.some((lt)=>gc(ue.masked,lt.start)&&!sk(ue,lt.start))?ue.literals:ue.literals.filter((lt)=>kh.test(ue.masked.slice(0,lt.start))||Le.some((jt)=>lt.start>=jt.start&&lt.start<jt.end)),it=new Set(be?We:[]),Be=Me&&Ne.length>0&&!nk(ue.masked,le==="python"?"#":"//"),ze=Be?ak(ue.masked):[],at=Be?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(lt)=>({name:lt[0],index:lt.index})):[],Rt=ok(at),Tt=!rk(ue.masked,at),kt=at.filter((lt)=>!Lh(ue.masked,{start:lt.index,text:lt.name,tokenStart:lt.index,tokenEnd:lt.index+lt.name.length},ze,Rt,Tt)).reduce((lt,jt)=>{let Bt=lt.get(jt.name)??[];return Bt.push(jt.index),lt.set(jt.name,Bt)},new Map);return[...Ne.filter((lt)=>lt.text!=="").map((lt)=>{if(!Be||it.has(lt))return Q(lt.text);if(Lh(ue.masked,lt,ze,Rt,Tt)||lk(ue.masked,lt,ze,kt))return{...Q(lt.text),literalRole:"data"};return Sk(ue,lt,ze)?{...Q(lt.text),literalRole:"write"}:Q(lt.text)}),...Ne.flatMap((lt)=>vd(lt.text)).map(Q),...De?[]:ue.literals.flatMap((lt)=>lt.text.match(fd)??[]).map(Q),...be?We.flatMap((lt)=>qi(lt.text,v,{...W,commandHoldsPipe:!0},z,B,X)??[Q(lt.text)]):[],...Oe?ue.literals.flatMap((lt)=>Ma(n,lt.text.replace(/\\(.)/g,(jt,Bt)=>Bt==="n"?`
+`:Bt),v,W,z,B,X)):[],...Me?[]:[ue.masked,...ue.comments].flatMap((lt)=>lt.match(fd)??[]).map(Q),...De?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Q):[]]}var Ed={"(":")","[":"]","{":"}"},Jh="and|elif|else|if|in|is|not|of|or|return|while|yield",JI=new RegExp(`(?:^|[^\\w$])(?:${Jh})$`),ek=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${Jh})\\s*\\(|/\\*`),tk=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function nk(n,u){return ek.test(n)||n.split(`
+`).some((v)=>{let W=v.indexOf(u);return W>=0&&/[()[\]{}]/.test(v.slice(W))})}function rk(n,u){return uk.test(n)||u.some((v)=>{let W=dk.get(v.name),z=v.index+v.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function ok(n){return n.some((u)=>ty(u.name).some((v)=>tk.test(v)))}var ik=new Set(["cmd","powershell","pwsh"]);function sk(n,u){let v=co(n.masked,u),W=Ed[n.masked[v]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,v+1),B=n.masked.slice(v+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(co(n.masked,z+1)))&&!n.literals.some((X)=>X.tokenStart>v&&X.tokenStart<z&&(gd.has(X.text)||Io(wn(X.text).toLowerCase())||ik.has(wn(X.text).toLowerCase().replace(/\.exe$/,""))))}function ak(n){let u=[];return n.split("").map((v,W)=>{let z=u.at(-1)??-1;if(v in Ed)u.push(W);if(v===")"||v==="]"||v==="}")u.pop();return z})}function Lh(n,u,v,W,z){let B=v[u.tokenStart]??-1,X=n[B]??"",Q=Zo(n,u.tokenStart),le=co(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,Q-3),Q+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(X==="["||X==="("))return!1;let ue=n[Q],be=n[le];if(X==="{"&&ue===":")return Ck(n,Q);let Oe=(ue===X||ue===",")&&(be===","||be===Ed[X]||X==="{"&&be===":");if(X!=="(")return Oe&&X!=="";return Oe&&(z&&ck.test(n.slice(Math.max(0,B-20),B))||(ue===","||be===",")&&bk(n,B))}function lk(n,u,v,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
+`:""}${n.slice(z,u.tokenStart)}`,X=mk.exec(B)?.[1],Q=n[v[u.tokenStart]??-1];if(X===void 0||Q==="("||Q==="[")return!1;let le=co(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(X);return(W.get(X)??[]).every((be)=>be===ue)}var ck=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,dk=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),uk=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,mk=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,fk=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,pk=/^\s*\.\s*write_(?:text|bytes)\s*\(/,gk=/(?:^|[^\w$.])open\s*$/,hk=/^[bt]*[awx][abtwx]*$/,yk=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function Sk(n,u,v){let W=v[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Zo(n.masked,u.tokenStart),B=co(n.masked,u.tokenEnd),X=n.masked[B],Q=n.masked.slice(Math.max(0,W-40),W);if(fk.test(Q))return(z===W||n.masked[z]===",")&&(X===","||X===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&pk.test(n.masked.slice(ea(n.masked,W+1)+1));if(z!==W||X!==",")return!1;if(yk.test(Q))return!0;if(!gk.test(Q))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&hk.test(le.text)&&/^[,)]/.test(n.masked.slice(co(n.masked,le.tokenEnd)))}function Ck(n,u){let v=Zo(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,v-63),v+1))?.[0]??"",z=n[Zo(n,v+1-W.length)];return z==="{"||z===","}function bk(n,u){let v=Zo(n,u),W=n.slice(Math.max(0,v-7),v+1);return!/[\w$)\]]$/.test(W)||JI.test(W)}function Ek(n){let u=bd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var vk={python:"#",javascript:"/"};function Rk(n,u){if(u==="opaque")return{kind:"unmaskable"};let v={masked:n.split(""),literals:[],comments:[]};return ey(n,0,u,v,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:v.masked.join(""),literals:v.literals,comments:v.comments}}function ey(n,u,v,W,z){let B=0;for(let X=u;X<n.length;X++){let Q=n[X]??"";if(z&&Q==="}"&&B===0)return X;if(z&&Q===vk[v])return null;if(v==="python"&&Q==="#"){let Le=n.slice(X).search(/[\r\n]/),We=Le===-1?n.length:X+Le;W.comments.push(n.slice(X,We)),W.masked.fill(" ",X,We),X=We-1;continue}if(Q==="{")B++;if(Q==="}")B--;if(v==="simple"&&(Q==="`"||Q==="%"||Q==="<")){if(xI.test(n.slice(X)))return null}let le=Q==="'"||Q==='"'||v==="javascript"&&Q==="`"?Q:null;if(le===null)continue;if(le==="`"&&Ak(n,X))return null;let ue=v==="python"?_k(n,X):"",be=v==="python"&&n.startsWith(le.repeat(3),X)?le.repeat(3):le,Oe=X+be.length,De=le==="`"||/[fF]/.test(ue),Me=X-ue.length,Ne=De?wk(n,Me,Oe,be,v,W):xk(n,Oe,be);if(Ne===null)return null;if(!De){let Le=n.slice(Oe,Ne);if(v==="simple"&&le==='"'&&AI.test(Le))return null;W.literals.push({start:Oe,text:Le,tokenStart:Me,tokenEnd:Ne+be.length}),W.masked.fill(" ",Oe,Ne)}W.masked.fill(" ",X,Oe),W.masked.fill(" ",Ne,Ne+be.length),X=Ne+be.length-1}return z?null:n.length}function wk(n,u,v,W,z,B){let X=z==="python"?"{":"${",Q=W==="`"||W.length===3,le="";for(let ue=v;ue<n.length;ue++){let be=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:v,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!Q&&(be===`
+`||be==="\r"))return null;let Oe=z==="python"&&(be==="{"||be==="}")&&n[ue+1]===be;if(!Oe&&n.startsWith(X,ue)){let Ne=ey(n,ue+X.length,z,B,!0);if(Ne===null)return null;le+=`${X}}`,B.masked.fill(" ",ue,ue+X.length),B.masked[Ne]=" ",ue=Ne;continue}let Me=be==="\\"&&!(z==="python"&&n[ue+1]==="{")||Oe?2:1;le+=n.slice(ue,ue+Me),B.masked.fill(" ",ue,ue+Me),ue+=Me-1}return null}function _k(n,u){return _I.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function xk(n,u,v){let W=v.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
+`||B==="\r"))return null;if(n.startsWith(v,z))return z}return null}function Ak(n,u){for(let v=u-1;v>=0;v--){let W=n[v];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function Pk(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let v=u[0],W=u.index;if(lI.has(v.toLowerCase()))return!0;let z=ty(v);if(!z.some((B)=>cI.has(B)))continue;if(z.length>1)return!0;if(n[Zo(n,W)]===".")return!0;if(n[co(n,W+v.length)]==="(")return!0}return!1}function ty(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Zo(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function co(n,u){for(let v=u;v<n.length;v++)if(!/\s/.test(n[v]??""))return v;return n.length}function Tk(n,u,v,W,z,B){return Dk(n).flatMap((X)=>{let Q=u.getShellSyntax(X);if(Q.status==="invalid")return[];return[...Qo(Q,u,{...v,displayOperandsAreCapturedOutput:!0},W,z,B),...Ik(Q,W)?kk(Q,W).map((le)=>({target:le,cwd:z})):[]]})}function Ik(n,u){let v=Hs(n);for(let W=0;W<v.length;W++){let z=v[W];if(z?.kind!=="word"||wn(hr(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<v.length;B++){let X=v[B];if(X?.kind==="operator")break;if(X?.kind!=="word")continue;let Q=hr(X.text,u);if(Q==="--decode"||!Q.startsWith("--")&&Q.startsWith("-")&&/[dD]/.test(Q))return!0}}return!1}function kk(n,u){return Hs(n).flatMap((v)=>v.kind==="word"?[hr(v.text,u)]:v.kind==="redirection"&&v.target?[hr(v.target,u)]:[]).flatMap(vd)}function vd(n){let u=Mk(n);if(u===null)return[];let v=Buffer.from(u,"base64").toString("utf8");if(v===""||Ok(v))return[];return Buffer.from(v,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[v]:[]}function Ok(n){return Array.from(n).some((u)=>{let v=u.charCodeAt(0);return v<32||v===127})}function Mk(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function Dk(n){let u=[],v={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(li(z,v))continue;if(ny(n,W,v)){let B=Nk(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!v.inSingle&&z==="`"){let B=Lk(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function Nk(n,u){let v={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(li(B,v))continue;if(ny(n,z,v)){W++,z++;continue}if(!v.inSingle&&!v.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function Lk(n,u){let v=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function ny(n,u,v){return!v.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function Wk(n){let u=[],v=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){v.push(ue);continue}let be=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(be!==null){let Oe=be[1]??"",De=be[2];if(Oe===bI)z=!0;if(vI.has(Oe))W=!0;if(De!==void 0){if(Oe===Th)u.push(De);continue}if(wI.has(Oe)){let Me=n[le+1];if(Oe===Th&&Me!==void 0)u.push(Me);le++}continue}if(ue.startsWith("-")&&ue.length>1){let Oe=ue.slice(1),De="",Me="";for(let Le=0;Le<Oe.length;Le++){let We=Oe[Le]??"";if(EI.has(We))W=!0;if(RI.has(We)){De=We,Me=Oe.slice(Le+1);break}}if(De==="")continue;if(Me.length>0){if(De===Ph)u.push(Me);continue}let Ne=n[le+1];if(De===Ph&&Ne!==void 0)u.push(Ne);le++;continue}v.push(ue)}let Q=!W&&!z?v.slice(1):v;return[...u,...Q]}function Fk(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var Gk=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Wh=".env.",zk=[".example",".sample",".template",".tpl"],$k=[".env.example.",".env.sample."];function Bk(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function Uk(n){return n.length>0&&!/\s/.test(n)}function Da(n,u,v,W){let z=ry(n,u,v,W);return z!==""&&v.paths.entryKind(z)!=="missing"}function ry(n,u,v,W){try{return Ki(n,u,v,W)}catch(z){if(z instanceof a)throw z;return""}}var Hk=/[?&][^?&=/]+=/,jk=new Set(["node_modules","__pycache__"]),Vk=[["vendor","bundle"],["vendor","cache"]];function qk(n,u,v,W,z){if(Bk(n))return null;let B=On(n,u,W,z);if(!B)return null;let X=Kt(B.split("/").pop()??""),Q=Kt(B),le=()=>Uk(X)||Da(n,u,W,z),ue=Kt(Jk(n,u,W,z));for(let De of pl){let Me=`~/${De.suffixParts.join("/")}`;if((Gh(Q,Me)||Gh(ue,Me))&&Er(De.id,v))return De.id}if(X===".env.defaults"||X.startsWith(Wh)&&zk.some((De)=>X.endsWith(De))||$k.some((De)=>X.startsWith(De)))return null;let be=Kk(B,u,v,W,z);if(be)return be;if(Gk.has(X))return null;for(let De of fl)if(X===De.basename&&Er(De.id,v))return De.id;if(X.startsWith(Wh)&&Er(fs.id,v)&&le())return fs.id;for(let De of gl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){let Me=X.slice(De.prefix.length)[0];if((Me==="-"||Me==="_")&&Er(De.id,v)&&le())return De.id}for(let De of hl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){if(X.slice(De.prefix.length)===De.suffix&&Er(De.id,v))return De.id}if(Xk(Q))return null;if(!X.includes(".")&&ci.pattern.test(X)&&Er(ci.id,v))return ci.id;if(Hk.test(n)&&!Da(n,u,W,z))return null;let Oe=Qk(X,v);if(Oe)return Oe;return null}function Kk(n,u,v,W,z){return ps.find((B)=>{if(!Er(B.id,v))return!1;switch(B.id){case"secret.cli.claude-code":return Vt(n,Yt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let X=Kt(n).split("/");return Vt(n,Yt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||Vi(n,"~/.claude.json",u,W,z)||X.at(-1)==="settings.local.json"&&X.at(-2)===".claude"||X.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Vt(n,On("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let X=Yt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return Vt(n,X,["auth.json",".credentials.json"])||Ko(n,X,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let X=Yt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),Q=Kt(n).split("/").at(-1)??"";return Vt(n,X,["config.toml"])||Q.endsWith(".config.toml")&&Vt(n,X,[Q])}case"secret.cli.gemini":return Vt(n,an(Yt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let X=Kt(n).split("/"),Q=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[an(Yt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return Vt(n,an(Yt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||X.at(-1)==="settings.json"&&X.at(-2)===".gemini"||(Q?.trim()?Vi(n,Q,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>Vt(n,On(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let X=Yt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return Vt(n,X,["config.json"])||Ko(n,X,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Vt(n,Yt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let X=Yt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q=Yt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return Vt(n,X,["server.token"])||Ko(n,X,["credentials"])||Ko(n,Q,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let X=["config.toml","mcp.json"],Q=Kt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".kimi-code"||Vt(n,Yt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),X)||Vt(n,Yt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...X,"config.json","config.json.bak"])}case"secret.cli.opencode":{let X=an(Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),Q=Kt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return Vt(n,X,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Q)&&Vt(n,X,[Q])||ue.some((be)=>Vi(n,be,u,W,z))}case"secret.cli.opencode.config":{let X=an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),Q=W.env.get("ProgramData")?[an(Yt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Kt(n).split("/").at(-1)??"")||Vt(n,X,["config.json"])||(ue?.trim()?Vi(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...Q].some((be)=>Vt(n,On(be,u,W,z),le))}case"secret.cli.pi":return Vt(n,Yt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return Vt(n,Yt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let X=On("~",u,W,z);return[an(Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),an(X,".local","share","amp")].some((le)=>Vt(n,le,["secrets.json"]))||Ko(n,an(X,".amp"),["oauth"])}case"secret.cli.amp.config":{let X=["settings.json","settings.jsonc"],Q=[an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),an(On("~",u,W,z),".config","amp")],le=Kt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return Q.some((be)=>Vt(n,be,X))||le.at(-2)===".amp"&&X.includes(le.at(-1)??"")||(ue?.trim()?Vi(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let X=an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),Q=an(Yt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return Vt(n,On("~/.cursor",u,W,z),["auth.json"])||Vt(n,X,["auth.json"])||Kt(n).split("/").at(-1)==="mcp-auth.json"&&uo(Kt(n),Kt(Q))}case"secret.cli.cursor.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".cursor"}case"secret.cli.grok-build":return Vt(n,Yt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let X=Kt(n).split("/");return X.at(-1)==="config.toml"&&X.at(-2)===".grok"||Vt(n,Yt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||Vt(n,On("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Vt(n,On("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".factory"||Vt(n,On("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),On("~/.local/share",u,W,z)].some((X)=>Vt(n,an(X,"devin"),["credentials.toml"])||Ko(n,an(X,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),On("~/.config",u,W,z)].some((X)=>Vt(n,an(X,"devin"),["config.json"]));default:return!1}})?.id??null}var Fh=new WeakMap;function Yt(n,u,v,W,z){let B=Fh.get(z)??new Map;Fh.set(z,B);let X=`${v}\x00${n??""}\x00${u}`,Q=B.get(X);if(Q!==void 0)return Q;let le=On(n?.trim()?n:u,v,W,z);return B.set(X,le),le}function Vt(n,u,v){return v.some((W)=>oy(n,an(u,W)))}function Ko(n,u,v){return v.some((W)=>uo(Kt(n),Kt(an(u,W))))}function Vi(n,u,v,W,z){return oy(n,On(u,v,W,z))}function oy(n,u){return Kt(n)===Kt(u)}function an(n,...u){return Jn([n,...u].filter(Boolean).join("/"))}function Yk(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Ki(n,u,z,B));return v.some((Q)=>uo(X,Kt(Ki(Q,W,z,B))))}function Zk(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Ki(n,u,z,B));if(!X)return!1;let Q=z.env.get("HOME")??z.home,le=Q?Jn(Ht(Sn(Q),z.paths,B)):"",ue=Kt(le),be=z.env.get("CC_SAFETY_NET_HOME"),Oe=Kt(be?Jn(Ht(Na(Sn(be)),z.paths,B)):le&&Jn(Ht(`${le}/.cc-safety-net`,z.paths,B)));if(Oe&&uo(X,Oe))return!1;return v.some((De)=>{let Me=El(De);if(Me&&zh.basename(X)!==Kt(Me.name))return!1;let Ne=Kt(Ki(Me?.root??De,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return uo(X,Ne)&&!(Me&&X===Ne)})}function Xk(n){let u=n.split("/");return u.some((v)=>jk.has(v))||Vk.some(([v,W])=>u.some((z,B)=>z===v&&u[B+1]===W))}function Qk(n,u){let v=n.lastIndexOf("."),W=v>0&&v<n.length-1?n.slice(v+1):"";if(W==="")return null;for(let z of yl)if(W===z.extension&&Er(z.id,u))return z.id;for(let z of Sl)if(z.pattern.test(W)&&Er(z.id,u))return z.id;return null}function Kt(n){return n.toLowerCase()}function Er(n,u){return!u?.disabledRules?.includes(n)}function On(n,u,v,W){let{home:z,normalized:B}=Rd(n,v,W);if(!B)return"";if(!z)return B;let X=wd(B,z),Q=Oa(X)?X:Jn(Na(u,X)),le=Jn(Ht(Q,v.paths,W));if(!uo(le,z)){if(Oa(X))return le;return le===Q?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function Gh(n,u){return n===u||n.startsWith(`${u}/`)}function Jk(n,u,v,W){let{home:z,normalized:B}=Rd(n,v,W);if(!B||!z)return"";let X=wd(B,z),Q=zh.normalize(Oa(X)?X:Jn(Na(u,X))),le=Jn(Sn(v.env.get("HOME")??v.home)),ue=(De)=>process.platform==="win32"?De.toLowerCase():De,be=[z,le].find((De)=>De!==""&&uo(ue(Q),ue(De)));if(be===void 0)return"";let Oe=Q.slice(be.length);return Oe?`~${Oe}`:"~"}function Ki(n,u,v,W){let{home:z,normalized:B}=Rd(n,v,W);if(!B)return"";let X=z?wd(B,z):B;return Jn(Ht(Oa(X)?X:Na(u,X),v.paths,W))}function Rd(n,u,v){let W=u.env.get("HOME")??u.home,z=W?Jn(Ht(Sn(W),u.paths,v)):"",B=Jn(Sn(eO(hr(n,u))));return{home:z,normalized:B}}function eO(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return tI(n)}catch{return n}}function wd(n,u){if(n==="~")return u;if(n.startsWith("~/"))return an(u,n.slice(2));return n}function tO(n){if(process.platform==="win32")return!0;return eI.parse(n).root.length>1}function Jn(n){let u=n.trim(),v=(u.includes("\\")&&tO(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(v==="/")return v;return v.replace(/\/+$/g,"")}function uo(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function wn(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,v){super(`CC Safety Net ${n} dependency failed`,{cause:v});this.stage=n;this.evaluation=u}}var nO={findPolicyMutation:_h,findGitMetadataMutation:Df,resolveGitMetadata:sO,loadPolicySnapshot:w,findSensitiveTarget:jh,analyzeCommand:Sh,getModes:O},rO=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,oO=["workdir","cwd","working_directory"];function G(n,u){let v={...nO,...u.dependencies},W=cO(n),z=()=>Nr("config-load",W,()=>v.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,X=B?.policy.commandTools.find((Bt)=>Bt.name===n.toolName),Q=X&&W?iO(n,W,X.cwd,u.environment.paths):n;if("decision"in Q)return Q;let le=Q,ue=le===n?{}:{promotedInvocation:le},be=Yi(le)?le.command:W,Oe=Nr("policy-protection",be,()=>If(le)),De=ko(Oe,"input-candidate"),Me=ko(Oe,"declared-command");if(Yi(le)&&le.command?.trim()&&Me?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:tr,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(De?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:Tf,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=_n(),Le=Nr("policy-protection",be,()=>v.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=Nr("policy-protection",be,()=>v.findPolicyMutation(Oe,u.environment,Ne));if(We){let Bt=be??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Bt,segment:We.target}}}}let it=Nr("policy-protection",be,()=>Eh(Oe,u.environment,Ne));if(it){let Bt=be??it.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Bt,segment:it.target}}}}let Be=Nr("policy-protection",be,()=>v.findGitMetadataMutation(Oe,Le,u.environment,Ne));if(Be){let Bt=be??Be.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Bt,segment:Be.target}}}}let ze=B??z(),at=ze.policy,Rt=v.getModes(at,u.environment.env),Tt={level:Rt.effectiveLevel,...aO(ze),...ue},kt=at.secretProtection.enabled===!1?null:Nr("secret-protection",be,()=>v.findSensitiveTarget(Oe,at.secretProtection,u.environment,Ne,{strict:Yi(le)||De?.program.dialect==="powershell"?Rt.strict:void 0}));if(kt){let Bt=be??kt.target;return{stage:"secret-protection",...Tt,decision:{kind:"deny",reason:$h,intent:"hard_stop",ruleId:kt.ruleId,evidence:{command:Bt,segment:kt.target}}}}if(!Yi(le))return{stage:"non-command",...Tt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...sy(be),...Tt};let lt=Nr("command-analysis",be,()=>Ch(()=>v.analyzeCommand(le.command,{cwd:le.context.configCwd,effectiveCwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:ze,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Rt.capabilities,worktreeMode:Rt.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},lO(Oe),Oe.store),le.command,u.trace)),jt=le.route.shell==="auto"&&Oe.store.readsAutoAsPowerShell()?()=>{let Bt=u.trace?.branch(),sn={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...Bt?{trace:Bt.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>ze,resolveGitMetadata:()=>Le}}),...ue};return{decision:sn.decision,withItsTrace:()=>(Bt?.adopt(),sn)}}:void 0;if(lt.decision){let Bt=!Rt.strict&&(lt.decision.ruleId==="raw-text.dangerous-command"||lt.decision.reason===Xr&&!rO.test(lt.decision.evidence?.segment??"")&&Bn(le.command)===null),sn=Bt?jt?.():void 0;if(sn?.decision.kind==="deny"&&!sn.decision.unverifiedByStandardMode)return sn.withItsTrace();return{stage:"command-analysis",...Tt,..."errorCode"in lt?{errorCode:lt.errorCode}:{},decision:Bt?{...lt.decision,unverifiedByStandardMode:!0}:lt.decision}}return jt?.().withItsTrace()??{stage:"command-analysis",...Tt,decision:{kind:"allow"}}}function iO(n,u,v,W){let z=[...new Set((v?[v]:oO).flatMap((le)=>{let ue=Object.getOwnPropertyDescriptor(n.input,le);return ue?[ue.value]:[]}))],B=z.filter((le)=>typeof le==="string"&&le.trim()!=="");if(z.length>1||B.length!==z.length)return sy(u);let X=B[0],Q=X===void 0?n.context.configCwd:uu(X,n.context.configCwd,W);if(!Q){let le=I({directory:"requested",problem:"unusable",cwd:X??""});return{stage:"command-validation",decision:{kind:"deny",reason:le.reason,ruleId:le.ruleId,intent:le.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:Q},u)}function sO(n,u){let v=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(v.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(v.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(v.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(v.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(v.flatMap((W)=>W.hooksDirectories))])})}function aO(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function lO(n){return ko(n,"declared-command")?.program}function cO(n){try{return de(n.input)}catch(u){let v=Yi(n)?n.command:void 0;throw new g("policy-protection",iy("policy-protection",u instanceof h?void 0:v,u),u)}}function Nr(n,u,v){try{return v()}catch(W){throw new g(n,iy(n,W instanceof h?void 0:u,W),W)}}function iy(n,u,v){let W=v instanceof H?{reason:or,ruleId:"analysis.strict-unparseable"}:v instanceof a||v instanceof E?{reason:Wa,ruleId:"analysis.limit"}:{reason:Jo,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function sy(n){let u=V();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Yi(n){return n.route.kind==="command"}
+export{l,a,ee,Ve,dt,A,Pt,pt,Fe,te,V,I,ne,_t,c,r,ft,$e,O,k,xe,At,h,je,b,de,Se,It,mt,gt,d,qe,i,R,s,pe,o,x,we,q,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,Ke,ge,f,e,Je,Ue,Ye,Te,vt,bt,he,He,ye,Ze,ie,J,Xe,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Qe,et,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Mt,Ie,rt,ot,g,G};