cc-safety-net 2.7.2 → 2.7.4

package/dist/chunks/index-k92nxp12.js

@@ -0,0 +1,54 @@
+var Ga="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",tr="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",ei="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Fa={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},po={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...Fa},processedCandidateBytes:{cap:4194304,...Fa},pathEnvironmentExpansion:{cap:64,...Fa},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...po},trackedHeredocFiles:{cap:64,...po},scriptFiles:{cap:64,...po},controlFlowStates:{cap:64,...po},wrapperPeelIterations:{cap:20,...po},derivedCommandShape:po});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function _n(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,v=1){let W=(n.get(u)??0)+v;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var uy=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ee(n){return qe(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function qe(n){return uy.reduce((u,v)=>u.replace(v,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return Td(n).reduceRight((u,v)=>`${u.slice(0,v.valueStart)}<redacted>${u.slice(v.valueEnd)}`,n)}function A(n){return qe(dt(n))}function Pt(n){return Td(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function Td(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let v=n[u.index-1];if(u.index>0&&v&&!/[\s"'([{]/.test(v))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:my(n,W)}]})}function my(n,u){if(n.startsWith("$(",u))return fy(n,u);let v=n[u];if(v==='"'||v==="'"){for(let z=u+1;z<n.length;z++){if(v==='"'&&n[z]==="\\"){z++;continue}if(n[z]===v)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function fy(n,u){let v=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){v++,z++;continue}if(B!==")")continue;if(v--,v===0)return z+1}return n.length}var py={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function gy(n){let u=n.maxLen??200,v=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${v(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(v(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(v(n.segment))}`:void 0,n.cwd?`Working directory: ${W(v(n.cwd))}`:void 0,n.configWarning?`Config warning: ${v(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":py[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
+
+`)}function Fe(n,u){if(n.decision.kind!=="deny")return;let v=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:v?.command,segment:v?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function te(n={}){return{reason:ei,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function q(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var hy={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...hy[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function ne(n){return gy({...n,redact:ee})}function _t(n){return ee(n instanceof Error?n.message:String(n))}import{spawnSync as Xy}from"node:child_process";import{lstatSync as Qy,realpathSync as Jy,statSync as eS}from"node:fs";import{isAbsolute as tS}from"node:path";import{homedir as nS,tmpdir as rS}from"node:os";import{statSync as Ky}from"node:fs";import{join as Yy}from"node:path";import{basename as Od,dirname as yy,isAbsolute as Sy,join as by,normalize as Cy,resolve as Id}from"node:path";var Ey=256,Xi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Sn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function cr(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function Ua(n,u){return za(n,0,u)}function za(n,u,v){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let Q=$a(n,z+2),le=vy(n,z,u);if(le===null){if(Xi.has(Q))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=Ry(ue,u,v),z=le+1;continue}let X=$a(n,z+1);if(!X){W+="$",z++;continue}W+=Ba(X,v)??`$${X}`,z+=X.length+1}return W}function vy(n,u,v){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,v+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function Ry(n,u,v){let W=n.slice(2,-1),z=$a(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return Ba(z,v)??n;let X=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!X){if(Xi.has(z))throw new a("pathEnvironmentExpansion");return n}if(!Xi.has(z))return n;if(X.endsWith("="))throw new a("pathEnvironmentExpansion");let Q=Ba(z,v),le=X.startsWith(":")?Q!==null&&Q!=="":Q!==null;if(X.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(X.endsWith("-")||X.endsWith("?"))return le?Q??"":za(B.slice(X.length),u+1,v);return le?za(B.slice(X.length),u+1,v):""}function $a(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let v=u+1;while(/[A-Za-z0-9_]/.test(n[v]??""))v++;return n.slice(u,v)}function Ba(n,u){if(!Xi.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function Ht(n,u,v){if(!n)return n;let W=v.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){Md(v,B);let X=u.realpath(B);if(X!==null)return kd(v,n,X,z);let Q=yy(B);if(Q===B||z.length>=Ey)return kd(v,n,B,z);z.push(Od(B)),B=Q}}function kd(n,u,v,W){let z=W.length===0?v:by(v,...W.reverse());return n.resolvedPaths.set(u,z),z}function wy(n,u,v){let W=v.resolvedPaths.get(n);if(W!==void 0)return W;Md(v,n);let z=u.realpath(n);if(z!==null)v.resolvedPaths.set(n,z);return z}function Md(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function bn(n,u,v,W){let z=Nd(n,u,v);if(!z)return"";return Ht(z,v.paths,W).replace(/\\/g,"/")}function Dd(n,u,v,W,z){let B=Nd(n,u,v);if(!B)return null;if(z(Od(B)))return Ht(B,v.paths,W).replace(/\\/g,"/");let X=wy(B,v.paths,W);return X===null?null:X.replace(/\\/g,"/")}function Nd(n,u,v){let W=v.home,z=Ua(n.trim(),v).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?Id(W,z.slice(2)):z,X=Sn(B);return Cy(Sy(X)?X:Id(u,X))}import{spawnSync as _y}from"node:child_process";import{accessSync as Ld,constants as Wd,existsSync as ti,lstatSync as xy,opendirSync as Ay,readFileSync as ni,realpathSync as go,statSync as ho}from"node:fs";import{dirname as zd,isAbsolute as Ha,join as Gn,resolve as Qi}from"node:path";var Py=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Ty=5000;function $d(n,u=Hy(),v=Ty){let W=Iy(n),z=W===null?null:ky(W);if(W===null||z===null)return null;let B=By(W,z,u,v);return B===null?null:{recursiveSubmodules:B}}function Iy(n){try{let u=go(Qi(n));return ho(u).isDirectory()?u:null}catch{return null}}function ky(n){let u=$y(n);if(!u)return null;try{let v=xy(u);if(v.isSymbolicLink()||!v.isFile())return null;let W=ja(u);if(!W?.commonDir)return null;if(!Dy(W.gitDir,u))return null;return Hd(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function ja(n){try{let u=Oy(n);if(!u)return null;let v=go(Ha(u)?u:Qi(zd(n),u));if(!ho(v).isDirectory())return null;return{gitDir:v,commonDir:My(v)}}catch{return null}}function Oy(n){let u=ni(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function My(n){try{let u=ni(Gn(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let v=go(Ha(u)?u:Qi(n,u));return ho(v).isDirectory()?v:null}catch{return null}}function Dy(n,u){let v=Ny(n);return v===null?!1:Ly(n,v,u)}function Ny(n){let u=Gn(n,"gitdir");if(!ti(u))return null;let v=ni(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return v===""?null:v}function Ly(n,u,v){try{return Wy(Ha(u)?u:Qi(n,u),v)}catch{return!1}}function Wy(n,u){try{let v=ho(n),W=ho(u);if(v.ino!==0&&W.ino!==0&&v.dev===W.dev&&v.ino===W.ino)return!0}catch{}return Fd(go.native(n))===Fd(go.native(u))}function Fd(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),v=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?v.toLowerCase():v}function Bd(n){try{return Ld(Gn(n,"objects"),Wd.X_OK),Ld(Gn(n,"refs"),Wd.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(jd(Gn(n,"HEAD")))}catch{return!1}}function Ud(n){return ti(Gn(n,"commondir"))||Hd(n,n)}function Hd(n,u){return[Gn(u,"config"),Gn(n,"config.worktree")].some(Fy)||zy(n)}var Gd=1048576;function jd(n){let u=ho(n);if(!u.isFile()||u.size>Gd)throw Error(`${n} is not a regular file within ${Gd} bytes`);return ni(n,"utf-8")}function Fy(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(jd(n))}catch(u){return u.code!=="ENOENT"}}var Gy=1e4;function zy(n){let u=[n],v=0;try{while(u.length>0){let W=u.pop(),z=Ay(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(v++,B.isSymbolicLink()||B.isFIFO()||v>Gy)return!0;let X=W===n&&B.name==="objects";if(B.isDirectory()&&!X)u.push(Gn(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function $y(n){try{return Va(go(n))}catch{return null}}function Va(n){let u=n;while(!0){let v=Gn(u,".git");if(ti(v))return v;let W=zd(u);if(W===u)return null;u=W}}function By(n,u,v,W){if(Uy(u))return!0;if(v===null)return!0;let z=_y(v,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:jy(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&Vd(z.stdout.trim())}function Uy(n){return[Gn(n.commonDir,"config"),Gn(n.gitDir,"config.worktree")].filter((u)=>ti(u)).some((u)=>Vy(u))}function Hy(){return Py.find((n)=>ti(n))??null}function ri(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function jy(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!ri(u)))}function Vy(n){let u;try{u=ni(n,"utf-8")}catch{return!0}let v="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let X=B.match(/^\[([^\]]+)\]$/);if(X){v=X[1]?.trim().toLowerCase()??"";continue}let Q=B.indexOf("="),le=(Q===-1?B:B.slice(0,Q)).trim().toLowerCase(),ue=Q===-1?"true":B.slice(Q+1).trim();if(qy(v)&&le==="path")return!0;if(v==="submodule"&&le==="recurse")W=Vd(ue)}return W}function qy(n){return n==="include"||n.startsWith("includeif ")}function Vd(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function qd(n,u){if(n==="")return null;let v=_n(),W=Va(bn(n,n,u,v)),z=W?Zy(W,n,u,v):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Zy(n,u,v,W){try{let z=bn(n,u,v,W),B=Ky(n),X=B.isFile()?z:null,Q=B.isFile()?ja(n):null,le=(B.isDirectory()?[z]:[Q?.gitDir,Q?.commonDir]).flatMap((be)=>be?[yo(bn(be,u,v,W))]:[]),ue=[...new Set(B.isDirectory()?[yo(n.replace(/\\/g,"/")),...le]:le)];return{entry:yo(z),markerFile:X?yo(X):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((be)=>{let Oe=yo(Yy(be,"hooks").replace(/\\/g,"/"));return[Oe,yo(bn(Oe,u,v,W))]}))]}}catch{return null}}function yo(n){return process.platform==="win32"?n.toLowerCase():n}var oS={realpath:(n)=>{try{let u=Jy(n);return tS(u)?u:null}catch{return null}},entryKind:(n)=>{try{let u=Qy(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return eS(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return sS({env:new Map(Object.entries(process.env).flatMap(([u,v])=>v===void 0?[]:[[u,v]])),home:Sn(process.env.HOME||nS()),tmpdir:rS(),darwinUserTempDir:()=>Ji(n,"",iS),paths:oS})}function iS(){if(process.platform!=="darwin")return null;let n=Xy("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function sS(n,u={}){let v=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(X)=>Ji(v,X,()=>qd(X,B)),worktreeFacts:(X)=>Ji(W,X,()=>$d(X)),isGitDirectory:Bd,gitDirectoryRedirects:(X)=>Ji(z,X,()=>Ud(X)),...u};return B}function Ji(n,u,v){let W=n.get(u);if(W!==void 0)return W;let z=v();return n.set(u,z),z}var So=["fail_closed","paranoid_rm","paranoid_interpreters"],es={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},ts=["standard","strict","paranoid"];function Kd(n,u){if(!u)return n;return ts.indexOf(u)>ts.indexOf(n)?u:n}function Yd(n){let u=xe(r.level,n);return ts.find((v)=>v===u)}function Zd(n,u){return Kd(n,Yd(u))}function aS(n){let u=xe(r.level,n);if(!u)return;let v=Yd(n);if(v)return v;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${ts.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function $e(n){return ft(xe(r.auditScope,n))==="all"}function qa(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let v=n.safety?.level??"standard",W=aS(u),z=Kd(v,W),B=es[z],X={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},Q={failClosed:z===v?"preset":"environment",paranoidRm:z===v?"preset":"environment",paranoidInterpreters:z===v?"preset":"environment"},le={failClosed:[`policy safety.level=${v}`],paranoidRm:[`policy safety.level=${v}`],paranoidInterpreters:[`policy safety.level=${v}`]};if(z!==v)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)X.failClosed=n.safety.overrides.failClosed,Q.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)X.paranoidRm=n.safety.overrides.paranoidRm,Q.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)X.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,Q.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))X.failClosed=!0,Q.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))X.paranoidRm=!0,X.paranoidInterpreters=!0,Q.paranoidRm="environment",Q.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))X.paranoidRm=!0,Q.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))X.paranoidInterpreters=!0,Q.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:X.failClosed,paranoidRm:X.paranoidRm,paranoidInterpreters:X.paranoidInterpreters,worktreeMode:ue,effectiveLevel:qa(X),capabilities:{fail_closed:{enabled:X.failClosed,source:Q.failClosed,sources:le.failClosed},paranoid_rm:{enabled:X.paranoidRm,source:Q.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:X.paranoidInterpreters,source:Q.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let v=typeof n==="string"?oi(n,u):xe(n,u);return v==="1"||v?.toLowerCase()==="true"}function oi(n,u){return u.get(n)}function xe(n,u){let v=oi(n.name,u);if(v!==void 0)return v;if(n.legacyName)return oi(n.legacyName,u);return}function At(n,u){return oi(n.name,u)!==void 0||!!n.legacyName&&oi(n.legacyName,u)!==void 0}import{types as lS}from"node:util";var cS=new Set(["applypatch","patch"]),dS=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),uS=new Set(["grep","grepsearch","rg"]),mS=new Set(["find","findbyname","glob"]),fS=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),pS=new Set(["command","diff","input","patch","patchtext"]),Xd=new TextEncoder,gS=new TextDecoder,hS=/\s/,yS=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var ii=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function je(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function rs(n){return fS.has(je(n))}function b(n){let u=je(n);if(cS.has(u))return"patch";if(uS.has(u))return"grep";if(mS.has(u))return"glob";if(dS.has(u))return"path";return"unknown"}function de(n){if(!n||typeof n!=="object")return;lu(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)nr();return}if(u.get||u.set)nr();let v=u.value;return typeof v==="string"&&v!==""?v:void 0}function nu(n,u){return ru(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function ru(n,u,v,W,z){let B=au(n,W,z);if(typeof n==="string")return v?[n]:[];if(!B)return[];let X=B.entries.flatMap(([Q,le])=>ru(le,u,B.array?v:u.has(ou(Q)),W,z+1));return W.ancestors.delete(B.object),X}function ou(n){return n.replace(/-/g,"_").toLowerCase()}function iu(n){return su(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(bS)}function su(n,u,v,W){let z=au(n,v,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([X,Q])=>su(Q,z.array?u:pS.has(ou(X)),v,W+1));return v.ancestors.delete(z.object),B}function SS(n,u,v){if(u.nodes++,n!==null&&typeof n==="object"&&v>ii.maxDepth||u.nodes>ii.maxNodes)nr();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>ii.maxStringBytes||u.stringBytes>ii.maxAggregateStringBytes)nr()}function au(n,u,v){if(SS(n,u,v),!n||typeof n!=="object")return null;let W=lu(n);if(u.ancestors.has(n))nr();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>ii.maxKeys)nr();let B=z.flatMap((X)=>{let Q=Object.getOwnPropertyDescriptor(n,X);if(!Q||Q.get||Q.set)nr();return typeof X==="string"&&Q.enumerable?[[X,Q.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function lu(n){if(lS.isProxy(n))nr();let u=Array.isArray(n),v=Object.getPrototypeOf(n);if(u&&v!==Array.prototype||!u&&v!==Object.prototype&&v!==null)nr();return u}function nr(){throw new h}function bS(n){let u=[],v=n.split(/\r?\n/),W=!1,z=!1,B=null,X=null,Q=()=>{z=!1,B=null,X=null};for(let le=0;le<v.length;le++){let ue=v[le]??"";if(ue==="*** Begin Patch"){W=!0,Q();continue}if(ue==="*** End Patch"){W=!1,Q();continue}if(ue.startsWith("@@")){let be=CS(ue);if(z=!0,B=be?.oldLines??null,X=be?.newLines??null,B===0&&X===0)Q();continue}if(z&&B!==null&&X!==null){let be=ue.startsWith(" ")||ue.startsWith("-")?1:0,Oe=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-be),X=Math.max(0,X-Oe),B===0&&X===0)Q();continue}if(ue.startsWith("*** ")){Q(),u.push(...Ka(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...Ka(ue));continue}if(ue.startsWith("--- ")){let be=v[le+1]??"";if(!be.startsWith("+++ "))continue;u.push(...Za(ns(ue.slice(4),!0),ns(be.slice(4),!0))),le++;continue}if(!W)u.push(...Ka(ue))}return u}function CS(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function Ka(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return tu(u[1]);let v=/^\*\*\* Move to: (.+)$/.exec(n);if(v?.[1])return tu(v[1]);if(n.startsWith("diff --git "))return ES(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return eu(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return eu(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return PS(B[1]);return[]}function ES(n){let u=vS(n);if(u.length===2&&u[0]&&u[1])return Za(u[0],u[1]);let v=RS(n);return v?Za(n.slice(v.oldStart,v.oldEnd),n.slice(v.newStart,v.newEnd)):[]}function vS(n){let u=[],v=0;while(v<n.length&&u.length<2){while(Wr(n[v]))v++;if(v>=n.length)break;let W=n[v]==='"'||n[v]==="'"?n[v]:void 0;if(!W){let B=v;while(v<n.length&&!Wr(n[v]))v++;u.push(n.slice(B,v));continue}let z=cu(n,v,W);if(!z)return[];u.push(z.value),v=z.end}while(Wr(n[v]))v++;return v===n.length?u:[]}function RS(n){let u=0;while(u<n.length&&Wr(n[u]))u++;let v=n.length;while(v>u&&Wr(n[v-1]))v--;let W=0,z=u;while(z<v){if(!Wr(n[z])){z++;continue}let B=z;while(z<v&&Wr(n[z]))z++;if(B===u||z===v)continue;if(W++,W>yS)nr();if(wS(n,u,B,z,v))return{oldStart:u,oldEnd:B,newStart:z,newEnd:v}}return null}function wS(n,u,v,W,z){if(Ya(n,u,v,W,z))return!0;let B=Qd(n,"/",u,v),X=Qd(n,"/",W,z);if(B<=u||X<=W)return!1;if(Ya(n,u,B,W,X))return!1;return Ya(n,B+1,v,X+1,z)}function Ya(n,u,v,W,z){if(v-u!==z-W)return!1;for(let B=0;B<v-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function Qd(n,u,v,W){for(let z=v;z<W;z++)if(n[z]===u)return z;return-1}function Wr(n){return n!==void 0&&hS.test(n)}function cu(n,u,v){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===v)return{value:gS.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||v==="'"){W.push(...Xd.encode(B)),z+=B.length;continue}let X=n.slice(z+1),Q=/^[0-7]{1,3}/.exec(X)?.[0];if(Q){W.push(Number.parseInt(Q,8)),z+=Q.length+1;continue}W.push(...Xd.encode(_S(X[0]??""))),z+=2}return null}function _S(n){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n}function xS(n){return si(TS(n))}function Za(n,u){if(n==="/dev/null")return Jd(u);if(u==="/dev/null")return Jd(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(si);let v=AS(n,u)??(n===u?du(n):null);return[n,u,...v?[v]:[]].flatMap(si)}function Jd(n){let u=du(n);return[n,...u?[u]:[]].flatMap(si)}function du(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function AS(n,u){let v=n.indexOf("/"),W=u.indexOf("/");if(v<1||W<1)return null;if(n.slice(0,v)===u.slice(0,W))return null;let z=n.slice(v+1);return z===u.slice(W+1)?z:null}function eu(n){return xS(ns(n,!0))}function PS(n){return si(ns(n,!1))}function ns(n,u){let v=n.trim(),W=v[0]==='"'||v[0]==="'"?v[0]:void 0;if(W){let z=cu(v,0,W);if(z&&(u||v.slice(z.end).trim()===""))return z.value}return u?v.split("\t",1)[0]?.trim()??"":v}function TS(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function si(n){return n===""||n==="/dev/null"?[]:[n]}function tu(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}import{accessSync as IS,constants as uu,statSync as kS}from"node:fs";import{isAbsolute as Xa,relative as OS,resolve as mu,sep as MS}from"node:path";function Se(n){try{if(!kS(n).isDirectory())return!1;return IS(n,uu.R_OK|uu.X_OK),!0}catch{return!1}}function It(n,u,v){if(cr(n))return;let W=u.flatMap((B)=>os(B,v));if(!W[0])return;let z=os(Xa(n)?n:mu(W[0],n),v)[0];if(!z)return;return W.some((B)=>DS(z,B))?z:void 0}function fu(n,u,v){if(cr(n))return;return os(Xa(n)?n:mu(u,n),v)[0]}function mt(n,u){return n.flatMap((v)=>os(v,u))[0]}function os(n,u){let v=u.realpath(n);if(v===null)return[];return u.isDirectory(v)?[v]:[]}function DS(n,u){let v=OS(u,n);return v===""||v!==".."&&!v.startsWith(`..${MS}`)&&!Xa(v)}var NS=8388608;async function gt(n){let u=[],v=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(v+=z.byteLength,v>NS)throw LS(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,v).toString("utf-8")}function LS(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,v,W,z){if(v.kind!=="command")return{toolName:n,input:u,route:v,context:W};return{toolName:n,input:u,route:v,context:W,command:z}}import{dirname as Br}from"node:path";import{closeSync as WS,constants as ai,fstatSync as Qa,fsyncSync as FS,lstatSync as zn,mkdirSync as pu,openSync as gu,readdirSync as el,readFileSync as GS,realpathSync as bo,renameSync as zS,rmdirSync as hu,statSync as Ja,unlinkSync as tl,writeFileSync as $S}from"node:fs";import{isAbsolute as yu,join as Fr,normalize as BS,parse as is,relative as nl,resolve as rl,sep as ss}from"node:path";function Ve(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var US=Symbol("PolicyFilesystemScope"),HS=Symbol("PolicyFilesystemTarget"),Su=ai.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[US]:!0,root:rl(n),label:u}}function li(n,u){let v=BS(u);if(u===""||yu(u)||v===".."||v.startsWith(`..${ss}`))throw new i(n.label);return{[HS]:!0,scope:n,relativePath:v,path:Fr(n.root,v)}}function s(n,u){return li(n,nl(n.root,rl(u)))}function pe(n,u="rules policy"){let v=rl(n),W=is(v).dir;return li(R(W,u),nl(W,v))}function o(n){return dr(n.scope.label,()=>{if(!fn(n))return null;let u=gu(n.path,ai.O_RDONLY|Su);return Cu(u,()=>{let v=Qa(u);if(!v.isFile())throw new i(n.scope.label);let W=GS(u,"utf-8"),z=zn(n.path);if(!z.isFile()||z.isSymbolicLink()||v.dev!==z.dev||v.ino!==z.ino)throw new i(n.scope.label);return fn(n),W})})}function x(n,u,v=384,W){let z=`${n.path}.${Ve()}.tmp`;dr(n.scope.label,()=>{VS(n),fn(n);let B=gu(z,ai.O_CREAT|ai.O_EXCL|ai.O_WRONLY|Su,v),X=Cu(B,()=>{let Q=Qa(B);if(!Q.isFile())throw new i(n.scope.label);$S(B,u,"utf-8"),FS(B);let le=Qa(B);if(!le.isFile()||le.dev!==Q.dev||le.ino!==Q.ino)throw new i(n.scope.label);return le});fn(n),KS(n,z,X.dev,X.ino),zS(z,n.path),W?.(n.path),fn(n)},()=>YS(z))}function bu(n,u){if(n.path===u.path)return!0;return dr(n.scope.label,()=>{if(!fn(n)||!fn(u))return!1;let v=(W)=>Fr(bo(is(W).dir),is(W).base);return v(n.path)===v(u.path)})}function we(n){let u=dr(n.scope.label,()=>{if(!fn(n,"directory"))return null;let v=el(n.path);return fn(n,"directory"),v});if(!u)return null;return dr(n.scope.label,()=>{let v=u.map((W)=>{let z=li(n.scope,Fr(n.relativePath,W)),B=zn(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return as(ol(n.scope),bo(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return fn(n,"directory"),v})}function V(n){dr(n.scope.label,()=>{if(!fn(n))return;tl(n.path),fn(n)})}function Ot(n){dr(n.scope.label,()=>{if(!jS(n))return;vu(n),fn(n,"directory")})}function Dt(n){dr(n.scope.label,()=>{if(!fn(n,"directory"))return;hu(n.path),fn(n,"directory")})}function jS(n){return dr(n.scope.label,()=>{if(!fn(n,"directory"))return!1;return Eu(n),!0})}function dr(n,u,v){try{return u()}catch(W){if(v?.(),W instanceof i)throw W;throw new i(n)}}function Cu(n,u){try{return u()}finally{WS(n)}}function fn(n,u="file"){let v=Ru(n.scope);if(!v)return!1;let W=n.relativePath.split(ss);for(let z of W.keys()){let B=Fr(n.scope.root,...W.slice(0,z+1)),X=zn(B,{throwIfNoEntry:!1});if(!X)return!1;if(X.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!X.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!X.isFile():!X.isDirectory()))throw new i(n.scope.label);as(v,bo(B),n.scope.label)}return!0}function Eu(n){for(let u of el(n.path)){let v=li(n.scope,Fr(n.relativePath,u)),W=zn(v.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())Eu(v)}fn(n,"directory")}function vu(n){for(let u of el(n.path)){let v=li(n.scope,Fr(n.relativePath,u)),W=zn(v.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){vu(v);continue}if(!W.isFile())throw new i(n.scope.label);tl(v.path)}hu(n.path)}function VS(n){qS(n.scope);let u=ol(n.scope),v=n.relativePath.split(ss).slice(0,-1);for(let W of v.keys()){let z=Fr(n.scope.root,...v.slice(0,W+1));if(!zn(z,{throwIfNoEntry:!1}))pu(z,{mode:448});let B=zn(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);as(u,bo(z),n.scope.label)}}function qS(n){if(zn(n.root,{throwIfNoEntry:!1})){if(!Ja(n.root).isDirectory())throw new i(n.label);return}let u=[],v=n.root;while(!zn(v,{throwIfNoEntry:!1})){u.unshift(v);let W=is(v).dir;if(W===v)throw new i(n.label);v=W}if(!Ja(v).isDirectory())throw new i(n.label);for(let W of u){pu(W,{mode:448});let z=zn(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function Ru(n){if(!zn(n.root,{throwIfNoEntry:!1}))return null;if(!Ja(n.root).isDirectory())throw new i(n.label);return bo(n.root)}function ol(n){let u=Ru(n);if(!u)throw new i(n.label);return u}function KS(n,u,v,W){let z=zn(u);if(!z.isFile()||z.isSymbolicLink()||z.dev!==v||z.ino!==W)throw new i(n.scope.label);as(ol(n.scope),bo(u),n.scope.label)}function as(n,u,v){let W=nl(n,u);if(W===".."||W.startsWith(`..${ss}`)||yu(W))throw new i(v)}function YS(n){try{tl(n)}catch{}}import{dirname as Gr,isAbsolute as eb,join as zr,relative as tb,resolve as Rr,sep as nb}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ce="rulebook.json",Ee=".cc-safety-net/rules";var wu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,ZS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,_u=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,XS=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),QS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Nt=new RegExp(`^${XS}/(${m.source.slice(1,-1)})/${QS}$`);function JS(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function xu(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(wu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let v=u[3].lastIndexOf("/");if(v<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,v),z=u[3].slice(v+1);if(!W||!_u.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:JS(z),name:z}}function re(n){return ZS.test(n)}function fe(n){return _u.test(n)}function T(n){return wu.test(n)}function Lt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var Au="rule.json",ls="policy.json",Pu=".cc-safety-net",rb="rules",ob="CC_SAFETY_NET_HOME",Tu="`cc-safety-net rule update`";function ib(n){return Rr(n,Ee)}function D(n){return zr(ib(n),Au)}function S(n){return zr(Rr(n),Pu,ls)}function me(n,u={}){return u.userConfigDir??(u.userConfigPath?Gr(u.userConfigPath):zr(sb(n),rb))}function sb(n){let u=n.env.get(ob);return u?Rr(Sn(u)):zr(n.home,Pu)}function K(n,u={}){return zr(me(n,u),Au)}function p(n,u={}){return zr(Gr(me(n,u)),ls)}function L(n,u){let v=_n();return Ht(S(u.cwd),n.paths,v)===Ht(Rr(p(n,u)),n.paths,v)}function oe(n,u){let v=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=ht(n,u),B=yt(W,u.cwd);return{userConfigPath:v,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,v),projectConfigTarget:s(B,W)}}function ht(n,u){let v=u.userConfigPath?Gr(Gr(Rr(u.userConfigPath))):Gr(Rr(u.userConfigDir??me(n,u)));return R(v,"user policy")}function yt(n,u){let v=Rr(u),W=Rr(n),z=tb(v,W);if(z!==".."&&!z.startsWith(`..${nb}`)&&!eb(z))return R(v,"project policy");return R(Gr(Gr(W)),"project policy")}function U(n,u){return zr(n,u,Ce)}var Dn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,tn=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Iu=new Set(["python","python3","python2","node","ruby","perl"]),cs=/^python(?:[23](?:\.\d+)*)?$/,$n=new Set(["awk","gawk","nawk","mawk"]),ds=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]),us=new Set(["curl","wget","aria2c","http","https","xh","xhs","httpie","fetch","lwp-request","nc","ncat","netcat","socat","telnet"]);var ku="Rulebook exceeds CC Safety Net's safe validation limits.",Ou="Additional rulebook validation errors were omitted.",Vn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Mu(n){if(il(n.allowed_commands,Vn.maxAllowedCommands)||il(n.rules,Vn.maxRules)||il(n.tests,Vn.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:v}=Vn,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>Vn.maxStringCodeUnits||B&&z.length>Vn.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let X=B.match&&typeof B.match==="object"?B.match:{};for(let Q of[B.block_args,X.command_path,X.any_args,X.exclude_args]){if(!Array.isArray(Q))continue;if(Q.length>Vn.maxBlockArgsPerRule||Q.length>v)return!1;v-=Q.length;for(let le of Q)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function il(n,u){return Array.isArray(n)&&n.length>u}var sl=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ke=64,Re="Rule config exceeds CC Safety Net's safe source limit.";function $t(n){return Wt(n).toLowerCase()}function Wt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function xn(n,u){let v=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let X=z[B];if(!X||!/[a-zA-Z]/.test(X))break;let Q=`-${X}`;if(v.add(Q),u?.shortOptsWithValue?.has(Q))break}}return v}var ab={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},al=new Set(["--init-file","--rcfile"]);function ll(n,u,v,W){let z=!1,B=0,X=!1,Q=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let be=u.slice(le+1);if(u[0]==="-"&&(be==="c"||be[0]==="-"&&be.endsWith("c")))X=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(v?.startsWith("-")||v?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")X=!0;if(W==="argv"&&ue==="s")Q=u[0]==="-";if(!ab[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:X,stdinMode:Q}}function An(n){let u=Wt(n[0]??"").toLowerCase(),v=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let Q=v&&n[z+1]!==void 0?z+1:null;return{command:Q===null?null:n[Q]??null,commandIndex:Q,scriptIndex:!v&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!v&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:v?B:null,commandIndex:v?z:null,scriptIndex:!v&&!W&&B!=="-"?z:null,readsStdinAsCommands:!v&&(W||B==="-")};if(B.startsWith("--")){let Q=B.split("=",1)[0]??B;if(u==="bash"&&al.has(Q)&&!B.includes("="))z++;continue}let X=ll(u,B,n[z+1],"argv");if(X.commandSelected)v=!0;if(X.stdinMode)W=!0;z+=X.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!v}}function ci(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function ms(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let v of lb(n))ci(v,u);return u.inSingle||u.inDouble}function lb(n){let u="",v={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let X=n[B];if(!X)break;if(W){if(X===`
+`||X==="\r")u+=X,W=!1,v.escaped=!1;continue}if(X==="#"&&!v.inSingle&&!v.inDouble&&z){W=!0;continue}if(u+=X,!v.inSingle&&!v.inDouble&&!v.escaped)z=/[\s;&|()<>]/.test(X);ci(X,v)}return u}var cl=new Set(["rm","find","rsync","xargs","parallel"]),cb=new Set(["git","busybox",...cl,...tn,...Iu,...$n]),db=new Set(["python","node","ruby","perl"]);function Ke(n){let u=$t(n);return cb.has(u)||Nn(u)}function Nn(n){return db.has(ub(n))}function ub(n){let u=Wt(n).toLowerCase();return cs.test(u)?"python":u}var ge={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(mb(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let v=JSON.parse(u),W=vt(v);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:v.rules??[],overrides:v.overrides??{},transparent_wrappers:v.transparent_wrappers??[],...v.command_tools?{command_tools:v.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let v=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":v]}}}function mb(n){return typeof n==="string"?pe(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),cn=(n,u)=>({path:n,message:u,kind:"custom"});function Je(n){let u=new Set;return n.flatMap((v,W)=>{let z=$r(v)?v.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[cn(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var Ue=`must be one of ${sl.join(", ")}`,fb=/^[^/]+\/[^/]+$/,pb=["version","rules","overrides","transparent_wrappers","command_tools"],Ye=/^[^\s\p{Cc}]{1,256}$/u,Te="non-empty, at most 256 characters, no whitespace or control characters";function vt(n){let u=gb(n);return{errors:he(bt(u,pb,(v)=>v.kind==="custom"),": "," "),sources:wb(n,u)}}function gb(n){if(!$r(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>ke;return[...n.version===1?[]:[e(["version"],"must be 1")],...hb(n.rules,u),...bb(n.overrides),...Eb(n.transparent_wrappers),...u?[]:Sb(n.rules),...$r(n.overrides)?Object.keys(n.overrides).filter((v)=>!fb.test(v)).map((v)=>cn(["overrides",v],"must use <rulebook-name>/<rule-name>")):[],...vb(n.transparent_wrappers),...Rb(n.command_tools)]}function hb(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...Du(n,ke)?[e(["rules"],Re)]:[]];if(u)return[{path:["rules"],message:Re,kind:"limit"}];return n.flatMap((v,W)=>{if(typeof v!=="string")return[e(["rules",W],"must be a rulebook source string"),...yb(v,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return v===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function Du(n,u){let v=Nu(n);return v!==void 0&&!(v<=u)}function yb(n,u){let v=Nu(n);return v!==void 0&&!(v>=u)}function Nu(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function Sb(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||v==="")return[];if(v.trim()==="")return[cn(["rules",W],"must be a non-empty rulebook source string")];let z=xu(v);if(z)return[cn(["rules",W],z)];if(u.has(v))return[cn(["rules",W],`duplicate rulebook source "${v}"`)];return u.add(v),[]})}function bb(n){if(n===void 0)return[];if(!$r(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let v=n[u];if(v==="off")return[];if(!$r(v))return[e(["overrides",u],'must be "off" or an object')];return[...Cb(v.reason,["overrides",u,"reason"]),...v.intent===void 0||He(v.intent)?[]:[e(["overrides",u,"intent"],Ue)]]})}function Cb(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...Du(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function Eb(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,v)=>{if(typeof u!=="string")return[e(["transparent_wrappers",v],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",v],"must match command pattern")]})}function vb(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[cn(["transparent_wrappers",W],`duplicate command "${v}"`)];if(Ke(v))return[cn(["transparent_wrappers",W],`reserved command "${v}" cannot be a wrapper`)];return u.add(v),[]})}function Rb(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,v=(W,z)=>{if(u.has(W))return[cn(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return dl(W)?v(W,z):[e(["command_tools",z],`must be a tool name: ${Te}`)];if(!$r(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...dl(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Te}`)],...W.cwd===void 0||dl(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name: ${Te}`)]];return B.length>0?B:v(W.name,z)})}function dl(n){return typeof n==="string"&&Ye.test(n)}function wb(n,u){let v=$r(n)?n.rules:void 0;if(!Array.isArray(v))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(v.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function bt(n,u,v){let W=n.map((X)=>X.path[1]),z=[...new Set(W.filter((X)=>typeof X==="string"))],B=(X,Q)=>[X.path.length===0?-1:u.indexOf(String(X.path[0])),typeof Q==="number"?Q:z.indexOf(String(Q)),v(X)?0:1];return n.map((X,Q)=>({issue:X,rank:B(X,W[Q])})).sort((X,Q)=>X.rank[0]-Q.rank[0]||X.rank[1]-Q.rank[1]||X.rank[2]-Q.rank[2]).map((X)=>X.issue)}function he(n,u,v){return[...new Set(n.map((W)=>{let z=ul(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?v:u}${W.message}`}))]}function ul(n){return n.map((u,v)=>{if(typeof u==="number")return`[${u}]`;return v===0?String(u):`.${String(u)}`}).join("")}function He(n){return sl.includes(n)}function $r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ye(n){let u=Ab(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var _b=`required non-empty string up to ${M} characters`,Lu="must be a non-empty array of unique non-empty strings",xb="required non-empty array of non-empty strings";function Ab(n){if(!wr(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Mu(n))return{errors:[ku],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...he(Pb(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>Vn.maxValidationErrors?[...u.slice(0,Vn.maxValidationErrors),Ou]:u,ruleNames:new Set(Ze(n).map((v)=>v.toLowerCase()))}}function Ze(n){let u=wr(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((v)=>{let W=wr(v)?v.name:void 0;return typeof W==="string"?[W]:[]})}function Pb(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],...Tb(n.allowed_commands),...Ib(n.rules,u),...Db(n.tests),...Nb(n),...Lb(n)]}function Tb(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((v,W)=>typeof v==="string"&&P.test(v)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((v,W)=>{if(typeof v!=="string"||!P.test(v))return[];if(u.has(v))return[cn(["allowed_commands",W],`duplicate command "${v}"`)];return u.add(v),[]})]}function Ib(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((v,W)=>{if(!wr(v))return[e(["rules",W],"must be an object")];return u?Ob(v,["rules",W]):kb(v,["rules",W])}),...Je(n)]}function kb(n,u){return[...Wu(n.name,u),...Fu(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...fs(n.block_args,[...u,"block_args"],"required non-empty array",!1),...Gu(n.reason,u),...zu(n.intent,u)]}function Ob(n,u){return[...Wu(n.name,u),...Fu(n.command,u),...Gu(n.reason,u),...zu(n.intent,u),...Mb(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function Wu(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function Fu(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function Gu(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],_b)]}function zu(n,u){return n===void 0||He(n)?[]:[e([...u,"intent"],Ue)]}function Mb(n,u){if(!wr(n))return[e(u,"required object")];return[...fs(n.command_path,[...u,"command_path"],xb,!1),...n.any_args===void 0?[]:fs(n.any_args,[...u,"any_args"],Lu,!0),...n.exclude_args===void 0?[]:fs(n.exclude_args,[...u,"exclude_args"],Lu,!0)]}function fs(n,u,v,W){if(!Array.isArray(n))return[e(u,v)];let z=n.flatMap((B,X)=>{if(typeof B!=="string")return[e([...u,X],"must be a non-empty string")];return B===""?[cn([...u,X],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[cn(u,v)]:[],...W&&new Set(n).size!==n.length?[cn(u,"must not contain duplicate values")]:[]]}function Db(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,v)=>{if(!wr(u))return[e(["tests",v],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",v,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",v,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",v,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[cn(["tests",v,"rule"],"required string for blocked fixtures")]:[]]})}function Nb(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ze(n));return[...new Set(n.tests.flatMap((v)=>wr(v)&&v.expect==="blocked"&&typeof v.rule==="string"?[v.rule]:[]))].filter((v)=>!u.has(v)).map((v)=>cn(["tests"],`blocked fixture references unknown rule "${v}"`))}function Lb(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((v)=>typeof v==="string"));return n.rules.flatMap((v,W)=>{let z=wr(v)?v.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[cn(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function wr(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function ie(n,u){let v=oe(n,u),W;try{W=bu(v.userConfigTarget,v.projectConfigTarget)}catch(Me){if(Me instanceof i)return Vb(v,Me.message);throw Me}let z=f(v.userConfigTarget),B=W?{config:null,errors:[]}:f(v.projectConfigTarget),X=Uu(v.userConfigPath,z.errors),Q=Uu(v.projectConfigPath,B.errors),le=new Set,ue=z.config?ml(z.config,Br(v.userConfigPath),"user",v.userScope,le):Hu(),be=B.config?ml(B.config,Br(v.projectConfigPath),"project",v.projectScope,le):Hu(),Oe=z.config?.overrides??{},De=B.config?.overrides??{};return{rules:[...Bu(ue.rules,Oe),...Bu(be.rules,De)],transparent_wrappers:Ub(z.config,B.config),command_tools:Hb(z.config,B.config),rulebooks:[...ue.rulebooks,...be.rulebooks],errors:[...X,...Q,...ue.errors,...be.errors],warnings:[...ue.warnings,...be.warnings,...ue.canValidateOverrides?fl(Oe,ue.knownRuleIds,v.userConfigPath):[],...ue.canValidateOverrides?jb(De,ue.knownRuleIds,v.projectConfigPath):[],...be.canValidateOverrides?fl(De,be.knownRuleIds,v.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...v}}function J(n,u){let v=Wb(n,u);if(!v)return[];return[...v.scope.errors,...v.scope.warnings,...Fb(v.config,v.scope,n)]}function Wb(n,u){let v=u??R(Br(Br(n)),"rules policy"),W=f(s(v,n)).config;if(!W)return null;return{config:W,scope:ml(W,Br(n),"project",v)}}function Fb(n,u,v){return u.canValidateOverrides?fl(n.overrides??{},u.knownRuleIds,v):[]}function ml(n,u,v,W=R(Br(Br(u)),v==="user"?"user policy":"project policy"),z=new Set){let B=[],X=[],Q=n.rules.flatMap((ue)=>{let be=zb(ue,u,W);if(be.errors.length>0||!be.rulebook)return B.push(...be.errors),[];let Oe=be.rulebook;if(z.has(Oe.name))return X.push(`duplicate active rulebook name "${Oe.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(Oe.name),[{rules:Gb(Oe),rulebook:{source:v,spec:ue,name:Oe.name,version:Oe.version,rules:Oe.rules.map((De)=>`${Oe.name}/${De.name}`)}}]}),le=Q.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:Q.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:X,canValidateOverrides:B.length===0}}function Gb(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function zb(n,u,v){let W=Xe(n),z=U(u,W),B=Bb(z,v);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${$b(n)}`]};let X=Pe(B.content);if("problem"in X)return{rulebook:null,errors:[`invalid rulebook ${z}: ${X.problem}; fix that file`]};if(X.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${X.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:X.rulebook,errors:[]}}function Xe(n){return T(n)?j(n).name:n}function $b(n){return T(n)?`run ${Tu} to vendor ${n}`:"create that file or remove that source from the rules config"}function Bb(n,u){try{return{content:o(s(u,n))}}catch(v){if(v instanceof i)return{error:v.message};throw v}}function Pe(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ye(u)}}catch(v){return{problem:v instanceof Error?v.message:"invalid rulebook"}}}function Ub(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function Hb(n,u){let v=(n?.command_tools??[]).map($u),W=(u?.command_tools??[]).map($u);return[...v,...W.filter((z)=>!v.some((B)=>B.name===z.name))]}function $u(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function Bu(n,u){return n.flatMap((v)=>{let W=u[v.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...v,intent:W.intent??v.intent,reason:W.reason}];return[v]})}function fl(n,u,v){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${v}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function jb(n,u,v){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${v}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Uu(n,u){return u.map((v)=>v.startsWith("Unable to access ")?v:`${n}: ${v}`)}function Vb(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function Hu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as rC,readFileSync as oC}from"node:fs";var ju=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"network.cloud-metadata",category:"Network",label:"Cloud metadata endpoint",description:"Blocks HTTP clients, raw socket tools, and code interpreters naming a cloud metadata host (169.254.169.254, fd00:ec2::254, 169.254.170.2, 169.254.170.23, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200).",example:"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",intent:"manual_only"},{id:"network.upload-remote",category:"Network",label:"Data upload to a remote host",description:"Blocks curl and wget requests that send a body or upload a file in strict mode unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]).",example:"curl -T backup.tar https://uploads.example.com/",intent:"manual_only",activationCapability:"fail_closed"},{id:"unshare.user-namespace",category:"Execution",label:"unshare user namespace",description:"Blocks unshare creating a user namespace: -U/--user, -r/--map-root-user, -c/--map-current-user, --map-user(s), --map-group(s), or --map-auto.",example:"unshare -r id",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],pl=new Set(ju.map((n)=>n.id)),Y=ju,qb=new Map(Y.map((n)=>[n.id,n.intent]));function st(n,u){return{id:n,reason:u,intent:qb.get(n)??"manual_only"}}var gl=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],ps={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Kb=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Yb=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],hl=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Yb.flatMap((n)=>Kb.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var gs=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml","<project>/.codex/config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Vu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Zb=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],yl=Vu.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),Sl=Vu.flatMap((n)=>Zb.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),di={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},bl=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),Cl=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...gl,ps,...hl,...yl,...Sl,di,...bl,...Cl,...gs].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),hs=new Set(gs.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),El=new Set(xt.map((n)=>n.id));import{isAbsolute as vl,join as Xb,normalize as Qb,sep as ys}from"node:path";var Ss=process.platform==="win32",qu=/[*?]/;function Rl(n){let u=n.trim(),v=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Ss?u.replaceAll("\\","/"):u);if(!v)return null;let W=v[1]??"",z=v[2]??"";if(qu.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function ui(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function wl(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let v=ui(n.trim(),u);if(!vl(v))return"must be an absolute path or start with ~/";return mi(v,u)}function _l(n,u){let v=Ku(n,u);if(v===null)return"must be a non-empty path string";if(!vl(v))return null;if(mi(v,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Jb="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",eC="cannot cover the guard's own configuration";function Ku(n,u){if(typeof n!=="string"||n.trim()==="")return null;let v=n.trim(),W=Ss?v.replaceAll("\\","/"):v;return ui(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function xl(n,u){let v=Ku(n,u);if(v===null)return"must be a non-empty path string";let W=Rl(v)?.root??v;if(qu.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!vl(W))return null;if(mi(W,u)!==null)return Jb;return tC(W,u)?eC:null}function tC(n,u){let v=bs(n),W=bs(Xb(u,".cc-safety-net"));return v===W||v.startsWith(`${W}${ys}`)}function mi(n,u){let v=bs(n),W=bs(u);if(v===W)return"cannot be the home directory";let z=v.endsWith(ys)?v:`${v}${ys}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function bs(n){let u=Qb(n);if(Ss)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(Ss?3:1)&&u.endsWith(ys))u=u.slice(0,-1);return u}var Yu=30,Cs=1,Es=365;function Zu(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Xu=new Set(Y.filter((n)=>n.catastrophic).map((n)=>n.id));function Ft(n,u){if(!n)return null;if(Xu.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let v=u?.effectiveDestructiveCommandRules[n.id];return v&&!v.enabled?null:n}function dn(n,u,v){if(Xu.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??v}function Z(n,u){return Object.freeze(Object.fromEntries(Y.map((v)=>{let W=v.activationCapability?u[v.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[v.id],X=v.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...v.activationCapability?{activationCapability:v.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...v.activationCapability?{activationCapability:v.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...v.activationCapability?{activationCapability:v.activationCapability}:{},...B?{override:B}:{}};return[v.id,Object.freeze(X)]})))}function Qu(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:Z(n,u)})}var Ju={standard:0,strict:1,paranoid:2};function se(n,u,v=!1,W=n.safety.level){let z=nC(n,u,W),B=new Set(v?z.map((be)=>be.field):[]),X=(be,Oe)=>B.has(be)?void 0:Oe,Q=(be,Oe)=>Object.fromEntries(Object.entries(Oe??{}).filter(([De])=>!B.has(`${be}.${De}`))),le=(be,Oe)=>Oe?.filter((De)=>!B.has(`${be}.${De}`));return{policy:{version:1,safety:{level:X("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...Q("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:X("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:X("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...Q("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:Al(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:X("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...Q("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:Al(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:Al(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((be)=>be.message)}}function Al(n,u){return[...new Set([...n,...u??[]])]}function nC(n,u,v){let W=u.safety?.level,z=es[v];return[...W&&Ju[W]<Ju[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...So.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...em("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...em("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!hs.has(B))),...n.destructive_command_protection.enabled?tm(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?tm(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function em(n,u,v){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&v(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function tm(n,u){return(u??[]).filter((v)=>!n.includes(v))}var Tl=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Yu}};function om(n,u){let v=dC(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:et(S(u.cwd),n.home),z=ve(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),X=v.gui??ae,Q=Object.keys(z.policy).length>0?se(X,z.policy,B,Zd(X.safety.level,n.env)):void 0,le=[...v.errors,...W.errors,...z.diagnostics],ue=(v.fallback==="defaults"&&Q?"salvaged":v.fallback)??(v.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),be=z.policy.safety?.level&&Q?.policy.safety.level===z.policy.safety.level?"project":v.levelPresent?"user":"default";return{...Q?fi(Q.policy):v.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:be,weakenings:Q?.weakenings??[],weakeningsIgnored:B}}:{}}}var iC="project policy audit settings are ignored; audit is user scope only";function ve(n,u){if(!Ln(n))return{policy:{},diagnostics:[]};let v=Ln(n.safety)?n.safety:{},W=Ln(n.workflow)?n.workflow:{},z=Ln(n.destructive_command_protection)?n.destructive_command_protection:{},B=Ln(n.secret_protection)?n.secret_protection:{},X={...Tl.has(v.level)?{level:v.level}:{},...Ln(v.overrides)?nm({overrides:im(v.overrides,So,["safety","overrides"],Ur)}):{}},Q={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:vs(z.overrides,pl,am,Ur)}:{},...z.allow_paths!==void 0?{allow_paths:Eo(z.allow_paths,wl,u,["destructive_command_protection","allow_paths"],Ur)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:vs(B.overrides,El,lm,Ur)}:{},...B.deny_paths!==void 0?{deny_paths:Eo(B.deny_paths,_l,u,["secret_protection","deny_paths"],Ur)}:{},...B.allow_paths!==void 0?{allow_paths:Eo(B.allow_paths,xl,u,["secret_protection","allow_paths"],Ur)}:{}};return{policy:nm({safety:X,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:Q,secret_protection:le}),diagnostics:n.audit===void 0?[]:[iC]}}function im(n,u,v,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...v,z],Il));return[]}))}function nm(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Ur=()=>{return},Il="must be a boolean",kl="must be an object if provided",sm=`must be an integer between ${Cs} and ${Es}`,am={path:["destructive_command_protection","overrides"],label:"destructive command"},lm={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let v=[];return{policy:cm(n,u,(z)=>{v.push(z)}),issues:v}}function _(n,u){return cm(n,u,Ur)}function cm(n,u,v){if(!Ln(n))return v(e([],"Config must be an object")),N();if(n.version!==1)v(e(["version"],"must be 1"));let W=Co(n.safety,["safety"],["level","overrides"],v),z=Co(W.overrides,["safety","overrides"],So,v),B=Co(n.workflow,["workflow"],["worktree_mode"],v),X=Co(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],v),Q=Co(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],v),le=Co(n.audit,["audit"],["retention_days"],v);return dm(n,St,[],v),{version:1,safety:{level:sC(W.level,v),overrides:im(z,So,["safety","overrides"],v)},workflow:{worktree_mode:Pl(B.worktree_mode,["workflow","worktree_mode"],!1,v)},destructive_command_protection:{enabled:Pl(X.enabled,["destructive_command_protection","enabled"],!0,v),overrides:vs(X.overrides,pl,am,v),allow_paths:Eo(X.allow_paths,wl,u,["destructive_command_protection","allow_paths"],v)},secret_protection:{enabled:Pl(Q.enabled,["secret_protection","enabled"],!0,v),overrides:vs(Q.overrides,El,lm,v),deny_paths:Eo(Q.deny_paths,_l,u,["secret_protection","deny_paths"],v),allow_paths:Eo(Q.allow_paths,xl,u,["secret_protection","allow_paths"],v)},audit:{retention_days:aC(le.retention_days,v)}}}function Co(n,u,v,W){if(n===void 0)return{};if(!Ln(n))return W(e(u,kl)),{};return dm(n,v,u,W),n}function dm(n,u,v,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:v,message:z,kind:"unknownKeys"})}function sC(n,u){if(n===void 0)return"standard";if(Tl.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Pl(n,u,v,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,Il));return v}function aC(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=Cs&&n<=Es))u(e(["audit","retention_days"],sm));return Zu(n)}function vs(n,u,v,W){if(n===void 0)return{};if(!Ln(n))return W(e(v.path,kl)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...v.path,z],message:`unknown ${v.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...v.path,z],'must be "on" or "off"')),[]}))}function Eo(n,u,v,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,X)=>{let Q=u(B,v);if(Q===null)return[B];return z(typeof B==="string"?cn([...W,X],Q):e([...W,X],Q)),[]})}function Ln(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Qe(n,u){let v=O({safety:tt(n.safety)},u),W=Z({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},v.capabilities),z=Object.values(W),B=z.filter((X)=>X.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:v.effectiveLevel,capabilities:v.capabilities,rules:W,counts:{enabled:B.filter((X)=>X.enabled).length,disabled:B.filter((X)=>!X.enabled).length,effectiveCustomizations:z.filter((X)=>X.changesInherited).length}}}function et(n,u){if(!rC(n))return{exists:!1,policy:N(),errors:[]};try{let v=oC(n,"utf-8");if(!v.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(v),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${cC(B)}`),fallback:Ln(W)?"salvaged":"defaults"}}catch(v){let W=v instanceof Error?v.message:String(v);return{exists:!0,policy:N(),errors:[`${n}: ${v instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var lC=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[kl,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Il,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[sm,`not an integer between ${Cs} and ${Es}`]]);function cC(n){let u=ul(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let v=lC.get(n.message)??n.message;return u===""?v:`${u}: ${v}`}function dC(n,u){let v=et(n,u);if(!v.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ln(W))return{policy:fi(N()),errors:[]};let z=_(W,u);return{policy:fi(z),gui:z,errors:[],levelPresent:rm(W)}}if(v.parsed===void 0)return{policy:fi(N()),errors:v.errors,...v.fallback?{fallback:v.fallback}:{}};return{policy:fi(v.policy),gui:v.policy,errors:v.errors,...v.fallback?{fallback:v.fallback}:{},levelPresent:rm(v.parsed)}}function rm(n){let u=Ln(n)&&Ln(n.safety)?n.safety:{};return Tl.has(u.level)}function Ct(n){let u=Object.entries(n),v=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...hs].filter((W)=>!v.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function fi(n){return{safety:tt(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function tt(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let v=ie(n,u),W=om(n,u),z={rules:v.rules,transparentWrappers:v.transparent_wrappers,commandTools:v.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...v.userConfig?.overrides,...v.projectConfig?.overrides},X=Object.freeze(Object.fromEntries(z.rules.map((Q)=>{let le=v.rulebooks.find((be)=>be.rules.includes(Q.name)),ue=B[Q.name];return[Q.name,Object.freeze({id:Q.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...pC(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return Ge(z,uC(v,W),X,W.policyScopes)}function nt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function uC(n,u){let v=fC(u);if(n.errors.length===0&&n.warnings.length===0&&!v)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:gC(n.errors.length>0?mC(n.errors):void 0,n.warnings.length>0?Ml(n.warnings.join("; ")):void 0,v)}}function mC(n){return`${Ml(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function fC(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function pC(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function Ge(n,u,v=Object.freeze({}),W){let z=Ol(structuredClone(n)),B=W?{policyScopes:Ol(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:v,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:v,...B})}function Ol(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))Ol(u);return Object.freeze(n)}function gC(...n){return Ml(n.filter((u)=>!!u).join("; "))}function Ml(n){return/[.!?]$/.test(n)?n:`${n}.`}function _e(n){let u=n.effectiveCapabilities,v=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:Qu(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:qa({failClosed:v,paranoidRm:W,paranoidInterpreters:z}),strict:v,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as XP,isAbsolute as QP,join as ph,parse as JP,resolve as eT,sep as tT}from"node:path";function pi(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let v=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[v];return W!==void 0&&(W.provenance!=="literal"||v===0&&yC(W))}var hC=/^@(['"])[ \t]*(?:\r\n|[\r\n])/;function vo(n,u){let v=hC.exec(n.slice(u)),W=v?.[1];return v&&W?{quote:W,bodyStart:u+v[0].length}:null}function yC(n){return vo(n.raw,0)!==null}var SC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rs(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function gi(n){let u=Rs(n.words[0],"time")?1:0,v=u===1&&Rs(n.words[u],"-p")?u+1:u,W=u===1&&Rs(n.words[v],"--")?v+1:v,z=Rs(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((X)=>!SC.test(X.text));return B?.provenance==="literal"?B.text:void 0}var _r=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function ws(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function _s(n,u,v){n.push(v),u.reset()}function xs(n){let u=[];return{parts:u,push:(v,W,z)=>{if(W<=v)return;u.push({raw:n.slice(v,W),span:{start:v,end:W},provenance:z})}}}function Dl(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function Ro(n,u,v,W,z,B,X){return Dl({text:W,raw:n.slice(u,v),span:{start:u,end:v},provenance:z,quoted:B,...X?{parts:X}:{}})}function Nl(n,u,v){if(u>=v||mm(n[u]??""))return null;let W="",z=!1,B=!1,X=u;while(X<v&&!mm(n[X]??"")){let Q=n[X]??"";if(Q==="'"){z=!0;let le=um(n,X+1,v,"'");W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==='"'){z=!0;let le=um(n,X+1,v,'"');W+=le.text,B||=!le.closed,X=le.next;continue}if(Q==="\\"){z=!0;let le=n[X+1];if(!le||le===`
+`||le==="\r"){B=!0;break}W+=le,X+=2;continue}if(Q==="`"||n.startsWith("$(",X)||n.startsWith("${",X)||n.startsWith("<(",X)||n.startsWith(">(",X))B=!0;W+=Q,X++}return{delimiter:W,quoted:z,next:X,ambiguous:B}}function Ll(n,u,v,W){let z=[],B=u;for(let X of W){let Q=B,le=!1;while(B<v){let ue=bC(n,B,v);if((X.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===X.delimiter){X.attach({body:X.stripTabs?CC(n.slice(Q,B)):n.slice(Q,B),delimiter:X.delimiter,quotedDelimiter:X.quotedDelimiter,bodySpan:{start:Q,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${X.delimiter} was not found`}),{next:v,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function um(n,u,v,W){let z="",B=u;while(B<v&&n[B]!==`
+`&&n[B]!=="\r"){let X=n[B]??"";if(X===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&X==="\\"&&n[B+1]){let Q=n[B+1]??"";z+=["$","`",'"',"\\"].includes(Q)?Q:`\\${Q}`,B+=2;continue}z+=X,B++}return{text:z,next:B,closed:!1}}function mm(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function bC(n,u,v){let W=u;while(W<v&&n[W]!==`
+`)W++;let z=W>=v?v:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function CC(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ym=new Set(["&&","||","|","|&"]),EC=new Set(["!","do","elif","else","if","then","until","while"]);function Sm(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=Ts(n,0,n.length,u,W,0),B=[...z.issues,...kC(n,W.quotedExpansionEnd,z.nodes)?[vm]:[],...TC.test(n)?[Em]:[]];return{kind:"program",dialect:"posix",source:n,span:v,status:ks(B,z.limited),issues:B,nodes:z.nodes}}function Ts(n,u,v,W,z,B,X){let Q=[],le=[],ue=ws(),be=[],Oe=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Me={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);_s(Q,ue,{kind:"command",dialect:"posix",source:n.slice(Me.start,Me.end),span:Me,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&Q.length===0?n.slice(u,v):Ne.join(" ")})},De=u;while(De<v){let Me=n[De];if(!Me)break;if(X&&Me===X)return Oe(),hm(Q,le),{nodes:Q,issues:le,next:De+1,closed:!0,limited:!1,pendingHeredocs:be};if(yi(Me)){if(Me.charCodeAt(0)>127)le.push(Em);if(Me===`
+`||Me==="\r"){Oe();let Rt=Me==="\r"&&n[De+1]===`
+`?De+2:De+1,Tt=Q.at(-1);if(Tt?.kind!=="connector"||!ym.has(Tt.operator))Q.push({kind:"connector",operator:n.slice(De,Rt),span:{start:De,end:Rt}});if(be.length>0){let kt=Ll(n,Rt,v,be.splice(0));le.push(...kt.issues),De=kt.next;continue}De=Rt;continue}De++;continue}if(Me==="\\"&&n[De+1]===`
+`){De+=2;continue}if(Me==="#"){while(De<v&&n[De]!==`
+`&&n[De]!=="\r")De++;continue}let Ne=ue.start===-1?YC(n,De,v):void 0;if(Ne){if(Fl(Q,le),B>=W.maxDepth)return wo(Q,le,De,"depth-limit",W.maxDepth);if(!Wl(z))return wo(Q,le,De,"word-limit",W.maxWords);let Rt=Ts(n,Ne.braceIndex+1,v,W,z,B+1,"}"),Tt=Rt.next,kt={start:Ne.braceIndex+1,end:Rt.closed?Tt-1:Tt},lt=fm(n,kt,Rt);if(Q.push({kind:"function",name:Ne.name,span:{start:De,end:Tt},body:lt}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||Si(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(be.push(...Rt.pendingHeredocs),Rt.limited)return Ps(Q,le,Rt.next);if(!Rt.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});De=Tt;continue}let Le=Is(n,De);if(Le){if(Oe(),!Tm(Q.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});Q.push({kind:"connector",operator:Le,span:{start:De,end:De+Le.length}}),De+=Le.length;continue}if(Me===")"){Oe(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),Q.push({kind:"unknown",source:Me,span:{start:De,end:De+1}}),De++;continue}if((Me==="("||Me==="{"&&LC(n,De,v))&&ue.start===-1){if(Fl(Q,le),B>=W.maxDepth)return wo(Q,le,De,"depth-limit",W.maxDepth);let Rt=Me==="("?")":"}",Tt=Ts(n,De+1,v,W,z,B+1,Rt),kt=Tt.next,lt={start:De+1,end:Tt.closed?kt-1:kt},jt=fm(n,lt,Tt);if(Q.push({kind:"group",style:Me==="("?"subshell":"brace",span:{start:De,end:kt},body:jt}),le.push(...Tt.issues),Tt.pendingHeredocs.length>0||Si(Tt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(be.push(...Tt.pendingHeredocs),Tt.limited)return Ps(Q,le,Tt.next);if(!Tt.closed)le.push({code:Me==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Me} group is not closed`});De=kt;continue}let We=(Me==="<"||Me===">")&&n[De+1]!=="("?_C(n,De):null;if(We){let Rt=ue.words.at(-1),Tt=Rt&&Rt.span.end===De&&/^[0-9]+$/.test(Rt.raw)?Number(Rt.raw):void 0;if(Tt!==void 0)ue.words.pop();let kt=Tt===void 0?De:Rt?.span.start??De;ue.start=ue.start===-1?De:ue.start;let lt=De+We.length;while(lt<v&&/[ \t]/.test(n[lt]??""))lt++;let jt=n[lt],Bt=lt>De+We.length&&jt==="#",sn=!jt||yi(jt)||!!Is(n,lt)||jt===X||jt===")"||Bt||(jt==="<"||jt===">")&&n[lt+1]!=="(",yn=We==="<<"||We==="<<-",ut=yn?Nl(n,lt,v):void 0,Gt=ut?{word:Ro(n,lt,ut.next,ut.delimiter,"literal",ut.quoted),nested:[],issues:[],next:ut.next,limited:!1}:!sn?Gl(n,lt,v,W,z,B):void 0;if(Gt){if(le.push(...Gt.issues),Gt.limited)return Ps(Q,le,Gt.next);if(!Wl(z))return wo(Q,le,Gt.next,"word-limit",W.maxWords)}let Xt=Gt?.next??De+We.length,rn={kind:"redirection",operator:We,span:{start:kt,end:Xt},...Tt===void 0?{}:{fd:Tt},...Gt?{target:Gt.word}:{}};if(ue.redirections.push(rn),yn&&!ut)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(ut){if(ut.ambiguous||ut.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let un=ue.nested;be.push({delimiter:ut.delimiter,quotedDelimiter:ut.quoted,stripTabs:We==="<<-",attach:(En)=>{if(rn.heredoc=En,En.quotedDelimiter)return;let on=RC(n,En.bodySpan.start,En.bodySpan.end,W,z,B+1);un.push(...on.programs),le.push(...on.issues)}})}if(!yn&&!Gt)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(Gt)ue.nested.push(...Gt.nested);ue.end=Xt,De=Xt;continue}let Be=ue.start===-1;if(Be)Fl(Q,le);let ze=Gl(n,De,v,W,z,B);if(le.push(...ze.issues),ze.limited)return Ps(Q,le,ze.next);let it=GC(ue.words)?HC(n,ze.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(it?.limitCode)return wo(Q,le,ze.next,it.limitCode,it.limitCode==="word-limit"?W.maxWords:it.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let at=it?.words??[ze.word];for(let Rt of at){if(!Wl(z))return wo(Q,le,ze.next,"word-limit",W.maxWords);ue.words.push(Rt)}if(ue.start=ue.start===-1?De:ue.start,ue.end=ze.next,ue.nested.push(...ze.nested),Be&&Im(ze.word))Oe();De=ze.next>De?ze.next:De+1}return Oe(),hm(Q,le),le.push(...ZC(be)),{nodes:Q,issues:le,next:De,closed:X===void 0,limited:!1,pendingHeredocs:[]}}function fm(n,u,v){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:ks(v.issues,v.limited),issues:v.issues,nodes:v.nodes}}function Gl(n,u,v,W,z,B){let X="",Q=u,le=!1,ue="literal",be=[],Oe=[],De=!1;while(Q<v){let Me=n[Q],Ne=(Me==="<"||Me===">")&&n[Q+1]==="(";if(!Me||yi(Me)||(Me===";"||Me==="|"||Me==="&")&&Is(n,Q)||(Me==="<"||Me===">")&&!Ne)break;if(Me===")")break;if(Me==="'"){le=!0;let Be=n.indexOf("'",Q+1);if(Be===-1||Be>=v){X+=n.slice(Q+1,v),Oe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),Q=v;break}X+=n.slice(Q+1,Be),Q=Be+1;continue}if(Me==='"'){le=!0;let Be=vC(n,Q,v,W,z,B);if(X+=Be.text,be.push(...Be.nested),Oe.push(...Be.issues),De||=Be.limited,ue=hi(ue,Be.provenance),Q=Be.next,De)break;continue}if(n.startsWith("$'",Q)){le=!0;let Be=MC(n,Q+2,v);if(X+=Be.text,Oe.push(...Be.issues),!Be.closed)Oe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});Q=Be.next;continue}if(Me==="\\"){let Be=n[Q+1];if(!Be){Oe.push({code:"trailing-escape",message:"escape has no following character"}),Q++;break}if(Be===`
+`){Q+=2;continue}X+=Be,Q+=2;continue}if(jr(n,Q))Oe.push(Hr);let Le=Me==="$"||Me==="<"||Me===">"||Me==="`"?bi(n,Q,v,W,z,B):null,We=Le?$l(Le,be,Oe):Rm(n,Q,v,W,z,B,be,Oe);if(We){if(We.provenance==="variable")X+=n.slice(Q,We.next);if(De||=We.limited,ue=hi(ue,We.provenance),Q=We.next,De)break;continue}if(Me==="$"){let Be=_m(n,Q,v,X,ue);X=Be.text,ue=Be.provenance,Q=Be.next;continue}if(Me==="*"||Me==="?"||Me==="[")ue=hi(ue,"glob");X+=Me,Q++}return{word:Ro(n,u,Q,X,ue,le,ue==="literal"?void 0:NC(n,u,Q)),nested:be,issues:Oe,next:Q,limited:De}}function vC(n,u,v,W,z,B){let X="",Q="literal",le=[],ue=[],be=!1,Oe=u+1;while(Oe<v){let De=n[Oe];if(De==='"')return{text:X,provenance:Q,nested:le,issues:ue,next:Oe+1,limited:be};if(De==="\\"&&n[Oe+1]){let Le=n[Oe+1]??"";if(Le===`
+`){Oe+=2;continue}if(Le==="\r"&&n[Oe+2]===`
+`){Oe+=3;continue}X+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,Oe+=2;continue}if(jr(n,Oe))ue.push(Hr);let Me=bi(n,Oe,v,W,z,B),Ne=Me?$l(Me,le,ue):Rm(n,Oe,v,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")X+=n.slice(Oe,Ne.next);if(Oe=Ne.next,be||=Ne.limited,Q=hi(Q,Ne.provenance),be)return{text:X,provenance:Q,nested:le,issues:ue,next:Oe,limited:be};continue}if(De==="$"){let Le=_m(n,Oe,v,X,Q);X=Le.text,Q=Le.provenance,Oe=Le.next;continue}X+=De??"",Oe++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:X,provenance:Q,nested:le,issues:ue,next:v,limited:be}}function bi(n,u,v,W,z,B){let X=Cm(n,u);if(!X)return null;let{length:Q,closing:le}=X,ue=le==="))",be=le==="`",Oe=n[u]==="<"||n[u]===">",De=Bl(n,u+Q,v,le),Me=De===-1?v:De,Ne=De===-1?v:De+le.length;if(B>=W.maxDepth)return{program:KC(n,u+Q,Me,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let at=[],Rt=[],Tt=!1,kt=u+Q;while(kt<Me){let lt=bi(n,kt,Me,W,z,B+1);if(!lt){if(jr(n,kt))Rt.push(Hr);kt++;continue}if(at.push(...lt.program.nodes),Rt.push(...lt.program.issues),Tt||=lt.program.status==="limited",kt=lt.next,Tt)break}if(De===-1)Rt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Me),span:{start:u+Q,end:Me},status:ks(Rt,Tt),issues:Rt,nodes:at},next:Ne,provenance:"arithmetic"}}let Le=Ts(n,u+Q,Me,W,z,B+1),We=De===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+Q)} substitution is not closed`}]:[],Be=(be||Oe)&&Si(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],ze=be&&/\\[\\$`\n]/.test(n.slice(u+Q,Me))?[OC]:[],it=[...Le.issues,...We,...Be,...ze];return{program:{kind:"program",dialect:"posix",source:n.slice(u+Q,Me),span:{start:u+Q,end:Me},status:ks(it,Le.limited),issues:it,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function RC(n,u,v,W,z,B){let X=[],Q=[],le=u;while(le<v){let ue=n[le];if(ue==="\\"){le+=2;continue}let be=ue==="$"||ue==="`"?bi(n,le,v,W,z,B):null;if(!be){if(jr(n,le))Q.push(Hr);le++;continue}if(X.push(be.program),xC(n,le,be.next)&&AC(be.program))Q.push(Hr);le=be.next}return{programs:X,issues:Q}}function $l(n,u,v){return u.push(n.program),v.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function Bl(n,u,v,W){if(W==="`"){for(let Q=u;Q<v;Q++){if(n[Q]==="\\"){Q++;continue}if(n[Q]==="`")return Q}return-1}let z={single:!1,double:!1},B=[],X=[];for(let Q=u;Q<v;Q++){let le=n[Q];if((le===`
+`||le==="\r")&&X.length>0){let Oe=le==="\r"&&n[Q+1]===`
+`?Q+2:Q+1,De=Ll(n,Oe,v,X.splice(0));if(!De.terminated)return-1;Q=De.next-1;continue}let ue=bm(n,Q,u,v,z);if(ue!==null){Q=ue;continue}if(!z.double&&n.startsWith("$((",Q)){let Oe=wC(n,Q+3,v);if(Oe===-1)return-1;Q=Oe+1;continue}if(W===")"&&!z.double&&le==="<"&&n[Q+1]==="<"&&n[Q+2]!=="<"){let Oe=n[Q+2]==="-",De=Q+(Oe?3:2);while(De<v&&/[ \t]/.test(n[De]??""))De++;let Me=Nl(n,De,v);if(Me){X.push({delimiter:Me.delimiter,quotedDelimiter:Me.quoted,stripTabs:Oe,attach:()=>{return}}),Q=Me.next-1;continue}}if(n.startsWith("$(",Q)&&!n.startsWith("$((",Q)){B.push(z),z={single:!1,double:!1},Q++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let be=B.pop();if(be){z=be;continue}return W==="))"&&n[Q+1]!==")"?-1:Q}return-1}function wC(n,u,v){let W=1,z={single:!1,double:!1};for(let B=u;B<v;B++){let X=n[B],Q=bm(n,B,u,v,z);if(Q!==null){B=Q;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(X==="("&&!z.double)W++;if(X!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function bm(n,u,v,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!XC(n,u,v))return null;let X=u;while(X+1<W&&n[X+1]!==`
+`&&n[X+1]!=="\r")X++;return X}function Is(n,u){let v=n[u];if(v===";")return";";if(v==="&")return n[u+1]==="&"?"&&":"&";if(v==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function _C(n,u){let v=n[u];if(v===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(v!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function yi(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var Hr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function jr(n,u){if(n[u]!=="$")return!1;let v=pm(n,u+1);if(n[v]!=="{")return!1;let W=n[pm(n,v+1)]??"";return W==="|"||yi(W)}function xC(n,u,v){for(let W=n.indexOf("$",u);W!==-1&&W<v;W=n.indexOf("$",W+1))if(jr(n,W))return!0;return!1}function AC(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===Hr.code)}function pm(n,u){let v=u;while(n.startsWith("\\\n",v)||n.startsWith(`\\\r
+`,v))v+=n[v+1]==="\r"?3:2;return v}function Cm(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var PC=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),TC=/[\v\f\r]/,Em=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),vm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),IC=/\$\(|`|[<>]\(/g;function kC(n,u,v){let W=zl(v);return[...n.slice(u).matchAll(IC)].some((z)=>{let B=u+z.index;return!W.some((X)=>B>=X.start&&B<X.end)})}function zl(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((v)=>v.heredoc?[v.heredoc.bodySpan]:[]),...u.nested.flatMap((v)=>zl(v.nodes))];return u.kind==="group"||u.kind==="function"?zl(u.body.nodes):[]})}var OC=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function Rm(n,u,v,W,z,B,X,Q){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=Os(n,u+2,v),ue=le.close===-1?v:le.close+1;if(le.close===-1)Q.push(PC);if(le.quoted&&le.substitutions.length>0||le.continued)Q.push(vm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let be=le.substitutions.some((Oe)=>{if(jr(n,Oe))return Q.push(Hr),!1;let De=bi(n,Oe,ue,W,z,B);return De!==null&&$l(De,X,Q).limited});return{provenance:"variable",next:ue,limited:be}}function Os(n,u,v){let W=[],z=!1,B=!1,X=1,Q=u;while(Q<v){let le=n[Q];if(le==="$"&&jr(n,Q))W.push(Q);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[Q+1]===`
+`,Q+=le==="\\"?2:1;continue}let ue=Cm(n,Q);if(ue){W.push(Q);let be=Bl(n,Q+ue.length,v,ue.closing);if(be===-1)break;Q=be+ue.closing.length;continue}if(le==="$"&&n[Q+1]==="{"){X++,Q+=2;continue}if(le==="}"&&--X===0)return{close:Q,substitutions:W,quoted:z,continued:B};Q++}return{close:-1,substitutions:W,quoted:z,continued:B}}function wm(n,u,v){if(n[u+1]==="{"){let z=Os(n,u+2,v).close;return z===-1?v:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<v&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function MC(n,u,v){let W="",z=[],B=u;while(B<v){let X=n[B];if(X==="'")return{text:W,next:B+1,closed:!0,issues:z};if(X!=="\\"){W+=X??"",B++;continue}let Q=DC(n,B+1,v);if(W+=Q.text,Q.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Q.invalidCodePoint}`});B=Q.next}return{text:W,next:v,closed:!1,issues:z}}function DC(n,u,v){let W=n[u];if(!W||u>=v)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return As(n,u+1,v,16,2,u+1);if(W==="u")return As(n,u+1,v,16,4,u+1);if(W==="U")return As(n,u+1,v,16,8,u+1);if(/[0-7]/.test(W))return As(n,u,v,8,3,u+1);return{text:W,next:u+1}}function As(n,u,v,W,z,B){let X=W===16?/[0-9a-fA-F]/:/[0-7]/,Q="",le=u;while(le<v&&Q.length<z&&X.test(n[le]??""))Q+=n[le],le++;if(!Q)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(Q,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function ks(n,u=!1){if(u)return"limited";if(n.some((v)=>v.code==="invalid-ansi-c-code-point"||v.code==="missing-heredoc-delimiter"||v.code==="ambiguous-heredoc-delimiter"||v.code==="unterminated-heredoc"||v.code==="unsupported-heredoc-context"||v.code==="unsupported-function-substitution"||v.code==="unsupported-backtick-escape"||v.code==="unclosed-parameter-expansion"||v.code==="unsupported-parameter-expansion"||v.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function _m(n,u,v,W,z){let B=wm(n,u,v);return{text:W+n.slice(u,B),provenance:hi(z,"variable"),next:B}}function NC(n,u,v){let W=xs(n),z=u,B=!1,X=!1,Q=u;while(Q<v){let le=n[Q];if(le==="\\"&&!B){Q+=2;continue}if(!X&&le==="'"){B=!B,Q++;continue}if(!B&&le==='"'){X=!X,Q++;continue}if(B){Q++;continue}let ue=n.startsWith("$((",Q),be=n.startsWith("$(",Q)&&!ue,Oe=!X&&(n.startsWith("<(",Q)||n.startsWith(">(",Q)),De=le==="`";if(ue||be||Oe||De){let Me=ue?3:De?1:2,Ne=ue?"))":De?"`":")",Le=Bl(n,Q+Me,v,Ne),We=Le===-1?v:Le+Ne.length;W.push(z,Q,"literal"),W.push(Q,We,ue?"arithmetic":"command-substitution"),Q=We,z=We;continue}if(le==="$"){let Me=wm(n,Q,v);if(Me>Q+1){W.push(z,Q,"literal"),W.push(Q,Me,"variable"),Q=Me,z=Me;continue}}if(!X&&(le==="*"||le==="?"||le==="[")){W.push(z,Q,"literal"),W.push(Q,Q+1,"glob"),Q++,z=Q;continue}Q++}return W.push(z,v,"literal"),W.parts}function hi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function LC(n,u,v){return u+1>=v||yi(n[u+1]??"")||Is(n,u+1)!==null}var WC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),FC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function GC(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let v=zC(n,u);if(v===void 0||v===null)return!1;u=v}return!1}function zC(n,u){let v=n[u]?.text.toLowerCase();if(v==="command")return $C(n,u);if(v==="env")return BC(n,u);if(v==="sudo")return UC(n,u);return}function $C(n,u){if(n[u+1]?.text==="-v")return null;for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return v}return n.length}function BC(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(WC.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return v}return n.length}function UC(n,u){for(let v=u+1;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return v+1;if(FC.has(W)){if(n[v+1]===void 0)return null;v++;continue}if(W.startsWith("-"))continue;return v}return n.length}function xm(n,u,v,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=Am(n.raw,u,v,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((X)=>Pm(X,v));if(B.some((X)=>X===null))return{limited:!0};return{words:[...new Set(B.filter((X)=>X!==null&&X!==""))]}}function HC(n,u,v,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=Am(u.raw,v,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let X=B.values.map((Q)=>Pm(Q,W));if(X.some((Q)=>Q===null))return;return{words:X.filter((Q)=>Q!==null&&Q!=="").map((Q)=>Ro(n,u.span.start,u.span.end,Q,"literal",!1))}}function Am(n,u,v,W,z){let B=[n],X=n.length,Q=0;while(!0){let le=B.findIndex((Me)=>gm(Me,z));if(le===-1)break;if(++Q>v)return{limited:"expansions"};let ue=B[le]??"",be=gm(ue,z);if(!be||be.kind==="range")return{limited:"expansions"};let Oe=be.start+ue.length-be.end,De=be.alternatives.reduce((Me,Ne)=>Me+Oe+Ne.length,0);if(X-ue.length+De>W)return{limited:"length"};if(B.length-1+be.alternatives.length>u)return{limited:"words"};B.splice(le,1,...jC(ue,be)),X+=De-ue.length}return Q===0?void 0:{values:B}}function gm(n,u){let v=[],W,z=null,B=!1;for(let X=0;X<n.length;X++){let Q=n[X];if(B){B=!1;continue}if(Q==="\\"&&z!=="'"){B=!0;continue}if(Q===z){z=null;continue}if(z===null&&(Q==="'"||Q==='"')){z=Q;continue}if(z!==null)continue;if(Q==="{"){v.push({start:X,commas:[]});continue}if(Q===","&&v.length>0){v.at(-1)?.commas.push(X);continue}if(Q!=="}"||v.length===0)continue;let le=v.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:X+1,commas:le.commas}:u&&qC(n.slice(le.start+1,X))?{kind:"range",start:le.start,end:X+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:VC(n,W)}}function jC(n,u){return u.alternatives.map((v)=>`${n.slice(0,u.start)}${v}${n.slice(u.end)}`)}function VC(n,u){let v=[u.start,...u.commas,u.end-1];return v.slice(0,-1).map((W,z)=>n.slice(W+1,v[z+1]))}function qC(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function Pm(n,u){let v=`x${n}`,W=Gl(v,0,v.length,{maxInputLength:v.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==v.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function KC(n,u,v,W){return{kind:"program",dialect:"posix",source:n.slice(u,v),span:{start:u,end:v},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function wo(n,u,v,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(n,u,v){return{nodes:n,issues:u,next:v,closed:!1,limited:!0,pendingHeredocs:[]}}function Wl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function YC(n,u,v){let W=n.slice(u,v),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function Si(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((v)=>v.heredoc)||u.nested.some((v)=>Si(v.nodes));return(u.kind==="group"||u.kind==="function")&&Si(u.body.nodes)})}function ZC(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function Tm(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function hm(n,u){let v=n.at(-1);if(v?.kind!=="connector"||!ym.has(v.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${v.operator} requires a following command`})}function Im(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&EC.has(n.text)}function Fl(n,u){let v=n.at(-1);if(!Tm(v))return;if(v?.kind==="command"&&Im(v.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function XC(n,u,v){return u===v||/[\s;&|()]/u.test(n[u-1]??"")}var Mm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object","iex","invoke-expression"]),QC=new Set(["gc","cat","type","cp","mv","rm"]),Dm=["-rec","-for","-path","-literalpath","-whatif"],JC=/^\$env:\w/i,eE=/^(?:\$\{?\w+\}?|~)\\./;function Nm(n,u){let v=n.toLowerCase().replaceAll("`","");if(![...Mm].some((z)=>v.includes(z))&&!(v.includes("rm")&&Dm.some((z)=>v.includes(z)))&&!v.includes("<#")&&!tE(v))return!1;let W=Vl(n,u);if(Lm(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||jl(W).some(nE)}function Lm(n){return n.nodes.some((u)=>{if(u.kind==="group")return Lm(u.body);if(u.kind!=="command")return!1;return u.redirections.some((v)=>v.operator==="<<")})}function tE(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function nE(n){let u=n[0]==="&"||n[0]==="."?1:0,v=n[u]?.toLowerCase();if(v&&Mm.has(v))return!0;let W=n.slice(u+1);if(v&&QC.has(v)&&W.some(rE))return!0;if(v!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return Dm.some((X)=>B.startsWith(X))})}function rE(n){return JC.test(n)||eE.test(n)}function Vl(n,u){let v={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:v,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=ql(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:v,status:cE(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function ql(n,u,v,W,z,B=!1){let X=[],Q=[],le=ws(),ue=0,be=!1,Oe=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Me={start:le.start,end:le.end};_s(X,le,{kind:"command",dialect:"powershell",source:n.slice(Me.start,Me.end),span:Me,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},De=u;while(De<v){let Me=n[De];if(!Me)break;if(B&&Me==="}")return Oe(),{nodes:X,issues:Q,next:De+1,closed:!0,words:ue,limited:be};let Ne=lE(n,De,v,W.maxDepth);if(Ne){if(Ne.issue)Q.push(Ne.issue);if(Ne.limited)return Oe(),{nodes:X,issues:Q,next:Ne.next,closed:!1,words:ue,limited:!0};De=Ne.next;continue}if(/\s/.test(Me)){if(Me==="\r"||Me===`
+`){Oe();let Be=Me==="\r"&&n[De+1]===`
+`?De+2:De+1;X.push(Ul(n,De,Be)),De=Be;continue}De++;continue}let Le=Gm(n,De);if(Le){Oe(),X.push(Ul(n,De,De+Le.length)),De+=Le.length;continue}if(Me==="{"){if(Oe(),z>=W.maxDepth)return Q.push(Fm(W.maxDepth)),{nodes:X,issues:Q,next:v,closed:!1,words:ue,limited:!0};let Be=ql(n,De+1,v,W,z+1,!0),ze=Be.closed?Be.next-1:Be.next,it={kind:"program",dialect:"powershell",source:n.slice(De+1,ze),span:{start:De+1,end:ze},status:Be.limited?"limited":Be.issues.length>0?"partial":"complete",issues:Be.issues,nodes:Be.nodes};if(X.push({kind:"group",style:"brace",span:{start:De,end:Be.next},body:it}),Q.push(...Be.issues),!Be.closed)Q.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=Be.words,be||=Be.limited,De=Be.next;continue}if(Me==="}"){Oe(),X.push(Ul(n,De,De+1)),De++;continue}if(Me===">"||Me==="<"){le.start=le.start===-1?De:le.start;let Be=n[De+1]===Me?De+2:De+1,ze=Be;while(/[ \t]/.test(n[ze]??""))ze++;let it=ze<v?km(n,ze,v,W,z):void 0,at=it?.next??Be;if(le.redirections.push({kind:"redirection",operator:n.slice(De,Be),span:{start:De,end:at},...it?{target:it.word}:{}}),it)Q.push(...it.issues),le.nested.push(...it.nested),ue+=it.words,be||=it.limited;le.end=at,De=at;continue}if(Me===","){le.start=le.start===-1?De:le.start,le.words.push(Dl({text:",",raw:",",span:{start:De,end:De+1},provenance:"literal",quoted:!1})),le.end=++De;continue}let We=km(n,De,v,W,z);if(le.start=le.start===-1?De:le.start,le.end=We.next,le.words.push(We.word),Q.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,be||=We.limited,ue>W.maxWords)return Q.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),Oe(),{nodes:X,issues:Q,next:We.next,closed:!1,words:ue,limited:!0};De=We.next>De?We.next:De+1}return Oe(),{nodes:X,issues:Q,next:De,closed:!B,words:ue,limited:be}}function km(n,u,v,W,z){let B="",X="literal",Q=!1,le=[],ue=[],be=0,Oe=!1,De=(Ne)=>{let Le=iE(n,Ne,v,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),be+=Hl(Le.program),Oe||=Le.program.status==="limited",X="command-substitution",Le.next},Me=u;while(Me<v){let Ne=n[Me];if(!Ne||/\s/.test(Ne)||Gm(n,Me)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let We=n[Me+1];if(!We){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Me++;break}B+=We,Me+=2;continue}if(n.startsWith("$(",Me)){Me=De(Me);continue}let Le=oE(n,Me,Me===u);if(Le?.quote==="'"){Q=!0,Me=Le.bodyStart;let We=!1;while(Me<n.length){if(!Le.hereString&&n[Me]==="'"&&n[Me+1]==="'"){B+="'",Me+=2;continue}let Be=Om(n,Me,Le);if(Be>0){We=!0,Me+=Be;break}B+=n[Me]??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Le?.quote==='"'){Q=!0,Me=Le.bodyStart;let We=!1;while(Me<v){let Be=n[Me];if(Be==="`"&&n[Me+1]){B+=n[Me+1],Me+=2;continue}let ze=Om(n,Me,Le);if(ze>0){We=!0,Me+=ze;break}if(n.startsWith("$(",Me)){Me=De(Me);continue}if(Be==="$")X=n[Me+1]==="("?"command-substitution":"variable";B+=Be??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")X=n[Me+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Me===u)X="variable";B+=Ne,Me++}return{word:Ro(n,u,Me,B,X,Q,X==="literal"?void 0:sE(n,u,Me)),next:Me,issues:le,nested:ue,words:be,limited:Oe}}function oE(n,u,v){let W=n[u];if(W==="'"||W==='"')return{quote:W,bodyStart:u+1,hereString:!1};let z=v?vo(n,u):null;return z?{...z,hereString:!0}:void 0}function Om(n,u,v){if(!v.hereString)return n[u]===v.quote?1:0;return(u===v.bodyStart||n[u-1]===`
+`||n[u-1]==="\r")&&n.startsWith(`${v.quote}@`,u)?2:0}function iE(n,u,v,W,z){let B=Wm(n,u+2,v),X=B===-1?v:B,Q=B===-1?v:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:"limited",issues:[Fm(W.maxDepth)],nodes:[]},next:Q};let le=ql(n,u+2,X,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,X),span:{start:u+2,end:X},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:Q}}function Wm(n,u,v){let W=1,z=!1,B=!1;for(let X=u;X<v;X++){let Q=n[X];if(Q==="`"){X++;continue}if(!B&&Q==="'"){if(z&&n[X+1]==="'"){X++;continue}z=!z;continue}if(!z&&Q==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",X)){W++,X++;continue}if(!B&&Q==="(")W++;if(Q!==")")continue;if(W--,W===0)return X}return-1}function Hl(n){let u=0;for(let v of n.nodes){if(v.kind==="group")u+=Hl(v.body);if(v.kind==="command"){u+=v.words.length;for(let W of v.nested)u+=Hl(W)}}return u}function sE(n,u,v){let W=xs(n),z=vo(n,u),B=u,X=!1,Q=z?.bodyStart??u;while(Q<v){let le=n[Q];if(le==="`"){Q+=2;continue}if(le==="'"&&!z){if(X&&n[Q+1]==="'"){Q+=2;continue}X=!X,Q++;continue}if(X){Q++;continue}if(n.startsWith("$(",Q)){let ue=Wm(n,Q+2,v),be=ue===-1?v:ue+1;W.push(B,Q,"literal"),W.push(Q,be,"command-substitution"),Q=be,B=be;continue}if(le==="$"||le==="@"&&Q===u){let ue=aE(n,Q+1,v);W.push(B,Q,"literal"),W.push(Q,ue,"variable"),Q=ue,B=ue;continue}Q++}return W.push(B,v,"literal"),W.parts}function aE(n,u,v){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=v?v:z+1}let W=u;while(W<v&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function Fm(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function jl(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return jl(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((v)=>v.target?[v.target]:[])].sort((v,W)=>v.span.start-W.span.start).filter((v)=>v.text!==""&&v.raw!==",").map((v)=>v.text),...u.nested.flatMap(jl)]})}function Gm(n,u){for(let v of["&&","||",";","|"])if(n.startsWith(v,u))return v;return null}function lE(n,u,v,W){if(n[u]==="#"&&n[u+1]!==">"){let X=u+1;while(X<v&&n[X]!=="\r"&&n[X]!==`
+`)X++;return{next:X,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<v){if(n.startsWith("<#",B)){if(z++,z>W)return{next:v,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:v,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function cE(n,u){if(u)return"limited";if(n.some((v)=>v.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function Ul(n,u,v){return{kind:"connector",operator:n.slice(u,v),span:{start:u,end:v}}}function C(n,u="auto",v=_r){if(u==="powershell"||u==="auto"&&Nm(n.slice(0,v.maxInputLength),v))return Vl(n,v);return Sm(n,v)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:en(u.map((v)=>v.text))}function _o(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function en(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Kl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function nn(n){return n.value.length}function Ci(n,u,v=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*v)}function Pn(n,u){Ci(n,u)}function Vr(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Qt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function Yl(n){return n===`
+`||n==="\r"||n==="\u2028"||n==="\u2029"}function Jt(n,u,v){if(u+v.length>nn(n))return!1;for(let W=0;W<v.length;W++)if(ct(n,u+W)!==v[W])return!1;return!0}function ur(n,u,v){return!Vr(ct(n,u-1))&&Jt(n,u,v)&&!Vr(ct(n,u+v.length))}function mr(n,u){return Vr(ct(n,u-1))!==Vr(ct(n,u))}function pn(n){return n===`
+`||n===";"||n==="&"||n==="|"}function xo(n){return n==="|"||n===";"}function Ms(n,u,v){let W=Kl(n,v);if(u==="rm")return dE(W);if(u==="dd")return mE(W);return jm(W,!0)}function Ds(n,u,v){let W=Kl(n,v);if(u==="rm")return fE(W);if(u==="reset-hard")return Um(W,"--ha","rd");if(u==="reset-merge")return Um(W,"--me","rge");if(u==="clean")return yE(W);if(u==="checkout")return bE(W);if(u==="push-force")return CE(W);if(u==="push-refspec")return EE(W);if(u==="push-delete")return vE(W);if(u==="branch")return RE(W);if(u==="tag")return xE(W);if(u==="restore")return AE(W);return jm(W,!1)}function dE(n){let u=!1,v=!1,W=!1,z=-1;for(let B=0;B<=nn(n);B++){let X=ct(n,B);if(!u){let le=ct(n,B+2);if(ur(n,B,"rm")&&Qt(le)&&le!==`
+`)u=!0,B++;continue}let Q=uE(n,B);if(X===`
+`||Q!==-1){if(u=!1,v=!1,W=!1,z=-1,Q!==-1)B=Q-1;continue}if(X===";"||X==="&"||X==="|"||B===nn(n)){if(z>=0){let le=zm(n,z,B);v||=le.recursive,W||=le.force}if(v&&W)return!0;u=!1,v=!1,W=!1,z=-1;continue}if(Qt(X)){if(z<0)continue;if(Jt(n,z,"--")&&B-z===2){u=!1,v=!1,W=!1,z=-1;continue}let le=zm(n,z,B);if(v||=le.recursive,W||=le.force,v&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function uE(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(Jt(n,u,String.raw`\n`))return u+2;if(Jt(n,u,String.raw`\x0a`)||Jt(n,u,String.raw`\x0A`))return u+5;if(Jt(n,u,String.raw`\u000a`)||Jt(n,u,String.raw`\u000A`))return u+7;return Jt(n,u,String.raw`\012`)?u+4:-1}function zm(n,u,v){if($m(n,u,v,"recursive"))return{recursive:!0,force:!1};if($m(n,u,v,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<v;B++){let X=ct(n,B);W||=X==="r"||X==="R",z||=X==="f"||X==="F"}return{recursive:W,force:z}}function $m(n,u,v,W){let z=v-u-2;if(z<1||z>W.length||!Jt(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function mE(n){let u=!1;for(let v=0;v<nn(n);v++){if(pn(ct(n,v))){u=!1;continue}if(ur(n,v,"dd")){u=!0,v++;continue}if(!u||!ur(n,v,"of")||!Jt(n,v,"of=/dev/"))continue;let W=v+8;if(W<nn(n)&&!Qt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function fE(n){let u=!1,v=!1,W=!1;for(let z=0;z<=nn(n);){let B=ct(n,z);if(z===nn(n)||pn(B)){u=!1,v=!1,W=!1,z++;continue}let X=gE(n,z);if(X>=0){if(pE(n,X))return!0;let Q=X,le=!1;while(Qt(ct(n,Q)))le||=ct(n,Q)===`
+`,Q++;if(le)v=!1,W=!1;u=!0,z=Q;continue}if(!u){z++;continue}if(Jt(n,z,"--")&&(z===0||Qt(ct(n,z-1)))&&(!ct(n,z+2)||Qt(ct(n,z+2))||pn(ct(n,z+2)))){u=!1,v=!1,W=!1,z+=2;continue}if(v||=Jt(n,z,"--recursive")&&mr(n,z+11)||Zl(n,z,"recursive"),W||=Jt(n,z,"--force")&&mr(n,z+7)||Zl(n,z,"force"),v&&W)return!0;z++}return!1}function Zl(n,u,v){if(!Jt(n,u,"--"))return!1;let W=0;while(W<=v.length){let z=ct(n,u+W+2);if(!z||Qt(z)||pn(z))break;if(z!==v[W])return!1;W++}return W>0&&mr(n,u+W+2)}function pE(n,u){let v=u,W=!1,z=!1;while(v<nn(n)){while(Qt(ct(n,v)))v++;let B=v;while(v<nn(n)&&!Qt(ct(n,v)))v++;if(ct(n,B)!=="-"||v-B===2&&Jt(n,B,"--"))return!1;let X=Bm(n,B,"recursive"),Q=Bm(n,B,"force");if(W&&Q||z&&X)return!0;if(W||=X,z||=Q,ct(n,B+1)==="-")continue;let le=hE(n,B,v);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Bm(n,u,v){return Jt(n,u,`--${v}`)&&mr(n,u+v.length+2)||Zl(n,u,v)}function gE(n,u){if(u>0&&Vr(ct(n,u-1)))return-1;let v=u;if(ct(n,v)==="\\")v++;if(ct(n,v)!=="r")return-1;if(v++,ct(n,v)==="\\")v++;if(ct(n,v)!=="m"||!Qt(ct(n,v+1)))return-1;return v+1}function hE(n,u,v){let W=!1,z=!1,B=!1,X=!1,Q=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q};let le="";for(let ue=u+1;ue<v;ue++){let be=ct(n,ue)??"",Oe=(be==="r"||be==="f")&&mr(n,ue+1);W||=be==="r",z||=be==="f",B||=be==="r"&&Oe,X||=be==="f"&&Oe,Q||=(le==="r"&&be==="f"||le==="f"&&be==="r")&&Oe,le=be}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:X,combined:Q}}function Um(n,u,v){return vi(n,"reset",xo,!0,(W)=>ct(n,W)==="-"&&Ao(n,W,u,v)?!0:W)}function yE(n){return vi(n,"clean",xo,!0,(u)=>{if(ct(n,u)!=="-")return u;if(Ao(n,u,"--fo","rce"))return!0;let v=Ei(n,u,xo);for(let W=u+1;W<v;W++)if(ct(n,W)==="f")return!0;return v-1})}function Ns(n,u,v){if(!ur(n,u,"git"))return null;let W=u+3;if(!Qt(ct(n,W)))return{commandEnd:-1,next:W};while(Qt(ct(n,W)))W++;while(W<nn(n)){if(pn(ct(n,W)))return{commandEnd:-1,next:W};let z=Ei(n,W,pn);if(ur(n,W,v))return{commandEnd:W+v.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&Jt(n,W,"--"),X=SE(n,W,z);W=z;while(Qt(ct(n,W)))W++;if(B)return{commandEnd:ur(n,W,v)?W+v.length:-1,next:Ei(n,W,pn)};if(!X)continue;if(W>=nn(n)||pn(ct(n,W)))return{commandEnd:-1,next:W};W=Ei(n,W,pn);while(Qt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function SE(n,u,v){for(let W of Dn)if(v-u===W.length&&Jt(n,u,W))return!0;return!1}function bE(n){return Hm(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function CE(n){return vi(n,"push",xo,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!Vr(ct(n,u+2))&&!Jt(n,u+2,"-with-lease"))return!0;let v=Vm(n,u,"--fo","rce");if(v>=0&&!Jt(n,v,"-with-lease"))return!0;return u})}function EE(n){return vi(n,"push",pn,!1,(u)=>{if(Qt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<nn(n)&&!pn(ct(n,u+2))&&!Qt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function vE(n){return vi(n,"push",pn,!1,(u)=>{if(ct(n,u)==="-"&&Ao(n,u,"--de","lete"))return!0;if(Qt(ct(n,u))&&ct(n,u+1)===":"&&u+2<nn(n)&&!Qt(ct(n,u+2))&&!pn(ct(n,u+2)))return!0;return u})}function RE(n){let u=!1,v=!1,W=!1;for(let z=0;z<=nn(n);z++){if(z===nn(n)||pn(ct(n,z))){if(v&&W)return!0;u=!1,v=!1,W=!1;continue}if(!u){let Q=Ns(n,z,"branch");if(Q){u=Q.commandEnd>=0,z=Math.max(z,(u?Q.commandEnd:Q.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=Ei(n,z,pn),X=wE(n,z,B);if(v||=X.deletion,W||=X.force,v&&W)return!0;z=B-1}return!1}function wE(n,u,v){let W=!1,z=!1;for(let B=u;B<v;B++){if(ct(n,B)!=="-")continue;if(Ao(n,B,"--de","lete"))W=!0;if(Ao(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let X=B+1,Q=!1,le=!1,ue=!1;while(X<v&&_E(ct(n,X))){let be=ct(n,X);Q||=be==="d"||be==="D",le||=be==="f",ue||=be==="D",X++}if(!mr(n,X))continue;W||=Q,z||=le||ue}return{deletion:W,force:z}}function _E(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function xE(n){return Hm(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Hm(n,u){let v=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<nn(n);W++){let z=ct(n,W),B=v[v.length-1];if(!B)return!1;let X=B.escaped;if(B.escaped=!X&&B.quote!=="'"&&z==="\\",!X&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!X&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(v.length===1||!X&&B.quote!=="'")){v.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!X&&!B.quote&&v.length>1&&z==="("){B.depth++;continue}if(!X&&!B.quote&&v.length>1&&z===")"){if(B.depth--,B.depth===0)v.pop();continue}if(Qt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let Q=Ns(n,W,u.command);if(Q){B.outerActive=Q.commandEnd>=0&&Qt(ct(n,Q.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?Q.commandEnd:Q.next)-1);continue}}if(B.outerActive&&z==="-"){if(Ao(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&mr(n,W+1))return!0;if(xo(z))B.outerActive=!1}return!1}function vi(n,u,v,W,z){let B=!1;for(let X=0;X<nn(n);X++){let Q=ct(n,X),le=v(Q);if(!B&&!le){let ue=Ns(n,X,u);if(ue){B=ue.commandEnd>=0&&(!W||Qt(ct(n,ue.commandEnd))),X=Math.max(X,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(X);if(ue===!0)return!0;for(let be=X;be<=ue;be++)if(v(ct(n,be)))B=!1;X=ue}if(le)B=!1}return!1}function AE(n){let u=!1;for(let v=0;v<nn(n);v++){if(Yl(ct(n,v))){if(u)return!0;u=!1;continue}if(!u){let W=Ns(n,v,"restore");if(W){u=W.commandEnd>=0,v=Math.max(v,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,v)==="-"&&ct(n,v+1)==="-"&&(Jt(n,v+2,"staged")||Jt(n,v+2,"help")))u=!1}return u}function jm(n,u){let v=!1;for(let W=0;W<nn(n);W++){let z=ct(n,W),B=u?Yl(z):pn(z);if(v&&Qt(z)&&ct(n,W+1)==="-"&&ur(n,W+2,"delete"))return!0;if(B){v=!1;continue}if(ur(n,W,"find"))v=!0,W+=3}return!1}function Ei(n,u,v){let W=u;while(W<nn(n)&&!Qt(ct(n,W))&&!v(ct(n,W)))W++;return W}function Vm(n,u,v,W){if(!Jt(n,u,v))return-1;let z=u+v.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return mr(n,z)?z:-1}function Ao(n,u,v,W){return Vm(n,u,v,W)>=0}function Bn(n,u){Ci(u,n,2);let v=n.toLowerCase(),W=v.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let X of B){if(X.skipForEchoRg&&z)continue;let Q=X.caseSensitive?n:v;if(X.regex)Pn(u,Q);if((X.regex?.test(Q)??!1)||X.scan&&Ds(Q,X.scan,u))return st("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${X.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var PE=/^[A-Za-z_][A-Za-z0-9_]*=/;function Km(n,u,v){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;Ci(v,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return Ym(u.nodes,W,B)}function Ym(n,u,v){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return Ym(W.body.nodes,u,v);if(W.kind==="unknown")return!v.loose.test(W.source);return TE(W,u,v)})}function TE(n,u,v){if(n.nested.some((z)=>v.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!PE.test(z.text));return n.words.every((z,B)=>z===u||qm(z.raw,v.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!v.loose.test(z.heredoc.body))&&(!z.target||qm(z.target.raw,v.anchored,!0)))}function qm(n,u,v){let W=!1,z=!1;for(let B=0;B<n.length;B++){let X=n[B];if(X==="\\"&&!W){B++;continue}if(!z&&X==="'"){W=!W;continue}if(!W&&X==='"'){z=!z;continue}if(W||X!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!v)return!1}return!0}var IE="dd writing to a /dev device can destroy a disk or partition. Ask the user to run device writes manually after confirming the target.",kE="mkfs formatting a /dev device erases everything on it. Ask the user to run the format manually after confirming the target.",OE="This erases or repartitions a disk. Ask the user to run disk erase and partition commands manually after confirming the target.",ME="This output redirect overwrites a disk device. Ask the user to run device writes manually after confirming the target.",DE="shred permanently destroys the given target. Use rm for ordinary deletes, or ask the user to run shred manually.",NE=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Zm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,LE=new Set(["diskutil","wipefs","sgdisk","parted"]),WE=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),FE=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,GE=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),zE=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),$E=new Set(["i","b"]),BE=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,UE=new Set([">",">|",">>","<>",">&"]),HE=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Xm(n){return n==="dd"||n==="shred"||Zm.test(n)||LE.has(n)}function jE(n,u){let v=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&WE.has(W.toLowerCase())}if(n==="wipefs")return v&&u.some((W)=>FE.test(W));if(n==="sgdisk")return v&&u.some((W)=>W.startsWith("-")&&!VE(W));return n==="parted"&&v&&u.some((W)=>HE.has(W.toLowerCase()))}function VE(n){if(GE.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return $E.has(u[0]??"")||u.every((v)=>zE.has(v))}function Qm(n,u){let v=u.slice(1);if(n==="dd"&&v.some((W)=>/^of=\/dev\/.+/.test(W)&&!NE.has(W)))return st("dd.device-write",IE);if(Zm.test(n)&&v.some((W)=>W.startsWith("/dev/")))return st("mkfs.device",kE);if(jE(n,v))return st("disk.erase",OE);if(n==="shred"&&v.length>0)return st("shred.target",DE);return null}function Jm(n){return n.some((u)=>UE.has(u.operator)&&u.target?.provenance==="literal"&&BE.test(u.target.text))?st("redirect.block-device",ME):null}import{readFileSync as qE,statSync as KE}from"node:fs";import{isAbsolute as YE,resolve as ef}from"node:path";function xr(n,u,v,W){let z=YE(n)?ef(n):u?ef(u,n):void 0;if(!z)return;try{return Ht(z,v,W)}catch{return z}}function Xl(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}var tf=262144;function nf(n){if(!Xl(n))return null;try{let u=KE(n,{throwIfNoEntry:!1});if(!u?.isFile()||u.size>tf)return null;let v=qE(n);return v.length>tf||v.includes(0)?null:{text:v.toString("utf8").replaceAll(`\r
+`,`
+`),bytes:v.length}}catch{return null}}import{isAbsolute as Xs,normalize as dR,parse as uR,posix as Uf,resolve as Jr,sep as cc}from"node:path";import{isAbsolute as ZE,join as rf,normalize as af,parse as XE,sep as of}from"node:path";var QE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],JE=` 	
+`;function Ri(n,u){if(qr(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Ql(n.get("TMPDIR")??"",u)}function Po(n,u){if(n.has("TMPDIR"))return Ql(n.get("TMPDIR")??"",u);let v=Jl(n,u);if(v===void 0)return!0;return Ql(v,u)}function Jl(n,u){return cf(n,u,"TMPDIR")}function Ql(n,u){if(!n)return!1;if(tv(n))return!1;return To(n,u)}function qr(n,u){let v=cf(n,u,"IFS");return v!==void 0&&v!==""&&v!==JE}function To(n,u){let v=Ls(n,u.paths);if(v===null)return!1;return lf(u).some((W)=>Ar(v,W))}function Fs(n,u){let v=Ls(n,u.paths);if(v===null)return!1;return lf(u).some((W)=>Ws(W)===Ws(v))}var sf=new WeakMap;function lf(n){let u=sf.get(n);if(u)return u;let v=ev(n);return sf.set(n,v),v}function ev(n){let u=QE.map((W)=>Ls(W,n.paths)??af(W)),v=Ls(n.tmpdir,n.paths);if(!v)return u;if(process.platform==="win32")return[...u,v];if(process.platform==="darwin"&&nv(v))return[...u,v];return u}function tv(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function cf(n,u,v){return n.has(v)?n.get(v):u.env.get(v)}function nv(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function Ls(n,u){try{let v=af(n);if(!ZE(v))return v;let W=XE(v).root,z=v.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let X=0;X<z.length;X++){let Q=rf(B,z[X]??"");if(u.entryKind(Q)==="missing")return rf(Q,...z.slice(X+1));let le=u.realpath(Q);if(le===null)return null;B=le}return B}catch{return null}}function Ar(n,u){let v=Ws(n),W=Ws(u);if(v===W)return!0;let z=W.endsWith(of)?W:`${W}${of}`;return v.startsWith(z)}function Ws(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as eR,readdirSync as tR}from"node:fs";import{basename as nR,isAbsolute as Nf,join as rR,relative as Lf}from"node:path";import{isAbsolute as hf,parse as mv}from"node:path";import{dirname as rv,isAbsolute as ov,parse as iv,sep as sv}from"node:path";function Pr(n,u,v){if(cr(u))throw Error("Unsupported Windows namespace path");let W=ov(u)?iv(u).root:"",z=W||n;for(let B of lv(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=rv(z);continue}let X=av(z,B),Q=v.entryKind(X),le=Q==="symlink"?v.realpath(X):X;if(Q==="missing"||le===null)throw Error(`Cannot resolve path component: ${X}`);z=le}return z}function av(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${sv}${u}`}function lv(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var ec=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],cv=new Set(ec),dv=1024,df=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),uf=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),uv=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Gs(n){return cv.has(n)}function tc(n){return Gs(n)||df.has(n)||uf.has(n)||ri(n)}function fr(n,u,v){return v?.has(n)?v.get(n):u.get(n)}function mf(n,u){let v=fr("GIT_CONFIG_COUNT",n,u);if(v===void 0)return{state:"absent"};if(v==="")return{state:"valid",count:0};if(!/^\d+$/.test(v))return{state:"invalid"};let W=Number(v);return Number.isSafeInteger(W)&&W<=dv?{state:"valid",count:W}:{state:"invalid"}}function zs(n,u,v){let z=n.match(uv)?.[1];if(!z||!tc(z))return null;let B=n.indexOf("=");return{name:z,value:`${fr(z,u,v)??""}${n.slice(B+1)}`}}function ff(n){return gf(n,uf)}function pf(n){return gf(n,df)}function gf(n,u){if(!n)return!1;for(let v of n.keys())if(u.has(v))return!0;return!1}var Sf=/^[A-Za-z_][A-Za-z0-9_]*=/;function Tn(n){if(!Sf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function Ae(n){let u=new Map,v=0;while(v<n.length){let W=n[v];if(!W)break;let z=Tn(t(W));if(!z)break;u.set(z.name,z.value),v++}return{words:n.slice(v),envAssignments:u}}function bf(n){let u=$t(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function pr(n,u,v,W){if(!bf(Io(n)))return{words:n,envAssignments:new Map,cwd:v,rewritten:!1};let z=new Set(n),B=n,X=new Map,Q=new Map(W??[]),le=[],ue=v;for(let Oe=0;Oe<l.wrapperPeelIterations.cap;Oe++){let De=yf(B),Me=Ae(B);for(let[Le,We]of Me.envAssignments)X.set(Le,We),Q.set(Le,We);if(B=Me.words,B.length===0)break;while(B.length>0&&Io(B).includes("=")&&!pv(B)){let Le=gv(Io(B),Q,u.env)??zs(Io(B),u.env,Q);if(Le)X.set(Le.name,Le.value),Q.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=$t(Io(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=yv(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=Cv(B,ue,Q,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,Be]of Le.envAssignments)X.set(We,Be),Q.set(We,Be)}if(Ne==="command")B=Ev(B);if(Ne==="builtin")B=B.slice(qn(B,1)==="--"?2:1);if(yf(B)===De)break}let be=Ae(B);for(let[Oe,De]of be.envAssignments)X.set(Oe,De),Q.set(Oe,De);return{words:be.words,envAssignments:X,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:fv(be.words,z)}}function fv(n,u){return n.some((v)=>!u.has(v))}function yf(n){return n.map(t).join(" ")}function Io(n){let u=n[0];return u?t(u):""}function qn(n,u){let v=n[u];return v?t(v):void 0}function pv(n){return Sf.test(Io(n))}function gv(n,u,v){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??v.get("TMPDIR")??""}${n.slice(8)}`}}var hv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function yv(n,u,v){let W=1,z=v;while(W<n.length){let B=qn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let X=qn(n,W+1);z=X?wi(z,X,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=wi(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=wi(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(hv.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var Sv=new Set(["-i","-0","--null"]),bv=new Set(["-u","--unset","-C","--chdir","-P"]);function Cv(n,u,v,W){let z=new Map,B=[],X=u,Q=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:X,envSplitValues:B.length>0?B:void 0});while(Q<n.length){let ue=qn(n,Q);if(!ue)break;if(ue==="--")return le(Q+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let Oe of v.keys())z.set(Oe,"");z.set("TMPDIR",""),Q++;continue}if(Sv.has(ue)){Q++;continue}if(ue==="-u"||ue==="--unset"){let Oe=qn(n,Q+1);if(Oe!==void 0)z.set(Oe,"");Q+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),Q++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),Q++;continue}let be=ue==="-S"||ue==="--split-string"?{value:qn(n,Q+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(be){if(be.value!==void 0)B.push(be.value);return X=null,le(Q+be.consumed)}if(bv.has(ue)){if(ue==="-C"||ue==="--chdir"){let Oe=qn(n,Q+1);X=Oe?wi(X,Oe,W.paths):null}Q+=2;continue}if(ue.startsWith("-u=")){Q++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let Oe=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);X=wi(X,Oe,W.paths),Q++;continue}if(ue.startsWith("-P")){Q++;continue}if(ue.startsWith("-")){Q++;continue}if(!Tn(ue))break;while(Q<n.length){let Oe=Tn(qn(n,Q)??"");if(!Oe)break;z.set(Oe.name,Oe.value),Q++}if(qn(n,Q)==="--")Q++;return le(Q)}return le(Q)}function wi(n,u,v){if(u==="")return null;if(!n&&!hf(u))return null;let W=hf(u)?mv(u).root:v.realpath(n??"/");if(W===null)return null;try{return Pr(W,u,v)}catch{return null}}function Ev(n){if(qn(n,1)==="-v")return[...en(["type"]),...n.slice(2)];let u=1;while(u<n.length){let v=qn(n,u);if(!v)break;if(v==="-p"||v==="-v"||v==="-V"){u++;continue}if(v==="--")return n.slice(u+1);if(v.startsWith("-")&&!v.startsWith("--")&&v.length>1){if(!/^[pvV]+$/.test(v.slice(1)))break;u++;continue}break}return n.slice(u)}var vv=/['"\\$`{}#]/;function Kr(n,u){if(n.some((W)=>vv.test(W)))return null;let v=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return v.length<=64?v:null}function rr(n,u,v){return Yr(n,u,v).tokens}function Rv(n){let u=[],v="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((X)=>X.replace(/["']/g,"")).filter((X)=>X.length>0);v+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(v.length>0)u.push(v);v="",W++;continue}v+=z,W++}if(v.length>0)u.push(v);return u}function Tr(n,u,v,W=0){let z=Yr(n,u,v),B=(z.envSplitValues??[]).flatMap(Rv);if(B.length===0)return z.tokens;let X=[...B,...z.tokens];if(W>=8)return X;return Tr(X,u,v,W+1)}function Yr(n,u,v,W){if(!bf(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:v};let z=pr(en(n),u,v,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var oc=Symbol("adopt-as-operand"),wv=new Set(["env","sudo","command","builtin"]),_v=new Set(["&&","||","|&","|","&",";"]),xv=new Set(["<<","<<<",">|"]),Cf=new Set(["|","|&"]),Av=/[*@#?$!_-]/,Pv=/^\w+(?::\w+)*/,Tv=Object.freeze([]),_i=Object.freeze({kind:"scope",edge:"enter"}),xi=Object.freeze({kind:"scope",edge:"exit"}),Iv=Object.freeze([]),kv=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Ai=new Set(["bash","sh","zsh","dash","ksh"]),Ov=256,_f=new WeakMap;function xf(n,u){let v=u.status==="complete"?new Set(rc(u)):new Set,W=Nv(n,v);if(u.dialect==="powershell"?u.issues.some((le)=>le.code.includes("quote")):ms(W))return $s("unclosed-quote",W,u);let B={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},X=Zr(u,{source:W,suppressed:v,flags:B,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(B.limited)return $s("structural-limit",W,u);if(B.invalid)return $s("invalid",W,u);let Q=$s("complete",W,u,B.assignmentFallbacks);return _f.set(Q,Object.freeze(X)),Q}function js(n,u,v,W,z){let B=z.word??((Ne)=>Ne),X={cwd:u,variables:new Map,previous:null},Q=[],le=new Set,ue=null,be=[],Oe=Af(n),De=Oe.findLastIndex((Ne)=>Ne.kind==="operator"&&Cf.has(Ne.operator)),Me=De!==-1&&Oe.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of Oe.entries()){let We=Me||Ne<=De;if(Le.kind==="scope"){if(Le.edge==="enter"){be.push({state:X,segment:[...Q],shellWords:new Set(le),pipeProducer:ue});continue}let Be=z.segment(Q,X,ue,null,le,We);if(Be)return Be;let ze=be.pop();if(ze===void 0)throw Error("scope exit without a matching enter");X=ze.state,Q=ze.segment,le=ze.shellWords,ue=ze.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let Be=z.segment(Q,X,ue,Le.operator,le,We);if(Be)return Be;X=Mv(Q,X,v,W),ue=Q.length>0&&Cf.has(Le.operator)?Q:null,Q=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(Q.length-1);if(Le.target===void 0)continue;let Be=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},X,We);if(Be===oc){le.add(Q.length),Q.push(B(Le.target));continue}if(Be)return Be;continue}Q.push(B(Le.text))}return z.segment(Q,X,ue,null,le,Me)}function Vs(n){return Af(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function In(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(v,W,z,B)=>{let X=u.get(W);if(X===void 0)return v;let Q=z.startsWith(":")?X!=="":!0;if(z.endsWith("-"))return Q?X:In(B,u);return Q?In(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(v,W)=>u.get(W)??v).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(v,W)=>u.get(W)??v)}function Pi(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function Mv(n,u,v,W){let z=Pi(n)?new Map([...u.variables,...Dv(n,u.variables)]):u.variables,B=rr([...n],v),X=Wt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!X)return{...u,variables:z};if(X==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:bn(In(X,z),u.cwd,v,W),variables:z,previous:u.cwd}}function Dv(n,u){return n.flatMap((v)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(v),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],In(z,u)]]:[]})}function Af(n){return _f.get(n)??Tv}function Nv(n,u){return[...u].reduce((v,W)=>v.slice(0,W.start)+" ".repeat(W.end-W.start)+v.slice(W.end),n)}function $s(n,u,v,W=Iv){return Object.freeze({status:n,source:u,program:v,assignmentFallbacks:Object.freeze(W)})}function Zr(n,u){return n.nodes.flatMap((v,W)=>Lv(v,n,W,u)).sort((v,W)=>v.start-W.start).flatMap((v)=>[...v.events])}function Lv(n,u,v,W){if(n.kind==="connector")return[{start:n.span.start,events:[Kn(Bv(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Kn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",X=W.source[n.span.end-1]===(B?"}":")"),Q=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[Bs("{"),...Zr(n.body,Q),...X?[Bs("}")]:[]]:[_i,Kn("("),...Zr(n.body,Q),...X?[Kn(")")]:[],xi]}]}let z=Vv(n,W.functions);if(z){if(W.depth>=_r.maxDepth||++W.flags.expansions>Ov)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...Ef(n,W),Bs(";"),...Zr(z,{...W,depth:W.depth+1}),Bs(";")]},...vf(n,u,v,W)]}return[{start:n.span.start,events:Ef(n,W)},...vf(n,u,v,W)]}function Ef(n,u){return[...n.words.map((v)=>({start:v.span.start,events:Tf(v,n,u,!1)})),...n.redirections.map((v)=>({start:v.span.start,events:Wv(v,n,u)}))].sort((v,W)=>v.start-W.start).flatMap((v)=>v.events)}function Wv(n,u,v){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?Tf(n.target,u,v,!0):[],B=z[0],X=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[Hs(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:Uv(W),targetOrder:xv.has(W)?"legacy-segment":"immediate",...X===void 0?{}:{target:X},...n.heredoc&&v.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:kf(u)}:{}}),...X===void 0?z:z.slice(1)]}function vf(n,u,v,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let X=B.heredoc;if(!X)return[];let Q=[Hs(X.delimiter),.../[\r\n]/.test(W.source[X.terminatorSpan.end]??"")?[Kn(";")]:[]];if(W.suppressed.has(X.bodySpan))return[{start:X.bodySpan.start,events:Q}];return[{start:X.bodySpan.start,events:[...Pf(W.source.slice(X.bodySpan.start,X.bodySpan.end),W),...Q]}]}),...z.some((B)=>!B.heredoc&&B.target)?Fv(u,v,W):[]]}function Fv(n,u,v){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:Pf(v.source.slice(W.span.end,n.span.end),v)}]}function Pf(n,u){if(u.depth>=_r.maxDepth)return u.flags.limited=!0,[];let v=C(n,"posix");if(v.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Zr(v,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function Tf(n,u,v,W){let z=v.powershell?vo(n.raw,0):null;if(z&&n.provenance==="literal")return[Hs(n.text)];let B=[],X={single:!1,double:z!==null},Q="",le=!1,ue=()=>{let be=le&&!W?Kn("glob"):Q!==""||n.quoted&&B.length===0?Hs(Q):void 0;if(be)B.push(be);Q="",le=!1};for(let be of z?Gv(n,z.bodyStart):n.parts){if(be.provenance!=="command-substitution"&&be.provenance!=="arithmetic"){for(let Ne of nc(be.raw,X,v.flags,v.powershell)){if(typeof Ne==="string"){ue(),B.push(Kn(Ne));continue}Q+=Ne.text,le||=Ne.glob}continue}let Oe=u.nested.find((Ne)=>Ne.span.start>=be.span.start&&Ne.span.end<=be.span.end);if(X.double){let Ne=v.source.slice(be.span.start,be.span.end);Q+=nc(Ne,{single:!1,double:!0},v.flags,v.powershell).map((We)=>typeof We==="string"?We:We.text).join("");let Le=Oe?Zr(Oe,v).filter((We)=>We.kind==="redirection"&&We.body!==void 0):[];if(Le.length>0)B.push(_i,...Le,xi);continue}let De=Oe?Zr(Oe,v):[];if(be.raw.startsWith("`")){Q+="${}",ue(),B.push(_i,...De,xi);continue}if(be.raw.startsWith("<(")||be.raw.startsWith(">(")){ue(),B.push(be.raw.startsWith("<(")?Kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),_i,...De,...be.raw.endsWith(")")?[Kn(")")]:[],xi);continue}let Me=be.raw.startsWith("$((")?2:1;Q+="${}",ue(),B.push(...Array.from({length:Me},()=>Kn("(")),...Me===1?[_i]:[],...De,...be.raw.endsWith(")".repeat(Me))?Array.from({length:Me},()=>Kn(")")):[],...Me===1?[xi]:[])}return ue(),B}function Gv(n,u){let v=n.raw.length-(/(?:\r\n|[\r\n])"@$/.exec(n.raw)?.[0].length??0);return n.parts.flatMap((W)=>{if(W.provenance==="command-substitution")return[W];let z=n.raw.slice(Math.max(W.span.start-n.span.start,u),Math.min(W.span.end-n.span.start,v));return z===""?[]:[{...W,raw:z.replace(/["']/g,"`$&")}]})}function nc(n,u,v,W){let z=[],B="",X=!1,Q=0;while(Q<n.length){let le=n[Q]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:X},le),B="",X=!1,Q++;continue}if(W&&le==="`"&&!u.single){B+=n[Q+1]??"",Q+=2;continue}if(u.single&&le==="'"){u.single=!1,Q++;continue}if(u.single){B+=le,Q++;continue}if(u.double){if(le==='"'){u.double=!1,Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,Q+=2;continue}if(le==="$"){let ue=Rf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}B+=le,Q++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',Q++;continue}if(!W&&le==="\\"){let ue=n[Q+1]??"";X||=ue==="*"||ue==="?",B+=ue,Q+=2;continue}if(le==="$"){let ue=Rf(n,Q,u,v,W);B+=ue.text,Q=ue.next;continue}X||=le==="*"||le==="?",B+=le,Q++}return[...z,{text:B,glob:X}]}function Rf(n,u,v,W,z){let B=n[u+1];if(B==="{"){let Q=z?$v(n,u+2):Os(n,u+2,n.length).close;if(Q===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,Q+1);return zv(le,v,W,z),{text:le,next:Q+1}}if(B!==void 0&&Av.test(B))return{text:`\${${B}}`,next:u+2};let X=(z?Pv:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${X}}`,next:u+1+X.length}}function zv(n,u,v,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let X=z.slice(B.length),Q=[":=","="].find((ue)=>X.startsWith(ue));if(!Q)return;let le=nc(X.slice(Q.length),{...u},v,W);v.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function $v(n,u){let v=1,W=u;while(v>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")v++;if(n[W]==="}")v--;W++}return v===0?W-1:-1}function Bv(n){return/^[\r\n]+$/.test(n)?";":n}function Kn(n){return Object.freeze({kind:"operator",operator:n,boundary:_v.has(n)})}function Bs(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function Hs(n){return Object.freeze({kind:"word",text:n})}function Uv(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function ko(n){return kv.has(n)||/^python\d/.test(n)}var Hv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function If(n,u){let v=u[0];if(v===void 0||!v.startsWith("-"))return u;let W=Hv.get(n)?.has(v)??!1;return If(n,u.slice(W?2:1))}function Us(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return Us(n.slice(1));if(u==="uv"&&n[1]==="run")return Us(n.slice(2));if(!wv.has(u))return[...n];return Us(If(u,n.slice(1)))}function kf(n){let u=gi(n),v=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return Us(v<0?[]:n.words.slice(v).map((W)=>W.text))}function jv(n){let u=kf(n)[0];if(u===void 0)return!1;let v=Wt(u).toLowerCase();return ko(v)&&!Ai.has(v)}function rc(n){return n.nodes.flatMap((u,v)=>{if(u.kind==="group"||u.kind==="function")return rc(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((Q)=>rc(Q)),z=u.redirections.flatMap((Q)=>Q.heredoc?.quotedDelimiter?[Q.heredoc.bodySpan]:[]);if(jv(u))return[...W,...z];let B=n.nodes[v+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!Kv(u))return W;return[...W,...z]})}function Vv(n,u){let v=gi(n);return v===void 0?void 0:u.get(v)}function Ir(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function qv(n){if(Ir(n.words[0],"git"))return Ir(n.words[1],"commit");if(!Ir(n.words[0],"gh")||!Ir(n.words[2],"create"))return!1;return Ir(n.words[1],"pr")||Ir(n.words[1],"issue")}function Kv(n){return(Ir(n.words[0],"cat")||Ir(n.words[0],"tee")||qv(n))&&!n.words.some(wf)&&!n.redirections.some((v)=>wf(v.target))}function wf(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var or="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",qs="Unsupported heredoc syntax",Xr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function ir(){return{id:"analysis.dynamic-shell-source",reason:Xr,intent:"stop_and_explain"}}var Of="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var ic=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Yv=new Set([...ic,"dir_path","glob","glob_pattern","include_pattern"]),Zv=new Set([...ic,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(or)}}function Mf(n){let u=Xv(),v=de(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&v)W.push({usage:"input-candidate",source:v});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,X)=>{let Q=B.findIndex((be)=>be.source===X.source);if(Q!==-1){let be=B[Q];if(!be)return B;return B[Q]={...be,usages:[...be.usages,X.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(X.source,le);return B.push({usages:[X.usage],source:X.source,program:ue,shell:u.getShellSyntax(X.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:Qv(n),store:u}}function Oo(n,u){return n.commands.find((v)=>v.usages.includes(u))}function gr(n){return Oo(n,"declared-command")??Oo(n,"input-candidate")}function hr(n,u){if(!n.includes("$"))return n;return Ua(n,u)}function Xv(){let n=new Map,u=new WeakMap,v=(z,B)=>{let X=`${B}\x00${z}`,Q=n.get(X);if(Q)return Q;let le=C(z,B);return n.set(X,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let X=B??v(z,"posix"),Q=u.get(X);if(Q)return Q;let le=X.status==="limited"?{status:"structural-limit",source:z,program:X,assignmentFallbacks:[]}:xf(z,X);return u.set(X,le),le},getCommandProgram:v,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function Qv(n){let u=n.route.kind==="grep"?Yv:n.route.kind==="glob"?Zv:ic;return[...nu(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?iu(n.input):[]]}var Jv=new Set(["-S","--suffix"]);function Mo(n,u,v,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return js(n,u,v,W,{segment:(B,X)=>z.findSegmentTarget(B,X),redirection:(B,X)=>B.role==="file-write"&&z.isRedirectionTarget(In(B.target,X.variables),X)?B.target:null})}function Ks(n){let u=[],v=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){v=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){v=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){v=B.slice(2);continue}if(!W&&Jv.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return v?{sources:u,destination:v}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Wf(n,u,v,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(rs(n.invocation.toolName))return null;let Q=n.paths.find((le)=>Df(le,z,u,v,W,u.entries));return Q?{target:Q}:null}if(n.invocation.route.kind!=="command")return null;let B=gr(n);if(!B)return null;let X=Mo(B.shell,z,v,W,{findSegmentTarget:(Q,le)=>cR(Q,le,u,v,W),isRedirectionTarget:(Q,le)=>Df(Q,le.cwd,u,v,W,u.markerFiles),findMalformedTarget:()=>null});return X?{target:X}:null}function Qr(n,u,v,W,z,B,X=!1){if(!v)return!1;let Q=Zs(bn(n,u,z,B)),le=Q.replace(/(\/\.?\*+)+$/,"");if(le!==Q&&le!==""){if(sc(le,v))return!0;let ue=X||Q.slice(le.length).includes("/."),be=(Oe)=>ue?Ys(Oe,le):oR(Oe,le);if(v.markerFiles.some(be))return!0;return W&&ac(v).some(be)}if(sc(Q,v))return!0;return W&&ac(v).some((ue)=>Ys(ue,Q))}function oR(n,u){let v=Lf(u,n);if(v===""||v.startsWith("..")||Nf(v))return!1;return!v.split(/[\\/]/)[0]?.startsWith(".")}function iR(n,u,v,W,z){return Qr(n,u,v,!0,W,z)}function sR(n,u,v,W,z){if(!v)return!1;return sc(Zs(bn(n,u,W,z)),v)}function Df(n,u,v,W,z,B){let X=Zs(bn(n,u,W,z));return B.includes(X)||Gf(X,v)}function Ff(n,u,v,W,z){if(!v)return!1;return v.hooksDirectories.some((B)=>n.some((X)=>Ys(B,Zs(bn(X,u,W,z)))))}function sc(n,u){return u.entries.includes(n)||u.directories.includes(n)||Gf(n,u)}function Gf(n,u){return u.hooksDirectories.some((v)=>Ys(n,v))}var aR=50000;function zf(n,u){let v=[...new Set(ac(n))];if(v.some((z)=>u(nR(z))))return!0;let W=0;while(v.length>0){let z=v.pop()??"",B=lR(z);if(!B)return!0;if(W+=B.length,W>aR)return!0;if(B.some((X)=>u(X.name)))return!0;v.push(...B.filter((X)=>X.isDirectory()).map((X)=>rR(z,X.name)))}return!1}function lR(n){try{let u=eR(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return tR(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function ac(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function Ys(n,u){let v=Lf(u,n);return v===""||!/^\.\.(?:[\\/]|$)/.test(v)&&!Nf(v)}function Zs(n){return process.platform==="win32"?n.toLowerCase():n}function cR(n,u,v,W,z){if(Pi(n))return null;let B=Tr([...n],W);if(Wt(B[0]??"").toLowerCase()!=="mv")return null;let X=Ks(B.slice(1)),Q=X.sources.find((le)=>iR(In(le,u.variables),u.cwd,v,W,z));if(Q)return Q;return X.destination&&sR(In(X.destination,u.variables),u.cwd,v,W,z)?X.destination:null}var mR=process.platform==="win32",$f=64,fR=16384;function dc(n,u,v,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!dn(v,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!dn(v,z.id,u.paranoid))return null;return st(z.id,z.reason)}function Do(n,u,v,W,z={}){return pR(n,u,z).map((B)=>Ft(dc(B,u,v,W),v)).find((B)=>B!==null)??null}function pR(n,u,v){let W=sr(n,u,v);if(W.kind==="cwd_self_target")return[W,sr(n,u,{...v,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=sr(n,u,{...v,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,sr(n,u,{...v,skipHomeCwd:!0,skipCwdSelf:!0})]}function eo(n){let u=xm(n,$f,$f,fR);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:gR(n)}}function gR(n){let u=n.parts.filter((v)=>v.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(v.raw));return u.length>0&&u.every((v)=>hR(n.raw,v.span.start-n.span.start))}function hR(n,u){let v=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&v!=="'"){W=!0;continue}if(v===B){v=null;continue}if(v===null&&(B==="'"||B==='"'))v=B}return v==='"'}function Un(n){let u=n.environment.home,v=n.environment.paths,W=n.budget??_n();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:RR(n.allowPaths,u,v,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function sr(n,u,v={}){let W=v.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!v.tmpdirWordSplittingProtected&&_R(n))return{kind:"outside_anchored_cwd"};let z=!W&&Hf(n,u.posixShell);if(cr(n))return{kind:"outside_anchored_cwd"};if(Ti(n,W))return{kind:"root_or_home_target"};if(bR(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Qr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(CR(n,u.trustTmpdirVar,u.posixShell,z,W,v.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z){let X=u.resolvedCwd??u.anchoredCwd;return!v.skipHomeCwd&&X!==null&&Bf(X,u.environment.home,u.environment.paths,u.budget)?{kind:"home_cwd_target"}:{kind:"dynamic_target"}}if(wR(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!v.skipHomeCwd&&[B,u.resolvedCwd??B].some((X)=>Bf(X,u.environment.home,u.environment.paths,u.budget)))return{kind:"home_cwd_target"};if(!v.skipCwdSelf&&[u.resolvedCwd??B,B].some((X)=>TR(n,u.resolvedCwd??B,u.environment.paths,u.budget,X)))return{kind:"cwd_self_target"};if(IR(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(yR(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function yR(n,u,v){let W=n.trim();if(v||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if(Xs(W)||W.startsWith("~"))return!1;if(uc(W))return!1;if(jf(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return To(Jr(u.resolvedCwd,W),u.environment)}function SR(n,u,v={}){let{containmentTarget:W,...z}=v;if(sr(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(vR(B))return!1;if(Fs(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((X)=>jf(W??B,X,u.environment.paths,u.budget))}function Ti(n,u=!1){let v=n.trim(),W=Uf.normalize(v),z=v.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((X)=>/^\*+$/.test(X)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function bR(n,u,v){let W=n.trim(),z=v?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=Xs(z)?z:u.resolvedCwd?Jr(u.resolvedCwd,z):null;if(!B)return!1;let X=kn(Ht(B,u.environment.paths,u.budget));if(X===uR(X).root)return!0;return X===kn(Ht(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function kn(n){let u=dR(n);if(mR){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function CR(n,u,v,W,z,B,X,Q){let le=n.trim();if(uc(le))return!1;if(!W&&To(le,Q))return!0;return(u||B&&X)&&v&&!z&&ER(le,v)}function ER(n,u){return["$TMPDIR","${TMPDIR}"].some((v)=>{if(n===v)return!0;if(!n.startsWith(`${v}/`))return!1;return!Hf(n.slice(v.length+1),u)})}function vR(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return Uf.normalize(`/${u[1]??""}`)==="/"}function uc(n){return n.split(/[\\/]+/).includes("..")}function RR(n,u,v,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=ui(z.trim(),u);if(!Xs(B))return[];try{let X=Ht(B,v,W);if(mi(X,Ht(u,v,W)))return[];return[kn(X)]}catch{return[]}})}function wR(n,u,v){if(u.allowRoots.length===0)return!1;let W=n.trim();if(uc(W))return!1;let z=v?W:ui(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,X=Xs(z)?z:B?Jr(B,z):null;if(!X)return!1;try{let Q=kn(Ht(X,u.environment.paths,u.budget));return u.allowRoots.some((le)=>Q===le||Q.startsWith(le.endsWith(cc)?le:`${le}${cc}`))}catch{return!1}}function _R(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function Hf(n,u=!1){return n.includes("$")||n.includes("`")||xR(n)||u&&AR(n)}function xR(n){let u=!1;for(let v of n){if(u){u=!1;continue}if(v==="\\"){u=!0;continue}if(v==="*"||v==="?"||v==="[")return!0}return!1}function AR(n){let u=!1;for(let v=0;v<n.length;v++){let W=n[v];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&PR(n,v)||(W==="+"||W==="@"||W==="!")&&n[v+1]==="(")return!0}return!1}function PR(n,u){let v=n.indexOf("}",u+1);if(v===-1)return!1;let W=n.slice(u+1,v);return W.includes(",")||W.includes("..")}function Bf(n,u,v,W){try{return kn(Ht(n,v,W))===kn(Ht(u,v,W))}catch{try{return kn(n)===kn(u)}catch{return!1}}}function TR(n,u,v,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return kn(Ht(Jr(u,n),v,W))===kn(Ht(z,v,W))}catch{try{return kn(Jr(u,n))===kn(z)}catch{return!1}}}function IR(n,u,v,W,z,B,X){let Q=v??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return lc(n,u,B,X)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return lc(Jr(Q,n),u,B,X)}catch{return!1}if(n.startsWith("../"))return!1;try{return lc(Jr(Q,n),u,B,X)}catch{return!1}}function lc(n,u,v,W){try{return Vf(Ht(n,v,W),Ht(u,v,W))}catch{return!1}}function jf(n,u,v,W){if(!u)return!1;try{return Vf(Ht(u,v,W),Ht(n,v,W))}catch{return!0}}function Vf(n,u){let v=kn(n),W=kn(u);return v.startsWith(`${W}${cc}`)||v===W}function Qs(n,u){let v=u.envAssignments??new Map,W=Jl(v,u.environment),z=u.trustedTmpdirValue??Po(v,u.environment),B=u.allowTmpdirVar??!Ri(v,u.environment),X={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??qr(v,u.environment),trustedTmpdirValue:z,budget:u.budget},Q=Un(X),le=Un({...X,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),be=u.cwd&&u.environment.paths.realpath(u.cwd),Oe=ue&&be&&!Ar(be,ue)?u.cwd:void 0;return n.every((De)=>{let Me=eo(De);if(Me.unsafeBraceExpansion||Me.expandedTargets?.length===0)return!1;return(Me.expandedTargets??[t(De)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?Oe:void 0,We=Le??Ne,Be={targetIsLiteral:Me.expandedTargets!==void 0||Me.targetIsLiteral,tmpdirWordSplittingProtected:Me.tmpdirWordSplittingProtected};if(!dn(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&sr(We,Q,Be).kind==="within_anchored_cwd")return!0;return SR(We,Le?le:Q,{...Be,containmentTarget:kR(We,W)})})})}function kR(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var No="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Ii="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",fc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),OR=new Set(["-p","--print"]),MR=new Map([["node",new Set(["-c","--check"])],["ruby",new Set(["-c"])]]),DR=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),NR=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),LR=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),WR=new Map([["python",new Set(["m"])]]),FR=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),GR=new Set(["always","default","never"]),zR=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),$R=/\\\r?\n/g,qf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,BR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${qf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${qf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],UR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Kf(n){return ea(n).code}function Js(n){return ea(n).sources}function Yf(n){return UR.get(ta(n))??[]}function ea(n){let u=ta(n[0]??"");if(!fc.has(u))return{code:null,sources:[],optionsOpen:!1};let v=[],W=[],z=!0;for(let B=1;B<n.length;B++){let X=n[B];if(X===void 0)break;if(X==="--")return Yn(u,v,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(X===""||X==="-"||!X.startsWith("-"))return Yn(u,v,W,z,B,X);if(u==="node"&&OR.has(X)){let Oe=n[B+1];if(Oe===void 0)return Yn(u,v,W,z);if(Oe.startsWith("-"))continue;v.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),B++;continue}if(jR(u,X)){let Oe=n[B+1];if(Oe===void 0)return Yn(u,v,W,z);if(v.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),u==="python")return Yn(u,v,W,z);B++;continue}let Q=/^--eval=(.*)$/s.exec(X);if(VR(u)&&Q){let Oe=Q[1]??"";v.push({tokenIndex:B,value:Oe}),W.push({tokenIndex:B,kind:"inline-code",value:Oe});continue}if(u==="node"){let Oe=HR(X);if(Oe){if(Oe.attached){if(z&&=Oe.value!=="",Oe.value!=="")W.push({tokenIndex:B,kind:"module-file",value:Oe.value});continue}let De=n[B+1];if(De===void 0||De.startsWith("-"))return z=!1,Yn(u,v,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:De}),B++;continue}}if(u==="python"&&X.startsWith("--check-hash-based-pycs=")||u==="node"&&(X==="--conditions="||X==="--diagnostic-dir="||X==="--title=")||u==="ruby"&&(X==="--disable="||X==="--enable="))return Yn(u,v,W,z);if(FR.get(u)?.has(X)){let Oe=n[B+1];if(Oe===void 0||Oe.startsWith("-")&&!(u==="ruby"&&zR.has(X))||u==="python"&&!GR.has(Oe))return Yn(u,v,W,z);B++;continue}if(X.startsWith("--"))continue;let le,ue=!1;for(let Oe=1;Oe<X.length;Oe++){let De=X[Oe];if(De===void 0)break;if(WR.get(u)?.has(De)){let Me=X.slice(Oe+1),Ne=Me||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});return Yn(u,v,W,z)}if(DR.get(u)?.has(De)){le=X.slice(Oe+1)||n[B+1],ue=Oe+1===X.length;break}if(u==="node"&&De==="r"){if(z&&=X==="-r",X==="-r"){let Me=n[B+1];if(z&&=Me!==void 0&&!Me.startsWith("-"),z&&Me!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Me});B++}break}if(u==="ruby"&&De==="r"){let Me=X.slice(Oe+1),Ne=Me||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});if(!Me)B++;break}if(u==="perl"&&(De==="M"||De==="m")){let Me=X.slice(Oe+1);if(!Me){if(z=!1,Oe+1===X.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Me});break}if(NR.get(u)?.has(De)){if(Oe+1===X.length)B++;break}if(LR.get(u)?.has(De)&&Oe+1<X.length)break}if(le===void 0)continue;let be=ue?B+1:B;if(v.push({tokenIndex:be,value:le}),W.push({tokenIndex:be,kind:"inline-code",value:le}),u==="python")return Yn(u,v,W,z);if(ue)B++}return Yn(u,v,W,z,void 0,void 0,!0)}function Yn(n,u,v,W,z,B,X=!1){let Q=n==="node"?u.slice(-1):u,le=new Set(Q.map((be)=>be.tokenIndex)),ue=v.filter((be)=>be.kind!=="inline-code"||le.has(be.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?Q[0]?.value:Q.map((be)=>be.value).join(`
+`))||null,sources:W?ue:[],optionsOpen:W&&X}}function HR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function pc(n){let u=MR.get(ta(n[0]??"")),v=n.findIndex((W,z)=>z>0&&(W==="-"||!W.startsWith("-")));return u!==void 0&&n.slice(1,v===-1?void 0:v).some((W)=>u.has(W))}function gc(n,u){return ta(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function ta(n){let u=Wt(n).toLowerCase();return cs.test(u)?"python":u}function jR(n,u){return fc.get(n)?.has(u)??!1}function VR(n){return fc.get(n)?.has("--eval")??!1}function ki(n,u,v=!1){let W=YR(n,u);if(Pn(u,W),BR.some((X)=>Array.from(W.matchAll(X)).some((Q)=>Q.groups?.literal===void 0||Ti(Q.groups.literal,!0))))return!0;if(!mc(W,u))return!1;Pn(u,W);let B=KR(W);if(mc(B,u))return!0;if(Pn(u,B),!Zf.test(B))return!1;return!v||qR(W,u)}function qR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let be=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,Oe=le+be.length,De=Oe;while(De<n.length&&!n.startsWith(be,De))De+=n[De]==="\\"?2:1;if(De>=n.length)return!0;z.push({start:Oe,text:n.slice(Oe,De)}),W.fill(" ",le,De+be.length),le=De+be.length-1}let B=W.join(""),X=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>Zf.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:na(B,ue)}});if(X.some((le)=>hc(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),be=X.some((Oe)=>le.start>=Oe.start&&le.start<Oe.end);return(ue||be)&&mc(le.text,u)})}function na(n,u){let v=1;for(let W=u;W<n.length;W++){if(n[W]==="(")v++;if(n[W]===")")v--;if(v===0)return W}return n.length}function hc(n,u){let v=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))v++;if(")]}".includes(z)&&v--===0)return!1;if(z===","&&v===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var Zf=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function KR(n){let u=[],v=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,X=W+B.length;while(X<n.length&&!n.startsWith(B,X))X+=n[X]==="\\"?2:1;if(X>=n.length)break;u.push(n.slice(v,W)," "),W=X+B.length,v=W}return u.push(n.slice(v)),u.join("")}function mc(n,u){if(Ms(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Pn(u,n),W.test(n))return!0;if(Ms(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Pn(u,n),W.test(n))return!0;if(Ms(n,"find",u))return!0;let v=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(Pn(u,n),v.some((z)=>Ds(z,W))))}function YR(n,u){return Pn(u,n),n.replace($R,"")}var ZR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Xf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",XR="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Qf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Jf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",QR="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",JR="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",ew={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Jf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Qf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:QR},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Xf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:XR},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Xf}};function ep(n,u,v){return tw(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,Un({...v,allowPaths:v.policy?.destructiveCommandAllowPaths}),v.policy)}function tw(n,u,v,W){let z=n.filter((le)=>le.kind==="word"),B=rw(z),X=z[B];if(!X||!ZR.has(mw(X.text)))return null;let Q=nw(z.slice(B+1));if(Q.whatIfProtected)return null;if(dn(W,"powershell.remove-item-pipeline-dynamic-target",v.strict)&&u&&(Q.targets.length===0||Q.recursive))return st("powershell.remove-item-pipeline-dynamic-target",JR);for(let le of Q.targets)if(!cr(le.text)&&Ti(Oi(le.text)))return st(Q.recursive&&Q.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Jf);for(let le of Q.targets)if(v.resolvedCwd&&Qr(Oi(le.text),v.resolvedCwd,v.protectedGitMetadata,Q.recursive,v.environment,v.budget,!0))return st("powershell.remove-item-git-metadata",y);if(!Q.recursive||!Q.force)return null;if(dn(W,"powershell.remove-item-recursive-force-dynamic-target",v.strict)&&(Q.hasDynamicTarget||Q.targets.length===0))return st("powershell.remove-item-recursive-force-dynamic-target",Qf);for(let le of Q.targets){let ue=Do(Oi(le.text),v,W,ew);if(ue)return ue}return null}function nw(n){let u=[],v=!1,W=!1,z=!1,B=!1,X=!1;for(let Q=0;Q<n.length;Q++){let le=n[Q];if(!le||le.kind!=="word")continue;if(ow(le))continue;if(X){u.push(yc(le)),B=B||le.dynamic;continue}if(le.text==="--"){X=!0;continue}let ue=sw(le.text);if(!ue){u.push(yc(le)),B=B||le.dynamic;continue}if(aw(ue.name)){let be=ue.value?iw(ue.value,le):n[++Q];if(be?.kind==="word"){u.push(yc(be)),B=B||be.dynamic;continue}B=!0;continue}if(lw(ue.name)){v=!0;continue}if(cw(ue.name)){W=!0;continue}if(dw(ue.name))z=uw(ue.value)}return{targets:u,recursive:v,force:W,whatIfProtected:z,hasDynamicTarget:B}}function rw(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function yc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function ow(n){return n.kind==="word"&&n.text===","}function Oi(n){let u=n.replace(/\\/g,"/"),v=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return v?`$HOME${u.slice(v[0].length)}`:u}function iw(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function sw(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),v=u.indexOf(":");if(v===-1)return{name:u.toLowerCase()};return{name:u.slice(0,v).toLowerCase(),value:u.slice(v+1)}}function aw(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function lw(n){return"recurse".startsWith(n)}function cw(n){return n.length>=2&&"force".startsWith(n)}function dw(n){return n==="wi"||"whatif".startsWith(n)}function uw(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function mw(n){return n.toLowerCase()}import{sep as OP}from"node:path";var fw=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),pw=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),gw=new Set(["-o","--output","--query","--subscription"]),hw=new Set;function tp(n){if(n==="aws")return fw;if(n==="gcloud")return pw;if(n==="az")return gw;return hw}var yw=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Sw=new Set;function np(n){if(n==="git")return Dn;if(n==="docker")return yw;return Sw}function F(n,u){if(n.length===0||u.length===0)return null;let v=$t(n[0]??""),W=xn(n);for(let z of u){if(!Ew(v,z.command))continue;if(z.match){if(bw(v,n,z.match))return rp(z);continue}if(!vw(v,n,z.subcommand))continue;if(ww(n,new Set(z.block_args),W))return rp(z)}return null}function rp(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function bw(n,u,v){let W=u.slice(1);if(v.exclude_args?.some((z)=>W.includes(z)))return!1;if(v.any_args&&!v.any_args.some((z)=>W.includes(z)))return!1;return Cw(W,v.command_path,tp(n))}function Cw(n,u,v){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&v.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function Ew(n,u){return n===$t(u)}function vw(n,u,v){if(!v)return!0;return op(u,1,v,np(n))}function op(n,u,v,W){let z=!1;for(let B=u;B<n.length;B++){let X=n[B];if(!X)continue;if(z){z=!1;continue}if(X==="--"){let Q=n[B+1];if(Q&&!Q.startsWith("-"))return Q===v;return!1}if(W.has(X)){z=!0;continue}if(X.startsWith("-")){if(!X.includes("=")&&Rw(n,B,v,W))return!0;continue}return X===v}return!1}function Rw(n,u,v,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return op(n,u+2,v,W)}function ww(n,u,v){return n.some((W)=>u.has(W))||[...v].some((W)=>u.has(W))}var _w=new Set(["-e","--source"]),xw=new Set(["-F","-v","--assign","--field-separator"]),ip=new Set(["-f","--file"]),Aw=new Set(["print","printf","return"]),sp=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Pw="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function ap(n,u,v){let W=!1;for(let z of Tw(n)){let B=Iw(z,v);if(!B)continue;for(let X of B.commands){let Q=u(X);if(Q)return Q;if(X.includes("{}")||/[$`]/.test(X))W=!0}W||=B.dynamic}return W?st("awk.system-dynamic",Pw):null}function bc(n){let u=[],v=!1,W=!1,z=!0,B=!0;for(let X=1;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(z&&Q==="--"){z=!1;continue}if(z&&_w.has(Q)){v=!0;let le=n[X+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:X+1,kind:"inline-code",value:le});X++;continue}if(z&&Q.startsWith("--source=")){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(9)});continue}if(z&&Q.startsWith("-e")&&Q.length>2){v=!0,u.push({tokenIndex:X,kind:"inline-code",value:Q.slice(2)});continue}if(z&&(xw.has(Q)||ip.has(Q))){let le=n[X+1];if(B&&=le!==void 0,ip.has(Q)){if(W=!0,le!==void 0)u.push({tokenIndex:X+1,kind:"program-file",value:le})}X++;continue}if(z&&(Q.startsWith("-F")||Q.startsWith("-v")&&Q.slice(2).includes("=")))continue;if(z&&Q.startsWith("-f")&&Q.length>2){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(2)});continue}if(z&&(Q.startsWith("--assign=")||Q.startsWith("--field-separator=")))continue;if(z&&Q.startsWith("--file=")){W=!0,u.push({tokenIndex:X,kind:"program-file",value:Q.slice(7)});continue}if(z&&Q.startsWith("-")&&Q!=="-")continue;if(!v&&!W)u.push({tokenIndex:X,kind:"main-program",value:Q});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function Di(n){return bc(n).sources}function Tw(n){return Di(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function Iw(n,u){Pn(u,n);let v=n.includes("system")?Cc(n,u):null,W=kw(n,u);if(!v&&!W)return null;return{dynamic:!!v?.dynamic||!!W?.dynamic,commands:[...v?.commands??[],...W?.commands??[]]}}function Cc(n,u){Pn(u,n);let v=[],W=!1,z=!1,B=0;while(B<n.length){let X=n[B];if(X==='"'||X==="'"){B=oa(n,B,X)?.endIndex??B+1;continue}if(X==="#"){B=lp(n,B+1);continue}if(X==="/"&&cp(n,B)){B=dp(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let Q=B;if(B+=6,Mi(n[Q-1])||Mi(n[B]))continue;let le=ra(n,B);if(n[le]!=="(")continue;le=ra(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let be=oa(n,le,ue);if(!be){W=!0,z=!0;continue}if(le=ra(n,be.endIndex),W=!0,n[le]!==")"){z=!0,B=be.endIndex;continue}v.push(be.value),B=le+1}if(!W)return null;return{dynamic:z,commands:v}}function kw(n,u){Pn(u,n);let v=[],W=!1,z=!1,B=0,X=0,Q=null,le=null,ue=0;while(B<n.length){let be=n[B];if(!be)break;if(be==='"'||be==="'"){let Me=oa(n,B,be);if(Me&&ue===X)le={...Me,startIndex:B};ue=Me?.endIndex??B+1,B=Me?.endIndex??B+1;continue}if(be==="#"){B=lp(n,B+1),X=B,Q=null,le=null,ue=B;continue}if(be==="/"&&cp(n,B)){let Me=dp(n,B+1);ue=Me??B+1,B=Me??B+1;continue}if(`;
+{}`.includes(be)){B++,X=B,Q=null,le=null,ue=B;continue}if(Q===null&&(Sc(n,B,"print")||Sc(n,B,"printf")))Q=B;if(be!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(be))ue=B+1;B++;continue}let Oe=n[B+1]==="&"?B+2:B+1,De=ra(n,Oe);if(Sc(n,De,"getline")){z=!0;let Me=Dw(X,le,ue);if(W||=Me===null,Me!==null)v.push(Me);ue=Oe,B=Oe;continue}if(Lw(X,Q)){z=!0;let Me=Mw(n,De);if(!Me){W=!0,ue=Oe,B=Oe;continue}if(!Ow(n,Me.endIndex)){W=!0,ue=Me.endIndex,B=Me.endIndex;continue}v.push(Me.value),ue=Me.endIndex,B=Me.endIndex;continue}ue=Oe,B++}if(!z)return null;return{dynamic:W,commands:v}}function Mi(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function ra(n,u){let v=u;while(/\s/.test(n[v]??""))v++;return v}function Ow(n,u){let v=u;while(/[\t\f\v\r ]/.test(n[v]??""))v++;let W=n[v];return!W||`;
+}#`.includes(W)}function oa(n,u,v){let W="",z=!1;for(let B=u+1;B<n.length;B++){let X=n[B];if(!X)break;if(z){let Q=Nw(n,B);if(!Q)return null;W+=Q.value,B=Q.endIndex,z=!1;continue}if(X==="\\"){z=!0;continue}if(X===v)return{value:W,endIndex:B+1};W+=X}return null}function Mw(n,u){let v=n[u];if(v!=='"'&&v!=="'")return null;return oa(n,u,v)}function Dw(n,u,v){if(!u)return null;return u.startIndex>=n&&u.endIndex===v?u.value:null}function Nw(n,u){let v=n[u];if(!v)return null;if(v==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(v)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[v]??v,endIndex:u}}function Sc(n,u,v){return n.startsWith(v,u)&&!Mi(n[u-1])&&!Mi(n[u+v.length])}function Lw(n,u){return u!==null&&u>=n}function lp(n,u){let v=n.indexOf(`
+`,u);return v===-1?n.length:v+1}function cp(n,u){let v=Ww(n,u);if(v===-1)return!0;if("{([,;!~=".includes(n[v]??""))return!0;let W=v;while(Mi(n[W-1]))W--;return Aw.has(n.slice(W,v+1))}function Ww(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function dp(n,u){let v=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="/")return W+1}return null}var Fw=new Set(["sudo","env","command","builtin"]),up=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function mp(n){return up.has(n)}function ia(n,u){let v=n[0];if(!v||!fp(Wt(v),u))return null;let W=Wt(v),z=n[1]==="--"?2:1,B=Gw(n,z,W,u),X=B[0];if(X===void 0)return null;return{wrapper:W,tokens:n.slice(X),childIndex:X,alternativeChildIndices:B.slice(1)}}function Gw(n,u,v,W){let z=n[1]==="--",B=[];for(let X=u;X<n.length;X++){let Q=n[X];if(!Q)continue;let le=Wt(Q)!==v&&zw(Q,W);if(le)B.push(X);if(!le&&ds.has($t(Q)))break;if(z)break}return B}function zw(n,u){let v=Wt(n),W=$t(n);return W==="git"||W==="unshare"||v==="busybox"||to(n)||cl.has(v)||Xm(W)||us.has(W)||fp(v,u)||tn.has(W)||n==="$SHELL"||Nn(W)||$n.has(W)||u.rules.some((z)=>z.command===v)}function fp(n,u){return up.has(n)||u.transparentWrappers.includes(n)}function to(n){return Fw.has(n.toLowerCase())}function no(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function Zn(n,u){let v=u.policy??{rules:[],transparentWrappers:[]};return sa([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),v,{iterations:0},!1)}function*sa(n,u,v,W,z,B,X,Q,le){let ue=Yr(n,u,v,B);for(let[Me,Ne]of ue.envAssignments)B.set(Me,Ne),z.set(Me,Ne);let{tokens:be,cwd:Oe}=ue;if(ue.envSplitValues){let Me=Kr(ue.envSplitValues,be);if(!Me)throw new a("derivedCommandShape");Ec(Q),yield*sa(Me,u,Oe,W,z,B,X,Q,le);return}if(to(be[0]??""))throw new a("wrapperPeelIterations");let De=ia(be,X);if(De){for(let Me of[De.childIndex,...De.alternativeChildIndices])Ec(Q),yield*sa(Me===De.childIndex?De.tokens:be.slice(Me),u,Oe,W,new Map(z),new Map(B),X,Q,!0);return}if(Bw(be)){Ec(Q),yield*sa(be.slice(1),u,Oe,W,z,B,X,Q,le);return}yield $w(be,Oe,W,z,B,le)}function $w(n,u,v,W,z,B){return{tokens:n,cwd:u===null?void 0:u??v,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:Wt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function Ec(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Bw(n){return Wt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function vc(n,u){let v=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;v.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:v}}function yr(n){let u=!1,v=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||Rc(W,"recursive")){u=!0;continue}if(W==="-f"||Rc(W,"force")){v=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))v=!0}}return u&&v}function aa(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((v)=>Rc(v,"recursive")||/^-[A-Za-z]+$/.test(v)&&/[rR]/.test(v.slice(1)))}function Rc(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var Uw=["--init-file","--rcfile"],Hw=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Hn(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v)continue;if(v==="-c")return gp(n,u,!0);if(v.startsWith("-")&&v.includes("c")&&!v.startsWith("--")){let W=gp(n,u,!1);if(W!==null)return W}}return null}var pp=/^-[cn]+$/;function Xn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!pp.test(W)))return!1;let v=u.findIndex((W)=>!pp.test(W));return u.slice(0,v===-1?void 0:v).some((W)=>W.includes("n"))}var jw=/^-[abcefhiklmnprstuvx]+$/;function la(n){let u=n.findIndex((B,X)=>X>0&&!jw.test(B)),v=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(v.some((B)=>B.startsWith("+")))return!0;let W=v.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=Hn(n);if(z===null)return v.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function gp(n,u,v){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!v&&W.startsWith("-"))return null;return W}function hp(n){let u=Wt(n[0]??"").toLowerCase(),v=Vw(n,u),W=Hw.get(u)??null,z=v.argvSource?.kind!=="absent";return{argvSource:u==="bash"?v.argvSource:null,argvSourceApplies:u==="bash"&&v.interactive&&v.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!v.interactive:W==="ENV"&&v.interactive)}}function Vw(n,u){let v=An(n),W=v.commandIndex??v.scriptIndex??n.length,z=[],B=!1,X=!0;for(let Q=1;Q<W;Q++){let le=n[Q];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&X?Uw.find((De)=>le===De):void 0){let De=n[Q+1];z.push(De===void 0?{kind:"absent"}:{kind:"literal",value:De}),Q++;continue}let Oe=le.split("=",1)[0]??le;if(u==="bash"&&al.has(Oe)&&!le.includes("="))Q++;continue}if(u==="bash")X=!1;let ue=ll(u,le,n[Q+1],"startup");if(ue.interactive)B=le[0]==="-";Q+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var qw="find -delete permanently removes files. Use -print first to preview.",Kw="find -exec rm -rf is dangerous. Use explicit file list instead.",Yw=new Set(["-exec","-execdir","-ok","-okdir"]),Zw=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function yp(n,u){let v=n.map(t),W=Xw(n,v,u);if(W)return W;if(ca(v,1)&&!r_(n,v,u)){let X=Ft(st("find.delete",qw),u.policy);if(X)return X}let z=u.budget??_n(),B=0;while(B<v.length){let X=v[B],Q=Sr(X??"");if(Q>0){B+=Q+1;continue}if(!ar(X)){B++;continue}z.charge("derivedTokens",v.length-B-1);let le=Lo(v,B);B=le.nextIndex;let ue=o_(le.tokens,u.environment);if(ue){let Me=Ft(ue,u.policy);if(Me)return Me}let be=X==="-execdir"||X==="-okdir",Oe=u.analyzeTokens?.(le.tokens,be?null:u.cwd)??null,De=Oe?.id.startsWith("custom.")?Oe:Ft(Oe,u.policy);if(De)return De}return null}function Xw(n,u,v){if(!ca(u,1)&&!wc(u,v.environment))return null;let z=Ni(n)??en(["."]),B=Un({...v,allowPaths:v.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let X of z){let Q=eo(X);for(let le of Q.expandedTargets??[t(X)]){let ue=sr(le,B,{targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return st("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!Qw(n,B.protectedGitMetadata,v.environment))return st("find.delete-git-metadata",y)}}if(n_(u)&&B.resolvedCwd&&Ff(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return st("find.delete-git-metadata",y);return null}function Qw(n,u,v){if(!u)return!1;let W=n.map(t),z=[],B=!1,X=Ni(n)?.at(-1),Q=X?n.indexOf(X)+1:1;while(Q<W.length){let le=W[Q]??"";if(ar(le)){let ue=Lo(W,Q),be=Tr([...ue.tokens],v),Oe=aa(be),De=tn.has(Wt(be[0]??"").toLowerCase()),Me=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&be.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(Oe||De||Me||Ne)return!1;B=!0,Q=ue.nextIndex;continue}if(le==="-delete"){B=!0,Q++;continue}if(le==="-name"||le==="-iname"){let ue=n[Q+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(e_(ue.text,le==="-iname"));Q+=2;continue}if(!Jw.has(le))return!1;Q+=1+Sr(le)}return z.length>0&&!zf(u,(le)=>z.every((ue)=>ue.test(le)))}var Jw=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function e_(n,u){let v=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${v}$`,u?"isu":"su")}var t_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function wc(n,u){let v=0;while(v<n.length){if(!ar(n[v])){v++;continue}let W=Lo(n,v),z=Tr([...W.tokens],u),B=Wt(z[0]??"").toLowerCase(),X=tn.has(B)&&t_.test((Hn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||X)&&z.some((le)=>le.includes("{}")))return!0;v=W.nextIndex}return!1}function n_(n){return n.some((u,v)=>{if(!["-name","-iname"].includes(u))return!1;return n[v+1]?.toLowerCase()==="hooks"})}function r_(n,u,v){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=Ni(n);return W!==null&&Qs(W,v)}function Ni(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},v=1;while(u(v)==="-H"||u(v)==="-P")v++;if(u(v)==="--")v++;let W=[];while(v<n.length){let z=u(v),B=n[v];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),v++}return W.length>0?W:null}function o_(n,u){let v=rr([...n],u);if(v.length===0)return null;let W=Wt(v[0]??"");if(W==="busybox"&&v.length>1)v=v.slice(1),W=Wt(v[0]??"");if(W==="rm"&&yr(v))return st("find.exec-rm-recursive-force",Kw);return null}function Lo(n,u){let v=u+1;while(v<n.length&&n[v]!==";"&&!(n[v]==="+"&&n[v-1]==="{}"))v++;return{tokens:n.slice(u+1,v),nextIndex:Math.min(v+1,n.length)}}function ca(n,u){let v=u;while(v<n.length){let W=n[v];if(!W){v++;continue}if(ar(W)){v=Lo(n,v).nextIndex;continue}let z=Sr(W);if(z>0){v+=z+1;continue}if(W==="-delete")return!0;v++}return!1}function Sr(n){return Zw.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function ar(n){return n!==void 0&&Yw.has(n)}import{resolve as Nx}from"node:path";function*_c(n){for(let u of n.nodes)yield*i_(u)}function xc(n){return[..._c(n)]}function Mt(n){return xc(n).map((u)=>u.words.map((v)=>v.text))}function Li(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let v=u.nodes[0];if(v?.kind!=="command")return null;if(v.redirections.length>0||v.nested.length>0)return null;if(v.words.some((W)=>W.provenance==="command-substitution"))return null;return v.words.map((W)=>W.text)}function*i_(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*_c(u);return}if(n.kind==="group")yield*_c(n.body)}var s_=5,Ac="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function gn(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function bp(n,u,v){let W=Wo(n,u,v),z=a_(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,X=!1;for(let Q=0;Q<s_;Q++){let{subcommand:le,rest:ue}=Wn(B),be=le?.toLowerCase();if(!be||!z.has(be))return{blockedReason:W.blockedReason,expanded:X,tokens:B};let Oe=z.get(be),De=m_(Oe);if(De===null||De.length===0)return{blockedReason:Ac,expanded:!0,tokens:B};B=["git",...De,...ue],X=!0}return{blockedReason:Ac,expanded:!0,tokens:B}}function Cp(n,u,v){return Wo(n,u,v).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function Wn(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?Wt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=Dn.has(z)?2:1}return{subcommand:null,rest:[]}}function a_(n){let u=new Map;for(let v of n){let W=v.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,v.value)}return u}function Wo(n,u,v){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?Wt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=c_(u,v);return{blockedReason:B.blockedReason,entries:[...B.entries,...l_(n,u,v)]}}function l_(n,u,v){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let X=Pc(n[z+1]);if(X)W.push(X);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let X=Pc(B.slice(2));if(X)W.push(X);z++;continue}if(B==="--config-env"){let X=Sp(n[z+1],u,v);if(X)W.push(X);z+=2;continue}if(B.startsWith("--config-env=")){let X=Sp(B.slice(13),u,v);if(X)W.push(X);z++;continue}if(Dn.has(B)){z+=2;continue}z++}return W}function c_(n,u){let v=d_(n,u),W=u_(n,u);return{blockedReason:v===null||W===null?Ac:null,entries:[...v??[],...W??[]]}}function d_(n,u){let v=fr("GIT_CONFIG_PARAMETERS",n,u);if(v===void 0)return[];let W=[],z=Li(v);if(!z)return null;for(let B of z){let X=Pc(B);if(!X)return null;W.push(X)}return W}function u_(n,u){let v=mf(n,u);if(v.state==="absent")return[];if(v.state==="invalid")return null;let W=[];for(let z=0;z<v.count;z++){let B=fr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),X=fr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||X===void 0)return null;W.push({key:B,value:X})}return W}function Pc(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function Sp(n,u,v){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:fr(n.slice(W+1),u,v)}}function m_(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return Li(u)}var f_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",p_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",g_="git checkout --force discards uncommitted changes. Use 'git stash' first.",h_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",y_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",S_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",b_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",C_="git switch --force discards uncommitted changes. Use 'git stash' first.",E_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",v_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",R_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",w_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",__="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",x_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",A_="git push --force destroys remote history. Use --force-with-lease for safer force push.",P_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",T_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",I_="git branch -D force-deletes without merge check. Use -d for safe delete.",k_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",O_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",M_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",D_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",N_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",L_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",W_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",F_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),G_=new Set(["--recurse-submodules","--track","-t"]),Tc=new Set(["-b","-B","-U"]),Ic=new Set(["-c","-C"]),z_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ut(n,u){let v=n.split("=",1)[0]??n;return v.length>=4&&u.startsWith(v)&&v.startsWith("--")&&v.slice(2).length>=2}var Fo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function vp(n,u){let{subcommand:v,rest:W}=Wn(n);if(!v)return null;switch(v.toLowerCase()){case"checkout":return kr($_(W,u));case"switch":return kr(U_(W));case"restore":return kr(j_(W));case"reset":return q_(W);case"clean":return kr(Y_(W));case"rm":return kr(Z_(W));case"push":return ro(X_(W));case"branch":return ro(ex(W));case"stash":return ro(ix(W));case"worktree":return ro(sx(W));case"rebase":return kr(tx(W));case"merge":return kr(nx(W));case"tag":return ro(rx(W));case"reflog":return ro(ox(W));default:return null}}function kr(n){return n?{...n,localDiscard:!0}:null}function ro(n){return n?{...n,localDiscard:!1}:null}function $_(n,u){let{index:v,before:W}=gn(n),z=xn(W,{shortOptsWithValue:Tc});if(W.some((Q)=>Ut(Q,"--force"))||z.has("-f"))return st("git.checkout-force",g_);for(let Q of n){if(Q==="-b"||Q==="-B"||Q==="--orphan")return null;if(Ut(Q,"--pathspec-from-file"))return st("git.checkout-pathspec-from-file",y_)}if(v!==-1){if(W.some((le)=>!le.startsWith("-")))return st("git.checkout-ref-path",h_);return st("git.checkout-double-dash",f_)}let B=H_(n);if(B.length>=2)return st("git.checkout-ambiguous",S_);let X=B[0];if(X===void 0||z.has("-d")||z.has("-t")||n.some((Q)=>Ut(Q,"--detach")||Ut(Q,"--track")))return null;if(B_(X)||u(X))return st("git.checkout-double-dash",p_);return null}function B_(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function U_(n){let{before:u}=gn(n);if(u.some((W)=>Ut(W,"--discard-changes")))return st("git.switch-discard-changes",b_);let v=xn(u,{shortOptsWithValue:Ic});if(u.some((W)=>Ut(W,"--force"))||v.has("-f"))return st("git.switch-force",C_);return null}function H_(n){let u=[],v=0;while(v<n.length){let W=n[v];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),v++;continue}if(F_.has(W)){v+=2;continue}if(G_.has(W)){let z=n[v+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];v+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}v++}return u}function j_(n){let u=V_(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?st("git.restore-worktree",v_):st("git.restore-unstaged",E_)}function V_(n){let u=!1,v=!1,W=!0,z=!1,B=(X)=>{if(!z)W=!1,z=!0;if(X!==void 0)W=X};for(let X=0;X<n.length;X++){let Q=n[X];if(Q===void 0)break;if(Q==="--"){u||=X+1<n.length;break}if(Q==="--pathspec-from-file"){u=!0,X++;continue}if(Q.startsWith("--pathspec-from-file=")){u=!0;continue}if(Q==="-h"||Q==="--help"||Q==="--version")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(Q==="--staged"){B();continue}if(Q==="--no-staged"){B();continue}if(Q==="--worktree"){B(!0);continue}if(Q==="--no-worktree"){B(!1);continue}if(Q==="--patch"){v=!0;continue}if(Q==="--no-patch"){v=!1;continue}if(z_.has(Q)){X++;continue}if(Q.startsWith("--"))continue;if(Q==="-"){u=!0;continue}if(!Q.startsWith("-")){u=!0;continue}for(let le=1;le<Q.length;le++){let ue=Q.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){v=!0;continue}if(ue==="s"||ue==="U"){if(le===Q.length-1)X++;break}}}return{hasPathspec:u,hasPatch:v,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function q_(n){let u=null;for(let v of n){if(Ut(v,"--hard")){u=st("git.reset-hard",R_);break}if(Ut(v,"--merge")){u=st("git.reset-merge",w_);break}}if(!u)return null;return K_(n)?ro(u):kr(u)}function K_(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function Y_(n){for(let v of n)if(v==="-n"||Ut(v,"--dry-run"))return null;let u=xn(n.filter((v)=>v!=="--"));if(n.some((v)=>Ut(v,"--force"))||u.has("-f"))return st("git.clean-force",__);return null}function Z_(n){let u=!1,v=!1,W=!1;for(let z of gn(n).before){if(Ut(z,"--no-force")){u=!1;continue}if(Ut(z,"--force")){u=!0;continue}if(Ut(z,"--no-cached")){v=!1;continue}if(Ut(z,"--cached")){v=!0;continue}if(Ut(z,"--no-dry-run")){W=!1;continue}if(Ut(z,"--dry-run")){W=!0;continue}let B=xn([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!v&&!W?st("git.rm-force",x_):null}function X_(n){let{before:u,after:v}=gn(n),W=xn(u);if(u.some((X)=>Ut(X,"--mirror")))return st("git.push-mirror",T_);if(u.some((X)=>Ut(X,"--force"))||W.has("-f")||Ep(u,v).some(Q_))return st("git.push-force",A_);if(u.some((X)=>Ut(X,"--delete"))||W.has("-d")||Ep(u,v).some(J_))return st("git.push-delete",P_);return null}function Ep(n,u){return[...n.filter((v)=>v!==""&&!v.startsWith("-")),...u]}function Q_(n){return n.startsWith("+")||n.includes(":+")}function J_(n){return n.length>1&&n.startsWith(":")}function ex(n){let{before:u}=gn(n),v=xn(u),W=v.has("-D")||v.has("-d")||u.some((B)=>Ut(B,"--delete")),z=v.has("-D")||v.has("-f")||u.some((B)=>Ut(B,"--force"));if(W&&z)return st("git.branch-force-delete",I_);return null}function tx(n){let{before:u}=gn(n);return u.some((v)=>Ut(v,"--abort"))?st("git.rebase-abort",k_):null}function nx(n){let{before:u}=gn(n);return u.some((v)=>Ut(v,"--abort"))?st("git.merge-abort",O_):null}function rx(n){let{before:u}=gn(n);return xn(u).has("-d")||u.some((W)=>Ut(W,"--delete"))?st("git.tag-delete",M_):null}function ox(n){return n[0]==="delete"?st("git.reflog-delete",D_):null}function ix(n){for(let u of n){if(u==="drop")return st("git.stash-drop",N_);if(u==="clear")return st("git.stash-clear",L_)}return null}function sx(n){let{before:u}=gn(n);if(!u.includes("remove"))return null;let W=xn(u);if(u.some((z)=>Ut(z,"--force"))||W.has("-f"))return st("git.worktree-remove-force",W_);return null}import{isAbsolute as Ix,join as kx,resolve as Ox}from"node:path";var Oc="TMPDIR",Mc="IFS",wp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,_p=/^[A-Za-z_][A-Za-z0-9_]*$/,xp=new Set(["export","typeset","declare","readonly"]),ax=new Set(["builtin","command","time"]),lx=new Set(["do","then","else"]),cx=new Set(["do","then","case"]),Rp=new Set(["done","fi","esac"]),dx=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,ux=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Go(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function zo(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function Ap(n,u,v){let W=Go(u.shellAssignments,v);return n.map((z)=>{if(!Dp(z.text))return t(z);if(z.provenance==="variable")return Pp(z.text,W);if(z.provenance==="command-substitution")return fx(z,v.darwinUserTempDir)??t(z);return z.provenance==="literal"&&dx.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function Pp(n,u){return n.replace(ux,(v,W,z)=>u.get(W??z??"")??v)}var mx=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function fx(n,u){if(n.provenance!=="command-substitution")return null;let v=n.parts.map((z)=>{if(z.provenance==="command-substitution")return mx.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!v.every((z)=>z!==null))return null;let W=v.join("");return/[\s$`*?[]/.test(W)?null:W}function Qn(n,u){let v=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!v)return null;let W=Pp(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function Tp(n,u){return{env:n,effectiveEnvAssignments:yx(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Ip(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function Dc(n,u){let v=Op(n,u),W=n[0]??"";if(cx.has(W))u.bodyDepth+=1;if(W==="elif"||Rp.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(Rp.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((Q)=>{u.shellAssignments.delete(Q)}),u.bodyAssignments.clear();v.assignments.filter((Q)=>Q.persists).forEach((Q)=>{if(u.shellAssignments.set(Q.name,Q.value),u.bodyDepth>0)u.bodyAssignments.add(Q.name);Nc(u,Q)});let z=v.commandIndex;if(z!==-1&&xp.has(n[z]??""))n.filter((Q)=>_p.test(Q)&&kc(Q)).forEach((Q)=>{Sx(u,Q)});let B=z===-1?-1:Mp(n,z);if(B===-1||n[B]!=="unset")return;let X=Cx(n,B);if(X===null)return;n.slice(X).forEach((Q)=>{if(u.bodyDepth>0){u.shellAssignments.set(Q,"");return}bx(u,Q)})}function kp(n,u){let v=Op(n,u).assignments;if(v.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return v.forEach((z)=>{W.set(z.name,z.value)}),W}function Op(n,u){let v=lx.has(n[0]??"")?1:0,W=n.findIndex((Q,le)=>le>=v&&!Dp(Q)),z=W!==-1&&xp.has(n[Mp(n,W)]??""),B=hx(u);return{assignments:n.flatMap((Q,le)=>{let ue=px(Q,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!Gs(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function Mp(n,u){let v=u;while(ax.has(n[v]??"")){v+=1;while(n[v]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[v]??""))return u;v+=1}}return v}function Dp(n){return Tn(n)!==null||wp.test(n)}function px(n,u,v){return Tn(n)??gx(n,u,v)}function gx(n,u,v){let W=zs(n,v,u);if(W)return W;let z=n.match(wp)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):v.get(z)??""}${n.slice(B+1)}`}}function kc(n){return n===Oc||n===Mc||tc(n)}function hx(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function yx(n,u){let v=[Oc,Mc].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(v.length===0)return u;return new Map([...v,...u??[]])}function Nc(n,u){let v=new Map(n.effectiveEnvAssignments??[]);v.set(u.name,u.value),n.effectiveEnvAssignments=v}function Sx(n,u){Nc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function bx(n,u){if(!kc(u)&&!_p.test(u))return;if(n.shellAssignments.set(u,""),Gs(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!kc(u)||u===Oc||u===Mc||ri(u)){Nc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let v=new Map(n.effectiveEnvAssignments);v.delete(u),n.effectiveEnvAssignments=v.size===0?void 0:v}function Cx(n,u){let v=u+1;while(v<n.length){let W=n[v];if(!W)return null;if(W==="--")return v+1;if(W==="-v"){v++;continue}if(W.startsWith("-"))return null;return v}return v}import{dirname as Lp,join as da,resolve as Ex}from"node:path";function ua(n,u){return ec.some((v)=>u?.has(v)||n.has(v))}function $o(n,u,v){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=v.realpath(Ex(u));if(W===null||!v.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,X=1;while(X<n.length){let Q=n[X];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-"))break;if(Q==="-C"){let le=n[X+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=Np(z,le,v);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,X+=2;continue}if(Q.startsWith("-C")&&Q.length>2){let le=Np(z,Q.slice(2),v);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,X++;continue}if(Q==="--git-dir"||Q==="--work-tree"){B=!0,X+=2;continue}if(Q.startsWith("--git-dir=")||Q.startsWith("--work-tree=")){B=!0,X++;continue}X+=Dn.has(Q)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function Np(n,u,v){try{let W=Pr(n,u,v);return v.isDirectory(W)?W:null}catch{return null}}function Wi(n,u){if(u.entryKind(da(n,".git"))!=="missing")return n;let v=Lp(n);return v===n?null:Wi(v,u)}function ma(n,u,v,W,z){let B=W.paths,X=da(v,".git"),Q=B.isDirectory(X),le=Q&&!W.isGitDirectory(X),ue=Wp(u).filter((be)=>le||be!==v&&Ar(be,v));return Wo(n,W.env,z).entries.some((be)=>be.key.toLowerCase()==="core.worktree")||ue.some((be)=>B.entryKind(da(be,"HEAD"))!=="missing"||be!==v&&B.entryKind(da(be,".git"))!=="missing")||Q&&W.gitDirectoryRedirects(X)}function Wp(n){let u=Lp(n);return u===n?[n]:[n,...Wp(u)]}function Fp(n,u,v){if(!u.localDiscard||!v.worktreeMode||ua(v.environment.env,v.envAssignments))return null;let W=$o(n,v.cwd,v.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=v.environment.worktreeFacts(W.gitCwd),B=Wi(W.gitCwd,v.environment.paths);if(!z||B===null||ma(n,W.gitCwd,B,v.environment,v.envAssignments))return null;if(Lc(n,v,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Lc(n,u,v){let{subcommand:W,rest:z}=Wn(n),B=W?.toLowerCase();if(u.dynamicArguments||vx(z)||Ax(n,u.environment.env,u.envAssignments,v)||_x(z)||Rx(B,z))return!0;return B==="clean"&&xx(z)>1}function vx(n){return n.some((u)=>/[$*?[]/.test(u))}function Rx(n,u){if(n==="checkout"){let{before:v}=gn(u),W=xn(v,{shortOptsWithValue:Tc}),z=v.some((X)=>Ut(X,"--force"))||W.has("-f"),B=W.has("-B")||v.some((X)=>X==="-B"||X.startsWith("-B"));return z&&B}if(n==="switch"){let{before:v}=gn(u),W=xn(v,{shortOptsWithValue:Ic}),z=v.some((X)=>Ut(X,"--force"))||v.some((X)=>Ut(X,"--discard-changes"))||W.has("-f"),B=v.some((X)=>X==="-C"||X.startsWith("-C")||wx(X))||W.has("-C");return z&&B}return!1}function wx(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function _x(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function xx(n){let u=0;for(let v of n){if(v==="--force"){u++;continue}if(v.startsWith("-")&&!v.startsWith("--")){for(let W of v.slice(1))if(W==="f")u++}}return u}function Ax(n,u,v,W){if(fr("GIT_CONFIG_PARAMETERS",u,v)!==void 0)return!0;let z=Wo(n,u,v);if(z.blockedReason!==null)return!0;let B=z.entries.map((Q)=>({key:Q.key.toLowerCase(),value:Q.value}));if(B.some((Q)=>Tx(Q.key)))return!0;let X=B.filter((Q)=>Q.key==="submodule.recurse").at(-1);if(X)return X.value===void 0||Px(X.value);if(pf(v))return!0;return W.recursiveSubmodules}function Px(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Tx(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function Gp(n,u,v){let W=n.map((le)=>Qn(le,v.shellAssignments??new Map)??t(le)),z=v.environment.paths,B=$o(W,v.cwd,z),X=v.originalCwd?z.realpath(Ox(v.originalCwd)):null;if(u.id.startsWith("git.push-")||X===null||B.gitCwd===null||B.hasExplicitGitContext||ua(v.environment.env,v.envAssignments))return null;let Q=u.id==="git.worktree-remove-force"?Dx(n,v.shellAssignments,z):Wi(B.gitCwd,z);if(Q===null||u.id!=="git.worktree-remove-force"&&!Mx(Q,B.gitCwd,W,u,v)||!To(Q,v.environment)||Fs(Q,v.environment)||Ar(X,Q)||Ar(Q,X))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function Mx(n,u,v,W,z){let B=z.environment.paths,X=kx(n,".git");if(B.entryKind(X)!=="present"||ma(v,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(X))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Lc(v,z,le)}function Dx(n,u,v){let W=Wn(n.map(t)).rest,{before:z,after:B}=gn(W.slice(W.indexOf("remove")+1)),X=[...z.filter((be)=>!be.startsWith("-")),...B],Q=X.length===1?X[0]??"":"",le=n.find((be)=>be.text===Q),ue=(le&&Qn(le,u??new Map))??Q;if(!Ix(ue)||/[\s$`*?[]/.test(ue)||v.entryKind(ue)!=="present"||!v.isDirectory(ue))return null;return v.realpath(ue)}var Lx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Wx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function fa(n,u){return zp(n,u)}function zp(n,u,v){let W=n.map(t),z=bp(W,u.environment.env,u.envAssignments),B=z.blockedReason?Ft(st("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let X=z.tokens;if((ff(u.envAssignments)||Cp(W,u.environment.env,u.envAssignments))&&Fx(X))return st("git.ssh-env",Lx);let Q=vp(X,(ue)=>{let be=$o(W,u.cwd,u.environment.paths).gitCwd;return be!==null&&u.environment.paths.entryKind(Nx(be,ue))!=="missing"});if(!Q)return null;if(z.expanded||z.blockedReason)return Q;let le=Fp(W,Q,u)??Gp(n,Q,u);if(!le)return Q;return v?.(le),null}function $p(n,u){let v=null;return{match:zp(n,u,(z)=>{v=z}),relaxation:v}}function Fx(n){let{subcommand:u,rest:v}=Wn(n),W=u?.toLowerCase();if(!W)return!1;if(Wx.has(W))return!0;if(W==="archive")return gn(v).before.some((z)=>Ut(z,"--remote"));return W==="remote"&&Gx(v)}function Gx(n){return n.find((u)=>!zx(u))?.toLowerCase()==="update"}function zx(n){return n==="-v"||Ut(n,"--verbose")||Ut(n,"--no-verbose")}import{isAbsolute as hA}from"node:path";function Bp(n,u,v,W){let z=n.slice(0,u),B=n.slice(u+v);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function pa(n,u,v){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>v(B).some((X)=>!z.has(W(X))))}var Up="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$x="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Bx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Ux="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Hx="rm -rf in home directory is dangerous. Change to a project directory first.",Hp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Ux},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Bx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Hx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Up},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:$x},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Up}};function ga(n,u){let v=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=aa(W),B=jx(n);for(let X of B){let Q=eo(X.word);if(z&&Q.unsafeBraceExpansion){let le=Ft(dc({kind:"outside_anchored_cwd"},v,u.policy,Hp),u.policy);if(le)return le;continue}for(let le of Q.expandedTargets??[X.text]){let ue=Sn(le),be={targetIsLiteral:Q.expandedTargets!==void 0||Q.targetIsLiteral,tmpdirWordSplittingProtected:Q.tmpdirWordSplittingProtected};if(!z&&v.resolvedCwd&&Qr(ue,v.resolvedCwd,v.protectedGitMetadata,z,v.environment,v.budget))return st("rm.git-metadata",y);if(!z)continue;let Oe=Do(ue,v,u.policy,Hp,be);if(Oe)return Oe}}return null}function jx(n){let u=[],v=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){v=!0;continue}if(v){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Or={kind:"none"},oo={kind:"dynamic"},Vp=new Set(["<","<<","<<-","<<<","<&","<>"]),qp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Vx=/^(?:[0-9]+|[@*])$/,qx=_r.maxWords,Kp=_r.maxInputLength;function Yp(n){if(!n||Wt($t(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),v=u[0]?.text;if(v===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(v==="%s")return W.join("");if(v==="%s\\n"||v===`%s
+`)return`${W.join(`
+`)}
+`;if(v.includes("%")||/\\(?![\\nrt])/.test(v))return;return v.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ya(n){let u=Bo(n[1])==="--"?2:1;if(n.length<=u)return Or;let v=n.slice(u);if(!v.every(zi))return oo;return{kind:"literal",source:v.map(t).join(" ")}}function Zp(n){let u=Bo(n[1])==="--"?2:1,v=n[u],W=Bo(v);if(v===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Or;if(!zi(v))return oo;return{kind:"literal",source:W}}function Sa(n,u){let v=tg(n);if(v===-1)return Or;let W=Xx(u);if(!W)return Or;let z=[],B=W.command?.length??0;for(let X of W.references){let Q=Jx(X,n,v,W.ifs);if(!Q)return oo;if(B+=Q.reduce((le,ue)=>le+ue.length+3,0),z.length+Q.length>qx||B>Kp)return oo;z.push(...Q)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ie)].filter((X)=>X!==null).join(" ")}}function Xp(n,u){let v=tg(n),W=n.slice(v+1),z=/\bIFS\b/.test(u);if(v===-1||!W.every(zi)||z)return u;let B=W.map(Bo),X="",Q=null,le=0;while(le<u.length){let ue=u[le]??"",be=Q==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(be){let Oe=be[1]??be[2],De=Oe==="@"||Oe==="*"?B.slice(1):[B[Number(Oe)]??""];if(Q!=='"'&&De.some((Ne)=>/[*?[]/.test(Ne)))return u;if(X+=Q==='"'?De.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(Oe==="@"?'" "':" "):De.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ie(Le):"").join(" ")).join(" "),X.length>Kp)return u;le+=be[0].length;continue}if(ue==="\\"&&Q!=="'"){X+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&Q!=='"'||ue==='"'&&Q!=="'")Q=Q?null:ue;X+=ue,le++}return X}function Uo(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function Qp(n,u,v,W){if(!An(n.map(t)).readsStdinAsCommands)return Or;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&Vp.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return z.heredoc&&Uo(z.heredoc)?{kind:"literal",source:z.heredoc.body}:Or;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return oo;return{kind:"literal",source:z.target.text}}if(!v)return Or;return W===void 0?oo:{kind:"literal",source:W}}function Jp(n){return n.some((u)=>(u.fd===void 0||u.fd===0)&&Vp.has(u.operator)&&u.operator!=="<&"&&(u.heredoc!==void 0?Uo(u.heredoc):u.target?.provenance==="literal"&&!Kx.has(u.target.text)))}function br(n,u,v=new Map){let W=An(n.map(t)).scriptIndex;if(W===null)return Or;let z=n[W],B=z&&u!==void 0?zo(z,u):null;if(B!==null)return{kind:"literal",source:B};let X=Bo(z);if(_o(z,X))return{kind:"literal",source:X};let Q=z?Qn(z,v):null;return Q===null?oo:{kind:"literal",source:Q}}var Kx=new Set(["/dev/stdin","/dev/fd/0","/proc/self/fd/0"]),eg=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Gi(n,u,v){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(xc).some((W)=>ba(W,v))}var Yx=new Set(["irm","iwr","invoke-restmethod","invoke-webrequest"]);function ha(n,u){let v=$t(n);return eg.has(v)||u==="powershell"&&Yx.has(v)}function ba(n,u){let v=pr(n.words,u).words.map(t),W=v[0];if(W===void 0)return!1;if(ha(W,n.dialect))return!0;return mp($t(W))&&v.slice(1).some((z)=>!Zx(z)&&ha(z,n.dialect))}function Zx(n){return n.includes("/")&&!n.startsWith("/")}function zc(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],v=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!v)return!1;if(!(u.text==="eval"&&v.quoted&&v.parts.length===3&&v.parts[0]?.raw==='"'&&v.parts[1]?.provenance==="command-substitution"&&v.parts[1].raw.startsWith("$(")&&v.parts[2]?.raw==='"'||u.text==="eval"&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!v.quoted&&v.parts.length===1&&v.parts[0]?.provenance==="command-substitution"&&v.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let X=B.words[0]?.text;if(X===void 0||Tn(X)!==null)return!1;let Q=Wt($t(X));return!eg.has(Q)&&!tn.has(Q)&&!to(Q)}function tg(n){return An(n.map(t)).commandIndex??-1}function Xx(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),v=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(v),z=(W?.[3]??v).split(/\s+/).map(Qx);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
+`}}function Qx(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),v=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??v;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function Jx(n,u,v,W){let z=u.slice(v+2);if(n.parameter==="@")return n.quoted?Wc(z):eA(z,W);if(n.parameter==="*"){let Q=Wc(z);if(!Q)return;let le=Q.join(W[0]??"");return n.quoted?[le]:Fc(le,W)}let B=u[v+1+n.parameter];if(B&&!zi(B))return;let X=Bo(B);return n.quoted?[X]:Fc(X,W)}function Wc(n){return n.every(zi)?n.map(t):void 0}function eA(n,u){let v=Wc(n);if(!v)return;let W=v.map((z)=>Fc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Fc(n,u){if(["*","?","[","]"].some((v)=>n.includes(v)))return;if(u==="")return n===""?[]:[n];if(u===` 	
+`)return n.trim().split(/\s+/).filter(Boolean);if(u.length!==1)return;return u===" "||u==="\t"||u===`
+`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function zi(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function Bo(n){return n?t(n):""}function Ie(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function $c(n,u){return Gc(C(n,"posix"),u)}function $i(n){return $c(n,new Set(Array.from(n.matchAll(qp)).flatMap((u)=>{let v=u[1]??u[2];return v===void 0?[]:[v]})))}function Gc(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let v=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(Gc(W.body,v))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>Gc(z,v))||ng(W.words,v))return!0;iA(W,v)}return!1}function ng(n,u){let v=n.findIndex((X)=>Tn(X.text)===null);if(v===-1)return!1;let W=n[v];if(!W)return!1;if(Fi(W,u))return!0;let z=$t(W.text);if(z==="source"||z==="."){let X=n[v+1]?.text==="--"?v+2:v+1;return jp(n[X],u)}if(tn.has(z)){let X=n.slice(v),Q=X.map((be)=>be.text),le=An(Q),ue=le.commandIndex??le.scriptIndex;return!Xn(Q)&&ue!==null&&jp(X[ue],u)}let B=tA(n,v,u);if(B===null)return!1;if(B===-1)return!0;return ng(n.slice(B),u)}function tA(n,u,v){let W=$t(n[u]?.text??"");if(W==="command")return nA(n,u+1);if(W==="exec")return rA(n,u+1);if(W==="env")return oA(n,u+1,v);return null}function nA(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return v}return null}function rA(n,u){for(let v=u;v<n.length;v++){let W=n[v]?.text??"";if(W==="--")return n[v+1]?v+1:null;if(W==="-a"){v++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return v}return null}function oA(n,u,v){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Fi(n[W+1],v)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Fi(z,v)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(Tn(B))continue;return W}return null}function iA(n,u){if(!n.words.every((v)=>Tn(v.text)!==null))return;for(let v of n.words){let W=Tn(v.text);if(!W)continue;if(Fi(v,u))u.add(W.name)}}function Fi(n,u){if(!n)return!1;return n.parts.filter((v)=>v.provenance==="variable").some((v)=>Array.from(v.raw.matchAll(qp)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(Vx.test(z)||u.has(z))}))}function jp(n,u){return!!n&&(n.parts.some((v)=>v.provenance!=="literal"&&v.provenance!=="variable")||Fi(n,u))}var Bc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Uc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",sA="__CC_SAFETY_NET_XARGS_INPUT__",Ca="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ea="rm",aA=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,lA=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,cA=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,dA=/^(?:[0-9]+|[@*])$/;function ig(n,u){let v=n.map(t),{childStart:W,replacementToken:z}=io(v),B=v.slice(W),X=st("xargs.shell-dynamic",Uc);if(mA(B,z,u)&&Ft(X,u.policy))return Ft(X,u.policy);for(let Q of Zn(B,u)){let le=Q.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Ft(X,u.policy):null;if(ue)return ue;let be=ug(le,z,Q.wrapperEnvAssignments),Oe=Q.head==="rm"&&z!==null&&cg(le,z),De=u.analyzeChild(le,{...no(Q,u),dynamicInput:be,dynamicSourceInput:Oe||ag(le,Q.head,z,Q.wrapperEnvAssignments,be,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:Oe,shellDynamicMatch:X,dynamicSourceMatch:X,rmDynamicMatch:st("xargs.rm-recursive-force-dynamic",Bc)});if(De)return De;let Me=uA(le,z,u.policy?.rules??[],Ft(X,u.policy));if(Me)return Me;if(Q.head==="git"){let Le=z===null?[...le,sA]:le,We=z!==null&&(le.some((ze)=>ze.includes(z))||Array.from(Q.envAssignments.values()).some((ze)=>ze.includes(z))),Be=u.analyzeChild(Le,{...no(Q,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(Be)return Be}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function uA(n,u,v,W){if(v.length===0)return null;if(u===null){for(let B of v){let X=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],v);if(X)return X}return null}let z=$t(n[0]??"");if(!v.some((B)=>$t(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function sg(n,u,v){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=Bp(n,W,u.length,v);return z===null?[]:[z]}function ag(n,u,v,W,z,B,X){if(tn.has(u)){if(Xn(n))return!1;if(v!==null&&fA(n,v,X))return!0;let Q=Hn(n);if(!Q){let le=br(en(n));if(le.kind==="literal")return v!==null&&le.source.includes(v);return le.kind==="none"&&z}if(v!==null&&Q.includes(v)&&!lg(Q,v,X))return!0;if(Bn(Q))return!0;return pA(Q,v,W)}if(Nn(u))return rg(n,v,ea,Yf(u));if($n.has(u))return rg(n,v,bc,sp);if(u==="eval"){let Q=ya(en(n));if(Q.kind==="dynamic")return!0;if(v!==null)return Q.kind==="literal"&&Q.source.includes(v);return z}if(u==="find")return gA(n,v,B);if(u==="git"){let Q=Wn(n);return v===null?Q.subcommand===null:(Q.subcommand?.includes(v)??!1)||Q.subcommand!==null&&Fo.has(Q.subcommand.toLowerCase())&&dg(Q.rest,v).some((le)=>le.includes(v))}return!1}function lg(n,u,v){if(v===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Bn(B)===null&&v(B)===null}function rg(n,u,v,W){let z=v(n);if(u===null)return z.optionsOpen||v([...n,Ca]).sources.some((Q)=>Q.value===Ca);if(z.sources.some((Q)=>Q.value.includes(u)))return!0;let B=W.flatMap((Q)=>[Q.selector,...Q.valueForm==="attached-only"||Q.valueForm==="attached-or-separate"?[`${Q.selector}${Ca}`]:[],...Q.valueForm==="equals-or-separate"?[`${Q.selector}=${Ca}`]:[]]),X=new Set(B.flatMap((Q)=>n.flatMap((le)=>sg(le,u,Q))));return pa(z.sources,X,(Q)=>v(n.map((le)=>le.replaceAll(u,Q))).sources)}function mA(n,u,v){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(Zn(n,v),(B)=>B.head)),z=u===null?[...n,Ea]:n.map((B,X)=>X===0?B:B.replaceAll(u,Ea));return Array.from(Zn(z,v)).some((B)=>B.head===Ea&&!W.has(Ea))}function cg(n,u){return dg(n.slice(1),u).some((v)=>v.includes(u)&&(v.startsWith("-")||v.startsWith(u)))}function dg(n,u){let v=n.findIndex((W)=>W==="--"&&!W.includes(u));return v===-1?n:n.slice(0,v)}function ug(n,u,v){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(v.values()).some((W)=>W.includes(u))}function fA(n,u,v){let W=An(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!lg(z,u,v)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((X)=>n.some((Q,le)=>{if(le===0||!Q.includes(u))return!1;return sg(Q,u,X).some((be)=>{let Oe=n.map((Me,Ne)=>Ne===le?Me.replaceAll(u,be):Me),De=An(Oe);if(De.commandIndex===null&&De.scriptIndex===null)return!1;if(W.commandIndex===null&&De.commandIndex!==null)return!0;if(W.scriptIndex===null&&De.scriptIndex!==null)return!0;if(De.commandIndex!==null&&(Oe[De.commandIndex]??"").includes(be))return!0;return De.scriptIndex!==null&&(Oe[De.scriptIndex]??"").includes(be)})}))}function pA(n,u,v){let W=new Set(u===null?[]:Array.from(v).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(aA))if(og(z,W))return!0;for(let z of n.matchAll(lA))for(let B of(z[1]??"").matchAll(cA))if(og(B,W))return!0;return $c(n,W)}function og(n,u){let v=n[1]??n[2];return v!==void 0&&(dA.test(v)||u.has(v))}function gA(n,u,v){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let X=n[B]??"";if(!W&&!X.startsWith("-")&&X!=="!"&&X!=="("){if(X.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(ar(X)){let le=Lo(n,B);B=le.nextIndex-1;for(let ue of Zn(le.tokens,{environment:v,cwd:void 0})){let be=ug(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&cg(ue.tokens,u)||ag(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,be,v))return!0}continue}let Q=Sr(X);if(Q>0){if(z=Q,X.includes(u))return!0;continue}if(X.includes(u))return!0}return!1}function io(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),v=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:v};if(!z.startsWith("-"))return{childStart:W,replacementToken:v};if(z==="-I"){v=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){v=z.slice(2),W++;continue}if(z==="--replace"){v="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);v=B===""?"{}":B,W++;continue}if(z==="-J"){v=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:v}}var Bi="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Ui="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",yA="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",SA="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ra=/\{[^{}\s]*\}/g,mg=/\{\}|\{-?\d+\}/g,fg=/[\s;&|<>()$`\\"']/,bA=["e","f","source","file","-e","-f","--source","--file"],CA=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],EA=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),vA=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),pg=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),RA=new Set(["--workdir","--wd"]),gg="__CC_SAFETY_NET_PARALLEL_SOURCE__";function jn(n,u){for(let v of n){let W=u(v);if(W)return W}return null}function Sg(n){return jn([...n],(u)=>Bn(u))}function bg(n,u){let v=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=Ho(u);if(Ne)return Ne}if(v.length===2&&(v[1]==="--version"||v[1]==="--help"))return null;let z=kg(v),{template:B,jobs:X,runsRemotely:Q,readsCommandsFromInput:le,unsupported:ue,workdir:be,dryRun:Oe}=z;if(ue){let Ne=Ho(u);if(Ne)return Ne;let Le=Sg(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=IA(u);if(Ne)return Ne}if(be!==void 0&&Q){let Ne=Ho(u);if(Ne)return Ne}let De=kA(be,u.cwd,u.environment.paths);if(De===null){let Ne=Ho(u);if(Ne)return Ne}let Me=Q?{...u,cwd:void 0,originalCwd:void 0}:De===null||De===void 0||De===u.cwd?u:{...u,cwd:De};if(Oe){if([...Zn(B,Me)].flatMap((Le)=>[...Le.envAssignments.values()]).some(Vc)){let Le=Ho(u);if(Le)return Le}return null}if(B.length===0){let Ne=X.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=_g(Me.envAssignments,Me.cwd,Q);return jn(Ne,(We)=>u.analyzeNested(We,Le))}return jn(Zn(B,Me),(Ne)=>wA(Ne,z,u,Me))}function wA(n,u,v,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:X}=u,Q=n.tokens,le=[...n.envAssignments.values()];if(le.some(Tg)){let at=Ho(v);if(at)return at}let ue=Sg(le);if(ue)return ue;let be=le.some(qt),Oe=z||be,De=X&&Oe,Me=_g(n.envAssignments,n.wrapperCwd,B||De),Ne=Oe?{...Me,worktreeMode:!1}:Me,Le=Q.join(" "),We=qt(Le.split(/[ \t\n=]/,1)[0]??""),Be=!u.quotesCommand&&(We||Q.some((at)=>fg.test(at))),ze=We||fg.test(Q[0]??""),it=Be&&ze&&u.jobs.length>0?null:_A(n,u,v,W,Ne,be);if(it||!Be)return it;return Cg(qt(Le)?Le:`${Le} {}`,!We,n,u,v,W,Ne)}function _A(n,u,v,W,z,B){let{jobs:X,templateHasPlaceholder:Q,runsRemotely:le,usesStdin:ue}=u,be=n.tokens,Oe=Q||B;if(tn.has(n.head)){let Me=()=>{if(!Q||X.length===0)return null;return jn(X,(We)=>v.analyzeChild(va(be,We,v.budget),no(n,W)))};if(Xn(be))return Me();if(la(be))return ir();let Ne=Hn(be);if(Ne){if(Ig(Ne)){let it=Mr(v);if(it)return it;if(X.length===0)return null;return jn(X,(at)=>v.analyzeNested(Ag(Ne,at,v.budget),z))}if(qt(Ne))return Cg(Ne,!1,n,u,v,W,z);let We=!B&&(!Q||X.length>0)?(X.length>0?X:[void 0]).map((it)=>Sa(en(it===void 0?be:Q?be.map((at)=>xg(at,it)):[...be,...it]),Ne)):[];if(We.some((it)=>it.kind==="dynamic")){let it=Mr(v);if(it)return it}let Be=We.flatMap((it)=>it.kind==="literal"?[it.source]:[]);if(Be.length>0)return v.budget.charge("derivedTokens",Be.length),jn(Be,(it)=>v.analyzeNested(it,z));if($i(Ne)){let it=Mr(v);if(it)return it}let ze=v.analyzeNested(Ne,z);if(ze)return ze;if(Oe)return Mr(v);return null}let Le=br(en(be));if(Le.kind==="dynamic"||Le.kind==="literal"&&qt(Le.source))return Mr(v)??Me();if(Le.kind==="literal")return Me();if(X.length>0){let We=Mr(v);if(We)return We;let Be=Me();if(Be)return Be;if(Q)return null;let ze=X.flatMap((it)=>it[0]===void 0?[]:[it[0]]);return v.budget.charge("derivedTokens",ze.length),jn(ze,(it)=>v.analyzeNested(it,z))}if(Oe||ue)return Mr(v)??Me();return null}if(n.head==="rm"&&yr(be)){if(Q&&X.length>0)return jn(X,(Ne)=>Hc(va(be,Ne,v.budget,mg),n.cwd,W));if(X.length>0)return jn(X,(Ne)=>Hc(yg(be,Ne,v.budget),n.cwd,W));let Me=Hc(be.flatMap((Ne,Le)=>{if(Le===0||!qt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(mg,"")]:[]}),n.cwd,W);if(Me)return Me;return wg(v)}let De=X.length>0?X:[void 0];return jn(De,(Me)=>{let Ne=Me===void 0?be:Q?va(be,Me,v.budget):yg(be,Me,v.budget),Le=st("parallel.shell-dynamic",Ui),We=ue&&n.head==="find"?TA(Ne,W):null,Be=vg(Ne,ue,v)??We?.customResult??null,ze=$t(n.head),it=ue&&(ze==="rm"&&jc(Ne)||ze==="xargs"&&Rg(Ne)||We?.rmOptions===!0),at=ue&&(it||We?.executedSource===!0||We===null&&Eg(Ne,ze)),Rt=v.analyzeChild(Ne,{...no(n,W),worktreeMode:le||ue||Oe?!1:v.worktreeMode,dynamicInput:ue||Oe,dynamicRmInput:it,dynamicSourceInput:Be!==null||at,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Bi)});if(at){let Tt=Ft(Le,v.policy);if(Tt)return Tt}return Rt??Be??F(Ne,v.policy?.rules??[])})}function Cg(n,u,v,W,z,B,X){if(W.jobs.length>0)return jn(W.jobs,(ue)=>z.analyzeNested(Ag(n,u?ue.map(Ie):ue,z.budget),X));let Q=Li(n);if(Q?.[0]&&$t(Q[0])==="rm"&&yr(Q)){let ue=wg(z);if(ue)return ue}return(Q?z.analyzeChild(Q,{...no(v,B),dynamicInput:W.usesStdin,shellDynamicMatch:st("parallel.shell-dynamic",Ui),rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Bi)}):null)??z.analyzeNested(n,X)}function Eg(n,u){if(qt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(tn.has(u))return PA(n);if(u==="git")return xA(n);if(u==="find")return!0;if($n.has(u))return hg(n,bA,Di);if(Nn(u))return hg(n,CA,Js);return!1}function jc(n){let u=n.indexOf("--"),v=n.slice(1,u===-1?void 0:u);if(!n.some(qt))return u===-1;return v.some((z)=>qt(z)&&(z.startsWith("-")||Ig(z)))}function xA(n){if(AA(n))return!0;let u=Wn(n);if(u.subcommand===null||qt(u.subcommand))return!0;if(!Fo.has(u.subcommand.toLowerCase()))return!1;let v=u.rest.indexOf("--"),W=u.rest.slice(0,v===-1?void 0:v);if(!n.some(qt))return v===-1;return W.some(qt)}function AA(n){for(let u=1;u<n.length;u++){let v=n[u];if(!v||v==="--"||!v.startsWith("-"))return!1;if(v==="-c"||v==="--config-env"){if(qt(n[u+1]??""))return!0;u++;continue}if(v.startsWith("-c")&&v.length>2||v.startsWith("--config-env=")){if(qt(v))return!0;continue}if(qt(v))return!0}return!1}function PA(n){if(Xn(n))return!1;let u=Hn(n);if(u!==null)return qt(u);let v=br(en(n));if(v.kind==="literal")return qt(v.source);if(v.kind==="dynamic")return!0;return!n.some(qt)}function hg(n,u,v){let W=v(n);if(W.some((z)=>qt(z.value)))return!0;if(!n.some(qt))return v([...n,gg]).some((z)=>z.value===gg);return pa(W,u,(z)=>v(n.map((B)=>xg(B,[z]))))}function vg(n,u,v){let W=v.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>$t(B.command)===$t(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(qt))return Mr(v);return jn(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function TA(n,u){let v={customResult:null,executedSource:!n.some(qt),rmOptions:!1},W=!1,z=0,B=null,X=()=>{if(!B?.some(qt))return;for(let Q of Zn(B,u))v.executedSource||=Eg(Q.tokens,Q.head),v.rmOptions||=Q.head==="rm"&&jc(Q.tokens)||Q.head==="xargs"&&Rg(Q.tokens),v.customResult??=vg(Q.tokens,!0,u)};for(let Q of n.slice(1)){if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){v.executedSource||=qt(Q);continue}if(W=!0,B){if(Q===";"||Q==="+"){X(),B=null;continue}B.push(Q);continue}if(z>0){z--;continue}if(ar(Q)){B=[],v.executedSource||=qt(Q);continue}let le=Sr(Q);if(le>0){z=le,v.executedSource||=qt(Q);continue}v.executedSource||=qt(Q)}return X(),v}function Rg(n){let u=n.slice(io(n).childStart);return $t(u[0]??"")==="rm"&&jc(u)}function wa(n,u){return(v)=>Ft(st(n,u),v.policy)}var Mr=wa("parallel.shell-dynamic",Ui),IA=wa("parallel.command-stream-dynamic",yA),Ho=wa("parallel.command-stream-dynamic",SA),wg=wa("parallel.rm-recursive-force-dynamic",Bi);function Hc(n,u,v){return Ft(ga(en(n),{environment:v.environment,cwd:u,budget:v.budget,originalCwd:v.originalCwd,strict:v.strict,paranoid:v.paranoidRm,allowTmpdirVar:v.allowTmpdirVar,tmpdirWordSplittingUnsafe:qr(v.envAssignments??new Map,v.environment),trustedTmpdirValue:Po(v.envAssignments??new Map,v.environment),protectedGitMetadata:v.protectedGitMetadata,policy:v.policy}),v.policy)}function _g(n,u,v){let W={};if(n)W.envAssignments=n;if(v)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function xg(n,u){return n.replace(Ra,(v)=>Pg(v,u))}function va(n,u,v,W=Ra){return v.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let X=Pg(B,u);return v.charge("derivedTokens",Math.max(1,Math.ceil(X.length/64))),X}))}function Ag(n,u,v){return va([n],u,v)[0]??""}function yg(n,u,v){return v.charge("derivedTokens",n.length+u.length),[...n,...u]}function Pg(n,u){let v=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(v===void 0)return u[0]??"";let W=Number(v);return u[W>0?W-1:u.length+W]??""}function qt(n){return n.search(Ra)!==-1}function Tg(n){if(Vc(n))return!0;for(let u of n.matchAll(Ra))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function Vc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function Ig(n){return/^\{[^{}\s]*\}$/.test(n)}function kA(n,u,v){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!hA(n))return null;try{return Pr(u??n,n,v)}catch{return null}}function kg(n){let u=1,v=[],W=n.length,z=-1,B=!1,X=!1,Q=!1,le,ue=!1,be=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let at=vc(n,u+1);v.push(...at.templateTokens),W=u+1,z=at.markerIndex;break}if(!Le.startsWith("-")){let at=vc(n,u);v.push(...at.templateTokens),W=u,z=at.markerIndex;break}let We=n[u+1],Be=Le.indexOf("="),ze=Be===-1?Le:Le.slice(0,Be),it=Be===-1?void 0:Le.slice(Be+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){be||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){be=!0,u+=2;continue}if(ze==="--replace"||Le.startsWith("-i")&&Le.length>2){let at=ze==="--replace"?it:Le.slice(2);be||=at!==""&&at!=="{}",u++;continue}if(Le==="-a"||vA.has(ze)){be=!0,u+=it===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){X=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){Q=!0,u++;continue}if(ze==="--env"){be=!0,u+=it===void 0?2:1;continue}if(pg.has(ze)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=pg.has(Le)?2:1;continue}if(RA.has(ze)){be=!0;let at=it??We;if(at===void 0||at===":::"||at==="--"){u++;continue}le=at,u+=it===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&it!==void 0){u++;continue}if(EA.has(Le)){if(We===void 0||We===":::"||We==="--"){be=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}be||=v.some(ue?Vc:Tg);let Oe=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let Be=n[We];if(Be===":::"){Oe.push(Le),Le=[];continue}if(Be!==void 0)Le.push(Be)}Oe.push(Le)}be||=Oe.length>1;let De=OA(Oe),Me=v.some(qt),Ne=v.length===0&&z===-1;return{template:v,jobs:De,childStart:W,templateHasPlaceholder:Me,runsRemotely:B,quotesCommand:X,usesStdin:Q||z===-1,readsCommandsFromInput:Ne,unsupported:be,workdir:le,dryRun:ue}}function OA(n){if(n.length===0||n.some((v)=>v.length===0))return[];let u=[[]];for(let[v,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let X of u)X.push(B);if(u.length*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let X of W){if((z.length+1)*(v+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,X])}u=z}return u}function Og(n){return kg(n).childStart}var MA="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",_a="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Kc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function qc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function Dg(n,u,v,W,z=!1,B){let Q=(pi(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&dn(B,"shell.dynamic-executable",z)?st("shell.dynamic-executable",MA):null;return Ft(Q,B)??Ng(n,u,v,z,B)}function Ng(n,u,v,W,z){if(u.length<2)return null;let B=u.flatMap((Q,le)=>Kc(Q)?[le]:[]);if(B.length===0)return null;let X=$t(u[0]?.text??"");if(X==="git"){let Q=ce(n,u),le=NA(Q);if(dn(z,"shell.dynamic-structure",W)&&B.some((Oe)=>Oe<=le))return Ft(st("shell.dynamic-structure",_a),z);if(Ft(fa(Q,{environment:v}),z))return null;let ue=u[le]?.text.toLowerCase(),be=Q.findIndex((Oe,De)=>De>le&&t(Oe)==="--");if(dn(z,"shell.dynamic-structure",W)&&ue&&Fo.has(ue)&&B.some((Oe)=>Oe>le&&(be===-1||Oe<be)))return Ft(st("shell.dynamic-structure",_a),z);return null}if(X==="find")return dn(z,"shell.dynamic-structure",W)&&LA(u)?Ft(st("shell.dynamic-structure",_a),z):null;if(X==="rm"){let Q=u.findIndex((ue,be)=>be>0&&t(ue)==="--"),le=yr(u.map(t));return dn(z,"shell.dynamic-structure",W)&&B.some((ue)=>(Q===-1||ue<Q)&&(ue<u.length-1||!le))?Ft(st("shell.dynamic-structure",_a),z):null}if(X==="xargs")return Mg(n,u.slice(io(u.map(t)).childStart),"xargs",v,W,z);if(X==="parallel")return Mg(n,u.slice(Og(u.map(t))),"parallel",v,W,z);return null}function Mg(n,u,v,W,z,B){if(u.length===0)return null;let X=DA(u,W);if(pi(n,X)){let le=Ft(st(`${v}.shell-dynamic`,v==="xargs"?Uc:Ui),B);if(le)return le}let Q=Ng(n,X,W,z,B);if(Q)return Q;if(X[0]?.text==="rm"&&X.slice(1).some((le)=>Kc(le)&&qc(le)))return Ft(st(`${v}.rm-recursive-force-dynamic`,v==="xargs"?Bc:Bi),B);return null}function DA(n,u){let v=pr(n,u),W=v.rewritten?en(v.words.map(t)):v.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function NA(n){let u=1;while(u<n.length){let v=n[u],W=v?t(v):"";if(Dn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function LA(n){let u=!1,v=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let X=n[B];if(!X)continue;let Q=Kc(X);if(v>0){v--;continue}if(z){if(X.text===";"||X.text==="+"){z=!1,u=!0,W=!1;continue}if(Q&&(W||qc(X)))return!0;W=!1;continue}if(!u&&!X.text.startsWith("-")){if(Q&&(B>1||qc(X)))return!0;continue}if(u=!0,Q)return!0;let le=Sr(X.text);if(le>0){v=le;continue}if(ar(X.text))z=!0,W=!0}return!1}function Yc(n,u){return n.some((v)=>{if(v.value==="-"&&(v.kind==="main-script"||v.kind==="program-file"))return!0;return!_o(u[v.tokenIndex],v.value)})}var WA="unshare creating a user namespace grants root inside it, a common step toward privilege escalation. Ask the user to run it manually if it is needed.",FA=/^--(?:user|map-root-user|map-current-user|map-auto|map-subids|map-(?:user|group)s?|owner|mount-binfmt|load-interp)(?:=|$)/,GA=/[Urcl]/,zA=/[RwSGl]/,$A=new Set(["--propagation","--setgroups","--root","--wd","--setuid","--setgid","--map-user","--map-group","--map-users","--map-groups","--owner","--whitelist-env","--load-interp"]);function Lg(n){let u=n.slice(1).search(zA);return u===-1?n.length:u+1}function BA(n){return $A.has(n)||/^-[^-]/.test(n)&&Lg(n)===n.length-1}function UA(n){return n.startsWith("--")?FA.test(n):GA.test(n.slice(1,Lg(n)+1))}function Wg(n,u){if(n!=="unshare")return null;let v=u.slice(1),W=(B)=>BA(v[B-1]??""),z=v.findIndex((B,X)=>!W(X)&&(B==="--"||!B.startsWith("-")));return v.slice(0,z===-1?void 0:z).some((B,X)=>!W(X)&&UA(B))?st("unshare.user-namespace",WA):null}var HA="This reaches a cloud metadata endpoint, which hands out instance credentials. Ask the user to run metadata requests manually if they are needed.",jA="This uploads data to a remote host, which can send local files or secrets off the machine. Send it to localhost instead, or ask the user to run the upload manually if it is needed.",VA=/(?<![\w.-])(?:169\.254\.169\.254|169\.254\.170\.23|169\.254\.170\.2|100\.100\.100\.200|metadata\.google\.internal|metadata\.goog)(?![\w-]|\.[\w-])|(?<![\w:])fd00:ec2::(?:254|23)(?![\w:])/i,Zc=new Set(["xargs","find"]),Fg=(n)=>new Map(Object.entries(n).flatMap(([u,v])=>v.map((W)=>[W,u]))),Gg=new Map([["curl",Fg({data:["-d","--data","--data-ascii","--data-binary","--data-raw","--data-urlencode","--json"],upload:["-F","--form","--form-string","-T","--upload-file"],url:["--url","-x","--proxy","--preproxy"],source:["-K","--config"],local:["--unix-socket","--abstract-unix-socket"],get:["-G","--get"],value:[..."ACDEHPQUXYbcehmortuwyz".split("").map((n)=>`-${n}`),"--output","--output-dir","--header","--proxy-header","--request","--user-agent","--user","--proxy-user","--max-time","--connect-timeout","--write-out","--cookie","--cookie-jar","--referer","--retry","--retry-delay","--retry-max-time","--cert","--key","--cacert","--capath","--range","--resolve","--connect-to","--limit-rate","--oauth2-bearer","--dump-header","--continue-at","--time-cond","--interface","--max-filesize","--max-redirs","--noproxy","--url-query","--aws-sigv4","--variable","--stderr","--trace","--trace-ascii"]})],["wget",Fg({upload:["--post-data","--post-file","--body-data","--body-file"],source:["-i","--input-file"],value:[..."ABDIOPQRTUXaelotw".split("").map((n)=>`-${n}`),"--output-document","--output-file","--append-output","--header","--user-agent","--method","--timeout","--tries","--user","--password","--directory-prefix","--execute","--wait","--referer","--load-cookies","--save-cookies","--ca-certificate","--certificate","--private-key"]})]]),qA=/^(?:localhost|[a-z\d-]+(?:\.[a-z\d-]+)*\.localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\])$/;function $g(n,u){if(KA(n,u))return st("network.cloud-metadata",HA);return ZA(n,u)?st("network.upload-remote",jA):null}function KA(n,u){return(Zc.has(n)?u.slice(1).some(zg):zg(n))&&u.some((W,z)=>!YA(u[z-1],W)&&VA.test(W))}function zg(n){let u=Xc(n);return us.has(u)||Nn(u)}function YA(n,u){return n==="--noproxy"||u.startsWith("--noproxy=")}function ZA(n,u){let v=Zc.has(n)?u.findIndex((Me,Ne)=>Ne>0&&Gg.has(Xc(Me))):0,W=Gg.get(Xc(u[v]??n));if(v<0||W===void 0)return!1;let z=u.slice(v+1),B=z.findIndex((Me)=>Me===";"||Me==="+"),X=B<0||!Zc.has(n)?z:z.slice(0,B),Q=new Set,le=[],ue=(Me,Ne)=>{if(Q.add(Me),Me==="url"&&Ne!=="")le.push(Ne);if(Me==="source")le.push("")},be=0,Oe=!1;while(be<X.length){let Me=X[be]??"";if(be++,Oe||!Me.startsWith("-")||Me==="-"){le.push(Me);continue}if(Me==="--"){Oe=!0;continue}if(Me.startsWith("--")){let ze=Me.indexOf("="),it=W.get(ze<0?Me:Me.slice(0,ze));if(it===void 0)continue;let at=it!=="get",Rt=ze>=0?Me.slice(ze+1):at?X[be]??"":"";if(at&&ze<0)be++;ue(it,Rt);continue}let Ne=Me.slice(1).split(""),Le=Ne.findIndex((ze)=>{let it=W.get(`-${ze}`);return it!==void 0&&it!=="get"});if((Le<0?Ne:Ne.slice(0,Le)).some((ze)=>W.get(`-${ze}`)==="get"))Q.add("get");if(Le<0)continue;let We=W.get(`-${Me[Le+1]}`)??"value",Be=Me.slice(Le+2);if(Be==="")be++;ue(We,Be===""?X[be-1]??"":Be)}return(Q.has("upload")||Q.has("data")&&!Q.has("get"))&&!Q.has("local")&&!(le.length>0&&le.every(XA))}function Xc(n){return $t(Wt(n))}function XA(n){let u=n.replace(/^[a-z][a-z\d+.-]*:\/\//i,"").split(/[/?#]/)[0]??"",v=u.slice(u.lastIndexOf("@")+1).toLowerCase(),W=v.startsWith("[")?v.slice(0,v.indexOf("]")+1):v.split(":")[0];return qA.test(W??"")}var Bg="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QA="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",JA="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",eP="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",tP="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",nP="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",rP={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:eP},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:JA},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:nP},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Bg},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:QA},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Bg}},oP=/^\/\/?[ck]$/i,Ug=/[&|]+/,iP=/(?:"[^"]*"|[^\s"])+/g,sP=/[\^%!]/,aP=/\\"./s,lP=/(^|\/)[*.]*\*[*.]*$/,cP=/^"?[\\/]+[?.][\\/]/,dP=new Set(["rmdir","rd","del","erase"]),uP=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,mP=/\/s(?!\w)/i,fP=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Hg(n,u){let v=n.map(t),W=v.findIndex((De)=>oP.test(De));if(W===-1)return null;let z=v.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,X=B.split(Ug).map((De)=>{let Me=De.match(iP)??[],Ne=Me.findIndex((We)=>dP.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Me.slice(Ne);return{piece:De,tokens:Me,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),Q=X.filter((De)=>De.recursiveDelete),le=Q.length>0||uP.test(B)&&mP.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((De)=>aP.test(De))||Q.some((De)=>De.tokens.some((Me)=>cP.test(Me)))))return st("cmd.recursive-delete-escaped-quote",tP);let ue=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),be=X.reduce((De,Me)=>De??(Me.recursiveDelete?pP(Me.deleteTokens,ue,u.policy):u.analyzeNested(Me.piece)),null),Oe=le&&(Q.length===0||sP.test(B)||fP.test(B)||B.includes('"')&&Ug.test(B));return be??(Oe?ir():null)}function pP(n,u,v){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??Do(Oi(z.replaceAll('"',"")).replace(lP,"$1*"),u,v,rP),null)}var gP="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",hP=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,yP=/^-(?:executionpolicy|ep)$/i,SP=/^-(?:command|c)$/i,bP=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,CP="encodedcommand",EP=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,vP=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,RP=/[$`]/,wP="--%";function jg(n,u){let v=n.map(t),W=v.every((B,X)=>X===0||B!==wP&&_P(n[X],B))?Jc(v):void 0;if(W!==void 0)return u(W);if(v.some(xP))return ir();let z=v.join(" ");return EP.test(z)&&vP.test(z)?st("powershell.nested-recursive-delete-unread",gP):null}function Jc(n){let u=Qc(n,1),v=u===void 0?[]:n.slice(u+1);return v.length>0?v.join(" "):void 0}function Qc(n,u){let v=n[u]??"";if(SP.test(v))return u;if(hP.test(v))return Qc(n,u+1);return yP.test(v)?Qc(n,u+2):void 0}function _P(n,u){return n?.provenance==="unknown"?!RP.test(u):_o(n,u)}function xP(n){let u=bP.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||CP.startsWith(u))}var AP="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",PP="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",TP=/[efBMT@]/,IP=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function Vg(n,u){let v=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],be=ue?t(ue):"";if(B++,!ue)continue;if(z||be==="-"||!be.startsWith("-")){v.push(ue);continue}if(be==="--"){z=!0;continue}if(be.startsWith("--")){if(W||=be==="--del"||be.startsWith("--dele"),!be.includes("=")&&IP.has(be.slice(2)))B++;continue}if(be.slice(1).search(TP)===be.length-2)B++}let X=v.slice(1).filter((ue)=>!kP(t(ue)));if(!W||X.length===0)return null;let Q=Un({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=X.flatMap((ue)=>{let be=eo(ue);return(be.expandedTargets??[t(ue)]).map((Oe)=>sr(Oe,Q,{targetIsLiteral:be.expandedTargets!==void 0||be.targetIsLiteral,tmpdirWordSplittingProtected:be.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return st("rm.recursive-force-root-or-home",PP);if(le.includes("git_metadata_target"))return st("rm.git-metadata",y);if(Qs(X,u))return null;return Ft(st("rsync.delete",AP),u.policy)}function kP(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Kg=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>ga(n.words,xa(n))},{heads:new Set(["cmd"]),analyze:(n)=>Hg(n.words,{...xa(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Dr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>jg(n.parsedWords,(u)=>Dr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>fa(n.words,ed(n))},{heads:new Set(["find"]),analyze:(n)=>yp(n.words,{...xa(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>Vg(n.words,{...xa(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>ig(n.words,{...qg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Dr(n.options.analyzeNested(u,v))})},{heads:new Set(["parallel"]),analyze:(n)=>bg(n.words,{...qg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,v)=>Dr(n.options.analyzeNested(u,v))})}];function qg(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Dr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function xa(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:qr(n.envAssignments,n.options.environment),trustedTmpdirValue:Po(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function ed(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function Qg(n){return Kg.find((u)=>u.heads.has(n))?.analyze}function Vo(n,u,v){let W=v.trace;if(n.length===0)return null;let z=v.commandView?.dialect??"posix",B=(Et)=>Et.map((zt)=>z==="posix"?t(zt):zt.text),X=v.child,Q=X!==void 0&&!X.embedded,le=X?.embedded===!0,ue=v.effectiveCwd===null,be=X?X.cwd:ue?void 0:v.effectiveCwd??v.cwd,Oe=X?X.originalCwd:ue?void 0:v.cwd,De=Ae(n);if(De.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...De.envAssignments.keys()],output:B(De.words)});let Me=pr(De.words,v.environment,be,new Map([...v.envAssignments??[],...De.envAssignments])),Ne=Me.envSplitValues??[];if(Ne.length>0){let Et=[...Ne,...B(Me.words)].join(" "),zt=Bn(Et);if(zt)return W?.recordSegment({type:"dangerous-text",token:Et,matched:!0,reason:zt.reason}),Rn(zt);if(v.strict)return Cn(W);let Zt=Kr(Ne,B(Me.words));if(Zt){v.budget.charge("derivedTokens",Zt.length);let Fn=v.analyzeNested(Zt.join(" "),{effectiveCwd:Me.cwd===void 0?v.effectiveCwd:Me.cwd,envAssignments:new Map([...v.envAssignments??[],...De.envAssignments,...Me.envAssignments])});if(Fn)return Fn}}let Le=Me.rewritten?en(B(Me.words)):ce(z,Me.words),We=B(Le),Be={...v,wrapperNormalizationBudget:v.wrapperNormalizationBudget??{iterations:0}};if(W&&De.words.length>Le.length){let Et=B(De.words);W.recordSegment({type:"leading-tokens-stripped",input:Et,removed:Et.slice(0,Et.length-Le.length),output:We})}let ze=new Map([...v.envAssignments??[],...De.envAssignments,...Me.envAssignments]),it=We[0];if(!it)return null;if(to(it))throw new a("wrapperPeelIterations");let at=$t(it),Rt=Me.cwd===null?void 0:Me.cwd??be,Tt=Me.cwd===null?void 0:Oe,kt=Me.cwd===void 0?v.effectiveCwd:Me.cwd,lt=Me.cwd===void 0?v.effectiveCwd:null,jt=X?X.allowTmpdirVar:!Ri(ze,v.environment),Bt=Dg(z,Me.words,v.environment,u===0,v.strict,v.policy);if(Bt)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Bt.reason}),Rn(Bt);let sn=ia(We,v.policy);if(sn){for(let Et of[sn.childIndex,...sn.alternativeChildIndices]){Zg(Be.wrapperNormalizationBudget);let zt=Le.slice(Et);W?.recordSegment({type:"transparent-wrapper",wrapper:sn.wrapper,output:B(zt)});let Zt=Vo(zt,u,{...Be,effectiveCwd:kt,envAssignments:ze});if(Zt)return Zt}return null}let yn=le?void 0:at==="eval"?ya(Le):at==="trap"&&!Q?Zp(Le):void 0;if(Q&&X&&at==="eval"){if(yn?.kind==="dynamic")return jo(X,v.policy);if(yn?.kind==="literal"){let Et=v.analyzeNested(yn.source,{effectiveCwd:kt,envAssignments:ze});if(Et)return Et}return qo(X,v.policy)}if(yn?.kind==="dynamic"&&(v.strict||!v.commandView||!zc(v.commandView)))return Cn(W);if(yn?.kind==="literal"){W?.recordSegment({type:"recurse",reason:at==="eval"?"shell-eval":"shell-trap",innerCommand:yn.source,depth:u+1});let Et=v.analyzeNested(yn.source,{effectiveCwd:kt,envAssignments:ze,functionDefinitions:v.functionDefinitions});if(Et)return Et}if(Q?tn.has(at):nh(it,at)){if(Xn(We))return null;if(la(We))return Cn(W);if(Q&&X){let Et=Hn(We);if(Et){if(X.dynamicSourceInput??X.dynamicInput){let Zt=jo(X,v.policy);if(Zt)return Zt}if($i(Et)){let Zt=jo(X,v.policy);if(Zt)return Zt}return v.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze})}let zt=br(Le);if(zt.kind==="dynamic")return jo(X,v.policy);if(zt.kind==="literal")return X.dynamicSourceInput?jo(X,v.policy):null;return X.dynamicSourceInput??X.dynamicInput?jo(X,v.policy):null}if(le){let Et=Hn(We),zt=Et?v.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze}):br(Le).kind==="dynamic"?Cn(W):null;if(zt)return zt}if(X===void 0){let Et=LP(We,ze,kt,v,W,u);if(Et)return Et;let zt=Hn(We);if(zt){let vn=An(We).commandIndex,ln=vn===null?void 0:Le[vn];if(ln&&v.commandView&&Gi(ln,v.commandView.nested,v.environment))return Cn(W);let er=Sa(Le,zt);if(er.kind==="dynamic")return Cn(W);let lr=er.kind==="literal"?er.source:Xp(Le,zt),Ad=GP(lr);W?.recordSegment({type:"shell-wrapper",wrapper:at,innerCommand:Ad}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Ad,depth:u+1});let Pd=v.analyzeNested(lr,{effectiveCwd:kt,envAssignments:ze});if(Pd)return Pd;return $i(lr)?Cn(W):null}let Zt=br(Le,v.environment.home,v.strict?void 0:Go(v.shellAssignments??new Map,{home:v.environment.home,cwd:lt}));if(Zt.kind==="dynamic")return Cn(W);if(Zt.kind==="literal")return Hi(Zt.source,kt,ze,v,W,u);let Fn=Qp(Le,v.commandView?.redirections??[],v.hasPipelineInput??!1,v.literalShellInput);if(Fn.kind==="dynamic")return Cn(W);if(Fn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Fn.source,depth:u+1}),v.analyzeNested(Fn.source,{effectiveCwd:kt,envAssignments:ze})}}if(!X&&(at==="source"||at===".")){let Et=We[1]==="-p"?2:null;if(Et!==null){let ln=v.commandView?Le[Et]:void 0;if(!ln)return null;if(ln.provenance!=="literal")return Cn(W)}let zt=Et===null?1:3,Zt=We[zt]==="--"?zt+1:zt,Fn=v.commandView?Le[Zt]:void 0;if(!Fn)return null;let vn=Yg(Fn,v,lt);if(vn!==null)return Hi(vn,kt,ze,v,W,u);if(v.strict||!v.commandView||!zc(v.commandView))return Cn(W)}let Gt=Le[0];if(!X&&Gt&&it.includes("/")){let Et=Yg(Gt,v,lt),zt=Et===null?null:Hi(Et,kt,ze,v,W,u,!1,!0);if(zt)return zt}if($n.has(at)&&!le){if(!X&&v.strict&&Yc(Di(We),Le))return Cn(W);let Et=ap(We,(Zt)=>Dr(v.analyzeNested(Zt,{effectiveCwd:kt,envAssignments:ze}))),zt=Ft(Et,v.policy);if(zt)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:zt.reason}),Rn(zt)}if(Nn(at)&&!le){let Et=Js(We),zt=v.remotePipelineInput===!0&&!Jp(v.commandView?.redirections??[])&&!pc(We)&&Et.every((ln)=>ln.kind==="main-script"&&ln.value==="-"),Zt=Et.some((ln)=>{let er=Le[ln.tokenIndex];return ln.kind!=="module-file"&&er!==void 0&&v.commandView!==void 0&&Gi(er,v.commandView.nested,v.environment)}),Fn=!pc(We)&&Et.some((ln)=>ln.kind==="main-script"&&Le[ln.tokenIndex]?.provenance==="literal"&&v.downloadedPaths?.has(xr(ln.value,kt,v.environment.paths,v.budget)??""));if(!X&&(zt||Zt||Fn||v.strict&&Yc(Et,Le)))return Cn(W);let vn=Kf(We);if(Q&&X)return DP(at,vn,kt,ze,v,X);if(vn){let ln=dn(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:at,codeArg:vn,paranoidBlocked:ln}),ln){let lr=Ft(st("interpreter.one-liner-paranoid",Ii),v.policy);if(lr)return Rn(lr)}if(gc(at,vn))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:vn,depth:u+1});let er=v.analyzeNested(vn,{effectiveCwd:kt,envAssignments:ze});if(er&&!Jg(er,vn))return er;if(ki(vn,void 0,!v.strict)){let lr=Ft(st("interpreter.dangerous-command",No),v.policy);if(lr)return W?.recordSegment({type:"dangerous-text",token:vn,matched:!0,reason:No}),Rn(lr)}W=void 0}}if(at==="busybox"&&We.length>1)return Zg(Be.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),Vo(Le.slice(1),u,{...Be,effectiveCwd:kt,envAssignments:ze});let Xt=X?void 0:[["analyzer/device.ts:analyzeDeviceCommandMatch",Qm(at,We)],["analyzer/network.ts:analyzeNetworkCommandMatch",$g(at,We)],["analyzer/namespace.ts:analyzeNamespaceCommandMatch",Wg(at,We)]].map(([Et,zt])=>({rule:Et,match:Ft(zt,v.policy)})).find((Et)=>Et.match);if(Xt?.match)return W?.recordSegment({type:"rule-check",rule:Xt.rule,matched:!0,reason:Xt.match.reason}),Rn(Xt.match);let rn=W===Be.trace?Be:{...Be,trace:W},un={words:Le,parsedWords:Me.words,head:at,cwd:Rt,originalCwd:Tt,envAssignments:ze,allowTmpdirVar:jt,dynamicArguments:Me.words.some((Et)=>Et.provenance==="command-substitution"),depth:u,effectiveCwd:kt,options:rn,analyzeChildTokens:(Et,zt)=>Q&&X?nd(Et,u,rn,{...X,cwd:zt??void 0,effectiveCwd:zt??void 0}):Dr(Vo(en(Et),u+1,{...rn,child:void 0,commandView:void 0,effectiveCwd:zt,envAssignments:ze}))??F(Et,rn.policy.rules),analyzeChild:(Et,zt)=>nd(Et,u,rn,zt)},En=X&&(at==="xargs"||at==="parallel")?void 0:Qg(at);if(at==="rm"||at==="xargs"||at==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:ze.has("TMPDIR")||v.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:jt});let on=W&&at==="git"?$p(un.words,ed(un)):void 0,mn=Xg(on?on.match:En?.(un)??null,v.policy);if(W)zP(un,mn,on?.relaxation??null);if(mn)return Rn(mn);if(Q&&X&&(at==="rm"||at==="rmdir")){if(!(at==="rm"&&(yr(We)||X.dynamicRmInput)))return null;return(X.dynamicRmInput?qo(X,v.policy):null)??NP(X,v.policy)}let mo=En!==void 0&&!BP.has(at),Lr=!X&&!mo&&!ds.has(at),vr=W&&Lr?[]:void 0;if(Lr)for(let Et=1;Et<We.length;Et++){let zt=We[Et];if(!zt)continue;vr?.push(zt);let Zt=Xg(MP(We,Et,u,rn,Rt,Tt,kt,ze),v.policy);if(Zt)return W?.recordSegment({type:"fallback-scan",tokensScanned:vr??[],embeddedCommandFound:$t(zt)}),Rn(Zt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:vr??[]}),le&&X&&!X.wrappedByTransparent)return null;let fo=F(We,v.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:v.policy.rules.length>0,matched:!!fo,reason:fo?.reason}),fo)return Rn(fo);return Q&&X?qo(X,v.policy):null}function nd(n,u,v,W){return Dr(Vo(en(n),u+1,{...v,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function MP(n,u,v,W,z,B,X,Q){for(let le of Zn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:Q,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let be=$t(ue);if(nh(ue,be)||Qg(be)!==void 0&&be!=="xargs"&&be!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let De=nd(le.tokens,v,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?X:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!Ri(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(De)return De}return null}function DP(n,u,v,W,z,B){if(!u)return qo(B,z.policy);if(dn(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let Q=Ft(st("interpreter.one-liner-paranoid",Ii),z.policy);if(Q)return Rn(Q)}if(gc(n,u))return qo(B,z.policy);let X=z.analyzeNested(u,{effectiveCwd:v,envAssignments:W});if(X&&!Jg(X,u))return X;if(ki(u,void 0,!z.strict)){let Q=Ft(st("interpreter.dangerous-command",No),z.policy);if(Q)return Rn(Q)}return qo(B,z.policy)}function Jg(n,u){let v=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(qs)||n.reason===or)&&!ms(u);return v||W}function jo(n,u){let v=n.shellDynamicMatch?Ft(n.shellDynamicMatch,u):null;return v?Rn(v):null}function qo(n,u){let v=n.dynamicSourceInput&&n.dynamicSourceMatch?Ft(n.dynamicSourceMatch,u):null;return v?Rn(v):null}function NP(n,u){let v=n.dynamicInput&&n.rmDynamicMatch?Ft(n.rmDynamicMatch,u):null;return v?Rn(v):null}function LP(n,u,v,W,z,B){let X=hp(n);if(X.argvSource?.kind==="absent")return Cn(z);if(X.argvSourceApplies&&X.argvSource){let le=Hi(X.argvSource.value,v,u,W,z,B,!0);if(le)return le}if(!X.envSourceApplies||!X.envName)return null;let Q=u.get(X.envName);if(!Q)return null;return Hi(Q,v,u,W,z,B,!0)}function Yg(n,u,v){let W=u.environment.home,z=zo(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Qn(n,Go(u.shellAssignments??new Map,{home:W,cwd:v}))}var eh=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function Hi(n,u,v,W,z,B,X=!1,Q=!1){if(X&&/[$`*?[\]]/.test(n))return Cn(z);let le=xr(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0&&(X||le&&W.downloadedPaths?.has(le)))return Cn(z);if(ue===void 0)return le?WP(n,le,u,v,W,z,Q):null;if(Q&&ue.startsWith("#!")&&!eh.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!Q)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v});let be=th(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:v}));return be?.intent==="stop_and_explain"?null:be}var rd=/^(?:analysis|raw-text)\.|^(?!custom\.).*dynamic|^interpreter\.one-liner-paranoid$/;function WP(n,u,v,W,z,B,X){if([...z.writtenPaths??[]].some((Ne)=>u===Ne||u.startsWith(`${Ne}${OP}`)))return null;let le=z.scriptReads??{},ue=le.budget??=_n(),be=(Ne)=>th(()=>{if(Ne)FP(ue);ue.charge("scriptFiles");let Le=nf(u);if(Le===null)return null;if(X&&Le.text.startsWith("#!")&&!eh.test(Le.text))return null;if(!Ne)B?.recordSegment({type:"script-file",path:n,bytes:Le.bytes});let We=z.analyzeNested(Le.text,{effectiveCwd:v,envAssignments:W,scriptBudget:ue,withoutUncertainCapabilities:Ne,untraced:!0});if(!We||We.scriptLocation)return We;let Be=We.sourceOffset===void 0?"":`:${Le.text.slice(0,We.sourceOffset).split(`
+`).length}`;return{...We,scriptLocation:`${n}${Be}`}}),Oe=(Ne)=>Ne&&!rd.test(Ne.ruleId)?Ne:null,De=be(),Me=z.strict||z.paranoidInterpreters;return Oe(De)??(Me&&De?Oe(be(!0)):null)}function FP(n){let u=n.counters.get("scriptFiles");if(n.counters.clear(),u!==void 0)n.counters.set("scriptFiles",u)}function th(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function GP(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function zP(n,u,v){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!v,reason:u?.reason??v?.originalReason}),v)n.options.trace?.recordSegment({type:v.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:v.originalReason,gitCwd:v.gitCwd})}function Zg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Rn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function Cn(n){return n?.recordSegment({type:"error",message:Xr}),Rn(ir())}function nh(n,u){return tn.has(u)||n==="$SHELL"||n==="${SHELL}"||tn.has(Wt(u))}function Xg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Ft(n,u)}var $P=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,BP=new Set(["powershell","pwsh"]),UP=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function HP(n,u){let v=ih(n,u);if(v.length===0)return!1;let W=v[oh(v)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return $P.test(n.join(" "))}function rh(n,u,v,W,z){if(n.dialect==="powershell"){let it=jP(n.words,z);if(it.kind==="none")return;if(!u||it.kind==="unknown")return null;return td(YP(it.target),u,v.paths)}let B=n.words.map(t),X=B.some((it)=>/^CDPATH\+?=/.test(it));if(!HP(B,v))return X?null:void 0;if(!u)return null;let Q=ih(B,v,u),le=oh(Q);if(le===-1||Q[le]!=="cd")return null;let ue=Q.slice(le+1),be=ue.findIndex((it)=>it.length<=1||!it.startsWith("-")||it==="--");if((be===-1?ue:ue.slice(0,be)).some((it)=>!/^-[LP]+$/.test(it)))return null;let De=be===-1?[]:ue.slice(be),Me=De[0]==="--"?De.slice(1):De;if(Me.length>1)return null;let Ne=Me[0],Le=W.get("HOME")||v.home;if(Ne===void 0)return td(Sn(Le),u,v.paths);let We=n.words.find((it)=>it.provenance==="variable"&&it.text===Ne),Be=n.words.find((it)=>it.text===Ne&&/^~(?:\/|$)/.test(it.raw)),ze=We?Qn(We,new Map([...W,["HOME",Le]])):Be?`${Le}${Ne.slice(1)}`:Ne;if(ze===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(ze)&&(X||v.env.has("CDPATH")))return null;return td(Sn(ze),u,v.paths)}function td(n,u,v){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=Pr(u,n,v);return v.isDirectory(W)?W:null}catch{return null}}function jP(n,u){let v=VP(n[0])?1:0,W=n[v];if(!qP(W,v===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!UP.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return KP(n.slice(v+1),u)}function VP(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function qP(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function KP(n,u){let v;for(let W of n){if(W.provenance!=="literal"||v!==void 0)return{kind:"unknown"};v=W.text}if(v!==void 0)return{kind:"target",target:v};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function YP(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function oh(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let v=u+1;while(n[v]?.startsWith("-"))v++;return v}function ih(n,u,v){let W=ZP(n);return rr([...W],u,v)}function ZP(n){let u=0;while(u<n.length){let v=n[u];if(v!=="{"&&v!=="("&&v!=="$(")break;u++}return n.slice(u)}var nT="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",so="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function rT(n){let u=_e({...n,effectiveCapabilities:{...n.effectiveCapabilities,fail_closed:{...n.effectiveCapabilities.fail_closed,enabled:!1},paranoid_interpreters:{...n.effectiveCapabilities.paranoid_interpreters,enabled:!1}}}),v=Object.fromEntries(Object.entries(u.policy.effectiveDestructiveCommandRules).map(([W,z])=>[W,rd.test(W)?z:n.policy.effectiveDestructiveCommandRules[W]??z]));return{...u,policy:Object.freeze({...u.policy,effectiveDestructiveCommandRules:Object.freeze(v)})}}function dd(n,u,v,W){if(u>=l.recursionDepth.cap)return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??v.factStore?.getCommandProgram(n,v.shell??"auto")??C(n,v.shell);if(z.status==="limited")return v.trace?.recordSegment({type:"error",message:tr}),{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let be=z.issues.find((Oe)=>Oe.code.includes("heredoc"));if(be){if(!v.strict)return cd(n,v);let Oe=`${qs}: ${be.message}`;return v.trace?.recordGlobal({type:"error",message:Oe}),{reason:Oe,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return fh(n,v),{reason:or,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(v.strict&&z.status==="partial")return fh(n,v),{reason:or,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((be)=>be.code.includes("quote")))return cd(n,v);let X=v.cwd,Q=v.effectiveCwd!==void 0?v.effectiveCwd:v.cwd,le=Tp(v.environment.env,v.envAssignments),ue={...v,rootProgram:z,writtenPaths:v.writtenPaths??new Set,downloadedPaths:v.downloadedPaths??new Set,scriptReads:v.scriptReads??{}};return Ta(z,u,ue,X,[{effectiveCwd:Q,shellGitContextState:le,literalHeredocFiles:new Map(v.literalHeredocFiles),functionDefinitions:new Map(v.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Ta(n,u,v,W,z){let B=[...z],X,Q,le,ue=!1;for(let[be,Oe]of n.nodes.entries()){if(Oe.kind==="connector"){Q=Oe.operator;continue}let De=Cr(Q)&&ue;ue=De||Oe.kind==="command"&&(ba(Oe,v.environment)||Oe.dialect==="powershell"&&hh(Oe.words));let Me=n.nodes[be+1],Ne=Me?.kind==="connector"?Me.operator:void 0,Le=oT(n,be,Oe,Q,Ne),Be=Q==="&&"||Q==="||"?X:void 0,ze=Q==="&&"?Be?.success??B:Q==="||"?Be?.failure??B:B,it=Q==="||"?Be?.success??[]:[],at=Q==="&&"?Be?.failure??[]:[],Rt={connector:Q,skippedSuccessStates:it,skippedFailureStates:at};if(Cr(Ne)&&!Cr(Q))le=Rt;let Tt=Cr(Ne)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Cr(Q)?le??Rt:Rt,kt=ao(Tt.connector)||ao(Ne);if(Oe.kind==="function"){let rn=ze.flatMap((En)=>{let on=lo(En);return on.functionDefinitions.set(Oe.name,Oe.body),od(En,[on],Le,Ne==="&",ao(Ne))}),un=id(rn,[],Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=un.states,X=un.conditionalStates,Q=void 0;continue}if(Oe.kind==="group"){let rn=[],un=[];for(let on of ze){let mn=Ta(Oe.body,u,v,W,[lo(on)]);if(mn.result)return mn;if(rn.push(...od(on,mn.states,Le,Ne==="&",ao(Ne))),kt)un.push(on,...Le?mn.states.map((mo)=>Aa(on,mo)):mn.states)}let En=id(rn,un,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=En.states,X=En.conditionalStates,Q=void 0;continue}if(Oe.kind!=="command")continue;let lt=LT(n.nodes[be-1]),jt=v.trace?.flattenNested?v.trace.currentSegmentIndex:v.trace?.allocateSegment(),Bt=n.nodes[be-2],sn=Cr(Q)&&Bt?.kind==="command"?Bt:void 0,yn=sn?Yp(sn)??sT(sn):void 0,ut=[],Gt=[];for(let rn of ze){let un=aT(Oe,u,v,W,[lo(rn)]);if(un.result)return{result:un.result,states:B};let En=n.dialect==="powershell"?un.states:un.states.map((on)=>Aa(rn,on));for(let on of En){let mn=lo(on),mo=uT(Oe,u,v.trace?{...v,trace:gh(v.trace,jt)}:v,W,mn,Cr(Q),yn,De);if(mo)return{result:{...mo,sourceOffset:Oe.span.start},states:B};let Lr=UT(Oe,mn.functionDefinitions);if(Lr)v.budget.charge("derivedTokens",Ia(Lr));let vr=Lr?u+1>=l.recursionDepth.cap?ad(Oe.displayText,v,[mn]):Ta(Lr,u+1,v,W,[mn]):{result:null,states:$T(Oe,mn).flatMap((Et)=>WT(Oe,on,Et,lt))};if(vr.result)return vr;ut.push(...od(rn,vr.states,Le,Ne==="&",ao(Ne)));let fo=typeof mn.effectiveCwd==="string"&&mn.effectiveCwd!==on.effectiveCwd&&Oe.redirections.every((Et)=>["<",">",">>",">|"].includes(Et.operator)&&Et.target?.text==="/dev/null");if(kt&&(lt||!fo))Gt.push(rn),Gt.push(...vr.states.map((Et)=>Le?Aa(rn,Et):Et))}}let Xt=id(ut,Gt,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=Xt.states,X=Xt.conditionalStates,Q=void 0}return{result:null,states:B}}function oT(n,u,v,W,z){if(v.kind==="group"&&v.style==="subshell")return!0;if(n.dialect==="posix"&&(Cr(W)||Cr(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&v.kind==="group"&&v.style==="brace"&&iT(n,u)}function od(n,u,v,W,z){let B=v?u.map((Q)=>Aa(n,Q)):[...u],X=z?B.flatMap((Q)=>Ko(n.literalHeredocFiles,Q.literalHeredocFiles)?[Q]:[{...Q,literalHeredocFiles:new Map(n.literalHeredocFiles)},Q]):B;return W?[n,...X]:X}function Aa(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function iT(n,u){let v=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!v||v.kind!=="command")return!0;let W=v.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(lT(v))return!0;return v.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Cr(n){return n==="|"||n==="|&"}function sT(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function ao(n){return n==="&&"||n==="||"}function id(n,u,v,W,z,B){let X={success:Pa([...v,...n]),failure:Pa([...W,...u])},Q=ao(B)?X:void 0;return{states:ao(z)||Q?Pa([...X.success,...X.failure]):X.success,conditionalStates:Q}}function gh(n,u,v=n.flattenNested){return{currentSegmentIndex:u,flattenNested:v,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function aT(n,u,v,W,z){let B=n.nested.map((X)=>({program:X,depth:u}));if(n.dialect==="powershell"){let X=cT(n);if(X){if(u+1>=l.recursionDepth.cap)return ad(X,v,z);let Q=C(X,"powershell");if(Q.status==="limited")return ad(X,v,z);if(Q.status!=="complete")return sh(B,v,W,z);v.budget.charge("derivedTokens",Ia(Q)),B.push({program:Q,depth:u+1})}}return sh(B,v,W,z)}function lT(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function sh(n,u,v,W){let z=[...W];for(let B of n){let X=[];for(let Q of z){let le=Ta(B.program,B.depth,u,v,[lo(Q)]);if(le.result)return le;X.push(...le.states)}z=Pa(X)}return{result:null,states:z}}function cT(n){let u=yh(n),v=u?.[0];return u?.length===1&&v?.quoted&&v.provenance==="literal"?v.text:void 0}function dT(n,u,v){let W=yh(n);if(!W)return!1;return u||W.some((z)=>Gi(z,n.nested,v))||hh(W)}function hh(n){return n.some((u)=>/\.Download(?:String|Data)\(/i.test(u.raw)||!u.quoted&&ha(/^(?:\$?\(|[&.\s])*([^\s()]*)/.exec(u.raw)?.[1]??"","powershell"))}function yh(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),v=u?1:0,W=n.words[v];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(v+1);return z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?z.slice(1):z}function Ia(n){return n.nodes.reduce((u,v)=>u+(v.kind==="command"?v.words.length+v.nested.reduce((W,z)=>W+Ia(z),0):v.kind==="group"||v.kind==="function"?Ia(v.body):0),0)}function ad(n,u,v){return u.trace?.recordSegment({type:"error",message:tr}),{result:{reason:tr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...v]}}function uT(n,u,v,W,z,B,X,Q){let le={...v,environment:{...v.environment,env:z.shellGitContextState.env,paths:wT(v.environment.paths,z.createdDirectories,v.budget)}},ue=IT(n,!le.strict);if(ue&&le.strict)return le.trace?.recordSegment({type:"error",message:ue}),{reason:ue,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};bT(n,z,le),ET(n,z,le),Sh(n,z,"before-consumer",le.environment.paths,le.budget);let be=ce(n.dialect,n.words),Oe=be.map(t),De=n.displayText,Me=Ap(be,z.shellGitContextState,{home:le.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:le.environment.darwinUserTempDir}),Ne=kp(Me,z.shellGitContextState);if(n.dialect==="powershell"){let ze=Ft(ep(n,B,HT(le,z.effectiveCwd)),le.policy);if(le.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ze,reason:ze?.reason}),ze)return sd(De,ze);if(dT(n,Q,le.environment))return le.trace?.recordSegment({type:"error",message:Xr}),sd(De,ir())}let Le=Ft(Jm(n.redirections),le.policy);if(Le)return le.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Le.reason}),sd(De,Le);if(Oe.length===1&&Oe[0]?.includes(" ")&&!pi(n.dialect,n.words)){let ze=Ft(Bn(Oe[0]),le.policy),it=ze!==null&&!le.strict&&Km(n,le.rootProgram);if(ze&&!it)return le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!0,reason:ze.reason}),{reason:ze.reason,segment:De,ruleId:ze.id,intent:ze.intent};le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!1});let at=ah(n,ue,z,Ne,X,le);if(at)return at;return Dc(Me,z.shellGitContextState),null}let We=Vo(n.words,u,{...le,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Ne,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:X,remotePipelineInput:Q,analyzeNested:(ze,it)=>{let at=it&&Object.hasOwn(it,"effectiveCwd")?it.effectiveCwd:z.effectiveCwd,Rt=dd(ze,u+1,{...le,...it?.withoutUncertainCapabilities?rT(le):{},budget:it?.scriptBudget??le.budget,effectiveCwd:at,envAssignments:it?.envAssignments??Ne,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:it?.functionDefinitions,worktreeMode:it?.worktreeMode??le.worktreeMode,shell:it?.shell??le.shell,trace:le.trace&&!it?.untraced?gh(le.trace,le.trace.currentSegmentIndex,!0):void 0});return Rt?{reason:Rt.reason,ruleId:Rt.ruleId,intent:Rt.intent,sourceOffset:Rt.sourceOffset,scriptLocation:Rt.scriptLocation}:null}});if(We)return{...We,segment:De};let Be=ah(n,ue,z,Ne,X,le);if(Be)return Be;return Dc(Me,z.shellGitContextState),null}function ah(n,u,v,W,z,B){let X=kT(n,u,v,W??new Map,B);if(X)return X;if(Sh(n,v,"after-consumer",B.environment.paths,B.budget),!pT(n))v.literalHeredocFiles.clear();return vT(n,u,v,B.environment.paths,B.budget,B.environment.home),_T(n,v,B.environment.paths,B.budget,B.environment.home),DT(n,v,z,B.environment,B.trace),null}var mT=new Set([">>","<>"]),fT=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function pT(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>fT.test(u.raw))}var gT=new Set(["cp","mv","install","ln","sed","curl","wget","tee"]),hT=new Set(["cp","mv","install","ln"]),yT=/^-[^-]*i|^--in-place/,lh=/^(?:-t|--target-directory=?)(.*)$/;function ST(n){let u=n.findIndex((Oe)=>gT.has(Wt(Oe.text))),v=Wt(n[u]?.text??""),W=n.slice(u+1).filter((Oe)=>Oe.provenance==="literal").map((Oe)=>Oe.text);if(u===-1)return[];if(v==="sed")return W.some((Oe)=>yT.test(Oe))?W:[];if(!hT.has(v))return W;let z=W.findIndex((Oe)=>lh.test(Oe)),B=W[z]?.match(lh)?.[1],X=z!==-1&&!B,Q=X?W[z+1]:B,le=W.filter((Oe,De)=>!Oe.startsWith("-")&&!(X&&De===z+1)),ue=Q??le.at(-1);if(ue===void 0)return[];return[...Q===void 0?le.slice(1):[Q],...le.map((Oe)=>ph(ue,Wt(Oe)))]}function bT(n,u,v){let W=v.writtenPaths;if(!W)return;let B=[...n.redirections.flatMap((X)=>X.operator.includes(">")&&X.target?[X.target]:[]).filter((X)=>X.provenance==="literal").map((X)=>X.text),...ST(n.words)].flatMap((X)=>[X,X.slice(X.indexOf("=")+1),Wt(X.split(/[?#]/)[0]??"")]);for(let X of new Set(B.filter(Boolean))){let Q=xr(X,u.effectiveCwd,v.environment.paths,v.budget);if(Q)W.add(Q)}}var ch=new Map([["curl",/^(?:-[^-o]*o|--output(?:=|$))(.*)/],["wget",/^(?:-[^-O]*O|--output-document(?:=|$))(.*)/]]);function CT(n){let u=n.findIndex((W)=>ch.has(Wt(W.text))),v=ch.get(Wt(n[u]?.text??""));return n.slice(u+1).flatMap((W,z,B)=>{let X=W.provenance==="literal"?v?.exec(W.text)?.[1]:void 0,Q=B[z+1];if(X)return[X];return X===""&&Q?.provenance==="literal"?[Q.text]:[]})}function ET(n,u,v){let W=ba(n,v.environment),z=[...n.redirections.filter(bh).flatMap((B)=>B.target?.provenance==="literal"?[B.target.text]:[]),...W?CT(n.words):[]];for(let B of z.filter((X)=>X!=="-")){let X=xr(B,u.effectiveCwd,v.environment.paths,v.budget);if(X&&W)v.downloadedPaths?.add(X);if(X&&!W)v.downloadedPaths?.delete(X)}}function Sh(n,u,v,W,z){for(let X of n.redirections){if(!(v==="before-consumer"?bh(X):mT.has(X.operator)))continue;dh(X.target,u,W,z)}if(v!=="before-consumer"||!hn(n.words[0],"tee"))return;let B=Eh(n.words.slice(1));if(!B)return;for(let X of B.operands)dh(X,u,W,z)}function bh(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function dh(n,u,v,W){let z=n?.provenance==="literal"?xr(n.text,u.effectiveCwd,v,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function vT(n,u,v,W,z,B){if(u)return;let X=n.redirections.find((Q)=>Q.operator==="<<"||Q.operator==="<<-")?.heredoc;if(!X)return;for(let Q of RT(n,Go(v.shellGitContextState.shellAssignments,{home:B,cwd:v.effectiveCwd}),B)){let le=xr(Q,v.effectiveCwd,W,z);if(!le||!Xl(le))continue;if(!v.literalHeredocFiles.has(le)&&v.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");v.literalHeredocFiles.set(le,X.body)}}function RT(n,u,v){let W=ld(PT(n.redirections)?.target,u,v),z=W===void 0?[]:[W];if(hn(n.words[0],"cat"))return AT(n.words)?z:[];if(!hn(n.words[0],"tee"))return[];let B=Eh(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let X=B.operands.map((Q)=>ld(Q,u,v));if(!X.every((Q)=>Q!==void 0))return[];return[...X,...z]}function ld(n,u,v){if(TT(n))return n.text;if(!n)return;return zo(n,v)??Qn(n,u)??void 0}function wT(n,u,v){if(u.size===0)return n;let W=(z)=>{let B=Ht(z,n,v);return[...u].some((X)=>X===B||X.startsWith(`${B}${tT}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?Ht(z,n,v):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function _T(n,u,v,W,z){if(u.shellGitContextState.bodyDepth>0||!hn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((be)=>ld(be,u.shellGitContextState.shellAssignments,z));if(!B.every((be)=>be!==void 0))return;let X=B.findIndex((be)=>be==="--"||be==="-"||!be.startsWith("-")),Q=B.slice(0,X);if(X===-1||!Q.every((be)=>/^(?:-[pv]+|--parents|--verbose)$/.test(be)))return;let le=Q.some((be)=>be==="--parents"||/^-v*p/.test(be)),ue=u.effectiveCwd;for(let be of B.slice(B[X]==="--"?X+1:X)){if(be.split(/[\\/]/).includes("..")||!QP(be)&&!ue)continue;let Oe=Ht(eT(ue??"",be),v,W);if(le?xT(Oe,v):v.isDirectory(XP(Oe))&&Ch(Oe,v))u.createdDirectories.add(Oe)}}function xT(n,u){let v=JP(n).root,W=n.slice(v.length).split(/[\\/]+/).filter(Boolean),z=(X)=>ph(v,...W.slice(0,X+1)),B=W.findIndex((X,Q)=>!u.isDirectory(z(Q)));return B===-1||Ch(z(B),u)}function Ch(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function AT(n){let u=!1;for(let v of n.slice(1)){if(u||v.provenance!=="literal")return!1;if(v.text==="--"){u=!0;continue}if(!/^-u+$/.test(v.text))return!1}return!0}function PT(n){let u=n.findLast((v)=>(v.fd??([">",">|",">>",">&"].includes(v.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function Eh(n,u=new Map){let v=[],W=!0,z=!1,B=!1;for(let X of n){if(X.provenance!=="literal"&&Qn(X,u)===null)return;if(W&&hn(X,"--")){W=!1;continue}if(W&&!X.quoted&&X.raw===X.text&&/^-[^-]/.test(X.text)){z||=X.text.slice(1).includes("a"),B||=Array.from(X.text.slice(1)).some((Q)=>Q!=="a"&&Q!=="i");continue}if(W&&!X.quoted&&X.raw===X.text&&X.text.startsWith("--")){z||=X.text==="--append",B||=X.text!=="--append"&&X.text!=="--ignore-interrupts";continue}v.push(X)}return{operands:v,append:z,hasUnsupportedOptions:B}}function TT(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function hn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function IT(n,u){let v=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(v.length===0)return;if(v.length!==1)return so;let W=v[0];if(!W?.heredoc)return so;let z=/\$\(|`/.test(W.heredoc.body);if(!Uo(W.heredoc)&&(!u||z))return nT;if(W.fd!==void 0&&W.fd!==0)return so;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return so;let B=n.redirections.some((le)=>le!==W&&uh(le.target));if(hn(n.words[0],"cat"))return B?so:void 0;if(hn(n.words[0],"tee"))return B||n.words.slice(1).some(uh)?so:void 0;let X=n.words[0],Q=n.words[1];if(hn(X,"git")&&(hn(Q,"apply")||hn(Q,"commit")))return;if(hn(X,"gh")&&(hn(Q,"pr")||hn(Q,"issue"))&&hn(n.words[2],"create"))return;return so}function uh(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function kT(n,u,v,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),X=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(MT(n,B,v,W,z))return null;let Q=OT(n,B,z);if(Q!==void 0)return Q?{reason:Q.reason,segment:n.displayText,ruleId:Q.id,intent:Q.intent}:null;let le=cd(X.length===B.length?X.join(`
+`):n.source,z);return le?{...le,segment:n.displayText}:null}function OT(n,u,v){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!Uo(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=hn(n.words[0],"uv")&&hn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!Nn(B.text))return;let X=z.findIndex((Oe)=>hn(Oe,"-"));if(!z.slice(1,X===-1?void 0:X).every((Oe)=>Oe.provenance==="literal"&&Oe.text.startsWith("-")))return;let le=W.heredoc.body,ue=dn(v.policy,"interpreter.one-liner-paranoid",!!v.paranoidInterpreters);if(v.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let Oe=Ft(st("interpreter.one-liner-paranoid",Ii),v.policy);if(Oe)return Oe}if(!ki(le,void 0,!v.strict))return null;let be=Ft(st("interpreter.dangerous-command",No),v.policy);if(!be)return null;return v.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:be.reason}),be}function MT(n,u,v,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!Uo(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let X=pr(n.words,z.environment,v.effectiveCwd,W),Q=X.words.map(t),le=$t(Q[0]??"");if((X.envSplitValues?.length??0)>0||!tn.has(le)&&!tn.has(Wt(le)))return!1;return Xn(Q)}function DT(n,u,v,W,z){let B=rh(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,v);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var NT=new Set(["fi","done","esac"]);function LT(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function WT(n,u,v,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,X=v.shellGitContextState.bodyDepth,Q=v.compoundBodies;if(X>B)return v.compoundBodies=[...Q.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:Q[B]?.branchCwds??[],hasElse:!1}],[v];let le=B>0?Q[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return v.compoundBodies=[...Q.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,v.effectiveCwd],hasElse:z==="else"}],v.effectiveCwd=le.entryCwd,[v];let ue=le!==void 0&&NT.has(z);if(ue)v.compoundBodies=Q.slice(0,X);return[...new Set([v.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((Oe)=>{if(Oe===v.effectiveCwd)return v;let De=lo(v);return De.effectiveCwd=Oe,De})}function FT(n,u){return n.length===u.length&&n.every((v,W)=>{let z=u[W];return z!==void 0&&v.entryCwd===z.entryCwd&&v.hasElse===z.hasElse&&v.branchCwds.length===z.branchCwds.length&&v.branchCwds.every((B,X)=>B===z.branchCwds[X])})}var GT=/^[A-Za-z_][A-Za-z0-9_]*$/,zT=8;function $T(n,u){let v=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||v===void 0||!GT.test(v))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=zT&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(v),[u];return W.map((B)=>{let X=lo(u);return X.shellGitContextState.shellAssignments.set(v,B.text),X})}function lo(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:Ip(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function Pa(n){let u=[];for(let v of n){if(!u.some((W)=>BT(W,v)))u.push(v);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function BT(n,u){return n.effectiveCwd===u.effectiveCwd&&FT(n.compoundBodies,u.compoundBodies)&&Ko(n.shellGitContextState.env,u.shellGitContextState.env)&&Ko(n.literalHeredocFiles,u.literalHeredocFiles)&&Ko(n.functionDefinitions,u.functionDefinitions)&&Ko(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&Ko(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&mh(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&mh(n.createdDirectories,u.createdDirectories)}function mh(n,u){return n.size===u.size&&[...n].every((v)=>u.has(v))}function Ko(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([v,W])=>u.get(v)===W&&u.has(v))}function UT(n,u){let v=gi(n);return v===void 0?void 0:u.get(v)}function sd(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function HT(n,u=n.effectiveCwd){let v=u===null;return{environment:n.environment,cwd:v?void 0:u??n.cwd,originalCwd:v?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function cd(n,u){let v=Ft(Bn(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!v,reason:v?.reason};if(u.trace?.recordSegment(z,W),!v&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return v?{reason:v.reason,segment:n,ruleId:v.id,intent:v.intent}:null}function fh(n,u){let v={type:"strict-unparseable",rawCommand:n,reason:or},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(v);if(W!==void 0)u.trace?.recordSegment(v)}var jT=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function vh(n,u,v,W){let z=dd(n,0,{...u,..._e(u),budget:u.budget??_n(),factStore:W},v);if(!z)return null;return{kind:"deny",reason:z.scriptLocation?`${z.scriptLocation}: ${z.reason}`:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function Rh(n,u,v){try{return{decision:n()}}catch(W){let z=VT(W,u,v);if(!z)throw W;return z}}function VT(n,u,v){if(!(n instanceof a)||!jT.has(n.kind))return null;let W=l[n.kind];if(v?.currentSegmentIndex!==void 0)v.recordSegment({type:"error",message:W.reason});if(v?.currentSegmentIndex===void 0)v?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var qT=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),md=new Set(["cc-safety-net","ccsn"]),KT=new Set(["bunx","npx","pnpx"]),YT=new Set(["pnpm","yarn"]),ZT=new Set(["npm","pnpm","yarn"]),XT=new Set(["bun","node"]);function Oa(n,u,v={}){if(md.has(n))return 0;if(KT.has(n)){if(v.broad)return ud(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return ka(u[z])?z+1:null}let W=v.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&ZT.has(n)&&v.broad&&u[W]==="exec"){let z=ud(u.slice(W+1));return z===null?null:W+1+z}if(YT.has(n)){if(n==="yarn"&&!v.broad)return null;if(!v.broad)return u[0]==="dlx"&&ka(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=ud(u.slice(W+1));return z===null?null:W+1+z}if(XT.has(n)){let z=v.broad&&W!==-1?W:0;if(wh(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&wh(u[z+1]))return z+2}return null}function ud(n){let u=n.findIndex((W)=>ka(W));if(u===-1)return null;let v=u;while(v<n.length){let W=n[v]??"";if(!W.startsWith("-")&&!ka(W))break;v++}return v}function ka(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return md.has(n);if(u===0)return!1;let v=n.slice(u+1);if(v===""||v.includes("/")||v.includes(":"))return!1;return md.has(n.slice(0,u))}function wh(n){let u=n?.replaceAll("\\","/");return[...qT].some((v)=>u===v||u?.endsWith(`/${v}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function _h(n,u,v){let W=gr(n);if(!W)return null;let z=Mo(W.shell,n.invocation.context.executionCwd,u,v,{findSegmentTarget:(B)=>QT(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function QT(n,u){let v=rr([...n],u),W=v.slice(1),z=Oa(Wt(v[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((X)=>X!=="-g"&&X!=="--global");return B[0]==="policy"&&B[1]==="apply"?v.join(" "):null}import{dirname as Ma}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",JT=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Th(n,u,v){let W=iI(n.invocation.context,u,v);if(n.invocation.route.kind==="patch")return xh(n.paths,!1,n.invocation.context.executionCwd,W,u,v);let z=gr(n);if(n.invocation.route.kind==="command")return z?Ah(z.shell,n.invocation.context.executionCwd,W,u,v):null;if(n.invocation.route.kind==="unknown"&&z){let B=Ah(z.shell,n.invocation.context.executionCwd,W,u,v);if(B)return B}return xh(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||rs(n.invocation.toolName),n.invocation.context.executionCwd,W,u,v)}function xh(n,u,v,W,z,B){if(u)return null;let X=n.find((Q)=>ji(Q,v,W,z,B));return X?{target:X}:null}function Ah(n,u,v,W,z){let B=Mo(n,u,W,z,{findSegmentTarget:(X,Q)=>eI(X,Q,v,W,z)?.target??null,isRedirectionTarget:(X,Q)=>ji(X,Q.cwd,v,W,z),findMalformedTarget:(X)=>oI(X,u,v,W,z)?.target??null});return B?{target:B}:null}function eI(n,u,v,W,z){if(Pi(n))return null;let B=Tr([...n],W),X=Wt(B[0]??"").toLowerCase(),Q=B.slice(1);if(X==="rm"&&tI(Q)){let le=nI(Q).find((ue)=>Ph(In(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(X==="find"){if(ca(B,1)||wc(B,W)){let ue=(Ni(en(B))??en(["."])).find((be)=>{let Oe=In(be.text,u.variables);return ji(Oe,u.cwd,v,W,z)||Ph(Oe,u.cwd,v,W,z)})?.text;if(ue)return{target:ue}}}if(X==="mv"){let le=Ks(Q).sources.find((ue)=>sI(In(ue,u.variables),u.cwd,v,W,z));if(le)return{target:le}}if(rI(B,X))return null;for(let le of[...n,...B])for(let ue of Ih(le))if(ji(In(ue,u.variables),u.cwd,v,W,z))return{target:ue};return null}function tI(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function nI(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((v)=>!v.startsWith("-")),...n.slice(u+1)];return n.filter((v)=>!v.startsWith("-"))}function rI(n,u){if(!JT.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((v)=>v.startsWith("-i")||v==="--in-place"||v.startsWith("--in-place="))}function oI(n,u,v,W,z){for(let B of n.split(/\s+/))for(let X of Ih(B))if(ji(X,u,v,W,z))return{target:X};return null}function Ih(n){let u=n.trim().replace(/^['"]|['"]$/g,""),v=u.indexOf("=");return v===-1||v===u.length-1?[u]:[u,u.slice(v+1)]}function iI(n,u,v){let W=(Q)=>Vi(bn(Q,n.executionCwd,u,v)),z=W(p(u)),B=[W(S(n.executionCwd)),W(S(n.configCwd))],X=new Set(B.map((Q)=>Ma(Q)));for(let Q=Ma(z);;Q=Ma(Q))if(X.add(Q),Ma(Q)===Q)break;return{files:new Set([z,...B]),directoriesAndAncestors:X}}function ji(n,u,v,W,z){let B=Dd(n,u,W,z,(X)=>Vi(X)===ls);return B!==null&&v.files.has(Vi(B))}function Ph(n,u,v,W,z){return v.directoriesAndAncestors.has(Vi(bn(n,u,W,z)))}function sI(n,u,v,W,z){let B=Vi(bn(n,u,W,z));return v.files.has(B)||v.directoriesAndAncestors.has(B)}function Vi(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as Da,posix as Hh,resolve as Wa,win32 as aI}from"node:path";import{fileURLToPath as lI}from"node:url";var jh="Access to a sensitive path is not allowed.",Vh=new Set(["echo","printf"]),cI=new Set(["find"]),dI=new Set(["!","do","elif","else","if","then","until","while"]),uI=new Set(["-exec","-execdir"]),mI=new Set([";","+"]),fI=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),pI=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),qh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),gI=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),hI=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),yd=new Set(["-c","-e","-r","-E","--eval","--exec"]),yI=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Sd=new Set(["grep","rg"]),Kh=new Set(["files-with-matches","files-without-match","count","quiet"]),SI=new Set([...Kh,"ignore-case","fixed-strings","hidden"]),bI=new Set(["wc",...Sd]),CI=new Set(["cd","grep","head","openssl","tail","tailscale"]),EI=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,vI=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),RI=new Set(["commit","merge","notes","stash","tag"]),wI=new Set(["-m","--message"]),_I=new Set(["--grep"]),xI=new Set(["powershell","pwsh"]),kh=new Set(["jq","gojq","jaq"]),Oh="f",Mh="file",AI="files",PI=new Set(["e","f"]),TI=new Set(["regexp","file"]),II=new Set(["e","f","A","B","C","m"]),kI=new Set(["regexp","file","after-context","before-context","context","max-count"]),fd="__CC_SAFETY_NET_PIPE_INPUT__",gd=/[\w./~@+-]*[./~][\w./~@+-]*/g,OI=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,MI=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,DI=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Dh=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Nh=/\b(?:system|exec|spawn|popen)\s*$/,NI=/\b(?:eval|exec)\s*\(/g,LI=/\b(?:eval|exec)\s*$/,WI=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Lh(n,u,v,W,z,B){for(let X of n){let Q=X.target;if(nO(Q,X.cwd,u?.denyPaths??[],v,W,z))return{target:Q,ruleId:"secret.deny-path"};if(B&&!B.has(Q))continue;let le=eO(Q,X.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(ay(Q,X.cwd,W,z)))continue;if(ue&&B?.get(Q)==="data")continue;if(ue&&(X.isRedirectionWriteTarget===!0||B?.get(Q)==="write")&&!Q.includes("$")&&!La(Q,X.cwd,W,z))continue;if(ue&&(X.isCreatedPath===!0||X.isCertificateInput===!0))continue;if(ue&&/\s/.test(Q)&&!Q.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(Q)&&!La(Q,X.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&rO(Q,X.cwd,u?.allowPaths??[],v,W,z))continue;return{target:Q,ruleId:le}}}return null}function Yh(n,u,v,W,z={}){let B=Wh(n,v,W),X=Lh(B,u,n.invocation.context.configCwd,v,W);if(X===null||X.ruleId==="secret.deny-path"||z.strict!==!1)return X;let Q=Wh(n,v,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;Q.forEach((Ne)=>Zh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),be=Q.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),Oe=new Set(be.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),De=new Set(be.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Me=Lh(B,u,n.invocation.context.configCwd,v,W,new Map(be.map((Ne)=>[Ne.target,Oe.has(Ne.target)?"path":De.has(Ne.target)?"write":"data"])));return Me?.ruleId!=="secret.deny-path"&&FI(n,v)?null:Me}function FI(n,u){let v=gr(n);if(!v)return!1;if(v.program.nodes.some((X)=>X.kind==="command"&&X.nested.length>0))return!1;let W=[];for(let X of Vs(v.shell)){if(X.kind==="operator"&&X.boundary)return!1;if(X.kind==="redirection")return!1;if(X.kind==="operator")continue;W.push(hr(X.text,u))}let z=bd(W,u);if(z===null||z.length===0)return!1;let B=wn(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return v.program.dialect==="powershell"&&(B==="ls"||B==="stat");return Cd(B,z.slice(1))}function Qo(n,u){return bd(n,u)??rr(n,u)}function bd(n,u){let v=Yr(n,u);if(v.envSplitValues===void 0)return v.tokens;let W=Kr(v.envSplitValues,v.tokens);return W===null?null:bd(W,u)}function Cd(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((v)=>!v.startsWith("-")||EI.test(v));if(Sd.has(n))return GI(n,u);if(n!=="find")return!1;return!u.some((v)=>fI.has(v))}function GI(n,u){let v=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(v.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),X=(ue)=>{let be=v[ue-1]??"";return/^--[^=]+$/.test(be)&&!SI.has(be.slice(2))||B(be)&&be.slice(1).search(W)===be.length-2},Q=v.findIndex((ue,be)=>!ue.startsWith("-")&&!X(be));return(n==="grep"&&Q>=0?v.slice(0,Q):v).some((ue,be)=>{if(X(be))return!1;if(ue.startsWith("--"))return Kh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function Wh(n,u,v,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((Q)=>({target:Q,cwd:z}));let X=gr(n);return[...X?Jo(X.shell,n.store,W,u,z,v,zI(X)):[],...B==="unknown"?n.paths.map((Q)=>({target:Q,cwd:z})):[]]}function zI(n){return n.program.dialect==="powershell"}function Jo(n,u,v,W,z,B,X=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let Q=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...Lk(hr(n.source,W),u,v,W,z,B)],le=(We)=>hr(XI(We,X),W),ue=/[<>=]\(/.test(n.source),be=/\bcoproc\b|\|&/.test(n.source),Oe=[],De=[],Me=(We)=>({...v,commandHoldsPipe:v.commandHoldsPipe===!0||We||be});js(n,z,W,B,{word:le,segment:(We,Be,ze,it,at,Rt)=>{if(We.length===0)return null;let Tt=Me(Rt);if(Tt.commandHoldsPipe)Oe.push(...We);if(De.push(wn(Xh(Qo(We,W))[0]??"").toLowerCase()),Q.push(...Zo(We,u,ue||it==="|"||it==="|&"?{...Tt,segmentMayFeedReader:!0}:Tt,W,Be.cwd,B,at)),ze!==null)Q.push(...UI(ze,We,u,Tt,W,Be.cwd,B));return null},redirection:(We,Be,ze)=>{if(We.body!==void 0&&We.consumer!==void 0){let it=Me(ze);Q.push(...Qh(We.consumer,[We.body],u,it,W,Be.cwd,B,(at)=>HI(We.consumer??[],at,u,it,W,Be.cwd,B)))}if(We.targetOrder==="legacy-segment")return oc;return Q.push({target:le(We.target),cwd:Be.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(Oe.flatMap(Zh)),Le=ue||/\$\(|`/.test(n.source)||!De.every((We)=>CI.has(We));return Q.map(({loopVariable:We,...Be})=>{if(Be.certificateOutputMayFeedReader===!0&&Le)return{target:Be.target,cwd:Be.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?Be:{...Be,loopVariable:We}})}function Zh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function Ki(n,u,v,W,z,B,X=!1){let Q=u.getShellSyntax(n,X?u.getCommandProgram(n,"powershell"):void 0);if(Q.status==="structural-limit")throw new E;return Q.status==="complete"?Jo(Q,u,v,W,z,B,X):null}function Zo(n,u,v,W,z,B,X){let Q=(ut)=>({target:ut,cwd:z}),le=n.findIndex((ut)=>!dI.has(ut));if(v.skipMetadataOnlySegments===!0&&le>0)return Zo(n.slice(le),u,v,W,z,B,new Set([...X??[]].map((ut)=>ut-le)));let ue=n[1]??"";if(v.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((ut)=>Mn("for",ut)).map((ut)=>({...Q(ut),loopVariable:ue}));if(X?.size){let ut=n.filter((Gt,Xt)=>!X.has(Xt));if(kh.has(wn(Qo(ut,W)[0]??"").toLowerCase()))return[...n.filter((Gt,Xt)=>X.has(Xt)).map(Q),...Zo(ut,u,v,W,z,B)]}let be=Yr(n,W,z),Oe=typeof be.cwd==="string"?be.cwd:z,De=new Set(n.filter((ut,Gt)=>X?.has(Gt))),Me=(ut)=>({target:ut,cwd:De.has(ut)?z:Oe}),Ne=be.tokens,Le=be.envSplitValues??[],We=[...n.slice(0,n.length-Ne.length).filter((ut)=>!jk(ut)&&Tn(ut)===null&&!Le.includes(ut)).flatMap((ut)=>Mn("",ut)).map(Q),...[...be.envAssignments.values()].filter((ut)=>ut!=="").map(Me)];if(Le.length>0){let ut=Kr(Le,Ne);if(ut!==null)return[...We,...Zo(ut,u,v,W,z,B,new Set([...X??[]].map((Gt)=>Gt+ut.length-n.length)))];return[...We,...Le.flatMap((Gt)=>Ki(Gt,u,v,W,Oe,B)??[Me(Gt)]),...Ne.flatMap((Gt)=>Mn("",Gt)).map(Me)]}if(Ne.length===0)return We;let Be=Ne[0]??"",ze=wn(Be).toLowerCase(),it=Ne.slice(1),at=v.segmentMayFeedReader===!0||v.commandHoldsPipe===!0||v.displayOperandsAreCapturedOutput===!0,Rt=at&&bI.has(ze);if(v.skipMetadataOnlySegments===!0&&!Rt&&Cd(ze,it))return We;let Tt=BI(Be,ze,it);if(Tt)return[...We,...Tt.map(Me)];if(Vh.has(ze))return v.displayOperandsAreCapturedOutput===!0?[...We,...Jh(Ne).map(Me)]:We;if(ze==="eval")return[...We,...Ki(it.join(" "),u,v,W,Oe,B)??it.map(Me)];let kt=xI.has($t(Be))?Jc(Ne):void 0;if(kt!==void 0)B.charge("derivedTokens",Ne.length);let lt=kt===void 0?null:Ki(kt,u,v,W,Oe,B,!0);if(lt?.length)return[...We,...lt];if(ze==="export")return[...We,...it.flatMap((ut)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ut)?[ut.slice(ut.indexOf("=")+1)]:Mn(ze,ut)).map(Me)];if(ze==="git")return[...We,...JI(it).map(Me)];if(ze==="gh")return[...We,...hd(ze,it,vI).map(Me)];if(kh.has(ze))return[...We,...QI(it).map(Me)];if(Sd.has(ze))return[...We,...Hk(it).map(Me)];if(cI.has(ze))return[...We,...tk(it,u,v,W,Oe,B).map(Me)];if(ze==="mkdir"||ze==="touch"){let ut=v.segmentMayFeedReader!==!0&&!(ze==="touch"&&it.some((Gt)=>/^(?:--r|-[^-]*r)/.test(Gt)));return[...We,...it.flatMap((Gt)=>Mn(ze,Gt).map((Xt)=>ut&&!Gt.startsWith("-")&&!De.has(Gt)?{...Me(Xt),isCreatedPath:!0}:Me(Xt)))]}if($n.has(ze))return[...We,...it.flatMap((ut)=>Mn("awk",ut)).map(Me),...it.flatMap((ut)=>rk(ut,u,v,W,Oe,B)),...it.flatMap(ok).map(Me)];if(ze==="curl")return[...We,...it.filter((ut,Gt)=>ty(ut)===null&&ey(it[Gt-1])===null).flatMap((ut)=>Mn(ze,ut)).map(Me),...ek(it).map(Me)];if(ko(ze)){let ut=Ai.has(ze)?An([ze,...it]):null;if(ut!==null&&ut.command!==null&&ut.commandIndex!==null){let Gt=u.getShellSyntax(ut.command);if(Gt.status==="structural-limit")throw new E;if(Gt.status==="complete")return[...We,...Jo(Gt,u,v,W,Oe,B),...it.slice(ut.commandIndex).filter((Xt)=>!Xt.startsWith("-")).map(Me)]}return[...We,...nk(ze,it,u,v,W,Oe,B)]}let jt=(ut,Gt)=>new RegExp(`^--?${ut}=`).test(it[Gt]??"")||new RegExp(`^--?${ut}$`).test(it[Gt-1]??""),Bt=$I(Ne),sn=ze==="openssl"&&it[0]==="x509",yn=at?{certificateOutputMayFeedReader:!0}:{};return[...We,...it.flatMap((ut,Gt)=>Mn(ze,ut).map((Xt)=>Bt&&jt("(?:cert|key)-file",Gt)?{...Me(Xt),isCreatedPath:!0,...yn}:sn&&jt("in",Gt)?{...Me(Xt),isCertificateInput:!0,...yn}:Me(Xt)))]}function Xh(n){return wn(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function $I(n){let u=Xh(n);return wn(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function BI(n,u,v){let W=Oa(u,v);if(W===null||v[W]!=="explain")return null;let z=[n,...v.slice(0,W)],B=v.slice(W+1);for(let X=0;X<B.length;X++){let Q=B[X];if(Q==="--json"||Q==="--help"||Q==="-h")continue;if(Q==="--cwd"){let le=B[X+1];if(le&&!le.startsWith("--"))z.push(le);X++;continue}return z}return z}function UI(n,u,v,W,z,B,X){let Q=Qo(n,z);if(KI(u,v,W,z,B,X)){let le=Cd(wn(Q[0]??"").toLowerCase(),Q.slice(1))?Q.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...Jh(Q),...le].map((ue)=>({target:ue,cwd:B}))}return Qh(u,jI(Q),v,W,z,B,X,()=>[])}function HI(n,u,v,W,z,B,X){let Q=Qo(n,z);if(!ko(wn(Q[0]??"").toLowerCase()))return[];return Ki(u,v,W,z,B,X)??[{target:u,cwd:B}]}function Qh(n,u,v,W,z,B,X,Q){let le=YI(n,z);if(le===null)return u.flatMap(Q);return u.flatMap((ue)=>Ai.has(le)?Jo(v.getShellSyntax(ue),v,W,z,B,X):Na(le,ue,v,W,z,B,X))}function Jh(n){let u=wn(n[0]??"").toLowerCase();if(!Vh.has(u))return[];let v=n[n[1]==="--"?2:1];if(u==="printf"&&v!==void 0&&!v.startsWith("-")&&!v.replaceAll("%%","").includes("%"))return[Ed(v.replaceAll("%%","%"))];return n.slice(1)}function jI(n){let u=wn(n[0]??"").toLowerCase(),v=n.slice(1);if(u==="echo"){let W=v.findIndex((z)=>!/^-[neE]+$/.test(z));return[(W===-1?[]:v.slice(W)).join(" ")]}if(u==="printf")return VI(v);return[]}function VI(n){let u=n[0];if(u===void 0)return[];let v=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(v===0||n.length===1)return[Ed(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/v)},(z,B)=>qI(u,W.slice(B*v,(B+1)*v)))}function qI(n,u){let v=0;return Ed(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[v]??"";return v++,z}))}function Ed(n){return n.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function KI(n,u,v,W,z,B){let X=Qo(n,W);if(X.length===0||wn(X[0]??"").toLowerCase()!=="xargs")return!1;let Q=io(X),le=X.slice(Q.childStart);if(le.length===0)return!1;if(Q.replacementToken==="")return!1;let ue=Q.replacementToken,be=ue===null?[...le,fd]:le.map((Oe)=>Oe.split(ue).join(fd));return Zo(be,u,v,W,z,B).some((Oe)=>Oe.target.includes(fd))}function YI(n,u){let v=Qo(n,u);if(v.length===0)return null;let W=wn(v[0]??"").toLowerCase();if(!ko(W))return null;return ZI(W,v.slice(1))?W:null}function ZI(n,u){let v=vd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(yd.has(z)||ny(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(v==="python"&&z==="-m")return!1;if(WI.get(v)?.has(z))W++;continue}return!1}return!0}function vd(n){return/^python\d/.test(n)?"python":n}var Fh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function XI(n,u){if(!u||!Fh.test(n))return n;return`~${n.replace(Fh,"").replace(/\\/g,"/")}`}function Mn(n,u){if(u==="--")return[];let v=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))v.push(u.slice(W+1));if(u.startsWith("-"))return v;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return v;if(n==="zip"&&/\.zip$/i.test(u))return v;return v.push(u),v}function QI(n){let u=-1,v=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!v&&z==="--"){v=!0;continue}if(v||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>Mn("jq",B))}return n.flatMap((W,z)=>z===u?[]:Mn("jq",W))}function JI(n){let u=[];for(let v=0;v<n.length;v++){let W=n[v]??"";if(W==="--"||!W.startsWith("-"))return[...u,...RI.has(W)?hd("git",n.slice(v).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),wI):hd("git",n.slice(v),_I)];if(u.push(...Mn("git",W)),!Dn.has(W))continue;let z=n[v+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:Mn("git",z)),v++}return u}function hd(n,u,v){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((X)=>Mn(n,X))];if(v.has(B)){z++;continue}if(B.includes("=")&&v.has(B.slice(0,B.indexOf("="))))continue;W.push(...Mn(n,B))}return W}function ek(n){return n.flatMap((u,v)=>{let W=ty(u);if(W!==null)return Gh(W.flag,W.value);let z=ey(n[v-1]);return z===null?[]:Gh(z,u)})}function Gh(n,u){if(n==="-F"||n==="--form"){let v=u.indexOf("="),W=v===-1?u:u.slice(v+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return pd(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let v=u.indexOf("@"),W=u.indexOf("=");if(v===-1||W!==-1&&W<v)return[];return pd(u.slice(v+1))}return u.startsWith("@")?pd(u.slice(1)):[]}function ey(n){if(n===void 0)return null;if(qh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function ty(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let v=n.indexOf("=");if(v===-1)return null;let W=n.slice(0,v);return qh.has(W)?{flag:W,value:n.slice(v+1)}:null}function pd(n){return n===""||n==="-"?[]:[n]}function tk(n,u,v,W,z,B){let X=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),Q=[...n.slice(0,X===-1?n.length:X),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!uI.has(n[le]??""))continue;let ue=n.slice(le+1),be=ue.findIndex((Me)=>mI.has(Me)),Oe=be===-1?ue:ue.slice(0,be),De=Zo(Oe,u,v,W,z,B).map((Me)=>Me.target);if(Q.push(...De.filter((Me)=>Me!=="{}")),!De.includes("{}"))continue;Q.push(...n.slice(0,le).flatMap((Me,Ne,Le)=>{if(!pI.has(Me))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return Q}function nk(n,u,v,W,z,B,X){let Q=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(yd.has(ue)||ny(n,ue)){let Oe=u[le+1];if(Oe!==void 0)Q.push(...Na(n,Oe,v,W,z,B,X)),le++;continue}let be=/^--(?:eval|exec)=(.*)$/.exec(ue);if(be!==null&&be[1]!==void 0){Q.push(...Na(n,be[1],v,W,z,B,X));continue}if(!ue.startsWith("-"))Q.push({target:ue,cwd:B})}return Q}function ny(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return yI.get(u[u.length-1]??"")?.has(vd(n))??!1}function rk(n,u,v,W,z,B){if(!n.includes("system"))return[];return Cc(n)?.commands.flatMap((X)=>Jo(u.getShellSyntax(X),u,v,W,z,B))??[]}function ok(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function ik(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((v)=>v[2]).filter((v)=>v!==void 0&&v!=="");return[...u,...u.flatMap(wd),...n.match(gd)??[]]}function Na(n,u,v,W,z,B,X){let Q=(lt)=>({target:lt,cwd:B}),le=Pk(n),ue=Ik(u,le);if(ue.kind==="unmaskable")return ik(u).map(Q);let be=ue.masked.match(Dh)!==null||ue.literals.some((lt)=>Nh.test(ue.masked.slice(0,lt.start))),Oe=ue.masked.match(NI)!==null||ue.literals.some((lt)=>LI.test(ue.masked.slice(0,lt.start))),De=W.inlineLiteralsPresumedData===!0&&!Ai.has(n),Me=De&&(le==="python"||le==="javascript"),Ne=De&&!(Nk(ue.masked)||be||Oe)?[]:ue.literals,Le=De?Array.from(ue.masked.matchAll(Dh),(lt)=>{let jt=lt.index+lt[0].length;return{start:jt,end:na(ue.masked,jt)}}):[],We=!De||Le.some((lt)=>hc(ue.masked,lt.start)&&!fk(ue,lt.start))?ue.literals:ue.literals.filter((lt)=>Nh.test(ue.masked.slice(0,lt.start))||Le.some((jt)=>lt.start>=jt.start&&lt.start<jt.end)),Be=new Set(be?We:[]),ze=Me&&Ne.length>0&&!ck(ue.masked,le==="python"?"#":"//"),it=ze?pk(ue.masked):[],at=ze?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(lt)=>({name:lt[0],index:lt.index})):[],Rt=uk(at),Tt=!dk(ue.masked,at),kt=at.filter((lt)=>!zh(ue.masked,{start:lt.index,text:lt.name,tokenStart:lt.index,tokenEnd:lt.index+lt.name.length},it,Rt,Tt)).reduce((lt,jt)=>{let Bt=lt.get(jt.name)??[];return Bt.push(jt.index),lt.set(jt.name,Bt)},new Map);return[...Ne.filter((lt)=>lt.text!=="").map((lt)=>{if(!ze||Be.has(lt))return Q(lt.text);if(zh(ue.masked,lt,it,Rt,Tt)||gk(ue.masked,lt,it,kt))return{...Q(lt.text),literalRole:"data"};return _k(ue,lt,it)?{...Q(lt.text),literalRole:"write"}:Q(lt.text)}),...Ne.flatMap((lt)=>wd(lt.text)).map(Q),...De?[]:ue.literals.flatMap((lt)=>lt.text.match(gd)??[]).map(Q),...be?We.flatMap((lt)=>Ki(lt.text,v,{...W,commandHoldsPipe:!0},z,B,X)??[Q(lt.text)]):[],...Oe?ue.literals.flatMap((lt)=>Na(n,lt.text.replace(/\\(.)/g,(jt,Bt)=>Bt==="n"?`
+`:Bt),v,W,z,B,X)):[],...Me?[]:[ue.masked,...ue.comments].flatMap((lt)=>lt.match(gd)??[]).map(Q),...De?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(Q):[]]}var Rd={"(":")","[":"]","{":"}"},ry="and|elif|else|if|in|is|not|of|or|return|while|yield",sk=new RegExp(`(?:^|[^\\w$])(?:${ry})$`),ak=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${ry})\\s*\\(|/\\*`),lk=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function ck(n,u){return ak.test(n)||n.split(`
+`).some((v)=>{let W=v.indexOf(u);return W>=0&&/[()[\]{}]/.test(v.slice(W))})}function dk(n,u){return Sk.test(n)||u.some((v)=>{let W=yk.get(v.name),z=v.index+v.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function uk(n){return n.some((u)=>iy(u.name).some((v)=>lk.test(v)))}var mk=new Set(["cmd","powershell","pwsh"]);function fk(n,u){let v=co(n.masked,u),W=Rd[n.masked[v]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,v+1),B=n.masked.slice(v+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(co(n.masked,z+1)))&&!n.literals.some((X)=>X.tokenStart>v&&X.tokenStart<z&&(yd.has(X.text)||ko(wn(X.text).toLowerCase())||mk.has(wn(X.text).toLowerCase().replace(/\.exe$/,""))))}function pk(n){let u=[];return n.split("").map((v,W)=>{let z=u.at(-1)??-1;if(v in Rd)u.push(W);if(v===")"||v==="]"||v==="}")u.pop();return z})}function zh(n,u,v,W,z){let B=v[u.tokenStart]??-1,X=n[B]??"",Q=Xo(n,u.tokenStart),le=co(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,Q-3),Q+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(X==="["||X==="("))return!1;let ue=n[Q],be=n[le];if(X==="{"&&ue===":")return xk(n,Q);let Oe=(ue===X||ue===",")&&(be===","||be===Rd[X]||X==="{"&&be===":");if(X!=="(")return Oe&&X!=="";return Oe&&(z&&hk.test(n.slice(Math.max(0,B-20),B))||(ue===","||be===",")&&Ak(n,B))}function gk(n,u,v,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
+`:""}${n.slice(z,u.tokenStart)}`,X=bk.exec(B)?.[1],Q=n[v[u.tokenStart]??-1];if(X===void 0||Q==="("||Q==="[")return!1;let le=co(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(X);return(W.get(X)??[]).every((be)=>be===ue)}var hk=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,yk=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),Sk=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,bk=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,Ck=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,Ek=/^\s*\.\s*write_(?:text|bytes)\s*\(/,vk=/(?:^|[^\w$.])open\s*$/,Rk=/^[bt]*[awx][abtwx]*$/,wk=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function _k(n,u,v){let W=v[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Xo(n.masked,u.tokenStart),B=co(n.masked,u.tokenEnd),X=n.masked[B],Q=n.masked.slice(Math.max(0,W-40),W);if(Ck.test(Q))return(z===W||n.masked[z]===",")&&(X===","||X===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&Ek.test(n.masked.slice(na(n.masked,W+1)+1));if(z!==W||X!==",")return!1;if(wk.test(Q))return!0;if(!vk.test(Q))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&Rk.test(le.text)&&/^[,)]/.test(n.masked.slice(co(n.masked,le.tokenEnd)))}function xk(n,u){let v=Xo(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,v-63),v+1))?.[0]??"",z=n[Xo(n,v+1-W.length)];return z==="{"||z===","}function Ak(n,u){let v=Xo(n,u),W=n.slice(Math.max(0,v-7),v+1);return!/[\w$)\]]$/.test(W)||sk.test(W)}function Pk(n){let u=vd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var Tk={python:"#",javascript:"/"};function Ik(n,u){if(u==="opaque")return{kind:"unmaskable"};let v={masked:n.split(""),literals:[],comments:[]};return oy(n,0,u,v,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:v.masked.join(""),literals:v.literals,comments:v.comments}}function oy(n,u,v,W,z){let B=0;for(let X=u;X<n.length;X++){let Q=n[X]??"";if(z&&Q==="}"&&B===0)return X;if(z&&Q===Tk[v])return null;if(v==="python"&&Q==="#"){let Le=n.slice(X).search(/[\r\n]/),We=Le===-1?n.length:X+Le;W.comments.push(n.slice(X,We)),W.masked.fill(" ",X,We),X=We-1;continue}if(Q==="{")B++;if(Q==="}")B--;if(v==="simple"&&(Q==="`"||Q==="%"||Q==="<")){if(MI.test(n.slice(X)))return null}let le=Q==="'"||Q==='"'||v==="javascript"&&Q==="`"?Q:null;if(le===null)continue;if(le==="`"&&Dk(n,X))return null;let ue=v==="python"?Ok(n,X):"",be=v==="python"&&n.startsWith(le.repeat(3),X)?le.repeat(3):le,Oe=X+be.length,De=le==="`"||/[fF]/.test(ue),Me=X-ue.length,Ne=De?kk(n,Me,Oe,be,v,W):Mk(n,Oe,be);if(Ne===null)return null;if(!De){let Le=n.slice(Oe,Ne);if(v==="simple"&&le==='"'&&DI.test(Le))return null;W.literals.push({start:Oe,text:Le,tokenStart:Me,tokenEnd:Ne+be.length}),W.masked.fill(" ",Oe,Ne)}W.masked.fill(" ",X,Oe),W.masked.fill(" ",Ne,Ne+be.length),X=Ne+be.length-1}return z?null:n.length}function kk(n,u,v,W,z,B){let X=z==="python"?"{":"${",Q=W==="`"||W.length===3,le="";for(let ue=v;ue<n.length;ue++){let be=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:v,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!Q&&(be===`
+`||be==="\r"))return null;let Oe=z==="python"&&(be==="{"||be==="}")&&n[ue+1]===be;if(!Oe&&n.startsWith(X,ue)){let Ne=oy(n,ue+X.length,z,B,!0);if(Ne===null)return null;le+=`${X}}`,B.masked.fill(" ",ue,ue+X.length),B.masked[Ne]=" ",ue=Ne;continue}let Me=be==="\\"&&!(z==="python"&&n[ue+1]==="{")||Oe?2:1;le+=n.slice(ue,ue+Me),B.masked.fill(" ",ue,ue+Me),ue+=Me-1}return null}function Ok(n,u){return OI.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function Mk(n,u,v){let W=v.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
+`||B==="\r"))return null;if(n.startsWith(v,z))return z}return null}function Dk(n,u){for(let v=u-1;v>=0;v--){let W=n[v];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function Nk(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let v=u[0],W=u.index;if(gI.has(v.toLowerCase()))return!0;let z=iy(v);if(!z.some((B)=>hI.has(B)))continue;if(z.length>1)return!0;if(n[Xo(n,W)]===".")return!0;if(n[co(n,W+v.length)]==="(")return!0}return!1}function iy(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Xo(n,u){for(let v=u-1;v>=0;v--)if(!/\s/.test(n[v]??""))return v;return-1}function co(n,u){for(let v=u;v<n.length;v++)if(!/\s/.test(n[v]??""))return v;return n.length}function Lk(n,u,v,W,z,B){return $k(n).flatMap((X)=>{let Q=u.getShellSyntax(X);if(Q.status==="invalid")return[];return[...Jo(Q,u,{...v,displayOperandsAreCapturedOutput:!0},W,z,B),...Wk(Q,W)?Fk(Q,W).map((le)=>({target:le,cwd:z})):[]]})}function Wk(n,u){let v=Vs(n);for(let W=0;W<v.length;W++){let z=v[W];if(z?.kind!=="word"||wn(hr(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<v.length;B++){let X=v[B];if(X?.kind==="operator")break;if(X?.kind!=="word")continue;let Q=hr(X.text,u);if(Q==="--decode"||!Q.startsWith("--")&&Q.startsWith("-")&&/[dD]/.test(Q))return!0}}return!1}function Fk(n,u){return Vs(n).flatMap((v)=>v.kind==="word"?[hr(v.text,u)]:v.kind==="redirection"&&v.target?[hr(v.target,u)]:[]).flatMap(wd)}function wd(n){let u=zk(n);if(u===null)return[];let v=Buffer.from(u,"base64").toString("utf8");if(v===""||Gk(v))return[];return Buffer.from(v,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[v]:[]}function Gk(n){return Array.from(n).some((u)=>{let v=u.charCodeAt(0);return v<32||v===127})}function zk(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function $k(n){let u=[],v={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(ci(z,v))continue;if(sy(n,W,v)){let B=Bk(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!v.inSingle&&z==="`"){let B=Uk(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function Bk(n,u){let v={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(ci(B,v))continue;if(sy(n,z,v)){W++,z++;continue}if(!v.inSingle&&!v.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function Uk(n,u){let v=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(v){v=!1;continue}if(z==="\\"){v=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function sy(n,u,v){return!v.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function Hk(n){let u=[],v=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){v.push(ue);continue}let be=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(be!==null){let Oe=be[1]??"",De=be[2];if(Oe===AI)z=!0;if(TI.has(Oe))W=!0;if(De!==void 0){if(Oe===Mh)u.push(De);continue}if(kI.has(Oe)){let Me=n[le+1];if(Oe===Mh&&Me!==void 0)u.push(Me);le++}continue}if(ue.startsWith("-")&&ue.length>1){let Oe=ue.slice(1),De="",Me="";for(let Le=0;Le<Oe.length;Le++){let We=Oe[Le]??"";if(PI.has(We))W=!0;if(II.has(We)){De=We,Me=Oe.slice(Le+1);break}}if(De==="")continue;if(Me.length>0){if(De===Oh)u.push(Me);continue}let Ne=n[le+1];if(De===Oh&&Ne!==void 0)u.push(Ne);le++;continue}v.push(ue)}let Q=!W&&!z?v.slice(1):v;return[...u,...Q]}function jk(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var Vk=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),$h=".env.",qk=[".example",".sample",".template",".tpl"],Kk=[".env.example.",".env.sample."];function Yk(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function Zk(n){return n.length>0&&!/\s/.test(n)}function La(n,u,v,W){let z=ay(n,u,v,W);return z!==""&&v.paths.entryKind(z)!=="missing"}function ay(n,u,v,W){try{return Yi(n,u,v,W)}catch(z){if(z instanceof a)throw z;return""}}var Xk=/[?&][^?&=/]+=/,Qk=new Set(["node_modules","__pycache__"]),Jk=[["vendor","bundle"],["vendor","cache"]];function eO(n,u,v,W,z){if(Yk(n))return null;let B=On(n,u,W,z);if(!B)return null;let X=Kt(B.split("/").pop()??""),Q=Kt(B),le=()=>Zk(X)||La(n,u,W,z),ue=Kt(sO(n,u,W,z));for(let De of hl){let Me=`~/${De.suffixParts.join("/")}`;if((Uh(Q,Me)||Uh(ue,Me))&&Er(De.id,v))return De.id}if(X===".env.defaults"||X.startsWith($h)&&qk.some((De)=>X.endsWith(De))||Kk.some((De)=>X.startsWith(De)))return null;let be=tO(B,u,v,W,z);if(be)return be;if(Vk.has(X))return null;for(let De of gl)if(X===De.basename&&Er(De.id,v))return De.id;if(X.startsWith($h)&&Er(ps.id,v)&&le())return ps.id;for(let De of yl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){let Me=X.slice(De.prefix.length)[0];if((Me==="-"||Me==="_")&&Er(De.id,v)&&le())return De.id}for(let De of Sl)if(X.length>De.prefix.length&&X.startsWith(De.prefix)){if(X.slice(De.prefix.length)===De.suffix&&Er(De.id,v))return De.id}if(oO(Q))return null;if(!X.includes(".")&&di.pattern.test(X)&&Er(di.id,v))return di.id;if(Xk.test(n)&&!La(n,u,W,z))return null;let Oe=iO(X,v);if(Oe)return Oe;return null}function tO(n,u,v,W,z){return gs.find((B)=>{if(!Er(B.id,v))return!1;switch(B.id){case"secret.cli.claude-code":return Vt(n,Yt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let X=Kt(n).split("/");return Vt(n,Yt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||qi(n,"~/.claude.json",u,W,z)||X.at(-2)===".claude"&&["settings.json","settings.local.json"].includes(X.at(-1)??"")||X.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Vt(n,On("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let X=Yt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return Vt(n,X,["auth.json",".credentials.json"])||Yo(n,X,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let X=Yt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),Q=Kt(n).split("/"),le=Q.at(-1)??"";return Vt(n,X,["config.toml"])||le.endsWith(".config.toml")&&Vt(n,X,[le])||Q.at(-2)===".codex"&&le==="config.toml"}case"secret.cli.gemini":return Vt(n,an(Yt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let X=Kt(n).split("/"),Q=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[an(Yt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return Vt(n,an(Yt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||X.at(-1)==="settings.json"&&X.at(-2)===".gemini"||(Q?.trim()?qi(n,Q,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>Vt(n,On(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let X=Yt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return Vt(n,X,["config.json"])||Yo(n,X,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Vt(n,Yt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let X=Yt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q=Yt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return Vt(n,X,["server.token"])||Yo(n,X,["credentials"])||Yo(n,Q,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let X=["config.toml","mcp.json"],Q=Kt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".kimi-code"||Vt(n,Yt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),X)||Vt(n,Yt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...X,"config.json","config.json.bak"])}case"secret.cli.opencode":{let X=an(Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),Q=Kt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return Vt(n,X,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(Q)&&Vt(n,X,[Q])||ue.some((be)=>qi(n,be,u,W,z))}case"secret.cli.opencode.config":{let X=an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),Q=W.env.get("ProgramData")?[an(Yt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Kt(n).split("/").at(-1)??"")||Vt(n,X,["config.json"])||(ue?.trim()?qi(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...Q].some((be)=>Vt(n,On(be,u,W,z),le))}case"secret.cli.pi":return Vt(n,Yt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return Vt(n,Yt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let X=On("~",u,W,z);return[an(Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),an(X,".local","share","amp")].some((le)=>Vt(n,le,["secrets.json"]))||Yo(n,an(X,".amp"),["oauth"])}case"secret.cli.amp.config":{let X=["settings.json","settings.jsonc"],Q=[an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),an(On("~",u,W,z),".config","amp")],le=Kt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return Q.some((be)=>Vt(n,be,X))||le.at(-2)===".amp"&&X.includes(le.at(-1)??"")||(ue?.trim()?qi(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let X=an(Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),Q=an(Yt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return Vt(n,On("~/.cursor",u,W,z),["auth.json"])||Vt(n,X,["auth.json"])||Kt(n).split("/").at(-1)==="mcp-auth.json"&&uo(Kt(n),Kt(Q))}case"secret.cli.cursor.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".cursor"}case"secret.cli.grok-build":return Vt(n,Yt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let X=Kt(n).split("/");return X.at(-1)==="config.toml"&&X.at(-2)===".grok"||Vt(n,Yt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||Vt(n,On("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return Vt(n,On("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let X=Kt(n).split("/");return X.at(-1)==="mcp.json"&&X.at(-2)===".factory"||Vt(n,On("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[Yt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),On("~/.local/share",u,W,z)].some((X)=>Vt(n,an(X,"devin"),["credentials.toml"])||Yo(n,an(X,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[Yt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),On("~/.config",u,W,z)].some((X)=>Vt(n,an(X,"devin"),["config.json"]));default:return!1}})?.id??null}var Bh=new WeakMap;function Yt(n,u,v,W,z){let B=Bh.get(z)??new Map;Bh.set(z,B);let X=`${v}\x00${n??""}\x00${u}`,Q=B.get(X);if(Q!==void 0)return Q;let le=On(n?.trim()?n:u,v,W,z);return B.set(X,le),le}function Vt(n,u,v){return v.some((W)=>ly(n,an(u,W)))}function Yo(n,u,v){return v.some((W)=>uo(Kt(n),Kt(an(u,W))))}function qi(n,u,v,W,z){return ly(n,On(u,v,W,z))}function ly(n,u){return Kt(n)===Kt(u)}function an(n,...u){return Jn([n,...u].filter(Boolean).join("/"))}function nO(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Yi(n,u,z,B));return v.some((Q)=>uo(X,Kt(Yi(Q,W,z,B))))}function rO(n,u,v,W,z,B){if(v.length===0)return!1;let X=Kt(Yi(n,u,z,B));if(!X)return!1;let Q=z.env.get("HOME")??z.home,le=Q?Jn(Ht(Sn(Q),z.paths,B)):"",ue=Kt(le),be=z.env.get("CC_SAFETY_NET_HOME"),Oe=Kt(be?Jn(Ht(Wa(Sn(be)),z.paths,B)):le&&Jn(Ht(`${le}/.cc-safety-net`,z.paths,B)));if(Oe&&uo(X,Oe))return!1;return v.some((De)=>{let Me=Rl(De);if(Me&&Hh.basename(X)!==Kt(Me.name))return!1;let Ne=Kt(Yi(Me?.root??De,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return uo(X,Ne)&&!(Me&&X===Ne)})}function oO(n){let u=n.split("/");return u.some((v)=>Qk.has(v))||Jk.some(([v,W])=>u.some((z,B)=>z===v&&u[B+1]===W))}function iO(n,u){let v=n.lastIndexOf("."),W=v>0&&v<n.length-1?n.slice(v+1):"";if(W==="")return null;for(let z of bl)if(W===z.extension&&Er(z.id,u))return z.id;for(let z of Cl)if(z.pattern.test(W)&&Er(z.id,u))return z.id;return null}function Kt(n){return n.toLowerCase()}function Er(n,u){return!u?.disabledRules?.includes(n)}function On(n,u,v,W){let{home:z,normalized:B}=_d(n,v,W);if(!B)return"";if(!z)return B;let X=xd(B,z),Q=Da(X)?X:Jn(Wa(u,X)),le=Jn(Ht(Q,v.paths,W));if(!uo(le,z)){if(Da(X))return le;return le===Q?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function Uh(n,u){return n===u||n.startsWith(`${u}/`)}function sO(n,u,v,W){let{home:z,normalized:B}=_d(n,v,W);if(!B||!z)return"";let X=xd(B,z),Q=Hh.normalize(Da(X)?X:Jn(Wa(u,X))),le=Jn(Sn(v.env.get("HOME")??v.home)),ue=(De)=>process.platform==="win32"?De.toLowerCase():De,be=[z,le].find((De)=>De!==""&&uo(ue(Q),ue(De)));if(be===void 0)return"";let Oe=Q.slice(be.length);return Oe?`~${Oe}`:"~"}function Yi(n,u,v,W){let{home:z,normalized:B}=_d(n,v,W);if(!B)return"";let X=z?xd(B,z):B;return Jn(Ht(Da(X)?X:Wa(u,X),v.paths,W))}function _d(n,u,v){let W=u.env.get("HOME")??u.home,z=W?Jn(Ht(Sn(W),u.paths,v)):"",B=Jn(Sn(aO(hr(n,u))));return{home:z,normalized:B}}function aO(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return lI(n)}catch{return n}}function xd(n,u){if(n==="~")return u;if(n.startsWith("~/"))return an(u,n.slice(2));return n}function lO(n){if(process.platform==="win32")return!0;return aI.parse(n).root.length>1}function Jn(n){let u=n.trim(),v=(u.includes("\\")&&lO(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(v==="/")return v;return v.replace(/\/+$/g,"")}function uo(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function wn(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,v){super(`CC Safety Net ${n} dependency failed`,{cause:v});this.stage=n;this.evaluation=u}}var cO={findPolicyMutation:Th,findGitMetadataMutation:Wf,resolveGitMetadata:fO,loadPolicySnapshot:w,findSensitiveTarget:Yh,analyzeCommand:vh,getModes:O},dO=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,uO=["workdir","cwd","working_directory"];function G(n,u){let v={...cO,...u.dependencies},W=hO(n),z=()=>Nr("config-load",W,()=>v.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,X=B?.policy.commandTools.find((Bt)=>Bt.name===n.toolName),Q=X&&W?mO(n,W,X.cwd,u.environment.paths):n;if("decision"in Q)return Q;let le=Q,ue=le===n?{}:{promotedInvocation:le},be=Zi(le)?le.command:W,Oe=Nr("policy-protection",be,()=>Mf(le)),De=Oo(Oe,"input-candidate"),Me=Oo(Oe,"declared-command");if(Zi(le)&&le.command?.trim()&&Me?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:tr,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(De?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:Of,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=_n(),Le=Nr("policy-protection",be,()=>v.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=Nr("policy-protection",be,()=>v.findPolicyMutation(Oe,u.environment,Ne));if(We){let Bt=be??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Bt,segment:We.target}}}}let Be=Nr("policy-protection",be,()=>_h(Oe,u.environment,Ne));if(Be){let Bt=be??Be.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Bt,segment:Be.target}}}}let ze=Nr("policy-protection",be,()=>v.findGitMetadataMutation(Oe,Le,u.environment,Ne));if(ze){let Bt=be??ze.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Bt,segment:ze.target}}}}let it=B??z(),at=it.policy,Rt=v.getModes(at,u.environment.env),Tt={level:Rt.effectiveLevel,...pO(it),...ue},kt=at.secretProtection.enabled===!1?null:Nr("secret-protection",be,()=>v.findSensitiveTarget(Oe,at.secretProtection,u.environment,Ne,{strict:Zi(le)||De?.program.dialect==="powershell"?Rt.strict:void 0}));if(kt){let Bt=be??kt.target;return{stage:"secret-protection",...Tt,decision:{kind:"deny",reason:jh,intent:"hard_stop",ruleId:kt.ruleId,evidence:{command:Bt,segment:kt.target}}}}if(!Zi(le))return{stage:"non-command",...Tt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...dy(be),...Tt};let lt=Nr("command-analysis",be,()=>Rh(()=>v.analyzeCommand(le.command,{cwd:le.context.configCwd,effectiveCwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:it,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Rt.capabilities,worktreeMode:Rt.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},gO(Oe),Oe.store),le.command,u.trace)),jt=le.route.shell==="auto"&&Oe.store.readsAutoAsPowerShell()?()=>{let Bt=u.trace?.branch(),sn={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...Bt?{trace:Bt.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>it,resolveGitMetadata:()=>Le}}),...ue};return{decision:sn.decision,withItsTrace:()=>(Bt?.adopt(),sn)}}:void 0;if(lt.decision){let Bt=!Rt.strict&&(lt.decision.ruleId==="raw-text.dangerous-command"||lt.decision.reason===Xr&&!dO.test(lt.decision.evidence?.segment??"")&&Bn(le.command)===null),sn=Bt?jt?.():void 0;if(sn?.decision.kind==="deny"&&!sn.decision.unverifiedByStandardMode)return sn.withItsTrace();return{stage:"command-analysis",...Tt,..."errorCode"in lt?{errorCode:lt.errorCode}:{},decision:Bt?{...lt.decision,unverifiedByStandardMode:!0}:lt.decision}}return jt?.().withItsTrace()??{stage:"command-analysis",...Tt,decision:{kind:"allow"}}}function mO(n,u,v,W){let z=[...new Set((v?[v]:uO).flatMap((le)=>{let ue=Object.getOwnPropertyDescriptor(n.input,le);return ue?[ue.value]:[]}))],B=z.filter((le)=>typeof le==="string"&&le.trim()!=="");if(z.length>1||B.length!==z.length)return dy(u);let X=B[0],Q=X===void 0?n.context.configCwd:fu(X,n.context.configCwd,W);if(!Q){let le=I({directory:"requested",problem:"unusable",cwd:X??""});return{stage:"command-validation",decision:{kind:"deny",reason:le.reason,ruleId:le.ruleId,intent:le.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:Q},u)}function fO(n,u){let v=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(v.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(v.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(v.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(v.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(v.flatMap((W)=>W.hooksDirectories))])})}function pO(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function gO(n){return Oo(n,"declared-command")?.program}function hO(n){try{return de(n.input)}catch(u){let v=Zi(n)?n.command:void 0;throw new g("policy-protection",cy("policy-protection",u instanceof h?void 0:v,u),u)}}function Nr(n,u,v){try{return v()}catch(W){throw new g(n,cy(n,W instanceof h?void 0:u,W),W)}}function cy(n,u,v){let W=v instanceof H?{reason:or,ruleId:"analysis.strict-unparseable"}:v instanceof a||v instanceof E?{reason:Ga,ruleId:"analysis.limit"}:{reason:ei,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function dy(n){let u=q();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Zi(n){return n.route.kind==="command"}
+export{l,a,ee,qe,dt,A,Pt,pt,Fe,te,q,I,ne,_t,c,r,ft,$e,O,k,xe,At,h,je,b,de,Se,It,mt,gt,d,Ve,i,R,s,pe,o,x,we,V,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,Ke,ge,f,e,Je,Ue,Ye,Te,vt,bt,he,He,ye,Ze,ie,J,Xe,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Qe,et,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Mt,Ie,rt,ot,g,G};