cc-safety-net 2.7.1 → 2.7.2

package/dist/chunks/index-rh1b7fd5.js

@@ -1,53 +0,0 @@
-var Wa="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",tr="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Zo="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var La={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},fo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...La},processedCandidateBytes:{cap:4194304,...La},pathEnvironmentExpansion:{cap:64,...La},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...fo},trackedHeredocFiles:{cap:64,...fo},scriptFiles:{cap:64,...fo},controlFlowStates:{cap:64,...fo},wrapperPeelIterations:{cap:20,...fo},derivedCommandShape:fo});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function Rn(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,v=1){let W=(n.get(u)??0)+v;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var ay=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ee(n){return Ve(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ve(n){return ay.reduce((u,v)=>u.replace(v,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return wd(n).reduceRight((u,v)=>`${u.slice(0,v.valueStart)}<redacted>${u.slice(v.valueEnd)}`,n)}function A(n){return Ve(dt(n))}function Pt(n){return wd(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function wd(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let v=n[u.index-1];if(u.index>0&&v&&!/[\s"'([{]/.test(v))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:ly(n,W)}]})}function ly(n,u){if(n.startsWith("$(",u))return cy(n,u);let v=n[u];if(v==='"'||v==="'"){for(let z=u+1;z<n.length;z++){if(v==='"'&&n[z]==="\\"){z++;continue}if(n[z]===v)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function cy(n,u){let v=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){v++,z++;continue}if(B!==")")continue;if(v--,v===0)return z+1}return n.length}var dy={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function uy(n){let u=n.maxLen??200,v=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${v(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(v(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(v(n.segment))}`:void 0,n.cwd?`Working directory: ${W(v(n.cwd))}`:void 0,n.configWarning?`Config warning: ${v(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":dy[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
-
-`)}function Fe(n,u){if(n.decision.kind!=="deny")return;let v=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:v?.command,segment:v?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function te(n={}){return{reason:Zo,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function V(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var my={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...my[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function ne(n){return uy({...n,redact:ee})}function _t(n){return ee(n instanceof Error?n.message:String(n))}import{spawnSync as qy}from"node:child_process";import{lstatSync as Ky,realpathSync as Yy,statSync as Zy}from"node:fs";import{isAbsolute as Xy}from"node:path";import{homedir as Qy,tmpdir as Jy}from"node:os";import{statSync as Hy}from"node:fs";import{join as jy}from"node:path";import{basename as Td,dirname as fy,isAbsolute as py,join as gy,normalize as hy,resolve as Ad}from"node:path";var yy=256,qi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function gn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function cr(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function $a(n,u){return Fa(n,0,u)}function Fa(n,u,v){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let Q=Ga(n,z+2),le=Sy(n,z,u);if(le===null){if(qi.has(Q))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=Cy(ue,u,v),z=le+1;continue}let X=Ga(n,z+1);if(!X){W+="$",z++;continue}W+=za(X,v)??`$${X}`,z+=X.length+1}return W}function Sy(n,u,v){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,v+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function Cy(n,u,v){let W=n.slice(2,-1),z=Ga(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return za(z,v)??n;let X=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!X){if(qi.has(z))throw new a("pathEnvironmentExpansion");return n}if(!qi.has(z))return n;if(X.endsWith("="))throw new a("pathEnvironmentExpansion");let Q=za(z,v),le=X.startsWith(":")?Q!==null&&Q!=="":Q!==null;if(X.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(X.endsWith("-")||X.endsWith("?"))return le?Q??"":Fa(B.slice(X.length),u+1,v);return le?Fa(B.slice(X.length),u+1,v):""}function Ga(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let v=u+1;while(/[A-Za-z0-9_]/.test(n[v]??""))v++;return n.slice(u,v)}function za(n,u){if(!qi.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function Ut(n,u,v){if(!n)return n;let W=v.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){Id(v,B);let X=u.realpath(B);if(X!==null)return Pd(v,n,X,z);let Q=fy(B);if(Q===B||z.length>=yy)return Pd(v,n,B,z);z.push(Td(B)),B=Q}}function Pd(n,u,v,W){let z=W.length===0?v:gy(v,...W.reverse());return n.resolvedPaths.set(u,z),z}function by(n,u,v){let W=v.resolvedPaths.get(n);if(W!==void 0)return W;Id(v,n);let z=u.realpath(n);if(z!==null)v.resolvedPaths.set(n,z);return z}function Id(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function hn(n,u,v,W){let z=Od(n,u,v);if(!z)return"";return Ut(z,v.paths,W).replace(/\\/g,"/")}function kd(n,u,v,W,z){let B=Od(n,u,v);if(!B)return null;if(z(Td(B)))return Ut(B,v.paths,W).replace(/\\/g,"/");let X=by(B,v.paths,W);return X===null?null:X.replace(/\\/g,"/")}function Od(n,u,v){let W=v.home,z=$a(n.trim(),v).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?Ad(W,z.slice(2)):z,X=gn(B);return hy(py(X)?X:Ad(u,X))}import{spawnSync as vy}from"node:child_process";import{accessSync as Md,constants as Dd,existsSync as Xo,lstatSync as Ey,opendirSync as Ry,readFileSync as Qo,realpathSync as po,statSync as go}from"node:fs";import{dirname as Wd,isAbsolute as Ba,join as Ln,resolve as Ki}from"node:path";var _y=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],xy=5000;function Fd(n,u=zy(),v=xy){let W=wy(n),z=W===null?null:Ay(W);if(W===null||z===null)return null;let B=Fy(W,z,u,v);return B===null?null:{recursiveSubmodules:B}}function wy(n){try{let u=po(Ki(n));return go(u).isDirectory()?u:null}catch{return null}}function Ay(n){let u=Wy(n);if(!u)return null;try{let v=Ey(u);if(v.isSymbolicLink()||!v.isFile())return null;let W=Ua(u);if(!W?.commonDir)return null;if(!Iy(W.gitDir,u))return null;return $d(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function Ua(n){try{let u=Py(n);if(!u)return null;let v=po(Ba(u)?u:Ki(Wd(n),u));if(!go(v).isDirectory())return null;return{gitDir:v,commonDir:Ty(v)}}catch{return null}}function Py(n){let u=Qo(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function Ty(n){try{let u=Qo(Ln(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let v=po(Ba(u)?u:Ki(n,u));return go(v).isDirectory()?v:null}catch{return null}}function Iy(n,u){let v=ky(n);return v===null?!1:Oy(n,v,u)}function ky(n){let u=Ln(n,"gitdir");if(!Xo(u))return null;let v=Qo(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return v===""?null:v}function Oy(n,u,v){try{return My(Ba(u)?u:Ki(n,u),v)}catch{return!1}}function My(n,u){try{let v=go(n),W=go(u);if(v.ino!==0&&W.ino!==0&&v.dev===W.dev&&v.ino===W.ino)return!0}catch{}return Nd(po.native(n))===Nd(po.native(u))}function Nd(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),v=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?v.toLowerCase():v}function Gd(n){try{return Md(Ln(n,"objects"),Dd.X_OK),Md(Ln(n,"refs"),Dd.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Bd(Ln(n,"HEAD")))}catch{return!1}}function zd(n){return Xo(Ln(n,"commondir"))||$d(n,n)}function $d(n,u){return[Ln(u,"config"),Ln(n,"config.worktree")].some(Dy)||Ly(n)}var Ld=1048576;function Bd(n){let u=go(n);if(!u.isFile()||u.size>Ld)throw Error(`${n} is not a regular file within ${Ld} bytes`);return Qo(n,"utf-8")}function Dy(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(Bd(n))}catch(u){return u.code!=="ENOENT"}}var Ny=1e4;function Ly(n){let u=[n],v=0;try{while(u.length>0){let W=u.pop(),z=Ry(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(v++,B.isSymbolicLink()||B.isFIFO()||v>Ny)return!0;let X=W===n&&B.name==="objects";if(B.isDirectory()&&!X)u.push(Ln(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function Wy(n){try{return Ha(po(n))}catch{return null}}function Ha(n){let u=n;while(!0){let v=Ln(u,".git");if(Xo(v))return v;let W=Wd(u);if(W===u)return null;u=W}}function Fy(n,u,v,W){if(Gy(u))return!0;if(v===null)return!0;let z=vy(v,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:$y(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&Ud(z.stdout.trim())}function Gy(n){return[Ln(n.commonDir,"config"),Ln(n.gitDir,"config.worktree")].filter((u)=>Xo(u)).some((u)=>By(u))}function zy(){return _y.find((n)=>Xo(n))??null}function Jo(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function $y(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!Jo(u)))}function By(n){let u;try{u=Qo(n,"utf-8")}catch{return!0}let v="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let X=B.match(/^\[([^\]]+)\]$/);if(X){v=X[1]?.trim().toLowerCase()??"";continue}let Q=B.indexOf("="),le=(Q===-1?B:B.slice(0,Q)).trim().toLowerCase(),ue=Q===-1?"true":B.slice(Q+1).trim();if(Uy(v)&&le==="path")return!0;if(v==="submodule"&&le==="recurse")W=Ud(ue)}return W}function Uy(n){return n==="include"||n.startsWith("includeif ")}function Ud(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Hd(n,u){if(n==="")return null;let v=Rn(),W=Ha(hn(n,n,u,v)),z=W?Vy(W,n,u,v):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Vy(n,u,v,W){try{let z=hn(n,u,v,W),B=Hy(n),X=B.isFile()?z:null,Q=B.isFile()?Ua(n):null,le=(B.isDirectory()?[z]:[Q?.gitDir,Q?.commonDir]).flatMap((be)=>be?[ho(hn(be,u,v,W))]:[]),ue=[...new Set(B.isDirectory()?[ho(n.replace(/\\/g,"/")),...le]:le)];return{entry:ho(z),markerFile:X?ho(X):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((be)=>{let Me=ho(jy(be,"hooks").replace(/\\/g,"/"));return[Me,ho(hn(Me,u,v,W))]}))]}}catch{return null}}function ho(n){return process.platform==="win32"?n.toLowerCase():n}var eS={realpath:(n)=>{try{let u=Yy(n);return Xy(u)?u:null}catch{return null}},entryKind:(n)=>{try{let u=Ky(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return Zy(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return nS({env:new Map(Object.entries(process.env).flatMap(([u,v])=>v===void 0?[]:[[u,v]])),home:gn(process.env.HOME||Qy()),tmpdir:Jy(),darwinUserTempDir:()=>Yi(n,"",tS),paths:eS})}function tS(){if(process.platform!=="darwin")return null;let n=qy("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function nS(n,u={}){let v=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(X)=>Yi(v,X,()=>Hd(X,B)),worktreeFacts:(X)=>Yi(W,X,()=>Fd(X)),isGitDirectory:Gd,gitDirectoryRedirects:(X)=>Yi(z,X,()=>zd(X)),...u};return B}function Yi(n,u,v){let W=n.get(u);if(W!==void 0)return W;let z=v();return n.set(u,z),z}var yo=["fail_closed","paranoid_rm","paranoid_interpreters"],Zi={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},Xi=["standard","strict","paranoid"];function jd(n,u){if(!u)return n;return Xi.indexOf(u)>Xi.indexOf(n)?u:n}function Vd(n){let u=xe(r.level,n);return Xi.find((v)=>v===u)}function qd(n,u){return jd(n,Vd(u))}function rS(n){let u=xe(r.level,n);if(!u)return;let v=Vd(n);if(v)return v;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${Xi.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function $e(n){return ft(xe(r.auditScope,n))==="all"}function ja(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let v=n.safety?.level??"standard",W=rS(u),z=jd(v,W),B=Zi[z],X={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},Q={failClosed:z===v?"preset":"environment",paranoidRm:z===v?"preset":"environment",paranoidInterpreters:z===v?"preset":"environment"},le={failClosed:[`policy safety.level=${v}`],paranoidRm:[`policy safety.level=${v}`],paranoidInterpreters:[`policy safety.level=${v}`]};if(z!==v)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)X.failClosed=n.safety.overrides.failClosed,Q.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)X.paranoidRm=n.safety.overrides.paranoidRm,Q.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)X.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,Q.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))X.failClosed=!0,Q.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))X.paranoidRm=!0,X.paranoidInterpreters=!0,Q.paranoidRm="environment",Q.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))X.paranoidRm=!0,Q.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))X.paranoidInterpreters=!0,Q.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:X.failClosed,paranoidRm:X.paranoidRm,paranoidInterpreters:X.paranoidInterpreters,worktreeMode:ue,effectiveLevel:ja(X),capabilities:{fail_closed:{enabled:X.failClosed,source:Q.failClosed,sources:le.failClosed},paranoid_rm:{enabled:X.paranoidRm,source:Q.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:X.paranoidInterpreters,source:Q.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let v=typeof n==="string"?ei(n,u):xe(n,u);return v==="1"||v?.toLowerCase()==="true"}function ei(n,u){return u.get(n)}function xe(n,u){let v=ei(n.name,u);if(v!==void 0)return v;if(n.legacyName)return ei(n.legacyName,u);return}function At(n,u){return ei(n.name,u)!==void 0||!!n.legacyName&&ei(n.legacyName,u)!==void 0}import{types as oS}from"node:util";var iS=new Set(["applypatch","patch"]),sS=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),aS=new Set(["grep","grepsearch","rg"]),lS=new Set(["find","findbyname","glob"]),cS=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),dS=new Set(["command","diff","input","patch","patchtext"]),Kd=new TextEncoder,uS=new TextDecoder,mS=/\s/,fS=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var ti=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function je(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function Ji(n){return cS.has(je(n))}function b(n){let u=je(n);if(iS.has(u))return"patch";if(aS.has(u))return"grep";if(lS.has(u))return"glob";if(sS.has(u))return"path";return"unknown"}function de(n){if(!n||typeof n!=="object")return;iu(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)nr();return}if(u.get||u.set)nr();let v=u.value;return typeof v==="string"&&v!==""?v:void 0}function Jd(n,u){return eu(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function eu(n,u,v,W,z){let B=ou(n,W,z);if(typeof n==="string")return v?[n]:[];if(!B)return[];let X=B.entries.flatMap(([Q,le])=>eu(le,u,B.array?v:u.has(tu(Q)),W,z+1));return W.ancestors.delete(B.object),X}function tu(n){return n.replace(/-/g,"_").toLowerCase()}function nu(n){return ru(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(gS)}function ru(n,u,v,W){let z=ou(n,v,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([X,Q])=>ru(Q,z.array?u:dS.has(tu(X)),v,W+1));return v.ancestors.delete(z.object),B}function pS(n,u,v){if(u.nodes++,n!==null&&typeof n==="object"&&v>ti.maxDepth||u.nodes>ti.maxNodes)nr();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>ti.maxStringBytes||u.stringBytes>ti.maxAggregateStringBytes)nr()}function ou(n,u,v){if(pS(n,u,v),!n||typeof n!=="object")return null;let W=iu(n);if(u.ancestors.has(n))nr();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>ti.maxKeys)nr();let B=z.flatMap((X)=>{let Q=Object.getOwnPropertyDescriptor(n,X);if(!Q||Q.get||Q.set)nr();return typeof X==="string"&&Q.enumerable?[[X,Q.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function iu(n){if(oS.isProxy(n))nr();let u=Array.isArray(n),v=Object.getPrototypeOf(n);if(u&&v!==Array.prototype||!u&&v!==Object.prototype&&v!==null)nr();return u}function nr(){throw new h}function gS(n){let u=[],v=n.split(/\r?\n/),W=!1,z=!1,B=null,X=null,Q=()=>{z=!1,B=null,X=null};for(let le=0;le<v.length;le++){let ue=v[le]??"";if(ue==="*** Begin Patch"){W=!0,Q();continue}if(ue==="*** End Patch"){W=!1,Q();continue}if(ue.startsWith("@@")){let be=hS(ue);if(z=!0,B=be?.oldLines??null,X=be?.newLines??null,B===0&&X===0)Q();continue}if(z&&B!==null&&X!==null){let be=ue.startsWith(" ")||ue.startsWith("-")?1:0,Me=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-be),X=Math.max(0,X-Me),B===0&&X===0)Q();continue}if(ue.startsWith("*** ")){Q(),u.push(...Va(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...Va(ue));continue}if(ue.startsWith("--- ")){let be=v[le+1]??"";if(!be.startsWith("+++ "))continue;u.push(...Ka(Qi(ue.slice(4),!0),Qi(be.slice(4),!0))),le++;continue}if(!W)u.push(...Va(ue))}return u}function hS(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function Va(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return Qd(u[1]);let v=/^\*\*\* Move to: (.+)$/.exec(n);if(v?.[1])return Qd(v[1]);if(n.startsWith("diff --git "))return yS(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return Xd(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return Xd(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return _S(B[1]);return[]}function yS(n){let u=SS(n);if(u.length===2&&u[0]&&u[1])return Ka(u[0],u[1]);let v=CS(n);return v?Ka(n.slice(v.oldStart,v.oldEnd),n.slice(v.newStart,v.newEnd)):[]}function SS(n){let u=[],v=0;while(v<n.length&&u.length<2){while(Fr(n[v]))v++;if(v>=n.length)break;let W=n[v]==='"'||n[v]==="'"?n[v]:void 0;if(!W){let B=v;while(v<n.length&&!Fr(n[v]))v++;u.push(n.slice(B,v));continue}let z=su(n,v,W);if(!z)return[];u.push(z.value),v=z.end}while(Fr(n[v]))v++;return v===n.length?u:[]}function CS(n){let u=0;while(u<n.length&&Fr(n[u]))u++;let v=n.length;while(v>u&&Fr(n[v-1]))v--;let W=0,z=u;while(z<v){if(!Fr(n[z])){z++;continue}let B=z;while(z<v&&Fr(n[z]))z++;if(B===u||z===v)continue;if(W++,W>fS)nr();if(bS(n,u,B,z,v))return{oldStart:u,oldEnd:B,newStart:z,newEnd:v}}return null}function bS(n,u,v,W,z){if(qa(n,u,v,W,z))return!0;let B=Yd(n,"/",u,v),X=Yd(n,"/",W,z);if(B<=u||X<=W)return!1;if(qa(n,u,B,W,X))return!1;return qa(n,B+1,v,X+1,z)}function qa(n,u,v,W,z){if(v-u!==z-W)return!1;for(let B=0;B<v-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function Yd(n,u,v,W){for(let z=v;z<W;z++)if(n[z]===u)return z;return-1}function Fr(n){return n!==void 0&&mS.test(n)}function su(n,u,v){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===v)return{value:uS.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||v==="'"){W.push(...Kd.encode(B)),z+=B.length;continue}let X=n.slice(z+1),Q=/^[0-7]{1,3}/.exec(X)?.[0];if(Q){W.push(Number.parseInt(Q,8)),z+=Q.length+1;continue}W.push(...Kd.encode(vS(X[0]??""))),z+=2}return null}function vS(n){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n}function ES(n){return ni(xS(n))}function Ka(n,u){if(n==="/dev/null")return Zd(u);if(u==="/dev/null")return Zd(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(ni);let v=RS(n,u)??(n===u?au(n):null);return[n,u,...v?[v]:[]].flatMap(ni)}function Zd(n){let u=au(n);return[n,...u?[u]:[]].flatMap(ni)}function au(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function RS(n,u){let v=n.indexOf("/"),W=u.indexOf("/");if(v<1||W<1)return null;if(n.slice(0,v)===u.slice(0,W))return null;let z=n.slice(v+1);return z===u.slice(W+1)?z:null}function Xd(n){return ES(Qi(n,!0))}function _S(n){return ni(Qi(n,!1))}function Qi(n,u){let v=n.trim(),W=v[0]==='"'||v[0]==="'"?v[0]:void 0;if(W){let z=su(v,0,W);if(z&&(u||v.slice(z.end).trim()===""))return z.value}return u?v.split("\t",1)[0]?.trim()??"":v}function xS(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function ni(n){return n===""||n==="/dev/null"?[]:[n]}function Qd(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}import{accessSync as wS,constants as lu,statSync as AS}from"node:fs";import{isAbsolute as Ya,relative as PS,resolve as cu,sep as TS}from"node:path";function Se(n){try{if(!AS(n).isDirectory())return!1;return wS(n,lu.R_OK|lu.X_OK),!0}catch{return!1}}function It(n,u,v){if(cr(n))return;let W=u.flatMap((B)=>es(B,v));if(!W[0])return;let z=es(Ya(n)?n:cu(W[0],n),v)[0];if(!z)return;return W.some((B)=>IS(z,B))?z:void 0}function du(n,u,v){if(cr(n))return;return es(Ya(n)?n:cu(u,n),v)[0]}function mt(n,u){return n.flatMap((v)=>es(v,u))[0]}function es(n,u){let v=u.realpath(n);if(v===null)return[];return u.isDirectory(v)?[v]:[]}function IS(n,u){let v=PS(u,n);return v===""||v!==".."&&!v.startsWith(`..${TS}`)&&!Ya(v)}var kS=8388608;async function gt(n){let u=[],v=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(v+=z.byteLength,v>kS)throw OS(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,v).toString("utf-8")}function OS(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,v,W,z){if(v.kind!=="command")return{toolName:n,input:u,route:v,context:W};return{toolName:n,input:u,route:v,context:W,command:z}}import{dirname as Ur}from"node:path";import{closeSync as MS,constants as ri,fstatSync as Za,fsyncSync as DS,lstatSync as Wn,mkdirSync as uu,openSync as mu,readdirSync as Qa,readFileSync as NS,realpathSync as So,renameSync as LS,rmdirSync as fu,statSync as Xa,unlinkSync as Ja,writeFileSync as WS}from"node:fs";import{isAbsolute as pu,join as Gr,normalize as FS,parse as ts,relative as el,resolve as tl,sep as ns}from"node:path";function qe(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var GS=Symbol("PolicyFilesystemScope"),zS=Symbol("PolicyFilesystemTarget"),gu=ri.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[GS]:!0,root:tl(n),label:u}}function oi(n,u){let v=FS(u);if(u===""||pu(u)||v===".."||v.startsWith(`..${ns}`))throw new i(n.label);return{[zS]:!0,scope:n,relativePath:v,path:Gr(n.root,v)}}function s(n,u){return oi(n,el(n.root,tl(u)))}function pe(n,u="rules policy"){let v=tl(n),W=ts(v).dir;return oi(R(W,u),el(W,v))}function o(n){return dr(n.scope.label,()=>{if(!un(n))return null;let u=mu(n.path,ri.O_RDONLY|gu);return yu(u,()=>{let v=Za(u);if(!v.isFile())throw new i(n.scope.label);let W=NS(u,"utf-8"),z=Wn(n.path);if(!z.isFile()||z.isSymbolicLink()||v.dev!==z.dev||v.ino!==z.ino)throw new i(n.scope.label);return un(n),W})})}function x(n,u,v=384,W){let z=`${n.path}.${qe()}.tmp`;dr(n.scope.label,()=>{BS(n),un(n);let B=mu(z,ri.O_CREAT|ri.O_EXCL|ri.O_WRONLY|gu,v),X=yu(B,()=>{let Q=Za(B);if(!Q.isFile())throw new i(n.scope.label);WS(B,u,"utf-8"),DS(B);let le=Za(B);if(!le.isFile()||le.dev!==Q.dev||le.ino!==Q.ino)throw new i(n.scope.label);return le});un(n),HS(n,z,X.dev,X.ino),LS(z,n.path),W?.(n.path),un(n)},()=>jS(z))}function hu(n,u){if(n.path===u.path)return!0;return dr(n.scope.label,()=>{if(!un(n)||!un(u))return!1;let v=(W)=>Gr(So(ts(W).dir),ts(W).base);return v(n.path)===v(u.path)})}function we(n){let u=dr(n.scope.label,()=>{if(!un(n,"directory"))return null;let v=Qa(n.path);return un(n,"directory"),v});if(!u)return null;return dr(n.scope.label,()=>{let v=u.map((W)=>{let z=oi(n.scope,Gr(n.relativePath,W)),B=Wn(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return rs(nl(n.scope),So(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return un(n,"directory"),v})}function q(n){dr(n.scope.label,()=>{if(!un(n))return;Ja(n.path),un(n)})}function Ot(n){dr(n.scope.label,()=>{if(!$S(n))return;Cu(n),un(n,"directory")})}function Dt(n){dr(n.scope.label,()=>{if(!un(n,"directory"))return;fu(n.path),un(n,"directory")})}function $S(n){return dr(n.scope.label,()=>{if(!un(n,"directory"))return!1;return Su(n),!0})}function dr(n,u,v){try{return u()}catch(W){if(v?.(),W instanceof i)throw W;throw new i(n)}}function yu(n,u){try{return u()}finally{MS(n)}}function un(n,u="file"){let v=bu(n.scope);if(!v)return!1;let W=n.relativePath.split(ns);for(let z of W.keys()){let B=Gr(n.scope.root,...W.slice(0,z+1)),X=Wn(B,{throwIfNoEntry:!1});if(!X)return!1;if(X.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!X.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!X.isFile():!X.isDirectory()))throw new i(n.scope.label);rs(v,So(B),n.scope.label)}return!0}function Su(n){for(let u of Qa(n.path)){let v=oi(n.scope,Gr(n.relativePath,u)),W=Wn(v.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())Su(v)}un(n,"directory")}function Cu(n){for(let u of Qa(n.path)){let v=oi(n.scope,Gr(n.relativePath,u)),W=Wn(v.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){Cu(v);continue}if(!W.isFile())throw new i(n.scope.label);Ja(v.path)}fu(n.path)}function BS(n){US(n.scope);let u=nl(n.scope),v=n.relativePath.split(ns).slice(0,-1);for(let W of v.keys()){let z=Gr(n.scope.root,...v.slice(0,W+1));if(!Wn(z,{throwIfNoEntry:!1}))uu(z,{mode:448});let B=Wn(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);rs(u,So(z),n.scope.label)}}function US(n){if(Wn(n.root,{throwIfNoEntry:!1})){if(!Xa(n.root).isDirectory())throw new i(n.label);return}let u=[],v=n.root;while(!Wn(v,{throwIfNoEntry:!1})){u.unshift(v);let W=ts(v).dir;if(W===v)throw new i(n.label);v=W}if(!Xa(v).isDirectory())throw new i(n.label);for(let W of u){uu(W,{mode:448});let z=Wn(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function bu(n){if(!Wn(n.root,{throwIfNoEntry:!1}))return null;if(!Xa(n.root).isDirectory())throw new i(n.label);return So(n.root)}function nl(n){let u=bu(n);if(!u)throw new i(n.label);return u}function HS(n,u,v,W){let z=Wn(u);if(!z.isFile()||z.isSymbolicLink()||z.dev!==v||z.ino!==W)throw new i(n.scope.label);rs(nl(n.scope),So(u),n.scope.label)}function rs(n,u,v){let W=el(n,u);if(W===".."||W.startsWith(`..${ns}`)||pu(W))throw new i(v)}function jS(n){try{Ja(n)}catch{}}import{dirname as zr,isAbsolute as ZS,join as $r,relative as XS,resolve as Rr,sep as QS}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ce="rulebook.json",Ee=".cc-safety-net/rules";var vu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,VS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,Eu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,qS=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),KS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Nt=new RegExp(`^${qS}/(${m.source.slice(1,-1)})/${KS}$`);function YS(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function Ru(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(vu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let v=u[3].lastIndexOf("/");if(v<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,v),z=u[3].slice(v+1);if(!W||!Eu.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:YS(z),name:z}}function re(n){return VS.test(n)}function fe(n){return Eu.test(n)}function T(n){return vu.test(n)}function Lt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var _u="rule.json",os="policy.json",xu=".cc-safety-net",JS="rules",eC="CC_SAFETY_NET_HOME",wu="`cc-safety-net rule update`";function tC(n){return Rr(n,Ee)}function D(n){return $r(tC(n),_u)}function S(n){return $r(Rr(n),xu,os)}function me(n,u={}){return u.userConfigDir??(u.userConfigPath?zr(u.userConfigPath):$r(nC(n),JS))}function nC(n){let u=n.env.get(eC);return u?Rr(gn(u)):$r(n.home,xu)}function K(n,u={}){return $r(me(n,u),_u)}function p(n,u={}){return $r(zr(me(n,u)),os)}function L(n,u){let v=Rn();return Ut(S(u.cwd),n.paths,v)===Ut(Rr(p(n,u)),n.paths,v)}function oe(n,u){let v=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=ht(n,u),B=yt(W,u.cwd);return{userConfigPath:v,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,v),projectConfigTarget:s(B,W)}}function ht(n,u){let v=u.userConfigPath?zr(zr(Rr(u.userConfigPath))):zr(Rr(u.userConfigDir??me(n,u)));return R(v,"user policy")}function yt(n,u){let v=Rr(u),W=Rr(n),z=XS(v,W);if(z!==".."&&!z.startsWith(`..${QS}`)&&!ZS(z))return R(v,"project policy");return R(zr(zr(W)),"project policy")}function U(n,u){return $r(n,u,Ce)}var kn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,Jt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Au=new Set(["python","python3","python2","node","ruby","perl"]),is=/^python(?:[23](?:\.\d+)*)?$/,Fn=new Set(["awk","gawk","nawk","mawk"]),ss=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]),as=new Set(["curl","wget","aria2c","http","https","xh","xhs","httpie","fetch","lwp-request","nc","ncat","netcat","socat","telnet"]);var Pu="Rulebook exceeds CC Safety Net's safe validation limits.",Tu="Additional rulebook validation errors were omitted.",Vn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Iu(n){if(rl(n.allowed_commands,Vn.maxAllowedCommands)||rl(n.rules,Vn.maxRules)||rl(n.tests,Vn.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:v}=Vn,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>Vn.maxStringCodeUnits||B&&z.length>Vn.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let X=B.match&&typeof B.match==="object"?B.match:{};for(let Q of[B.block_args,X.command_path,X.any_args,X.exclude_args]){if(!Array.isArray(Q))continue;if(Q.length>Vn.maxBlockArgsPerRule||Q.length>v)return!1;v-=Q.length;for(let le of Q)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function rl(n,u){return Array.isArray(n)&&n.length>u}var ol=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ke=64,Re="Rule config exceeds CC Safety Net's safe source limit.";function $t(n){return Wt(n).toLowerCase()}function Wt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function _n(n,u){let v=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let X=z[B];if(!X||!/[a-zA-Z]/.test(X))break;let Q=`-${X}`;if(v.add(Q),u?.shortOptsWithValue?.has(Q))break}}return v}var rC={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},il=new Set(["--init-file","--rcfile"]);function sl(n,u,v,W){let z=!1,B=0,X=!1,Q=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let be=u.slice(le+1);if(u[0]==="-"&&(be==="c"||be[0]==="-"&&be.endsWith("c")))X=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(v?.startsWith("-")||v?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")X=!0;if(W==="argv"&&ue==="s")Q=u[0]==="-";if(!rC[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:X,stdinMode:Q}}function xn(n){let u=Wt(n[0]??"").toLowerCase(),v=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let Q=v&&n[z+1]!==void 0?z+1:null;return{command:Q===null?null:n[Q]??null,commandIndex:Q,scriptIndex:!v&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!v&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:v?B:null,commandIndex:v?z:null,scriptIndex:!v&&!W&&B!=="-"?z:null,readsStdinAsCommands:!v&&(W||B==="-")};if(B.startsWith("--")){let Q=B.split("=",1)[0]??B;if(u==="bash"&&il.has(Q)&&!B.includes("="))z++;continue}let X=sl(u,B,n[z+1],"argv");if(X.commandSelected)v=!0;if(X.stdinMode)W=!0;z+=X.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!v}}function ii(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function ls(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let v of oC(n))ii(v,u);return u.inSingle||u.inDouble}function oC(n){let u="",v={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let X=n[B];if(!X)break;if(W){if(X===`
-`||X==="\r")u+=X,W=!1,v.escaped=!1;continue}if(X==="#"&&!v.inSingle&&!v.inDouble&&z){W=!0;continue}if(u+=X,!v.inSingle&&!v.inDouble&&!v.escaped)z=/[\s;&|()<>]/.test(X);ii(X,v)}return u}var al=new Set(["rm","find","rsync","xargs","parallel"]),iC=new Set(["git","busybox",...al,...Jt,...Au,...Fn]),sC=new Set(["python","node","ruby","perl"]);function Ke(n){let u=$t(n);return iC.has(u)||On(u)}function On(n){return sC.has(aC(n))}function aC(n){let u=Wt(n).toLowerCase();return is.test(u)?"python":u}var ge={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(lC(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let v=JSON.parse(u),W=vt(v);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:v.rules??[],overrides:v.overrides??{},transparent_wrappers:v.transparent_wrappers??[],...v.command_tools?{command_tools:v.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let v=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":v]}}}function lC(n){return typeof n==="string"?pe(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),an=(n,u)=>({path:n,message:u,kind:"custom"});function Je(n){let u=new Set;return n.flatMap((v,W)=>{let z=Br(v)?v.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[an(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var Ue=`must be one of ${ol.join(", ")}`,cC=/^[^/]+\/[^/]+$/,dC=["version","rules","overrides","transparent_wrappers","command_tools"],Ye=/^[^\s\p{Cc}]{1,256}$/u,Te="non-empty, at most 256 characters, no whitespace or control characters";function vt(n){let u=uC(n);return{errors:he(bt(u,dC,(v)=>v.kind==="custom"),": "," "),sources:bC(n,u)}}function uC(n){if(!Br(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>ke;return[...n.version===1?[]:[e(["version"],"must be 1")],...mC(n.rules,u),...gC(n.overrides),...yC(n.transparent_wrappers),...u?[]:pC(n.rules),...Br(n.overrides)?Object.keys(n.overrides).filter((v)=>!cC.test(v)).map((v)=>an(["overrides",v],"must use <rulebook-name>/<rule-name>")):[],...SC(n.transparent_wrappers),...CC(n.command_tools)]}function mC(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...ku(n,ke)?[e(["rules"],Re)]:[]];if(u)return[{path:["rules"],message:Re,kind:"limit"}];return n.flatMap((v,W)=>{if(typeof v!=="string")return[e(["rules",W],"must be a rulebook source string"),...fC(v,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return v===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function ku(n,u){let v=Ou(n);return v!==void 0&&!(v<=u)}function fC(n,u){let v=Ou(n);return v!==void 0&&!(v>=u)}function Ou(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function pC(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||v==="")return[];if(v.trim()==="")return[an(["rules",W],"must be a non-empty rulebook source string")];let z=Ru(v);if(z)return[an(["rules",W],z)];if(u.has(v))return[an(["rules",W],`duplicate rulebook source "${v}"`)];return u.add(v),[]})}function gC(n){if(n===void 0)return[];if(!Br(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let v=n[u];if(v==="off")return[];if(!Br(v))return[e(["overrides",u],'must be "off" or an object')];return[...hC(v.reason,["overrides",u,"reason"]),...v.intent===void 0||He(v.intent)?[]:[e(["overrides",u,"intent"],Ue)]]})}function hC(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...ku(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function yC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,v)=>{if(typeof u!=="string")return[e(["transparent_wrappers",v],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",v],"must match command pattern")]})}function SC(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[an(["transparent_wrappers",W],`duplicate command "${v}"`)];if(Ke(v))return[an(["transparent_wrappers",W],`reserved command "${v}" cannot be a wrapper`)];return u.add(v),[]})}function CC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,v=(W,z)=>{if(u.has(W))return[an(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return ll(W)?v(W,z):[e(["command_tools",z],`must be a tool name: ${Te}`)];if(!Br(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...ll(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Te}`)],...W.cwd===void 0||ll(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name: ${Te}`)]];return B.length>0?B:v(W.name,z)})}function ll(n){return typeof n==="string"&&Ye.test(n)}function bC(n,u){let v=Br(n)?n.rules:void 0;if(!Array.isArray(v))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(v.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function bt(n,u,v){let W=n.map((X)=>X.path[1]),z=[...new Set(W.filter((X)=>typeof X==="string"))],B=(X,Q)=>[X.path.length===0?-1:u.indexOf(String(X.path[0])),typeof Q==="number"?Q:z.indexOf(String(Q)),v(X)?0:1];return n.map((X,Q)=>({issue:X,rank:B(X,W[Q])})).sort((X,Q)=>X.rank[0]-Q.rank[0]||X.rank[1]-Q.rank[1]||X.rank[2]-Q.rank[2]).map((X)=>X.issue)}function he(n,u,v){return[...new Set(n.map((W)=>{let z=cl(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?v:u}${W.message}`}))]}function cl(n){return n.map((u,v)=>{if(typeof u==="number")return`[${u}]`;return v===0?String(u):`.${String(u)}`}).join("")}function He(n){return ol.includes(n)}function Br(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ye(n){let u=RC(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var vC=`required non-empty string up to ${M} characters`,Mu="must be a non-empty array of unique non-empty strings",EC="required non-empty array of non-empty strings";function RC(n){if(!_r(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Iu(n))return{errors:[Pu],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...he(_C(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>Vn.maxValidationErrors?[...u.slice(0,Vn.maxValidationErrors),Tu]:u,ruleNames:new Set(Ze(n).map((v)=>v.toLowerCase()))}}function Ze(n){let u=_r(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((v)=>{let W=_r(v)?v.name:void 0;return typeof W==="string"?[W]:[]})}function _C(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],...xC(n.allowed_commands),...wC(n.rules,u),...IC(n.tests),...kC(n),...OC(n)]}function xC(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((v,W)=>typeof v==="string"&&P.test(v)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[an(["allowed_commands",W],`duplicate command "${v}"`)];return u.add(v),[]})]}function wC(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((v,W)=>{if(!_r(v))return[e(["rules",W],"must be an object")];return u?PC(v,["rules",W]):AC(v,["rules",W])}),...Je(n)]}function AC(n,u){return[...Du(n.name,u),...Nu(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...cs(n.block_args,[...u,"block_args"],"required non-empty array",!1),...Lu(n.reason,u),...Wu(n.intent,u)]}function PC(n,u){return[...Du(n.name,u),...Nu(n.command,u),...Lu(n.reason,u),...Wu(n.intent,u),...TC(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function Du(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function Nu(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function Lu(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],vC)]}function Wu(n,u){return n===void 0||He(n)?[]:[e([...u,"intent"],Ue)]}function TC(n,u){if(!_r(n))return[e(u,"required object")];return[...cs(n.command_path,[...u,"command_path"],EC,!1),...n.any_args===void 0?[]:cs(n.any_args,[...u,"any_args"],Mu,!0),...n.exclude_args===void 0?[]:cs(n.exclude_args,[...u,"exclude_args"],Mu,!0)]}function cs(n,u,v,W){if(!Array.isArray(n))return[e(u,v)];let z=n.flatMap((B,X)=>{if(typeof B!=="string")return[e([...u,X],"must be a non-empty string")];return B===""?[an([...u,X],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[an(u,v)]:[],...W&&new Set(n).size!==n.length?[an(u,"must not contain duplicate values")]:[]]}function IC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,v)=>{if(!_r(u))return[e(["tests",v],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",v,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",v,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",v,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[an(["tests",v,"rule"],"required string for blocked fixtures")]:[]]})}function kC(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ze(n));return[...new Set(n.tests.flatMap((v)=>_r(v)&&v.expect==="blocked"&&typeof v.rule==="string"?[v.rule]:[]))].filter((v)=>!u.has(v)).map((v)=>an(["tests"],`blocked fixture references unknown rule "${v}"`))}function OC(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((v)=>typeof v==="string"));return n.rules.flatMap((v,W)=>{let z=_r(v)?v.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[an(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function _r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ie(n,u){let v=oe(n,u),W;try{W=hu(v.userConfigTarget,v.projectConfigTarget)}catch(Oe){if(Oe instanceof i)return BC(v,Oe.message);throw Oe}let z=f(v.userConfigTarget),B=W?{config:null,errors:[]}:f(v.projectConfigTarget),X=zu(v.userConfigPath,z.errors),Q=zu(v.projectConfigPath,B.errors),le=new Set,ue=z.config?dl(z.config,Ur(v.userConfigPath),"user",v.userScope,le):$u(),be=B.config?dl(B.config,Ur(v.projectConfigPath),"project",v.projectScope,le):$u(),Me=z.config?.overrides??{},De=B.config?.overrides??{};return{rules:[...Gu(ue.rules,Me),...Gu(be.rules,De)],transparent_wrappers:GC(z.config,B.config),command_tools:zC(z.config,B.config),rulebooks:[...ue.rulebooks,...be.rulebooks],errors:[...X,...Q,...ue.errors,...be.errors],warnings:[...ue.warnings,...be.warnings,...ue.canValidateOverrides?ul(Me,ue.knownRuleIds,v.userConfigPath):[],...ue.canValidateOverrides?$C(De,ue.knownRuleIds,v.projectConfigPath):[],...be.canValidateOverrides?ul(De,be.knownRuleIds,v.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...v}}function J(n,u){let v=MC(n,u);if(!v)return[];return[...v.scope.errors,...v.scope.warnings,...DC(v.config,v.scope,n)]}function MC(n,u){let v=u??R(Ur(Ur(n)),"rules policy"),W=f(s(v,n)).config;if(!W)return null;return{config:W,scope:dl(W,Ur(n),"project",v)}}function DC(n,u,v){return u.canValidateOverrides?ul(n.overrides??{},u.knownRuleIds,v):[]}function dl(n,u,v,W=R(Ur(Ur(u)),v==="user"?"user policy":"project policy"),z=new Set){let B=[],X=[],Q=n.rules.flatMap((ue)=>{let be=LC(ue,u,W);if(be.errors.length>0||!be.rulebook)return B.push(...be.errors),[];let Me=be.rulebook;if(z.has(Me.name))return X.push(`duplicate active rulebook name "${Me.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(Me.name),[{rules:NC(Me),rulebook:{source:v,spec:ue,name:Me.name,version:Me.version,rules:Me.rules.map((De)=>`${Me.name}/${De.name}`)}}]}),le=Q.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:Q.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:X,canValidateOverrides:B.length===0}}function NC(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function LC(n,u,v){let W=Xe(n),z=U(u,W),B=FC(z,v);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${WC(n)}`]};let X=Pe(B.content);if("problem"in X)return{rulebook:null,errors:[`invalid rulebook ${z}: ${X.problem}; fix that file`]};if(X.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${X.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:X.rulebook,errors:[]}}function Xe(n){return T(n)?j(n).name:n}function WC(n){return T(n)?`run ${wu} to vendor ${n}`:"create that file or remove that source from the rules config"}function FC(n,u){try{return{content:o(s(u,n))}}catch(v){if(v instanceof i)return{error:v.message};throw v}}function Pe(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ye(u)}}catch(v){return{problem:v instanceof Error?v.message:"invalid rulebook"}}}function GC(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function zC(n,u){let v=(n?.command_tools??[]).map(Fu),W=(u?.command_tools??[]).map(Fu);return[...v,...W.filter((z)=>!v.some((B)=>B.name===z.name))]}function Fu(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function Gu(n,u){return n.flatMap((v)=>{let W=u[v.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...v,intent:W.intent??v.intent,reason:W.reason}];return[v]})}function ul(n,u,v){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${v}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function $C(n,u,v){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${v}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function zu(n,u){return u.map((v)=>v.startsWith("Unable to access ")?v:`${n}: ${v}`)}function BC(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function $u(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as JC,readFileSync as eb}from"node:fs";var Bu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"network.cloud-metadata",category:"Network",label:"Cloud metadata endpoint",description:"Blocks HTTP clients, raw socket tools, and code interpreters naming a cloud metadata host (169.254.169.254, fd00:ec2::254, 169.254.170.2, 169.254.170.23, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200).",example:"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",intent:"manual_only"},{id:"network.upload-remote",category:"Network",label:"Data upload to a remote host",description:"Blocks curl and wget requests that send a body or upload a file unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]).",example:"curl -T backup.tar https://uploads.example.com/",intent:"manual_only"},{id:"unshare.user-namespace",category:"Execution",label:"unshare user namespace",description:"Blocks unshare creating a user namespace: -U/--user, -r/--map-root-user, -c/--map-current-user, --map-user(s), --map-group(s), or --map-auto.",example:"unshare -r id",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ml=new Set(Bu.map((n)=>n.id)),Y=Bu,UC=new Map(Y.map((n)=>[n.id,n.intent]));function at(n,u){return{id:n,reason:u,intent:UC.get(n)??"manual_only"}}var fl=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],ds={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},HC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],jC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],pl=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...jC.flatMap((n)=>HC.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var us=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Uu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],VC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],gl=Uu.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),hl=Uu.flatMap((n)=>VC.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),si={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},yl=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),Sl=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...fl,ds,...pl,...gl,...hl,si,...yl,...Sl,...us].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),ms=new Set(us.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),Cl=new Set(xt.map((n)=>n.id));import{isAbsolute as bl,join as qC,normalize as KC,sep as fs}from"node:path";var ps=process.platform==="win32",Hu=/[*?]/;function vl(n){let u=n.trim(),v=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(ps?u.replaceAll("\\","/"):u);if(!v)return null;let W=v[1]??"",z=v[2]??"";if(Hu.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function ai(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function El(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let v=ai(n.trim(),u);if(!bl(v))return"must be an absolute path or start with ~/";return li(v,u)}function Rl(n,u){let v=ju(n,u);if(v===null)return"must be a non-empty path string";if(!bl(v))return null;if(li(v,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var YC="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ZC="cannot cover the guard's own configuration";function ju(n,u){if(typeof n!=="string"||n.trim()==="")return null;let v=n.trim(),W=ps?v.replaceAll("\\","/"):v;return ai(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function _l(n,u){let v=ju(n,u);if(v===null)return"must be a non-empty path string";let W=vl(v)?.root??v;if(Hu.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bl(W))return null;if(li(W,u)!==null)return YC;return XC(W,u)?ZC:null}function XC(n,u){let v=gs(n),W=gs(qC(u,".cc-safety-net"));return v===W||v.startsWith(`${W}${fs}`)}function li(n,u){let v=gs(n),W=gs(u);if(v===W)return"cannot be the home directory";let z=v.endsWith(fs)?v:`${v}${fs}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function gs(n){let u=KC(n);if(ps)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(ps?3:1)&&u.endsWith(fs))u=u.slice(0,-1);return u}var Vu=30,hs=1,ys=365;function qu(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Ku=new Set(Y.filter((n)=>n.catastrophic).map((n)=>n.id));function Ft(n,u){if(!n)return null;if(Ku.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let v=u?.effectiveDestructiveCommandRules[n.id];return v&&!v.enabled?null:n}function ln(n,u,v){if(Ku.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??v}function Z(n,u){return Object.freeze(Object.fromEntries(Y.map((v)=>{let W=v.activationCapability?u[v.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[v.id],X=v.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...v.activationCapability?{activationCapability:v.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...v.activationCapability?{activationCapability:v.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...v.activationCapability?{activationCapability:v.activationCapability}:{},...B?{override:B}:{}};return[v.id,Object.freeze(X)]})))}function Yu(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:Z(n,u)})}var Zu={standard:0,strict:1,paranoid:2};function se(n,u,v=!1,W=n.safety.level){let z=QC(n,u,W),B=new Set(v?z.map((be)=>be.field):[]),X=(be,Me)=>B.has(be)?void 0:Me,Q=(be,Me)=>Object.fromEntries(Object.entries(Me??{}).filter(([De])=>!B.has(`${be}.${De}`))),le=(be,Me)=>Me?.filter((De)=>!B.has(`${be}.${De}`));return{policy:{version:1,safety:{level:X("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...Q("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:X("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:X("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...Q("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:xl(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:X("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...Q("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:xl(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:xl(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((be)=>be.message)}}function xl(n,u){return[...new Set([...n,...u??[]])]}function QC(n,u,v){let W=u.safety?.level,z=Zi[v];return[...W&&Zu[W]<Zu[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...yo.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...Xu("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...Xu("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!ms.has(B))),...n.destructive_command_protection.enabled?Qu(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?Qu(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function Xu(n,u,v){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&v(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function Qu(n,u){return(u??[]).filter((v)=>!n.includes(v))}var Al=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Vu}};function tm(n,u){let v=sb(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:et(S(u.cwd),n.home),z=ve(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),X=v.gui??ae,Q=Object.keys(z.policy).length>0?se(X,z.policy,B,qd(X.safety.level,n.env)):void 0,le=[...v.errors,...W.errors,...z.diagnostics],ue=(v.fallback==="defaults"&&Q?"salvaged":v.fallback)??(v.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),be=z.policy.safety?.level&&Q?.policy.safety.level===z.policy.safety.level?"project":v.levelPresent?"user":"default";return{...Q?ci(Q.policy):v.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:be,weakenings:Q?.weakenings??[],weakeningsIgnored:B}}:{}}}var tb="project policy audit settings are ignored; audit is user scope only";function ve(n,u){if(!Mn(n))return{policy:{},diagnostics:[]};let v=Mn(n.safety)?n.safety:{},W=Mn(n.workflow)?n.workflow:{},z=Mn(n.destructive_command_protection)?n.destructive_command_protection:{},B=Mn(n.secret_protection)?n.secret_protection:{},X={...Al.has(v.level)?{level:v.level}:{},...Mn(v.overrides)?Ju({overrides:nm(v.overrides,yo,["safety","overrides"],Hr)}):{}},Q={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:Ss(z.overrides,ml,om,Hr)}:{},...z.allow_paths!==void 0?{allow_paths:bo(z.allow_paths,El,u,["destructive_command_protection","allow_paths"],Hr)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:Ss(B.overrides,Cl,im,Hr)}:{},...B.deny_paths!==void 0?{deny_paths:bo(B.deny_paths,Rl,u,["secret_protection","deny_paths"],Hr)}:{},...B.allow_paths!==void 0?{allow_paths:bo(B.allow_paths,_l,u,["secret_protection","allow_paths"],Hr)}:{}};return{policy:Ju({safety:X,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:Q,secret_protection:le}),diagnostics:n.audit===void 0?[]:[tb]}}function nm(n,u,v,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...v,z],Pl));return[]}))}function Ju(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Hr=()=>{return},Pl="must be a boolean",Tl="must be an object if provided",rm=`must be an integer between ${hs} and ${ys}`,om={path:["destructive_command_protection","overrides"],label:"destructive command"},im={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let v=[];return{policy:sm(n,u,(z)=>{v.push(z)}),issues:v}}function _(n,u){return sm(n,u,Hr)}function sm(n,u,v){if(!Mn(n))return v(e([],"Config must be an object")),N();if(n.version!==1)v(e(["version"],"must be 1"));let W=Co(n.safety,["safety"],["level","overrides"],v),z=Co(W.overrides,["safety","overrides"],yo,v),B=Co(n.workflow,["workflow"],["worktree_mode"],v),X=Co(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],v),Q=Co(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],v),le=Co(n.audit,["audit"],["retention_days"],v);return am(n,St,[],v),{version:1,safety:{level:nb(W.level,v),overrides:nm(z,yo,["safety","overrides"],v)},workflow:{worktree_mode:wl(B.worktree_mode,["workflow","worktree_mode"],!1,v)},destructive_command_protection:{enabled:wl(X.enabled,["destructive_command_protection","enabled"],!0,v),overrides:Ss(X.overrides,ml,om,v),allow_paths:bo(X.allow_paths,El,u,["destructive_command_protection","allow_paths"],v)},secret_protection:{enabled:wl(Q.enabled,["secret_protection","enabled"],!0,v),overrides:Ss(Q.overrides,Cl,im,v),deny_paths:bo(Q.deny_paths,Rl,u,["secret_protection","deny_paths"],v),allow_paths:bo(Q.allow_paths,_l,u,["secret_protection","allow_paths"],v)},audit:{retention_days:rb(le.retention_days,v)}}}function Co(n,u,v,W){if(n===void 0)return{};if(!Mn(n))return W(e(u,Tl)),{};return am(n,v,u,W),n}function am(n,u,v,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:v,message:z,kind:"unknownKeys"})}function nb(n,u){if(n===void 0)return"standard";if(Al.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function wl(n,u,v,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,Pl));return v}function rb(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=hs&&n<=ys))u(e(["audit","retention_days"],rm));return qu(n)}function Ss(n,u,v,W){if(n===void 0)return{};if(!Mn(n))return W(e(v.path,Tl)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...v.path,z],message:`unknown ${v.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...v.path,z],'must be "on" or "off"')),[]}))}function bo(n,u,v,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,X)=>{let Q=u(B,v);if(Q===null)return[B];return z(typeof B==="string"?an([...W,X],Q):e([...W,X],Q)),[]})}function Mn(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Qe(n,u){let v=O({safety:tt(n.safety)},u),W=Z({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},v.capabilities),z=Object.values(W),B=z.filter((X)=>X.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:v.effectiveLevel,capabilities:v.capabilities,rules:W,counts:{enabled:B.filter((X)=>X.enabled).length,disabled:B.filter((X)=>!X.enabled).length,effectiveCustomizations:z.filter((X)=>X.changesInherited).length}}}function et(n,u){if(!JC(n))return{exists:!1,policy:N(),errors:[]};try{let v=eb(n,"utf-8");if(!v.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(v),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${ib(B)}`),fallback:Mn(W)?"salvaged":"defaults"}}catch(v){let W=v instanceof Error?v.message:String(v);return{exists:!0,policy:N(),errors:[`${n}: ${v instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var ob=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Tl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Pl,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[rm,`not an integer between ${hs} and ${ys}`]]);function ib(n){let u=cl(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let v=ob.get(n.message)??n.message;return u===""?v:`${u}: ${v}`}function sb(n,u){let v=et(n,u);if(!v.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Mn(W))return{policy:ci(N()),errors:[]};let z=_(W,u);return{policy:ci(z),gui:z,errors:[],levelPresent:em(W)}}if(v.parsed===void 0)return{policy:ci(N()),errors:v.errors,...v.fallback?{fallback:v.fallback}:{}};return{policy:ci(v.policy),gui:v.policy,errors:v.errors,...v.fallback?{fallback:v.fallback}:{},levelPresent:em(v.parsed)}}function em(n){let u=Mn(n)&&Mn(n.safety)?n.safety:{};return Al.has(u.level)}function Ct(n){let u=Object.entries(n),v=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...ms].filter((W)=>!v.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function ci(n){return{safety:tt(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function tt(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let v=ie(n,u),W=tm(n,u),z={rules:v.rules,transparentWrappers:v.transparent_wrappers,commandTools:v.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...v.userConfig?.overrides,...v.projectConfig?.overrides},X=Object.freeze(Object.fromEntries(z.rules.map((Q)=>{let le=v.rulebooks.find((be)=>be.rules.includes(Q.name)),ue=B[Q.name];return[Q.name,Object.freeze({id:Q.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...db(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return Ge(z,ab(v,W),X,W.policyScopes)}function nt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function ab(n,u){let v=cb(u);if(n.errors.length===0&&n.warnings.length===0&&!v)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:ub(n.errors.length>0?lb(n.errors):void 0,n.warnings.length>0?kl(n.warnings.join("; ")):void 0,v)}}function lb(n){return`${kl(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function cb(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function db(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function Ge(n,u,v=Object.freeze({}),W){let z=Il(structuredClone(n)),B=W?{policyScopes:Il(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:v,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:v,...B})}function Il(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))Il(u);return Object.freeze(n)}function ub(...n){return kl(n.filter((u)=>!!u).join("; "))}function kl(n){return/[.!?]$/.test(n)?n:`${n}.`}function _e(n){let u=n.effectiveCapabilities,v=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:Yu(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:ja({failClosed:v,paranoidRm:W,paranoidInterpreters:z}),strict:v,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as jP,isAbsolute as VP,join as ch,parse as qP,resolve as KP,sep as YP}from"node:path";function di(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let v=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[v]?.provenance;return W!==void 0&&W!=="literal"}var mb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Cs(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function ui(n){let u=Cs(n.words[0],"time")?1:0,v=u===1&&Cs(n.words[u],"-p")?u+1:u,W=u===1&&Cs(n.words[v],"--")?v+1:v,z=Cs(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((X)=>!mb.test(X.text));return B?.provenance==="literal"?B.text:void 0}var xr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function bs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function vs(n,u,v){n.push(v),u.reset()}function Es(n){let u=[];return{parts:u,push:(v,W,z)=>{if(W<=v)return;u.push({raw:n.slice(v,W),span:{start:v,end:W},provenance:z})}}}function Ol(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function vo(n,u,v,W,z,B,X){return Ol({text:W,raw:n.slice(u,v),span:{start:u,end:v},provenance:z,quoted:B,...X?{parts:X}:{}})}function Ml(n,u,v){if(u>=v||cm(n[u]??""))return null;let W="",z=!1,B=!1,X=u;while(X<v&&!cm(n[X]??"")){let Q=n[X]??"";if(Q==="'"){z=!0;let le=lm(n,X+1,v,"'");W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==='"'){z=!0;let le=lm(n,X+1,v,'"');W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==="\\"){z=!0;let le=n[X+1];if(!le||le===`
-`||le==="\r"){B=!0;break}W+=le,X+=2;continue}if(Q==="`"||n.startsWith("$(",X)||n.startsWith("${",X)||n.startsWith("<(",X)||n.startsWith(">(",X))B=!0;W+=Q,X++}return{delimiter:W,quoted:z,next:X,ambiguous:B}}function Dl(n,u,v,W){let z=[],B=u;for(let X of W){let Q=B,le=!1;while(B<v){let ue=fb(n,B,v);if((X.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===X.delimiter){X.attach({body:X.stripTabs?pb(n.slice(Q,B)):n.slice(Q,B),delimiter:X.delimiter,quotedDelimiter:X.quotedDelimiter,bodySpan:{start:Q,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${X.delimiter} was not found`}),{next:v,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function lm(n,u,v,W){let z="",B=u;while(B<v&&n[B]!==`
-`&&n[B]!=="\r"){let X=n[B]??"";if(X===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&X==="\\"&&n[B+1]){let Q=n[B+1]??"";z+=["$","`",'"',"\\"].includes(Q)?Q:`\\${Q}`,B+=2;continue}z+=X,B++}return{text:z,next:B,closed:!1}}function cm(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function fb(n,u,v){let W=u;while(W<v&&n[W]!==`
-`)W++;let z=W>=v?v:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function pb(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var pm=new Set(["&&","||","|","|&"]),gb=new Set(["!","do","elif","else","if","then","until","while"]);function gm(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=xs(n,0,n.length,u,W,0),B=[...z.issues,...xb(n,W.quotedExpansionEnd,z.nodes)?[Cm]:[],...Rb.test(n)?[Sm]:[]];return{kind:"program",dialect:"posix",source:n,span:v,status:As(B,z.limited),issues:B,nodes:z.nodes}}function xs(n,u,v,W,z,B,X){let Q=[],le=[],ue=bs(),be=[],Me=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Oe={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);vs(Q,ue,{kind:"command",dialect:"posix",source:n.slice(Oe.start,Oe.end),span:Oe,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&Q.length===0?n.slice(u,v):Ne.join(" ")})},De=u;while(De<v){let Oe=n[De];if(!Oe)break;if(X&&Oe===X)return Me(),fm(Q,le),{nodes:Q,issues:le,next:De+1,closed:!0,limited:!1,pendingHeredocs:be};if(fi(Oe)){if(Oe.charCodeAt(0)>127)le.push(Sm);if(Oe===`
-`||Oe==="\r"){Me();let Et=Oe==="\r"&&n[De+1]===`
-`?De+2:De+1,Rt=Q.at(-1);if(Rt?.kind!=="connector"||!pm.has(Rt.operator))Q.push({kind:"connector",operator:n.slice(De,Et),span:{start:De,end:Et}});if(be.length>0){let Tt=Dl(n,Et,v,be.splice(0));le.push(...Tt.issues),De=Tt.next;continue}De=Et;continue}De++;continue}if(Oe==="\\"&&n[De+1]===`
-`){De+=2;continue}if(Oe==="#"){while(De<v&&n[De]!==`
-`&&n[De]!=="\r")De++;continue}let Ne=ue.start===-1?Ub(n,De,v):void 0;if(Ne){if(Ll(Q,le),B>=W.maxDepth)return Eo(Q,le,De,"depth-limit",W.maxDepth);if(!Nl(z))return Eo(Q,le,De,"word-limit",W.maxWords);let Et=xs(n,Ne.braceIndex+1,v,W,z,B+1,"}"),Rt=Et.next,Tt={start:Ne.braceIndex+1,end:Et.closed?Rt-1:Rt},Be=dm(n,Tt,Et);if(Q.push({kind:"function",name:Ne.name,span:{start:De,end:Rt},body:Be}),le.push(...Et.issues),Et.pendingHeredocs.length>0||pi(Et.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(be.push(...Et.pendingHeredocs),Et.limited)return _s(Q,le,Et.next);if(!Et.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});De=Rt;continue}let Le=ws(n,De);if(Le){if(Me(),!wm(Q.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});Q.push({kind:"connector",operator:Le,span:{start:De,end:De+Le.length}}),De+=Le.length;continue}if(Oe===")"){Me(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Q.push({kind:"unknown",source:Oe,span:{start:De,end:De+1}}),De++;continue}if((Oe==="("||Oe==="{"&&Ib(n,De,v))&&ue.start===-1){if(Ll(Q,le),B>=W.maxDepth)return Eo(Q,le,De,"depth-limit",W.maxDepth);let Et=Oe==="("?")":"}",Rt=xs(n,De+1,v,W,z,B+1,Et),Tt=Rt.next,Be={start:De+1,end:Rt.closed?Tt-1:Tt},Gt=dm(n,Be,Rt);if(Q.push({kind:"group",style:Oe==="("?"subshell":"brace",span:{start:De,end:Tt},body:Gt}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||pi(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(be.push(...Rt.pendingHeredocs),Rt.limited)return _s(Q,le,Rt.next);if(!Rt.closed)le.push({code:Oe==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Oe} group is not closed`});De=Tt;continue}let We=(Oe==="<"||Oe===">")&&n[De+1]!=="("?Cb(n,De):null;if(We){let Et=ue.words.at(-1),Rt=Et&&Et.span.end===De&&/^[0-9]+$/.test(Et.raw)?Number(Et.raw):void 0;if(Rt!==void 0)ue.words.pop();let Tt=Rt===void 0?De:Et?.span.start??De;ue.start=ue.start===-1?De:ue.start;let Be=De+We.length;while(Be<v&&/[ \t]/.test(n[Be]??""))Be++;let Gt=n[Be],kt=Be>De+We.length&&Gt==="#",Qt=!Gt||fi(Gt)||!!ws(n,Be)||Gt===X||Gt===")"||kt||(Gt==="<"||Gt===">")&&n[Be+1]!=="(",In=We==="<<"||We==="<<-",Sn=In?Ml(n,Be,v):void 0,on=Sn?{word:vo(n,Be,Sn.next,Sn.delimiter,"literal",Sn.quoted),nested:[],issues:[],next:Sn.next,limited:!1}:!Qt?Wl(n,Be,v,W,z,B):void 0;if(on){if(le.push(...on.issues),on.limited)return _s(Q,le,on.next);if(!Nl(z))return Eo(Q,le,on.next,"word-limit",W.maxWords)}let jn=on?.next??De+We.length,tn={kind:"redirection",operator:We,span:{start:Tt,end:jn},...Rt===void 0?{}:{fd:Rt},...on?{target:on.word}:{}};if(ue.redirections.push(tn),In&&!Sn)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Sn){if(Sn.ambiguous||Sn.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let cn=ue.nested;be.push({delimiter:Sn.delimiter,quotedDelimiter:Sn.quoted,stripTabs:We==="<<-",attach:(Cn)=>{if(tn.heredoc=Cn,Cn.quotedDelimiter)return;let nn=yb(n,Cn.bodySpan.start,Cn.bodySpan.end,W,z,B+1);cn.push(...nn.programs),le.push(...nn.issues)}})}if(!In&&!on)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(on)ue.nested.push(...on.nested);ue.end=jn,De=jn;continue}let ze=ue.start===-1;if(ze)Ll(Q,le);let st=Wl(n,De,v,W,z,B);if(le.push(...st.issues),st.limited)return _s(Q,le,st.next);let it=Mb(ue.words)?Fb(n,st.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(it?.limitCode)return Eo(Q,le,st.next,it.limitCode,it.limitCode==="word-limit"?W.maxWords:it.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let lt=it?.words??[st.word];for(let Et of lt){if(!Nl(z))return Eo(Q,le,st.next,"word-limit",W.maxWords);ue.words.push(Et)}if(ue.start=ue.start===-1?De:ue.start,ue.end=st.next,ue.nested.push(...st.nested),ze&&Am(st.word))Me();De=st.next>De?st.next:De+1}return Me(),fm(Q,le),le.push(...Hb(be)),{nodes:Q,issues:le,next:De,closed:X===void 0,limited:!1,pendingHeredocs:[]}}function dm(n,u,v){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:As(v.issues,v.limited),issues:v.issues,nodes:v.nodes}}function Wl(n,u,v,W,z,B){let X="",Q=u,le=!1,ue="literal",be=[],Me=[],De=!1;while(Q<v){let Oe=n[Q],Ne=(Oe==="<"||Oe===">")&&n[Q+1]==="(";if(!Oe||fi(Oe)||(Oe===";"||Oe==="|"||Oe==="&")&&ws(n,Q)||(Oe==="<"||Oe===">")&&!Ne)break;if(Oe===")")break;if(Oe==="'"){le=!0;let ze=n.indexOf("'",Q+1);if(ze===-1||ze>=v){X+=n.slice(Q+1,v),Me.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Q=v;break}X+=n.slice(Q+1,ze),Q=ze+1;continue}if(Oe==='"'){le=!0;let ze=hb(n,Q,v,W,z,B);if(X+=ze.text,be.push(...ze.nested),Me.push(...ze.issues),De||=ze.limited,ue=mi(ue,ze.provenance),Q=ze.next,De)break;continue}if(n.startsWith("$'",Q)){le=!0;let ze=Ab(n,Q+2,v);if(X+=ze.text,Me.push(...ze.issues),!ze.closed)Me.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Q=ze.next;continue}if(Oe==="\\"){let ze=n[Q+1];if(!ze){Me.push({code:"trailing-escape",message:"escape has no following character"}),Q++;break}if(ze===`
-`){Q+=2;continue}X+=ze,Q+=2;continue}if(Vr(n,Q))Me.push(jr);let Le=Oe==="$"||Oe==="<"||Oe===">"||Oe==="`"?gi(n,Q,v,W,z,B):null,We=Le?Gl(Le,be,Me):bm(n,Q,v,W,z,B,be,Me);if(We){if(We.provenance==="variable")X+=n.slice(Q,We.next);if(De||=We.limited,ue=mi(ue,We.provenance),Q=We.next,De)break;continue}if(Oe==="$"){let ze=Em(n,Q,v,X,ue);X=ze.text,ue=ze.provenance,Q=ze.next;continue}if(Oe==="*"||Oe==="?"||Oe==="[")ue=mi(ue,"glob");X+=Oe,Q++}return{word:vo(n,u,Q,X,ue,le,ue==="literal"?void 0:Tb(n,u,Q)),nested:be,issues:Me,next:Q,limited:De}}function hb(n,u,v,W,z,B){let X="",Q="literal",le=[],ue=[],be=!1,Me=u+1;while(Me<v){let De=n[Me];if(De==='"')return{text:X,provenance:Q,nested:le,issues:ue,next:Me+1,limited:be};if(De==="\\"&&n[Me+1]){let Le=n[Me+1]??"";if(Le===`
-`){Me+=2;continue}if(Le==="\r"&&n[Me+2]===`
-`){Me+=3;continue}X+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,Me+=2;continue}if(Vr(n,Me))ue.push(jr);let Oe=gi(n,Me,v,W,z,B),Ne=Oe?Gl(Oe,le,ue):bm(n,Me,v,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")X+=n.slice(Me,Ne.next);if(Me=Ne.next,be||=Ne.limited,Q=mi(Q,Ne.provenance),be)return{text:X,provenance:Q,nested:le,issues:ue,next:Me,limited:be};continue}if(De==="$"){let Le=Em(n,Me,v,X,Q);X=Le.text,Q=Le.provenance,Me=Le.next;continue}X+=De??"",Me++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:X,provenance:Q,nested:le,issues:ue,next:v,limited:be}}function gi(n,u,v,W,z,B){let X=ym(n,u);if(!X)return null;let{length:Q,closing:le}=X,ue=le==="))",be=le==="`",Me=n[u]==="<"||n[u]===">",De=zl(n,u+Q,v,le),Oe=De===-1?v:De,Ne=De===-1?v:De+le.length;if(B>=W.maxDepth)return{program:Bb(n,u+Q,Oe,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let lt=[],Et=[],Rt=!1,Tt=u+Q;while(Tt<Oe){let Be=gi(n,Tt,Oe,W,z,B+1);if(!Be){if(Vr(n,Tt))Et.push(jr);Tt++;continue}if(lt.push(...Be.program.nodes),Et.push(...Be.program.issues),Rt||=Be.program.status==="limited",Tt=Be.next,Rt)break}if(De===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Oe),span:{start:u+Q,end:Oe},status:As(Et,Rt),issues:Et,nodes:lt},next:Ne,provenance:"arithmetic"}}let Le=xs(n,u+Q,Oe,W,z,B+1),We=De===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+Q)} substitution is not closed`}]:[],ze=(be||Me)&&pi(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],st=be&&/\\[\\$`\n]/.test(n.slice(u+Q,Oe))?[wb]:[],it=[...Le.issues,...We,...ze,...st];return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Oe),span:{start:u+Q,end:Oe},status:As(it,Le.limited),issues:it,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function yb(n,u,v,W,z,B){let X=[],Q=[],le=u;while(le<v){let ue=n[le];if(ue==="\\"){le+=2;continue}let be=ue==="$"||ue==="`"?gi(n,le,v,W,z,B):null;if(!be){if(Vr(n,le))Q.push(jr);le++;continue}if(X.push(be.program),bb(n,le,be.next)&&vb(be.program))Q.push(jr);le=be.next}return{programs:X,issues:Q}}function Gl(n,u,v){return u.push(n.program),v.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function zl(n,u,v,W){if(W==="`"){for(let Q=u;Q<v;Q++){if(n[Q]==="\\"){Q++;continue}if(n[Q]==="`")return Q}return-1}let z={single:!1,double:!1},B=[],X=[];for(let Q=u;Q<v;Q++){let le=n[Q];if((le===`
-`||le==="\r")&&X.length>0){let Me=le==="\r"&&n[Q+1]===`
-`?Q+2:Q+1,De=Dl(n,Me,v,X.splice(0));if(!De.terminated)return-1;Q=De.next-1;continue}let ue=hm(n,Q,u,v,z);if(ue!==null){Q=ue;continue}if(!z.double&&n.startsWith("$((",Q)){let Me=Sb(n,Q+3,v);if(Me===-1)return-1;Q=Me+1;continue}if(W===")"&&!z.double&&le==="<"&&n[Q+1]==="<"&&n[Q+2]!=="<"){let Me=n[Q+2]==="-",De=Q+(Me?3:2);while(De<v&&/[ \t]/.test(n[De]??""))De++;let Oe=Ml(n,De,v);if(Oe){X.push({delimiter:Oe.delimiter,quotedDelimiter:Oe.quoted,stripTabs:Me,attach:()=>{return}}),Q=Oe.next-1;continue}}if(n.startsWith("$(",Q)&&!n.startsWith("$((",Q)){B.push(z),z={single:!1,double:!1},Q++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let be=B.pop();if(be){z=be;continue}return W==="))"&&n[Q+1]!==")"?-1:Q}return-1}function Sb(n,u,v){let W=1,z={single:!1,double:!1};for(let B=u;B<v;B++){let X=n[B],Q=hm(n,B,u,v,z);if(Q!==null){B=Q;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(X==="("&&!z.double)W++;if(X!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function hm(n,u,v,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!jb(n,u,v))return null;let X=u;while(X+1<W&&n[X+1]!==`
-`&&n[X+1]!=="\r")X++;return X}function ws(n,u){let v=n[u];if(v===";")return";";if(v==="&")return n[u+1]==="&"?"&&":"&";if(v==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function Cb(n,u){let v=n[u];if(v===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(v!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function fi(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var jr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vr(n,u){if(n[u]!=="$")return!1;let v=um(n,u+1);if(n[v]!=="{")return!1;let W=n[um(n,v+1)]??"";return W==="|"||fi(W)}function bb(n,u,v){for(let W=n.indexOf("$",u);W!==-1&&W<v;W=n.indexOf("$",W+1))if(Vr(n,W))return!0;return!1}function vb(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===jr.code)}function um(n,u){let v=u;while(n.startsWith("\\\n",v)||n.startsWith(`\\\r
-`,v))v+=n[v+1]==="\r"?3:2;return v}function ym(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var Eb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Rb=/[\v\f\r]/,Sm=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),Cm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),_b=/\$\(|`|[<>]\(/g;function xb(n,u,v){let W=Fl(v);return[...n.slice(u).matchAll(_b)].some((z)=>{let B=u+z.index;return!W.some((X)=>B>=X.start&&B<X.end)})}function Fl(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((v)=>v.heredoc?[v.heredoc.bodySpan]:[]),...u.nested.flatMap((v)=>Fl(v.nodes))];return u.kind==="group"||u.kind==="function"?Fl(u.body.nodes):[]})}var wb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function bm(n,u,v,W,z,B,X,Q){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=Ps(n,u+2,v),ue=le.close===-1?v:le.close+1;if(le.close===-1)Q.push(Eb);if(le.quoted&&le.substitutions.length>0||le.continued)Q.push(Cm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let be=le.substitutions.some((Me)=>{if(Vr(n,Me))return Q.push(jr),!1;let De=gi(n,Me,ue,W,z,B);return De!==null&&Gl(De,X,Q).limited});return{provenance:"variable",next:ue,limited:be}}function Ps(n,u,v){let W=[],z=!1,B=!1,X=1,Q=u;while(Q<v){let le=n[Q];if(le==="$"&&Vr(n,Q))W.push(Q);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[Q+1]===`
-`,Q+=le==="\\"?2:1;continue}let ue=ym(n,Q);if(ue){W.push(Q);let be=zl(n,Q+ue.length,v,ue.closing);if(be===-1)break;Q=be+ue.closing.length;continue}if(le==="$"&&n[Q+1]==="{"){X++,Q+=2;continue}if(le==="}"&&--X===0)return{close:Q,substitutions:W,quoted:z,continued:B};Q++}return{close:-1,substitutions:W,quoted:z,continued:B}}function vm(n,u,v){if(n[u+1]==="{"){let z=Ps(n,u+2,v).close;return z===-1?v:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<v&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function Ab(n,u,v){let W="",z=[],B=u;while(B<v){let X=n[B];if(X==="'")return{text:W,next:B+1,closed:!0,issues:z};if(X!=="\\"){W+=X??"",B++;continue}let Q=Pb(n,B+1,v);if(W+=Q.text,Q.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Q.invalidCodePoint}`});B=Q.next}return{text:W,next:v,closed:!1,issues:z}}function Pb(n,u,v){let W=n[u];if(!W||u>=v)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return Rs(n,u+1,v,16,2,u+1);if(W==="u")return Rs(n,u+1,v,16,4,u+1);if(W==="U")return Rs(n,u+1,v,16,8,u+1);if(/[0-7]/.test(W))return Rs(n,u,v,8,3,u+1);return{text:W,next:u+1}}function Rs(n,u,v,W,z,B){let X=W===16?/[0-9a-fA-F]/:/[0-7]/,Q="",le=u;while(le<v&&Q.length<z&&X.test(n[le]??""))Q+=n[le],le++;if(!Q)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(Q,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function As(n,u=!1){if(u)return"limited";if(n.some((v)=>v.code==="invalid-ansi-c-code-point"||v.code==="missing-heredoc-delimiter"||v.code==="ambiguous-heredoc-delimiter"||v.code==="unterminated-heredoc"||v.code==="unsupported-heredoc-context"||v.code==="unsupported-function-substitution"||v.code==="unsupported-backtick-escape"||v.code==="unclosed-parameter-expansion"||v.code==="unsupported-parameter-expansion"||v.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function Em(n,u,v,W,z){let B=vm(n,u,v);return{text:W+n.slice(u,B),provenance:mi(z,"variable"),next:B}}function Tb(n,u,v){let W=Es(n),z=u,B=!1,X=!1,Q=u;while(Q<v){let le=n[Q];if(le==="\\"&&!B){Q+=2;continue}if(!X&&le==="'"){B=!B,Q++;continue}if(!B&&le==='"'){X=!X,Q++;continue}if(B){Q++;continue}let ue=n.startsWith("$((",Q),be=n.startsWith("$(",Q)&&!ue,Me=!X&&(n.startsWith("<(",Q)||n.startsWith(">(",Q)),De=le==="`";if(ue||be||Me||De){let Oe=ue?3:De?1:2,Ne=ue?"))":De?"`":")",Le=zl(n,Q+Oe,v,Ne),We=Le===-1?v:Le+Ne.length;W.push(z,Q,"literal"),W.push(Q,We,ue?"arithmetic":"command-substitution"),Q=We,z=We;continue}if(le==="$"){let Oe=vm(n,Q,v);if(Oe>Q+1){W.push(z,Q,"literal"),W.push(Q,Oe,"variable"),Q=Oe,z=Oe;continue}}if(!X&&(le==="*"||le==="?"||le==="[")){W.push(z,Q,"literal"),W.push(Q,Q+1,"glob"),Q++,z=Q;continue}Q++}return W.push(z,v,"literal"),W.parts}function mi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function Ib(n,u,v){return u+1>=v||fi(n[u+1]??"")||ws(n,u+1)!==null}var kb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let v=Db(n,u);if(v===void 0||v===null)return!1;u=v}return!1}function Db(n,u){let v=n[u]?.text.toLowerCase();if(v==="command")return Nb(n,u);if(v==="env")return Lb(n,u);if(v==="sudo")return Wb(n,u);return}function Nb(n,u){if(n[u+1]?.text==="-v")return null;for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return v}return n.length}function Lb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(kb.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return v}return n.length}function Wb(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(Ob.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-"))continue;return v}return n.length}function Rm(n,u,v,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=_m(n.raw,u,v,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((X)=>xm(X,v));if(B.some((X)=>X===null))return{limited:!0};return{words:[...new Set(B.filter((X)=>X!==null&&X!==""))]}}function Fb(n,u,v,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=_m(u.raw,v,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let X=B.values.map((Q)=>xm(Q,W));if(X.some((Q)=>Q===null))return;return{words:X.filter((Q)=>Q!==null&&Q!=="").map((Q)=>vo(n,u.span.start,u.span.end,Q,"literal",!1))}}function _m(n,u,v,W,z){let B=[n],X=n.length,Q=0;while(!0){let le=B.findIndex((Oe)=>mm(Oe,z));if(le===-1)break;if(++Q>v)return{limited:"expansions"};let ue=B[le]??"",be=mm(ue,z);if(!be||be.kind==="range")return{limited:"expansions"};let Me=be.start+ue.length-be.end,De=be.alternatives.reduce((Oe,Ne)=>Oe+Me+Ne.length,0);if(X-ue.length+De>W)return{limited:"length"};if(B.length-1+be.alternatives.length>u)return{limited:"words"};B.splice(le,1,...Gb(ue,be)),X+=De-ue.length}return Q===0?void 0:{values:B}}function mm(n,u){let v=[],W,z=null,B=!1;for(let X=0;X<n.length;X++){let Q=n[X];if(B){B=!1;continue}if(Q==="\\"&&z!=="'"){B=!0;continue}if(Q===z){z=null;continue}if(z===null&&(Q==="'"||Q==='"')){z=Q;continue}if(z!==null)continue;if(Q==="{"){v.push({start:X,commas:[]});continue}if(Q===","&&v.length>0){v.at(-1)?.commas.push(X);continue}if(Q!=="}"||v.length===0)continue;let le=v.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:X+1,commas:le.commas}:u&&$b(n.slice(le.start+1,X))?{kind:"range",start:le.start,end:X+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:zb(n,W)}}function Gb(n,u){return u.alternatives.map((v)=>`${n.slice(0,u.start)}${v}${n.slice(u.end)}`)}function zb(n,u){let v=[u.start,...u.commas,u.end-1];return v.slice(0,-1).map((W,z)=>n.slice(W+1,v[z+1]))}function $b(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function xm(n,u){let v=`x${n}`,W=Wl(v,0,v.length,{maxInputLength:v.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==v.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function Bb(n,u,v,W){return{kind:"program",dialect:"posix",source:n.slice(u,v),span:{start:u,end:v},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function Eo(n,u,v,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function _s(n,u,v){return{nodes:n,issues:u,next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function Nl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function Ub(n,u,v){let W=n.slice(u,v),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function pi(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((v)=>v.heredoc)||u.nested.some((v)=>pi(v.nodes));return(u.kind==="group"||u.kind==="function")&&pi(u.body.nodes)})}function Hb(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function wm(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function fm(n,u){let v=n.at(-1);if(v?.kind!=="connector"||!pm.has(v.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${v.operator} requires a following command`})}function Am(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&gb.has(n.text)}function Ll(n,u){let v=n.at(-1);if(!wm(v))return;if(v?.kind==="command"&&Am(v.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function jb(n,u,v){return u===v||/[\s;&|()]/u.test(n[u-1]??"")}var Tm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object","iex","invoke-expression"]),Vb=new Set(["gc","cat","type","cp","mv","rm"]),Im=["-rec","-for","-path","-literalpath","-whatif"],qb=/^\$env:\w/i,Kb=/^(?:\$\{?\w+\}?|~)\\./;function km(n,u){let v=n.toLowerCase().replaceAll("`","");if(![...Tm].some((z)=>v.includes(z))&&!(v.includes("rm")&&Im.some((z)=>v.includes(z)))&&!v.includes("<#")&&!Yb(v))return!1;let W=Hl(n,u);if(Om(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||Ul(W).some(Zb)}function Om(n){return n.nodes.some((u)=>{if(u.kind==="group")return Om(u.body);if(u.kind!=="command")return!1;return u.redirections.some((v)=>v.operator==="<<")})}function Yb(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function Zb(n){let u=n[0]==="&"||n[0]==="."?1:0,v=n[u]?.toLowerCase();if(v&&Tm.has(v))return!0;let W=n.slice(u+1);if(v&&Vb.has(v)&&W.some(Xb))return!0;if(v!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return Im.some((X)=>B.startsWith(X))})}function Xb(n){return qb.test(n)||Kb.test(n)}function Hl(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=jl(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:v,status:nv(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function jl(n,u,v,W,z,B=!1){let X=[],Q=[],le=bs(),ue=0,be=!1,Me=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Oe={start:le.start,end:le.end};vs(X,le,{kind:"command",dialect:"powershell",source:n.slice(Oe.start,Oe.end),span:Oe,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},De=u;while(De<v){let Oe=n[De];if(!Oe)break;if(B&&Oe==="}")return Me(),{nodes:X,issues:Q,next:De+1,closed:!0,words:ue,limited:be};let Ne=tv(n,De,v,W.maxDepth);if(Ne){if(Ne.issue)Q.push(Ne.issue);if(Ne.limited)return Me(),{nodes:X,issues:Q,next:Ne.next,closed:!1,words:ue,limited:!0};De=Ne.next;continue}if(/\s/.test(Oe)){if(Oe==="\r"||Oe===`
-`){Me();let ze=Oe==="\r"&&n[De+1]===`
-`?De+2:De+1;X.push($l(n,De,ze)),De=ze;continue}De++;continue}let Le=Nm(n,De);if(Le){Me(),X.push($l(n,De,De+Le.length)),De+=Le.length;continue}if(Oe==="{"){if(Me(),z>=W.maxDepth)return Q.push(Dm(W.maxDepth)),{nodes:X,issues:Q,next:v,closed:!1,words:ue,limited:!0};let ze=jl(n,De+1,v,W,z+1,!0),st=ze.closed?ze.next-1:ze.next,it={kind:"program",dialect:"powershell",source:n.slice(De+1,st),span:{start:De+1,end:st},status:ze.limited?"limited":ze.issues.length>0?"partial":"complete",issues:ze.issues,nodes:ze.nodes};if(X.push({kind:"group",style:"brace",span:{start:De,end:ze.next},body:it}),Q.push(...ze.issues),!ze.closed)Q.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=ze.words,be||=ze.limited,De=ze.next;continue}if(Oe==="}"){Me(),X.push($l(n,De,De+1)),De++;continue}if(Oe===">"||Oe==="<"){le.start=le.start===-1?De:le.start;let ze=n[De+1]===Oe?De+2:De+1,st=ze;while(/[ \t]/.test(n[st]??""))st++;let it=st<v?Pm(n,st,v,W,z):void 0,lt=it?.next??ze;if(le.redirections.push({kind:"redirection",operator:n.slice(De,ze),span:{start:De,end:lt},...it?{target:it.word}:{}}),it)Q.push(...it.issues),le.nested.push(...it.nested),ue+=it.words,be||=it.limited;le.end=lt,De=lt;continue}if(Oe===","){le.start=le.start===-1?De:le.start,le.words.push(Ol({text:",",raw:",",span:{start:De,end:De+1},provenance:"literal",quoted:!1})),le.end=++De;continue}let We=Pm(n,De,v,W,z);if(le.start=le.start===-1?De:le.start,le.end=We.next,le.words.push(We.word),Q.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,be||=We.limited,ue>W.maxWords)return Q.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),Me(),{nodes:X,issues:Q,next:We.next,closed:!1,words:ue,limited:!0};De=We.next>De?We.next:De+1}return Me(),{nodes:X,issues:Q,next:De,closed:!B,words:ue,limited:be}}function Pm(n,u,v,W,z){let B="",X="literal",Q=!1,le=[],ue=[],be=0,Me=!1,De=(Ne)=>{let Le=Qb(n,Ne,v,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),be+=Bl(Le.program),Me||=Le.program.status==="limited",X="command-substitution",Le.next},Oe=u;while(Oe<v){let Ne=n[Oe];if(!Ne||/\s/.test(Ne)||Nm(n,Oe)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let Le=n[Oe+1];if(!Le){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Oe++;break}B+=Le,Oe+=2;continue}if(n.startsWith("$(",Oe)){Oe=De(Oe);continue}if(Ne==="'"){Q=!0,Oe++;let Le=!1;while(Oe<n.length){if(n[Oe]==="'"&&n[Oe+1]==="'"){B+="'",Oe+=2;continue}if(n[Oe]==="'"){Le=!0,Oe++;break}B+=n[Oe]??"",Oe++}if(!Le)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Ne==='"'){Q=!0,Oe++;let Le=!1;while(Oe<v){let We=n[Oe];if(We==="`"&&n[Oe+1]){B+=n[Oe+1],Oe+=2;continue}if(We==='"'){Le=!0,Oe++;break}if(n.startsWith("$(",Oe)){Oe=De(Oe);continue}if(We==="$")X=n[Oe+1]==="("?"command-substitution":"variable";B+=We??"",Oe++}if(!Le)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")X=n[Oe+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Oe===u)X="variable";B+=Ne,Oe++}return{word:vo(n,u,Oe,B,X,Q,X==="literal"?void 0:Jb(n,u,Oe)),next:Oe,issues:le,nested:ue,words:be,limited:Me}}function Qb(n,u,v,W,z){let B=Mm(n,u+2,v),X=B===-1?v:B,Q=B===-1?v:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:"limited",issues:[Dm(W.maxDepth)],nodes:[]},next:Q};let le=jl(n,u+2,X,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:Q}}function Mm(n,u,v){let W=1,z=!1,B=!1;for(let X=u;X<v;X++){let Q=n[X];if(Q==="`"){X++;continue}if(!B&&Q==="'"){if(z&&n[X+1]==="'"){X++;continue}z=!z;continue}if(!z&&Q==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",X)){W++,X++;continue}if(!B&&Q==="(")W++;if(Q!==")")continue;if(W--,W===0)return X}return-1}function Bl(n){let u=0;for(let v of n.nodes){if(v.kind==="group")u+=Bl(v.body);if(v.kind==="command"){u+=v.words.length;for(let W of v.nested)u+=Bl(W)}}return u}function Jb(n,u,v){let W=Es(n),z=u,B=!1,X=u;while(X<v){let Q=n[X];if(Q==="`"){X+=2;continue}if(Q==="'"){if(B&&n[X+1]==="'"){X+=2;continue}B=!B,X++;continue}if(B){X++;continue}if(n.startsWith("$(",X)){let le=Mm(n,X+2,v),ue=le===-1?v:le+1;W.push(z,X,"literal"),W.push(X,ue,"command-substitution"),X=ue,z=ue;continue}if(Q==="$"||Q==="@"&&X===u){let le=ev(n,X+1,v);W.push(z,X,"literal"),W.push(X,le,"variable"),X=le,z=le;continue}X++}return W.push(z,v,"literal"),W.parts}function ev(n,u,v){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=v?v:z+1}let W=u;while(W<v&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function Dm(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function Ul(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return Ul(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((v)=>v.target?[v.target]:[])].sort((v,W)=>v.span.start-W.span.start).filter((v)=>v.text!==""&&v.raw!==",").map((v)=>v.text),...u.nested.flatMap(Ul)]})}function Nm(n,u){for(let v of["&&","||",";","|"])if(n.startsWith(v,u))return v;return null}function tv(n,u,v,W){if(n[u]==="#"&&n[u+1]!==">"){let X=u+1;while(X<v&&n[X]!=="\r"&&n[X]!==`
-`)X++;return{next:X,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<v){if(n.startsWith("<#",B)){if(z++,z>W)return{next:v,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:v,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function nv(n,u){if(u)return"limited";if(n.some((v)=>v.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function $l(n,u,v){return{kind:"connector",operator:n.slice(u,v),span:{start:u,end:v}}}function C(n,u="auto",v=xr){if(u==="powershell"||u==="auto"&&km(n.slice(0,v.maxInputLength),v))return Hl(n,v);return gm(n,v)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:Xt(u.map((v)=>v.text))}function Ro(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function Xt(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Vl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function en(n){return n.value.length}function hi(n,u,v=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*v)}function wn(n,u){hi(n,u)}function qr(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Yt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function ql(n){return n===`
-`||n==="\r"||n==="\u2028"||n==="\u2029"}function Zt(n,u,v){if(u+v.length>en(n))return!1;for(let W=0;W<v.length;W++)if(ct(n,u+W)!==v[W])return!1;return!0}function ur(n,u,v){return!qr(ct(n,u-1))&&Zt(n,u,v)&&!qr(ct(n,u+v.length))}function mr(n,u){return qr(ct(n,u-1))!==qr(ct(n,u))}function mn(n){return n===`
-`||n===";"||n==="&"||n==="|"}function _o(n){return n==="|"||n===";"}function Ts(n,u,v){let W=Vl(n,v);if(u==="rm")return rv(W);if(u==="dd")return iv(W);return $m(W,!0)}function Is(n,u,v){let W=Vl(n,v);if(u==="rm")return sv(W);if(u==="reset-hard")return Gm(W,"--ha","rd");if(u==="reset-merge")return Gm(W,"--me","rge");if(u==="clean")return dv(W);if(u==="checkout")return mv(W);if(u==="push-force")return fv(W);if(u==="push-refspec")return pv(W);if(u==="push-delete")return gv(W);if(u==="branch")return hv(W);if(u==="tag")return Cv(W);if(u==="restore")return bv(W);return $m(W,!1)}function rv(n){let u=!1,v=!1,W=!1,z=-1;for(let B=0;B<=en(n);B++){let X=ct(n,B);if(!u){let le=ct(n,B+2);if(ur(n,B,"rm")&&Yt(le)&&le!==`
-`)u=!0,B++;continue}let Q=ov(n,B);if(X===`
-`||Q!==-1){if(u=!1,v=!1,W=!1,z=-1,Q!==-1)B=Q-1;continue}if(X===";"||X==="&"||X==="|"||B===en(n)){if(z>=0){let le=Lm(n,z,B);v||=le.recursive,W||=le.force}if(v&&W)return!0;u=!1,v=!1,W=!1,z=-1;continue}if(Yt(X)){if(z<0)continue;if(Zt(n,z,"--")&&B-z===2){u=!1,v=!1,W=!1,z=-1;continue}let le=Lm(n,z,B);if(v||=le.recursive,W||=le.force,v&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function ov(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(Zt(n,u,String.raw`\n`))return u+2;if(Zt(n,u,String.raw`\x0a`)||Zt(n,u,String.raw`\x0A`))return u+5;if(Zt(n,u,String.raw`\u000a`)||Zt(n,u,String.raw`\u000A`))return u+7;return Zt(n,u,String.raw`\012`)?u+4:-1}function Lm(n,u,v){if(Wm(n,u,v,"recursive"))return{recursive:!0,force:!1};if(Wm(n,u,v,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<v;B++){let X=ct(n,B);W||=X==="r"||X==="R",z||=X==="f"||X==="F"}return{recursive:W,force:z}}function Wm(n,u,v,W){let z=v-u-2;if(z<1||z>W.length||!Zt(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function iv(n){let u=!1;for(let v=0;v<en(n);v++){if(mn(ct(n,v))){u=!1;continue}if(ur(n,v,"dd")){u=!0,v++;continue}if(!u||!ur(n,v,"of")||!Zt(n,v,"of=/dev/"))continue;let W=v+8;if(W<en(n)&&!Yt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function sv(n){let u=!1,v=!1,W=!1;for(let z=0;z<=en(n);){let B=ct(n,z);if(z===en(n)||mn(B)){u=!1,v=!1,W=!1,z++;continue}let X=lv(n,z);if(X>=0){if(av(n,X))return!0;let Q=X,le=!1;while(Yt(ct(n,Q)))le||=ct(n,Q)===`
-`,Q++;if(le)v=!1,W=!1;u=!0,z=Q;continue}if(!u){z++;continue}if(Zt(n,z,"--")&&(z===0||Yt(ct(n,z-1)))&&(!ct(n,z+2)||Yt(ct(n,z+2))||mn(ct(n,z+2)))){u=!1,v=!1,W=!1,z+=2;continue}if(v||=Zt(n,z,"--recursive")&&mr(n,z+11)||Kl(n,z,"recursive"),W||=Zt(n,z,"--force")&&mr(n,z+7)||Kl(n,z,"force"),v&&W)return!0;z++}return!1}function Kl(n,u,v){if(!Zt(n,u,"--"))return!1;let W=0;while(W<=v.length){let z=ct(n,u+W+2);if(!z||Yt(z)||mn(z))break;if(z!==v[W])return!1;W++}return W>0&&mr(n,u+W+2)}function av(n,u){let v=u,W=!1,z=!1;while(v<en(n)){while(Yt(ct(n,v)))v++;let B=v;while(v<en(n)&&!Yt(ct(n,v)))v++;if(ct(n,B)!=="-"||v-B===2&&Zt(n,B,"--"))return!1;let X=Fm(n,B,"recursive"),Q=Fm(n,B,"force");if(W&&Q||z&&X)return!0;if(W||=X,z||=Q,ct(n,B+1)==="-")continue;let le=cv(n,B,v);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Fm(n,u,v){return Zt(n,u,`--${v}`)&&mr(n,u+v.length+2)||Kl(n,u,v)}function lv(n,u){if(u>0&&qr(ct(n,u-1)))return-1;let v=u;if(ct(n,v)==="\\")v++;if(ct(n,v)!=="r")return-1;if(v++,ct(n,v)==="\\")v++;if(ct(n,v)!=="m"||!Yt(ct(n,v+1)))return-1;return v+1}function cv(n,u,v){let W=!1,z=!1,B=!1,X=!1,Q=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q};let le="";for(let ue=u+1;ue<v;ue++){let be=ct(n,ue)??"",Me=(be==="r"||be==="f")&&mr(n,ue+1);W||=be==="r",z||=be==="f",B||=be==="r"&&Me,X||=be==="f"&&Me,Q||=(le==="r"&&be==="f"||le==="f"&&be==="r")&&Me,le=be}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q}}function Gm(n,u,v){return Si(n,"reset",_o,!0,(W)=>ct(n,W)==="-"&&xo(n,W,u,v)?!0:W)}function dv(n){return Si(n,"clean",_o,!0,(u)=>{if(ct(n,u)!=="-")return u;if(xo(n,u,"--fo","rce"))return!0;let v=yi(n,u,_o);for(let W=u+1;W<v;W++)if(ct(n,W)==="f")return!0;return v-1})}function ks(n,u,v){if(!ur(n,u,"git"))return null;let W=u+3;if(!Yt(ct(n,W)))return{commandEnd:-1,next:W};while(Yt(ct(n,W)))W++;while(W<en(n)){if(mn(ct(n,W)))return{commandEnd:-1,next:W};let z=yi(n,W,mn);if(ur(n,W,v))return{commandEnd:W+v.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&Zt(n,W,"--"),X=uv(n,W,z);W=z;while(Yt(ct(n,W)))W++;if(B)return{commandEnd:ur(n,W,v)?W+v.length:-1,next:yi(n,W,mn)};if(!X)continue;if(W>=en(n)||mn(ct(n,W)))return{commandEnd:-1,next:W};W=yi(n,W,mn);while(Yt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function uv(n,u,v){for(let W of kn)if(v-u===W.length&&Zt(n,u,W))return!0;return!1}function mv(n){return zm(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function fv(n){return Si(n,"push",_o,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!qr(ct(n,u+2))&&!Zt(n,u+2,"-with-lease"))return!0;let v=Bm(n,u,"--fo","rce");if(v>=0&&!Zt(n,v,"-with-lease"))return!0;return u})}function pv(n){return Si(n,"push",mn,!1,(u)=>{if(Yt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<en(n)&&!mn(ct(n,u+2))&&!Yt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function gv(n){return Si(n,"push",mn,!1,(u)=>{if(ct(n,u)==="-"&&xo(n,u,"--de","lete"))return!0;if(Yt(ct(n,u))&&ct(n,u+1)===":"&&u+2<en(n)&&!Yt(ct(n,u+2))&&!mn(ct(n,u+2)))return!0;return u})}function hv(n){let u=!1,v=!1,W=!1;for(let z=0;z<=en(n);z++){if(z===en(n)||mn(ct(n,z))){if(v&&W)return!0;u=!1,v=!1,W=!1;continue}if(!u){let Q=ks(n,z,"branch");if(Q){u=Q.commandEnd>=0,z=Math.max(z,(u?Q.commandEnd:Q.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=yi(n,z,mn),X=yv(n,z,B);if(v||=X.deletion,W||=X.force,v&&W)return!0;z=B-1}return!1}function yv(n,u,v){let W=!1,z=!1;for(let B=u;B<v;B++){if(ct(n,B)!=="-")continue;if(xo(n,B,"--de","lete"))W=!0;if(xo(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let X=B+1,Q=!1,le=!1,ue=!1;while(X<v&&Sv(ct(n,X))){let be=ct(n,X);Q||=be==="d"||be==="D",le||=be==="f",ue||=be==="D",X++}if(!mr(n,X))continue;W||=Q,z||=le||ue}return{deletion:W,force:z}}function Sv(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function Cv(n){return zm(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function zm(n,u){let v=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<en(n);W++){let z=ct(n,W),B=v[v.length-1];if(!B)return!1;let X=B.escaped;if(B.escaped=!X&&B.quote!=="'"&&z==="\\",!X&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!X&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(v.length===1||!X&&B.quote!=="'")){v.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!X&&!B.quote&&v.length>1&&z==="("){B.depth++;continue}if(!X&&!B.quote&&v.length>1&&z===")"){if(B.depth--,B.depth===0)v.pop();continue}if(Yt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let Q=ks(n,W,u.command);if(Q){B.outerActive=Q.commandEnd>=0&&Yt(ct(n,Q.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?Q.commandEnd:Q.next)-1);continue}}if(B.outerActive&&z==="-"){if(xo(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&mr(n,W+1))return!0;if(_o(z))B.outerActive=!1}return!1}function Si(n,u,v,W,z){let B=!1;for(let X=0;X<en(n);X++){let Q=ct(n,X),le=v(Q);if(!B&&!le){let ue=ks(n,X,u);if(ue){B=ue.commandEnd>=0&&(!W||Yt(ct(n,ue.commandEnd))),X=Math.max(X,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(X);if(ue===!0)return!0;for(let be=X;be<=ue;be++)if(v(ct(n,be)))B=!1;X=ue}if(le)B=!1}return!1}function bv(n){let u=!1;for(let v=0;v<en(n);v++){if(ql(ct(n,v))){if(u)return!0;u=!1;continue}if(!u){let W=ks(n,v,"restore");if(W){u=W.commandEnd>=0,v=Math.max(v,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,v)==="-"&&ct(n,v+1)==="-"&&(Zt(n,v+2,"staged")||Zt(n,v+2,"help")))u=!1}return u}function $m(n,u){let v=!1;for(let W=0;W<en(n);W++){let z=ct(n,W),B=u?ql(z):mn(z);if(v&&Yt(z)&&ct(n,W+1)==="-"&&ur(n,W+2,"delete"))return!0;if(B){v=!1;continue}if(ur(n,W,"find"))v=!0,W+=3}return!1}function yi(n,u,v){let W=u;while(W<en(n)&&!Yt(ct(n,W))&&!v(ct(n,W)))W++;return W}function Bm(n,u,v,W){if(!Zt(n,u,v))return-1;let z=u+v.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return mr(n,z)?z:-1}function xo(n,u,v,W){return Bm(n,u,v,W)>=0}function Gn(n,u){hi(u,n,2);let v=n.toLowerCase(),W=v.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let X of B){if(X.skipForEchoRg&&z)continue;let Q=X.caseSensitive?n:v;if(X.regex)wn(u,Q);if((X.regex?.test(Q)??!1)||X.scan&&Is(Q,X.scan,u))return at("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${X.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var vv=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hm(n,u,v){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;hi(v,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return jm(u.nodes,W,B)}function jm(n,u,v){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return jm(W.body.nodes,u,v);if(W.kind==="unknown")return!v.loose.test(W.source);return Ev(W,u,v)})}function Ev(n,u,v){if(n.nested.some((z)=>v.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!vv.test(z.text));return n.words.every((z,B)=>z===u||Um(z.raw,v.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!v.loose.test(z.heredoc.body))&&(!z.target||Um(z.target.raw,v.anchored,!0)))}function Um(n,u,v){let W=!1,z=!1;for(let B=0;B<n.length;B++){let X=n[B];if(X==="\\"&&!W){B++;continue}if(!z&&X==="'"){W=!W;continue}if(!W&&X==='"'){z=!z;continue}if(W||X!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!v)return!1}return!0}var Rv="dd writing to a /dev device can destroy a disk or partition. Ask the user to run device writes manually after confirming the target.",_v="mkfs formatting a /dev device erases everything on it. Ask the user to run the format manually after confirming the target.",xv="This erases or repartitions a disk. Ask the user to run disk erase and partition commands manually after confirming the target.",wv="This output redirect overwrites a disk device. Ask the user to run device writes manually after confirming the target.",Av="shred permanently destroys the given target. Use rm for ordinary deletes, or ask the user to run shred manually.",Pv=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Vm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,Tv=new Set(["diskutil","wipefs","sgdisk","parted"]),Iv=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),kv=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,Ov=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),Mv=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),Dv=new Set(["i","b"]),Nv=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,Lv=new Set([">",">|",">>","<>",">&"]),Wv=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function qm(n){return n==="dd"||n==="shred"||Vm.test(n)||Tv.has(n)}function Fv(n,u){let v=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&Iv.has(W.toLowerCase())}if(n==="wipefs")return v&&u.some((W)=>kv.test(W));if(n==="sgdisk")return v&&u.some((W)=>W.startsWith("-")&&!Gv(W));return n==="parted"&&v&&u.some((W)=>Wv.has(W.toLowerCase()))}function Gv(n){if(Ov.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return Dv.has(u[0]??"")||u.every((v)=>Mv.has(v))}function Km(n,u){let v=u.slice(1);if(n==="dd"&&v.some((W)=>/^of=\/dev\/.+/.test(W)&&!Pv.has(W)))return at("dd.device-write",Rv);if(Vm.test(n)&&v.some((W)=>W.startsWith("/dev/")))return at("mkfs.device",_v);if(Fv(n,v))return at("disk.erase",xv);if(n==="shred"&&v.length>0)return at("shred.target",Av);return null}function Ym(n){return n.some((u)=>Lv.has(u.operator)&&u.target?.provenance==="literal"&&Nv.test(u.target.text))?at("redirect.block-device",wv):null}import{readFileSync as zv,statSync as $v}from"node:fs";import{isAbsolute as Bv,resolve as Zm}from"node:path";function wr(n,u,v,W){let z=Bv(n)?Zm(n):u?Zm(u,n):void 0;if(!z)return;try{return Ut(z,v,W)}catch{return z}}function Yl(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}var Xm=262144;function Qm(n){if(!Yl(n))return null;try{let u=$v(n,{throwIfNoEntry:!1});if(!u?.isFile()||u.size>Xm)return null;let v=zv(n);return v.length>Xm||v.includes(0)?null:{text:v.toString("utf8").replaceAll(`\r
-`,`
-`),bytes:v.length}}catch{return null}}import{isAbsolute as Ks,normalize as nR,parse as rR,posix as Ff,resolve as Qr,sep as lc}from"node:path";import{isAbsolute as Uv,join as Jm,normalize as nf,parse as Hv,sep as ef}from"node:path";var jv=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vv=` 	
-`;function Ci(n,u){if(Kr(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Zl(n.get("TMPDIR")??"",u)}function wo(n,u){if(n.has("TMPDIR"))return Zl(n.get("TMPDIR")??"",u);let v=Xl(n,u);if(v===void 0)return!0;return Zl(v,u)}function Xl(n,u){return of(n,u,"TMPDIR")}function Zl(n,u){if(!n)return!1;if(Kv(n))return!1;return Ao(n,u)}function Kr(n,u){let v=of(n,u,"IFS");return v!==void 0&&v!==""&&v!==Vv}function Ao(n,u){let v=Os(n,u.paths);if(v===null)return!1;return rf(u).some((W)=>Ar(v,W))}function Ds(n,u){let v=Os(n,u.paths);if(v===null)return!1;return rf(u).some((W)=>Ms(W)===Ms(v))}var tf=new WeakMap;function rf(n){let u=tf.get(n);if(u)return u;let v=qv(n);return tf.set(n,v),v}function qv(n){let u=jv.map((W)=>Os(W,n.paths)??nf(W)),v=Os(n.tmpdir,n.paths);if(!v)return u;if(process.platform==="win32")return[...u,v];if(process.platform==="darwin"&&Yv(v))return[...u,v];return u}function Kv(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function of(n,u,v){return n.has(v)?n.get(v):u.env.get(v)}function Yv(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function Os(n,u){try{let v=nf(n);if(!Uv(v))return v;let W=Hv(v).root,z=v.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let X=0;X<z.length;X++){let Q=Jm(B,z[X]??"");if(u.entryKind(Q)==="missing")return Jm(Q,...z.slice(X+1));let le=u.realpath(Q);if(le===null)return null;B=le}return B}catch{return null}}function Ar(n,u){let v=Ms(n),W=Ms(u);if(v===W)return!0;let z=W.endsWith(ef)?W:`${W}${ef}`;return v.startsWith(z)}function Ms(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as VE,readdirSync as qE}from"node:fs";import{basename as KE,isAbsolute as kf,join as YE,relative as Of}from"node:path";import{isAbsolute as mf,parse as iE}from"node:path";import{dirname as Zv,isAbsolute as Xv,parse as Qv,sep as Jv}from"node:path";function Pr(n,u,v){if(cr(u))throw Error("Unsupported Windows namespace path");let W=Xv(u)?Qv(u).root:"",z=W||n;for(let B of tE(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=Zv(z);continue}let X=eE(z,B),Q=v.entryKind(X),le=Q==="symlink"?v.realpath(X):X;if(Q==="missing"||le===null)throw Error(`Cannot resolve path component: ${X}`);z=le}return z}function eE(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${Jv}${u}`}function tE(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var Ql=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],nE=new Set(Ql),rE=1024,sf=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),af=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),oE=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ns(n){return nE.has(n)}function Jl(n){return Ns(n)||sf.has(n)||af.has(n)||Jo(n)}function fr(n,u,v){return v?.has(n)?v.get(n):u.get(n)}function lf(n,u){let v=fr("GIT_CONFIG_COUNT",n,u);if(v===void 0)return{state:"absent"};if(v==="")return{state:"valid",count:0};if(!/^\d+$/.test(v))return{state:"invalid"};let W=Number(v);return Number.isSafeInteger(W)&&W<=rE?{state:"valid",count:W}:{state:"invalid"}}function Ls(n,u,v){let z=n.match(oE)?.[1];if(!z||!Jl(z))return null;let B=n.indexOf("=");return{name:z,value:`${fr(z,u,v)??""}${n.slice(B+1)}`}}function cf(n){return uf(n,af)}function df(n){return uf(n,sf)}function uf(n,u){if(!n)return!1;for(let v of n.keys())if(u.has(v))return!0;return!1}var pf=/^[A-Za-z_][A-Za-z0-9_]*=/;function zn(n){if(!pf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function Ae(n){let u=new Map,v=0;while(v<n.length){let W=n[v];if(!W)break;let z=zn(t(W));if(!z)break;u.set(z.name,z.value),v++}return{words:n.slice(v),envAssignments:u}}function gf(n){let u=$t(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function pr(n,u,v,W){if(!gf(Po(n)))return{words:n,envAssignments:new Map,cwd:v,rewritten:!1};let z=new Set(n),B=n,X=new Map,Q=new Map(W??[]),le=[],ue=v;for(let Me=0;Me<l.wrapperPeelIterations.cap;Me++){let De=ff(B),Oe=Ae(B);for(let[Le,We]of Oe.envAssignments)X.set(Le,We),Q.set(Le,We);if(B=Oe.words,B.length===0)break;while(B.length>0&&Po(B).includes("=")&&!aE(B)){let Le=lE(Po(B),Q,u.env)??Ls(Po(B),u.env,Q);if(Le)X.set(Le.name,Le.value),Q.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=$t(Po(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=dE(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=fE(B,ue,Q,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,ze]of Le.envAssignments)X.set(We,ze),Q.set(We,ze)}if(Ne==="command")B=pE(B);if(Ne==="builtin")B=B.slice(qn(B,1)==="--"?2:1);if(ff(B)===De)break}let be=Ae(B);for(let[Me,De]of be.envAssignments)X.set(Me,De),Q.set(Me,De);return{words:be.words,envAssignments:X,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:sE(be.words,z)}}function sE(n,u){return n.some((v)=>!u.has(v))}function ff(n){return n.map(t).join(" ")}function Po(n){let u=n[0];return u?t(u):""}function qn(n,u){let v=n[u];return v?t(v):void 0}function aE(n){return pf.test(Po(n))}function lE(n,u,v){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??v.get("TMPDIR")??""}${n.slice(8)}`}}var cE=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function dE(n,u,v){let W=1,z=v;while(W<n.length){let B=qn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let X=qn(n,W+1);z=X?bi(z,X,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=bi(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=bi(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(cE.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var uE=new Set(["-i","-0","--null"]),mE=new Set(["-u","--unset","-C","--chdir","-P"]);function fE(n,u,v,W){let z=new Map,B=[],X=u,Q=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:X,envSplitValues:B.length>0?B:void 0});while(Q<n.length){let ue=qn(n,Q);if(!ue)break;if(ue==="--")return le(Q+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let Me of v.keys())z.set(Me,"");z.set("TMPDIR",""),Q++;continue}if(uE.has(ue)){Q++;continue}if(ue==="-u"||ue==="--unset"){let Me=qn(n,Q+1);if(Me!==void 0)z.set(Me,"");Q+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),Q++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),Q++;continue}let be=ue==="-S"||ue==="--split-string"?{value:qn(n,Q+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(be){if(be.value!==void 0)B.push(be.value);return X=null,le(Q+be.consumed)}if(mE.has(ue)){if(ue==="-C"||ue==="--chdir"){let Me=qn(n,Q+1);X=Me?bi(X,Me,W.paths):null}Q+=2;continue}if(ue.startsWith("-u=")){Q++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let Me=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);X=bi(X,Me,W.paths),Q++;continue}if(ue.startsWith("-P")){Q++;continue}if(ue.startsWith("-")){Q++;continue}if(!zn(ue))break;while(Q<n.length){let Me=zn(qn(n,Q)??"");if(!Me)break;z.set(Me.name,Me.value),Q++}if(qn(n,Q)==="--")Q++;return le(Q)}return le(Q)}function bi(n,u,v){if(u==="")return null;if(!n&&!mf(u))return null;let W=mf(u)?iE(u).root:v.realpath(n??"/");if(W===null)return null;try{return Pr(W,u,v)}catch{return null}}function pE(n){if(qn(n,1)==="-v")return[...Xt(["type"]),...n.slice(2)];let u=1;while(u<n.length){let v=qn(n,u);if(!v)break;if(v==="-p"||v==="-v"||v==="-V"){u++;continue}if(v==="--")return n.slice(u+1);if(v.startsWith("-")&&!v.startsWith("--")&&v.length>1){if(!/^[pvV]+$/.test(v.slice(1)))break;u++;continue}break}return n.slice(u)}var gE=/['"\\$`{}#]/;function Ws(n,u){if(n.some((W)=>gE.test(W)))return null;let v=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return v.length<=64?v:null}function Tr(n,u,v){return Fs(n,u,v).tokens}function hE(n){let u=[],v="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((X)=>X.replace(/["']/g,"")).filter((X)=>X.length>0);v+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(v.length>0)u.push(v);v="",W++;continue}v+=z,W++}if(v.length>0)u.push(v);return u}function Ir(n,u,v,W=0){let z=Fs(n,u,v),B=(z.envSplitValues??[]).flatMap(hE);if(B.length===0)return z.tokens;let X=[...B,...z.tokens];if(W>=8)return X;return Ir(X,u,v,W+1)}function Fs(n,u,v,W){if(!gf(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:v};let z=pr(Xt(n),u,v,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var nc=Symbol("adopt-as-operand"),yE=new Set(["env","sudo","command","builtin"]),SE=new Set(["&&","||","|&","|","&",";"]),CE=new Set(["<<","<<<",">|"]),hf=new Set(["|","|&"]),bE=/[*@#?$!_-]/,vE=/^\w+(?::\w+)*/,EE=Object.freeze([]),vi=Object.freeze({kind:"scope",edge:"enter"}),Ei=Object.freeze({kind:"scope",edge:"exit"}),RE=Object.freeze([]),_E=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Ri=new Set(["bash","sh","zsh","dash","ksh"]),xE=256,vf=new WeakMap;function Ef(n,u){let v=u.status==="complete"?new Set(tc(u)):new Set,W=PE(n,v);if(ls(W))return Gs("unclosed-quote",W,u);let z={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},B=Yr(u,{source:W,suppressed:v,flags:z,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(z.limited)return Gs("structural-limit",W,u);if(z.invalid)return Gs("invalid",W,u);let X=Gs("complete",W,u,z.assignmentFallbacks);return vf.set(X,Object.freeze(B)),X}function Bs(n,u,v,W,z){let B=z.word??((Ne)=>Ne),X={cwd:u,variables:new Map,previous:null},Q=[],le=new Set,ue=null,be=[],Me=Rf(n),De=Me.findLastIndex((Ne)=>Ne.kind==="operator"&&hf.has(Ne.operator)),Oe=De!==-1&&Me.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of Me.entries()){let We=Oe||Ne<=De;if(Le.kind==="scope"){if(Le.edge==="enter"){be.push({state:X,segment:[...Q],shellWords:new Set(le),pipeProducer:ue});continue}let ze=z.segment(Q,X,ue,null,le,We);if(ze)return ze;let st=be.pop();if(st===void 0)throw Error("scope exit without a matching enter");X=st.state,Q=st.segment,le=st.shellWords,ue=st.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let ze=z.segment(Q,X,ue,Le.operator,le,We);if(ze)return ze;X=wE(Q,X,v,W),ue=Q.length>0&&hf.has(Le.operator)?Q:null,Q=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(Q.length-1);if(Le.target===void 0)continue;let ze=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},X,We);if(ze===nc){le.add(Q.length),Q.push(B(Le.target));continue}if(ze)return ze;continue}Q.push(B(Le.text))}return z.segment(Q,X,ue,null,le,Oe)}function Us(n){return Rf(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function An(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(v,W,z,B)=>{let X=u.get(W);if(X===void 0)return v;let Q=z.startsWith(":")?X!=="":!0;if(z.endsWith("-"))return Q?X:An(B,u);return Q?An(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(v,W)=>u.get(W)??v).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(v,W)=>u.get(W)??v)}function _i(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function wE(n,u,v,W){let z=_i(n)?new Map([...u.variables,...AE(n,u.variables)]):u.variables,B=Tr([...n],v),X=Wt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!X)return{...u,variables:z};if(X==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:hn(An(X,z),u.cwd,v,W),variables:z,previous:u.cwd}}function AE(n,u){return n.flatMap((v)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(v),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],An(z,u)]]:[]})}function Rf(n){return vf.get(n)??EE}function PE(n,u){return[...u].reduce((v,W)=>v.slice(0,W.start)+" ".repeat(W.end-W.start)+v.slice(W.end),n)}function Gs(n,u,v,W=RE){return Object.freeze({status:n,source:u,program:v,assignmentFallbacks:Object.freeze(W)})}function Yr(n,u){return n.nodes.flatMap((v,W)=>TE(v,n,W,u)).sort((v,W)=>v.start-W.start).flatMap((v)=>[...v.events])}function TE(n,u,v,W){if(n.kind==="connector")return[{start:n.span.start,events:[Kn(DE(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Kn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",X=W.source[n.span.end-1]===(B?"}":")"),Q=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[zs("{"),...Yr(n.body,Q),...X?[zs("}")]:[]]:[vi,Kn("("),...Yr(n.body,Q),...X?[Kn(")")]:[],Ei]}]}let z=FE(n,W.functions);if(z){if(W.depth>=xr.maxDepth||++W.flags.expansions>xE)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...yf(n,W),zs(";"),...Yr(z,{...W,depth:W.depth+1}),zs(";")]},...Sf(n,u,v,W)]}return[{start:n.span.start,events:yf(n,W)},...Sf(n,u,v,W)]}function yf(n,u){return[...n.words.map((v)=>({start:v.span.start,events:xf(v,n,u,!1)})),...n.redirections.map((v)=>({start:v.span.start,events:IE(v,n,u)}))].sort((v,W)=>v.start-W.start).flatMap((v)=>v.events)}function IE(n,u,v){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?xf(n.target,u,v,!0):[],B=z[0],X=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[rc(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:NE(W),targetOrder:CE.has(W)?"legacy-segment":"immediate",...X===void 0?{}:{target:X},...n.heredoc&&v.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:Af(u)}:{}}),...X===void 0?z:z.slice(1)]}function Sf(n,u,v,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let X=B.heredoc;if(!X)return[];let Q=[rc(X.delimiter),.../[\r\n]/.test(W.source[X.terminatorSpan.end]??"")?[Kn(";")]:[]];if(W.suppressed.has(X.bodySpan))return[{start:X.bodySpan.start,events:Q}];return[{start:X.bodySpan.start,events:[..._f(W.source.slice(X.bodySpan.start,X.bodySpan.end),W),...Q]}]}),...z.some((B)=>!B.heredoc&&B.target)?kE(u,v,W):[]]}function kE(n,u,v){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:_f(v.source.slice(W.span.end,n.span.end),v)}]}function _f(n,u){if(u.depth>=xr.maxDepth)return u.flags.limited=!0,[];let v=C(n,"posix");if(v.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Yr(v,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function xf(n,u,v,W){let z=[],B={single:!1,double:!1},X="",Q=!1,le=()=>{let ue=Q&&!W?Kn("glob"):X!==""||n.quoted&&z.length===0?rc(X):void 0;if(ue)z.push(ue);X="",Q=!1};for(let ue of n.parts){if(ue.provenance!=="command-substitution"&&ue.provenance!=="arithmetic"){for(let Oe of ec(ue.raw,B,v.flags,v.powershell)){if(typeof Oe==="string"){le(),z.push(Kn(Oe));continue}X+=Oe.text,Q||=Oe.glob}continue}let be=u.nested.find((Oe)=>Oe.span.start>=ue.span.start&&Oe.span.end<=ue.span.end);if(B.double){let Oe=v.source.slice(ue.span.start,ue.span.end);X+=ec(Oe,{single:!1,double:!0},v.flags,v.powershell).map((Le)=>typeof Le==="string"?Le:Le.text).join("");let Ne=be?Yr(be,v).filter((Le)=>Le.kind==="redirection"&&Le.body!==void 0):[];if(Ne.length>0)z.push(vi,...Ne,Ei);continue}let Me=be?Yr(be,v):[];if(ue.raw.startsWith("`")){X+="${}",le(),z.push(vi,...Me,Ei);continue}if(ue.raw.startsWith("<(")||ue.raw.startsWith(">(")){le(),z.push(ue.raw.startsWith("<(")?Kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),vi,...Me,...ue.raw.endsWith(")")?[Kn(")")]:[],Ei);continue}let De=ue.raw.startsWith("$((")?2:1;X+="${}",le(),z.push(...Array.from({length:De},()=>Kn("(")),...De===1?[vi]:[],...Me,...ue.raw.endsWith(")".repeat(De))?Array.from({length:De},()=>Kn(")")):[],...De===1?[Ei]:[])}return le(),z}function ec(n,u,v,W){let z=[],B="",X=!1,Q=0;while(Q<n.length){let le=n[Q]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:X},le),B="",X=!1,Q++;continue}if(W&&le==="`"&&!u.single){B+=n[Q+1]??"",Q+=2;continue}if(u.single&&le==="'"){u.single=!1,Q++;continue}if(u.single){B+=le,Q++;continue}if(u.double){if(le==='"'){u.double=!1,Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,Q+=2;continue}if(le==="$"){let ue=Cf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}B+=le,Q++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";X||=ue==="*"||ue==="?",B+=ue,Q+=2;continue}if(le==="$"){let ue=Cf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}X||=le==="*"||le==="?",B+=le,Q++}return[...z,{text:B,glob:X}]}function Cf(n,u,v,W,z){let B=n[u+1];if(B==="{"){let Q=z?ME(n,u+2):Ps(n,u+2,n.length).close;if(Q===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,Q+1);return OE(le,v,W,z),{text:le,next:Q+1}}if(B!==void 0&&bE.test(B))return{text:`\${${B}}`,next:u+2};let X=(z?vE:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${X}}`,next:u+1+X.length}}function OE(n,u,v,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let X=z.slice(B.length),Q=[":=","="].find((ue)=>X.startsWith(ue));if(!Q)return;let le=ec(X.slice(Q.length),{...u},v,W);v.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function ME(n,u){let v=1,W=u;while(v>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")v++;if(n[W]==="}")v--;W++}return v===0?W-1:-1}function DE(n){return/^[\r\n]+$/.test(n)?";":n}function Kn(n){return Object.freeze({kind:"operator",operator:n,boundary:SE.has(n)})}function zs(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function rc(n){return Object.freeze({kind:"word",text:n})}function NE(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function To(n){return _E.has(n)||/^python\d/.test(n)}var LE=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function wf(n,u){let v=u[0];if(v===void 0||!v.startsWith("-"))return u;let W=LE.get(n)?.has(v)??!1;return wf(n,u.slice(W?2:1))}function $s(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return $s(n.slice(1));if(u==="uv"&&n[1]==="run")return $s(n.slice(2));if(!yE.has(u))return[...n];return $s(wf(u,n.slice(1)))}function Af(n){let u=ui(n),v=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return $s(v<0?[]:n.words.slice(v).map((W)=>W.text))}function WE(n){let u=Af(n)[0];if(u===void 0)return!1;let v=Wt(u).toLowerCase();return To(v)&&!Ri.has(v)}function tc(n){return n.nodes.flatMap((u,v)=>{if(u.kind==="group"||u.kind==="function")return tc(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((Q)=>tc(Q)),z=u.redirections.flatMap((Q)=>Q.heredoc?.quotedDelimiter?[Q.heredoc.bodySpan]:[]);if(WE(u))return[...W,...z];let B=n.nodes[v+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!zE(u))return W;return[...W,...z]})}function FE(n,u){let v=ui(n);return v===void 0?void 0:u.get(v)}function kr(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function GE(n){if(kr(n.words[0],"git"))return kr(n.words[1],"commit");if(!kr(n.words[0],"gh")||!kr(n.words[2],"create"))return!1;return kr(n.words[1],"pr")||kr(n.words[1],"issue")}function zE(n){return(kr(n.words[0],"cat")||kr(n.words[0],"tee")||GE(n))&&!n.words.some(bf)&&!n.redirections.some((v)=>bf(v.target))}function bf(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var rr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Hs="Unsupported heredoc syntax",Zr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function or(){return{id:"analysis.dynamic-shell-source",reason:Zr,intent:"stop_and_explain"}}var Pf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var oc=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),$E=new Set([...oc,"dir_path","glob","glob_pattern","include_pattern"]),BE=new Set([...oc,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(rr)}}function Tf(n){let u=UE(),v=de(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&v)W.push({usage:"input-candidate",source:v});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,X)=>{let Q=B.findIndex((be)=>be.source===X.source);if(Q!==-1){let be=B[Q];if(!be)return B;return B[Q]={...be,usages:[...be.usages,X.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(X.source,le);return B.push({usages:[X.usage],source:X.source,program:ue,shell:u.getShellSyntax(X.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:HE(n),store:u}}function Io(n,u){return n.commands.find((v)=>v.usages.includes(u))}function gr(n){return Io(n,"declared-command")??Io(n,"input-candidate")}function hr(n,u){if(!n.includes("$"))return n;return $a(n,u)}function UE(){let n=new Map,u=new WeakMap,v=(z,B)=>{let X=`${B}\x00${z}`,Q=n.get(X);if(Q)return Q;let le=C(z,B);return n.set(X,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let X=B??v(z,"posix"),Q=u.get(X);if(Q)return Q;let le=X.status==="limited"?{status:"structural-limit",source:z,program:X,assignmentFallbacks:[]}:Ef(z,X);return u.set(X,le),le},getCommandProgram:v,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function HE(n){let u=n.route.kind==="grep"?$E:n.route.kind==="glob"?BE:oc;return[...Jd(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?nu(n.input):[]]}var jE=new Set(["-S","--suffix"]);function ko(n,u,v,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return Bs(n,u,v,W,{segment:(B,X)=>z.findSegmentTarget(B,X),redirection:(B,X)=>B.role==="file-write"&&z.isRedirectionTarget(An(B.target,X.variables),X)?B.target:null})}function js(n){let u=[],v=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){v=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){v=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){v=B.slice(2);continue}if(!W&&jE.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return v?{sources:u,destination:v}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Mf(n,u,v,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(Ji(n.invocation.toolName))return null;let Q=n.paths.find((le)=>If(le,z,u,v,W,u.entries));return Q?{target:Q}:null}if(n.invocation.route.kind!=="command")return null;let B=gr(n);if(!B)return null;let X=ko(B.shell,z,v,W,{findSegmentTarget:(Q,le)=>tR(Q,le,u,v,W),isRedirectionTarget:(Q,le)=>If(Q,le.cwd,u,v,W,u.markerFiles),findMalformedTarget:()=>null});return X?{target:X}:null}function Xr(n,u,v,W,z,B,X=!1){if(!v)return!1;let Q=qs(hn(n,u,z,B)),le=Q.replace(/(\/\.?\*+)+$/,"");if(le!==Q&&le!==""){if(ic(le,v))return!0;let ue=X||Q.slice(le.length).includes("/."),be=(Me)=>ue?Vs(Me,le):ZE(Me,le);if(v.markerFiles.some(be))return!0;return W&&sc(v).some(be)}if(ic(Q,v))return!0;return W&&sc(v).some((ue)=>Vs(ue,Q))}function ZE(n,u){let v=Of(u,n);if(v===""||v.startsWith("..")||kf(v))return!1;return!v.split(/[\\/]/)[0]?.startsWith(".")}function XE(n,u,v,W,z){return Xr(n,u,v,!0,W,z)}function QE(n,u,v,W,z){if(!v)return!1;return ic(qs(hn(n,u,W,z)),v)}function If(n,u,v,W,z,B){let X=qs(hn(n,u,W,z));return B.includes(X)||Nf(X,v)}function Df(n,u,v,W,z){if(!v)return!1;return v.hooksDirectories.some((B)=>n.some((X)=>Vs(B,qs(hn(X,u,W,z)))))}function ic(n,u){return u.entries.includes(n)||u.directories.includes(n)||Nf(n,u)}function Nf(n,u){return u.hooksDirectories.some((v)=>Vs(n,v))}var JE=50000;function Lf(n,u){let v=[...new Set(sc(n))];if(v.some((z)=>u(KE(z))))return!0;let W=0;while(v.length>0){let z=v.pop()??"",B=eR(z);if(!B)return!0;if(W+=B.length,W>JE)return!0;if(B.some((X)=>u(X.name)))return!0;v.push(...B.filter((X)=>X.isDirectory()).map((X)=>YE(z,X.name)))}return!1}function eR(n){try{let u=VE(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return qE(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function sc(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function Vs(n,u){let v=Of(u,n);return v===""||!/^\.\.(?:[\\/]|$)/.test(v)&&!kf(v)}function qs(n){return process.platform==="win32"?n.toLowerCase():n}function tR(n,u,v,W,z){if(_i(n))return null;let B=Ir([...n],W);if(Wt(B[0]??"").toLowerCase()!=="mv")return null;let X=js(B.slice(1)),Q=X.sources.find((le)=>XE(An(le,u.variables),u.cwd,v,W,z));if(Q)return Q;return X.destination&&QE(An(X.destination,u.variables),u.cwd,v,W,z)?X.destination:null}var oR=process.platform==="win32",Wf=64,iR=16384;function cc(n,u,v,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!ln(v,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!ln(v,z.id,u.paranoid))return null;return at(z.id,z.reason)}function Oo(n,u,v,W,z={}){return sR(n,u,z).map((B)=>Ft(cc(B,u,v,W),v)).find((B)=>B!==null)??null}function sR(n,u,v){let W=ir(n,u,v);if(W.kind==="cwd_self_target")return[W,ir(n,u,{...v,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=ir(n,u,{...v,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,ir(n,u,{...v,skipHomeCwd:!0,skipCwdSelf:!0})]}function Jr(n){let u=Rm(n,Wf,Wf,iR);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:aR(n)}}function aR(n){let u=n.parts.filter((v)=>v.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(v.raw));return u.length>0&&u.every((v)=>lR(n.raw,v.span.start-n.span.start))}function lR(n,u){let v=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&v!=="'"){W=!0;continue}if(v===B){v=null;continue}if(v===null&&(B==="'"||B==='"'))v=B}return v==='"'}function $n(n){let u=n.environment.home,v=n.environment.paths,W=n.budget??Rn();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:gR(n.allowPaths,u,v,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function ir(n,u,v={}){let W=v.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!v.tmpdirWordSplittingProtected&&yR(n))return{kind:"outside_anchored_cwd"};let z=!W&&Gf(n,u.posixShell);if(cr(n))return{kind:"outside_anchored_cwd"};if(xi(n,W))return{kind:"root_or_home_target"};if(uR(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Xr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(mR(n,u.trustTmpdirVar,u.posixShell,z,W,v.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z)return{kind:"dynamic_target"};if(hR(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!v.skipHomeCwd&&[B,u.resolvedCwd??B].some((X)=>vR(X,u.environment.home,u.environment.paths,u.budget)))return{kind:"home_cwd_target"};if(!v.skipCwdSelf&&[u.resolvedCwd??B,B].some((X)=>ER(n,u.resolvedCwd??B,u.environment.paths,u.budget,X)))return{kind:"cwd_self_target"};if(RR(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(cR(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function cR(n,u,v){let W=n.trim();if(v||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if(Ks(W)||W.startsWith("~"))return!1;if(dc(W))return!1;if(zf(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return Ao(Qr(u.resolvedCwd,W),u.environment)}function dR(n,u,v={}){let{containmentTarget:W,...z}=v;if(ir(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(pR(B))return!1;if(Ds(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((X)=>zf(W??B,X,u.environment.paths,u.budget))}function xi(n,u=!1){let v=n.trim(),W=Ff.normalize(v),z=v.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((X)=>/^\*+$/.test(X)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function uR(n,u,v){let W=n.trim(),z=v?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=Ks(z)?z:u.resolvedCwd?Qr(u.resolvedCwd,z):null;if(!B)return!1;let X=Pn(Ut(B,u.environment.paths,u.budget));if(X===rR(X).root)return!0;return X===Pn(Ut(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function Pn(n){let u=nR(n);if(oR){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function mR(n,u,v,W,z,B,X,Q){let le=n.trim();if(dc(le))return!1;if(!W&&Ao(le,Q))return!0;return(u||B&&X)&&v&&!z&&fR(le,v)}function fR(n,u){return["$TMPDIR","${TMPDIR}"].some((v)=>{if(n===v)return!0;if(!n.startsWith(`${v}/`))return!1;return!Gf(n.slice(v.length+1),u)})}function pR(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return Ff.normalize(`/${u[1]??""}`)==="/"}function dc(n){return n.split(/[\\/]+/).includes("..")}function gR(n,u,v,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=ai(z.trim(),u);if(!Ks(B))return[];try{let X=Ut(B,v,W);if(li(X,Ut(u,v,W)))return[];return[Pn(X)]}catch{return[]}})}function hR(n,u,v){if(u.allowRoots.length===0)return!1;let W=n.trim();if(dc(W))return!1;let z=v?W:ai(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,X=Ks(z)?z:B?Qr(B,z):null;if(!X)return!1;try{let Q=Pn(Ut(X,u.environment.paths,u.budget));return u.allowRoots.some((le)=>Q===le||Q.startsWith(le.endsWith(lc)?le:`${le}${lc}`))}catch{return!1}}function yR(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function Gf(n,u=!1){return n.includes("$")||n.includes("`")||SR(n)||u&&CR(n)}function SR(n){let u=!1;for(let v of n){if(u){u=!1;continue}if(v==="\\"){u=!0;continue}if(v==="*"||v==="?"||v==="[")return!0}return!1}function CR(n){let u=!1;for(let v=0;v<n.length;v++){let W=n[v];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&bR(n,v)||(W==="+"||W==="@"||W==="!")&&n[v+1]==="(")return!0}return!1}function bR(n,u){let v=n.indexOf("}",u+1);if(v===-1)return!1;let W=n.slice(u+1,v);return W.includes(",")||W.includes("..")}function vR(n,u,v,W){try{return Pn(Ut(n,v,W))===Pn(Ut(u,v,W))}catch{try{return Pn(n)===Pn(u)}catch{return!1}}}function ER(n,u,v,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return Pn(Ut(Qr(u,n),v,W))===Pn(Ut(z,v,W))}catch{try{return Pn(Qr(u,n))===Pn(z)}catch{return!1}}}function RR(n,u,v,W,z,B,X){let Q=v??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return ac(n,u,B,X)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return ac(Qr(Q,n),u,B,X)}catch{return!1}if(n.startsWith("../"))return!1;try{return ac(Qr(Q,n),u,B,X)}catch{return!1}}function ac(n,u,v,W){try{return $f(Ut(n,v,W),Ut(u,v,W))}catch{return!1}}function zf(n,u,v,W){if(!u)return!1;try{return $f(Ut(u,v,W),Ut(n,v,W))}catch{return!0}}function $f(n,u){let v=Pn(n),W=Pn(u);return v.startsWith(`${W}${lc}`)||v===W}function Ys(n,u){let v=u.envAssignments??new Map,W=Xl(v,u.environment),z=u.trustedTmpdirValue??wo(v,u.environment),B=u.allowTmpdirVar??!Ci(v,u.environment),X={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??Kr(v,u.environment),trustedTmpdirValue:z,budget:u.budget},Q=$n(X),le=$n({...X,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),be=u.cwd&&u.environment.paths.realpath(u.cwd),Me=ue&&be&&!Ar(be,ue)?u.cwd:void 0;return n.every((De)=>{let Oe=Jr(De);if(Oe.unsafeBraceExpansion||Oe.expandedTargets?.length===0)return!1;return(Oe.expandedTargets??[t(De)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?Me:void 0,We=Le??Ne,ze={targetIsLiteral:Oe.expandedTargets!==void 0||Oe.targetIsLiteral,tmpdirWordSplittingProtected:Oe.tmpdirWordSplittingProtected};if(!ln(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&ir(We,Q,ze).kind==="within_anchored_cwd")return!0;return dR(We,Le?le:Q,{...ze,containmentTarget:_R(We,W)})})})}function _R(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var Mo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",wi="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",mc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),xR=new Set(["-p","--print"]),wR=new Map([["node",new Set(["-c","--check"])],["ruby",new Set(["-c"])]]),AR=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),PR=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),TR=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),IR=new Map([["python",new Set(["m"])]]),kR=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),OR=new Set(["always","default","never"]),MR=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DR=/\\\r?\n/g,Bf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,NR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${Bf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${Bf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],LR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Uf(n){return Xs(n).code}function Zs(n){return Xs(n).sources}function Hf(n){return LR.get(Qs(n))??[]}function Xs(n){let u=Qs(n[0]??"");if(!mc.has(u))return{code:null,sources:[],optionsOpen:!1};let v=[],W=[],z=!0;for(let B=1;B<n.length;B++){let X=n[B];if(X===void 0)break;if(X==="--")return Yn(u,v,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(X===""||X==="-"||!X.startsWith("-"))return Yn(u,v,W,z,B,X);if(u==="node"&&xR.has(X)){let Me=n[B+1];if(Me===void 0)return Yn(u,v,W,z);if(Me.startsWith("-"))continue;v.push({tokenIndex:B+1,value:Me}),W.push({tokenIndex:B+1,kind:"inline-code",value:Me}),B++;continue}if(FR(u,X)){let Me=n[B+1];if(Me===void 0)return Yn(u,v,W,z);if(v.push({tokenIndex:B+1,value:Me}),W.push({tokenIndex:B+1,kind:"inline-code",value:Me}),u==="python")return Yn(u,v,W,z);B++;continue}let Q=/^--eval=(.*)$/s.exec(X);if(GR(u)&&Q){let Me=Q[1]??"";v.push({tokenIndex:B,value:Me}),W.push({tokenIndex:B,kind:"inline-code",value:Me});continue}if(u==="node"){let Me=WR(X);if(Me){if(Me.attached){if(z&&=Me.value!=="",Me.value!=="")W.push({tokenIndex:B,kind:"module-file",value:Me.value});continue}let De=n[B+1];if(De===void 0||De.startsWith("-"))return z=!1,Yn(u,v,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:De}),B++;continue}}if(u==="python"&&X.startsWith("--check-hash-based-pycs=")||u==="node"&&(X==="--conditions="||X==="--diagnostic-dir="||X==="--title=")||u==="ruby"&&(X==="--disable="||X==="--enable="))return Yn(u,v,W,z);if(kR.get(u)?.has(X)){let Me=n[B+1];if(Me===void 0||Me.startsWith("-")&&!(u==="ruby"&&MR.has(X))||u==="python"&&!OR.has(Me))return Yn(u,v,W,z);B++;continue}if(X.startsWith("--"))continue;let le,ue=!1;for(let Me=1;Me<X.length;Me++){let De=X[Me];if(De===void 0)break;if(IR.get(u)?.has(De)){let Oe=X.slice(Me+1),Ne=Oe||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Oe?B:B+1,kind:"module-file",value:Ne});return Yn(u,v,W,z)}if(AR.get(u)?.has(De)){le=X.slice(Me+1)||n[B+1],ue=Me+1===X.length;break}if(u==="node"&&De==="r"){if(z&&=X==="-r",X==="-r"){let Oe=n[B+1];if(z&&=Oe!==void 0&&!Oe.startsWith("-"),z&&Oe!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Oe});B++}break}if(u==="ruby"&&De==="r"){let Oe=X.slice(Me+1),Ne=Oe||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Oe?B:B+1,kind:"module-file",value:Ne});if(!Oe)B++;break}if(u==="perl"&&(De==="M"||De==="m")){let Oe=X.slice(Me+1);if(!Oe){if(z=!1,Me+1===X.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Oe});break}if(PR.get(u)?.has(De)){if(Me+1===X.length)B++;break}if(TR.get(u)?.has(De)&&Me+1<X.length)break}if(le===void 0)continue;let be=ue?B+1:B;if(v.push({tokenIndex:be,value:le}),W.push({tokenIndex:be,kind:"inline-code",value:le}),u==="python")return Yn(u,v,W,z);if(ue)B++}return Yn(u,v,W,z,void 0,void 0,!0)}function Yn(n,u,v,W,z,B,X=!1){let Q=n==="node"?u.slice(-1):u,le=new Set(Q.map((be)=>be.tokenIndex)),ue=v.filter((be)=>be.kind!=="inline-code"||le.has(be.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?Q[0]?.value:Q.map((be)=>be.value).join(`
-`))||null,sources:W?ue:[],optionsOpen:W&&X}}function WR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function fc(n){let u=wR.get(Qs(n[0]??"")),v=n.findIndex((W,z)=>z>0&&(W==="-"||!W.startsWith("-")));return u!==void 0&&n.slice(1,v===-1?void 0:v).some((W)=>u.has(W))}function pc(n,u){return Qs(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function Qs(n){let u=Wt(n).toLowerCase();return is.test(u)?"python":u}function FR(n,u){return mc.get(n)?.has(u)??!1}function GR(n){return mc.get(n)?.has("--eval")??!1}function Ai(n,u,v=!1){let W=BR(n,u);if(wn(u,W),NR.some((X)=>Array.from(W.matchAll(X)).some((Q)=>Q.groups?.literal===void 0||xi(Q.groups.literal,!0))))return!0;if(!uc(W,u))return!1;wn(u,W);let B=$R(W);if(uc(B,u))return!0;if(wn(u,B),!jf.test(B))return!1;return!v||zR(W,u)}function zR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let be=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,Me=le+be.length,De=Me;while(De<n.length&&!n.startsWith(be,De))De+=n[De]==="\\"?2:1;if(De>=n.length)return!0;z.push({start:Me,text:n.slice(Me,De)}),W.fill(" ",le,De+be.length),le=De+be.length-1}let B=W.join(""),X=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>jf.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:Js(B,ue)}});if(X.some((le)=>gc(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),be=X.some((Me)=>le.start>=Me.start&&le.start<Me.end);return(ue||be)&&uc(le.text,u)})}function Js(n,u){let v=1;for(let W=u;W<n.length;W++){if(n[W]==="(")v++;if(n[W]===")")v--;if(v===0)return W}return n.length}function gc(n,u){let v=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))v++;if(")]}".includes(z)&&v--===0)return!1;if(z===","&&v===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var jf=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function $R(n){let u=[],v=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,X=W+B.length;while(X<n.length&&!n.startsWith(B,X))X+=n[X]==="\\"?2:1;if(X>=n.length)break;u.push(n.slice(v,W)," "),W=X+B.length,v=W}return u.push(n.slice(v)),u.join("")}function uc(n,u){if(Ts(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(wn(u,n),W.test(n))return!0;if(Ts(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(wn(u,n),W.test(n))return!0;if(Ts(n,"find",u))return!0;let v=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(wn(u,n),v.some((z)=>Is(z,W))))}function BR(n,u){return wn(u,n),n.replace(DR,"")}var UR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Vf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",HR="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Kf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",jR="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",VR="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",qR={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Kf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:qf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:jR},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Vf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:HR},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Vf}};function Yf(n,u,v){return KR(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,$n({...v,allowPaths:v.policy?.destructiveCommandAllowPaths}),v.policy)}function KR(n,u,v,W){let z=n.filter((le)=>le.kind==="word"),B=ZR(z),X=z[B];if(!X||!UR.has(i_(X.text)))return null;let Q=YR(z.slice(B+1));if(Q.whatIfProtected)return null;if(ln(W,"powershell.remove-item-pipeline-dynamic-target",v.strict)&&u&&(Q.targets.length===0||Q.recursive))return at("powershell.remove-item-pipeline-dynamic-target",VR);for(let le of Q.targets)if(!cr(le.text)&&xi(Pi(le.text)))return at(Q.recursive&&Q.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Kf);for(let le of Q.targets)if(v.resolvedCwd&&Xr(Pi(le.text),v.resolvedCwd,v.protectedGitMetadata,Q.recursive,v.environment,v.budget,!0))return at("powershell.remove-item-git-metadata",y);if(!Q.recursive||!Q.force)return null;if(ln(W,"powershell.remove-item-recursive-force-dynamic-target",v.strict)&&(Q.hasDynamicTarget||Q.targets.length===0))return at("powershell.remove-item-recursive-force-dynamic-target",qf);for(let le of Q.targets){let ue=Oo(Pi(le.text),v,W,qR);if(ue)return ue}return null}function YR(n){let u=[],v=!1,W=!1,z=!1,B=!1,X=!1;for(let Q=0;Q<n.length;Q++){let le=n[Q];if(!le||le.kind!=="word")continue;if(XR(le))continue;if(X){u.push(hc(le)),B=B||le.dynamic;continue}if(le.text==="--"){X=!0;continue}let ue=JR(le.text);if(!ue){u.push(hc(le)),B=B||le.dynamic;continue}if(e_(ue.name)){let be=ue.value?QR(ue.value,le):n[++Q];if(be?.kind==="word"){u.push(hc(be)),B=B||be.dynamic;continue}B=!0;continue}if(t_(ue.name)){v=!0;continue}if(n_(ue.name)){W=!0;continue}if(r_(ue.name))z=o_(ue.value)}return{targets:u,recursive:v,force:W,whatIfProtected:z,hasDynamicTarget:B}}function ZR(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function hc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function XR(n){return n.kind==="word"&&n.text===","}function Pi(n){let u=n.replace(/\\/g,"/"),v=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return v?`$HOME${u.slice(v[0].length)}`:u}function QR(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function JR(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),v=u.indexOf(":");if(v===-1)return{name:u.toLowerCase()};return{name:u.slice(0,v).toLowerCase(),value:u.slice(v+1)}}function e_(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function t_(n){return"recurse".startsWith(n)}function n_(n){return n.length>=2&&"force".startsWith(n)}function r_(n){return n==="wi"||"whatif".startsWith(n)}function o_(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function i_(n){return n.toLowerCase()}import{sep as xP}from"node:path";var s_=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),a_=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),l_=new Set(["-o","--output","--query","--subscription"]),c_=new Set;function Zf(n){if(n==="aws")return s_;if(n==="gcloud")return a_;if(n==="az")return l_;return c_}var d_=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),u_=new Set;function Xf(n){if(n==="git")return kn;if(n==="docker")return d_;return u_}function F(n,u){if(n.length===0||u.length===0)return null;let v=$t(n[0]??""),W=_n(n);for(let z of u){if(!p_(v,z.command))continue;if(z.match){if(m_(v,n,z.match))return Qf(z);continue}if(!g_(v,n,z.subcommand))continue;if(y_(n,new Set(z.block_args),W))return Qf(z)}return null}function Qf(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function m_(n,u,v){let W=u.slice(1);if(v.exclude_args?.some((z)=>W.includes(z)))return!1;if(v.any_args&&!v.any_args.some((z)=>W.includes(z)))return!1;return f_(W,v.command_path,Zf(n))}function f_(n,u,v){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&v.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function p_(n,u){return n===$t(u)}function g_(n,u,v){if(!v)return!0;return Jf(u,1,v,Xf(n))}function Jf(n,u,v,W){let z=!1;for(let B=u;B<n.length;B++){let X=n[B];if(!X)continue;if(z){z=!1;continue}if(X==="--"){let Q=n[B+1];if(Q&&!Q.startsWith("-"))return Q===v;return!1}if(W.has(X)){z=!0;continue}if(X.startsWith("-")){if(!X.includes("=")&&h_(n,B,v,W))return!0;continue}return X===v}return!1}function h_(n,u,v,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return Jf(n,u+2,v,W)}function y_(n,u,v){return n.some((W)=>u.has(W))||[...v].some((W)=>u.has(W))}var S_=new Set(["-e","--source"]),C_=new Set(["-F","-v","--assign","--field-separator"]),ep=new Set(["-f","--file"]),b_=new Set(["print","printf","return"]),tp=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],v_="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function np(n,u,v){let W=!1;for(let z of E_(n)){let B=R_(z,v);if(!B)continue;for(let X of B.commands){let Q=u(X);if(Q)return Q;if(X.includes("{}")||/[$`]/.test(X))W=!0}W||=B.dynamic}return W?at("awk.system-dynamic",v_):null}function Sc(n){let u=[],v=!1,W=!1,z=!0,B=!0;for(let X=1;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(z&&Q==="--"){z=!1;continue}if(z&&S_.has(Q)){v=!0;let le=n[X+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:X+1,kind:"inline-code",value:le});X++;continue}if(z&&Q.startsWith("--source=")){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(9)});continue}if(z&&Q.startsWith("-e")&&Q.length>2){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(2)});continue}if(z&&(C_.has(Q)||ep.has(Q))){let le=n[X+1];if(B&&=le!==void 0,ep.has(Q)){if(W=!0,le!==void 0)u.push({tokenIndex:X+1,kind:"program-file",value:le})}X++;continue}if(z&&(Q.startsWith("-F")||Q.startsWith("-v")&&Q.slice(2).includes("=")))continue;if(z&&Q.startsWith("-f")&&Q.length>2){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(2)});continue}if(z&&(Q.startsWith("--assign=")||Q.startsWith("--field-separator=")))continue;if(z&&Q.startsWith("--file=")){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(7)});continue}if(z&&Q.startsWith("-")&&Q!=="-")continue;if(!v&&!W)u.push({tokenIndex:X,kind:"main-program",value:Q});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function Ii(n){return Sc(n).sources}function E_(n){return Ii(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function R_(n,u){wn(u,n);let v=n.includes("system")?Cc(n,u):null,W=__(n,u);if(!v&&!W)return null;return{dynamic:!!v?.dynamic||!!W?.dynamic,commands:[...v?.commands??[],...W?.commands??[]]}}function Cc(n,u){wn(u,n);let v=[],W=!1,z=!1,B=0;while(B<n.length){let X=n[B];if(X==='"'||X==="'"){B=ta(n,B,X)?.endIndex??B+1;continue}if(X==="#"){B=rp(n,B+1);continue}if(X==="/"&&op(n,B)){B=ip(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let Q=B;if(B+=6,Ti(n[Q-1])||Ti(n[B]))continue;let le=ea(n,B);if(n[le]!=="(")continue;le=ea(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let be=ta(n,le,ue);if(!be){W=!0,z=!0;continue}if(le=ea(n,be.endIndex),W=!0,n[le]!==")"){z=!0,B=be.endIndex;continue}v.push(be.value),B=le+1}if(!W)return null;return{dynamic:z,commands:v}}function __(n,u){wn(u,n);let v=[],W=!1,z=!1,B=0,X=0,Q=null,le=null,ue=0;while(B<n.length){let be=n[B];if(!be)break;if(be==='"'||be==="'"){let Oe=ta(n,B,be);if(Oe&&ue===X)le={...Oe,startIndex:B};ue=Oe?.endIndex??B+1,B=Oe?.endIndex??B+1;continue}if(be==="#"){B=rp(n,B+1),X=B,Q=null,le=null,ue=B;continue}if(be==="/"&&op(n,B)){let Oe=ip(n,B+1);ue=Oe??B+1,B=Oe??B+1;continue}if(`;
-{}`.includes(be)){B++,X=B,Q=null,le=null,ue=B;continue}if(Q===null&&(yc(n,B,"print")||yc(n,B,"printf")))Q=B;if(be!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(be))ue=B+1;B++;continue}let Me=n[B+1]==="&"?B+2:B+1,De=ea(n,Me);if(yc(n,De,"getline")){z=!0;let Oe=A_(X,le,ue);if(W||=Oe===null,Oe!==null)v.push(Oe);ue=Me,B=Me;continue}if(T_(X,Q)){z=!0;let Oe=w_(n,De);if(!Oe){W=!0,ue=Me,B=Me;continue}if(!x_(n,Oe.endIndex)){W=!0,ue=Oe.endIndex,B=Oe.endIndex;continue}v.push(Oe.value),ue=Oe.endIndex,B=Oe.endIndex;continue}ue=Me,B++}if(!z)return null;return{dynamic:W,commands:v}}function Ti(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function ea(n,u){let v=u;while(/\s/.test(n[v]??""))v++;return v}function x_(n,u){let v=u;while(/[\t\f\v\r ]/.test(n[v]??""))v++;let W=n[v];return!W||`;
-}#`.includes(W)}function ta(n,u,v){let W="",z=!1;for(let B=u+1;B<n.length;B++){let X=n[B];if(!X)break;if(z){let Q=P_(n,B);if(!Q)return null;W+=Q.value,B=Q.endIndex,z=!1;continue}if(X==="\\"){z=!0;continue}if(X===v)return{value:W,endIndex:B+1};W+=X}return null}function w_(n,u){let v=n[u];if(v!=='"'&&v!=="'")return null;return ta(n,u,v)}function A_(n,u,v){if(!u)return null;return u.startIndex>=n&&u.endIndex===v?u.value:null}function P_(n,u){let v=n[u];if(!v)return null;if(v==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(v)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[v]??v,endIndex:u}}function yc(n,u,v){return n.startsWith(v,u)&&!Ti(n[u-1])&&!Ti(n[u+v.length])}function T_(n,u){return u!==null&&u>=n}function rp(n,u){let v=n.indexOf(`
-`,u);return v===-1?n.length:v+1}function op(n,u){let v=I_(n,u);if(v===-1)return!0;if("{([,;!~=".includes(n[v]??""))return!0;let W=v;while(Ti(n[W-1]))W--;return b_.has(n.slice(W,v+1))}function I_(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function ip(n,u){let v=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="/")return W+1}return null}var k_=new Set(["sudo","env","command","builtin"]),sp=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function ap(n){return sp.has(n)}function na(n,u){let v=n[0];if(!v||!lp(Wt(v),u))return null;let W=Wt(v),z=n[1]==="--"?2:1,B=O_(n,z,W,u),X=B[0];if(X===void 0)return null;return{wrapper:W,tokens:n.slice(X),childIndex:X,alternativeChildIndices:B.slice(1)}}function O_(n,u,v,W){let z=n[1]==="--",B=[];for(let X=u;X<n.length;X++){let Q=n[X];if(!Q)continue;let le=Wt(Q)!==v&&M_(Q,W);if(le)B.push(X);if(!le&&ss.has($t(Q)))break;if(z)break}return B}function M_(n,u){let v=Wt(n),W=$t(n);return W==="git"||W==="unshare"||v==="busybox"||eo(n)||al.has(v)||qm(W)||as.has(W)||lp(v,u)||Jt.has(W)||n==="$SHELL"||On(W)||Fn.has(W)||u.rules.some((z)=>z.command===v)}function lp(n,u){return sp.has(n)||u.transparentWrappers.includes(n)}function eo(n){return k_.has(n.toLowerCase())}function to(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function Zn(n,u){let v=u.policy??{rules:[],transparentWrappers:[]};return ra([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),v,{iterations:0},!1)}function*ra(n,u,v,W,z,B,X,Q,le){let ue=Fs(n,u,v,B);for(let[Oe,Ne]of ue.envAssignments)B.set(Oe,Ne),z.set(Oe,Ne);let{tokens:be,cwd:Me}=ue;if(ue.envSplitValues){let Oe=Ws(ue.envSplitValues,be);if(!Oe)throw new a("derivedCommandShape");bc(Q),yield*ra(Oe,u,Me,W,z,B,X,Q,le);return}if(eo(be[0]??""))throw new a("wrapperPeelIterations");let De=na(be,X);if(De){for(let Oe of[De.childIndex,...De.alternativeChildIndices])bc(Q),yield*ra(Oe===De.childIndex?De.tokens:be.slice(Oe),u,Me,W,new Map(z),new Map(B),X,Q,!0);return}if(N_(be)){bc(Q),yield*ra(be.slice(1),u,Me,W,z,B,X,Q,le);return}yield D_(be,Me,W,z,B,le)}function D_(n,u,v,W,z,B){return{tokens:n,cwd:u===null?void 0:u??v,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:Wt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function bc(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function N_(n){return Wt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function vc(n,u){let v=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;v.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:v}}function yr(n){let u=!1,v=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||Ec(W,"recursive")){u=!0;continue}if(W==="-f"||Ec(W,"force")){v=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))v=!0}}return u&&v}function oa(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((v)=>Ec(v,"recursive")||/^-[A-Za-z]+$/.test(v)&&/[rR]/.test(v.slice(1)))}function Ec(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var L_=["--init-file","--rcfile"],W_=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Bn(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v)continue;if(v==="-c")return dp(n,u,!0);if(v.startsWith("-")&&v.includes("c")&&!v.startsWith("--")){let W=dp(n,u,!1);if(W!==null)return W}}return null}var cp=/^-[cn]+$/;function Xn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!cp.test(W)))return!1;let v=u.findIndex((W)=>!cp.test(W));return u.slice(0,v===-1?void 0:v).some((W)=>W.includes("n"))}var F_=/^-[abcefhiklmnprstuvx]+$/;function ia(n){let u=n.findIndex((B,X)=>X>0&&!F_.test(B)),v=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(v.some((B)=>B.startsWith("+")))return!0;let W=v.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=Bn(n);if(z===null)return v.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function dp(n,u,v){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!v&&W.startsWith("-"))return null;return W}function up(n){let u=Wt(n[0]??"").toLowerCase(),v=G_(n,u),W=W_.get(u)??null,z=v.argvSource?.kind!=="absent";return{argvSource:u==="bash"?v.argvSource:null,argvSourceApplies:u==="bash"&&v.interactive&&v.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!v.interactive:W==="ENV"&&v.interactive)}}function G_(n,u){let v=xn(n),W=v.commandIndex??v.scriptIndex??n.length,z=[],B=!1,X=!0;for(let Q=1;Q<W;Q++){let le=n[Q];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&X?L_.find((De)=>le===De):void 0){let De=n[Q+1];z.push(De===void 0?{kind:"absent"}:{kind:"literal",value:De}),Q++;continue}let Me=le.split("=",1)[0]??le;if(u==="bash"&&il.has(Me)&&!le.includes("="))Q++;continue}if(u==="bash")X=!1;let ue=sl(u,le,n[Q+1],"startup");if(ue.interactive)B=le[0]==="-";Q+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var z_="find -delete permanently removes files. Use -print first to preview.",$_="find -exec rm -rf is dangerous. Use explicit file list instead.",B_=new Set(["-exec","-execdir","-ok","-okdir"]),U_=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function mp(n,u){let v=n.map(t),W=H_(n,v,u);if(W)return W;if(sa(v,1)&&!Z_(n,v,u)){let X=Ft(at("find.delete",z_),u.policy);if(X)return X}let z=u.budget??Rn(),B=0;while(B<v.length){let X=v[B],Q=Sr(X??"");if(Q>0){B+=Q+1;continue}if(!sr(X)){B++;continue}z.charge("derivedTokens",v.length-B-1);let le=Do(v,B);B=le.nextIndex;let ue=X_(le.tokens,u.environment);if(ue){let Oe=Ft(ue,u.policy);if(Oe)return Oe}let be=X==="-execdir"||X==="-okdir",Me=u.analyzeTokens?.(le.tokens,be?null:u.cwd)??null,De=Me?.id.startsWith("custom.")?Me:Ft(Me,u.policy);if(De)return De}return null}function H_(n,u,v){if(!sa(u,1)&&!Rc(u,v.environment))return null;let z=ki(n)??Xt(["."]),B=$n({...v,allowPaths:v.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let X of z){let Q=Jr(X);for(let le of Q.expandedTargets??[t(X)]){let ue=ir(le,B,{targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return at("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!j_(n,B.protectedGitMetadata,v.environment))return at("find.delete-git-metadata",y)}}if(Y_(u)&&B.resolvedCwd&&Df(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return at("find.delete-git-metadata",y);return null}function j_(n,u,v){if(!u)return!1;let W=n.map(t),z=[],B=!1,X=ki(n)?.at(-1),Q=X?n.indexOf(X)+1:1;while(Q<W.length){let le=W[Q]??"";if(sr(le)){let ue=Do(W,Q),be=Ir([...ue.tokens],v),Me=oa(be),De=Jt.has(Wt(be[0]??"").toLowerCase()),Oe=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&be.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(Me||De||Oe||Ne)return!1;B=!0,Q=ue.nextIndex;continue}if(le==="-delete"){B=!0,Q++;continue}if(le==="-name"||le==="-iname"){let ue=n[Q+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(q_(ue.text,le==="-iname"));Q+=2;continue}if(!V_.has(le))return!1;Q+=1+Sr(le)}return z.length>0&&!Lf(u,(le)=>z.every((ue)=>ue.test(le)))}var V_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function q_(n,u){let v=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${v}$`,u?"isu":"su")}var K_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Rc(n,u){let v=0;while(v<n.length){if(!sr(n[v])){v++;continue}let W=Do(n,v),z=Ir([...W.tokens],u),B=Wt(z[0]??"").toLowerCase(),X=Jt.has(B)&&K_.test((Bn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||X)&&z.some((le)=>le.includes("{}")))return!0;v=W.nextIndex}return!1}function Y_(n){return n.some((u,v)=>{if(!["-name","-iname"].includes(u))return!1;return n[v+1]?.toLowerCase()==="hooks"})}function Z_(n,u,v){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=ki(n);return W!==null&&Ys(W,v)}function ki(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},v=1;while(u(v)==="-H"||u(v)==="-P")v++;if(u(v)==="--")v++;let W=[];while(v<n.length){let z=u(v),B=n[v];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),v++}return W.length>0?W:null}function X_(n,u){let v=Tr([...n],u);if(v.length===0)return null;let W=Wt(v[0]??"");if(W==="busybox"&&v.length>1)v=v.slice(1),W=Wt(v[0]??"");if(W==="rm"&&yr(v))return at("find.exec-rm-recursive-force",$_);return null}function Do(n,u){let v=u+1;while(v<n.length&&n[v]!==";"&&!(n[v]==="+"&&n[v-1]==="{}"))v++;return{tokens:n.slice(u+1,v),nextIndex:Math.min(v+1,n.length)}}function sa(n,u){let v=u;while(v<n.length){let W=n[v];if(!W){v++;continue}if(sr(W)){v=Do(n,v).nextIndex;continue}let z=Sr(W);if(z>0){v+=z+1;continue}if(W==="-delete")return!0;v++}return!1}function Sr(n){return U_.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function sr(n){return n!==void 0&&B_.has(n)}import{resolve as Pw}from"node:path";function*_c(n){for(let u of n.nodes)yield*Q_(u)}function xc(n){return[..._c(n)]}function Mt(n){return xc(n).map((u)=>u.words.map((v)=>v.text))}function Oi(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let v=u.nodes[0];if(v?.kind!=="command")return null;if(v.redirections.length>0||v.nested.length>0)return null;if(v.words.some((W)=>W.provenance==="command-substitution"))return null;return v.words.map((W)=>W.text)}function*Q_(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*_c(u);return}if(n.kind==="group")yield*_c(n.body)}var J_=5,wc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function fn(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function pp(n,u,v){let W=No(n,u,v),z=ex(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,X=!1;for(let Q=0;Q<J_;Q++){let{subcommand:le,rest:ue}=Dn(B),be=le?.toLowerCase();if(!be||!z.has(be))return{blockedReason:W.blockedReason,expanded:X,tokens:B};let Me=z.get(be),De=ix(Me);if(De===null||De.length===0)return{blockedReason:wc,expanded:!0,tokens:B};B=["git",...De,...ue],X=!0}return{blockedReason:wc,expanded:!0,tokens:B}}function gp(n,u,v){return No(n,u,v).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function Dn(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?Wt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=kn.has(z)?2:1}return{subcommand:null,rest:[]}}function ex(n){let u=new Map;for(let v of n){let W=v.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,v.value)}return u}function No(n,u,v){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?Wt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=nx(u,v);return{blockedReason:B.blockedReason,entries:[...B.entries,...tx(n,u,v)]}}function tx(n,u,v){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let X=Ac(n[z+1]);if(X)W.push(X);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let X=Ac(B.slice(2));if(X)W.push(X);z++;continue}if(B==="--config-env"){let X=fp(n[z+1],u,v);if(X)W.push(X);z+=2;continue}if(B.startsWith("--config-env=")){let X=fp(B.slice(13),u,v);if(X)W.push(X);z++;continue}if(kn.has(B)){z+=2;continue}z++}return W}function nx(n,u){let v=rx(n,u),W=ox(n,u);return{blockedReason:v===null||W===null?wc:null,entries:[...v??[],...W??[]]}}function rx(n,u){let v=fr("GIT_CONFIG_PARAMETERS",n,u);if(v===void 0)return[];let W=[],z=Oi(v);if(!z)return null;for(let B of z){let X=Ac(B);if(!X)return null;W.push(X)}return W}function ox(n,u){let v=lf(n,u);if(v.state==="absent")return[];if(v.state==="invalid")return null;let W=[];for(let z=0;z<v.count;z++){let B=fr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),X=fr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||X===void 0)return null;W.push({key:B,value:X})}return W}function Ac(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function fp(n,u,v){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:fr(n.slice(W+1),u,v)}}function ix(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return Oi(u)}var sx="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",ax="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",lx="git checkout --force discards uncommitted changes. Use 'git stash' first.",cx="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",dx="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",ux="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",mx="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",fx="git switch --force discards uncommitted changes. Use 'git stash' first.",px="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",gx="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",hx="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",yx="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Sx="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Cx="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",bx="git push --force destroys remote history. Use --force-with-lease for safer force push.",vx="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Ex="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Rx="git branch -D force-deletes without merge check. Use -d for safe delete.",_x="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",xx="git merge --abort discards merge conflict resolutions. Use 'git status' first.",wx="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Ax="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Px="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Tx="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Ix="git worktree remove --force can delete uncommitted changes. Remove --force flag.",kx=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Ox=new Set(["--recurse-submodules","--track","-t"]),Pc=new Set(["-b","-B","-U"]),Tc=new Set(["-c","-C"]),Mx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Bt(n,u){let v=n.split("=",1)[0]??n;return v.length>=4&&u.startsWith(v)&&v.startsWith("--")&&v.slice(2).length>=2}var Lo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function yp(n,u){let{subcommand:v,rest:W}=Dn(n);if(!v)return null;switch(v.toLowerCase()){case"checkout":return Or(Dx(W,u));case"switch":return Or(Lx(W));case"restore":return Or(Fx(W));case"reset":return zx(W);case"clean":return Or(Bx(W));case"rm":return Or(Ux(W));case"push":return no(Hx(W));case"branch":return no(qx(W));case"stash":return no(Qx(W));case"worktree":return no(Jx(W));case"rebase":return Or(Kx(W));case"merge":return Or(Yx(W));case"tag":return no(Zx(W));case"reflog":return no(Xx(W));default:return null}}function Or(n){return n?{...n,localDiscard:!0}:null}function no(n){return n?{...n,localDiscard:!1}:null}function Dx(n,u){let{index:v,before:W}=fn(n),z=_n(W,{shortOptsWithValue:Pc});if(W.some((Q)=>Bt(Q,"--force"))||z.has("-f"))return at("git.checkout-force",lx);for(let Q of n){if(Q==="-b"||Q==="-B"||Q==="--orphan")return null;if(Bt(Q,"--pathspec-from-file"))return at("git.checkout-pathspec-from-file",dx)}if(v!==-1){if(W.some((le)=>!le.startsWith("-")))return at("git.checkout-ref-path",cx);return at("git.checkout-double-dash",sx)}let B=Wx(n);if(B.length>=2)return at("git.checkout-ambiguous",ux);let X=B[0];if(X===void 0||z.has("-d")||z.has("-t")||n.some((Q)=>Bt(Q,"--detach")||Bt(Q,"--track")))return null;if(Nx(X)||u(X))return at("git.checkout-double-dash",ax);return null}function Nx(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function Lx(n){let{before:u}=fn(n);if(u.some((W)=>Bt(W,"--discard-changes")))return at("git.switch-discard-changes",mx);let v=_n(u,{shortOptsWithValue:Tc});if(u.some((W)=>Bt(W,"--force"))||v.has("-f"))return at("git.switch-force",fx);return null}function Wx(n){let u=[],v=0;while(v<n.length){let W=n[v];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),v++;continue}if(kx.has(W)){v+=2;continue}if(Ox.has(W)){let z=n[v+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];v+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}v++}return u}function Fx(n){let u=Gx(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?at("git.restore-worktree",gx):at("git.restore-unstaged",px)}function Gx(n){let u=!1,v=!1,W=!0,z=!1,B=(X)=>{if(!z)W=!1,z=!0;if(X!==void 0)W=X};for(let X=0;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(Q==="--"){u||=X+1<n.length;break}if(Q==="--pathspec-from-file"){u=!0,X++;continue}if(Q.startsWith("--pathspec-from-file=")){u=!0;continue}if(Q==="-h"||Q==="--help"||Q==="--version")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(Q==="--staged"){B();continue}if(Q==="--no-staged"){B();continue}if(Q==="--worktree"){B(!0);continue}if(Q==="--no-worktree"){B(!1);continue}if(Q==="--patch"){v=!0;continue}if(Q==="--no-patch"){v=!1;continue}if(Mx.has(Q)){X++;continue}if(Q.startsWith("--"))continue;if(Q==="-"){u=!0;continue}if(!Q.startsWith("-")){u=!0;continue}for(let le=1;le<Q.length;le++){let ue=Q.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){v=!0;continue}if(ue==="s"||ue==="U"){if(le===Q.length-1)X++;break}}}return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function zx(n){let u=null;for(let v of n){if(Bt(v,"--hard")){u=at("git.reset-hard",hx);break}if(Bt(v,"--merge")){u=at("git.reset-merge",yx);break}}if(!u)return null;return $x(n)?no(u):Or(u)}function $x(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function Bx(n){for(let v of n)if(v==="-n"||Bt(v,"--dry-run"))return null;let u=_n(n.filter((v)=>v!=="--"));if(n.some((v)=>Bt(v,"--force"))||u.has("-f"))return at("git.clean-force",Sx);return null}function Ux(n){let u=!1,v=!1,W=!1;for(let z of fn(n).before){if(Bt(z,"--no-force")){u=!1;continue}if(Bt(z,"--force")){u=!0;continue}if(Bt(z,"--no-cached")){v=!1;continue}if(Bt(z,"--cached")){v=!0;continue}if(Bt(z,"--no-dry-run")){W=!1;continue}if(Bt(z,"--dry-run")){W=!0;continue}let B=_n([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!v&&!W?at("git.rm-force",Cx):null}function Hx(n){let{before:u,after:v}=fn(n),W=_n(u);if(u.some((X)=>Bt(X,"--mirror")))return at("git.push-mirror",Ex);if(u.some((X)=>Bt(X,"--force"))||W.has("-f")||hp(u,v).some(jx))return at("git.push-force",bx);if(u.some((X)=>Bt(X,"--delete"))||W.has("-d")||hp(u,v).some(Vx))return at("git.push-delete",vx);return null}function hp(n,u){return[...n.filter((v)=>v!==""&&!v.startsWith("-")),...u]}function jx(n){return n.startsWith("+")||n.includes(":+")}function Vx(n){return n.length>1&&n.startsWith(":")}function qx(n){let{before:u}=fn(n),v=_n(u),W=v.has("-D")||v.has("-d")||u.some((B)=>Bt(B,"--delete")),z=v.has("-D")||v.has("-f")||u.some((B)=>Bt(B,"--force"));if(W&&z)return at("git.branch-force-delete",Rx);return null}function Kx(n){let{before:u}=fn(n);return u.some((v)=>Bt(v,"--abort"))?at("git.rebase-abort",_x):null}function Yx(n){let{before:u}=fn(n);return u.some((v)=>Bt(v,"--abort"))?at("git.merge-abort",xx):null}function Zx(n){let{before:u}=fn(n);return _n(u).has("-d")||u.some((W)=>Bt(W,"--delete"))?at("git.tag-delete",wx):null}function Xx(n){return n[0]==="delete"?at("git.reflog-delete",Ax):null}function Qx(n){for(let u of n){if(u==="drop")return at("git.stash-drop",Px);if(u==="clear")return at("git.stash-clear",Tx)}return null}function Jx(n){let{before:u}=fn(n);if(!u.includes("remove"))return null;let W=_n(u);if(u.some((z)=>Bt(z,"--force"))||W.has("-f"))return at("git.worktree-remove-force",Ix);return null}import{isAbsolute as Rw,join as _w,resolve as xw}from"node:path";var kc="TMPDIR",Oc="IFS",Cp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,bp=/^[A-Za-z_][A-Za-z0-9_]*$/,vp=new Set(["export","typeset","declare","readonly"]),ew=new Set(["builtin","command","time"]),tw=new Set(["do","then","else"]),nw=new Set(["do","then","case"]),Sp=new Set(["done","fi","esac"]),rw=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,ow=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Wo(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function Fo(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function Ep(n,u,v){let W=Wo(u.shellAssignments,v);return n.map((z)=>{if(!Tp(z.text))return t(z);if(z.provenance==="variable")return Rp(z.text,W);if(z.provenance==="command-substitution")return sw(z,v.darwinUserTempDir)??t(z);return z.provenance==="literal"&&rw.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function Rp(n,u){return n.replace(ow,(v,W,z)=>u.get(W??z??"")??v)}var iw=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function sw(n,u){if(n.provenance!=="command-substitution")return null;let v=n.parts.map((z)=>{if(z.provenance==="command-substitution")return iw.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!v.every((z)=>z!==null))return null;let W=v.join("");return/[\s$`*?[]/.test(W)?null:W}function Qn(n,u){let v=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!v)return null;let W=Rp(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function _p(n,u){return{env:n,effectiveEnvAssignments:dw(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function xp(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function Mc(n,u){let v=Ap(n,u),W=n[0]??"";if(nw.has(W))u.bodyDepth+=1;if(W==="elif"||Sp.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(Sp.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((Q)=>{u.shellAssignments.delete(Q)}),u.bodyAssignments.clear();v.assignments.filter((Q)=>Q.persists).forEach((Q)=>{if(u.shellAssignments.set(Q.name,Q.value),u.bodyDepth>0)u.bodyAssignments.add(Q.name);Dc(u,Q)});let z=v.commandIndex;if(z!==-1&&vp.has(n[z]??""))n.filter((Q)=>bp.test(Q)&&Ic(Q)).forEach((Q)=>{uw(u,Q)});let B=z===-1?-1:Pp(n,z);if(B===-1||n[B]!=="unset")return;let X=fw(n,B);if(X===null)return;n.slice(X).forEach((Q)=>{if(u.bodyDepth>0){u.shellAssignments.set(Q,"");return}mw(u,Q)})}function wp(n,u){let v=Ap(n,u).assignments;if(v.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return v.forEach((z)=>{W.set(z.name,z.value)}),W}function Ap(n,u){let v=tw.has(n[0]??"")?1:0,W=n.findIndex((Q,le)=>le>=v&&!Tp(Q)),z=W!==-1&&vp.has(n[Pp(n,W)]??""),B=cw(u);return{assignments:n.flatMap((Q,le)=>{let ue=aw(Q,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!Ns(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function Pp(n,u){let v=u;while(ew.has(n[v]??"")){v+=1;while(n[v]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[v]??""))return u;v+=1}}return v}function Tp(n){return zn(n)!==null||Cp.test(n)}function aw(n,u,v){return zn(n)??lw(n,u,v)}function lw(n,u,v){let W=Ls(n,v,u);if(W)return W;let z=n.match(Cp)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):v.get(z)??""}${n.slice(B+1)}`}}function Ic(n){return n===kc||n===Oc||Jl(n)}function cw(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function dw(n,u){let v=[kc,Oc].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(v.length===0)return u;return new Map([...v,...u??[]])}function Dc(n,u){let v=new Map(n.effectiveEnvAssignments??[]);v.set(u.name,u.value),n.effectiveEnvAssignments=v}function uw(n,u){Dc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function mw(n,u){if(!Ic(u)&&!bp.test(u))return;if(n.shellAssignments.set(u,""),Ns(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!Ic(u)||u===kc||u===Oc||Jo(u)){Dc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let v=new Map(n.effectiveEnvAssignments);v.delete(u),n.effectiveEnvAssignments=v.size===0?void 0:v}function fw(n,u){let v=u+1;while(v<n.length){let W=n[v];if(!W)return null;if(W==="--")return v+1;if(W==="-v"){v++;continue}if(W.startsWith("-"))return null;return v}return v}import{dirname as kp,join as aa,resolve as pw}from"node:path";function la(n,u){return Ql.some((v)=>u?.has(v)||n.has(v))}function Go(n,u,v){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=v.realpath(pw(u));if(W===null||!v.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,X=1;while(X<n.length){let Q=n[X];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-"))break;if(Q==="-C"){let le=n[X+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=Ip(z,le,v);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,X+=2;continue}if(Q.startsWith("-C")&&Q.length>2){let le=Ip(z,Q.slice(2),v);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,X++;continue}if(Q==="--git-dir"||Q==="--work-tree"){B=!0,X+=2;continue}if(Q.startsWith("--git-dir=")||Q.startsWith("--work-tree=")){B=!0,X++;continue}X+=kn.has(Q)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function Ip(n,u,v){try{let W=Pr(n,u,v);return v.isDirectory(W)?W:null}catch{return null}}function Mi(n,u){if(u.entryKind(aa(n,".git"))!=="missing")return n;let v=kp(n);return v===n?null:Mi(v,u)}function ca(n,u,v,W,z){let B=W.paths,X=aa(v,".git"),Q=B.isDirectory(X),le=Q&&!W.isGitDirectory(X),ue=Op(u).filter((be)=>le||be!==v&&Ar(be,v));return No(n,W.env,z).entries.some((be)=>be.key.toLowerCase()==="core.worktree")||ue.some((be)=>B.entryKind(aa(be,"HEAD"))!=="missing"||be!==v&&B.entryKind(aa(be,".git"))!=="missing")||Q&&W.gitDirectoryRedirects(X)}function Op(n){let u=kp(n);return u===n?[n]:[n,...Op(u)]}function Mp(n,u,v){if(!u.localDiscard||!v.worktreeMode||la(v.environment.env,v.envAssignments))return null;let W=Go(n,v.cwd,v.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=v.environment.worktreeFacts(W.gitCwd),B=Mi(W.gitCwd,v.environment.paths);if(!z||B===null||ca(n,W.gitCwd,B,v.environment,v.envAssignments))return null;if(Nc(n,v,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Nc(n,u,v){let{subcommand:W,rest:z}=Dn(n),B=W?.toLowerCase();if(u.dynamicArguments||gw(z)||bw(n,u.environment.env,u.envAssignments,v)||Sw(z)||hw(B,z))return!0;return B==="clean"&&Cw(z)>1}function gw(n){return n.some((u)=>/[$*?[]/.test(u))}function hw(n,u){if(n==="checkout"){let{before:v}=fn(u),W=_n(v,{shortOptsWithValue:Pc}),z=v.some((X)=>Bt(X,"--force"))||W.has("-f"),B=W.has("-B")||v.some((X)=>X==="-B"||X.startsWith("-B"));return z&&B}if(n==="switch"){let{before:v}=fn(u),W=_n(v,{shortOptsWithValue:Tc}),z=v.some((X)=>Bt(X,"--force"))||v.some((X)=>Bt(X,"--discard-changes"))||W.has("-f"),B=v.some((X)=>X==="-C"||X.startsWith("-C")||yw(X))||W.has("-C");return z&&B}return!1}function yw(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function Sw(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function Cw(n){let u=0;for(let v of n){if(v==="--force"){u++;continue}if(v.startsWith("-")&&!v.startsWith("--")){for(let W of v.slice(1))if(W==="f")u++}}return u}function bw(n,u,v,W){if(fr("GIT_CONFIG_PARAMETERS",u,v)!==void 0)return!0;let z=No(n,u,v);if(z.blockedReason!==null)return!0;let B=z.entries.map((Q)=>({key:Q.key.toLowerCase(),value:Q.value}));if(B.some((Q)=>Ew(Q.key)))return!0;let X=B.filter((Q)=>Q.key==="submodule.recurse").at(-1);if(X)return X.value===void 0||vw(X.value);if(df(v))return!0;return W.recursiveSubmodules}function vw(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Ew(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function Dp(n,u,v){let W=n.map((le)=>Qn(le,v.shellAssignments??new Map)??t(le)),z=v.environment.paths,B=Go(W,v.cwd,z),X=v.originalCwd?z.realpath(xw(v.originalCwd)):null;if(u.id.startsWith("git.push-")||X===null||B.gitCwd===null||B.hasExplicitGitContext||la(v.environment.env,v.envAssignments))return null;let Q=u.id==="git.worktree-remove-force"?Aw(n,v.shellAssignments,z):Mi(B.gitCwd,z);if(Q===null||u.id!=="git.worktree-remove-force"&&!ww(Q,B.gitCwd,W,u,v)||!Ao(Q,v.environment)||Ds(Q,v.environment)||Ar(X,Q)||Ar(Q,X))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function ww(n,u,v,W,z){let B=z.environment.paths,X=_w(n,".git");if(B.entryKind(X)!=="present"||ca(v,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(X))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Nc(v,z,le)}function Aw(n,u,v){let W=Dn(n.map(t)).rest,{before:z,after:B}=fn(W.slice(W.indexOf("remove")+1)),X=[...z.filter((be)=>!be.startsWith("-")),...B],Q=X.length===1?X[0]??"":"",le=n.find((be)=>be.text===Q),ue=(le&&Qn(le,u??new Map))??Q;if(!Rw(ue)||/[\s$`*?[]/.test(ue)||v.entryKind(ue)!=="present"||!v.isDirectory(ue))return null;return v.realpath(ue)}var Tw="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Iw=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function da(n,u){return Np(n,u)}function Np(n,u,v){let W=n.map(t),z=pp(W,u.environment.env,u.envAssignments),B=z.blockedReason?Ft(at("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let X=z.tokens;if((cf(u.envAssignments)||gp(W,u.environment.env,u.envAssignments))&&kw(X))return at("git.ssh-env",Tw);let Q=yp(X,(ue)=>{let be=Go(W,u.cwd,u.environment.paths).gitCwd;return be!==null&&u.environment.paths.entryKind(Pw(be,ue))!=="missing"});if(!Q)return null;if(z.expanded||z.blockedReason)return Q;let le=Mp(W,Q,u)??Dp(n,Q,u);if(!le)return Q;return v?.(le),null}function Lp(n,u){let v=null;return{match:Np(n,u,(z)=>{v=z}),relaxation:v}}function kw(n){let{subcommand:u,rest:v}=Dn(n),W=u?.toLowerCase();if(!W)return!1;if(Iw.has(W))return!0;if(W==="archive")return fn(v).before.some((z)=>Bt(z,"--remote"));return W==="remote"&&Ow(v)}function Ow(n){return n.find((u)=>!Mw(u))?.toLowerCase()==="update"}function Mw(n){return n==="-v"||Bt(n,"--verbose")||Bt(n,"--no-verbose")}import{isAbsolute as cA}from"node:path";function Wp(n,u,v,W){let z=n.slice(0,u),B=n.slice(u+v);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function ua(n,u,v){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>v(B).some((X)=>!z.has(W(X))))}var Fp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Dw="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nw="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Lw="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Ww="rm -rf in home directory is dangerous. Change to a project directory first.",Gp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Lw},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Nw},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Ww},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Fp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Dw},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Fp}};function ma(n,u){let v=$n({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=oa(W),B=Fw(n);for(let X of B){let Q=Jr(X.word);if(z&&Q.unsafeBraceExpansion){let le=Ft(cc({kind:"outside_anchored_cwd"},v,u.policy,Gp),u.policy);if(le)return le;continue}for(let le of Q.expandedTargets??[X.text]){let ue=gn(le),be={targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected};if(!z&&v.resolvedCwd&&Xr(ue,v.resolvedCwd,v.protectedGitMetadata,z,v.environment,v.budget))return at("rm.git-metadata",y);if(!z)continue;let Me=Oo(ue,v,u.policy,Gp,be);if(Me)return Me}}return null}function Fw(n){let u=[],v=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){v=!0;continue}if(v){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Mr={kind:"none"},ro={kind:"dynamic"},$p=new Set(["<","<<","<<-","<<<","<&","<>"]),Bp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Gw=/^(?:[0-9]+|[@*])$/,zw=xr.maxWords,Up=xr.maxInputLength;function Hp(n){if(!n||Wt($t(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),v=u[0]?.text;if(v===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(v==="%s")return W.join("");if(v==="%s\\n"||v===`%s
-`)return`${W.join(`
-`)}
-`;if(v.includes("%")||/\\(?![\\nrt])/.test(v))return;return v.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function pa(n){let u=zo(n[1])==="--"?2:1;if(n.length<=u)return Mr;let v=n.slice(u);if(!v.every(Li))return ro;return{kind:"literal",source:v.map(t).join(" ")}}function jp(n){let u=zo(n[1])==="--"?2:1,v=n[u],W=zo(v);if(v===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Mr;if(!Li(v))return ro;return{kind:"literal",source:W}}function ga(n,u){let v=Zp(n);if(v===-1)return Mr;let W=Hw(u);if(!W)return Mr;let z=[],B=W.command?.length??0;for(let X of W.references){let Q=Vw(X,n,v,W.ifs);if(!Q)return ro;if(B+=Q.reduce((le,ue)=>le+ue.length+3,0),z.length+Q.length>zw||B>Up)return ro;z.push(...Q)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ie)].filter((X)=>X!==null).join(" ")}}function Vp(n,u){let v=Zp(n),W=n.slice(v+1),z=/\bIFS\b/.test(u);if(v===-1||!W.every(Li)||z)return u;let B=W.map(zo),X="",Q=null,le=0;while(le<u.length){let ue=u[le]??"",be=Q==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(be){let Me=be[1]??be[2],De=Me==="@"||Me==="*"?B.slice(1):[B[Number(Me)]??""];if(Q!=='"'&&De.some((Ne)=>/[*?[]/.test(Ne)))return u;if(X+=Q==='"'?De.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(Me==="@"?'" "':" "):De.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ie(Le):"").join(" ")).join(" "),X.length>Up)return u;le+=be[0].length;continue}if(ue==="\\"&&Q!=="'"){X+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&Q!=='"'||ue==='"'&&Q!=="'")Q=Q?null:ue;X+=ue,le++}return X}function $o(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function qp(n,u,v,W){if(!xn(n.map(t)).readsStdinAsCommands)return Mr;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&$p.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return z.heredoc&&$o(z.heredoc)?{kind:"literal",source:z.heredoc.body}:Mr;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return ro;return{kind:"literal",source:z.target.text}}if(!v)return Mr;return W===void 0?ro:{kind:"literal",source:W}}function Kp(n){return n.some((u)=>(u.fd===void 0||u.fd===0)&&$p.has(u.operator)&&u.operator!=="<&"&&(u.heredoc!==void 0?$o(u.heredoc):u.target?.provenance==="literal"&&!$w.has(u.target.text)))}function Cr(n,u,v=new Map){let W=xn(n.map(t)).scriptIndex;if(W===null)return Mr;let z=n[W],B=z&&u!==void 0?Fo(z,u):null;if(B!==null)return{kind:"literal",source:B};let X=zo(z);if(Ro(z,X))return{kind:"literal",source:X};let Q=z?Qn(z,v):null;return Q===null?ro:{kind:"literal",source:Q}}var $w=new Set(["/dev/stdin","/dev/fd/0","/proc/self/fd/0"]),Yp=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ni(n,u,v){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(xc).some((W)=>ha(W,v))}var Bw=new Set(["irm","iwr","invoke-restmethod","invoke-webrequest"]);function fa(n,u){let v=$t(n);return Yp.has(v)||u==="powershell"&&Bw.has(v)}function ha(n,u){let v=pr(n.words,u).words.map(t),W=v[0];if(W===void 0)return!1;if(fa(W,n.dialect))return!0;return ap($t(W))&&v.slice(1).some((z)=>!Uw(z)&&fa(z,n.dialect))}function Uw(n){return n.includes("/")&&!n.startsWith("/")}function Gc(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],v=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!v)return!1;if(!(u.text==="eval"&&v.quoted&&v.parts.length===3&&v.parts[0]?.raw==='"'&&v.parts[1]?.provenance==="command-substitution"&&v.parts[1].raw.startsWith("$(")&&v.parts[2]?.raw==='"'||u.text==="eval"&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let X=B.words[0]?.text;if(X===void 0||zn(X)!==null)return!1;let Q=Wt($t(X));return!Yp.has(Q)&&!Jt.has(Q)&&!eo(Q)}function Zp(n){return xn(n.map(t)).commandIndex??-1}function Hw(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),v=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(v),z=(W?.[3]??v).split(/\s+/).map(jw);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
-`}}function jw(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),v=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??v;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function Vw(n,u,v,W){let z=u.slice(v+2);if(n.parameter==="@")return n.quoted?Lc(z):qw(z,W);if(n.parameter==="*"){let Q=Lc(z);if(!Q)return;let le=Q.join(W[0]??"");return n.quoted?[le]:Wc(le,W)}let B=u[v+1+n.parameter];if(B&&!Li(B))return;let X=zo(B);return n.quoted?[X]:Wc(X,W)}function Lc(n){return n.every(Li)?n.map(t):void 0}function qw(n,u){let v=Lc(n);if(!v)return;let W=v.map((z)=>Wc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Wc(n,u){if(["*","?","[","]"].some((v)=>n.includes(v)))return;if(u==="")return n===""?[]:[n];if(u===` 	
-`)return n.trim().split(/\s+/).filter(Boolean);if(u.length!==1)return;return u===" "||u==="\t"||u===`
-`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function Li(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function zo(n){return n?t(n):""}function Ie(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function zc(n,u){return Fc(C(n,"posix"),u)}function Wi(n){return zc(n,new Set(Array.from(n.matchAll(Bp)).flatMap((u)=>{let v=u[1]??u[2];return v===void 0?[]:[v]})))}function Fc(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let v=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(Fc(W.body,v))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>Fc(z,v))||Xp(W.words,v))return!0;Qw(W,v)}return!1}function Xp(n,u){let v=n.findIndex((X)=>zn(X.text)===null);if(v===-1)return!1;let W=n[v];if(!W)return!1;if(Di(W,u))return!0;let z=$t(W.text);if(z==="source"||z==="."){let X=n[v+1]?.text==="--"?v+2:v+1;return zp(n[X],u)}if(Jt.has(z)){let X=n.slice(v),Q=X.map((be)=>be.text),le=xn(Q),ue=le.commandIndex??le.scriptIndex;return!Xn(Q)&&ue!==null&&zp(X[ue],u)}let B=Kw(n,v,u);if(B===null)return!1;if(B===-1)return!0;return Xp(n.slice(B),u)}function Kw(n,u,v){let W=$t(n[u]?.text??"");if(W==="command")return Yw(n,u+1);if(W==="exec")return Zw(n,u+1);if(W==="env")return Xw(n,u+1,v);return null}function Yw(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return v}return null}function Zw(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(W==="-a"){v++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return v}return null}function Xw(n,u,v){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Di(n[W+1],v)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Di(z,v)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(zn(B))continue;return W}return null}function Qw(n,u){if(!n.words.every((v)=>zn(v.text)!==null))return;for(let v of n.words){let W=zn(v.text);if(!W)continue;if(Di(v,u))u.add(W.name)}}function Di(n,u){if(!n)return!1;return n.parts.filter((v)=>v.provenance==="variable").some((v)=>Array.from(v.raw.matchAll(Bp)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(Gw.test(z)||u.has(z))}))}function zp(n,u){return!!n&&(n.parts.some((v)=>v.provenance!=="literal"&&v.provenance!=="variable")||Di(n,u))}var $c="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Bc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Jw="__CC_SAFETY_NET_XARGS_INPUT__",ya="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Sa="rm",eA=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tA=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,nA=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rA=/^(?:[0-9]+|[@*])$/;function eg(n,u){let v=n.map(t),{childStart:W,replacementToken:z}=oo(v),B=v.slice(W),X=at("xargs.shell-dynamic",Bc);if(iA(B,z,u)&&Ft(X,u.policy))return Ft(X,u.policy);for(let Q of Zn(B,u)){let le=Q.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Ft(X,u.policy):null;if(ue)return ue;let be=sg(le,z,Q.wrapperEnvAssignments),Me=Q.head==="rm"&&z!==null&&og(le,z),De=u.analyzeChild(le,{...to(Q,u),dynamicInput:be,dynamicSourceInput:Me||ng(le,Q.head,z,Q.wrapperEnvAssignments,be,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:Me,shellDynamicMatch:X,dynamicSourceMatch:X,rmDynamicMatch:at("xargs.rm-recursive-force-dynamic",$c)});if(De)return De;let Oe=oA(le,z,u.policy?.rules??[],Ft(X,u.policy));if(Oe)return Oe;if(Q.head==="git"){let Le=z===null?[...le,Jw]:le,We=z!==null&&(le.some((st)=>st.includes(z))||Array.from(Q.envAssignments.values()).some((st)=>st.includes(z))),ze=u.analyzeChild(Le,{...to(Q,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(ze)return ze}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function oA(n,u,v,W){if(v.length===0)return null;if(u===null){for(let B of v){let X=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],v);if(X)return X}return null}let z=$t(n[0]??"");if(!v.some((B)=>$t(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function tg(n,u,v){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=Wp(n,W,u.length,v);return z===null?[]:[z]}function ng(n,u,v,W,z,B,X){if(Jt.has(u)){if(Xn(n))return!1;if(v!==null&&sA(n,v,X))return!0;let Q=Bn(n);if(!Q){let le=Cr(Xt(n));if(le.kind==="literal")return v!==null&&le.source.includes(v);return le.kind==="none"&&z}if(v!==null&&Q.includes(v)&&!rg(Q,v,X))return!0;if(Gn(Q))return!0;return aA(Q,v,W)}if(On(u))return Qp(n,v,Xs,Hf(u));if(Fn.has(u))return Qp(n,v,Sc,tp);if(u==="eval"){let Q=pa(Xt(n));if(Q.kind==="dynamic")return!0;if(v!==null)return Q.kind==="literal"&&Q.source.includes(v);return z}if(u==="find")return lA(n,v,B);if(u==="git"){let Q=Dn(n);return v===null?Q.subcommand===null:(Q.subcommand?.includes(v)??!1)||Q.subcommand!==null&&Lo.has(Q.subcommand.toLowerCase())&&ig(Q.rest,v).some((le)=>le.includes(v))}return!1}function rg(n,u,v){if(v===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Gn(B)===null&&v(B)===null}function Qp(n,u,v,W){let z=v(n);if(u===null)return z.optionsOpen||v([...n,ya]).sources.some((Q)=>Q.value===ya);if(z.sources.some((Q)=>Q.value.includes(u)))return!0;let B=W.flatMap((Q)=>[Q.selector,...Q.valueForm==="attached-only"||Q.valueForm==="attached-or-separate"?[`${Q.selector}${ya}`]:[],...Q.valueForm==="equals-or-separate"?[`${Q.selector}=${ya}`]:[]]),X=new Set(B.flatMap((Q)=>n.flatMap((le)=>tg(le,u,Q))));return ua(z.sources,X,(Q)=>v(n.map((le)=>le.replaceAll(u,Q))).sources)}function iA(n,u,v){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(Zn(n,v),(B)=>B.head)),z=u===null?[...n,Sa]:n.map((B,X)=>X===0?B:B.replaceAll(u,Sa));return Array.from(Zn(z,v)).some((B)=>B.head===Sa&&!W.has(Sa))}function og(n,u){return ig(n.slice(1),u).some((v)=>v.includes(u)&&(v.startsWith("-")||v.startsWith(u)))}function ig(n,u){let v=n.findIndex((W)=>W==="--"&&!W.includes(u));return v===-1?n:n.slice(0,v)}function sg(n,u,v){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(v.values()).some((W)=>W.includes(u))}function sA(n,u,v){let W=xn(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!rg(z,u,v)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((X)=>n.some((Q,le)=>{if(le===0||!Q.includes(u))return!1;return tg(Q,u,X).some((be)=>{let Me=n.map((Oe,Ne)=>Ne===le?Oe.replaceAll(u,be):Oe),De=xn(Me);if(De.commandIndex===null&&De.scriptIndex===null)return!1;if(W.commandIndex===null&&De.commandIndex!==null)return!0;if(W.scriptIndex===null&&De.scriptIndex!==null)return!0;if(De.commandIndex!==null&&(Me[De.commandIndex]??"").includes(be))return!0;return De.scriptIndex!==null&&(Me[De.scriptIndex]??"").includes(be)})}))}function aA(n,u,v){let W=new Set(u===null?[]:Array.from(v).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(eA))if(Jp(z,W))return!0;for(let z of n.matchAll(tA))for(let B of(z[1]??"").matchAll(nA))if(Jp(B,W))return!0;return zc(n,W)}function Jp(n,u){let v=n[1]??n[2];return v!==void 0&&(rA.test(v)||u.has(v))}function lA(n,u,v){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let X=n[B]??"";if(!W&&!X.startsWith("-")&&X!=="!"&&X!=="("){if(X.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(sr(X)){let le=Do(n,B);B=le.nextIndex-1;for(let ue of Zn(le.tokens,{environment:v,cwd:void 0})){let be=sg(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&og(ue.tokens,u)||ng(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,be,v))return!0}continue}let Q=Sr(X);if(Q>0){if(z=Q,X.includes(u))return!0;continue}if(X.includes(u))return!0}return!1}function oo(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),v=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:v};if(!z.startsWith("-"))return{childStart:W,replacementToken:v};if(z==="-I"){v=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){v=z.slice(2),W++;continue}if(z==="--replace"){v="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);v=B===""?"{}":B,W++;continue}if(z==="-J"){v=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:v}}var Fi="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Gi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",dA="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",uA="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ba=/\{[^{}\s]*\}/g,ag=/\{\}|\{-?\d+\}/g,lg=/[\s;&|<>()$`\\"']/,mA=["e","f","source","file","-e","-f","--source","--file"],fA=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],pA=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),gA=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),cg=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),hA=new Set(["--workdir","--wd"]),dg="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Un(n,u){for(let v of n){let W=u(v);if(W)return W}return null}function fg(n){return Un([...n],(u)=>Gn(u))}function pg(n,u){let v=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=Bo(u);if(Ne)return Ne}if(v.length===2&&(v[1]==="--version"||v[1]==="--help"))return null;let z=wg(v),{template:B,jobs:X,runsRemotely:Q,readsCommandsFromInput:le,unsupported:ue,workdir:be,dryRun:Me}=z;if(ue){let Ne=Bo(u);if(Ne)return Ne;let Le=fg(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=RA(u);if(Ne)return Ne}if(be!==void 0&&Q){let Ne=Bo(u);if(Ne)return Ne}let De=_A(be,u.cwd,u.environment.paths);if(De===null){let Ne=Bo(u);if(Ne)return Ne}let Oe=Q?{...u,cwd:void 0,originalCwd:void 0}:De===null||De===void 0||De===u.cwd?u:{...u,cwd:De};if(Me){if([...Zn(B,Oe)].flatMap((Le)=>[...Le.envAssignments.values()]).some(jc)){let Le=Bo(u);if(Le)return Le}return null}if(B.length===0){let Ne=X.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=bg(Oe.envAssignments,Oe.cwd,Q);return Un(Ne,(We)=>u.analyzeNested(We,Le))}return Un(Zn(B,Oe),(Ne)=>yA(Ne,z,u,Oe))}function yA(n,u,v,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:X}=u,Q=n.tokens,le=[...n.envAssignments.values()];if(le.some(_g)){let lt=Bo(v);if(lt)return lt}let ue=fg(le);if(ue)return ue;let be=le.some(jt),Me=z||be,De=X&&Me,Oe=bg(n.envAssignments,n.wrapperCwd,B||De),Ne=Me?{...Oe,worktreeMode:!1}:Oe,Le=Q.join(" "),We=jt(Le.split(/[ \t\n=]/,1)[0]??""),ze=!u.quotesCommand&&(We||Q.some((lt)=>lg.test(lt))),st=We||lg.test(Q[0]??""),it=ze&&st&&u.jobs.length>0?null:SA(n,u,v,W,Ne,be);if(it||!ze)return it;return gg(jt(Le)?Le:`${Le} {}`,!We,n,u,v,W,Ne)}function SA(n,u,v,W,z,B){let{jobs:X,templateHasPlaceholder:Q,runsRemotely:le,usesStdin:ue}=u,be=n.tokens,Me=Q||B;if(Jt.has(n.head)){let Oe=()=>{if(!Q||X.length===0)return null;return Un(X,(We)=>v.analyzeChild(Ca(be,We,v.budget),to(n,W)))};if(Xn(be))return Oe();if(ia(be))return or();let Ne=Bn(be);if(Ne){if(xg(Ne)){let it=Dr(v);if(it)return it;if(X.length===0)return null;return Un(X,(lt)=>v.analyzeNested(Eg(Ne,lt,v.budget),z))}if(jt(Ne))return gg(Ne,!1,n,u,v,W,z);let We=!B&&(!Q||X.length>0)?(X.length>0?X:[void 0]).map((it)=>ga(Xt(it===void 0?be:Q?be.map((lt)=>vg(lt,it)):[...be,...it]),Ne)):[];if(We.some((it)=>it.kind==="dynamic")){let it=Dr(v);if(it)return it}let ze=We.flatMap((it)=>it.kind==="literal"?[it.source]:[]);if(ze.length>0)return v.budget.charge("derivedTokens",ze.length),Un(ze,(it)=>v.analyzeNested(it,z));if(Wi(Ne)){let it=Dr(v);if(it)return it}let st=v.analyzeNested(Ne,z);if(st)return st;if(Me)return Dr(v);return null}let Le=Cr(Xt(be));if(Le.kind==="dynamic"||Le.kind==="literal"&&jt(Le.source))return Dr(v)??Oe();if(Le.kind==="literal")return Oe();if(X.length>0){let We=Dr(v);if(We)return We;let ze=Oe();if(ze)return ze;if(Q)return null;let st=X.flatMap((it)=>it[0]===void 0?[]:[it[0]]);return v.budget.charge("derivedTokens",st.length),Un(st,(it)=>v.analyzeNested(it,z))}if(Me||ue)return Dr(v)??Oe();return null}if(n.head==="rm"&&yr(be)){if(Q&&X.length>0)return Un(X,(Ne)=>Uc(Ca(be,Ne,v.budget,ag),n.cwd,W));if(X.length>0)return Un(X,(Ne)=>Uc(mg(be,Ne,v.budget),n.cwd,W));let Oe=Uc(be.flatMap((Ne,Le)=>{if(Le===0||!jt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(ag,"")]:[]}),n.cwd,W);if(Oe)return Oe;return Cg(v)}let De=X.length>0?X:[void 0];return Un(De,(Oe)=>{let Ne=Oe===void 0?be:Q?Ca(be,Oe,v.budget):mg(be,Oe,v.budget),Le=at("parallel.shell-dynamic",Gi),We=ue&&n.head==="find"?EA(Ne,W):null,ze=yg(Ne,ue,v)??We?.customResult??null,st=$t(n.head),it=ue&&(st==="rm"&&Hc(Ne)||st==="xargs"&&Sg(Ne)||We?.rmOptions===!0),lt=ue&&(it||We?.executedSource===!0||We===null&&hg(Ne,st)),Et=v.analyzeChild(Ne,{...to(n,W),worktreeMode:le||ue||Me?!1:v.worktreeMode,dynamicInput:ue||Me,dynamicRmInput:it,dynamicSourceInput:ze!==null||lt,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:at("parallel.rm-recursive-force-dynamic",Fi)});if(lt){let Rt=Ft(Le,v.policy);if(Rt)return Rt}return Et??ze??F(Ne,v.policy?.rules??[])})}function gg(n,u,v,W,z,B,X){if(W.jobs.length>0)return Un(W.jobs,(ue)=>z.analyzeNested(Eg(n,u?ue.map(Ie):ue,z.budget),X));let Q=Oi(n);if(Q?.[0]&&$t(Q[0])==="rm"&&yr(Q)){let ue=Cg(z);if(ue)return ue}return(Q?z.analyzeChild(Q,{...to(v,B),dynamicInput:W.usesStdin,shellDynamicMatch:at("parallel.shell-dynamic",Gi),rmDynamicMatch:at("parallel.rm-recursive-force-dynamic",Fi)}):null)??z.analyzeNested(n,X)}function hg(n,u){if(jt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(Jt.has(u))return vA(n);if(u==="git")return CA(n);if(u==="find")return!0;if(Fn.has(u))return ug(n,mA,Ii);if(On(u))return ug(n,fA,Zs);return!1}function Hc(n){let u=n.indexOf("--"),v=n.slice(1,u===-1?void 0:u);if(!n.some(jt))return u===-1;return v.some((z)=>jt(z)&&(z.startsWith("-")||xg(z)))}function CA(n){if(bA(n))return!0;let u=Dn(n);if(u.subcommand===null||jt(u.subcommand))return!0;if(!Lo.has(u.subcommand.toLowerCase()))return!1;let v=u.rest.indexOf("--"),W=u.rest.slice(0,v===-1?void 0:v);if(!n.some(jt))return v===-1;return W.some(jt)}function bA(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v||v==="--"||!v.startsWith("-"))return!1;if(v==="-c"||v==="--config-env"){if(jt(n[u+1]??""))return!0;u++;continue}if(v.startsWith("-c")&&v.length>2||v.startsWith("--config-env=")){if(jt(v))return!0;continue}if(jt(v))return!0}return!1}function vA(n){if(Xn(n))return!1;let u=Bn(n);if(u!==null)return jt(u);let v=Cr(Xt(n));if(v.kind==="literal")return jt(v.source);if(v.kind==="dynamic")return!0;return!n.some(jt)}function ug(n,u,v){let W=v(n);if(W.some((z)=>jt(z.value)))return!0;if(!n.some(jt))return v([...n,dg]).some((z)=>z.value===dg);return ua(W,u,(z)=>v(n.map((B)=>vg(B,[z]))))}function yg(n,u,v){let W=v.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>$t(B.command)===$t(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(jt))return Dr(v);return Un(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function EA(n,u){let v={customResult:null,executedSource:!n.some(jt),rmOptions:!1},W=!1,z=0,B=null,X=()=>{if(!B?.some(jt))return;for(let Q of Zn(B,u))v.executedSource||=hg(Q.tokens,Q.head),v.rmOptions||=Q.head==="rm"&&Hc(Q.tokens)||Q.head==="xargs"&&Sg(Q.tokens),v.customResult??=yg(Q.tokens,!0,u)};for(let Q of n.slice(1)){if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){v.executedSource||=jt(Q);continue}if(W=!0,B){if(Q===";"||Q==="+"){X(),B=null;continue}B.push(Q);continue}if(z>0){z--;continue}if(sr(Q)){B=[],v.executedSource||=jt(Q);continue}let le=Sr(Q);if(le>0){z=le,v.executedSource||=jt(Q);continue}v.executedSource||=jt(Q)}return X(),v}function Sg(n){let u=n.slice(oo(n).childStart);return $t(u[0]??"")==="rm"&&Hc(u)}function va(n,u){return(v)=>Ft(at(n,u),v.policy)}var Dr=va("parallel.shell-dynamic",Gi),RA=va("parallel.command-stream-dynamic",dA),Bo=va("parallel.command-stream-dynamic",uA),Cg=va("parallel.rm-recursive-force-dynamic",Fi);function Uc(n,u,v){return Ft(ma(Xt(n),{environment:v.environment,cwd:u,budget:v.budget,originalCwd:v.originalCwd,strict:v.strict,paranoid:v.paranoidRm,allowTmpdirVar:v.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(v.envAssignments??new Map,v.environment),trustedTmpdirValue:wo(v.envAssignments??new Map,v.environment),protectedGitMetadata:v.protectedGitMetadata,policy:v.policy}),v.policy)}function bg(n,u,v){let W={};if(n)W.envAssignments=n;if(v)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function vg(n,u){return n.replace(ba,(v)=>Rg(v,u))}function Ca(n,u,v,W=ba){return v.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let X=Rg(B,u);return v.charge("derivedTokens",Math.max(1,Math.ceil(X.length/64))),X}))}function Eg(n,u,v){return Ca([n],u,v)[0]??""}function mg(n,u,v){return v.charge("derivedTokens",n.length+u.length),[...n,...u]}function Rg(n,u){let v=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(v===void 0)return u[0]??"";let W=Number(v);return u[W>0?W-1:u.length+W]??""}function jt(n){return n.search(ba)!==-1}function _g(n){if(jc(n))return!0;for(let u of n.matchAll(ba))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function jc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function xg(n){return/^\{[^{}\s]*\}$/.test(n)}function _A(n,u,v){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!cA(n))return null;try{return Pr(u??n,n,v)}catch{return null}}function wg(n){let u=1,v=[],W=n.length,z=-1,B=!1,X=!1,Q=!1,le,ue=!1,be=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let lt=vc(n,u+1);v.push(...lt.templateTokens),W=u+1,z=lt.markerIndex;break}if(!Le.startsWith("-")){let lt=vc(n,u);v.push(...lt.templateTokens),W=u,z=lt.markerIndex;break}let We=n[u+1],ze=Le.indexOf("="),st=ze===-1?Le:Le.slice(0,ze),it=ze===-1?void 0:Le.slice(ze+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){be||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){be=!0,u+=2;continue}if(st==="--replace"||Le.startsWith("-i")&&Le.length>2){let lt=st==="--replace"?it:Le.slice(2);be||=lt!==""&&lt!=="{}",u++;continue}if(Le==="-a"||gA.has(st)){be=!0,u+=it===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){X=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){Q=!0,u++;continue}if(st==="--env"){be=!0,u+=it===void 0?2:1;continue}if(cg.has(st)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=cg.has(Le)?2:1;continue}if(hA.has(st)){be=!0;let lt=it??We;if(lt===void 0||lt===":::"||lt==="--"){u++;continue}le=lt,u+=it===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&it!==void 0){u++;continue}if(pA.has(Le)){if(We===void 0||We===":::"||We==="--"){be=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}be||=v.some(ue?jc:_g);let Me=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let ze=n[We];if(ze===":::"){Me.push(Le),Le=[];continue}if(ze!==void 0)Le.push(ze)}Me.push(Le)}be||=Me.length>1;let De=xA(Me),Oe=v.some(jt),Ne=v.length===0&&z===-1;return{template:v,jobs:De,childStart:W,templateHasPlaceholder:Oe,runsRemotely:B,quotesCommand:X,usesStdin:Q||z===-1,readsCommandsFromInput:Ne,unsupported:be,workdir:le,dryRun:ue}}function xA(n){if(n.length===0||n.some((v)=>v.length===0))return[];let u=[[]];for(let[v,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let X of u)X.push(B);if(u.length*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let X of W){if((z.length+1)*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,X])}u=z}return u}function Ag(n){return wg(n).childStart}var wA="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ea="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function qc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function Vc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function Tg(n,u,v,W,z=!1,B){let Q=(di(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&ln(B,"shell.dynamic-executable",z)?at("shell.dynamic-executable",wA):null;return Ft(Q,B)??Ig(n,u,v,z,B)}function Ig(n,u,v,W,z){if(u.length<2)return null;let B=u.flatMap((Q,le)=>qc(Q)?[le]:[]);if(B.length===0)return null;let X=$t(u[0]?.text??"");if(X==="git"){let Q=ce(n,u),le=PA(Q);if(ln(z,"shell.dynamic-structure",W)&&B.some((Me)=>Me<=le))return Ft(at("shell.dynamic-structure",Ea),z);if(Ft(da(Q,{environment:v}),z))return null;let ue=u[le]?.text.toLowerCase(),be=Q.findIndex((Me,De)=>De>le&&t(Me)==="--");if(ln(z,"shell.dynamic-structure",W)&&ue&&Lo.has(ue)&&B.some((Me)=>Me>le&&(be===-1||Me<be)))return Ft(at("shell.dynamic-structure",Ea),z);return null}if(X==="find")return ln(z,"shell.dynamic-structure",W)&&TA(u)?Ft(at("shell.dynamic-structure",Ea),z):null;if(X==="rm"){let Q=u.findIndex((ue,be)=>be>0&&t(ue)==="--"),le=yr(u.map(t));return ln(z,"shell.dynamic-structure",W)&&B.some((ue)=>(Q===-1||ue<Q)&&(ue<u.length-1||!le))?Ft(at("shell.dynamic-structure",Ea),z):null}if(X==="xargs")return Pg(n,u.slice(oo(u.map(t)).childStart),"xargs",v,W,z);if(X==="parallel")return Pg(n,u.slice(Ag(u.map(t))),"parallel",v,W,z);return null}function Pg(n,u,v,W,z,B){if(u.length===0)return null;let X=AA(u,W);if(di(n,X)){let le=Ft(at(`${v}.shell-dynamic`,v==="xargs"?Bc:Gi),B);if(le)return le}let Q=Ig(n,X,W,z,B);if(Q)return Q;if(X[0]?.text==="rm"&&X.slice(1).some((le)=>qc(le)&&Vc(le)))return Ft(at(`${v}.rm-recursive-force-dynamic`,v==="xargs"?$c:Fi),B);return null}function AA(n,u){let v=pr(n,u),W=v.rewritten?Xt(v.words.map(t)):v.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function PA(n){let u=1;while(u<n.length){let v=n[u],W=v?t(v):"";if(kn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function TA(n){let u=!1,v=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let X=n[B];if(!X)continue;let Q=qc(X);if(v>0){v--;continue}if(z){if(X.text===";"||X.text==="+"){z=!1,u=!0,W=!1;continue}if(Q&&(W||Vc(X)))return!0;W=!1;continue}if(!u&&!X.text.startsWith("-")){if(Q&&(B>1||Vc(X)))return!0;continue}if(u=!0,Q)return!0;let le=Sr(X.text);if(le>0){v=le;continue}if(sr(X.text))z=!0,W=!0}return!1}function Kc(n,u){return n.some((v)=>{if(v.value==="-"&&(v.kind==="main-script"||v.kind==="program-file"))return!0;return!Ro(u[v.tokenIndex],v.value)})}var IA="unshare creating a user namespace grants root inside it, a common step toward privilege escalation. Ask the user to run it manually if it is needed.",kA=/^--(?:user|map-root-user|map-current-user|map-auto|map-subids|map-(?:user|group)s?|owner|mount-binfmt|load-interp)(?:=|$)/,OA=/[Urcl]/,MA=/[RwSGl]/,DA=new Set(["--propagation","--setgroups","--root","--wd","--setuid","--setgid","--map-user","--map-group","--map-users","--map-groups","--owner","--whitelist-env","--load-interp"]);function kg(n){let u=n.slice(1).search(MA);return u===-1?n.length:u+1}function NA(n){return DA.has(n)||/^-[^-]/.test(n)&&kg(n)===n.length-1}function LA(n){return n.startsWith("--")?kA.test(n):OA.test(n.slice(1,kg(n)+1))}function Og(n,u){if(n!=="unshare")return null;let v=u.slice(1),W=(B)=>NA(v[B-1]??""),z=v.findIndex((B,X)=>!W(X)&&(B==="--"||!B.startsWith("-")));return v.slice(0,z===-1?void 0:z).some((B,X)=>!W(X)&&LA(B))?at("unshare.user-namespace",IA):null}var WA="This reaches a cloud metadata endpoint, which hands out instance credentials. Ask the user to run metadata requests manually if they are needed.",FA="This uploads data to a remote host, which can send local files or secrets off the machine. Send it to localhost instead, or ask the user to run the upload manually if it is needed.",GA=/(?<![\w.-])(?:169\.254\.169\.254|169\.254\.170\.23|169\.254\.170\.2|100\.100\.100\.200|metadata\.google\.internal|metadata\.goog)(?![\w-]|\.[\w-])|(?<![\w:])fd00:ec2::(?:254|23)(?![\w:])/i,Yc=new Set(["xargs","find"]),Mg=(n)=>new Map(Object.entries(n).flatMap(([u,v])=>v.map((W)=>[W,u]))),Dg=new Map([["curl",Mg({data:["-d","--data","--data-ascii","--data-binary","--data-raw","--data-urlencode","--json"],upload:["-F","--form","--form-string","-T","--upload-file"],url:["--url","-x","--proxy","--preproxy"],source:["-K","--config"],local:["--unix-socket","--abstract-unix-socket"],get:["-G","--get"],value:[..."ACDEHPQUXYbcehmortuwyz".split("").map((n)=>`-${n}`),"--output","--output-dir","--header","--proxy-header","--request","--user-agent","--user","--proxy-user","--max-time","--connect-timeout","--write-out","--cookie","--cookie-jar","--referer","--retry","--retry-delay","--retry-max-time","--cert","--key","--cacert","--capath","--range","--resolve","--connect-to","--limit-rate","--oauth2-bearer","--dump-header","--continue-at","--time-cond","--interface","--max-filesize","--max-redirs","--noproxy","--url-query","--aws-sigv4","--variable","--stderr","--trace","--trace-ascii"]})],["wget",Mg({upload:["--post-data","--post-file","--body-data","--body-file"],source:["-i","--input-file"],value:[..."ABDIOPQRTUXaelotw".split("").map((n)=>`-${n}`),"--output-document","--output-file","--append-output","--header","--user-agent","--method","--timeout","--tries","--user","--password","--directory-prefix","--execute","--wait","--referer","--load-cookies","--save-cookies","--ca-certificate","--certificate","--private-key"]})]]),zA=/^(?:localhost|[a-z\d-]+(?:\.[a-z\d-]+)*\.localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\])$/;function Lg(n,u){if($A(n,u))return at("network.cloud-metadata",WA);return UA(n,u)?at("network.upload-remote",FA):null}function $A(n,u){return(Yc.has(n)?u.slice(1).some(Ng):Ng(n))&&u.some((W,z)=>!BA(u[z-1],W)&&GA.test(W))}function Ng(n){let u=Zc(n);return as.has(u)||On(u)}function BA(n,u){return n==="--noproxy"||u.startsWith("--noproxy=")}function UA(n,u){let v=Yc.has(n)?u.findIndex((Oe,Ne)=>Ne>0&&Dg.has(Zc(Oe))):0,W=Dg.get(Zc(u[v]??n));if(v<0||W===void 0)return!1;let z=u.slice(v+1),B=z.findIndex((Oe)=>Oe===";"||Oe==="+"),X=B<0||!Yc.has(n)?z:z.slice(0,B),Q=new Set,le=[],ue=(Oe,Ne)=>{if(Q.add(Oe),Oe==="url"&&Ne!=="")le.push(Ne);if(Oe==="source")le.push("")},be=0,Me=!1;while(be<X.length){let Oe=X[be]??"";if(be++,Me||!Oe.startsWith("-")||Oe==="-"){le.push(Oe);continue}if(Oe==="--"){Me=!0;continue}if(Oe.startsWith("--")){let st=Oe.indexOf("="),it=W.get(st<0?Oe:Oe.slice(0,st));if(it===void 0)continue;let lt=it!=="get",Et=st>=0?Oe.slice(st+1):lt?X[be]??"":"";if(lt&&st<0)be++;ue(it,Et);continue}let Ne=Oe.slice(1).split(""),Le=Ne.findIndex((st)=>{let it=W.get(`-${st}`);return it!==void 0&&it!=="get"});if((Le<0?Ne:Ne.slice(0,Le)).some((st)=>W.get(`-${st}`)==="get"))Q.add("get");if(Le<0)continue;let We=W.get(`-${Oe[Le+1]}`)??"value",ze=Oe.slice(Le+2);if(ze==="")be++;ue(We,ze===""?X[be-1]??"":ze)}return(Q.has("upload")||Q.has("data")&&!Q.has("get"))&&!Q.has("local")&&!(le.length>0&&le.every(HA))}function Zc(n){return $t(Wt(n))}function HA(n){let u=n.replace(/^[a-z][a-z\d+.-]*:\/\//i,"").split(/[/?#]/)[0]??"",v=u.slice(u.lastIndexOf("@")+1).toLowerCase(),W=v.startsWith("[")?v.slice(0,v.indexOf("]")+1):v.split(":")[0];return zA.test(W??"")}var Wg="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",jA="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",VA="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",qA="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",KA="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",YA="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",ZA={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:qA},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:VA},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:YA},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Wg},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:jA},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Wg}},XA=/^\/\/?[ck]$/i,Fg=/[&|]+/,QA=/(?:"[^"]*"|[^\s"])+/g,JA=/[\^%!]/,eP=/\\"./s,tP=/(^|\/)[*.]*\*[*.]*$/,nP=/^"?[\\/]+[?.][\\/]/,rP=new Set(["rmdir","rd","del","erase"]),oP=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,iP=/\/s(?!\w)/i,sP=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Gg(n,u){let v=n.map(t),W=v.findIndex((De)=>XA.test(De));if(W===-1)return null;let z=v.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,X=B.split(Fg).map((De)=>{let Oe=De.match(QA)??[],Ne=Oe.findIndex((We)=>rP.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Oe.slice(Ne);return{piece:De,tokens:Oe,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),Q=X.filter((De)=>De.recursiveDelete),le=Q.length>0||oP.test(B)&&iP.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((De)=>eP.test(De))||Q.some((De)=>De.tokens.some((Oe)=>nP.test(Oe)))))return at("cmd.recursive-delete-escaped-quote",KA);let ue=$n({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),be=X.reduce((De,Oe)=>De??(Oe.recursiveDelete?aP(Oe.deleteTokens,ue,u.policy):u.analyzeNested(Oe.piece)),null),Me=le&&(Q.length===0||JA.test(B)||sP.test(B)||B.includes('"')&&Fg.test(B));return be??(Me?or():null)}function aP(n,u,v){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??Oo(Pi(z.replaceAll('"',"")).replace(tP,"$1*"),u,v,ZA),null)}var lP="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",cP=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,dP=/^-(?:executionpolicy|ep)$/i,uP=/^-(?:command|c)$/i,mP=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,fP="encodedcommand",pP=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,gP=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,hP=/[$`]/,yP="--%";function zg(n,u){let v=n.map(t),W=v.every((B,X)=>X===0||B!==yP&&SP(n[X],B))?Qc(v):void 0;if(W!==void 0)return u(W);if(v.some(CP))return or();let z=v.join(" ");return pP.test(z)&&gP.test(z)?at("powershell.nested-recursive-delete-unread",lP):null}function Qc(n){let u=Xc(n,1),v=u===void 0?[]:n.slice(u+1);return v.length>0?v.join(" "):void 0}function Xc(n,u){let v=n[u]??"";if(uP.test(v))return u;if(cP.test(v))return Xc(n,u+1);return dP.test(v)?Xc(n,u+2):void 0}function SP(n,u){return n?.provenance==="unknown"?!hP.test(u):Ro(n,u)}function CP(n){let u=mP.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||fP.startsWith(u))}var bP="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",vP="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",EP=/[efBMT@]/,RP=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function $g(n,u){let v=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],be=ue?t(ue):"";if(B++,!ue)continue;if(z||be==="-"||!be.startsWith("-")){v.push(ue);continue}if(be==="--"){z=!0;continue}if(be.startsWith("--")){if(W||=be==="--del"||be.startsWith("--dele"),!be.includes("=")&&RP.has(be.slice(2)))B++;continue}if(be.slice(1).search(EP)===be.length-2)B++}let X=v.slice(1).filter((ue)=>!_P(t(ue)));if(!W||X.length===0)return null;let Q=$n({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=X.flatMap((ue)=>{let be=Jr(ue);return(be.expandedTargets??[t(ue)]).map((Me)=>ir(Me,Q,{targetIsLiteral:be.expandedTargets!==void 0||be.targetIsLiteral,tmpdirWordSplittingProtected:be.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return at("rm.recursive-force-root-or-home",vP);if(le.includes("git_metadata_target"))return at("rm.git-metadata",y);if(Ys(X,u))return null;return Ft(at("rsync.delete",bP),u.policy)}function _P(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Ug=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>ma(n.words,Ra(n))},{heads:new Set(["cmd"]),analyze:(n)=>Gg(n.words,{...Ra(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>zg(n.parsedWords,(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>da(n.words,Jc(n))},{heads:new Set(["find"]),analyze:(n)=>mp(n.words,{...Ra(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>$g(n.words,{...Ra(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>eg(n.words,{...Bg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Nr(n.options.analyzeNested(u,v))})},{heads:new Set(["parallel"]),analyze:(n)=>pg(n.words,{...Bg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Nr(n.options.analyzeNested(u,v))})}];function Bg(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Nr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function Ra(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(n.envAssignments,n.options.environment),trustedTmpdirValue:wo(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function Jc(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function qg(n){return Ug.find((u)=>u.heads.has(n))?.analyze}function Ho(n,u,v){let W=v.trace;if(n.length===0)return null;let z=v.commandView?.dialect??"posix",B=(ut)=>ut.map((zt)=>z==="posix"?t(zt):zt.text),X=v.child,Q=X!==void 0&&!X.embedded,le=X?.embedded===!0,ue=v.effectiveCwd===null,be=X?X.cwd:ue?void 0:v.effectiveCwd??v.cwd,Me=X?X.originalCwd:ue?void 0:v.cwd,De=Ae(n);if(De.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...De.envAssignments.keys()],output:B(De.words)});let Oe=pr(De.words,v.environment,be,new Map([...v.envAssignments??[],...De.envAssignments])),Ne=Oe.envSplitValues??[];if(Ne.length>0){let ut=[...Ne,...B(Oe.words)].join(" "),zt=Gn(ut);if(zt)return W?.recordSegment({type:"dangerous-text",token:ut,matched:!0,reason:zt.reason}),vn(zt);if(v.strict)return yn(W);let Kt=Ws(Ne,B(Oe.words));if(Kt){v.budget.charge("derivedTokens",Kt.length);let Nn=v.analyzeNested(Kt.join(" "),{effectiveCwd:Oe.cwd===void 0?v.effectiveCwd:Oe.cwd,envAssignments:new Map([...v.envAssignments??[],...De.envAssignments,...Oe.envAssignments])});if(Nn)return Nn}}let Le=Oe.rewritten?Xt(B(Oe.words)):ce(z,Oe.words),We=B(Le),ze={...v,wrapperNormalizationBudget:v.wrapperNormalizationBudget??{iterations:0}};if(W&&De.words.length>Le.length){let ut=B(De.words);W.recordSegment({type:"leading-tokens-stripped",input:ut,removed:ut.slice(0,ut.length-Le.length),output:We})}let st=new Map([...v.envAssignments??[],...De.envAssignments,...Oe.envAssignments]),it=We[0];if(!it)return null;if(eo(it))throw new a("wrapperPeelIterations");let lt=$t(it),Et=Oe.cwd===null?void 0:Oe.cwd??be,Rt=Oe.cwd===null?void 0:Me,Tt=Oe.cwd===void 0?v.effectiveCwd:Oe.cwd,Be=Oe.cwd===void 0?v.effectiveCwd:null,Gt=X?X.allowTmpdirVar:!Ci(st,v.environment),kt=Tg(z,Oe.words,v.environment,u===0,v.strict,v.policy);if(kt)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:kt.reason}),vn(kt);let Qt=na(We,v.policy);if(Qt){for(let ut of[Qt.childIndex,...Qt.alternativeChildIndices]){jg(ze.wrapperNormalizationBudget);let zt=Le.slice(ut);W?.recordSegment({type:"transparent-wrapper",wrapper:Qt.wrapper,output:B(zt)});let Kt=Ho(zt,u,{...ze,effectiveCwd:Tt,envAssignments:st});if(Kt)return Kt}return null}let In=le?void 0:lt==="eval"?pa(Le):lt==="trap"&&!Q?jp(Le):void 0;if(Q&&X&&lt==="eval"){if(In?.kind==="dynamic")return Uo(X,v.policy);if(In?.kind==="literal"){let ut=v.analyzeNested(In.source,{effectiveCwd:Tt,envAssignments:st});if(ut)return ut}return jo(X,v.policy)}if(In?.kind==="dynamic"&&(v.strict||!v.commandView||!Gc(v.commandView)))return yn(W);if(In?.kind==="literal"){W?.recordSegment({type:"recurse",reason:lt==="eval"?"shell-eval":"shell-trap",innerCommand:In.source,depth:u+1});let ut=v.analyzeNested(In.source,{effectiveCwd:Tt,envAssignments:st,functionDefinitions:v.functionDefinitions});if(ut)return ut}if(Q?Jt.has(lt):Xg(it,lt)){if(Xn(We))return null;if(ia(We))return yn(W);if(Q&&X){let ut=Bn(We);if(ut){if(X.dynamicSourceInput??X.dynamicInput){let Kt=Uo(X,v.policy);if(Kt)return Kt}if(Wi(ut)){let Kt=Uo(X,v.policy);if(Kt)return Kt}return v.analyzeNested(ut,{effectiveCwd:Tt,envAssignments:st})}let zt=Cr(Le);if(zt.kind==="dynamic")return Uo(X,v.policy);if(zt.kind==="literal")return X.dynamicSourceInput?Uo(X,v.policy):null;return X.dynamicSourceInput??X.dynamicInput?Uo(X,v.policy):null}if(le){let ut=Bn(We),zt=ut?v.analyzeNested(ut,{effectiveCwd:Tt,envAssignments:st}):Cr(Le).kind==="dynamic"?yn(W):null;if(zt)return zt}if(X===void 0){let ut=TP(We,st,Tt,v,W,u);if(ut)return ut;let zt=Bn(We);if(zt){let bn=xn(We).commandIndex,sn=bn===null?void 0:Le[bn];if(sn&&v.commandView&&Ni(sn,v.commandView.nested,v.environment))return yn(W);let er=ga(Le,zt);if(er.kind==="dynamic")return yn(W);let lr=er.kind==="literal"?er.source:Vp(Le,zt),_d=MP(lr);W?.recordSegment({type:"shell-wrapper",wrapper:lt,innerCommand:_d}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:_d,depth:u+1});let xd=v.analyzeNested(lr,{effectiveCwd:Tt,envAssignments:st});if(xd)return xd;return Wi(lr)?yn(W):null}let Kt=Cr(Le,v.environment.home,v.strict?void 0:Wo(v.shellAssignments??new Map,{home:v.environment.home,cwd:Be}));if(Kt.kind==="dynamic")return yn(W);if(Kt.kind==="literal")return zi(Kt.source,Tt,st,v,W,u);let Nn=qp(Le,v.commandView?.redirections??[],v.hasPipelineInput??!1,v.literalShellInput);if(Nn.kind==="dynamic")return yn(W);if(Nn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Nn.source,depth:u+1}),v.analyzeNested(Nn.source,{effectiveCwd:Tt,envAssignments:st})}}if(!X&&(lt==="source"||lt===".")){let ut=We[1]==="-p"?2:null;if(ut!==null){let sn=v.commandView?Le[ut]:void 0;if(!sn)return null;if(sn.provenance!=="literal")return yn(W)}let zt=ut===null?1:3,Kt=We[zt]==="--"?zt+1:zt,Nn=v.commandView?Le[Kt]:void 0;if(!Nn)return null;let bn=Hg(Nn,v,Be);if(bn!==null)return zi(bn,Tt,st,v,W,u);if(v.strict||!v.commandView||!Gc(v.commandView))return yn(W)}let on=Le[0];if(!X&&on&&it.includes("/")){let ut=Hg(on,v,Be),zt=ut===null?null:zi(ut,Tt,st,v,W,u,!1,!0);if(zt)return zt}if(Fn.has(lt)&&!le){if(!X&&v.strict&&Kc(Ii(We),Le))return yn(W);let ut=np(We,(Kt)=>Nr(v.analyzeNested(Kt,{effectiveCwd:Tt,envAssignments:st}))),zt=Ft(ut,v.policy);if(zt)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:zt.reason}),vn(zt)}if(On(lt)&&!le){let ut=Zs(We),zt=v.remotePipelineInput===!0&&!Kp(v.commandView?.redirections??[])&&!fc(We)&&ut.every((sn)=>sn.kind==="main-script"&&sn.value==="-"),Kt=ut.some((sn)=>{let er=Le[sn.tokenIndex];return sn.kind!=="module-file"&&er!==void 0&&v.commandView!==void 0&&Ni(er,v.commandView.nested,v.environment)}),Nn=!fc(We)&&ut.some((sn)=>sn.kind==="main-script"&&Le[sn.tokenIndex]?.provenance==="literal"&&v.downloadedPaths?.has(wr(sn.value,Tt,v.environment.paths,v.budget)??""));if(!X&&(zt||Kt||Nn||v.strict&&Kc(ut,Le)))return yn(W);let bn=Uf(We);if(Q&&X)return AP(lt,bn,Tt,st,v,X);if(bn){let sn=ln(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:lt,codeArg:bn,paranoidBlocked:sn}),sn){let lr=Ft(at("interpreter.one-liner-paranoid",wi),v.policy);if(lr)return vn(lr)}if(pc(lt,bn))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:bn,depth:u+1});let er=v.analyzeNested(bn,{effectiveCwd:Tt,envAssignments:st});if(er&&!Kg(er,bn))return er;if(Ai(bn,void 0,!v.strict)){let lr=Ft(at("interpreter.dangerous-command",Mo),v.policy);if(lr)return W?.recordSegment({type:"dangerous-text",token:bn,matched:!0,reason:Mo}),vn(lr)}W=void 0}}if(lt==="busybox"&&We.length>1)return jg(ze.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),Ho(Le.slice(1),u,{...ze,effectiveCwd:Tt,envAssignments:st});let jn=X?void 0:[["analyzer/device.ts:analyzeDeviceCommandMatch",Km(lt,We)],["analyzer/network.ts:analyzeNetworkCommandMatch",Lg(lt,We)],["analyzer/namespace.ts:analyzeNamespaceCommandMatch",Og(lt,We)]].map(([ut,zt])=>({rule:ut,match:Ft(zt,v.policy)})).find((ut)=>ut.match);if(jn?.match)return W?.recordSegment({type:"rule-check",rule:jn.rule,matched:!0,reason:jn.match.reason}),vn(jn.match);let tn=W===ze.trace?ze:{...ze,trace:W},cn={words:Le,parsedWords:Oe.words,head:lt,cwd:Et,originalCwd:Rt,envAssignments:st,allowTmpdirVar:Gt,dynamicArguments:Oe.words.some((ut)=>ut.provenance==="command-substitution"),depth:u,effectiveCwd:Tt,options:tn,analyzeChildTokens:(ut,zt)=>Q&&X?td(ut,u,tn,{...X,cwd:zt??void 0,effectiveCwd:zt??void 0}):Nr(Ho(Xt(ut),u+1,{...tn,child:void 0,commandView:void 0,effectiveCwd:zt,envAssignments:st}))??F(ut,tn.policy.rules),analyzeChild:(ut,zt)=>td(ut,u,tn,zt)},Cn=X&&(lt==="xargs"||lt==="parallel")?void 0:qg(lt);if(lt==="rm"||lt==="xargs"||lt==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:st.has("TMPDIR")||v.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Gt});let nn=W&&lt==="git"?Lp(cn.words,Jc(cn)):void 0,dn=Vg(nn?nn.match:Cn?.(cn)??null,v.policy);if(W)DP(cn,dn,nn?.relaxation??null);if(dn)return vn(dn);if(Q&&X&&(lt==="rm"||lt==="rmdir")){if(!(lt==="rm"&&(yr(We)||X.dynamicRmInput)))return null;return(X.dynamicRmInput?jo(X,v.policy):null)??PP(X,v.policy)}let uo=Cn!==void 0&&!LP.has(lt),Wr=!X&&!uo&&!ss.has(lt),Er=W&&Wr?[]:void 0;if(Wr)for(let ut=1;ut<We.length;ut++){let zt=We[ut];if(!zt)continue;Er?.push(zt);let Kt=Vg(wP(We,ut,u,tn,Et,Rt,Tt,st),v.policy);if(Kt)return W?.recordSegment({type:"fallback-scan",tokensScanned:Er??[],embeddedCommandFound:$t(zt)}),vn(Kt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:Er??[]}),le&&X&&!X.wrappedByTransparent)return null;let mo=F(We,v.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:v.policy.rules.length>0,matched:!!mo,reason:mo?.reason}),mo)return vn(mo);return Q&&X?jo(X,v.policy):null}function td(n,u,v,W){return Nr(Ho(Xt(n),u+1,{...v,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function wP(n,u,v,W,z,B,X,Q){for(let le of Zn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:Q,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let be=$t(ue);if(Xg(ue,be)||qg(be)!==void 0&&be!=="xargs"&&be!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let De=td(le.tokens,v,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?X:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!Ci(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(De)return De}return null}function AP(n,u,v,W,z,B){if(!u)return jo(B,z.policy);if(ln(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let Q=Ft(at("interpreter.one-liner-paranoid",wi),z.policy);if(Q)return vn(Q)}if(pc(n,u))return jo(B,z.policy);let X=z.analyzeNested(u,{effectiveCwd:v,envAssignments:W});if(X&&!Kg(X,u))return X;if(Ai(u,void 0,!z.strict)){let Q=Ft(at("interpreter.dangerous-command",Mo),z.policy);if(Q)return vn(Q)}return jo(B,z.policy)}function Kg(n,u){let v=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(Hs)||n.reason===rr)&&!ls(u);return v||W}function Uo(n,u){let v=n.shellDynamicMatch?Ft(n.shellDynamicMatch,u):null;return v?vn(v):null}function jo(n,u){let v=n.dynamicSourceInput&&n.dynamicSourceMatch?Ft(n.dynamicSourceMatch,u):null;return v?vn(v):null}function PP(n,u){let v=n.dynamicInput&&n.rmDynamicMatch?Ft(n.rmDynamicMatch,u):null;return v?vn(v):null}function TP(n,u,v,W,z,B){let X=up(n);if(X.argvSource?.kind==="absent")return yn(z);if(X.argvSourceApplies&&X.argvSource){let le=zi(X.argvSource.value,v,u,W,z,B,!0);if(le)return le}if(!X.envSourceApplies||!X.envName)return null;let Q=u.get(X.envName);if(!Q)return null;return zi(Q,v,u,W,z,B,!0)}function Hg(n,u,v){let W=u.environment.home,z=Fo(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Qn(n,Wo(u.shellAssignments??new Map,{home:W,cwd:v}))}var Yg=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function zi(n,u,v,W,z,B,X=!1,Q=!1){if(X&&/[$`*?[\]]/.test(n))return yn(z);let le=wr(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0&&(X||le&&W.downloadedPaths?.has(le)))return yn(z);if(ue===void 0)return le?kP(n,le,u,v,W,z,Q):null;if(Q&&ue.startsWith("#!")&&!Yg.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!Q)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v});let be=Zg(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v}));return be?.intent==="stop_and_explain"?null:be}var IP=/^(?:analysis|raw-text)\.|^(?!custom\.).*dynamic|^interpreter\.one-liner-paranoid$/;function kP(n,u,v,W,z,B,X){if([...z.writtenPaths??[]].some((Ne)=>u===Ne||u.startsWith(`${Ne}${xP}`)))return null;let le=z.scriptReads??{},ue=le.budget??=Rn(),be=(Ne)=>Zg(()=>{if(Ne)OP(ue);ue.charge("scriptFiles");let Le=Qm(u);if(Le===null)return null;if(X&&Le.text.startsWith("#!")&&!Yg.test(Le.text))return null;if(!Ne)B?.recordSegment({type:"script-file",path:n,bytes:Le.bytes});let We=z.analyzeNested(Le.text,{effectiveCwd:v,envAssignments:W,scriptBudget:ue,withoutUncertainCapabilities:Ne,untraced:!0});if(!We||We.scriptLocation)return We;let ze=We.sourceOffset===void 0?"":`:${Le.text.slice(0,We.sourceOffset).split(`
-`).length}`;return{...We,scriptLocation:`${n}${ze}`}}),Me=(Ne)=>Ne&&!IP.test(Ne.ruleId)?Ne:null,De=be(),Oe=z.strict||z.paranoidInterpreters;return Me(De)??(Oe&&De?Me(be(!0)):null)}function OP(n){let u=n.counters.get("scriptFiles");if(n.counters.clear(),u!==void 0)n.counters.set("scriptFiles",u)}function Zg(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function MP(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function DP(n,u,v){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!v,reason:u?.reason??v?.originalReason}),v)n.options.trace?.recordSegment({type:v.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:v.originalReason,gitCwd:v.gitCwd})}function jg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function vn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function yn(n){return n?.recordSegment({type:"error",message:Zr}),vn(or())}function Xg(n,u){return Jt.has(u)||n==="$SHELL"||n==="${SHELL}"||Jt.has(Wt(u))}function Vg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Ft(n,u)}var NP=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,LP=new Set(["powershell","pwsh"]),WP=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function FP(n,u){let v=eh(n,u);if(v.length===0)return!1;let W=v[Jg(v)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return NP.test(n.join(" "))}function Qg(n,u,v,W,z){if(n.dialect==="powershell"){let it=GP(n.words,z);if(it.kind==="none")return;if(!u||it.kind==="unknown")return null;return ed(UP(it.target),u,v.paths)}let B=n.words.map(t),X=B.some((it)=>/^CDPATH\+?=/.test(it));if(!FP(B,v))return X?null:void 0;if(!u)return null;let Q=eh(B,v,u),le=Jg(Q);if(le===-1||Q[le]!=="cd")return null;let ue=Q.slice(le+1),be=ue.findIndex((it)=>it.length<=1||!it.startsWith("-")||it==="--");if((be===-1?ue:ue.slice(0,be)).some((it)=>!/^-[LP]+$/.test(it)))return null;let De=be===-1?[]:ue.slice(be),Oe=De[0]==="--"?De.slice(1):De;if(Oe.length>1)return null;let Ne=Oe[0],Le=W.get("HOME")||v.home;if(Ne===void 0)return ed(gn(Le),u,v.paths);let We=n.words.find((it)=>it.provenance==="variable"&&it.text===Ne),ze=n.words.find((it)=>it.text===Ne&&/^~(?:\/|$)/.test(it.raw)),st=We?Qn(We,new Map([...W,["HOME",Le]])):ze?`${Le}${Ne.slice(1)}`:Ne;if(st===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(st)&&(X||v.env.has("CDPATH")))return null;return ed(gn(st),u,v.paths)}function ed(n,u,v){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=Pr(u,n,v);return v.isDirectory(W)?W:null}catch{return null}}function GP(n,u){let v=zP(n[0])?1:0,W=n[v];if(!$P(W,v===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!WP.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return BP(n.slice(v+1),u)}function zP(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function $P(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function BP(n,u){let v;for(let W of n){if(W.provenance!=="literal"||v!==void 0)return{kind:"unknown"};v=W.text}if(v!==void 0)return{kind:"target",target:v};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function UP(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function Jg(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let v=u+1;while(n[v]?.startsWith("-"))v++;return v}function eh(n,u,v){let W=HP(n);return Tr([...W],u,v)}function HP(n){let u=0;while(u<n.length){let v=n[u];if(v!=="{"&&v!=="("&&v!=="$(")break;u++}return n.slice(u)}var ZP="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",io="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ld(n,u,v,W){if(u>=l.recursionDepth.cap)return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??v.factStore?.getCommandProgram(n,v.shell??"auto")??C(n,v.shell);if(z.status==="limited")return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let be=z.issues.find((Me)=>Me.code.includes("heredoc"));if(be){if(!v.strict)return ad(n,v);let Me=`${Hs}: ${be.message}`;return v.trace?.recordGlobal({type:"error",message:Me}),{reason:Me,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return lh(n,v),{reason:rr,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(v.strict&&z.status==="partial")return lh(n,v),{reason:rr,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((be)=>be.code.includes("quote")))return ad(n,v);let X=v.cwd,Q=v.effectiveCwd!==void 0?v.effectiveCwd:v.cwd,le=_p(v.environment.env,v.envAssignments),ue={...v,rootProgram:z,writtenPaths:v.writtenPaths??new Set,downloadedPaths:v.downloadedPaths??new Set,scriptReads:v.scriptReads??{}};return wa(z,u,ue,X,[{effectiveCwd:Q,shellGitContextState:le,literalHeredocFiles:new Map(v.literalHeredocFiles),functionDefinitions:new Map(v.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function wa(n,u,v,W,z){let B=[...z],X,Q,le,ue=!1;for(let[be,Me]of n.nodes.entries()){if(Me.kind==="connector"){Q=Me.operator;continue}let De=br(Q)&&ue;ue=De||Me.kind==="command"&&(ha(Me,v.environment)||Me.dialect==="powershell"&&uh(Me.words));let Oe=n.nodes[be+1],Ne=Oe?.kind==="connector"?Oe.operator:void 0,Le=XP(n,be,Me,Q,Ne),ze=Q==="&&"||Q==="||"?X:void 0,st=Q==="&&"?ze?.success??B:Q==="||"?ze?.failure??B:B,it=Q==="||"?ze?.success??[]:[],lt=Q==="&&"?ze?.failure??[]:[],Et={connector:Q,skippedSuccessStates:it,skippedFailureStates:lt};if(br(Ne)&&!br(Q))le=Et;let Rt=br(Ne)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:br(Q)?le??Et:Et,Tt=so(Rt.connector)||so(Ne);if(Me.kind==="function"){let tn=st.flatMap((Cn)=>{let nn=ao(Cn);return nn.functionDefinitions.set(Me.name,Me.body),nd(Cn,[nn],Le,Ne==="&",so(Ne))}),cn=rd(tn,[],Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,Ne);B=cn.states,X=cn.conditionalStates,Q=void 0;continue}if(Me.kind==="group"){let tn=[],cn=[];for(let nn of st){let dn=wa(Me.body,u,v,W,[ao(nn)]);if(dn.result)return dn;if(tn.push(...nd(nn,dn.states,Le,Ne==="&",so(Ne))),Tt)cn.push(nn,...Le?dn.states.map((uo)=>_a(nn,uo)):dn.states)}let Cn=rd(tn,cn,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,Ne);B=Cn.states,X=Cn.conditionalStates,Q=void 0;continue}if(Me.kind!=="command")continue;let Be=TT(n.nodes[be-1]),Gt=v.trace?.flattenNested?v.trace.currentSegmentIndex:v.trace?.allocateSegment(),kt=n.nodes[be-2],Qt=br(Q)&&kt?.kind==="command"?kt:void 0,In=Qt?Hp(Qt)??JP(Qt):void 0,Sn=[],on=[];for(let tn of st){let cn=eT(Me,u,v,W,[ao(tn)]);if(cn.result)return{result:cn.result,states:B};let Cn=n.dialect==="powershell"?cn.states:cn.states.map((nn)=>_a(tn,nn));for(let nn of Cn){let dn=ao(nn),uo=oT(Me,u,v.trace?{...v,trace:dh(v.trace,Gt)}:v,W,dn,br(Q),In,De);if(uo)return{result:{...uo,sourceOffset:Me.span.start},states:B};let Wr=LT(Me,dn.functionDefinitions);if(Wr)v.budget.charge("derivedTokens",Aa(Wr));let Er=Wr?u+1>=l.recursionDepth.cap?id(Me.displayText,v,[dn]):wa(Wr,u+1,v,W,[dn]):{result:null,states:DT(Me,dn).flatMap((ut)=>IT(Me,nn,ut,Be))};if(Er.result)return Er;Sn.push(...nd(tn,Er.states,Le,Ne==="&",so(Ne)));let mo=typeof dn.effectiveCwd==="string"&&dn.effectiveCwd!==nn.effectiveCwd&&Me.redirections.every((ut)=>["<",">",">>",">|"].includes(ut.operator)&&ut.target?.text==="/dev/null");if(Tt&&(Be||!mo))on.push(tn),on.push(...Er.states.map((ut)=>Le?_a(tn,ut):ut))}}let jn=rd(Sn,on,Rt.skippedSuccessStates,Rt.skippedFailureStates,Rt.connector,Ne);B=jn.states,X=jn.conditionalStates,Q=void 0}return{result:null,states:B}}function XP(n,u,v,W,z){if(v.kind==="group"&&v.style==="subshell")return!0;if(n.dialect==="posix"&&(br(W)||br(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&v.kind==="group"&&v.style==="brace"&&QP(n,u)}function nd(n,u,v,W,z){let B=v?u.map((Q)=>_a(n,Q)):[...u],X=z?B.flatMap((Q)=>Vo(n.literalHeredocFiles,Q.literalHeredocFiles)?[Q]:[{...Q,literalHeredocFiles:new Map(n.literalHeredocFiles)},Q]):B;return W?[n,...X]:X}function _a(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function QP(n,u){let v=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!v||v.kind!=="command")return!0;let W=v.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(tT(v))return!0;return v.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function br(n){return n==="|"||n==="|&"}function JP(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function so(n){return n==="&&"||n==="||"}function rd(n,u,v,W,z,B){let X={success:xa([...v,...n]),failure:xa([...W,...u])},Q=so(B)?X:void 0;return{states:so(z)||Q?xa([...X.success,...X.failure]):X.success,conditionalStates:Q}}function dh(n,u,v=n.flattenNested){return{currentSegmentIndex:u,flattenNested:v,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function eT(n,u,v,W,z){let B=n.nested.map((X)=>({program:X,depth:u}));if(n.dialect==="powershell"){let X=nT(n);if(X){if(u+1>=l.recursionDepth.cap)return id(X,v,z);let Q=C(X,"powershell");if(Q.status==="limited")return id(X,v,z);if(Q.status!=="complete")return th(B,v,W,z);v.budget.charge("derivedTokens",Aa(Q)),B.push({program:Q,depth:u+1})}}return th(B,v,W,z)}function tT(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function th(n,u,v,W){let z=[...W];for(let B of n){let X=[];for(let Q of z){let le=wa(B.program,B.depth,u,v,[ao(Q)]);if(le.result)return le;X.push(...le.states)}z=xa(X)}return{result:null,states:z}}function nT(n){let u=mh(n),v=u?.[0];return u?.length===1&&v?.quoted&&v.provenance==="literal"?v.text:void 0}function rT(n,u,v){let W=mh(n);if(!W)return!1;return u||W.some((z)=>Ni(z,n.nested,v))||uh(W)}function uh(n){return n.some((u)=>/\.Download(?:String|Data)\(/i.test(u.raw)||!u.quoted&&fa(/^(?:\$?\(|[&.\s])*([^\s()]*)/.exec(u.raw)?.[1]??"","powershell"))}function mh(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),v=u?1:0,W=n.words[v];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(v+1);return z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?z.slice(1):z}function Aa(n){return n.nodes.reduce((u,v)=>u+(v.kind==="command"?v.words.length+v.nested.reduce((W,z)=>W+Aa(z),0):v.kind==="group"||v.kind==="function"?Aa(v.body):0),0)}function id(n,u,v){return u.trace?.recordSegment({type:"error",message:tr}),{result:{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...v]}}function oT(n,u,v,W,z,B,X,Q){let le={...v,environment:{...v.environment,env:z.shellGitContextState.env,paths:yT(v.environment.paths,z.createdDirectories,v.budget)}},ue=RT(n,!le.strict);if(ue&&le.strict)return le.trace?.recordSegment({type:"error",message:ue}),{reason:ue,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};mT(n,z,le),pT(n,z,le),fh(n,z,"before-consumer",le.environment.paths,le.budget);let be=ce(n.dialect,n.words),Me=be.map(t),De=n.displayText,Oe=Ep(be,z.shellGitContextState,{home:le.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:le.environment.darwinUserTempDir}),Ne=wp(Oe,z.shellGitContextState);if(n.dialect==="powershell"){let st=Ft(Yf(n,B,WT(le,z.effectiveCwd)),le.policy);if(le.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!st,reason:st?.reason}),st)return od(De,st);if(rT(n,Q,le.environment))return le.trace?.recordSegment({type:"error",message:Zr}),od(De,or())}let Le=Ft(Ym(n.redirections),le.policy);if(Le)return le.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Le.reason}),od(De,Le);if(Me.length===1&&Me[0]?.includes(" ")&&!di(n.dialect,n.words)){let st=Ft(Gn(Me[0]),le.policy),it=st!==null&&!le.strict&&Hm(n,le.rootProgram);if(st&&!it)return le.trace?.recordSegment({type:"dangerous-text",token:Me[0],matched:!0,reason:st.reason}),{reason:st.reason,segment:De,ruleId:st.id,intent:st.intent};le.trace?.recordSegment({type:"dangerous-text",token:Me[0],matched:!1});let lt=nh(n,ue,z,Ne,X,le);if(lt)return lt;return Mc(Oe,z.shellGitContextState),null}let We=Ho(n.words,u,{...le,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Ne,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:X,remotePipelineInput:Q,analyzeNested:(st,it)=>{let lt=it&&Object.hasOwn(it,"effectiveCwd")?it.effectiveCwd:z.effectiveCwd,Et=ld(st,u+1,{...le,...it?.withoutUncertainCapabilities?_e({...le,effectiveCapabilities:{...le.effectiveCapabilities,fail_closed:{...le.effectiveCapabilities.fail_closed,enabled:!1},paranoid_interpreters:{...le.effectiveCapabilities.paranoid_interpreters,enabled:!1}}}):{},budget:it?.scriptBudget??le.budget,effectiveCwd:lt,envAssignments:it?.envAssignments??Ne,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:it?.functionDefinitions,worktreeMode:it?.worktreeMode??le.worktreeMode,shell:it?.shell??le.shell,trace:le.trace&&!it?.untraced?dh(le.trace,le.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent,sourceOffset:Et.sourceOffset,scriptLocation:Et.scriptLocation}:null}});if(We)return{...We,segment:De};let ze=nh(n,ue,z,Ne,X,le);if(ze)return ze;return Mc(Oe,z.shellGitContextState),null}function nh(n,u,v,W,z,B){let X=_T(n,u,v,W??new Map,B);if(X)return X;if(fh(n,v,"after-consumer",B.environment.paths,B.budget),!aT(n))v.literalHeredocFiles.clear();return gT(n,u,v,B.environment.paths,B.budget,B.environment.home),ST(n,v,B.environment.paths,B.budget,B.environment.home),AT(n,v,z,B.environment,B.trace),null}var iT=new Set([">>","<>"]),sT=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function aT(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>sT.test(u.raw))}var lT=new Set(["cp","mv","install","ln","sed","curl","wget","tee"]),cT=new Set(["cp","mv","install","ln"]),dT=/^-[^-]*i|^--in-place/,rh=/^(?:-t|--target-directory=?)(.*)$/;function uT(n){let u=n.findIndex((Me)=>lT.has(Wt(Me.text))),v=Wt(n[u]?.text??""),W=n.slice(u+1).filter((Me)=>Me.provenance==="literal").map((Me)=>Me.text);if(u===-1)return[];if(v==="sed")return W.some((Me)=>dT.test(Me))?W:[];if(!cT.has(v))return W;let z=W.findIndex((Me)=>rh.test(Me)),B=W[z]?.match(rh)?.[1],X=z!==-1&&!B,Q=X?W[z+1]:B,le=W.filter((Me,De)=>!Me.startsWith("-")&&!(X&&De===z+1)),ue=Q??le.at(-1);if(ue===void 0)return[];return[...Q===void 0?le.slice(1):[Q],...le.map((Me)=>ch(ue,Wt(Me)))]}function mT(n,u,v){let W=v.writtenPaths;if(!W)return;let B=[...n.redirections.flatMap((X)=>X.operator.includes(">")&&X.target?[X.target]:[]).filter((X)=>X.provenance==="literal").map((X)=>X.text),...uT(n.words)].flatMap((X)=>[X,X.slice(X.indexOf("=")+1),Wt(X.split(/[?#]/)[0]??"")]);for(let X of new Set(B.filter(Boolean))){let Q=wr(X,u.effectiveCwd,v.environment.paths,v.budget);if(Q)W.add(Q)}}var oh=new Map([["curl",/^(?:-[^-o]*o|--output(?:=|$))(.*)/],["wget",/^(?:-[^-O]*O|--output-document(?:=|$))(.*)/]]);function fT(n){let u=n.findIndex((W)=>oh.has(Wt(W.text))),v=oh.get(Wt(n[u]?.text??""));return n.slice(u+1).flatMap((W,z,B)=>{let X=W.provenance==="literal"?v?.exec(W.text)?.[1]:void 0,Q=B[z+1];if(X)return[X];return X===""&&Q?.provenance==="literal"?[Q.text]:[]})}function pT(n,u,v){let W=ha(n,v.environment),z=[...n.redirections.filter(ph).flatMap((B)=>B.target?.provenance==="literal"?[B.target.text]:[]),...W?fT(n.words):[]];for(let B of z.filter((X)=>X!=="-")){let X=wr(B,u.effectiveCwd,v.environment.paths,v.budget);if(X&&W)v.downloadedPaths?.add(X);if(X&&!W)v.downloadedPaths?.delete(X)}}function fh(n,u,v,W,z){for(let X of n.redirections){if(!(v==="before-consumer"?ph(X):iT.has(X.operator)))continue;ih(X.target,u,W,z)}if(v!=="before-consumer"||!pn(n.words[0],"tee"))return;let B=hh(n.words.slice(1));if(!B)return;for(let X of B.operands)ih(X,u,W,z)}function ph(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function ih(n,u,v,W){let z=n?.provenance==="literal"?wr(n.text,u.effectiveCwd,v,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function gT(n,u,v,W,z,B){if(u)return;let X=n.redirections.find((Q)=>Q.operator==="<<"||Q.operator==="<<-")?.heredoc;if(!X)return;for(let Q of hT(n,Wo(v.shellGitContextState.shellAssignments,{home:B,cwd:v.effectiveCwd}),B)){let le=wr(Q,v.effectiveCwd,W,z);if(!le||!Yl(le))continue;if(!v.literalHeredocFiles.has(le)&&v.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");v.literalHeredocFiles.set(le,X.body)}}function hT(n,u,v){let W=sd(vT(n.redirections)?.target,u,v),z=W===void 0?[]:[W];if(pn(n.words[0],"cat"))return bT(n.words)?z:[];if(!pn(n.words[0],"tee"))return[];let B=hh(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let X=B.operands.map((Q)=>sd(Q,u,v));if(!X.every((Q)=>Q!==void 0))return[];return[...X,...z]}function sd(n,u,v){if(ET(n))return n.text;if(!n)return;return Fo(n,v)??Qn(n,u)??void 0}function yT(n,u,v){if(u.size===0)return n;let W=(z)=>{let B=Ut(z,n,v);return[...u].some((X)=>X===B||X.startsWith(`${B}${YP}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?Ut(z,n,v):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function ST(n,u,v,W,z){if(u.shellGitContextState.bodyDepth>0||!pn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((be)=>sd(be,u.shellGitContextState.shellAssignments,z));if(!B.every((be)=>be!==void 0))return;let X=B.findIndex((be)=>be==="--"||be==="-"||!be.startsWith("-")),Q=B.slice(0,X);if(X===-1||!Q.every((be)=>/^(?:-[pv]+|--parents|--verbose)$/.test(be)))return;let le=Q.some((be)=>be==="--parents"||/^-v*p/.test(be)),ue=u.effectiveCwd;for(let be of B.slice(B[X]==="--"?X+1:X)){if(be.split(/[\\/]/).includes("..")||!VP(be)&&!ue)continue;let Me=Ut(KP(ue??"",be),v,W);if(le?CT(Me,v):v.isDirectory(jP(Me))&&gh(Me,v))u.createdDirectories.add(Me)}}function CT(n,u){let v=qP(n).root,W=n.slice(v.length).split(/[\\/]+/).filter(Boolean),z=(X)=>ch(v,...W.slice(0,X+1)),B=W.findIndex((X,Q)=>!u.isDirectory(z(Q)));return B===-1||gh(z(B),u)}function gh(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function bT(n){let u=!1;for(let v of n.slice(1)){if(u||v.provenance!=="literal")return!1;if(v.text==="--"){u=!0;continue}if(!/^-u+$/.test(v.text))return!1}return!0}function vT(n){let u=n.findLast((v)=>(v.fd??([">",">|",">>",">&"].includes(v.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function hh(n,u=new Map){let v=[],W=!0,z=!1,B=!1;for(let X of n){if(X.provenance!=="literal"&&Qn(X,u)===null)return;if(W&&pn(X,"--")){W=!1;continue}if(W&&!X.quoted&&X.raw===X.text&&/^-[^-]/.test(X.text)){z||=X.text.slice(1).includes("a"),B||=Array.from(X.text.slice(1)).some((Q)=>Q!=="a"&&Q!=="i");continue}if(W&&!X.quoted&&X.raw===X.text&&X.text.startsWith("--")){z||=X.text==="--append",B||=X.text!=="--append"&&X.text!=="--ignore-interrupts";continue}v.push(X)}return{operands:v,append:z,hasUnsupportedOptions:B}}function ET(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function pn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function RT(n,u){let v=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(v.length===0)return;if(v.length!==1)return io;let W=v[0];if(!W?.heredoc)return io;let z=/\$\(|`/.test(W.heredoc.body);if(!$o(W.heredoc)&&(!u||z))return ZP;if(W.fd!==void 0&&W.fd!==0)return io;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return io;let B=n.redirections.some((le)=>le!==W&&sh(le.target));if(pn(n.words[0],"cat"))return B?io:void 0;if(pn(n.words[0],"tee"))return B||n.words.slice(1).some(sh)?io:void 0;let X=n.words[0],Q=n.words[1];if(pn(X,"git")&&(pn(Q,"apply")||pn(Q,"commit")))return;if(pn(X,"gh")&&(pn(Q,"pr")||pn(Q,"issue"))&&pn(n.words[2],"create"))return;return io}function sh(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function _T(n,u,v,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),X=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(wT(n,B,v,W,z))return null;let Q=xT(n,B,z);if(Q!==void 0)return Q?{reason:Q.reason,segment:n.displayText,ruleId:Q.id,intent:Q.intent}:null;let le=ad(X.length===B.length?X.join(`
-`):n.source,z);return le?{...le,segment:n.displayText}:null}function xT(n,u,v){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!$o(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=pn(n.words[0],"uv")&&pn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!On(B.text))return;let X=z.findIndex((Me)=>pn(Me,"-"));if(!z.slice(1,X===-1?void 0:X).every((Me)=>Me.provenance==="literal"&&Me.text.startsWith("-")))return;let le=W.heredoc.body,ue=ln(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(v.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let Me=Ft(at("interpreter.one-liner-paranoid",wi),v.policy);if(Me)return Me}if(!Ai(le,void 0,!v.strict))return null;let be=Ft(at("interpreter.dangerous-command",Mo),v.policy);if(!be)return null;return v.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:be.reason}),be}function wT(n,u,v,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!$o(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let X=pr(n.words,z.environment,v.effectiveCwd,W),Q=X.words.map(t),le=$t(Q[0]??"");if((X.envSplitValues?.length??0)>0||!Jt.has(le)&&!Jt.has(Wt(le)))return!1;return Xn(Q)}function AT(n,u,v,W,z){let B=Qg(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,v);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var PT=new Set(["fi","done","esac"]);function TT(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function IT(n,u,v,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,X=v.shellGitContextState.bodyDepth,Q=v.compoundBodies;if(X>B)return v.compoundBodies=[...Q.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:Q[B]?.branchCwds??[],hasElse:!1}],[v];let le=B>0?Q[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return v.compoundBodies=[...Q.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,v.effectiveCwd],hasElse:z==="else"}],v.effectiveCwd=le.entryCwd,[v];let ue=le!==void 0&&PT.has(z);if(ue)v.compoundBodies=Q.slice(0,X);return[...new Set([v.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((Me)=>{if(Me===v.effectiveCwd)return v;let De=ao(v);return De.effectiveCwd=Me,De})}function kT(n,u){return n.length===u.length&&n.every((v,W)=>{let z=u[W];return z!==void 0&&v.entryCwd===z.entryCwd&&v.hasElse===z.hasElse&&v.branchCwds.length===z.branchCwds.length&&v.branchCwds.every((B,X)=>B===z.branchCwds[X])})}var OT=/^[A-Za-z_][A-Za-z0-9_]*$/,MT=8;function DT(n,u){let v=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||v===void 0||!OT.test(v))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=MT&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(v),[u];return W.map((B)=>{let X=ao(u);return X.shellGitContextState.shellAssignments.set(v,B.text),X})}function ao(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:xp(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function xa(n){let u=[];for(let v of n){if(!u.some((W)=>NT(W,v)))u.push(v);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function NT(n,u){return n.effectiveCwd===u.effectiveCwd&&kT(n.compoundBodies,u.compoundBodies)&&Vo(n.shellGitContextState.env,u.shellGitContextState.env)&&Vo(n.literalHeredocFiles,u.literalHeredocFiles)&&Vo(n.functionDefinitions,u.functionDefinitions)&&Vo(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&Vo(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&ah(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&ah(n.createdDirectories,u.createdDirectories)}function ah(n,u){return n.size===u.size&&[...n].every((v)=>u.has(v))}function Vo(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([v,W])=>u.get(v)===W&&u.has(v))}function LT(n,u){let v=ui(n);return v===void 0?void 0:u.get(v)}function od(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function WT(n,u=n.effectiveCwd){let v=u===null;return{environment:n.environment,cwd:v?void 0:u??n.cwd,originalCwd:v?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function ad(n,u){let v=Ft(Gn(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!v,reason:v?.reason};if(u.trace?.recordSegment(z,W),!v&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return v?{reason:v.reason,segment:n,ruleId:v.id,intent:v.intent}:null}function lh(n,u){let v={type:"strict-unparseable",rawCommand:n,reason:rr},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(v);if(W!==void 0)u.trace?.recordSegment(v)}var FT=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function yh(n,u,v,W){let z=ld(n,0,{...u,..._e(u),budget:u.budget??Rn(),factStore:W},v);if(!z)return null;return{kind:"deny",reason:z.scriptLocation?`${z.scriptLocation}: ${z.reason}`:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function Sh(n,u,v){try{return{decision:n()}}catch(W){let z=GT(W,u,v);if(!z)throw W;return z}}function GT(n,u,v){if(!(n instanceof a)||!FT.has(n.kind))return null;let W=l[n.kind];if(v?.currentSegmentIndex!==void 0)v.recordSegment({type:"error",message:W.reason});if(v?.currentSegmentIndex===void 0)v?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var zT=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),dd=new Set(["cc-safety-net","ccsn"]),$T=new Set(["bunx","npx","pnpx"]),BT=new Set(["pnpm","yarn"]),UT=new Set(["npm","pnpm","yarn"]),HT=new Set(["bun","node"]);function Ta(n,u,v={}){if(dd.has(n))return 0;if($T.has(n)){if(v.broad)return cd(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return Pa(u[z])?z+1:null}let W=v.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&UT.has(n)&&v.broad&&u[W]==="exec"){let z=cd(u.slice(W+1));return z===null?null:W+1+z}if(BT.has(n)){if(n==="yarn"&&!v.broad)return null;if(!v.broad)return u[0]==="dlx"&&Pa(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=cd(u.slice(W+1));return z===null?null:W+1+z}if(HT.has(n)){let z=v.broad&&W!==-1?W:0;if(Ch(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&Ch(u[z+1]))return z+2}return null}function cd(n){let u=n.findIndex((W)=>Pa(W));if(u===-1)return null;let v=u;while(v<n.length){let W=n[v]??"";if(!W.startsWith("-")&&!Pa(W))break;v++}return v}function Pa(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return dd.has(n);if(u===0)return!1;let v=n.slice(u+1);if(v===""||v.includes("/")||v.includes(":"))return!1;return dd.has(n.slice(0,u))}function Ch(n){let u=n?.replaceAll("\\","/");return[...zT].some((v)=>u===v||u?.endsWith(`/${v}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function bh(n,u,v){let W=gr(n);if(!W)return null;let z=ko(W.shell,n.invocation.context.executionCwd,u,v,{findSegmentTarget:(B)=>jT(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function jT(n,u){let v=Tr([...n],u),W=v.slice(1),z=Ta(Wt(v[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((X)=>X!=="-g"&&X!=="--global");return B[0]==="policy"&&B[1]==="apply"?v.join(" "):null}import{dirname as Ia}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",VT=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function _h(n,u,v){let W=QT(n.invocation.context,u,v);if(n.invocation.route.kind==="patch")return vh(n.paths,!1,n.invocation.context.executionCwd,W,u,v);let z=gr(n);if(n.invocation.route.kind==="command")return z?Eh(z.shell,n.invocation.context.executionCwd,W,u,v):null;if(n.invocation.route.kind==="unknown"&&z){let B=Eh(z.shell,n.invocation.context.executionCwd,W,u,v);if(B)return B}return vh(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||Ji(n.invocation.toolName),n.invocation.context.executionCwd,W,u,v)}function vh(n,u,v,W,z,B){if(u)return null;let X=n.find((Q)=>$i(Q,v,W,z,B));return X?{target:X}:null}function Eh(n,u,v,W,z){let B=ko(n,u,W,z,{findSegmentTarget:(X,Q)=>qT(X,Q,v,W,z)?.target??null,isRedirectionTarget:(X,Q)=>$i(X,Q.cwd,v,W,z),findMalformedTarget:(X)=>XT(X,u,v,W,z)?.target??null});return B?{target:B}:null}function qT(n,u,v,W,z){if(_i(n))return null;let B=Ir([...n],W),X=Wt(B[0]??"").toLowerCase(),Q=B.slice(1);if(X==="rm"&&KT(Q)){let le=YT(Q).find((ue)=>Rh(An(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(X==="find"){if(sa(B,1)||Rc(B,W)){let ue=(ki(Xt(B))??Xt(["."])).find((be)=>{let Me=An(be.text,u.variables);return $i(Me,u.cwd,v,W,z)||Rh(Me,u.cwd,v,W,z)})?.text;if(ue)return{target:ue}}}if(X==="mv"){let le=js(Q).sources.find((ue)=>JT(An(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(ZT(B,X))return null;for(let le of[...n,...B])for(let ue of xh(le))if($i(An(ue,u.variables),u.cwd,v,W,z))return{target:ue};return null}function KT(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function YT(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((v)=>!v.startsWith("-")),...n.slice(u+1)];return n.filter((v)=>!v.startsWith("-"))}function ZT(n,u){if(!VT.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((v)=>v.startsWith("-i")||v==="--in-place"||v.startsWith("--in-place="))}function XT(n,u,v,W,z){for(let B of n.split(/\s+/))for(let X of xh(B))if($i(X,u,v,W,z))return{target:X};return null}function xh(n){let u=n.trim().replace(/^['"]|['"]$/g,""),v=u.indexOf("=");return v===-1||v===u.length-1?[u]:[u,u.slice(v+1)]}function QT(n,u,v){let W=(Q)=>Bi(hn(Q,n.executionCwd,u,v)),z=W(p(u)),B=[W(S(n.executionCwd)),W(S(n.configCwd))],X=new Set(B.map((Q)=>Ia(Q)));for(let Q=Ia(z);;Q=Ia(Q))if(X.add(Q),Ia(Q)===Q)break;return{files:new Set([z,...B]),directoriesAndAncestors:X}}function $i(n,u,v,W,z){let B=kd(n,u,W,z,(X)=>Bi(X)===os);return B!==null&&v.files.has(Bi(B))}function Rh(n,u,v,W,z){return v.directoriesAndAncestors.has(Bi(hn(n,u,W,z)))}function JT(n,u,v,W,z){let B=Bi(hn(n,u,W,z));return v.files.has(B)||v.directoriesAndAncestors.has(B)}function Bi(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as ka,posix as Gh,resolve as Na,win32 as eI}from"node:path";import{fileURLToPath as tI}from"node:url";var zh="Access to a sensitive path is not allowed.",$h=new Set(["echo","printf"]),nI=new Set(["find"]),rI=new Set(["!","do","elif","else","if","then","until","while"]),oI=new Set(["-exec","-execdir"]),iI=new Set([";","+"]),sI=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),aI=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Bh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),lI=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),cI=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),gd=new Set(["-c","-e","-r","-E","--eval","--exec"]),dI=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),hd=new Set(["grep","rg"]),Uh=new Set(["files-with-matches","files-without-match","count","quiet"]),uI=new Set([...Uh,"ignore-case","fixed-strings","hidden"]),mI=new Set(["wc",...hd]),fI=new Set(["cd","grep","head","openssl","tail","tailscale"]),pI=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,gI=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),hI=new Set(["commit","merge","notes","stash","tag"]),yI=new Set(["-m","--message"]),SI=new Set(["--grep"]),CI=new Set(["powershell","pwsh"]),wh=new Set(["jq","gojq","jaq"]),Ah="f",Ph="file",bI="files",vI=new Set(["e","f"]),EI=new Set(["regexp","file"]),RI=new Set(["e","f","A","B","C","m"]),_I=new Set(["regexp","file","after-context","before-context","context","max-count"]),ud="__CC_SAFETY_NET_PIPE_INPUT__",fd=/[\w./~@+-]*[./~][\w./~@+-]*/g,xI=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,wI=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,AI=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Th=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Ih=/\b(?:system|exec|spawn|popen)\s*$/,PI=/\b(?:eval|exec)\s*\(/g,TI=/\b(?:eval|exec)\s*$/,II=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function kh(n,u,v,W,z,B){for(let X of n){let Q=X.target;if(Yk(Q,X.cwd,u?.denyPaths??[],v,W,z))return{target:Q,ruleId:"secret.deny-path"};if(B&&!B.has(Q))continue;let le=qk(Q,X.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(ry(Q,X.cwd,W,z)))continue;if(ue&&B?.get(Q)==="data")continue;if(ue&&(X.isRedirectionWriteTarget===!0||B?.get(Q)==="write")&&!Q.includes("$")&&!Da(Q,X.cwd,W,z))continue;if(ue&&(X.isCreatedPath===!0||X.isCertificateInput===!0))continue;if(ue&&/\s/.test(Q)&&!Q.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Q)&&!Da(Q,X.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&Zk(Q,X.cwd,u?.allowPaths??[],v,W,z))continue;return{target:Q,ruleId:le}}}return null}function Hh(n,u,v,W,z={}){let B=Oh(n,v,W),X=kh(B,u,n.invocation.context.configCwd,v,W);if(X===null||X.ruleId==="secret.deny-path"||z.strict!==!1)return X;let Q=Oh(n,v,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;Q.forEach((Ne)=>jh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),be=Q.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),Me=new Set(be.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),De=new Set(be.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Oe=kh(B,u,n.invocation.context.configCwd,v,W,new Map(be.map((Ne)=>[Ne.target,Me.has(Ne.target)?"path":De.has(Ne.target)?"write":"data"])));return Oe?.ruleId!=="secret.deny-path"&&kI(n,v)?null:Oe}function kI(n,u){let v=gr(n);if(!v)return!1;if(v.program.nodes.some((X)=>X.kind==="command"&&X.nested.length>0))return!1;let W=[];for(let X of Us(v.shell)){if(X.kind==="operator"&&X.boundary)return!1;if(X.kind==="redirection")return!1;if(X.kind==="operator")continue;W.push(hr(X.text,u))}let z=ar(W);if(z.length===0)return!1;let B=En(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return v.program.dialect==="powershell"&&(B==="ls"||B==="stat");return yd(B,z.slice(1))}function yd(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((v)=>!v.startsWith("-")||pI.test(v));if(hd.has(n))return OI(n,u);if(n!=="find")return!1;return!u.some((v)=>sI.has(v))}function OI(n,u){let v=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(v.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),X=(ue)=>{let be=v[ue-1]??"";return/^--[^=]+$/.test(be)&&!uI.has(be.slice(2))||B(be)&&be.slice(1).search(W)===be.length-2},Q=v.findIndex((ue,be)=>!ue.startsWith("-")&&!X(be));return(n==="grep"&&Q>=0?v.slice(0,Q):v).some((ue,be)=>{if(X(be))return!1;if(ue.startsWith("--"))return Uh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function Oh(n,u,v,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((Q)=>({target:Q,cwd:z}));let X=gr(n);return[...X?Yo(X.shell,n.store,W,u,z,v,MI(X)):[],...B==="unknown"?n.paths.map((Q)=>({target:Q,cwd:z})):[]]}function MI(n){return n.program.dialect==="powershell"}function Yo(n,u,v,W,z,B,X=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let Q=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...Ik(hr(n.source,W),u,v,W,z,B)],le=(We)=>hr(jI(We,X),W),ue=/[<>=]\(/.test(n.source),be=/\bcoproc\b|\|&/.test(n.source),Me=[],De=[],Oe=(We)=>({...v,commandHoldsPipe:v.commandHoldsPipe===!0||We||be});Bs(n,z,W,B,{word:le,segment:(We,ze,st,it,lt,Et)=>{if(We.length===0)return null;let Rt=Oe(Et);if(Rt.commandHoldsPipe)Me.push(...We);if(De.push(En(Vh(ar(We))[0]??"").toLowerCase()),Q.push(...Hi(We,u,ue||it==="|"||it==="|&"?{...Rt,segmentMayFeedReader:!0}:Rt,W,ze.cwd,B,lt)),st!==null)Q.push(...LI(st,We,u,Rt,W,ze.cwd,B));return null},redirection:(We,ze,st)=>{if(We.body!==void 0&&We.consumer!==void 0){let it=Oe(st);Q.push(...qh(We.consumer,[We.body],u,it,W,ze.cwd,B,(lt)=>WI(We.consumer??[],lt,u,it,W,ze.cwd,B)))}if(We.targetOrder==="legacy-segment")return nc;return Q.push({target:le(We.target),cwd:ze.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(Me.flatMap(jh)),Le=ue||/\$\(|`/.test(n.source)||!De.every((We)=>fI.has(We));return Q.map(({loopVariable:We,...ze})=>{if(ze.certificateOutputMayFeedReader===!0&&Le)return{target:ze.target,cwd:ze.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?ze:{...ze,loopVariable:We}})}function jh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function Oa(n,u,v,W,z,B,X=!1){let Q=u.getShellSyntax(n,X?u.getCommandProgram(n,"powershell"):void 0);if(Q.status==="structural-limit")throw new E;return Q.status==="complete"?Yo(Q,u,v,W,z,B,X):null}function Hi(n,u,v,W,z,B,X){let Q=(Be)=>({target:Be,cwd:z}),le=n.findIndex((Be)=>!rI.has(Be));if(v.skipMetadataOnlySegments===!0&&le>0)return Hi(n.slice(le),u,v,W,z,B,new Set([...X??[]].map((Be)=>Be-le)));let ue=n[1]??"";if(v.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((Be)=>Hn("for",Be)).map((Be)=>({...Q(Be),loopVariable:ue}));if(X?.size){let Be=n.filter((Gt,kt)=>!X.has(kt));if(wh.has(En(ar(Be)[0]??"").toLowerCase()))return[...n.filter((Gt,kt)=>X.has(kt)).map(Q),...Hi(Be,u,v,W,z,B)]}let be=HI(n).map(Q),Me=ar(n);if(Me.length===0)return be;let De=Me[0]??"",Oe=En(De).toLowerCase(),Ne=Me.slice(1),Le=v.segmentMayFeedReader===!0||v.commandHoldsPipe===!0||v.displayOperandsAreCapturedOutput===!0,We=Le&&mI.has(Oe);if(v.skipMetadataOnlySegments===!0&&!We&&yd(Oe,Ne))return be;let ze=NI(De,Oe,Ne);if(ze)return[...be,...ze.map(Q)];if($h.has(Oe))return v.displayOperandsAreCapturedOutput===!0?[...be,...Kh(n).map(Q)]:be;if(Oe==="eval")return[...be,...Oa(Ne.join(" "),u,v,W,z,B)??Ne.map(Q)];let st=CI.has($t(De))?Qc(Me):void 0;if(st!==void 0)B.charge("derivedTokens",Me.length);let it=st===void 0?null:Oa(st,u,v,W,z,B,!0);if(it?.length)return[...be,...it];if(Oe==="export")return[...be,...Ne.flatMap((Be)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(Be)?[Be.slice(Be.indexOf("=")+1)]:Hn(Oe,Be)).map(Q)];if(Oe==="git")return[...be,...qI(Ne).map(Q)];if(Oe==="gh")return[...be,...pd(Oe,Ne,gI).map(Q)];if(wh.has(Oe))return[...be,...VI(Ne).map(Q)];if(hd.has(Oe))return[...be,...Fk(Ne).map(Q)];if(nI.has(Oe))return[...be,...YI(Ne,u,v,W,z,B).map(Q)];if(Oe==="mkdir"||Oe==="touch"){let Be=new Set(n.filter((kt,Qt)=>X?.has(Qt))),Gt=v.segmentMayFeedReader!==!0&&!(Oe==="touch"&&Ne.some((kt)=>/^(?:--r|-[^-]*r)/.test(kt)));return[...be,...Ne.flatMap((kt)=>Hn(Oe,kt).map((Qt)=>Gt&&!kt.startsWith("-")&&!Be.has(kt)?{...Q(Qt),isCreatedPath:!0}:Q(Qt)))]}if(Fn.has(Oe))return[...be,...Ne.flatMap((Be)=>Hn("awk",Be)).map(Q),...Ne.flatMap((Be)=>XI(Be,u,v,W,z,B)),...Ne.flatMap(QI).map(Q)];if(Oe==="curl")return[...be,...Ne.filter((Be,Gt)=>Zh(Be)===null&&Yh(Ne[Gt-1])===null).flatMap((Be)=>Hn(Oe,Be)).map(Q),...KI(Ne).map(Q)];if(To(Oe)){let Be=Ri.has(Oe)?xn([Oe,...Ne]):null;if(Be!==null&&Be.command!==null&&Be.commandIndex!==null){let Gt=u.getShellSyntax(Be.command);if(Gt.status==="structural-limit")throw new E;if(Gt.status==="complete")return[...be,...Yo(Gt,u,v,W,z,B),...Ne.slice(Be.commandIndex).filter((kt)=>!kt.startsWith("-")).map(Q)]}return[...be,...ZI(Oe,Ne,u,v,W,z,B)]}let lt=(Be,Gt)=>new RegExp(`^--?${Be}=`).test(Ne[Gt]??"")||new RegExp(`^--?${Be}$`).test(Ne[Gt-1]??""),Et=DI(Me),Rt=Oe==="openssl"&&Ne[0]==="x509",Tt=Le?{certificateOutputMayFeedReader:!0}:{};return[...be,...Ne.flatMap((Be,Gt)=>Hn(Oe,Be).map((kt)=>Et&&lt("(?:cert|key)-file",Gt)?{...Q(kt),isCreatedPath:!0,...Tt}:Rt&&lt("in",Gt)?{...Q(kt),isCertificateInput:!0,...Tt}:Q(kt)))]}function Vh(n){return En(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function DI(n){let u=Vh(n);return En(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function NI(n,u,v){let W=Ta(u,v);if(W===null||v[W]!=="explain")return null;let z=[n,...v.slice(0,W)],B=v.slice(W+1);for(let X=0;X<B.length;X++){let Q=B[X];if(Q==="--json"||Q==="--help"||Q==="-h")continue;if(Q==="--cwd"){let le=B[X+1];if(le&&!le.startsWith("--"))z.push(le);X++;continue}return z}return z}function LI(n,u,v,W,z,B,X){if($I(u,v,W,z,B,X)){let Q=ar(n),le=yd(En(Q[0]??"").toLowerCase(),Q.slice(1))?Q.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...Kh(n),...le].map((ue)=>({target:ue,cwd:B}))}return qh(u,FI(n),v,W,z,B,X,()=>[])}function WI(n,u,v,W,z,B,X){let Q=ar(n);if(!To(En(Q[0]??"").toLowerCase()))return[];return Oa(u,v,W,z,B,X)??[{target:u,cwd:B}]}function qh(n,u,v,W,z,B,X,Q){let le=BI(n);if(le===null)return u.flatMap(Q);return u.flatMap((ue)=>Ri.has(le)?Yo(v.getShellSyntax(ue),v,W,z,B,X):Ma(le,ue,v,W,z,B,X))}function Kh(n){let u=ar(n);if(u.length===0)return[];let v=En(u[0]??"").toLowerCase();if(!$h.has(v))return[];let W=u[u[1]==="--"?2:1];if(v==="printf"&&W!==void 0&&!W.startsWith("-")&&!W.replaceAll("%%","").includes("%"))return[Sd(W.replaceAll("%%","%"))];return u.slice(1)}function FI(n){let u=ar(n);if(u.length===0)return[];let v=En(u[0]??"").toLowerCase(),W=u.slice(1);if(v==="echo"){let z=W.findIndex((B)=>!/^-[neE]+$/.test(B));return[(z===-1?[]:W.slice(z)).join(" ")]}if(v==="printf")return GI(W);return[]}function GI(n){let u=n[0];if(u===void 0)return[];let v=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(v===0||n.length===1)return[Sd(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/v)},(z,B)=>zI(u,W.slice(B*v,(B+1)*v)))}function zI(n,u){let v=0;return Sd(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[v]??"";return v++,z}))}function Sd(n){return n.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function $I(n,u,v,W,z,B){let X=ar(n);if(X.length===0||En(X[0]??"").toLowerCase()!=="xargs")return!1;let Q=oo(X),le=X.slice(Q.childStart);if(le.length===0)return!1;if(Q.replacementToken==="")return!1;let ue=Q.replacementToken,be=ue===null?[...le,ud]:le.map((Me)=>Me.split(ue).join(ud));return Hi(be,u,v,W,z,B).some((Me)=>Me.target.includes(ud))}function BI(n){let u=ar(n);if(u.length===0)return null;let v=En(u[0]??"").toLowerCase();if(!To(v))return null;return UI(v,u.slice(1))?v:null}function UI(n,u){let v=Cd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(gd.has(z)||Xh(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(v==="python"&&z==="-m")return!1;if(II.get(v)?.has(z))W++;continue}return!1}return!0}function Cd(n){return/^python\d/.test(n)?"python":n}function HI(n){let u=[];for(let v of n){if(ny(v))continue;let W=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(v);if(W===null)break;if(W[1]!==void 0&&W[1]!=="")u.push(W[1])}return u}var Mh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function jI(n,u){if(!u||!Mh.test(n))return n;return`~${n.replace(Mh,"").replace(/\\/g,"/")}`}function Hn(n,u){if(u==="--")return[];let v=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))v.push(u.slice(W+1));if(u.startsWith("-"))return v;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return v;if(n==="zip"&&/\.zip$/i.test(u))return v;return v.push(u),v}function VI(n){let u=-1,v=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!v&&z==="--"){v=!0;continue}if(v||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>Hn("jq",B))}return n.flatMap((W,z)=>z===u?[]:Hn("jq",W))}function qI(n){let u=[];for(let v=0;v<n.length;v++){let W=n[v]??"";if(W==="--"||!W.startsWith("-"))return[...u,...hI.has(W)?pd("git",n.slice(v).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),yI):pd("git",n.slice(v),SI)];if(u.push(...Hn("git",W)),!kn.has(W))continue;let z=n[v+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:Hn("git",z)),v++}return u}function pd(n,u,v){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((X)=>Hn(n,X))];if(v.has(B)){z++;continue}if(B.includes("=")&&v.has(B.slice(0,B.indexOf("="))))continue;W.push(...Hn(n,B))}return W}function KI(n){return n.flatMap((u,v)=>{let W=Zh(u);if(W!==null)return Dh(W.flag,W.value);let z=Yh(n[v-1]);return z===null?[]:Dh(z,u)})}function Dh(n,u){if(n==="-F"||n==="--form"){let v=u.indexOf("="),W=v===-1?u:u.slice(v+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return md(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let v=u.indexOf("@"),W=u.indexOf("=");if(v===-1||W!==-1&&W<v)return[];return md(u.slice(v+1))}return u.startsWith("@")?md(u.slice(1)):[]}function Yh(n){if(n===void 0)return null;if(Bh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function Zh(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let v=n.indexOf("=");if(v===-1)return null;let W=n.slice(0,v);return Bh.has(W)?{flag:W,value:n.slice(v+1)}:null}function md(n){return n===""||n==="-"?[]:[n]}function YI(n,u,v,W,z,B){let X=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),Q=[...n.slice(0,X===-1?n.length:X),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!oI.has(n[le]??""))continue;let ue=n.slice(le+1),be=ue.findIndex((Oe)=>iI.has(Oe)),Me=be===-1?ue:ue.slice(0,be),De=Hi(Me,u,v,W,z,B).map((Oe)=>Oe.target);if(Q.push(...De.filter((Oe)=>Oe!=="{}")),!De.includes("{}"))continue;Q.push(...n.slice(0,le).flatMap((Oe,Ne,Le)=>{if(!aI.has(Oe))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Q}function ZI(n,u,v,W,z,B,X){let Q=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(gd.has(ue)||Xh(n,ue)){let Me=u[le+1];if(Me!==void 0)Q.push(...Ma(n,Me,v,W,z,B,X)),le++;continue}let be=/^--(?:eval|exec)=(.*)$/.exec(ue);if(be!==null&&be[1]!==void 0){Q.push(...Ma(n,be[1],v,W,z,B,X));continue}if(!ue.startsWith("-"))Q.push({target:ue,cwd:B})}return Q}function Xh(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return dI.get(u[u.length-1]??"")?.has(Cd(n))??!1}function XI(n,u,v,W,z,B){if(!n.includes("system"))return[];return Cc(n)?.commands.flatMap((X)=>Yo(u.getShellSyntax(X),u,v,W,z,B))??[]}function QI(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function JI(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((v)=>v[2]).filter((v)=>v!==void 0&&v!=="");return[...u,...u.flatMap(vd),...n.match(fd)??[]]}function Ma(n,u,v,W,z,B,X){let Q=(Be)=>({target:Be,cwd:B}),le=Ek(n),ue=_k(u,le);if(ue.kind==="unmaskable")return JI(u).map(Q);let be=ue.masked.match(Th)!==null||ue.literals.some((Be)=>Ih.test(ue.masked.slice(0,Be.start))),Me=ue.masked.match(PI)!==null||ue.literals.some((Be)=>TI.test(ue.masked.slice(0,Be.start))),De=W.inlineLiteralsPresumedData===!0&&!Ri.has(n),Oe=De&&(le==="python"||le==="javascript"),Ne=De&&!(Tk(ue.masked)||be||Me)?[]:ue.literals,Le=De?Array.from(ue.masked.matchAll(Th),(Be)=>{let Gt=Be.index+Be[0].length;return{start:Gt,end:Js(ue.masked,Gt)}}):[],We=!De||Le.some((Be)=>gc(ue.masked,Be.start)&&!ak(ue,Be.start))?ue.literals:ue.literals.filter((Be)=>Ih.test(ue.masked.slice(0,Be.start))||Le.some((Gt)=>Be.start>=Gt.start&&Be.start<Gt.end)),ze=new Set(be?We:[]),st=Oe&&Ne.length>0&&!rk(ue.masked,le==="python"?"#":"//"),it=st?lk(ue.masked):[],lt=st?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(Be)=>({name:Be[0],index:Be.index})):[],Et=ik(lt),Rt=!ok(ue.masked,lt),Tt=lt.filter((Be)=>!Nh(ue.masked,{start:Be.index,text:Be.name,tokenStart:Be.index,tokenEnd:Be.index+Be.name.length},it,Et,Rt)).reduce((Be,Gt)=>{let kt=Be.get(Gt.name)??[];return kt.push(Gt.index),Be.set(Gt.name,kt)},new Map);return[...Ne.filter((Be)=>Be.text!=="").map((Be)=>{if(!st||ze.has(Be))return Q(Be.text);if(Nh(ue.masked,Be,it,Et,Rt)||ck(ue.masked,Be,it,Tt))return{...Q(Be.text),literalRole:"data"};return Ck(ue,Be,it)?{...Q(Be.text),literalRole:"write"}:Q(Be.text)}),...Ne.flatMap((Be)=>vd(Be.text)).map(Q),...De?[]:ue.literals.flatMap((Be)=>Be.text.match(fd)??[]).map(Q),...be?We.flatMap((Be)=>Oa(Be.text,v,{...W,commandHoldsPipe:!0},z,B,X)??[Q(Be.text)]):[],...Me?ue.literals.flatMap((Be)=>Ma(n,Be.text.replace(/\\(.)/g,(Gt,kt)=>kt==="n"?`
-`:kt),v,W,z,B,X)):[],...Oe?[]:[ue.masked,...ue.comments].flatMap((Be)=>Be.match(fd)??[]).map(Q),...De?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Q):[]]}var bd={"(":")","[":"]","{":"}"},Qh="and|elif|else|if|in|is|not|of|or|return|while|yield",ek=new RegExp(`(?:^|[^\\w$])(?:${Qh})$`),tk=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${Qh})\\s*\\(|/\\*`),nk=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function rk(n,u){return tk.test(n)||n.split(`
-`).some((v)=>{let W=v.indexOf(u);return W>=0&&/[()[\]{}]/.test(v.slice(W))})}function ok(n,u){return mk.test(n)||u.some((v)=>{let W=uk.get(v.name),z=v.index+v.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function ik(n){return n.some((u)=>ey(u.name).some((v)=>nk.test(v)))}var sk=new Set(["cmd","powershell","pwsh"]);function ak(n,u){let v=lo(n.masked,u),W=bd[n.masked[v]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,v+1),B=n.masked.slice(v+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(lo(n.masked,z+1)))&&!n.literals.some((X)=>X.tokenStart>v&&X.tokenStart<z&&(gd.has(X.text)||To(En(X.text).toLowerCase())||sk.has(En(X.text).toLowerCase().replace(/\.exe$/,""))))}function lk(n){let u=[];return n.split("").map((v,W)=>{let z=u.at(-1)??-1;if(v in bd)u.push(W);if(v===")"||v==="]"||v==="}")u.pop();return z})}function Nh(n,u,v,W,z){let B=v[u.tokenStart]??-1,X=n[B]??"",Q=Ko(n,u.tokenStart),le=lo(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,Q-3),Q+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(X==="["||X==="("))return!1;let ue=n[Q],be=n[le];if(X==="{"&&ue===":")return bk(n,Q);let Me=(ue===X||ue===",")&&(be===","||be===bd[X]||X==="{"&&be===":");if(X!=="(")return Me&&X!=="";return Me&&(z&&dk.test(n.slice(Math.max(0,B-20),B))||(ue===","||be===",")&&vk(n,B))}function ck(n,u,v,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
-`:""}${n.slice(z,u.tokenStart)}`,X=fk.exec(B)?.[1],Q=n[v[u.tokenStart]??-1];if(X===void 0||Q==="("||Q==="[")return!1;let le=lo(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(X);return(W.get(X)??[]).every((be)=>be===ue)}var dk=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,uk=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),mk=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,fk=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,pk=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,gk=/^\s*\.\s*write_(?:text|bytes)\s*\(/,hk=/(?:^|[^\w$.])open\s*$/,yk=/^[bt]*[awx][abtwx]*$/,Sk=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function Ck(n,u,v){let W=v[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Ko(n.masked,u.tokenStart),B=lo(n.masked,u.tokenEnd),X=n.masked[B],Q=n.masked.slice(Math.max(0,W-40),W);if(pk.test(Q))return(z===W||n.masked[z]===",")&&(X===","||X===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&gk.test(n.masked.slice(Js(n.masked,W+1)+1));if(z!==W||X!==",")return!1;if(Sk.test(Q))return!0;if(!hk.test(Q))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&yk.test(le.text)&&/^[,)]/.test(n.masked.slice(lo(n.masked,le.tokenEnd)))}function bk(n,u){let v=Ko(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,v-63),v+1))?.[0]??"",z=n[Ko(n,v+1-W.length)];return z==="{"||z===","}function vk(n,u){let v=Ko(n,u),W=n.slice(Math.max(0,v-7),v+1);return!/[\w$)\]]$/.test(W)||ek.test(W)}function Ek(n){let u=Cd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var Rk={python:"#",javascript:"/"};function _k(n,u){if(u==="opaque")return{kind:"unmaskable"};let v={masked:n.split(""),literals:[],comments:[]};return Jh(n,0,u,v,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:v.masked.join(""),literals:v.literals,comments:v.comments}}function Jh(n,u,v,W,z){let B=0;for(let X=u;X<n.length;X++){let Q=n[X]??"";if(z&&Q==="}"&&B===0)return X;if(z&&Q===Rk[v])return null;if(v==="python"&&Q==="#"){let Le=n.slice(X).search(/[\r\n]/),We=Le===-1?n.length:X+Le;W.comments.push(n.slice(X,We)),W.masked.fill(" ",X,We),X=We-1;continue}if(Q==="{")B++;if(Q==="}")B--;if(v==="simple"&&(Q==="`"||Q==="%"||Q==="<")){if(wI.test(n.slice(X)))return null}let le=Q==="'"||Q==='"'||v==="javascript"&&Q==="`"?Q:null;if(le===null)continue;if(le==="`"&&Pk(n,X))return null;let ue=v==="python"?wk(n,X):"",be=v==="python"&&n.startsWith(le.repeat(3),X)?le.repeat(3):le,Me=X+be.length,De=le==="`"||/[fF]/.test(ue),Oe=X-ue.length,Ne=De?xk(n,Oe,Me,be,v,W):Ak(n,Me,be);if(Ne===null)return null;if(!De){let Le=n.slice(Me,Ne);if(v==="simple"&&le==='"'&&AI.test(Le))return null;W.literals.push({start:Me,text:Le,tokenStart:Oe,tokenEnd:Ne+be.length}),W.masked.fill(" ",Me,Ne)}W.masked.fill(" ",X,Me),W.masked.fill(" ",Ne,Ne+be.length),X=Ne+be.length-1}return z?null:n.length}function xk(n,u,v,W,z,B){let X=z==="python"?"{":"${",Q=W==="`"||W.length===3,le="";for(let ue=v;ue<n.length;ue++){let be=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:v,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!Q&&(be===`
-`||be==="\r"))return null;let Me=z==="python"&&(be==="{"||be==="}")&&n[ue+1]===be;if(!Me&&n.startsWith(X,ue)){let Ne=Jh(n,ue+X.length,z,B,!0);if(Ne===null)return null;le+=`${X}}`,B.masked.fill(" ",ue,ue+X.length),B.masked[Ne]=" ",ue=Ne;continue}let Oe=be==="\\"&&!(z==="python"&&n[ue+1]==="{")||Me?2:1;le+=n.slice(ue,ue+Oe),B.masked.fill(" ",ue,ue+Oe),ue+=Oe-1}return null}function wk(n,u){return xI.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function Ak(n,u,v){let W=v.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
-`||B==="\r"))return null;if(n.startsWith(v,z))return z}return null}function Pk(n,u){for(let v=u-1;v>=0;v--){let W=n[v];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function Tk(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let v=u[0],W=u.index;if(lI.has(v.toLowerCase()))return!0;let z=ey(v);if(!z.some((B)=>cI.has(B)))continue;if(z.length>1)return!0;if(n[Ko(n,W)]===".")return!0;if(n[lo(n,W+v.length)]==="(")return!0}return!1}function ey(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Ko(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function lo(n,u){for(let v=u;v<n.length;v++)if(!/\s/.test(n[v]??""))return v;return n.length}function Ik(n,u,v,W,z,B){return Nk(n).flatMap((X)=>{let Q=u.getShellSyntax(X);if(Q.status==="invalid")return[];return[...Yo(Q,u,{...v,displayOperandsAreCapturedOutput:!0},W,z,B),...kk(Q,W)?Ok(Q,W).map((le)=>({target:le,cwd:z})):[]]})}function kk(n,u){let v=Us(n);for(let W=0;W<v.length;W++){let z=v[W];if(z?.kind!=="word"||En(hr(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<v.length;B++){let X=v[B];if(X?.kind==="operator")break;if(X?.kind!=="word")continue;let Q=hr(X.text,u);if(Q==="--decode"||!Q.startsWith("--")&&Q.startsWith("-")&&/[dD]/.test(Q))return!0}}return!1}function Ok(n,u){return Us(n).flatMap((v)=>v.kind==="word"?[hr(v.text,u)]:v.kind==="redirection"&&v.target?[hr(v.target,u)]:[]).flatMap(vd)}function vd(n){let u=Dk(n);if(u===null)return[];let v=Buffer.from(u,"base64").toString("utf8");if(v===""||Mk(v))return[];return Buffer.from(v,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[v]:[]}function Mk(n){return Array.from(n).some((u)=>{let v=u.charCodeAt(0);return v<32||v===127})}function Dk(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function Nk(n){let u=[],v={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(ii(z,v))continue;if(ty(n,W,v)){let B=Lk(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!v.inSingle&&z==="`"){let B=Wk(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function Lk(n,u){let v={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(ii(B,v))continue;if(ty(n,z,v)){W++,z++;continue}if(!v.inSingle&&!v.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function Wk(n,u){let v=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function ty(n,u,v){return!v.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function Fk(n){let u=[],v=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){v.push(ue);continue}let be=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(be!==null){let Me=be[1]??"",De=be[2];if(Me===bI)z=!0;if(EI.has(Me))W=!0;if(De!==void 0){if(Me===Ph)u.push(De);continue}if(_I.has(Me)){let Oe=n[le+1];if(Me===Ph&&Oe!==void 0)u.push(Oe);le++}continue}if(ue.startsWith("-")&&ue.length>1){let Me=ue.slice(1),De="",Oe="";for(let Le=0;Le<Me.length;Le++){let We=Me[Le]??"";if(vI.has(We))W=!0;if(RI.has(We)){De=We,Oe=Me.slice(Le+1);break}}if(De==="")continue;if(Oe.length>0){if(De===Ah)u.push(Oe);continue}let Ne=n[le+1];if(De===Ah&&Ne!==void 0)u.push(Ne);le++;continue}v.push(ue)}let Q=!W&&!z?v.slice(1):v;return[...u,...Q]}function ar(n){let u=n.findIndex((v)=>!ny(v)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(v));return u===-1?[]:n.slice(u)}function ny(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var Gk=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Lh=".env.",zk=[".example",".sample",".template",".tpl"],$k=[".env.example.",".env.sample."];function Bk(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function Uk(n){return n.length>0&&!/\s/.test(n)}function Da(n,u,v,W){let z=ry(n,u,v,W);return z!==""&&v.paths.entryKind(z)!=="missing"}function ry(n,u,v,W){try{return ji(n,u,v,W)}catch(z){if(z instanceof a)throw z;return""}}var Hk=/[?&][^?&=/]+=/,jk=new Set(["node_modules","__pycache__"]),Vk=[["vendor","bundle"],["vendor","cache"]];function qk(n,u,v,W,z){if(Bk(n))return null;let B=Tn(n,u,W,z);if(!B)return null;let X=Vt(B.split("/").pop()??""),Q=Vt(B),le=()=>Uk(X)||Da(n,u,W,z),ue=Vt(Jk(n,u,W,z));for(let De of pl){let Oe=`~/${De.suffixParts.join("/")}`;if((Fh(Q,Oe)||Fh(ue,Oe))&&vr(De.id,v))return De.id}if(X===".env.defaults"||X.startsWith(Lh)&&zk.some((De)=>X.endsWith(De))||$k.some((De)=>X.startsWith(De)))return null;let be=Kk(B,u,v,W,z);if(be)return be;if(Gk.has(X))return null;for(let De of fl)if(X===De.basename&&vr(De.id,v))return De.id;if(X.startsWith(Lh)&&vr(ds.id,v)&&le())return ds.id;for(let De of gl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){let Oe=X.slice(De.prefix.length)[0];if((Oe==="-"||Oe==="_")&&vr(De.id,v)&&le())return De.id}for(let De of hl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){if(X.slice(De.prefix.length)===De.suffix&&vr(De.id,v))return De.id}if(Xk(Q))return null;if(!X.includes(".")&&si.pattern.test(X)&&vr(si.id,v))return si.id;if(Hk.test(n)&&!Da(n,u,W,z))return null;let Me=Qk(X,v);if(Me)return Me;return null}function Kk(n,u,v,W,z){return us.find((B)=>{if(!vr(B.id,v))return!1;switch(B.id){case"secret.cli.claude-code":return Ht(n,qt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let X=Vt(n).split("/");return Ht(n,qt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||Ui(n,"~/.claude.json",u,W,z)||X.at(-1)==="settings.local.json"&&X.at(-2)===".claude"||X.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Ht(n,Tn("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let X=qt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return Ht(n,X,["auth.json",".credentials.json"])||qo(n,X,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let X=qt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),Q=Vt(n).split("/").at(-1)??"";return Ht(n,X,["config.toml"])||Q.endsWith(".config.toml")&&Ht(n,X,[Q])}case"secret.cli.gemini":return Ht(n,rn(qt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let X=Vt(n).split("/"),Q=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[rn(qt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return Ht(n,rn(qt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||X.at(-1)==="settings.json"&&X.at(-2)===".gemini"||(Q?.trim()?Ui(n,Q,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>Ht(n,Tn(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let X=qt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return Ht(n,X,["config.json"])||qo(n,X,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Ht(n,qt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let X=qt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q=qt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return Ht(n,X,["server.token"])||qo(n,X,["credentials"])||qo(n,Q,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let X=["config.toml","mcp.json"],Q=Vt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".kimi-code"||Ht(n,qt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),X)||Ht(n,qt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...X,"config.json","config.json.bak"])}case"secret.cli.opencode":{let X=rn(qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),Q=Vt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return Ht(n,X,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Q)&&Ht(n,X,[Q])||ue.some((be)=>Ui(n,be,u,W,z))}case"secret.cli.opencode.config":{let X=rn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),Q=W.env.get("ProgramData")?[rn(qt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Vt(n).split("/").at(-1)??"")||Ht(n,X,["config.json"])||(ue?.trim()?Ui(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...Q].some((be)=>Ht(n,Tn(be,u,W,z),le))}case"secret.cli.pi":return Ht(n,qt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return Ht(n,qt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let X=Tn("~",u,W,z);return[rn(qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),rn(X,".local","share","amp")].some((le)=>Ht(n,le,["secrets.json"]))||qo(n,rn(X,".amp"),["oauth"])}case"secret.cli.amp.config":{let X=["settings.json","settings.jsonc"],Q=[rn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),rn(Tn("~",u,W,z),".config","amp")],le=Vt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return Q.some((be)=>Ht(n,be,X))||le.at(-2)===".amp"&&X.includes(le.at(-1)??"")||(ue?.trim()?Ui(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let X=rn(qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),Q=rn(qt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return Ht(n,Tn("~/.cursor",u,W,z),["auth.json"])||Ht(n,X,["auth.json"])||Vt(n).split("/").at(-1)==="mcp-auth.json"&&co(Vt(n),Vt(Q))}case"secret.cli.cursor.config":{let X=Vt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".cursor"}case"secret.cli.grok-build":return Ht(n,qt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let X=Vt(n).split("/");return X.at(-1)==="config.toml"&&X.at(-2)===".grok"||Ht(n,qt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||Ht(n,Tn("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Ht(n,Tn("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let X=Vt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".factory"||Ht(n,Tn("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[qt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),Tn("~/.local/share",u,W,z)].some((X)=>Ht(n,rn(X,"devin"),["credentials.toml"])||qo(n,rn(X,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[qt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),Tn("~/.config",u,W,z)].some((X)=>Ht(n,rn(X,"devin"),["config.json"]));default:return!1}})?.id??null}var Wh=new WeakMap;function qt(n,u,v,W,z){let B=Wh.get(z)??new Map;Wh.set(z,B);let X=`${v}\x00${n??""}\x00${u}`,Q=B.get(X);if(Q!==void 0)return Q;let le=Tn(n?.trim()?n:u,v,W,z);return B.set(X,le),le}function Ht(n,u,v){return v.some((W)=>oy(n,rn(u,W)))}function qo(n,u,v){return v.some((W)=>co(Vt(n),Vt(rn(u,W))))}function Ui(n,u,v,W,z){return oy(n,Tn(u,v,W,z))}function oy(n,u){return Vt(n)===Vt(u)}function rn(n,...u){return Jn([n,...u].filter(Boolean).join("/"))}function Yk(n,u,v,W,z,B){if(v.length===0)return!1;let X=Vt(ji(n,u,z,B));return v.some((Q)=>co(X,Vt(ji(Q,W,z,B))))}function Zk(n,u,v,W,z,B){if(v.length===0)return!1;let X=Vt(ji(n,u,z,B));if(!X)return!1;let Q=z.env.get("HOME")??z.home,le=Q?Jn(Ut(gn(Q),z.paths,B)):"",ue=Vt(le),be=z.env.get("CC_SAFETY_NET_HOME"),Me=Vt(be?Jn(Ut(Na(gn(be)),z.paths,B)):le&&Jn(Ut(`${le}/.cc-safety-net`,z.paths,B)));if(Me&&co(X,Me))return!1;return v.some((De)=>{let Oe=vl(De);if(Oe&&Gh.basename(X)!==Vt(Oe.name))return!1;let Ne=Vt(ji(Oe?.root??De,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return co(X,Ne)&&!(Oe&&X===Ne)})}function Xk(n){let u=n.split("/");return u.some((v)=>jk.has(v))||Vk.some(([v,W])=>u.some((z,B)=>z===v&&u[B+1]===W))}function Qk(n,u){let v=n.lastIndexOf("."),W=v>0&&v<n.length-1?n.slice(v+1):"";if(W==="")return null;for(let z of yl)if(W===z.extension&&vr(z.id,u))return z.id;for(let z of Sl)if(z.pattern.test(W)&&vr(z.id,u))return z.id;return null}function Vt(n){return n.toLowerCase()}function vr(n,u){return!u?.disabledRules?.includes(n)}function Tn(n,u,v,W){let{home:z,normalized:B}=Ed(n,v,W);if(!B)return"";if(!z)return B;let X=Rd(B,z),Q=ka(X)?X:Jn(Na(u,X)),le=Jn(Ut(Q,v.paths,W));if(!co(le,z)){if(ka(X))return le;return le===Q?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function Fh(n,u){return n===u||n.startsWith(`${u}/`)}function Jk(n,u,v,W){let{home:z,normalized:B}=Ed(n,v,W);if(!B||!z)return"";let X=Rd(B,z),Q=Gh.normalize(ka(X)?X:Jn(Na(u,X))),le=Jn(gn(v.env.get("HOME")??v.home)),ue=(De)=>process.platform==="win32"?De.toLowerCase():De,be=[z,le].find((De)=>De!==""&&co(ue(Q),ue(De)));if(be===void 0)return"";let Me=Q.slice(be.length);return Me?`~${Me}`:"~"}function ji(n,u,v,W){let{home:z,normalized:B}=Ed(n,v,W);if(!B)return"";let X=z?Rd(B,z):B;return Jn(Ut(ka(X)?X:Na(u,X),v.paths,W))}function Ed(n,u,v){let W=u.env.get("HOME")??u.home,z=W?Jn(Ut(gn(W),u.paths,v)):"",B=Jn(gn(eO(hr(n,u))));return{home:z,normalized:B}}function eO(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return tI(n)}catch{return n}}function Rd(n,u){if(n==="~")return u;if(n.startsWith("~/"))return rn(u,n.slice(2));return n}function tO(n){if(process.platform==="win32")return!0;return eI.parse(n).root.length>1}function Jn(n){let u=n.trim(),v=(u.includes("\\")&&tO(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(v==="/")return v;return v.replace(/\/+$/g,"")}function co(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function En(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,v){super(`CC Safety Net ${n} dependency failed`,{cause:v});this.stage=n;this.evaluation=u}}var nO={findPolicyMutation:_h,findGitMetadataMutation:Mf,resolveGitMetadata:sO,loadPolicySnapshot:w,findSensitiveTarget:Hh,analyzeCommand:yh,getModes:O},rO=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,oO=["workdir","cwd","working_directory"];function G(n,u){let v={...nO,...u.dependencies},W=cO(n),z=()=>Lr("config-load",W,()=>v.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,X=B?.policy.commandTools.find((kt)=>kt.name===n.toolName),Q=X&&W?iO(n,W,X.cwd,u.environment.paths):n;if("decision"in Q)return Q;let le=Q,ue=le===n?{}:{promotedInvocation:le},be=Vi(le)?le.command:W,Me=Lr("policy-protection",be,()=>Tf(le)),De=Io(Me,"input-candidate"),Oe=Io(Me,"declared-command");if(Vi(le)&&le.command?.trim()&&Oe?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:tr,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(De?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:Pf,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=Rn(),Le=Lr("policy-protection",be,()=>v.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=Lr("policy-protection",be,()=>v.findPolicyMutation(Me,u.environment,Ne));if(We){let kt=be??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:kt,segment:We.target}}}}let ze=Lr("policy-protection",be,()=>bh(Me,u.environment,Ne));if(ze){let kt=be??ze.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:kt,segment:ze.target}}}}let st=Lr("policy-protection",be,()=>v.findGitMetadataMutation(Me,Le,u.environment,Ne));if(st){let kt=be??st.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:kt,segment:st.target}}}}let it=B??z(),lt=it.policy,Et=v.getModes(lt,u.environment.env),Rt={level:Et.effectiveLevel,...aO(it),...ue},Tt=lt.secretProtection.enabled===!1?null:Lr("secret-protection",be,()=>v.findSensitiveTarget(Me,lt.secretProtection,u.environment,Ne,{strict:Vi(le)||De?.program.dialect==="powershell"?Et.strict:void 0}));if(Tt){let kt=be??Tt.target;return{stage:"secret-protection",...Rt,decision:{kind:"deny",reason:zh,intent:"hard_stop",ruleId:Tt.ruleId,evidence:{command:kt,segment:Tt.target}}}}if(!Vi(le))return{stage:"non-command",...Rt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...sy(be),...Rt};let Be=Lr("command-analysis",be,()=>Sh(()=>v.analyzeCommand(le.command,{cwd:le.context.configCwd,effectiveCwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:it,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Et.capabilities,worktreeMode:Et.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},lO(Me),Me.store),le.command,u.trace)),Gt=le.route.shell==="auto"&&Me.store.readsAutoAsPowerShell()?()=>{let kt=u.trace?.branch(),Qt={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...kt?{trace:kt.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>it,resolveGitMetadata:()=>Le}}),...ue};return{decision:Qt.decision,withItsTrace:()=>(kt?.adopt(),Qt)}}:void 0;if(Be.decision){let kt=!Et.strict&&(Be.decision.ruleId==="raw-text.dangerous-command"||Be.decision.reason===Zr&&!rO.test(Be.decision.evidence?.segment??"")&&Gn(le.command)===null),Qt=kt?Gt?.():void 0;if(Qt?.decision.kind==="deny"&&!Qt.decision.unverifiedByStandardMode)return Qt.withItsTrace();return{stage:"command-analysis",...Rt,..."errorCode"in Be?{errorCode:Be.errorCode}:{},decision:kt?{...Be.decision,unverifiedByStandardMode:!0}:Be.decision}}return Gt?.().withItsTrace()??{stage:"command-analysis",...Rt,decision:{kind:"allow"}}}function iO(n,u,v,W){let z=[...new Set((v?[v]:oO).flatMap((le)=>{let ue=Object.getOwnPropertyDescriptor(n.input,le);return ue?[ue.value]:[]}))],B=z.filter((le)=>typeof le==="string"&&le.trim()!=="");if(z.length>1||B.length!==z.length)return sy(u);let X=B[0],Q=X===void 0?n.context.configCwd:du(X,n.context.configCwd,W);if(!Q){let le=I({directory:"requested",problem:"unusable",cwd:X??""});return{stage:"command-validation",decision:{kind:"deny",reason:le.reason,ruleId:le.ruleId,intent:le.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:Q},u)}function sO(n,u){let v=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(v.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(v.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(v.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(v.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(v.flatMap((W)=>W.hooksDirectories))])})}function aO(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function lO(n){return Io(n,"declared-command")?.program}function cO(n){try{return de(n.input)}catch(u){let v=Vi(n)?n.command:void 0;throw new g("policy-protection",iy("policy-protection",u instanceof h?void 0:v,u),u)}}function Lr(n,u,v){try{return v()}catch(W){throw new g(n,iy(n,W instanceof h?void 0:u,W),W)}}function iy(n,u,v){let W=v instanceof H?{reason:rr,ruleId:"analysis.strict-unparseable"}:v instanceof a||v instanceof E?{reason:Wa,ruleId:"analysis.limit"}:{reason:Zo,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function sy(n){let u=V();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Vi(n){return n.route.kind==="command"}
-export{l,a,ee,Ve,dt,A,Pt,pt,Fe,te,V,I,ne,_t,c,r,ft,$e,O,k,xe,At,h,je,b,de,Se,It,mt,gt,d,qe,i,R,s,pe,o,x,we,q,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,Ke,ge,f,e,Je,Ue,Ye,Te,vt,bt,he,He,ye,Ze,ie,J,Xe,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Qe,et,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Mt,Ie,rt,ot,g,G};