cc-safety-net 2.7.5 → 2.7.6

package/dist/chunks/{index-dm4v8s9a.js → index-810r0z3b.js}

@@ -1,54 +1,54 @@
-var za="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",nr="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",ti="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ga={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},go={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...Ga},processedCandidateBytes:{cap:4194304,...Ga},pathEnvironmentExpansion:{cap:64,...Ga},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...go},trackedHeredocFiles:{cap:64,...go},scriptFiles:{cap:64,...go},controlFlowStates:{cap:64,...go},wrapperPeelIterations:{cap:20,...go},derivedCommandShape:go});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function xn(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,b=1){let W=(n.get(u)??0)+b;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var my=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function te(n){return qe(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function qe(n){return my.reduce((u,b)=>u.replace(b,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return Id(n).reduceRight((u,b)=>`${u.slice(0,b.valueStart)}<redacted>${u.slice(b.valueEnd)}`,n)}function A(n){return qe(dt(n))}function Pt(n){return Id(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function Id(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let b=n[u.index-1];if(u.index>0&&b&&!/[\s"'([{]/.test(b))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:fy(n,W)}]})}function fy(n,u){if(n.startsWith("$(",u))return py(n,u);let b=n[u];if(b==='"'||b==="'"){for(let z=u+1;z<n.length;z++){if(b==='"'&&n[z]==="\\"){z++;continue}if(n[z]===b)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function py(n,u){let b=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){b++,z++;continue}if(B!==")")continue;if(b--,b===0)return z+1}return n.length}var gy={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function hy(n){let u=n.maxLen??200,b=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${b(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(b(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(b(n.segment))}`:void 0,n.cwd?`Working directory: ${W(b(n.cwd))}`:void 0,n.configWarning?`Config warning: ${b(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":gy[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
+var za="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",nr="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",ti="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ga={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},go={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},l=Object.freeze({realpathAttempts:{cap:16384,...Ga},processedCandidateBytes:{cap:4194304,...Ga},pathEnvironmentExpansion:{cap:64,...Ga},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...go},trackedHeredocFiles:{cap:64,...go},scriptFiles:{cap:64,...go},controlFlowStates:{cap:64,...go},wrapperPeelIterations:{cap:20,...go},derivedCommandShape:go});class a extends Error{kind;name="AnalysisLimit";constructor(n){super(l[n].reason);this.kind=n}}function xn(){let n=new Map;return{counters:n,resolvedPaths:new Map,charge(u,b=1){let W=(n.get(u)??0)+b;if(n.set(u,W),W>l[u].cap)throw new a(u)}}}var fy=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function te(n){return qe(n.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function qe(n){return fy.reduce((u,b)=>u.replace(b,"<redacted>"),n.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function dt(n){return Id(n).reduceRight((u,b)=>`${u.slice(0,b.valueStart)}<redacted>${u.slice(b.valueEnd)}`,n)}function A(n){return qe(dt(n))}function Pt(n){return Id(n).map((u)=>n.slice(u.valueStart,u.valueEnd))}function pt(n){return/[A-Za-z_][A-Za-z0-9_]*=/.test(n)}function Id(n){return[...n.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((u)=>{let b=n[u.index-1];if(u.index>0&&b&&!/[\s"'([{]/.test(b))return[];let W=u.index+u[0].length;if(W>=n.length)return[];return[{valueStart:W,valueEnd:py(n,W)}]})}function py(n,u){if(n.startsWith("$(",u))return gy(n,u);let b=n[u];if(b==='"'||b==="'"){for(let z=u+1;z<n.length;z++){if(b==='"'&&n[z]==="\\"){z++;continue}if(n[z]===b)return z+1}return n.length}let W=u;while(W<n.length&&!/\s/.test(n[W]??""))W++;return W}function gy(n,u){let b=0,W;for(let z=u;z<n.length;z++){let B=n[z];if(W){if(W==='"'&&B==="\\"){z++;continue}if(B===W)W=void 0;continue}if(B==='"'||B==="'"){W=B;continue}if(B==="$"&&n[z+1]==="("){b++,z++;continue}if(B!==")")continue;if(b--,b===0)return z+1}return n.length}var hy={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yy(n){let u=n.maxLen??200,b=n.redact??((z)=>z),W=(z)=>z.length>u?`${z.slice(0,u)}...`:z;return[n.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${b(n.reason)}`,n.ruleId?`Rule: ${n.ruleId}`:void 0,n.toolName?`Tool: ${n.toolName}`:void 0,n.command?`Command: ${W(b(n.command))}`:void 0,n.segment&&n.segment!==n.command?`Segment: ${W(b(n.segment))}`:void 0,n.cwd?`Working directory: ${W(b(n.cwd))}`:void 0,n.configWarning?`Config warning: ${b(n.configWarning)}`:void 0,n.askUser?"Approve only if you expected this command.":hy[n.intent??"manual_only"]].filter((z)=>z!==void 0).join(`
 
-`)}function Fe(n,u){if(n.decision.kind!=="deny")return;let b=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:b?.command,segment:b?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function ne(n={}){return{reason:ti,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function q(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var yy={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...yy[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function re(n){return hy({...n,redact:te})}function _t(n){return te(n instanceof Error?n.message:String(n))}import{spawnSync as Qy}from"node:child_process";import{lstatSync as Jy,realpathSync as eS,statSync as tS}from"node:fs";import{isAbsolute as nS}from"node:path";import{homedir as rS,tmpdir as oS}from"node:os";import{statSync as Yy}from"node:fs";import{join as Zy}from"node:path";import{basename as Md,dirname as Sy,isAbsolute as Cy,join as by,normalize as Ey,resolve as kd}from"node:path";var vy=256,Qi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Cn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function dr(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function Ha(n,u){return $a(n,0,u)}function $a(n,u,b){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let ee=Ba(n,z+2),le=Ry(n,z,u);if(le===null){if(Qi.has(ee))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=wy(ue,u,b),z=le+1;continue}let Q=Ba(n,z+1);if(!Q){W+="$",z++;continue}W+=Ua(Q,b)??`$${Q}`,z+=Q.length+1}return W}function Ry(n,u,b){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,b+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function wy(n,u,b){let W=n.slice(2,-1),z=Ba(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return Ua(z,b)??n;let Q=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!Q){if(Qi.has(z))throw new a("pathEnvironmentExpansion");return n}if(!Qi.has(z))return n;if(Q.endsWith("="))throw new a("pathEnvironmentExpansion");let ee=Ua(z,b),le=Q.startsWith(":")?ee!==null&&ee!=="":ee!==null;if(Q.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(Q.endsWith("-")||Q.endsWith("?"))return le?ee??"":$a(B.slice(Q.length),u+1,b);return le?$a(B.slice(Q.length),u+1,b):""}function Ba(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let b=u+1;while(/[A-Za-z0-9_]/.test(n[b]??""))b++;return n.slice(u,b)}function Ua(n,u){if(!Qi.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function jt(n,u,b){if(!n)return n;let W=b.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){Dd(b,B);let Q=u.realpath(B);if(Q!==null)return Od(b,n,Q,z);let ee=Sy(B);if(ee===B||z.length>=vy)return Od(b,n,B,z);z.push(Md(B)),B=ee}}function Od(n,u,b,W){let z=W.length===0?b:by(b,...W.reverse());return n.resolvedPaths.set(u,z),z}function _y(n,u,b){let W=b.resolvedPaths.get(n);if(W!==void 0)return W;Dd(b,n);let z=u.realpath(n);if(z!==null)b.resolvedPaths.set(n,z);return z}function Dd(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function bn(n,u,b,W){let z=Ld(n,u,b);if(!z)return"";return jt(z,b.paths,W).replace(/\\/g,"/")}function Nd(n,u,b,W,z){let B=Ld(n,u,b);if(!B)return null;if(z(Md(B)))return jt(B,b.paths,W).replace(/\\/g,"/");let Q=_y(B,b.paths,W);return Q===null?null:Q.replace(/\\/g,"/")}function Ld(n,u,b){let W=b.home,z=Ha(n.trim(),b).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?kd(W,z.slice(2)):z,Q=Cn(B);return Ey(Cy(Q)?Q:kd(u,Q))}import{spawnSync as xy}from"node:child_process";import{accessSync as Wd,constants as Fd,existsSync as ni,lstatSync as Ay,opendirSync as Py,readFileSync as ri,realpathSync as ho,statSync as yo}from"node:fs";import{dirname as $d,isAbsolute as ja,join as zn,resolve as Ji}from"node:path";var Ty=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Iy=5000;function Bd(n,u=jy(),b=Iy){let W=ky(n),z=W===null?null:Oy(W);if(W===null||z===null)return null;let B=Uy(W,z,u,b);return B===null?null:{recursiveSubmodules:B}}function ky(n){try{let u=ho(Ji(n));return yo(u).isDirectory()?u:null}catch{return null}}function Oy(n){let u=By(n);if(!u)return null;try{let b=Ay(u);if(b.isSymbolicLink()||!b.isFile())return null;let W=Va(u);if(!W?.commonDir)return null;if(!Ny(W.gitDir,u))return null;return jd(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function Va(n){try{let u=My(n);if(!u)return null;let b=ho(ja(u)?u:Ji($d(n),u));if(!yo(b).isDirectory())return null;return{gitDir:b,commonDir:Dy(b)}}catch{return null}}function My(n){let u=ri(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function Dy(n){try{let u=ri(zn(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let b=ho(ja(u)?u:Ji(n,u));return yo(b).isDirectory()?b:null}catch{return null}}function Ny(n,u){let b=Ly(n);return b===null?!1:Wy(n,b,u)}function Ly(n){let u=zn(n,"gitdir");if(!ni(u))return null;let b=ri(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return b===""?null:b}function Wy(n,u,b){try{return Fy(ja(u)?u:Ji(n,u),b)}catch{return!1}}function Fy(n,u){try{let b=yo(n),W=yo(u);if(b.ino!==0&&W.ino!==0&&b.dev===W.dev&&b.ino===W.ino)return!0}catch{}return Gd(ho.native(n))===Gd(ho.native(u))}function Gd(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),b=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?b.toLowerCase():b}function Ud(n){try{return Wd(zn(n,"objects"),Fd.X_OK),Wd(zn(n,"refs"),Fd.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Vd(zn(n,"HEAD")))}catch{return!1}}function Hd(n){return ni(zn(n,"commondir"))||jd(n,n)}function jd(n,u){return[zn(u,"config"),zn(n,"config.worktree")].some(Gy)||$y(n)}var zd=1048576;function Vd(n){let u=yo(n);if(!u.isFile()||u.size>zd)throw Error(`${n} is not a regular file within ${zd} bytes`);return ri(n,"utf-8")}function Gy(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(Vd(n))}catch(u){return u.code!=="ENOENT"}}var zy=1e4;function $y(n){let u=[n],b=0;try{while(u.length>0){let W=u.pop(),z=Py(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(b++,B.isSymbolicLink()||B.isFIFO()||b>zy)return!0;let Q=W===n&&B.name==="objects";if(B.isDirectory()&&!Q)u.push(zn(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function By(n){try{return qa(ho(n))}catch{return null}}function qa(n){let u=n;while(!0){let b=zn(u,".git");if(ni(b))return b;let W=$d(u);if(W===u)return null;u=W}}function Uy(n,u,b,W){if(Hy(u))return!0;if(b===null)return!0;let z=xy(b,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:Vy(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&qd(z.stdout.trim())}function Hy(n){return[zn(n.commonDir,"config"),zn(n.gitDir,"config.worktree")].filter((u)=>ni(u)).some((u)=>qy(u))}function jy(){return Ty.find((n)=>ni(n))??null}function oi(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function Vy(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!oi(u)))}function qy(n){let u;try{u=ri(n,"utf-8")}catch{return!0}let b="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let Q=B.match(/^\[([^\]]+)\]$/);if(Q){b=Q[1]?.trim().toLowerCase()??"";continue}let ee=B.indexOf("="),le=(ee===-1?B:B.slice(0,ee)).trim().toLowerCase(),ue=ee===-1?"true":B.slice(ee+1).trim();if(Ky(b)&&le==="path")return!0;if(b==="submodule"&&le==="recurse")W=qd(ue)}return W}function Ky(n){return n==="include"||n.startsWith("includeif ")}function qd(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Kd(n,u){if(n==="")return null;let b=xn(),W=qa(bn(n,n,u,b)),z=W?Xy(W,n,u,b):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Xy(n,u,b,W){try{let z=bn(n,u,b,W),B=Yy(n),Q=B.isFile()?z:null,ee=B.isFile()?Va(n):null,le=(B.isDirectory()?[z]:[ee?.gitDir,ee?.commonDir]).flatMap((ve)=>ve?[So(bn(ve,u,b,W))]:[]),ue=[...new Set(B.isDirectory()?[So(n.replace(/\\/g,"/")),...le]:le)];return{entry:So(z),markerFile:Q?So(Q):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((ve)=>{let Oe=So(Zy(ve,"hooks").replace(/\\/g,"/"));return[Oe,So(bn(Oe,u,b,W))]}))]}}catch{return null}}function So(n){return process.platform==="win32"?n.toLowerCase():n}var iS={realpath:(n)=>{try{let u=eS(n);return nS(u)?u:null}catch{return null}},entryKind:(n)=>{try{let u=Jy(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return tS(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return aS({env:new Map(Object.entries(process.env).flatMap(([u,b])=>b===void 0?[]:[[u,b]])),home:Cn(process.env.HOME||rS()),tmpdir:oS(),darwinUserTempDir:()=>es(n,"",sS),paths:iS})}function sS(){if(process.platform!=="darwin")return null;let n=Qy("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function aS(n,u={}){let b=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(Q)=>es(b,Q,()=>Kd(Q,B)),worktreeFacts:(Q)=>es(W,Q,()=>Bd(Q)),isGitDirectory:Ud,gitDirectoryRedirects:(Q)=>es(z,Q,()=>Hd(Q)),...u};return B}function es(n,u,b){let W=n.get(u);if(W!==void 0)return W;let z=b();return n.set(u,z),z}var Co=["fail_closed","paranoid_rm","paranoid_interpreters"],ts={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},ns=["standard","strict","paranoid"];function Yd(n,u){if(!u)return n;return ns.indexOf(u)>ns.indexOf(n)?u:n}function Zd(n){let u=xe(r.level,n);return ns.find((b)=>b===u)}function Xd(n,u){return Yd(n,Zd(u))}function lS(n){let u=xe(r.level,n);if(!u)return;let b=Zd(n);if(b)return b;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${ns.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function $e(n){return ft(xe(r.auditScope,n))==="all"}function Ka(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let b=n.safety?.level??"standard",W=lS(u),z=Yd(b,W),B=ts[z],Q={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},ee={failClosed:z===b?"preset":"environment",paranoidRm:z===b?"preset":"environment",paranoidInterpreters:z===b?"preset":"environment"},le={failClosed:[`policy safety.level=${b}`],paranoidRm:[`policy safety.level=${b}`],paranoidInterpreters:[`policy safety.level=${b}`]};if(z!==b)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)Q.failClosed=n.safety.overrides.failClosed,ee.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)Q.paranoidRm=n.safety.overrides.paranoidRm,ee.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)Q.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,ee.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))Q.failClosed=!0,ee.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))Q.paranoidRm=!0,Q.paranoidInterpreters=!0,ee.paranoidRm="environment",ee.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))Q.paranoidRm=!0,ee.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))Q.paranoidInterpreters=!0,ee.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:Q.failClosed,paranoidRm:Q.paranoidRm,paranoidInterpreters:Q.paranoidInterpreters,worktreeMode:ue,effectiveLevel:Ka(Q),capabilities:{fail_closed:{enabled:Q.failClosed,source:ee.failClosed,sources:le.failClosed},paranoid_rm:{enabled:Q.paranoidRm,source:ee.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:Q.paranoidInterpreters,source:ee.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let b=typeof n==="string"?ii(n,u):xe(n,u);return b==="1"||b?.toLowerCase()==="true"}function ii(n,u){return u.get(n)}function xe(n,u){let b=ii(n.name,u);if(b!==void 0)return b;if(n.legacyName)return ii(n.legacyName,u);return}function At(n,u){return ii(n.name,u)!==void 0||!!n.legacyName&&ii(n.legacyName,u)!==void 0}import{dirname as Br}from"node:path";import{closeSync as cS,constants as si,fstatSync as Ya,fsyncSync as dS,lstatSync as $n,mkdirSync as Qd,openSync as Jd,readdirSync as Xa,readFileSync as uS,realpathSync as bo,renameSync as mS,rmdirSync as eu,statSync as Za,unlinkSync as Qa,writeFileSync as fS}from"node:fs";import{isAbsolute as tu,join as Fr,normalize as pS,parse as rs,relative as Ja,resolve as el,sep as os}from"node:path";function Ve(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var gS=Symbol("PolicyFilesystemScope"),hS=Symbol("PolicyFilesystemTarget"),nu=si.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[gS]:!0,root:el(n),label:u}}function ai(n,u){let b=pS(u);if(u===""||tu(u)||b===".."||b.startsWith(`..${os}`))throw new i(n.label);return{[hS]:!0,scope:n,relativePath:b,path:Fr(n.root,b)}}function s(n,u){return ai(n,Ja(n.root,el(u)))}function de(n,u="rules policy"){let b=el(n),W=rs(b).dir;return ai(R(W,u),Ja(W,b))}function o(n){return ur(n.scope.label,()=>{if(!pn(n))return null;let u=Jd(n.path,si.O_RDONLY|nu);return ou(u,()=>{let b=Ya(u);if(!b.isFile())throw new i(n.scope.label);let W=uS(u,"utf-8"),z=$n(n.path);if(!z.isFile()||z.isSymbolicLink()||b.dev!==z.dev||b.ino!==z.ino)throw new i(n.scope.label);return pn(n),W})})}function v(n,u,b=384,W){let z=`${n.path}.${Ve()}.tmp`;ur(n.scope.label,()=>{SS(n),pn(n);let B=Jd(z,si.O_CREAT|si.O_EXCL|si.O_WRONLY|nu,b),Q=ou(B,()=>{let ee=Ya(B);if(!ee.isFile())throw new i(n.scope.label);fS(B,u,"utf-8"),dS(B);let le=Ya(B);if(!le.isFile()||le.dev!==ee.dev||le.ino!==ee.ino)throw new i(n.scope.label);return le});pn(n),bS(n,z,Q.dev,Q.ino),mS(z,n.path),W?.(n.path),pn(n)},()=>ES(z))}function ru(n,u){if(n.path===u.path)return!0;return ur(n.scope.label,()=>{if(!pn(n)||!pn(u))return!1;let b=(W)=>Fr(bo(rs(W).dir),rs(W).base);return b(n.path)===b(u.path)})}function Se(n){let u=ur(n.scope.label,()=>{if(!pn(n,"directory"))return null;let b=Xa(n.path);return pn(n,"directory"),b});if(!u)return null;return ur(n.scope.label,()=>{let b=u.map((W)=>{let z=ai(n.scope,Fr(n.relativePath,W)),B=$n(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return is(tl(n.scope),bo(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return pn(n,"directory"),b})}function V(n){ur(n.scope.label,()=>{if(!pn(n))return;Qa(n.path),pn(n)})}function It(n){ur(n.scope.label,()=>{if(!yS(n))return;su(n),pn(n,"directory")})}function Ot(n){ur(n.scope.label,()=>{if(!pn(n,"directory"))return;eu(n.path),pn(n,"directory")})}function yS(n){return ur(n.scope.label,()=>{if(!pn(n,"directory"))return!1;return iu(n),!0})}function ur(n,u,b){try{return u()}catch(W){if(b?.(),W instanceof i)throw W;throw new i(n)}}function ou(n,u){try{return u()}finally{cS(n)}}function pn(n,u="file"){let b=au(n.scope);if(!b)return!1;let W=n.relativePath.split(os);for(let z of W.keys()){let B=Fr(n.scope.root,...W.slice(0,z+1)),Q=$n(B,{throwIfNoEntry:!1});if(!Q)return!1;if(Q.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!Q.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!Q.isFile():!Q.isDirectory()))throw new i(n.scope.label);is(b,bo(B),n.scope.label)}return!0}function iu(n){for(let u of Xa(n.path)){let b=ai(n.scope,Fr(n.relativePath,u)),W=$n(b.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())iu(b)}pn(n,"directory")}function su(n){for(let u of Xa(n.path)){let b=ai(n.scope,Fr(n.relativePath,u)),W=$n(b.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){su(b);continue}if(!W.isFile())throw new i(n.scope.label);Qa(b.path)}eu(n.path)}function SS(n){CS(n.scope);let u=tl(n.scope),b=n.relativePath.split(os).slice(0,-1);for(let W of b.keys()){let z=Fr(n.scope.root,...b.slice(0,W+1));if(!$n(z,{throwIfNoEntry:!1}))Qd(z,{mode:448});let B=$n(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);is(u,bo(z),n.scope.label)}}function CS(n){if($n(n.root,{throwIfNoEntry:!1})){if(!Za(n.root).isDirectory())throw new i(n.label);return}let u=[],b=n.root;while(!$n(b,{throwIfNoEntry:!1})){u.unshift(b);let W=rs(b).dir;if(W===b)throw new i(n.label);b=W}if(!Za(b).isDirectory())throw new i(n.label);for(let W of u){Qd(W,{mode:448});let z=$n(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function au(n){if(!$n(n.root,{throwIfNoEntry:!1}))return null;if(!Za(n.root).isDirectory())throw new i(n.label);return bo(n.root)}function tl(n){let u=au(n);if(!u)throw new i(n.label);return u}function bS(n,u,b,W){let z=$n(u);if(!z.isFile()||z.isSymbolicLink()||z.dev!==b||z.ino!==W)throw new i(n.scope.label);is(tl(n.scope),bo(u),n.scope.label)}function is(n,u,b){let W=Ja(n,u);if(W===".."||W.startsWith(`..${os}`)||tu(W))throw new i(b)}function ES(n){try{Qa(n)}catch{}}import{dirname as Gr,isAbsolute as xS,join as zr,relative as AS,resolve as wr,sep as PS}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,we="rulebook.json",Ce=".cc-safety-net/rules";var lu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,vS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,cu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,RS=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),wS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Dt=new RegExp(`^${RS}/(${m.source.slice(1,-1)})/${wS}$`);function _S(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function du(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(lu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let b=u[3].lastIndexOf("/");if(b<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,b),z=u[3].slice(b+1);if(!W||!cu.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:_S(z),name:z}}function oe(n){return vS.test(n)}function pe(n){return cu.test(n)}function T(n){return lu.test(n)}function Nt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var uu="rule.json",ss="policy.json",mu=".cc-safety-net",TS="rules",IS="CC_SAFETY_NET_HOME",fu="`cc-safety-net rule update`";function kS(n){return wr(n,Ce)}function D(n){return zr(kS(n),uu)}function x(n){return zr(wr(n),mu,ss)}function fe(n,u={}){return u.userConfigDir??(u.userConfigPath?Gr(u.userConfigPath):zr(OS(n),TS))}function OS(n){let u=n.env.get(IS);return u?wr(Cn(u)):zr(n.home,mu)}function K(n,u={}){return zr(fe(n,u),uu)}function p(n,u={}){return zr(Gr(fe(n,u)),ss)}function L(n,u){let b=xn();return jt(x(u.cwd),n.paths,b)===jt(wr(p(n,u)),n.paths,b)}function ie(n,u){let b=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=mt(n,u),B=gt(W,u.cwd);return{userConfigPath:b,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,b),projectConfigTarget:s(B,W)}}function mt(n,u){let b=u.userConfigPath?Gr(Gr(wr(u.userConfigPath))):Gr(wr(u.userConfigDir??fe(n,u)));return R(b,"user policy")}function gt(n,u){let b=wr(u),W=wr(n),z=AS(b,W);if(z!==".."&&!z.startsWith(`..${PS}`)&&!xS(z))return R(b,"project policy");return R(Gr(Gr(W)),"project policy")}function U(n,u){return zr(n,u,we)}var Nn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,nn=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),pu=new Set(["python","python3","python2","node","ruby","perl"]),as=/^python(?:[23](?:\.\d+)*)?$/,Bn=new Set(["awk","gawk","nawk","mawk"]),ls=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]),cs=new Set(["curl","wget","aria2c","http","https","xh","xhs","httpie","fetch","lwp-request","nc","ncat","netcat","socat","telnet"]);var gu="Rulebook exceeds CC Safety Net's safe validation limits.",hu="Additional rulebook validation errors were omitted.",qn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function yu(n){if(nl(n.allowed_commands,qn.maxAllowedCommands)||nl(n.rules,qn.maxRules)||nl(n.tests,qn.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:b}=qn,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>qn.maxStringCodeUnits||B&&z.length>qn.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let Q=B.match&&typeof B.match==="object"?B.match:{};for(let ee of[B.block_args,Q.command_path,Q.any_args,Q.exclude_args]){if(!Array.isArray(ee))continue;if(ee.length>qn.maxBlockArgsPerRule||ee.length>b)return!1;b-=ee.length;for(let le of ee)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function nl(n,u){return Array.isArray(n)&&n.length>u}var rl=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ee=64,ke="Rule config exceeds CC Safety Net's safe source limit.";function Bt(n){return Wt(n).toLowerCase()}function Wt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function An(n,u){let b=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let Q=z[B];if(!Q||!/[a-zA-Z]/.test(Q))break;let ee=`-${Q}`;if(b.add(ee),u?.shortOptsWithValue?.has(ee))break}}return b}var MS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ol=new Set(["--init-file","--rcfile"]);function il(n,u,b,W){let z=!1,B=0,Q=!1,ee=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let ve=u.slice(le+1);if(u[0]==="-"&&(ve==="c"||ve[0]==="-"&&ve.endsWith("c")))Q=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(b?.startsWith("-")||b?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")Q=!0;if(W==="argv"&&ue==="s")ee=u[0]==="-";if(!MS[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:Q,stdinMode:ee}}function Pn(n){let u=Wt(n[0]??"").toLowerCase(),b=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let ee=b&&n[z+1]!==void 0?z+1:null;return{command:ee===null?null:n[ee]??null,commandIndex:ee,scriptIndex:!b&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!b&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:b?B:null,commandIndex:b?z:null,scriptIndex:!b&&!W&&B!=="-"?z:null,readsStdinAsCommands:!b&&(W||B==="-")};if(B.startsWith("--")){let ee=B.split("=",1)[0]??B;if(u==="bash"&&ol.has(ee)&&!B.includes("="))z++;continue}let Q=il(u,B,n[z+1],"argv");if(Q.commandSelected)b=!0;if(Q.stdinMode)W=!0;z+=Q.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!b}}function li(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function ds(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let b of DS(n))li(b,u);return u.inSingle||u.inDouble}function DS(n){let u="",b={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let Q=n[B];if(!Q)break;if(W){if(Q===`
-`||Q==="\r")u+=Q,W=!1,b.escaped=!1;continue}if(Q==="#"&&!b.inSingle&&!b.inDouble&&z){W=!0;continue}if(u+=Q,!b.inSingle&&!b.inDouble&&!b.escaped)z=/[\s;&|()<>]/.test(Q);li(Q,b)}return u}var sl=new Set(["rm","find","rsync","xargs","parallel"]),NS=new Set(["git","busybox",...sl,...nn,...pu,...Bn]),LS=new Set(["python","node","ruby","perl"]);function Ke(n){let u=Bt(n);return NS.has(u)||Ln(u)}function Ln(n){return LS.has(WS(n))}function WS(n){let u=Wt(n).toLowerCase();return as.test(u)?"python":u}var me={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(FS(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let b=JSON.parse(u),W=ht(b);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:b.rules??[],overrides:b.overrides??{},transparent_wrappers:b.transparent_wrappers??[],...b.command_tools?{command_tools:b.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let b=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":b]}}}function FS(n){return typeof n==="string"?de(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),dn=(n,u)=>({path:n,message:u,kind:"custom"});function Je(n){let u=new Set;return n.flatMap((b,W)=>{let z=$r(b)?b.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[dn(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var je=`must be one of ${rl.join(", ")}`,GS=/^[^/]+\/[^/]+$/,zS=["version","rules","overrides","transparent_wrappers","command_tools"],Ye=/^[^\s\p{Cc}]{1,256}$/u,Re="non-empty, at most 256 characters, no whitespace or control characters";function ht(n){let u=$S(n);return{errors:ge(yt(u,zS,(b)=>b.kind==="custom"),": "," "),sources:ZS(n,u)}}function $S(n){if(!$r(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>Ee;return[...n.version===1?[]:[e(["version"],"must be 1")],...BS(n.rules,u),...jS(n.overrides),...qS(n.transparent_wrappers),...u?[]:HS(n.rules),...$r(n.overrides)?Object.keys(n.overrides).filter((b)=>!GS.test(b)).map((b)=>dn(["overrides",b],"must use <rulebook-name>/<rule-name>")):[],...KS(n.transparent_wrappers),...YS(n.command_tools)]}function BS(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...Su(n,Ee)?[e(["rules"],ke)]:[]];if(u)return[{path:["rules"],message:ke,kind:"limit"}];return n.flatMap((b,W)=>{if(typeof b!=="string")return[e(["rules",W],"must be a rulebook source string"),...US(b,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return b===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function Su(n,u){let b=Cu(n);return b!==void 0&&!(b<=u)}function US(n,u){let b=Cu(n);return b!==void 0&&!(b>=u)}function Cu(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function HS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((b,W)=>{if(typeof b!=="string"||b==="")return[];if(b.trim()==="")return[dn(["rules",W],"must be a non-empty rulebook source string")];let z=du(b);if(z)return[dn(["rules",W],z)];if(u.has(b))return[dn(["rules",W],`duplicate rulebook source "${b}"`)];return u.add(b),[]})}function jS(n){if(n===void 0)return[];if(!$r(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let b=n[u];if(b==="off")return[];if(!$r(b))return[e(["overrides",u],'must be "off" or an object')];return[...VS(b.reason,["overrides",u,"reason"]),...b.intent===void 0||Ue(b.intent)?[]:[e(["overrides",u,"intent"],je)]]})}function VS(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...Su(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function qS(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,b)=>{if(typeof u!=="string")return[e(["transparent_wrappers",b],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",b],"must match command pattern")]})}function KS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((b,W)=>{if(typeof b!=="string"||!P.test(b))return[];if(u.has(b))return[dn(["transparent_wrappers",W],`duplicate command "${b}"`)];if(Ke(b))return[dn(["transparent_wrappers",W],`reserved command "${b}" cannot be a wrapper`)];return u.add(b),[]})}function YS(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,b=(W,z)=>{if(u.has(W))return[dn(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return al(W)?b(W,z):[e(["command_tools",z],`must be a tool name: ${Re}`)];if(!$r(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...al(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Re}`)],...W.cwd===void 0||W.cwd===!1||al(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name or false: ${Re}`)]];return B.length>0?B:b(W.name,z)})}function al(n){return typeof n==="string"&&Ye.test(n)}function ZS(n,u){let b=$r(n)?n.rules:void 0;if(!Array.isArray(b))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(b.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function yt(n,u,b){let W=n.map((Q)=>Q.path[1]),z=[...new Set(W.filter((Q)=>typeof Q==="string"))],B=(Q,ee)=>[Q.path.length===0?-1:u.indexOf(String(Q.path[0])),typeof ee==="number"?ee:z.indexOf(String(ee)),b(Q)?0:1];return n.map((Q,ee)=>({issue:Q,rank:B(Q,W[ee])})).sort((Q,ee)=>Q.rank[0]-ee.rank[0]||Q.rank[1]-ee.rank[1]||Q.rank[2]-ee.rank[2]).map((Q)=>Q.issue)}function ge(n,u,b){return[...new Set(n.map((W)=>{let z=ll(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?b:u}${W.message}`}))]}function ll(n){return n.map((u,b)=>{if(typeof u==="number")return`[${u}]`;return b===0?String(u):`.${String(u)}`}).join("")}function Ue(n){return rl.includes(n)}function $r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function he(n){let u=JS(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var XS=`required non-empty string up to ${M} characters`,bu="must be a non-empty array of unique non-empty strings",QS="required non-empty array of non-empty strings";function JS(n){if(!_r(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!yu(n))return{errors:[gu],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ge(eC(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>qn.maxValidationErrors?[...u.slice(0,qn.maxValidationErrors),hu]:u,ruleNames:new Set(Ze(n).map((b)=>b.toLowerCase()))}}function Ze(n){let u=_r(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((b)=>{let W=_r(b)?b.name:void 0;return typeof W==="string"?[W]:[]})}function eC(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],...tC(n.allowed_commands),...nC(n.rules,u),...sC(n.tests),...aC(n),...lC(n)]}function tC(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((b,W)=>typeof b==="string"&&P.test(b)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((b,W)=>{if(typeof b!=="string"||!P.test(b))return[];if(u.has(b))return[dn(["allowed_commands",W],`duplicate command "${b}"`)];return u.add(b),[]})]}function nC(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((b,W)=>{if(!_r(b))return[e(["rules",W],"must be an object")];return u?oC(b,["rules",W]):rC(b,["rules",W])}),...Je(n)]}function rC(n,u){return[...Eu(n.name,u),...vu(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...us(n.block_args,[...u,"block_args"],"required non-empty array",!1),...Ru(n.reason,u),...wu(n.intent,u)]}function oC(n,u){return[...Eu(n.name,u),...vu(n.command,u),...Ru(n.reason,u),...wu(n.intent,u),...iC(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function Eu(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function vu(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function Ru(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],XS)]}function wu(n,u){return n===void 0||Ue(n)?[]:[e([...u,"intent"],je)]}function iC(n,u){if(!_r(n))return[e(u,"required object")];return[...us(n.command_path,[...u,"command_path"],QS,!1),...n.any_args===void 0?[]:us(n.any_args,[...u,"any_args"],bu,!0),...n.exclude_args===void 0?[]:us(n.exclude_args,[...u,"exclude_args"],bu,!0)]}function us(n,u,b,W){if(!Array.isArray(n))return[e(u,b)];let z=n.flatMap((B,Q)=>{if(typeof B!=="string")return[e([...u,Q],"must be a non-empty string")];return B===""?[dn([...u,Q],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[dn(u,b)]:[],...W&&new Set(n).size!==n.length?[dn(u,"must not contain duplicate values")]:[]]}function sC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,b)=>{if(!_r(u))return[e(["tests",b],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",b,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",b,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",b,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[dn(["tests",b,"rule"],"required string for blocked fixtures")]:[]]})}function aC(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ze(n));return[...new Set(n.tests.flatMap((b)=>_r(b)&&b.expect==="blocked"&&typeof b.rule==="string"?[b.rule]:[]))].filter((b)=>!u.has(b)).map((b)=>dn(["tests"],`blocked fixture references unknown rule "${b}"`))}function lC(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((b)=>typeof b==="string"));return n.rules.flatMap((b,W)=>{let z=_r(b)?b.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[dn(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function _r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function Lt(n,u,b){return J(n,{cwd:u}).command_tools.some((W)=>W.name===b&&W.cwd===!1)}function J(n,u){let b=ie(n,u),W;try{W=ru(b.userConfigTarget,b.projectConfigTarget)}catch(Me){if(Me instanceof i)return SC(b,Me.message);throw Me}let z=f(b.userConfigTarget),B=W?{config:null,errors:[]}:f(b.projectConfigTarget),Q=Au(b.userConfigPath,z.errors),ee=Au(b.projectConfigPath,B.errors),le=new Set,ue=z.config?cl(z.config,Br(b.userConfigPath),"user",b.userScope,le):Pu(),ve=B.config?cl(B.config,Br(b.projectConfigPath),"project",b.projectScope,le):Pu(),Oe=z.config?.overrides??{},De=B.config?.overrides??{};return{rules:[...xu(ue.rules,Oe),...xu(ve.rules,De)],transparent_wrappers:gC(z.config,B.config),command_tools:hC(z.config,B.config),rulebooks:[...ue.rulebooks,...ve.rulebooks],errors:[...Q,...ee,...ue.errors,...ve.errors],warnings:[...ue.warnings,...ve.warnings,...ue.canValidateOverrides?dl(Oe,ue.knownRuleIds,b.userConfigPath):[],...ue.canValidateOverrides?yC(De,ue.knownRuleIds,b.projectConfigPath):[],...ve.canValidateOverrides?dl(De,ve.knownRuleIds,b.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...b}}function Y(n,u){let b=cC(n,u);if(!b)return[];return[...b.scope.errors,...b.scope.warnings,...dC(b.config,b.scope,n)]}function cC(n,u){let b=u??R(Br(Br(n)),"rules policy"),W=f(s(b,n)).config;if(!W)return null;return{config:W,scope:cl(W,Br(n),"project",b)}}function dC(n,u,b){return u.canValidateOverrides?dl(n.overrides??{},u.knownRuleIds,b):[]}function cl(n,u,b,W=R(Br(Br(u)),b==="user"?"user policy":"project policy"),z=new Set){let B=[],Q=[],ee=n.rules.flatMap((ue)=>{let ve=mC(ue,u,W);if(ve.errors.length>0||!ve.rulebook)return B.push(...ve.errors),[];let Oe=ve.rulebook;if(z.has(Oe.name))return Q.push(`duplicate active rulebook name "${Oe.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(Oe.name),[{rules:uC(Oe),rulebook:{source:b,spec:ue,name:Oe.name,version:Oe.version,rules:Oe.rules.map((De)=>`${Oe.name}/${De.name}`)}}]}),le=ee.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:ee.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:Q,canValidateOverrides:B.length===0}}function uC(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function mC(n,u,b){let W=Xe(n),z=U(u,W),B=pC(z,b);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${fC(n)}`]};let Q=Te(B.content);if("problem"in Q)return{rulebook:null,errors:[`invalid rulebook ${z}: ${Q.problem}; fix that file`]};if(Q.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${Q.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:Q.rulebook,errors:[]}}function Xe(n){return T(n)?j(n).name:n}function fC(n){return T(n)?`run ${fu} to vendor ${n}`:"create that file or remove that source from the rules config"}function pC(n,u){try{return{content:o(s(u,n))}}catch(b){if(b instanceof i)return{error:b.message};throw b}}function Te(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:he(u)}}catch(b){return{problem:b instanceof Error?b.message:"invalid rulebook"}}}function gC(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function hC(n,u){let b=(n?.command_tools??[]).map(_u),W=(u?.command_tools??[]).map(_u);return[...b,...W.filter((z)=>!b.some((B)=>B.name===z.name))]}function _u(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function xu(n,u){return n.flatMap((b)=>{let W=u[b.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...b,intent:W.intent??b.intent,reason:W.reason}];return[b]})}function dl(n,u,b){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${b}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function yC(n,u,b){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${b}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Au(n,u){return u.map((b)=>b.startsWith("Unable to access ")?b:`${n}: ${b}`)}function SC(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function Pu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{types as CC}from"node:util";var bC=new Set(["applypatch","patch"]),EC=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),vC=new Set(["grep","grepsearch","rg"]),RC=new Set(["find","findbyname","glob"]),wC=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),_C=new Set(["command","diff","input","patch","patchtext"]),Tu=new TextEncoder,xC=new TextDecoder,AC=/\s/,PC=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var ci=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function He(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function fs(n){return wC.has(He(n))}function S(n){let u=He(n);if(bC.has(u))return"patch";if(vC.has(u))return"grep";if(RC.has(u))return"glob";if(EC.has(u))return"path";return"unknown"}function ye(n){if(!n||typeof n!=="object")return;zu(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)rr();return}if(u.get||u.set)rr();let b=u.value;return typeof b==="string"&&b!==""?b:void 0}function Du(n,u){return Nu(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Nu(n,u,b,W,z){let B=Gu(n,W,z);if(typeof n==="string")return b?[n]:[];if(!B)return[];let Q=B.entries.flatMap(([ee,le])=>Nu(le,u,B.array?b:u.has(Lu(ee)),W,z+1));return W.ancestors.delete(B.object),Q}function Lu(n){return n.replace(/-/g,"_").toLowerCase()}function Wu(n){return Fu(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(IC)}function Fu(n,u,b,W){let z=Gu(n,b,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([Q,ee])=>Fu(ee,z.array?u:_C.has(Lu(Q)),b,W+1));return b.ancestors.delete(z.object),B}function TC(n,u,b){if(u.nodes++,n!==null&&typeof n==="object"&&b>ci.maxDepth||u.nodes>ci.maxNodes)rr();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>ci.maxStringBytes||u.stringBytes>ci.maxAggregateStringBytes)rr()}function Gu(n,u,b){if(TC(n,u,b),!n||typeof n!=="object")return null;let W=zu(n);if(u.ancestors.has(n))rr();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>ci.maxKeys)rr();let B=z.flatMap((Q)=>{let ee=Object.getOwnPropertyDescriptor(n,Q);if(!ee||ee.get||ee.set)rr();return typeof Q==="string"&&ee.enumerable?[[Q,ee.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function zu(n){if(CC.isProxy(n))rr();let u=Array.isArray(n),b=Object.getPrototypeOf(n);if(u&&b!==Array.prototype||!u&&b!==Object.prototype&&b!==null)rr();return u}function rr(){throw new h}function IC(n){let u=[],b=n.split(/\r?\n/),W=!1,z=!1,B=null,Q=null,ee=()=>{z=!1,B=null,Q=null};for(let le=0;le<b.length;le++){let ue=b[le]??"";if(ue==="*** Begin Patch"){W=!0,ee();continue}if(ue==="*** End Patch"){W=!1,ee();continue}if(ue.startsWith("@@")){let ve=kC(ue);if(z=!0,B=ve?.oldLines??null,Q=ve?.newLines??null,B===0&&Q===0)ee();continue}if(z&&B!==null&&Q!==null){let ve=ue.startsWith(" ")||ue.startsWith("-")?1:0,Oe=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-ve),Q=Math.max(0,Q-Oe),B===0&&Q===0)ee();continue}if(ue.startsWith("*** ")){ee(),u.push(...ul(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...ul(ue));continue}if(ue.startsWith("--- ")){let ve=b[le+1]??"";if(!ve.startsWith("+++ "))continue;u.push(...fl(ms(ue.slice(4),!0),ms(ve.slice(4),!0))),le++;continue}if(!W)u.push(...ul(ue))}return u}function kC(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function ul(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return Mu(u[1]);let b=/^\*\*\* Move to: (.+)$/.exec(n);if(b?.[1])return Mu(b[1]);if(n.startsWith("diff --git "))return OC(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return Ou(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return Ou(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return GC(B[1]);return[]}function OC(n){let u=MC(n);if(u.length===2&&u[0]&&u[1])return fl(u[0],u[1]);let b=DC(n);return b?fl(n.slice(b.oldStart,b.oldEnd),n.slice(b.newStart,b.newEnd)):[]}function MC(n){let u=[],b=0;while(b<n.length&&u.length<2){while(Ur(n[b]))b++;if(b>=n.length)break;let W=n[b]==='"'||n[b]==="'"?n[b]:void 0;if(!W){let B=b;while(b<n.length&&!Ur(n[b]))b++;u.push(n.slice(B,b));continue}let z=$u(n,b,W);if(!z)return[];u.push(z.value),b=z.end}while(Ur(n[b]))b++;return b===n.length?u:[]}function DC(n){let u=0;while(u<n.length&&Ur(n[u]))u++;let b=n.length;while(b>u&&Ur(n[b-1]))b--;let W=0,z=u;while(z<b){if(!Ur(n[z])){z++;continue}let B=z;while(z<b&&Ur(n[z]))z++;if(B===u||z===b)continue;if(W++,W>PC)rr();if(NC(n,u,B,z,b))return{oldStart:u,oldEnd:B,newStart:z,newEnd:b}}return null}function NC(n,u,b,W,z){if(ml(n,u,b,W,z))return!0;let B=Iu(n,"/",u,b),Q=Iu(n,"/",W,z);if(B<=u||Q<=W)return!1;if(ml(n,u,B,W,Q))return!1;return ml(n,B+1,b,Q+1,z)}function ml(n,u,b,W,z){if(b-u!==z-W)return!1;for(let B=0;B<b-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function Iu(n,u,b,W){for(let z=b;z<W;z++)if(n[z]===u)return z;return-1}function Ur(n){return n!==void 0&&AC.test(n)}function $u(n,u,b){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===b)return{value:xC.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||b==="'"){W.push(...Tu.encode(B)),z+=B.length;continue}let Q=n.slice(z+1),ee=/^[0-7]{1,3}/.exec(Q)?.[0];if(ee){W.push(Number.parseInt(ee,8)),z+=ee.length+1;continue}W.push(...Tu.encode(LC(Q[0]??""))),z+=2}return null}function LC(n){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n}function WC(n){return di(zC(n))}function fl(n,u){if(n==="/dev/null")return ku(u);if(u==="/dev/null")return ku(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(di);let b=FC(n,u)??(n===u?Bu(n):null);return[n,u,...b?[b]:[]].flatMap(di)}function ku(n){let u=Bu(n);return[n,...u?[u]:[]].flatMap(di)}function Bu(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function FC(n,u){let b=n.indexOf("/"),W=u.indexOf("/");if(b<1||W<1)return null;if(n.slice(0,b)===u.slice(0,W))return null;let z=n.slice(b+1);return z===u.slice(W+1)?z:null}function Ou(n){return WC(ms(n,!0))}function GC(n){return di(ms(n,!1))}function ms(n,u){let b=n.trim(),W=b[0]==='"'||b[0]==="'"?b[0]:void 0;if(W){let z=$u(b,0,W);if(z&&(u||b.slice(z.end).trim()===""))return z.value}return u?b.split("\t",1)[0]?.trim()??"":b}function zC(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function di(n){return n===""||n==="/dev/null"?[]:[n]}function Mu(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}import{accessSync as $C,constants as Uu,statSync as BC}from"node:fs";import{isAbsolute as pl,relative as UC,resolve as Hu,sep as HC}from"node:path";function Pe(n){try{if(!BC(n).isDirectory())return!1;return $C(n,Uu.R_OK|Uu.X_OK),!0}catch{return!1}}function Mt(n,u,b){if(dr(n))return;let W=u.flatMap((B)=>ps(B,b));if(!W[0])return;let z=ps(pl(n)?n:Hu(W[0],n),b)[0];if(!z)return;return W.some((B)=>jC(z,B))?z:void 0}function ju(n,u,b){if(dr(n))return;return ps(pl(n)?n:Hu(u,n),b)[0]}function bt(n,u){return n.flatMap((b)=>ps(b,u))[0]}function ps(n,u){let b=u.realpath(n);if(b===null)return[];return u.isDirectory(b)?[b]:[]}function jC(n,u){let b=UC(u,n);return b===""||b!==".."&&!b.startsWith(`..${HC}`)&&!pl(b)}var VC=8388608;async function vt(n){let u=[],b=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(b+=z.byteLength,b>VC)throw qC(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,b).toString("utf-8")}function qC(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,b,W,z){if(b.kind!=="command")return{toolName:n,input:u,route:b,context:W};return{toolName:n,input:u,route:b,context:W,command:z}}import{existsSync as ob,readFileSync as ib}from"node:fs";var Vu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"network.cloud-metadata",category:"Network",label:"Cloud metadata endpoint",description:"Blocks HTTP clients, raw socket tools, and code interpreters naming a cloud metadata host (169.254.169.254, fd00:ec2::254, 169.254.170.2, 169.254.170.23, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200).",example:"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",intent:"manual_only"},{id:"network.upload-remote",category:"Network",label:"Data upload to a remote host",description:"Blocks curl and wget requests that send a body or upload a file in strict mode unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]).",example:"curl -T backup.tar https://uploads.example.com/",intent:"manual_only",activationCapability:"fail_closed"},{id:"unshare.user-namespace",category:"Execution",label:"unshare user namespace",description:"Blocks unshare creating a user namespace: -U/--user, -r/--map-root-user, -c/--map-current-user, --map-user(s), --map-group(s), or --map-auto.",example:"unshare -r id",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],gl=new Set(Vu.map((n)=>n.id)),Z=Vu,KC=new Map(Z.map((n)=>[n.id,n.intent]));function st(n,u){return{id:n,reason:u,intent:KC.get(n)??"manual_only"}}var hl=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],gs={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},YC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],ZC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],yl=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...ZC.flatMap((n)=>YC.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var hs=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml","<project>/.codex/config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],qu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],XC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Sl=qu.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),Cl=qu.flatMap((n)=>XC.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),ui={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},bl=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),El=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...hl,gs,...yl,...Sl,...Cl,ui,...bl,...El,...hs].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),ys=new Set(hs.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),vl=new Set(xt.map((n)=>n.id));import{isAbsolute as Rl,join as QC,normalize as JC,sep as Ss}from"node:path";var Cs=process.platform==="win32",Ku=/[*?]/;function wl(n){let u=n.trim(),b=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Cs?u.replaceAll("\\","/"):u);if(!b)return null;let W=b[1]??"",z=b[2]??"";if(Ku.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function mi(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function _l(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let b=mi(n.trim(),u);if(!Rl(b))return"must be an absolute path or start with ~/";return fi(b,u)}function xl(n,u){let b=Yu(n,u);if(b===null)return"must be a non-empty path string";if(!Rl(b))return null;if(fi(b,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var eb="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",tb="cannot cover the guard's own configuration";function Yu(n,u){if(typeof n!=="string"||n.trim()==="")return null;let b=n.trim(),W=Cs?b.replaceAll("\\","/"):b;return mi(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function Al(n,u){let b=Yu(n,u);if(b===null)return"must be a non-empty path string";let W=wl(b)?.root??b;if(Ku.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Rl(W))return null;if(fi(W,u)!==null)return eb;return nb(W,u)?tb:null}function nb(n,u){let b=bs(n),W=bs(QC(u,".cc-safety-net"));return b===W||b.startsWith(`${W}${Ss}`)}function fi(n,u){let b=bs(n),W=bs(u);if(b===W)return"cannot be the home directory";let z=b.endsWith(Ss)?b:`${b}${Ss}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function bs(n){let u=JC(n);if(Cs)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(Cs?3:1)&&u.endsWith(Ss))u=u.slice(0,-1);return u}var Zu=30,Es=1,vs=365;function Xu(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Qu=new Set(Z.filter((n)=>n.catastrophic).map((n)=>n.id));function Gt(n,u){if(!n)return null;if(Qu.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let b=u?.effectiveDestructiveCommandRules[n.id];return b&&!b.enabled?null:n}function un(n,u,b){if(Qu.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??b}function X(n,u){return Object.freeze(Object.fromEntries(Z.map((b)=>{let W=b.activationCapability?u[b.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[b.id],Q=b.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...b.activationCapability?{activationCapability:b.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...b.activationCapability?{activationCapability:b.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...b.activationCapability?{activationCapability:b.activationCapability}:{},...B?{override:B}:{}};return[b.id,Object.freeze(Q)]})))}function Ju(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:X(n,u)})}var em={standard:0,strict:1,paranoid:2};function se(n,u,b=!1,W=n.safety.level){let z=rb(n,u,W),B=new Set(b?z.map((ve)=>ve.field):[]),Q=(ve,Oe)=>B.has(ve)?void 0:Oe,ee=(ve,Oe)=>Object.fromEntries(Object.entries(Oe??{}).filter(([De])=>!B.has(`${ve}.${De}`))),le=(ve,Oe)=>Oe?.filter((De)=>!B.has(`${ve}.${De}`));return{policy:{version:1,safety:{level:Q("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...ee("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:Q("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:Q("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...ee("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:Pl(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:Q("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...ee("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:Pl(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:Pl(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((ve)=>ve.message)}}function Pl(n,u){return[...new Set([...n,...u??[]])]}function rb(n,u,b){let W=u.safety?.level,z=ts[b];return[...W&&em[W]<em[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...Co.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...tm("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...tm("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!ys.has(B))),...n.destructive_command_protection.enabled?nm(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?nm(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function tm(n,u,b){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&b(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function nm(n,u){return(u??[]).filter((b)=>!n.includes(b))}var Il=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Zu}};function im(n,u){let b=ub(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:et(x(u.cwd),n.home),z=be(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),Q=b.gui??ae,ee=Object.keys(z.policy).length>0?se(Q,z.policy,B,Xd(Q.safety.level,n.env)):void 0,le=[...b.errors,...W.errors,...z.diagnostics],ue=(b.fallback==="defaults"&&ee?"salvaged":b.fallback)??(b.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),ve=z.policy.safety?.level&&ee?.policy.safety.level===z.policy.safety.level?"project":b.levelPresent?"user":"default";return{...ee?pi(ee.policy):b.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:ve,weakenings:ee?.weakenings??[],weakeningsIgnored:B}}:{}}}var sb="project policy audit settings are ignored; audit is user scope only";function be(n,u){if(!Wn(n))return{policy:{},diagnostics:[]};let b=Wn(n.safety)?n.safety:{},W=Wn(n.workflow)?n.workflow:{},z=Wn(n.destructive_command_protection)?n.destructive_command_protection:{},B=Wn(n.secret_protection)?n.secret_protection:{},Q={...Il.has(b.level)?{level:b.level}:{},...Wn(b.overrides)?rm({overrides:sm(b.overrides,Co,["safety","overrides"],Hr)}):{}},ee={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:Rs(z.overrides,gl,lm,Hr)}:{},...z.allow_paths!==void 0?{allow_paths:vo(z.allow_paths,_l,u,["destructive_command_protection","allow_paths"],Hr)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:Rs(B.overrides,vl,cm,Hr)}:{},...B.deny_paths!==void 0?{deny_paths:vo(B.deny_paths,xl,u,["secret_protection","deny_paths"],Hr)}:{},...B.allow_paths!==void 0?{allow_paths:vo(B.allow_paths,Al,u,["secret_protection","allow_paths"],Hr)}:{}};return{policy:rm({safety:Q,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:ee,secret_protection:le}),diagnostics:n.audit===void 0?[]:[sb]}}function sm(n,u,b,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...b,z],kl));return[]}))}function rm(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Hr=()=>{return},kl="must be a boolean",Ol="must be an object if provided",am=`must be an integer between ${Es} and ${vs}`,lm={path:["destructive_command_protection","overrides"],label:"destructive command"},cm={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let b=[];return{policy:dm(n,u,(z)=>{b.push(z)}),issues:b}}function _(n,u){return dm(n,u,Hr)}function dm(n,u,b){if(!Wn(n))return b(e([],"Config must be an object")),N();if(n.version!==1)b(e(["version"],"must be 1"));let W=Eo(n.safety,["safety"],["level","overrides"],b),z=Eo(W.overrides,["safety","overrides"],Co,b),B=Eo(n.workflow,["workflow"],["worktree_mode"],b),Q=Eo(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],b),ee=Eo(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],b),le=Eo(n.audit,["audit"],["retention_days"],b);return um(n,St,[],b),{version:1,safety:{level:ab(W.level,b),overrides:sm(z,Co,["safety","overrides"],b)},workflow:{worktree_mode:Tl(B.worktree_mode,["workflow","worktree_mode"],!1,b)},destructive_command_protection:{enabled:Tl(Q.enabled,["destructive_command_protection","enabled"],!0,b),overrides:Rs(Q.overrides,gl,lm,b),allow_paths:vo(Q.allow_paths,_l,u,["destructive_command_protection","allow_paths"],b)},secret_protection:{enabled:Tl(ee.enabled,["secret_protection","enabled"],!0,b),overrides:Rs(ee.overrides,vl,cm,b),deny_paths:vo(ee.deny_paths,xl,u,["secret_protection","deny_paths"],b),allow_paths:vo(ee.allow_paths,Al,u,["secret_protection","allow_paths"],b)},audit:{retention_days:lb(le.retention_days,b)}}}function Eo(n,u,b,W){if(n===void 0)return{};if(!Wn(n))return W(e(u,Ol)),{};return um(n,b,u,W),n}function um(n,u,b,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:b,message:z,kind:"unknownKeys"})}function ab(n,u){if(n===void 0)return"standard";if(Il.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Tl(n,u,b,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,kl));return b}function lb(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=Es&&n<=vs))u(e(["audit","retention_days"],am));return Xu(n)}function Rs(n,u,b,W){if(n===void 0)return{};if(!Wn(n))return W(e(b.path,Ol)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...b.path,z],message:`unknown ${b.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...b.path,z],'must be "on" or "off"')),[]}))}function vo(n,u,b,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,Q)=>{let ee=u(B,b);if(ee===null)return[B];return z(typeof B==="string"?dn([...W,Q],ee):e([...W,Q],ee)),[]})}function Wn(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Qe(n,u){let b=O({safety:tt(n.safety)},u),W=X({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},b.capabilities),z=Object.values(W),B=z.filter((Q)=>Q.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:b.effectiveLevel,capabilities:b.capabilities,rules:W,counts:{enabled:B.filter((Q)=>Q.enabled).length,disabled:B.filter((Q)=>!Q.enabled).length,effectiveCustomizations:z.filter((Q)=>Q.changesInherited).length}}}function et(n,u){if(!ob(n))return{exists:!1,policy:N(),errors:[]};try{let b=ib(n,"utf-8");if(!b.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(b),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${db(B)}`),fallback:Wn(W)?"salvaged":"defaults"}}catch(b){let W=b instanceof Error?b.message:String(b);return{exists:!0,policy:N(),errors:[`${n}: ${b instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var cb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ol,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[kl,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[am,`not an integer between ${Es} and ${vs}`]]);function db(n){let u=ll(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let b=cb.get(n.message)??n.message;return u===""?b:`${u}: ${b}`}function ub(n,u){let b=et(n,u);if(!b.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Wn(W))return{policy:pi(N()),errors:[]};let z=_(W,u);return{policy:pi(z),gui:z,errors:[],levelPresent:om(W)}}if(b.parsed===void 0)return{policy:pi(N()),errors:b.errors,...b.fallback?{fallback:b.fallback}:{}};return{policy:pi(b.policy),gui:b.policy,errors:b.errors,...b.fallback?{fallback:b.fallback}:{},levelPresent:om(b.parsed)}}function om(n){let u=Wn(n)&&Wn(n.safety)?n.safety:{};return Il.has(u.level)}function Ct(n){let u=Object.entries(n),b=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...ys].filter((W)=>!b.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function pi(n){return{safety:tt(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function tt(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let b=J(n,u),W=im(n,u),z={rules:b.rules,transparentWrappers:b.transparent_wrappers,commandTools:b.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...b.userConfig?.overrides,...b.projectConfig?.overrides},Q=Object.freeze(Object.fromEntries(z.rules.map((ee)=>{let le=b.rulebooks.find((ve)=>ve.rules.includes(ee.name)),ue=B[ee.name];return[ee.name,Object.freeze({id:ee.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...gb(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return Ge(z,mb(b,W),Q,W.policyScopes)}function nt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function mb(n,u){let b=pb(u);if(n.errors.length===0&&n.warnings.length===0&&!b)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:hb(n.errors.length>0?fb(n.errors):void 0,n.warnings.length>0?Dl(n.warnings.join("; ")):void 0,b)}}function fb(n){return`${Dl(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function pb(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function gb(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function Ge(n,u,b=Object.freeze({}),W){let z=Ml(structuredClone(n)),B=W?{policyScopes:Ml(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:b,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:b,...B})}function Ml(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))Ml(u);return Object.freeze(n)}function hb(...n){return Dl(n.filter((u)=>!!u).join("; "))}function Dl(n){return/[.!?]$/.test(n)?n:`${n}.`}function _e(n){let u=n.effectiveCapabilities,b=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:Ju(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:Ka({failClosed:b,paranoidRm:W,paranoidInterpreters:z}),strict:b,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as QP,isAbsolute as JP,join as gh,parse as eT,resolve as tT,sep as nT}from"node:path";function gi(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let b=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[b];return W!==void 0&&(W.provenance!=="literal"||b===0&&Sb(W))}var yb=/^@(['"])[ \t]*(?:\r\n|[\r\n])/;function Ro(n,u){let b=yb.exec(n.slice(u)),W=b?.[1];return b&&W?{quote:W,bodyStart:u+b[0].length}:null}function Sb(n){return Ro(n.raw,0)!==null}var Cb=/^[A-Za-z_][A-Za-z0-9_]*=/;function ws(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function hi(n){let u=ws(n.words[0],"time")?1:0,b=u===1&&ws(n.words[u],"-p")?u+1:u,W=u===1&&ws(n.words[b],"--")?b+1:b,z=ws(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((Q)=>!Cb.test(Q.text));return B?.provenance==="literal"?B.text:void 0}var xr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function _s(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xs(n,u,b){n.push(b),u.reset()}function As(n){let u=[];return{parts:u,push:(b,W,z)=>{if(W<=b)return;u.push({raw:n.slice(b,W),span:{start:b,end:W},provenance:z})}}}function Nl(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function wo(n,u,b,W,z,B,Q){return Nl({text:W,raw:n.slice(u,b),span:{start:u,end:b},provenance:z,quoted:B,...Q?{parts:Q}:{}})}function Ll(n,u,b){if(u>=b||fm(n[u]??""))return null;let W="",z=!1,B=!1,Q=u;while(Q<b&&!fm(n[Q]??"")){let ee=n[Q]??"";if(ee==="'"){z=!0;let le=mm(n,Q+1,b,"'");W+=le.text,B||=!le.closed,Q=le.next;continue}if(ee==='"'){z=!0;let le=mm(n,Q+1,b,'"');W+=le.text,B||=!le.closed,Q=le.next;continue}if(ee==="\\"){z=!0;let le=n[Q+1];if(!le||le===`
-`||le==="\r"){B=!0;break}W+=le,Q+=2;continue}if(ee==="`"||n.startsWith("$(",Q)||n.startsWith("${",Q)||n.startsWith("<(",Q)||n.startsWith(">(",Q))B=!0;W+=ee,Q++}return{delimiter:W,quoted:z,next:Q,ambiguous:B}}function Wl(n,u,b,W){let z=[],B=u;for(let Q of W){let ee=B,le=!1;while(B<b){let ue=bb(n,B,b);if((Q.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===Q.delimiter){Q.attach({body:Q.stripTabs?Eb(n.slice(ee,B)):n.slice(ee,B),delimiter:Q.delimiter,quotedDelimiter:Q.quotedDelimiter,bodySpan:{start:ee,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${Q.delimiter} was not found`}),{next:b,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function mm(n,u,b,W){let z="",B=u;while(B<b&&n[B]!==`
-`&&n[B]!=="\r"){let Q=n[B]??"";if(Q===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&Q==="\\"&&n[B+1]){let ee=n[B+1]??"";z+=["$","`",'"',"\\"].includes(ee)?ee:`\\${ee}`,B+=2;continue}z+=Q,B++}return{text:z,next:B,closed:!1}}function fm(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function bb(n,u,b){let W=u;while(W<b&&n[W]!==`
-`)W++;let z=W>=b?b:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function Eb(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Sm=new Set(["&&","||","|","|&"]),vb=new Set(["!","do","elif","else","if","then","until","while"]);function Cm(n,u){let b={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:b,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=Is(n,0,n.length,u,W,0),B=[...z.issues,...Ob(n,W.quotedExpansionEnd,z.nodes)?[Rm]:[],...Ib.test(n)?[vm]:[]];return{kind:"program",dialect:"posix",source:n,span:b,status:Os(B,z.limited),issues:B,nodes:z.nodes}}function Is(n,u,b,W,z,B,Q){let ee=[],le=[],ue=_s(),ve=[],Oe=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Me={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);xs(ee,ue,{kind:"command",dialect:"posix",source:n.slice(Me.start,Me.end),span:Me,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&ee.length===0?n.slice(u,b):Ne.join(" ")})},De=u;while(De<b){let Me=n[De];if(!Me)break;if(Q&&Me===Q)return Oe(),ym(ee,le),{nodes:ee,issues:le,next:De+1,closed:!0,limited:!1,pendingHeredocs:ve};if(Si(Me)){if(Me.charCodeAt(0)>127)le.push(vm);if(Me===`
+`)}function Fe(n,u){if(n.decision.kind!=="deny")return;let b=u.includeEvidence?n.decision.evidence:void 0;return{reason:n.decision.reason,ruleId:n.decision.ruleId,intent:n.decision.intent,command:b?.command,segment:b?.segment,toolName:u.toolName,...n.configFallback?{configWarning:n.configFallback.reason}:{},...n.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function ne(n={}){return{reason:ti,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:n.command,segment:n.segment??n.command,toolName:n.toolName}}function q(n={}){return{reason:"CC Safety Net could not check this tool call because it arrived without a usable tool name or arguments. This is not a CC Safety Net failure. Send the call again with its tool name and complete arguments.",ruleId:"tool-call.malformed",intent:"use_alternative",command:n.command,segment:n.command,toolName:n.toolName}}var Sy={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function I(n,u={}){return{...Sy[n.directory][n.problem],command:u.command,toolName:u.toolName,cwd:n.cwd}}function re(n){return yy({...n,redact:te})}function _t(n){return te(n instanceof Error?n.message:String(n))}import{spawnSync as Jy}from"node:child_process";import{lstatSync as eS,realpathSync as tS,statSync as nS}from"node:fs";import{isAbsolute as rS}from"node:path";import{homedir as oS,tmpdir as iS}from"node:os";import{statSync as Zy}from"node:fs";import{join as Xy}from"node:path";import{basename as Md,dirname as Cy,isAbsolute as by,join as Ey,normalize as vy,resolve as kd}from"node:path";var Ry=256,Qi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Cn(n,u=process.platform){if(u!=="win32")return n;return n.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function dr(n,u=process.platform){if(u!=="win32")return!1;return(n[0]==="/"||n[0]==="\\")&&(n[1]==="/"||n[1]==="\\")}function Ha(n,u){return $a(n,0,u)}function $a(n,u,b){let W="",z=0,B=0;while(z<n.length){if(n[z]!=="$"){W+=n[z],z++;continue}if(n[z+1]==="{"){let ee=Ba(n,z+2),le=wy(n,z,u);if(le===null){if(Qi.has(ee))throw new a("pathEnvironmentExpansion");if(B++,B>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");W+="${",z+=2;continue}let ue=n.slice(z,le+1);W+=_y(ue,u,b),z=le+1;continue}let Q=Ba(n,z+1);if(!Q){W+="$",z++;continue}W+=Ua(Q,b)??`$${Q}`,z+=Q.length+1}return W}function wy(n,u,b){let W=1;for(let z=u+2;z<n.length;z++){if(n[z]==="\\"){z++;continue}if(n[z]==="$"&&n[z+1]==="{"){if(W++,b+W>l.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");z++;continue}if(n[z]!=="}")continue;if(W--,W===0)return z}return null}function _y(n,u,b){let W=n.slice(2,-1),z=Ba(W,0);if(!z)return n;let B=W.slice(z.length);if(!B)return Ua(z,b)??n;let Q=[":-",":+",":=",":?","-","+","=","?"].find((ue)=>B.startsWith(ue));if(!Q){if(Qi.has(z))throw new a("pathEnvironmentExpansion");return n}if(!Qi.has(z))return n;if(Q.endsWith("="))throw new a("pathEnvironmentExpansion");let ee=Ua(z,b),le=Q.startsWith(":")?ee!==null&&ee!=="":ee!==null;if(Q.endsWith("?")&&!le)throw new a("pathEnvironmentExpansion");if(Q.endsWith("-")||Q.endsWith("?"))return le?ee??"":$a(B.slice(Q.length),u+1,b);return le?$a(B.slice(Q.length),u+1,b):""}function Ba(n,u){if(!/[A-Za-z_]/.test(n[u]??""))return"";let b=u+1;while(/[A-Za-z0-9_]/.test(n[b]??""))b++;return n.slice(u,b)}function Ua(n,u){if(!Qi.has(n))return null;if(n==="HOME")return u.env.get("HOME")??u.home;return u.env.get(n)??null}function jt(n,u,b){if(!n)return n;let W=b.resolvedPaths.get(n);if(W!==void 0)return W;let z=[],B=n;while(!0){Dd(b,B);let Q=u.realpath(B);if(Q!==null)return Od(b,n,Q,z);let ee=Cy(B);if(ee===B||z.length>=Ry)return Od(b,n,B,z);z.push(Md(B)),B=ee}}function Od(n,u,b,W){let z=W.length===0?b:Ey(b,...W.reverse());return n.resolvedPaths.set(u,z),z}function xy(n,u,b){let W=b.resolvedPaths.get(n);if(W!==void 0)return W;Dd(b,n);let z=u.realpath(n);if(z!==null)b.resolvedPaths.set(n,z);return z}function Dd(n,u){n.charge("realpathAttempts"),n.charge("processedCandidateBytes",Buffer.byteLength(u))}function bn(n,u,b,W){let z=Ld(n,u,b);if(!z)return"";return jt(z,b.paths,W).replace(/\\/g,"/")}function Nd(n,u,b,W,z){let B=Ld(n,u,b);if(!B)return null;if(z(Md(B)))return jt(B,b.paths,W).replace(/\\/g,"/");let Q=xy(B,b.paths,W);return Q===null?null:Q.replace(/\\/g,"/")}function Ld(n,u,b){let W=b.home,z=Ha(n.trim(),b).replace(/\\/g,"/");if(!z)return"";let B=z==="~"?W:z.startsWith("~/")?kd(W,z.slice(2)):z,Q=Cn(B);return vy(by(Q)?Q:kd(u,Q))}import{spawnSync as Ay}from"node:child_process";import{accessSync as Wd,constants as Fd,existsSync as ni,lstatSync as Py,opendirSync as Ty,readFileSync as ri,realpathSync as ho,statSync as yo}from"node:fs";import{dirname as $d,isAbsolute as ja,join as zn,resolve as Ji}from"node:path";var Iy=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],ky=5000;function Bd(n,u=Vy(),b=ky){let W=Oy(n),z=W===null?null:My(W);if(W===null||z===null)return null;let B=Hy(W,z,u,b);return B===null?null:{recursiveSubmodules:B}}function Oy(n){try{let u=ho(Ji(n));return yo(u).isDirectory()?u:null}catch{return null}}function My(n){let u=Uy(n);if(!u)return null;try{let b=Py(u);if(b.isSymbolicLink()||!b.isFile())return null;let W=Va(u);if(!W?.commonDir)return null;if(!Ly(W.gitDir,u))return null;return jd(W.gitDir,W.commonDir)?null:{gitDir:W.gitDir,commonDir:W.commonDir}}catch{return null}}function Va(n){try{let u=Dy(n);if(!u)return null;let b=ho(ja(u)?u:Ji($d(n),u));if(!yo(b).isDirectory())return null;return{gitDir:b,commonDir:Ny(b)}}catch{return null}}function Dy(n){let u=ri(n,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!u.startsWith("gitdir:"))return null;return u.slice(7).trim()||null}function Ny(n){try{let u=ri(zn(n,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!u)return null;let b=ho(ja(u)?u:Ji(n,u));return yo(b).isDirectory()?b:null}catch{return null}}function Ly(n,u){let b=Wy(n);return b===null?!1:Fy(n,b,u)}function Wy(n){let u=zn(n,"gitdir");if(!ni(u))return null;let b=ri(u,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return b===""?null:b}function Fy(n,u,b){try{return Gy(ja(u)?u:Ji(n,u),b)}catch{return!1}}function Gy(n,u){try{let b=yo(n),W=yo(u);if(b.ino!==0&&W.ino!==0&&b.dev===W.dev&&b.ino===W.ino)return!0}catch{}return Gd(ho.native(n))===Gd(ho.native(u))}function Gd(n){let u=n.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),b=u.length>1&&u.endsWith("/")?u.slice(0,-1):u;return process.platform==="win32"?b.toLowerCase():b}function Ud(n){try{return Wd(zn(n,"objects"),Fd.X_OK),Wd(zn(n,"refs"),Fd.X_OK),/^(?:ref:[\t\n\r ]*refs\/|[0-9a-fA-F]{40})/.test(Vd(zn(n,"HEAD")))}catch{return!1}}function Hd(n){return ni(zn(n,"commondir"))||jd(n,n)}function jd(n,u){return[zn(u,"config"),zn(n,"config.worktree")].some(zy)||By(n)}var zd=1048576;function Vd(n){let u=yo(n);if(!u.isFile()||u.size>zd)throw Error(`${n} is not a regular file within ${zd} bytes`);return ri(n,"utf-8")}function zy(n){try{return/(?:^|[\s\]])worktree\s*=/i.test(Vd(n))}catch(u){return u.code!=="ENOENT"}}var $y=1e4;function By(n){let u=[n],b=0;try{while(u.length>0){let W=u.pop(),z=Ty(W);try{for(let B=z.readSync();B!==null;B=z.readSync()){if(b++,B.isSymbolicLink()||B.isFIFO()||b>$y)return!0;let Q=W===n&&B.name==="objects";if(B.isDirectory()&&!Q)u.push(zn(W,B.name))}}finally{z.closeSync()}}return!1}catch(W){return W.code!=="ENOENT"}}function Uy(n){try{return qa(ho(n))}catch{return null}}function qa(n){let u=n;while(!0){let b=zn(u,".git");if(ni(b))return b;let W=$d(u);if(W===u)return null;u=W}}function Hy(n,u,b,W){if(jy(u))return!0;if(b===null)return!0;let z=Ay(b,["config","--get","submodule.recurse"],{cwd:n,encoding:"utf8",env:qy(process.env),stdio:["ignore","pipe","ignore"],timeout:W});if(z.error!==void 0||z.status!==0&&z.status!==1)return null;return z.status===0&&qd(z.stdout.trim())}function jy(n){return[zn(n.commonDir,"config"),zn(n.gitDir,"config.worktree")].filter((u)=>ni(u)).some((u)=>Ky(u))}function Vy(){return Iy.find((n)=>ni(n))??null}function oi(n){return n==="GIT_CONFIG_COUNT"||n==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(n)}function qy(n){return Object.fromEntries(Object.entries(n).filter(([u])=>!oi(u)))}function Ky(n){let u;try{u=ri(n,"utf-8")}catch{return!0}let b="",W=!1;for(let z of u.split(/\r?\n/)){let B=z.trim();if(B===""||B.startsWith("#")||B.startsWith(";"))continue;let Q=B.match(/^\[([^\]]+)\]$/);if(Q){b=Q[1]?.trim().toLowerCase()??"";continue}let ee=B.indexOf("="),le=(ee===-1?B:B.slice(0,ee)).trim().toLowerCase(),ue=ee===-1?"true":B.slice(ee+1).trim();if(Yy(b)&&le==="path")return!0;if(b==="submodule"&&le==="recurse")W=qd(ue)}return W}function Yy(n){return n==="include"||n.startsWith("includeif ")}function qd(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Kd(n,u){if(n==="")return null;let b=xn(),W=qa(bn(n,n,u,b)),z=W?Qy(W,n,u,b):null;if(!z)return null;return Object.freeze({entries:Object.freeze([z.entry]),markerFiles:Object.freeze(z.markerFile?[z.markerFile]:[]),directories:Object.freeze(z.directories),hooksDirectories:Object.freeze(z.hooksDirectories)})}function Qy(n,u,b,W){try{let z=bn(n,u,b,W),B=Zy(n),Q=B.isFile()?z:null,ee=B.isFile()?Va(n):null,le=(B.isDirectory()?[z]:[ee?.gitDir,ee?.commonDir]).flatMap((ve)=>ve?[So(bn(ve,u,b,W))]:[]),ue=[...new Set(B.isDirectory()?[So(n.replace(/\\/g,"/")),...le]:le)];return{entry:So(z),markerFile:Q?So(Q):null,directories:ue,hooksDirectories:[...new Set(ue.flatMap((ve)=>{let Oe=So(Xy(ve,"hooks").replace(/\\/g,"/"));return[Oe,So(bn(Oe,u,b,W))]}))]}}catch{return null}}function So(n){return process.platform==="win32"?n.toLowerCase():n}var sS={realpath:(n)=>{try{let u=tS(n);return rS(u)?u:null}catch{return null}},entryKind:(n)=>{try{let u=eS(n,{throwIfNoEntry:!1});if(!u)return"missing";return u.isSymbolicLink()?"symlink":"present"}catch(u){if(u.code==="ENAMETOOLONG")return"missing";throw u}},isDirectory:(n)=>{try{return nS(n).isDirectory()}catch{return!1}}};function c(){let n=new Map;return lS({env:new Map(Object.entries(process.env).flatMap(([u,b])=>b===void 0?[]:[[u,b]])),home:Cn(process.env.HOME||oS()),tmpdir:iS(),darwinUserTempDir:()=>es(n,"",aS),paths:sS})}function aS(){if(process.platform!=="darwin")return null;let n=Jy("/usr/bin/getconf",["DARWIN_USER_TEMP_DIR"],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000}),u=n.stdout?.replace(/\n$/,"");return n.status===0&&u?.startsWith("/")?u:null}function lS(n,u={}){let b=new Map,W=new Map,z=new Map,B={...n,gitMetadata:(Q)=>es(b,Q,()=>Kd(Q,B)),worktreeFacts:(Q)=>es(W,Q,()=>Bd(Q)),isGitDirectory:Ud,gitDirectoryRedirects:(Q)=>es(z,Q,()=>Hd(Q)),...u};return B}function es(n,u,b){let W=n.get(u);if(W!==void 0)return W;let z=b();return n.set(u,z),z}var Co=["fail_closed","paranoid_rm","paranoid_interpreters"],ts={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var r={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"},projectTightenOnly:{name:"CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY"}},ns=["standard","strict","paranoid"];function Yd(n,u){if(!u)return n;return ns.indexOf(u)>ns.indexOf(n)?u:n}function Zd(n){let u=xe(r.level,n);return ns.find((b)=>b===u)}function Xd(n,u){return Yd(n,Zd(u))}function cS(n){let u=xe(r.level,n);if(!u)return;let b=Zd(n);if(b)return b;console.error(`CC Safety Net: ignored invalid ${r.level.name}=${JSON.stringify(u.slice(0,40))}. Use ${ns.join(", ")}.`);return}function ft(n){if(n===void 0||n==="all")return"all";if(n==="blocked")return"blocked";return"invalid"}function $e(n){return ft(xe(r.auditScope,n))==="all"}function Ka(n){if(n.failClosed&&n.paranoidRm&&n.paranoidInterpreters)return"paranoid";if(n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"strict";if(!n.failClosed&&!n.paranoidRm&&!n.paranoidInterpreters)return"standard";return"custom"}function O(n={},u){let b=n.safety?.level??"standard",W=cS(u),z=Yd(b,W),B=ts[z],Q={failClosed:B.fail_closed,paranoidRm:B.paranoid_rm,paranoidInterpreters:B.paranoid_interpreters},ee={failClosed:z===b?"preset":"environment",paranoidRm:z===b?"preset":"environment",paranoidInterpreters:z===b?"preset":"environment"},le={failClosed:[`policy safety.level=${b}`],paranoidRm:[`policy safety.level=${b}`],paranoidInterpreters:[`policy safety.level=${b}`]};if(z!==b)le.failClosed.push(`env ${r.level.name}=${W}`),le.paranoidRm.push(`env ${r.level.name}=${W}`),le.paranoidInterpreters.push(`env ${r.level.name}=${W}`);if(n.safety?.overrides?.failClosed!==void 0)Q.failClosed=n.safety.overrides.failClosed,ee.failClosed="capability_override",le.failClosed.push("policy safety.overrides.fail_closed");if(n.safety?.overrides?.paranoidRm!==void 0)Q.paranoidRm=n.safety.overrides.paranoidRm,ee.paranoidRm="capability_override",le.paranoidRm.push("policy safety.overrides.paranoid_rm");if(n.safety?.overrides?.paranoidInterpreters!==void 0)Q.paranoidInterpreters=n.safety.overrides.paranoidInterpreters,ee.paranoidInterpreters="capability_override",le.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(k(r.strict,u))Q.failClosed=!0,ee.failClosed="environment",le.failClosed.push(`env ${r.strict.name}`);if(k(r.paranoid,u))Q.paranoidRm=!0,Q.paranoidInterpreters=!0,ee.paranoidRm="environment",ee.paranoidInterpreters="environment",le.paranoidRm.push(`env ${r.paranoid.name}`),le.paranoidInterpreters.push(`env ${r.paranoid.name}`);if(k(r.paranoidRm,u))Q.paranoidRm=!0,ee.paranoidRm="environment",le.paranoidRm.push(`env ${r.paranoidRm.name}`);if(k(r.paranoidInterpreters,u))Q.paranoidInterpreters=!0,ee.paranoidInterpreters="environment",le.paranoidInterpreters.push(`env ${r.paranoidInterpreters.name}`);let ue=!!n.worktreeMode||k(r.worktree,u);return{strict:Q.failClosed,paranoidRm:Q.paranoidRm,paranoidInterpreters:Q.paranoidInterpreters,worktreeMode:ue,effectiveLevel:Ka(Q),capabilities:{fail_closed:{enabled:Q.failClosed,source:ee.failClosed,sources:le.failClosed},paranoid_rm:{enabled:Q.paranoidRm,source:ee.paranoidRm,sources:le.paranoidRm},paranoid_interpreters:{enabled:Q.paranoidInterpreters,source:ee.paranoidInterpreters,sources:le.paranoidInterpreters}}}}function k(n,u){let b=typeof n==="string"?ii(n,u):xe(n,u);return b==="1"||b?.toLowerCase()==="true"}function ii(n,u){return u.get(n)}function xe(n,u){let b=ii(n.name,u);if(b!==void 0)return b;if(n.legacyName)return ii(n.legacyName,u);return}function At(n,u){return ii(n.name,u)!==void 0||!!n.legacyName&&ii(n.legacyName,u)!==void 0}import{dirname as Br}from"node:path";import{closeSync as dS,constants as si,fstatSync as Ya,fsyncSync as uS,lstatSync as $n,mkdirSync as Qd,openSync as Jd,readdirSync as Xa,readFileSync as mS,realpathSync as bo,renameSync as fS,rmdirSync as eu,statSync as Za,unlinkSync as Qa,writeFileSync as pS}from"node:fs";import{isAbsolute as tu,join as Fr,normalize as gS,parse as rs,relative as Ja,resolve as el,sep as os}from"node:path";function Ve(){let n=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${n()}${n()}`}var hS=Symbol("PolicyFilesystemScope"),yS=Symbol("PolicyFilesystemTarget"),nu=si.O_NOFOLLOW??0;class i extends Error{name="PolicyFilesystemError";constructor(n){super(`Unable to access ${n} filesystem safely.`)}}function R(n,u){return{[hS]:!0,root:el(n),label:u}}function ai(n,u){let b=gS(u);if(u===""||tu(u)||b===".."||b.startsWith(`..${os}`))throw new i(n.label);return{[yS]:!0,scope:n,relativePath:b,path:Fr(n.root,b)}}function s(n,u){return ai(n,Ja(n.root,el(u)))}function de(n,u="rules policy"){let b=el(n),W=rs(b).dir;return ai(R(W,u),Ja(W,b))}function o(n){return ur(n.scope.label,()=>{if(!pn(n))return null;let u=Jd(n.path,si.O_RDONLY|nu);return ou(u,()=>{let b=Ya(u);if(!b.isFile())throw new i(n.scope.label);let W=mS(u,"utf-8"),z=$n(n.path);if(!z.isFile()||z.isSymbolicLink()||!lu(b,z))throw new i(n.scope.label);return pn(n),W})})}function v(n,u,b=384,W){let z=`${n.path}.${Ve()}.tmp`;ur(n.scope.label,()=>{CS(n),pn(n);let B=Jd(z,si.O_CREAT|si.O_EXCL|si.O_WRONLY|nu,b),Q=ou(B,()=>{let ee=Ya(B);if(!ee.isFile())throw new i(n.scope.label);pS(B,u,"utf-8"),uS(B);let le=Ya(B);if(!le.isFile()||le.dev!==ee.dev||le.ino!==ee.ino)throw new i(n.scope.label);return le});pn(n),ES(n,z,Q),fS(z,n.path),W?.(n.path),pn(n)},()=>RS(z))}function ru(n,u){if(n.path===u.path)return!0;return ur(n.scope.label,()=>{if(!pn(n)||!pn(u))return!1;let b=(W)=>Fr(bo(rs(W).dir),rs(W).base);return b(n.path)===b(u.path)})}function Se(n){let u=ur(n.scope.label,()=>{if(!pn(n,"directory"))return null;let b=Xa(n.path);return pn(n,"directory"),b});if(!u)return null;return ur(n.scope.label,()=>{let b=u.map((W)=>{let z=ai(n.scope,Fr(n.relativePath,W)),B=$n(z.path);if(B.isSymbolicLink()||!B.isFile()&&!B.isDirectory())throw new i(n.scope.label);return is(tl(n.scope),bo(z.path),n.scope.label),{name:W,kind:B.isDirectory()?"directory":"file"}});return pn(n,"directory"),b})}function V(n){ur(n.scope.label,()=>{if(!pn(n))return;Qa(n.path),pn(n)})}function It(n){ur(n.scope.label,()=>{if(!SS(n))return;su(n),pn(n,"directory")})}function Ot(n){ur(n.scope.label,()=>{if(!pn(n,"directory"))return;eu(n.path),pn(n,"directory")})}function SS(n){return ur(n.scope.label,()=>{if(!pn(n,"directory"))return!1;return iu(n),!0})}function ur(n,u,b){try{return u()}catch(W){if(b?.(),W instanceof i)throw W;throw new i(n)}}function ou(n,u){try{return u()}finally{dS(n)}}function pn(n,u="file"){let b=au(n.scope);if(!b)return!1;let W=n.relativePath.split(os);for(let z of W.keys()){let B=Fr(n.scope.root,...W.slice(0,z+1)),Q=$n(B,{throwIfNoEntry:!1});if(!Q)return!1;if(Q.isSymbolicLink())throw new i(n.scope.label);if(z<W.length-1&&!Q.isDirectory())throw new i(n.scope.label);if(z===W.length-1&&(u==="file"?!Q.isFile():!Q.isDirectory()))throw new i(n.scope.label);is(b,bo(B),n.scope.label)}return!0}function iu(n){for(let u of Xa(n.path)){let b=ai(n.scope,Fr(n.relativePath,u)),W=$n(b.path);if(W.isSymbolicLink()||!W.isDirectory()&&!W.isFile())throw new i(n.scope.label);if(W.isDirectory())iu(b)}pn(n,"directory")}function su(n){for(let u of Xa(n.path)){let b=ai(n.scope,Fr(n.relativePath,u)),W=$n(b.path);if(W.isSymbolicLink())throw new i(n.scope.label);if(W.isDirectory()){su(b);continue}if(!W.isFile())throw new i(n.scope.label);Qa(b.path)}eu(n.path)}function CS(n){bS(n.scope);let u=tl(n.scope),b=n.relativePath.split(os).slice(0,-1);for(let W of b.keys()){let z=Fr(n.scope.root,...b.slice(0,W+1));if(!$n(z,{throwIfNoEntry:!1}))Qd(z,{mode:448});let B=$n(z);if(!B.isDirectory()||B.isSymbolicLink())throw new i(n.scope.label);is(u,bo(z),n.scope.label)}}function bS(n){if($n(n.root,{throwIfNoEntry:!1})){if(!Za(n.root).isDirectory())throw new i(n.label);return}let u=[],b=n.root;while(!$n(b,{throwIfNoEntry:!1})){u.unshift(b);let W=rs(b).dir;if(W===b)throw new i(n.label);b=W}if(!Za(b).isDirectory())throw new i(n.label);for(let W of u){Qd(W,{mode:448});let z=$n(W);if(!z.isDirectory()||z.isSymbolicLink())throw new i(n.label)}}function au(n){if(!$n(n.root,{throwIfNoEntry:!1}))return null;if(!Za(n.root).isDirectory())throw new i(n.label);return bo(n.root)}function tl(n){let u=au(n);if(!u)throw new i(n.label);return u}function ES(n,u,b){let W=$n(u);if(!W.isFile()||W.isSymbolicLink()||!lu(b,W))throw new i(n.scope.label);is(tl(n.scope),bo(u),n.scope.label)}var vS=process.platform==="win32";function lu(n,u){return n.ino===u.ino&&(vS||n.dev===u.dev)}function is(n,u,b){let W=Ja(n,u);if(W===".."||W.startsWith(`..${os}`)||tu(W))throw new i(b)}function RS(n){try{Qa(n)}catch{}}import{dirname as Gr,isAbsolute as PS,join as zr,relative as TS,resolve as wr,sep as IS}from"node:path";var m=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,we="rulebook.json",Ce=".cc-safety-net/rules";var cu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,wS=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,du=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,_S=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),xS="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Dt=new RegExp(`^${_S}/(${m.source.slice(1,-1)})/${xS}$`);function AS(n){return`.cc-safety-net/rules/${n}/rulebook.json`}function uu(n){if(T(n))try{return j(n),null}catch(u){return u instanceof Error?u.message:String(u)}return m.test(n)?null:`Local rulebook sources must be bare names matching ${m}: ${n}`}function j(n){if(n.startsWith("github:"))throw Error(`Invalid rulebook source: ${n}`);let u=n.match(cu);if(!u?.[1]||!u[2]||!u[3])throw Error(`Invalid GitHub rulebook source: ${n}`);let b=u[3].lastIndexOf("/");if(b<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);let W=u[3].slice(0,b),z=u[3].slice(b+1);if(!W||!du.test(W))throw Error(`GitHub rulebook refs must use valid path segments: ${n}`);if(!z||!m.test(z))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${n}`);return{owner:u[1],repo:u[2],ref:W,path:AS(z),name:z}}function oe(n){return wS.test(n)}function pe(n){return du.test(n)}function T(n){return cu.test(n)}function Nt(n){if(!m.test(n))throw Error(`Local rulebook sources must be bare names matching ${m}: ${n}`)}var mu="rule.json",ss="policy.json",fu=".cc-safety-net",kS="rules",OS="CC_SAFETY_NET_HOME",pu="`cc-safety-net rule update`";function MS(n){return wr(n,Ce)}function D(n){return zr(MS(n),mu)}function x(n){return zr(wr(n),fu,ss)}function fe(n,u={}){return u.userConfigDir??(u.userConfigPath?Gr(u.userConfigPath):zr(DS(n),kS))}function DS(n){let u=n.env.get(OS);return u?wr(Cn(u)):zr(n.home,fu)}function K(n,u={}){return zr(fe(n,u),mu)}function p(n,u={}){return zr(Gr(fe(n,u)),ss)}function L(n,u){let b=xn();return jt(x(u.cwd),n.paths,b)===jt(wr(p(n,u)),n.paths,b)}function ie(n,u){let b=u.userConfigPath??K(n,u),W=u.projectConfigPath??D(u.cwd),z=mt(n,u),B=gt(W,u.cwd);return{userConfigPath:b,projectConfigPath:W,userScope:z,projectScope:B,userConfigTarget:s(z,b),projectConfigTarget:s(B,W)}}function mt(n,u){let b=u.userConfigPath?Gr(Gr(wr(u.userConfigPath))):Gr(wr(u.userConfigDir??fe(n,u)));return R(b,"user policy")}function gt(n,u){let b=wr(u),W=wr(n),z=TS(b,W);if(z!==".."&&!z.startsWith(`..${IS}`)&&!PS(z))return R(b,"project policy");return R(Gr(Gr(W)),"project policy")}function U(n,u){return zr(n,u,we)}var Nn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),P=/^[a-zA-Z][a-zA-Z0-9_-]*$/,M=256,nn=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),gu=new Set(["python","python3","python2","node","ruby","perl"]),as=/^python(?:[23](?:\.\d+)*)?$/,Bn=new Set(["awk","gawk","nawk","mawk"]),ls=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]),cs=new Set(["curl","wget","aria2c","http","https","xh","xhs","httpie","fetch","lwp-request","nc","ncat","netcat","socat","telnet"]);var hu="Rulebook exceeds CC Safety Net's safe validation limits.",yu="Additional rulebook validation errors were omitted.",qn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Su(n){if(nl(n.allowed_commands,qn.maxAllowedCommands)||nl(n.rules,qn.maxRules)||nl(n.tests,qn.maxTests))return!1;let{maxAggregateStringCodeUnits:u,maxTotalBlockArgs:b}=qn,W=(z,B=!1)=>{if(typeof z!=="string")return!0;if(z.length>qn.maxStringCodeUnits||B&&z.length>qn.maxFixtureCommandCodeUnits||z.length>u)return!1;return u-=z.length,!0};if(!W(n.name)||!W(n.version)||!W(n.description)||!W(n.author)||!W(n.migrated_from))return!1;if(Array.isArray(n.allowed_commands)){for(let z of n.allowed_commands)if(!W(z))return!1}if(Array.isArray(n.rules))for(let z of n.rules){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.name)||!W(B.command)||!W(B.subcommand)||!W(B.reason)||!W(B.intent))return!1;let Q=B.match&&typeof B.match==="object"?B.match:{};for(let ee of[B.block_args,Q.command_path,Q.any_args,Q.exclude_args]){if(!Array.isArray(ee))continue;if(ee.length>qn.maxBlockArgsPerRule||ee.length>b)return!1;b-=ee.length;for(let le of ee)if(!W(le))return!1}}if(Array.isArray(n.tests))for(let z of n.tests){if(!z||typeof z!=="object")continue;let B=z;if(!W(B.command,!0)||!W(B.expect)||!W(B.rule))return!1}return!0}function nl(n,u){return Array.isArray(n)&&n.length>u}var rl=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ee=64,ke="Rule config exceeds CC Safety Net's safe source limit.";function Bt(n){return Wt(n).toLowerCase()}function Wt(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}function An(n,u){let b=new Set,W=!1;for(let z of n){if(z==="--"){W=!0;continue}if(W)continue;if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1)for(let B=1;B<z.length;B++){let Q=z[B];if(!Q||!/[a-zA-Z]/.test(Q))break;let ee=`-${Q}`;if(b.add(ee),u?.shortOptsWithValue?.has(ee))break}}return b}var NS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ol=new Set(["--init-file","--rcfile"]);function il(n,u,b,W){let z=!1,B=0,Q=!1,ee=!1;for(let le=1;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(n==="ksh"&&ue==="o"&&le+1<u.length){if(W==="argv"){let ve=u.slice(le+1);if(u[0]==="-"&&(ve==="c"||ve[0]==="-"&&ve.endsWith("c")))Q=!0}break}if(n==="ksh"&&ue==="o"&&le+1===u.length&&(b?.startsWith("-")||b?.startsWith("+")))break;if(n==="zsh"&&ue==="o"&&le+1<u.length)break;if(W==="startup"&&ue==="i")z=u[0]==="-";if(W==="argv"&&u[0]==="-"&&ue==="c")Q=!0;if(W==="argv"&&ue==="s")ee=u[0]==="-";if(!NS[n]?.includes(ue))continue;if(le+1===u.length)B++;break}return{interactive:z,followingValues:B,commandSelected:Q,stdinMode:ee}}function Pn(n){let u=Wt(n[0]??"").toLowerCase(),b=!1,W=!1;for(let z=1;z<n.length;z++){let B=n[z];if(B===void 0)break;if(B==="--"){let ee=b&&n[z+1]!==void 0?z+1:null;return{command:ee===null?null:n[ee]??null,commandIndex:ee,scriptIndex:!b&&!W&&n[z+1]!==void 0?z+1:null,readsStdinAsCommands:!b&&(W||n[z+1]===void 0)}}if(B==="-"||B[0]!=="-"&&B[0]!=="+")return{command:b?B:null,commandIndex:b?z:null,scriptIndex:!b&&!W&&B!=="-"?z:null,readsStdinAsCommands:!b&&(W||B==="-")};if(B.startsWith("--")){let ee=B.split("=",1)[0]??B;if(u==="bash"&&ol.has(ee)&&!B.includes("="))z++;continue}let Q=il(u,B,n[z+1],"argv");if(Q.commandSelected)b=!0;if(Q.stdinMode)W=!0;z+=Q.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!b}}function li(n,u){if(u.escaped)return u.escaped=!1,!0;if(n==="\\"&&!u.inSingle)return u.escaped=!0,!0;if(n==="'"&&!u.inDouble)return u.inSingle=!u.inSingle,!0;if(n==='"'&&!u.inSingle)return u.inDouble=!u.inDouble,!0;return!1}function ds(n){let u={inSingle:!1,inDouble:!1,escaped:!1};for(let b of LS(n))li(b,u);return u.inSingle||u.inDouble}function LS(n){let u="",b={inSingle:!1,inDouble:!1,escaped:!1},W=!1,z=!0;for(let B=0;B<n.length;B++){let Q=n[B];if(!Q)break;if(W){if(Q===`
+`||Q==="\r")u+=Q,W=!1,b.escaped=!1;continue}if(Q==="#"&&!b.inSingle&&!b.inDouble&&z){W=!0;continue}if(u+=Q,!b.inSingle&&!b.inDouble&&!b.escaped)z=/[\s;&|()<>]/.test(Q);li(Q,b)}return u}var sl=new Set(["rm","find","rsync","xargs","parallel"]),WS=new Set(["git","busybox",...sl,...nn,...gu,...Bn]),FS=new Set(["python","node","ruby","perl"]);function Ke(n){let u=Bt(n);return WS.has(u)||Ln(u)}function Ln(n){return FS.has(GS(n))}function GS(n){let u=Wt(n).toLowerCase();return as.test(u)?"python":u}var me={version:1,rules:[],overrides:{},transparent_wrappers:[]};function f(n){try{let u=o(zS(n));if(u===null)return{config:null,errors:[]};if(!u.trim())return{config:null,errors:["Config file is empty"]};let b=JSON.parse(u),W=ht(b);if(W.errors.length>0)return{config:null,errors:W.errors};return{config:{version:1,rules:b.rules??[],overrides:b.overrides??{},transparent_wrappers:b.transparent_wrappers??[],...b.command_tools?{command_tools:b.command_tools}:{}},errors:[]}}catch(u){if(u instanceof i)return{config:null,errors:[u.message]};let b=u instanceof Error?u.message:String(u);return{config:null,errors:[u instanceof SyntaxError?"Invalid JSON":b]}}}function zS(n){return typeof n==="string"?de(n):n}var e=(n,u)=>({path:n,message:u,kind:"typed"}),dn=(n,u)=>({path:n,message:u,kind:"custom"});function Je(n){let u=new Set;return n.flatMap((b,W)=>{let z=$r(b)?b.name:void 0;if(typeof z!=="string")return[];if(u.has(z.toLowerCase()))return[dn(["rules",W,"name"],`duplicate rule name "${z}"`)];return u.add(z.toLowerCase()),[]})}var je=`must be one of ${rl.join(", ")}`,$S=/^[^/]+\/[^/]+$/,BS=["version","rules","overrides","transparent_wrappers","command_tools"],Ye=/^[^\s\p{Cc}]{1,256}$/u,Re="non-empty, at most 256 characters, no whitespace or control characters";function ht(n){let u=US(n);return{errors:ge(yt(u,BS,(b)=>b.kind==="custom"),": "," "),sources:QS(n,u)}}function US(n){if(!$r(n))return[e([],"Config must be an object")];let u=Array.isArray(n.rules)&&n.rules.length>Ee;return[...n.version===1?[]:[e(["version"],"must be 1")],...HS(n.rules,u),...qS(n.overrides),...YS(n.transparent_wrappers),...u?[]:VS(n.rules),...$r(n.overrides)?Object.keys(n.overrides).filter((b)=>!$S.test(b)).map((b)=>dn(["overrides",b],"must use <rulebook-name>/<rule-name>")):[],...ZS(n.transparent_wrappers),...XS(n.command_tools)]}function HS(n,u){if(n===void 0)return[];if(!Array.isArray(n))return[e(["rules"],"must be an array of rulebook source strings"),...Cu(n,Ee)?[e(["rules"],ke)]:[]];if(u)return[{path:["rules"],message:ke,kind:"limit"}];return n.flatMap((b,W)=>{if(typeof b!=="string")return[e(["rules",W],"must be a rulebook source string"),...jS(b,1)?[e(["rules",W],"must be a non-empty rulebook source string")]:[]];return b===""?[e(["rules",W],"must be a non-empty rulebook source string")]:[]})}function Cu(n,u){let b=bu(n);return b!==void 0&&!(b<=u)}function jS(n,u){let b=bu(n);return b!==void 0&&!(b>=u)}function bu(n){if(n===null||n===void 0)return;let u=n.length;return u===void 0?void 0:Number(u)}function VS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((b,W)=>{if(typeof b!=="string"||b==="")return[];if(b.trim()==="")return[dn(["rules",W],"must be a non-empty rulebook source string")];let z=uu(b);if(z)return[dn(["rules",W],z)];if(u.has(b))return[dn(["rules",W],`duplicate rulebook source "${b}"`)];return u.add(b),[]})}function qS(n){if(n===void 0)return[];if(!$r(n))return[e(["overrides"],"must be an object if provided")];return Object.keys(n).flatMap((u)=>{let b=n[u];if(b==="off")return[];if(!$r(b))return[e(["overrides",u],'must be "off" or an object')];return[...KS(b.reason,["overrides",u,"reason"]),...b.intent===void 0||Ue(b.intent)?[]:[e(["overrides",u,"intent"],je)]]})}function KS(n,u){if(typeof n!=="string")return[e(u,"required non-empty string"),...Cu(n,M)?[e(u,`must be at most ${M} characters`)]:[]];if(n==="")return[e(u,"required non-empty string")];return n.length>M?[e(u,`must be at most ${M} characters`)]:[]}function YS(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["transparent_wrappers"],"must be an array of command strings")];return n.flatMap((u,b)=>{if(typeof u!=="string")return[e(["transparent_wrappers",b],"must be a command string")];return P.test(u)?[]:[e(["transparent_wrappers",b],"must match command pattern")]})}function ZS(n){if(!Array.isArray(n))return[];let u=new Set;return n.flatMap((b,W)=>{if(typeof b!=="string"||!P.test(b))return[];if(u.has(b))return[dn(["transparent_wrappers",W],`duplicate command "${b}"`)];if(Ke(b))return[dn(["transparent_wrappers",W],`reserved command "${b}" cannot be a wrapper`)];return u.add(b),[]})}function XS(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["command_tools"],"must be an array of tool names or {name, cwd} objects")];let u=new Set,b=(W,z)=>{if(u.has(W))return[dn(["command_tools",z],`duplicate tool "${W}"`)];return u.add(W),[]};return n.flatMap((W,z)=>{if(typeof W==="string")return al(W)?b(W,z):[e(["command_tools",z],`must be a tool name: ${Re}`)];if(!$r(W))return[e(["command_tools",z],"must be a tool name or a {name, cwd} object")];let B=[...al(W.name)?[]:[e(["command_tools",z,"name"],`must be a tool name: ${Re}`)],...W.cwd===void 0||W.cwd===!1||al(W.cwd)?[]:[e(["command_tools",z,"cwd"],`must be an argument name or false: ${Re}`)]];return B.length>0?B:b(W.name,z)})}function al(n){return typeof n==="string"&&Ye.test(n)}function QS(n,u){let b=$r(n)?n.rules:void 0;if(!Array.isArray(b))return new Set;if(u.some((z)=>z.path.length===1&&z.path[0]==="rules"))return new Set;let W=new Set(u.filter((z)=>z.path[0]==="rules"&&typeof z.path[1]==="number").map((z)=>z.path[1]));return new Set(b.filter((z,B)=>typeof z==="string"&&!W.has(B)))}function yt(n,u,b){let W=n.map((Q)=>Q.path[1]),z=[...new Set(W.filter((Q)=>typeof Q==="string"))],B=(Q,ee)=>[Q.path.length===0?-1:u.indexOf(String(Q.path[0])),typeof ee==="number"?ee:z.indexOf(String(ee)),b(Q)?0:1];return n.map((Q,ee)=>({issue:Q,rank:B(Q,W[ee])})).sort((Q,ee)=>Q.rank[0]-ee.rank[0]||Q.rank[1]-ee.rank[1]||Q.rank[2]-ee.rank[2]).map((Q)=>Q.issue)}function ge(n,u,b){return[...new Set(n.map((W)=>{let z=ll(W.path);if(W.kind==="unknownKeys")return`${z?`${z}.`:""}unknown field "${W.message}"`;if(W.kind==="key"||W.kind==="limit"||W.path.length===0)return W.message;return`${z}${W.path.length===1?b:u}${W.message}`}))]}function ll(n){return n.map((u,b)=>{if(typeof u==="number")return`[${u}]`;return b===0?String(u):`.${String(u)}`}).join("")}function Ue(n){return rl.includes(n)}function $r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function he(n){let u=tC(n);if(u.errors.length>0)throw Error(u.errors.join("; "));return n}var JS=`required non-empty string up to ${M} characters`,Eu="must be a non-empty array of unique non-empty strings",eC="required non-empty array of non-empty strings";function tC(n){if(!_r(n))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Su(n))return{errors:[hu],ruleNames:new Set};let u=[...n.rulebook_version===1||n.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ge(nC(n,n.rulebook_version===2),": ",": ")];return{errors:u.length>qn.maxValidationErrors?[...u.slice(0,qn.maxValidationErrors),yu]:u,ruleNames:new Set(Ze(n).map((b)=>b.toLowerCase()))}}function Ze(n){let u=_r(n)?n.rules:void 0;return(Array.isArray(u)?u:[]).flatMap((b)=>{let W=_r(b)?b.name:void 0;return typeof W==="string"?[W]:[]})}function nC(n,u){return[...typeof n.name==="string"&&m.test(n.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof n.version==="string"&&n.version!==""?[]:[e(["version"],"required non-empty string")],...rC(n.allowed_commands),...oC(n.rules,u),...lC(n.tests),...cC(n),...dC(n)]}function rC(n){if(!Array.isArray(n))return[e(["allowed_commands"],"required array")];let u=new Set;return[...n.flatMap((b,W)=>typeof b==="string"&&P.test(b)?[]:[e(["allowed_commands",W],"must match command pattern")]),...n.flatMap((b,W)=>{if(typeof b!=="string"||!P.test(b))return[];if(u.has(b))return[dn(["allowed_commands",W],`duplicate command "${b}"`)];return u.add(b),[]})]}function oC(n,u){if(!Array.isArray(n))return[e(["rules"],"required array")];return[...n.flatMap((b,W)=>{if(!_r(b))return[e(["rules",W],"must be an object")];return u?sC(b,["rules",W]):iC(b,["rules",W])}),...Je(n)]}function iC(n,u){return[...vu(n.name,u),...Ru(n.command,u),...n.subcommand===void 0||typeof n.subcommand==="string"&&P.test(n.subcommand)?[]:[e([...u,"subcommand"],"must match command pattern")],...us(n.block_args,[...u,"block_args"],"required non-empty array",!1),...wu(n.reason,u),..._u(n.intent,u)]}function sC(n,u){return[...vu(n.name,u),...Ru(n.command,u),...wu(n.reason,u),..._u(n.intent,u),...aC(n.match,[...u,"match"]),...n.subcommand===void 0?[]:[e([...u,"subcommand"],"not supported in rulebook_version 2")],...n.block_args===void 0?[]:[e([...u,"block_args"],"not supported in rulebook_version 2")]]}function vu(n,u){if(typeof n!=="string")return[e([...u,"name"],"required string")];return m.test(n)?[]:[e([...u,"name"],"must match rule name pattern")]}function Ru(n,u){return typeof n==="string"&&P.test(n)?[]:[e([...u,"command"],"required string matching command pattern")]}function wu(n,u){return typeof n==="string"&&n!==""&&n.length<=M?[]:[e([...u,"reason"],JS)]}function _u(n,u){return n===void 0||Ue(n)?[]:[e([...u,"intent"],je)]}function aC(n,u){if(!_r(n))return[e(u,"required object")];return[...us(n.command_path,[...u,"command_path"],eC,!1),...n.any_args===void 0?[]:us(n.any_args,[...u,"any_args"],Eu,!0),...n.exclude_args===void 0?[]:us(n.exclude_args,[...u,"exclude_args"],Eu,!0)]}function us(n,u,b,W){if(!Array.isArray(n))return[e(u,b)];let z=n.flatMap((B,Q)=>{if(typeof B!=="string")return[e([...u,Q],"must be a non-empty string")];return B===""?[dn([...u,Q],"must be a non-empty string")]:[]});if(n.some((B)=>typeof B!=="string"))return z;return[...z,...n.length===0?[dn(u,b)]:[],...W&&new Set(n).size!==n.length?[dn(u,"must not contain duplicate values")]:[]]}function lC(n){if(n===void 0)return[];if(!Array.isArray(n))return[e(["tests"],"must be an array if provided")];return n.flatMap((u,b)=>{if(!_r(u))return[e(["tests",b],"must be an object")];return[...typeof u.command==="string"&&u.command.trim()!==""?[]:[e(["tests",b,"command"],"required non-empty string")],...u.expect==="blocked"||u.expect==="allowed"?[]:[e(["tests",b,"expect"],'must be "blocked" or "allowed"')],...u.rule===void 0||typeof u.rule==="string"?[]:[e(["tests",b,"rule"],"must be a string if provided")],...u.expect==="blocked"&&typeof u.rule!=="string"?[dn(["tests",b,"rule"],"required string for blocked fixtures")]:[]]})}function cC(n){if(!Array.isArray(n.tests))return[];let u=new Set(Ze(n));return[...new Set(n.tests.flatMap((b)=>_r(b)&&b.expect==="blocked"&&typeof b.rule==="string"?[b.rule]:[]))].filter((b)=>!u.has(b)).map((b)=>dn(["tests"],`blocked fixture references unknown rule "${b}"`))}function dC(n){if(!Array.isArray(n.allowed_commands)||!Array.isArray(n.rules))return[];let u=new Set(n.allowed_commands.filter((b)=>typeof b==="string"));return n.rules.flatMap((b,W)=>{let z=_r(b)?b.command:void 0;if(typeof z!=="string"||u.has(z))return[];return[dn(["rules",W,"command"],`"${z}" must be listed in allowed_commands`)]})}function _r(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function Lt(n,u,b){return J(n,{cwd:u}).command_tools.some((W)=>W.name===b&&W.cwd===!1)}function J(n,u){let b=ie(n,u),W;try{W=ru(b.userConfigTarget,b.projectConfigTarget)}catch(Me){if(Me instanceof i)return bC(b,Me.message);throw Me}let z=f(b.userConfigTarget),B=W?{config:null,errors:[]}:f(b.projectConfigTarget),Q=Pu(b.userConfigPath,z.errors),ee=Pu(b.projectConfigPath,B.errors),le=new Set,ue=z.config?cl(z.config,Br(b.userConfigPath),"user",b.userScope,le):Tu(),ve=B.config?cl(B.config,Br(b.projectConfigPath),"project",b.projectScope,le):Tu(),Oe=z.config?.overrides??{},De=B.config?.overrides??{};return{rules:[...Au(ue.rules,Oe),...Au(ve.rules,De)],transparent_wrappers:yC(z.config,B.config),command_tools:SC(z.config,B.config),rulebooks:[...ue.rulebooks,...ve.rulebooks],errors:[...Q,...ee,...ue.errors,...ve.errors],warnings:[...ue.warnings,...ve.warnings,...ue.canValidateOverrides?dl(Oe,ue.knownRuleIds,b.userConfigPath):[],...ue.canValidateOverrides?CC(De,ue.knownRuleIds,b.projectConfigPath):[],...ve.canValidateOverrides?dl(De,ve.knownRuleIds,b.projectConfigPath):[]],userConfig:z.config??void 0,projectConfig:B.config??void 0,...b}}function Y(n,u){let b=uC(n,u);if(!b)return[];return[...b.scope.errors,...b.scope.warnings,...mC(b.config,b.scope,n)]}function uC(n,u){let b=u??R(Br(Br(n)),"rules policy"),W=f(s(b,n)).config;if(!W)return null;return{config:W,scope:cl(W,Br(n),"project",b)}}function mC(n,u,b){return u.canValidateOverrides?dl(n.overrides??{},u.knownRuleIds,b):[]}function cl(n,u,b,W=R(Br(Br(u)),b==="user"?"user policy":"project policy"),z=new Set){let B=[],Q=[],ee=n.rules.flatMap((ue)=>{let ve=pC(ue,u,W);if(ve.errors.length>0||!ve.rulebook)return B.push(...ve.errors),[];let Oe=ve.rulebook;if(z.has(Oe.name))return Q.push(`duplicate active rulebook name "${Oe.name}" for ${ue}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return z.add(Oe.name),[{rules:fC(Oe),rulebook:{source:b,spec:ue,name:Oe.name,version:Oe.version,rules:Oe.rules.map((De)=>`${Oe.name}/${De.name}`)}}]}),le=ee.flatMap((ue)=>ue.rules);return{rules:le,rulebooks:ee.map((ue)=>ue.rulebook),knownRuleIds:new Set(le.map((ue)=>ue.name)),errors:B,warnings:Q,canValidateOverrides:B.length===0}}function fC(n){if(n.rulebook_version===2)return n.rules.map((u)=>({name:`${n.name}/${u.name}`,command:u.command,block_args:[],match:u.match,reason:u.reason,intent:u.intent}));return n.rules.map((u)=>({...u,name:`${n.name}/${u.name}`,match:void 0}))}function pC(n,u,b){let W=Xe(n),z=U(u,W),B=hC(z,b);if("error"in B)return{rulebook:null,errors:[B.error]};if(B.content===null)return{rulebook:null,errors:[`missing rulebook file ${z} for ${n}; ${gC(n)}`]};let Q=Te(B.content);if("problem"in Q)return{rulebook:null,errors:[`invalid rulebook ${z}: ${Q.problem}; fix that file`]};if(Q.rulebook.name!==W)return{rulebook:null,errors:[`rulebook name "${Q.rulebook.name}" in ${z} must match source "${n}"; fix that file`]};return{rulebook:Q.rulebook,errors:[]}}function Xe(n){return T(n)?j(n).name:n}function gC(n){return T(n)?`run ${pu} to vendor ${n}`:"create that file or remove that source from the rules config"}function hC(n,u){try{return{content:o(s(u,n))}}catch(b){if(b instanceof i)return{error:b.message};throw b}}function Te(n){let u;try{u=JSON.parse(n)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:he(u)}}catch(b){return{problem:b instanceof Error?b.message:"invalid rulebook"}}}function yC(n,u){return[...new Set([...n?.transparent_wrappers??[],...u?.transparent_wrappers??[]])]}function SC(n,u){let b=(n?.command_tools??[]).map(xu),W=(u?.command_tools??[]).map(xu);return[...b,...W.filter((z)=>!b.some((B)=>B.name===z.name))]}function xu(n){if(typeof n==="string")return{name:n};return n.cwd===void 0?{name:n.name}:{name:n.name,cwd:n.cwd}}function Au(n,u){return n.flatMap((b)=>{let W=u[b.name];if(W==="off")return[];if(W&&typeof W==="object")return[{...b,intent:W.intent??b.intent,reason:W.reason}];return[b]})}function dl(n,u,b){return Object.keys(n).filter((W)=>!u.has(W)).map((W)=>`unknown override key "${W}" in ${b}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function CC(n,u,b){return Object.keys(n).filter((W)=>u.has(W)).map((W)=>`project override cannot target user-scoped rule "${W}" in ${b}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Pu(n,u){return u.map((b)=>b.startsWith("Unable to access ")?b:`${n}: ${b}`)}function bC(n,u){return{rules:[],transparent_wrappers:[],command_tools:[],rulebooks:[],errors:[u],warnings:[],userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath}}function Tu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{types as EC}from"node:util";var vC=new Set(["applypatch","patch"]),RC=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),wC=new Set(["grep","grepsearch","rg"]),_C=new Set(["find","findbyname","glob"]),xC=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),AC=new Set(["command","diff","input","patch","patchtext"]),Iu=new TextEncoder,PC=new TextDecoder,TC=/\s/,IC=64;class h extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var ci=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function He(n){return n.replace(/[-_\s]/g,"").toLowerCase()}function fs(n){return xC.has(He(n))}function S(n){let u=He(n);if(vC.has(u))return"patch";if(wC.has(u))return"grep";if(_C.has(u))return"glob";if(RC.has(u))return"path";return"unknown"}function ye(n){if(!n||typeof n!=="object")return;$u(n);let u=Object.getOwnPropertyDescriptor(n,"command");if(!u){if("command"in n)rr();return}if(u.get||u.set)rr();let b=u.value;return typeof b==="string"&&b!==""?b:void 0}function Nu(n,u){return Lu(n,u,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Lu(n,u,b,W,z){let B=zu(n,W,z);if(typeof n==="string")return b?[n]:[];if(!B)return[];let Q=B.entries.flatMap(([ee,le])=>Lu(le,u,B.array?b:u.has(Wu(ee)),W,z+1));return W.ancestors.delete(B.object),Q}function Wu(n){return n.replace(/-/g,"_").toLowerCase()}function Fu(n){return Gu(n,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(OC)}function Gu(n,u,b,W){let z=zu(n,b,W);if(typeof n==="string")return u?[n]:[];if(!z)return[];let B=z.entries.flatMap(([Q,ee])=>Gu(ee,z.array?u:AC.has(Wu(Q)),b,W+1));return b.ancestors.delete(z.object),B}function kC(n,u,b){if(u.nodes++,n!==null&&typeof n==="object"&&b>ci.maxDepth||u.nodes>ci.maxNodes)rr();if(typeof n!=="string")return;let W=Buffer.byteLength(n);if(u.stringBytes+=W,W>ci.maxStringBytes||u.stringBytes>ci.maxAggregateStringBytes)rr()}function zu(n,u,b){if(kC(n,u,b),!n||typeof n!=="object")return null;let W=$u(n);if(u.ancestors.has(n))rr();let z=Reflect.ownKeys(n);if(u.keys+=z.length,u.keys>ci.maxKeys)rr();let B=z.flatMap((Q)=>{let ee=Object.getOwnPropertyDescriptor(n,Q);if(!ee||ee.get||ee.set)rr();return typeof Q==="string"&&ee.enumerable?[[Q,ee.value]]:[]});return u.ancestors.add(n),{object:n,array:W,entries:B}}function $u(n){if(EC.isProxy(n))rr();let u=Array.isArray(n),b=Object.getPrototypeOf(n);if(u&&b!==Array.prototype||!u&&b!==Object.prototype&&b!==null)rr();return u}function rr(){throw new h}function OC(n){let u=[],b=n.split(/\r?\n/),W=!1,z=!1,B=null,Q=null,ee=()=>{z=!1,B=null,Q=null};for(let le=0;le<b.length;le++){let ue=b[le]??"";if(ue==="*** Begin Patch"){W=!0,ee();continue}if(ue==="*** End Patch"){W=!1,ee();continue}if(ue.startsWith("@@")){let ve=MC(ue);if(z=!0,B=ve?.oldLines??null,Q=ve?.newLines??null,B===0&&Q===0)ee();continue}if(z&&B!==null&&Q!==null){let ve=ue.startsWith(" ")||ue.startsWith("-")?1:0,Oe=ue.startsWith(" ")||ue.startsWith("+")?1:0;if(B=Math.max(0,B-ve),Q=Math.max(0,Q-Oe),B===0&&Q===0)ee();continue}if(ue.startsWith("*** ")){ee(),u.push(...ul(ue));continue}if(z)continue;if(ue.startsWith("diff --git ")){u.push(...ul(ue));continue}if(ue.startsWith("--- ")){let ve=b[le+1]??"";if(!ve.startsWith("+++ "))continue;u.push(...fl(ms(ue.slice(4),!0),ms(ve.slice(4),!0))),le++;continue}if(!W)u.push(...ul(ue))}return u}function MC(n){let u=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(n);if(!u)return null;return{oldLines:Number(u[1]??1),newLines:Number(u[2]??1)}}function ul(n){let u=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(n);if(u?.[1])return Du(u[1]);let b=/^\*\*\* Move to: (.+)$/.exec(n);if(b?.[1])return Du(b[1]);if(n.startsWith("diff --git "))return DC(n.slice(11));let W=/^--- (.+)$/.exec(n);if(W?.[1])return Mu(W[1]);let z=/^\+\+\+ (.+)$/.exec(n);if(z?.[1])return Mu(z[1]);let B=/^(?:rename|copy) (?:from|to) (.+)$/.exec(n);if(B?.[1])return $C(B[1]);return[]}function DC(n){let u=NC(n);if(u.length===2&&u[0]&&u[1])return fl(u[0],u[1]);let b=LC(n);return b?fl(n.slice(b.oldStart,b.oldEnd),n.slice(b.newStart,b.newEnd)):[]}function NC(n){let u=[],b=0;while(b<n.length&&u.length<2){while(Ur(n[b]))b++;if(b>=n.length)break;let W=n[b]==='"'||n[b]==="'"?n[b]:void 0;if(!W){let B=b;while(b<n.length&&!Ur(n[b]))b++;u.push(n.slice(B,b));continue}let z=Bu(n,b,W);if(!z)return[];u.push(z.value),b=z.end}while(Ur(n[b]))b++;return b===n.length?u:[]}function LC(n){let u=0;while(u<n.length&&Ur(n[u]))u++;let b=n.length;while(b>u&&Ur(n[b-1]))b--;let W=0,z=u;while(z<b){if(!Ur(n[z])){z++;continue}let B=z;while(z<b&&Ur(n[z]))z++;if(B===u||z===b)continue;if(W++,W>IC)rr();if(WC(n,u,B,z,b))return{oldStart:u,oldEnd:B,newStart:z,newEnd:b}}return null}function WC(n,u,b,W,z){if(ml(n,u,b,W,z))return!0;let B=ku(n,"/",u,b),Q=ku(n,"/",W,z);if(B<=u||Q<=W)return!1;if(ml(n,u,B,W,Q))return!1;return ml(n,B+1,b,Q+1,z)}function ml(n,u,b,W,z){if(b-u!==z-W)return!1;for(let B=0;B<b-u;B++)if(n[u+B]!==n[W+B])return!1;return!0}function ku(n,u,b,W){for(let z=b;z<W;z++)if(n[z]===u)return z;return-1}function Ur(n){return n!==void 0&&TC.test(n)}function Bu(n,u,b){let W=[],z=u+1;while(z<n.length){let B=String.fromCodePoint(n.codePointAt(z)??0);if(B===b)return{value:PC.decode(Uint8Array.from(W)),end:z+1};if(B!=="\\"||b==="'"){W.push(...Iu.encode(B)),z+=B.length;continue}let Q=n.slice(z+1),ee=/^[0-7]{1,3}/.exec(Q)?.[0];if(ee){W.push(Number.parseInt(ee,8)),z+=ee.length+1;continue}W.push(...Iu.encode(FC(Q[0]??""))),z+=2}return null}function FC(n){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n}function GC(n){return di(BC(n))}function fl(n,u){if(n==="/dev/null")return Ou(u);if(u==="/dev/null")return Ou(n);if(n.startsWith("a/")&&u.startsWith("b/"))return[n.slice(2),u.slice(2)].flatMap(di);let b=zC(n,u)??(n===u?Uu(n):null);return[n,u,...b?[b]:[]].flatMap(di)}function Ou(n){let u=Uu(n);return[n,...u?[u]:[]].flatMap(di)}function Uu(n){let u=n.indexOf("/");return u>0&&u<n.length-1?n.slice(u+1):null}function zC(n,u){let b=n.indexOf("/"),W=u.indexOf("/");if(b<1||W<1)return null;if(n.slice(0,b)===u.slice(0,W))return null;let z=n.slice(b+1);return z===u.slice(W+1)?z:null}function Mu(n){return GC(ms(n,!0))}function $C(n){return di(ms(n,!1))}function ms(n,u){let b=n.trim(),W=b[0]==='"'||b[0]==="'"?b[0]:void 0;if(W){let z=Bu(b,0,W);if(z&&(u||b.slice(z.end).trim()===""))return z.value}return u?b.split("\t",1)[0]?.trim()??"":b}function BC(n){return n.startsWith("a/")||n.startsWith("b/")?n.slice(2):n}function di(n){return n===""||n==="/dev/null"?[]:[n]}function Du(n){let u=n.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return u===""||u==="/dev/null"?[]:[u]}import{accessSync as UC,constants as Hu,statSync as HC}from"node:fs";import{isAbsolute as pl,relative as jC,resolve as ju,sep as VC}from"node:path";function Pe(n){try{if(!HC(n).isDirectory())return!1;return UC(n,Hu.R_OK|Hu.X_OK),!0}catch{return!1}}function Mt(n,u,b){if(dr(n))return;let W=u.flatMap((B)=>ps(B,b));if(!W[0])return;let z=ps(pl(n)?n:ju(W[0],n),b)[0];if(!z)return;return W.some((B)=>qC(z,B))?z:void 0}function Vu(n,u,b){if(dr(n))return;return ps(pl(n)?n:ju(u,n),b)[0]}function bt(n,u){return n.flatMap((b)=>ps(b,u))[0]}function ps(n,u){let b=u.realpath(n);if(b===null)return[];return u.isDirectory(b)?[b]:[]}function qC(n,u){let b=jC(u,n);return b===""||b!==".."&&!b.startsWith(`..${VC}`)&&!pl(b)}var KC=8388608;async function vt(n){let u=[],b=0;for await(let W of n){let z=typeof W==="string"?Buffer.from(W,"utf-8"):Buffer.from(W.buffer,W.byteOffset,W.byteLength);if(b+=z.byteLength,b>KC)throw YC(n),Error("hook input byte limit exceeded");u.push(z)}return Buffer.concat(u,b).toString("utf-8")}function YC(n){let u=n.destroy??n.cancel;if(!u)return;try{Promise.resolve(u.call(n)).catch(()=>{})}catch{}}function d(n,u,b,W,z){if(b.kind!=="command")return{toolName:n,input:u,route:b,context:W};return{toolName:n,input:u,route:b,context:W,command:z}}import{existsSync as sb,readFileSync as ab}from"node:fs";var qu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.nested-recursive-delete-unread",category:"PowerShell",label:"Nested PowerShell recursive delete not read",description:"Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.",example:"pwsh -WorkingDirectory C:\\ -c 'Remove-Item -Recurse -Force *'",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-root-or-home",category:"Command Prompt",label:"cmd recursive delete root or home",description:"Blocks cmd rmdir /s or del /s of root or home paths.",example:"cmd /c rmdir /s /q C:\\",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-escaped-quote",category:"Command Prompt",label:"cmd recursive delete with escaped quotes",description:"Blocks cmd rmdir /s or del /s whose quoting can reach cmd as \\\" and split the target down to the drive root.",example:'cmd /c "rmdir /s /q \\"build output\\""',intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-git-metadata",category:"Command Prompt",label:"cmd recursive delete Git metadata",description:"Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.",example:"cmd /c rmdir /s /q .git",intent:"hard_stop",catastrophic:!0},{id:"cmd.recursive-delete-dynamic-target",category:"Command Prompt",label:"cmd recursive delete dynamic target",description:"Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.",example:"cmd /c del /s /q *.log",intent:"scope_down",activationCapability:"fail_closed"},{id:"cmd.recursive-delete-home-cwd",category:"Command Prompt",label:"cmd recursive delete from home cwd",description:"Blocks cmd rmdir /s or del /s while working in home.",example:"Set-Location $HOME; cmd /c rmdir /s /q build",intent:"scope_down"},{id:"cmd.recursive-delete-cwd-self",category:"Command Prompt",label:"cmd recursive delete current directory",description:"Blocks cmd rmdir /s or del /s of the current directory.",example:"cmd /c rmdir /s /q .",intent:"scope_down"},{id:"cmd.recursive-delete-outside-cwd",category:"Command Prompt",label:"cmd recursive delete outside cwd",description:"Blocks cmd rmdir /s or del /s outside the original cwd.",example:"cmd /c rmdir /s /q ..\\outside",intent:"scope_down"},{id:"cmd.recursive-delete-paranoid",category:"Command Prompt",label:"cmd recursive delete paranoid mode",description:"Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.",example:"cmd /c rmdir /s /q build",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"rsync.delete",category:"Filesystem",label:"rsync delete",description:"Blocks rsync delete modes whose destination is outside the cwd, a temp root, or a variable.",example:'rsync -a --delete "$SRC/" "$DST/"',intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"Filesystem format on a device",description:"Blocks mkfs, mke2fs, and newfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"disk.erase",category:"Filesystem",label:"Disk erase or repartition",description:"Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.",example:"diskutil eraseDisk APFS Untitled disk4",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"redirect.block-device",category:"Filesystem",label:"Redirect onto a disk device",description:"Blocks output redirects whose literal target is a disk device path under /dev.",example:"cat disk.img > /dev/sda",intent:"manual_only"},{id:"network.cloud-metadata",category:"Network",label:"Cloud metadata endpoint",description:"Blocks HTTP clients, raw socket tools, and code interpreters naming a cloud metadata host (169.254.169.254, fd00:ec2::254, 169.254.170.2, 169.254.170.23, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200).",example:"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",intent:"manual_only"},{id:"network.upload-remote",category:"Network",label:"Data upload to a remote host",description:"Blocks curl and wget requests that send a body or upload a file in strict mode unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]).",example:"curl -T backup.tar https://uploads.example.com/",intent:"manual_only",activationCapability:"fail_closed"},{id:"unshare.user-namespace",category:"Execution",label:"unshare user namespace",description:"Blocks unshare creating a user namespace: -U/--user, -r/--map-root-user, -c/--map-current-user, --map-user(s), --map-group(s), or --map-auto.",example:"unshare -r id",intent:"manual_only"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],gl=new Set(qu.map((n)=>n.id)),Z=qu,ZC=new Map(Z.map((n)=>[n.id,n.intent]));function st(n,u){return{id:n,reason:u,intent:ZC.get(n)??"manual_only"}}var hl=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],gs={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},XC=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],QC=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],yl=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...QC.flatMap((n)=>XC.map((u)=>({id:["secret.home",n.idSlug,u.slice(1)].join("."),category:"Home path",label:[n.label,u].join(""),description:["Blocks home ",n.label,u," credential backup files."].join(""),suffixParts:[...n.directoryParts,[n.basename,u].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var hs=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml","<project>/.codex/config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]},{id:"secret.cli.droid",category:"Coding CLI credential",label:"Factory Droid credentials",paths:["~/.factory/auth.encrypted","~/.factory/auth.v2.file","~/.factory/auth.v2.key","~/.factory/auth.v2.loginkeychain"]},{id:"secret.cli.droid.config",category:"Coding CLI config",label:"Factory Droid config",paths:["~/.factory/settings.json","~/.factory/hooks.json","~/.factory/mcp.json","<project>/.factory/mcp.json"]},{id:"secret.cli.devin",category:"Coding CLI credential",label:"Devin CLI credentials",paths:["~/.local/share/devin/credentials.toml","~/.local/share/devin/mcp/oauth"]},{id:"secret.cli.devin.config",category:"Coding CLI config",label:"Devin CLI config",paths:["~/.config/devin/config.json"]}],Ku=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],JC=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Sl=Ku.map((n)=>({id:`secret.variant.${n.slug}.separator`,category:"Variant",label:`${n.label}-* / ${n.label}_*`,description:`Blocks ${n.label} variants with dash or underscore suffixes.`,prefix:n.prefix})),Cl=Ku.flatMap((n)=>JC.map((u)=>({id:`secret.variant.${n.slug}.${u.slice(1)}`,category:"Variant",label:`${n.label}${u}`,description:`Blocks ${n.label}${u} private credential variants.`,prefix:n.prefix,suffix:u}))),ui={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},bl=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((n)=>({id:`secret.ext.${n}`,category:"Extension",label:`.${n}`,description:`Blocks files with the .${n} extension.`,extension:n})),El=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xt=[...hl,gs,...yl,...Sl,...Cl,ui,...bl,...El,...hs].map((n)=>({id:n.id,category:n.category,label:n.label,...n.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in n?{paths:n.paths}:{description:n.description}})),ys=new Set(hs.flatMap((n)=>n.category==="Coding CLI config"?[n.id]:[])),vl=new Set(xt.map((n)=>n.id));import{isAbsolute as Rl,join as eb,normalize as tb,sep as Ss}from"node:path";var Cs=process.platform==="win32",Yu=/[*?]/;function wl(n){let u=n.trim(),b=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Cs?u.replaceAll("\\","/"):u);if(!b)return null;let W=b[1]??"",z=b[2]??"";if(Yu.test(W)||z==="."||z==="..")return null;return{root:W||"/",name:z}}function mi(n,u){if(n==="~")return u;if(n.startsWith("~/"))return`${u}${n.slice(1)}`;return n}function _l(n,u){if(typeof n!=="string"||n.trim()==="")return"must be a non-empty path string";let b=mi(n.trim(),u);if(!Rl(b))return"must be an absolute path or start with ~/";return fi(b,u)}function xl(n,u){let b=Zu(n,u);if(b===null)return"must be a non-empty path string";if(!Rl(b))return null;if(fi(b,u)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var nb="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",rb="cannot cover the guard's own configuration";function Zu(n,u){if(typeof n!=="string"||n.trim()==="")return null;let b=n.trim(),W=Cs?b.replaceAll("\\","/"):b;return mi(W.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),u)}function Al(n,u){let b=Zu(n,u);if(b===null)return"must be a non-empty path string";let W=wl(b)?.root??b;if(Yu.test(W))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Rl(W))return null;if(fi(W,u)!==null)return nb;return ob(W,u)?rb:null}function ob(n,u){let b=bs(n),W=bs(eb(u,".cc-safety-net"));return b===W||b.startsWith(`${W}${Ss}`)}function fi(n,u){let b=bs(n),W=bs(u);if(b===W)return"cannot be the home directory";let z=b.endsWith(Ss)?b:`${b}${Ss}`;if(W.startsWith(z))return"cannot contain the home directory";return null}function bs(n){let u=tb(n);if(Cs)u=u.replace(/\//g,"\\").toLowerCase();if(u.length>(Cs?3:1)&&u.endsWith(Ss))u=u.slice(0,-1);return u}var Xu=30,Es=1,vs=365;function Qu(n){if(typeof n!=="number"||!Number.isInteger(n))return 30;if(n<1)return 1;return n>365?365:n}var Ju=new Set(Z.filter((n)=>n.catastrophic).map((n)=>n.id));function Gt(n,u){if(!n)return null;if(Ju.has(n.id))return n;if(u?.destructiveCommandProtectionEnabled===!1)return null;let b=u?.effectiveDestructiveCommandRules[n.id];return b&&!b.enabled?null:n}function un(n,u,b){if(Ju.has(u))return!0;if(n?.destructiveCommandProtectionEnabled===!1)return!1;return n?.effectiveDestructiveCommandRules[u]?.enabled??b}function X(n,u){return Object.freeze(Object.fromEntries(Z.map((b)=>{let W=b.activationCapability?u[b.activationCapability]:void 0,z=W?.enabled??!0,B=n.destructiveCommandRuleOverrides[b.id],Q=b.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...B?{override:B}:{}}:n.destructiveCommandProtectionEnabled?B?{enabled:B==="on",inheritedEnabled:z,changesInherited:B==="on"!==z,source:"rule_override",...b.activationCapability?{activationCapability:b.activationCapability}:{},override:B}:{enabled:z,inheritedEnabled:z,changesInherited:!1,source:W?.source??"built_in_default",...b.activationCapability?{activationCapability:b.activationCapability}:{}}:{enabled:!1,inheritedEnabled:z,changesInherited:!1,source:"master_disabled",...b.activationCapability?{activationCapability:b.activationCapability}:{},...B?{override:B}:{}};return[b.id,Object.freeze(Q)]})))}function em(n,u){return Object.freeze({...n,effectiveDestructiveCommandRules:X(n,u)})}var tm={standard:0,strict:1,paranoid:2};function se(n,u,b=!1,W=n.safety.level){let z=ib(n,u,W),B=new Set(b?z.map((ve)=>ve.field):[]),Q=(ve,Oe)=>B.has(ve)?void 0:Oe,ee=(ve,Oe)=>Object.fromEntries(Object.entries(Oe??{}).filter(([De])=>!B.has(`${ve}.${De}`))),le=(ve,Oe)=>Oe?.filter((De)=>!B.has(`${ve}.${De}`));return{policy:{version:1,safety:{level:Q("safety.level",u.safety?.level)??n.safety.level,overrides:{...n.safety.overrides,...ee("safety.overrides",u.safety?.overrides)}},workflow:{worktree_mode:Q("workflow.worktree_mode",u.workflow?.worktree_mode)??n.workflow.worktree_mode},destructive_command_protection:{enabled:Q("destructive_command_protection.enabled",u.destructive_command_protection?.enabled)??n.destructive_command_protection.enabled,overrides:{...n.destructive_command_protection.overrides,...ee("destructive_command_protection.overrides",u.destructive_command_protection?.overrides)},allow_paths:Pl(n.destructive_command_protection.allow_paths,le("destructive_command_protection.allow_paths",u.destructive_command_protection?.allow_paths))},secret_protection:{enabled:Q("secret_protection.enabled",u.secret_protection?.enabled)??n.secret_protection.enabled,overrides:{...n.secret_protection.overrides,...ee("secret_protection.overrides",u.secret_protection?.overrides)},deny_paths:Pl(n.secret_protection.deny_paths,u.secret_protection?.deny_paths),allow_paths:Pl(n.secret_protection.allow_paths,le("secret_protection.allow_paths",u.secret_protection?.allow_paths))},audit:n.audit},weakenings:z.map((ve)=>ve.message)}}function Pl(n,u){return[...new Set([...n,...u??[]])]}function ib(n,u,b){let W=u.safety?.level,z=ts[b];return[...W&&tm[W]<tm[n.safety.level]?[{field:"safety.level",message:`project policy lowers level: ${n.safety.level} -> ${W}`}]:[],...Co.flatMap((B)=>u.safety?.overrides?.[B]===!1&&(n.safety.overrides[B]??z[B])?[{field:`safety.overrides.${B}`,message:`project policy disables ${B}`}]:[]),...u.workflow?.worktree_mode===!0&&!n.workflow.worktree_mode?[{field:"workflow.worktree_mode",message:"project policy enables worktree mode relaxations"}]:[],...u.destructive_command_protection?.enabled===!1&&n.destructive_command_protection.enabled?[{field:"destructive_command_protection.enabled",message:"project policy disables destructive command protection"}]:[],...u.secret_protection?.enabled===!1&&n.secret_protection.enabled?[{field:"secret_protection.enabled",message:"project policy disables secret protection"}]:[],...nm("destructive_command_protection.overrides",u.destructive_command_protection?.overrides,(B)=>n.destructive_command_protection.enabled&&n.destructive_command_protection.overrides[B]!=="off"),...nm("secret_protection.overrides",u.secret_protection?.overrides,(B)=>n.secret_protection.enabled&&(n.secret_protection.overrides[B]==="on"?!0:n.secret_protection.overrides[B]!=="off"&&!ys.has(B))),...n.destructive_command_protection.enabled?rm(n.destructive_command_protection.allow_paths,u.destructive_command_protection?.allow_paths).map((B)=>({field:`destructive_command_protection.allow_paths.${B}`,message:`project policy adds destructive allow path: ${B}`})):[],...n.secret_protection.enabled?rm(n.secret_protection.allow_paths,u.secret_protection?.allow_paths).map((B)=>({field:`secret_protection.allow_paths.${B}`,message:`project policy adds secret allow path: ${B}`})):[]]}function nm(n,u,b){return Object.entries(u??{}).flatMap(([W,z])=>z==="off"&&b(W)?[{field:`${n}.${W}`,message:`project policy disables rule ${W}`}]:[])}function rm(n,u){return(u??[]).filter((b)=>!n.includes(b))}var Il=new Set(["standard","strict","paranoid"]),ae={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Xu}};function sm(n,u){let b=fb(p(n,u),n.home),W=L(n,u)?{exists:!1,policy:N(),errors:[]}:et(x(u.cwd),n.home),z=be(W.parsed,n.home),B=k(r.projectTightenOnly,n.env),Q=b.gui??ae,ee=Object.keys(z.policy).length>0?se(Q,z.policy,B,Xd(Q.safety.level,n.env)):void 0,le=[...b.errors,...W.errors,...z.diagnostics],ue=(b.fallback==="defaults"&&ee?"salvaged":b.fallback)??(b.gui?void 0:W.fallback)??(le.length>0?"salvaged":void 0),ve=z.policy.safety?.level&&ee?.policy.safety.level===z.policy.safety.level?"project":b.levelPresent?"user":"default";return{...ee?pi(ee.policy):b.policy,errors:le,...ue?{fallback:ue}:{},...W.exists?{policyScopes:{levelScope:ve,weakenings:ee?.weakenings??[],weakeningsIgnored:B}}:{}}}var lb="project policy audit settings are ignored; audit is user scope only";function be(n,u){if(!Wn(n))return{policy:{},diagnostics:[]};let b=Wn(n.safety)?n.safety:{},W=Wn(n.workflow)?n.workflow:{},z=Wn(n.destructive_command_protection)?n.destructive_command_protection:{},B=Wn(n.secret_protection)?n.secret_protection:{},Q={...Il.has(b.level)?{level:b.level}:{},...Wn(b.overrides)?om({overrides:am(b.overrides,Co,["safety","overrides"],Hr)}):{}},ee={...typeof z.enabled==="boolean"?{enabled:z.enabled}:{},...z.overrides!==void 0?{overrides:Rs(z.overrides,gl,cm,Hr)}:{},...z.allow_paths!==void 0?{allow_paths:vo(z.allow_paths,_l,u,["destructive_command_protection","allow_paths"],Hr)}:{}},le={...typeof B.enabled==="boolean"?{enabled:B.enabled}:{},...B.overrides!==void 0?{overrides:Rs(B.overrides,vl,dm,Hr)}:{},...B.deny_paths!==void 0?{deny_paths:vo(B.deny_paths,xl,u,["secret_protection","deny_paths"],Hr)}:{},...B.allow_paths!==void 0?{allow_paths:vo(B.allow_paths,Al,u,["secret_protection","allow_paths"],Hr)}:{}};return{policy:om({safety:Q,workflow:typeof W.worktree_mode==="boolean"?{worktree_mode:W.worktree_mode}:{},destructive_command_protection:ee,secret_protection:le}),diagnostics:n.audit===void 0?[]:[lb]}}function am(n,u,b,W){return Object.fromEntries(u.flatMap((z)=>{let B=n[z];if(typeof B==="boolean")return[[z,B]];if(B!==void 0)W(e([...b,z],kl));return[]}))}function om(n){return Object.fromEntries(Object.entries(n).flatMap((u)=>Object.keys(u[1]).length>0?[u]:[]))}var Hr=()=>{return},kl="must be a boolean",Ol="must be an object if provided",lm=`must be an integer between ${Es} and ${vs}`,cm={path:["destructive_command_protection","overrides"],label:"destructive command"},dm={path:["secret_protection","overrides"],label:"secret protection"},St=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function wt(n,u){let b=[];return{policy:um(n,u,(z)=>{b.push(z)}),issues:b}}function _(n,u){return um(n,u,Hr)}function um(n,u,b){if(!Wn(n))return b(e([],"Config must be an object")),N();if(n.version!==1)b(e(["version"],"must be 1"));let W=Eo(n.safety,["safety"],["level","overrides"],b),z=Eo(W.overrides,["safety","overrides"],Co,b),B=Eo(n.workflow,["workflow"],["worktree_mode"],b),Q=Eo(n.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],b),ee=Eo(n.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],b),le=Eo(n.audit,["audit"],["retention_days"],b);return mm(n,St,[],b),{version:1,safety:{level:cb(W.level,b),overrides:am(z,Co,["safety","overrides"],b)},workflow:{worktree_mode:Tl(B.worktree_mode,["workflow","worktree_mode"],!1,b)},destructive_command_protection:{enabled:Tl(Q.enabled,["destructive_command_protection","enabled"],!0,b),overrides:Rs(Q.overrides,gl,cm,b),allow_paths:vo(Q.allow_paths,_l,u,["destructive_command_protection","allow_paths"],b)},secret_protection:{enabled:Tl(ee.enabled,["secret_protection","enabled"],!0,b),overrides:Rs(ee.overrides,vl,dm,b),deny_paths:vo(ee.deny_paths,xl,u,["secret_protection","deny_paths"],b),allow_paths:vo(ee.allow_paths,Al,u,["secret_protection","allow_paths"],b)},audit:{retention_days:db(le.retention_days,b)}}}function Eo(n,u,b,W){if(n===void 0)return{};if(!Wn(n))return W(e(u,Ol)),{};return mm(n,b,u,W),n}function mm(n,u,b,W){for(let z of Object.keys(n).filter((B)=>!u.includes(B)))W({path:b,message:z,kind:"unknownKeys"})}function cb(n,u){if(n===void 0)return"standard";if(Il.has(n))return n;return u(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Tl(n,u,b,W){if(typeof n==="boolean")return n;if(n!==void 0)W(e(u,kl));return b}function db(n,u){if(!(n===void 0||typeof n==="number"&&Number.isInteger(n)&&n>=Es&&n<=vs))u(e(["audit","retention_days"],lm));return Qu(n)}function Rs(n,u,b,W){if(n===void 0)return{};if(!Wn(n))return W(e(b.path,Ol)),{};return Object.fromEntries(Object.entries(n).flatMap(([z,B])=>{if(!u.has(z))return W({path:[...b.path,z],message:`unknown ${b.label} rule id "${z}"`,kind:"key"}),[];if(B==="on"||B==="off")return[[z,B]];return W(e([...b.path,z],'must be "on" or "off"')),[]}))}function vo(n,u,b,W,z){if(n===void 0)return[];if(!Array.isArray(n))return z(e(W,"must be an array of paths")),[];return n.flatMap((B,Q)=>{let ee=u(B,b);if(ee===null)return[B];return z(typeof B==="string"?dn([...W,Q],ee):e([...W,Q],ee)),[]})}function Wn(n){return!!n&&typeof n==="object"&&!Array.isArray(n)}function N(){return structuredClone(ae)}function Qe(n,u){let b=O({safety:tt(n.safety)},u),W=X({destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides},b.capabilities),z=Object.values(W),B=z.filter((Q)=>Q.source!=="catastrophic");return{selectedPreset:n.safety.level,effectiveLevel:b.effectiveLevel,capabilities:b.capabilities,rules:W,counts:{enabled:B.filter((Q)=>Q.enabled).length,disabled:B.filter((Q)=>!Q.enabled).length,effectiveCustomizations:z.filter((Q)=>Q.changesInherited).length}}}function et(n,u){if(!sb(n))return{exists:!1,policy:N(),errors:[]};try{let b=ab(n,"utf-8");if(!b.trim())return{exists:!0,policy:N(),errors:[`${n}: Config file is empty`],fallback:"defaults"};let W=JSON.parse(b),z=wt(W,u);if(z.issues.length===0)return{exists:!0,parsed:W,policy:z.policy,errors:[]};return{exists:!0,parsed:W,policy:z.policy,errors:z.issues.map((B)=>`${n}: ${mb(B)}`),fallback:Wn(W)?"salvaged":"defaults"}}catch(b){let W=b instanceof Error?b.message:String(b);return{exists:!0,policy:N(),errors:[`${n}: ${b instanceof SyntaxError?"Invalid JSON":W}`],fallback:"defaults"}}}var ub=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ol,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[kl,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[lm,`not an integer between ${Es} and ${vs}`]]);function mb(n){let u=ll(n.path);if(n.kind==="unknownKeys")return`${u===""?"":`${u}.`}${n.message}: unknown field`;if(n.kind==="key")return`${u}: unknown rule id`;let b=ub.get(n.message)??n.message;return u===""?b:`${u}: ${b}`}function fb(n,u){let b=et(n,u);if(!b.exists){let W=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Wn(W))return{policy:pi(N()),errors:[]};let z=_(W,u);return{policy:pi(z),gui:z,errors:[],levelPresent:im(W)}}if(b.parsed===void 0)return{policy:pi(N()),errors:b.errors,...b.fallback?{fallback:b.fallback}:{}};return{policy:pi(b.policy),gui:b.policy,errors:b.errors,...b.fallback?{fallback:b.fallback}:{},levelPresent:im(b.parsed)}}function im(n){let u=Wn(n)&&Wn(n.safety)?n.safety:{};return Il.has(u.level)}function Ct(n){let u=Object.entries(n),b=new Set(u.flatMap(([W,z])=>z==="on"?[W]:[]));return[...new Set([...[...ys].filter((W)=>!b.has(W)),...u.flatMap(([W,z])=>z==="off"?[W]:[])])]}function pi(n){return{safety:tt(n.safety),worktreeMode:n.workflow.worktree_mode,destructiveCommandProtectionEnabled:n.destructive_command_protection.enabled,destructiveCommandRuleOverrides:n.destructive_command_protection.overrides,destructiveCommandAllowPaths:n.destructive_command_protection.allow_paths,secretProtection:{enabled:n.secret_protection.enabled,disabledRules:Ct(n.secret_protection.overrides),denyPaths:n.secret_protection.deny_paths,allowPaths:n.secret_protection.allow_paths}}}function tt(n){let u={...n.overrides.fail_closed!==void 0?{failClosed:n.overrides.fail_closed}:{},...n.overrides.paranoid_rm!==void 0?{paranoidRm:n.overrides.paranoid_rm}:{},...n.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:n.overrides.paranoid_interpreters}:{}};return{level:n.level,...Object.keys(u).length>0?{overrides:u}:{}}}function w(n,u){let b=J(n,u),W=sm(n,u),z={rules:b.rules,transparentWrappers:b.transparent_wrappers,commandTools:b.command_tools,safety:W.safety,worktreeMode:W.worktreeMode,destructiveCommandProtectionEnabled:W.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:W.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:W.destructiveCommandAllowPaths,secretProtection:{enabled:W.secretProtection.enabled??!0,disabledRules:W.secretProtection.disabledRules??[],denyPaths:W.secretProtection.denyPaths,allowPaths:W.secretProtection.allowPaths??[]}},B={...b.userConfig?.overrides,...b.projectConfig?.overrides},Q=Object.freeze(Object.fromEntries(z.rules.map((ee)=>{let le=b.rulebooks.find((ve)=>ve.rules.includes(ee.name)),ue=B[ee.name];return[ee.name,Object.freeze({id:ee.name,...le?{rulebook:Object.freeze({name:le.name,version:le.version}),...yb(le.spec)?{source:le.spec}:{}}:{},...ue&&typeof ue==="object"?{override:Object.freeze({type:"reason",reason:ue.reason})}:{}})]})));return Ge(z,pb(b,W),Q,W.policyScopes)}function nt(n){if(n.state==="ready")return{state:n.state};return{state:n.state,reason:n.reason}}function pb(n,u){let b=hb(u);if(n.errors.length===0&&n.warnings.length===0&&!b)return;return{diagnostics:[...n.errors,...n.warnings,...u.errors],reason:Sb(n.errors.length>0?gb(n.errors):void 0,n.warnings.length>0?Dl(n.warnings.join("; ")):void 0,b)}}function gb(n){return`${Dl(n.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function hb(n){if(n.errors.length===0)return;let u=n.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${n.errors.join("; ")}. Enforcing ${u}; the invalid values are not active. Fix the policy file manually`}function yb(n){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(n)}function Ge(n,u,b=Object.freeze({}),W){let z=Ml(structuredClone(n)),B=W?{policyScopes:Ml(structuredClone(W))}:{};if(!u)return Object.freeze({state:"ready",policy:z,diagnostics:Object.freeze([]),ruleMetadata:b,...B});return Object.freeze({state:"degraded",policy:z,diagnostics:Object.freeze([...u.diagnostics]),reason:u.reason,ruleMetadata:b,...B})}function Ml(n){if(typeof n!=="object"||n===null)return n;for(let u of Object.values(n))Ml(u);return Object.freeze(n)}function Sb(...n){return Dl(n.filter((u)=>!!u).join("; "))}function Dl(n){return/[.!?]$/.test(n)?n:`${n}.`}function _e(n){let u=n.effectiveCapabilities,b=u.fail_closed.enabled,W=u.paranoid_rm.enabled,z=u.paranoid_interpreters.enabled;return{policy:em(n.policySnapshot.policy,u),effectiveCapabilities:u,effectiveLevel:Ka({failClosed:b,paranoidRm:W,paranoidInterpreters:z}),strict:b,paranoidRm:W,paranoidInterpreters:z,worktreeMode:n.worktreeMode??!1}}import{dirname as eT,isAbsolute as tT,join as hh,parse as nT,resolve as rT,sep as oT}from"node:path";function gi(n,u){if(n!=="powershell")return u[0]?.provenance==="command-substitution";let b=u[0]?.text==="&"||u[0]?.text==="."?1:0,W=u[b];return W!==void 0&&(W.provenance!=="literal"||b===0&&bb(W))}var Cb=/^@(['"])[ \t]*(?:\r\n|[\r\n])/;function Ro(n,u){let b=Cb.exec(n.slice(u)),W=b?.[1];return b&&W?{quote:W,bodyStart:u+b[0].length}:null}function bb(n){return Ro(n.raw,0)!==null}var Eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function ws(n,u){return n?.provenance==="literal"&&!n.quoted&&n.raw===u&&n.text===u}function hi(n){let u=ws(n.words[0],"time")?1:0,b=u===1&&ws(n.words[u],"-p")?u+1:u,W=u===1&&ws(n.words[b],"--")?b+1:b,z=ws(n.words[W],"!")?W+1:W,B=n.words.slice(z).find((Q)=>!Eb.test(Q.text));return B?.provenance==="literal"?B.text:void 0}var xr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function _s(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xs(n,u,b){n.push(b),u.reset()}function As(n){let u=[];return{parts:u,push:(b,W,z)=>{if(W<=b)return;u.push({raw:n.slice(b,W),span:{start:b,end:W},provenance:z})}}}function Nl(n){let u=n.parts??[{raw:n.raw,span:n.span,provenance:n.provenance}];return{kind:"word",...n,parts:u}}function wo(n,u,b,W,z,B,Q){return Nl({text:W,raw:n.slice(u,b),span:{start:u,end:b},provenance:z,quoted:B,...Q?{parts:Q}:{}})}function Ll(n,u,b){if(u>=b||pm(n[u]??""))return null;let W="",z=!1,B=!1,Q=u;while(Q<b&&!pm(n[Q]??"")){let ee=n[Q]??"";if(ee==="'"){z=!0;let le=fm(n,Q+1,b,"'");W+=le.text,B||=!le.closed,Q=le.next;continue}if(ee==='"'){z=!0;let le=fm(n,Q+1,b,'"');W+=le.text,B||=!le.closed,Q=le.next;continue}if(ee==="\\"){z=!0;let le=n[Q+1];if(!le||le===`
+`||le==="\r"){B=!0;break}W+=le,Q+=2;continue}if(ee==="`"||n.startsWith("$(",Q)||n.startsWith("${",Q)||n.startsWith("<(",Q)||n.startsWith(">(",Q))B=!0;W+=ee,Q++}return{delimiter:W,quoted:z,next:Q,ambiguous:B}}function Wl(n,u,b,W){let z=[],B=u;for(let Q of W){let ee=B,le=!1;while(B<b){let ue=vb(n,B,b);if((Q.stripTabs?ue.text.replace(/^\t+/,""):ue.text)===Q.delimiter){Q.attach({body:Q.stripTabs?Rb(n.slice(ee,B)):n.slice(ee,B),delimiter:Q.delimiter,quotedDelimiter:Q.quotedDelimiter,bodySpan:{start:ee,end:B},terminatorSpan:{start:B,end:ue.contentEnd}}),B=ue.next,le=!0;break}if(ue.next<=B)break;B=ue.next}if(le)continue;return z.push({code:"unterminated-heredoc",message:`heredoc delimiter ${Q.delimiter} was not found`}),{next:b,issues:z,terminated:!1}}return{next:B,issues:z,terminated:!0}}function fm(n,u,b,W){let z="",B=u;while(B<b&&n[B]!==`
+`&&n[B]!=="\r"){let Q=n[B]??"";if(Q===W)return{text:z,next:B+1,closed:!0};if(W==='"'&&Q==="\\"&&n[B+1]){let ee=n[B+1]??"";z+=["$","`",'"',"\\"].includes(ee)?ee:`\\${ee}`,B+=2;continue}z+=Q,B++}return{text:z,next:B,closed:!1}}function pm(n){return n!=="\r"&&(/[\s;&|<>)]/u.test(n)||n==="`")}function vb(n,u,b){let W=u;while(W<b&&n[W]!==`
+`)W++;let z=W>=b?b:W+1;return{text:n.slice(u,W),contentEnd:W,next:z}}function Rb(n){return n.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Cm=new Set(["&&","||","|","|&"]),wb=new Set(["!","do","elif","else","if","then","until","while"]);function bm(n,u){let b={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"posix",source:n,span:b,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W={wordsUsed:0,maxWords:u.maxWords,quotedExpansionEnd:1/0},z=Is(n,0,n.length,u,W,0),B=[...z.issues,...Db(n,W.quotedExpansionEnd,z.nodes)?[wm]:[],...Ob.test(n)?[Rm]:[]];return{kind:"program",dialect:"posix",source:n,span:b,status:Os(B,z.limited),issues:B,nodes:z.nodes}}function Is(n,u,b,W,z,B,Q){let ee=[],le=[],ue=_s(),ve=[],Oe=()=>{if(ue.words.length===0&&ue.redirections.length===0)return;let Me={start:ue.start,end:ue.end},Ne=ue.words.map((Le)=>Le.text);xs(ee,ue,{kind:"command",dialect:"posix",source:n.slice(Me.start,Me.end),span:Me,words:ue.words,redirections:ue.redirections,nested:ue.nested,displayText:le.length>0&&ee.length===0?n.slice(u,b):Ne.join(" ")})},De=u;while(De<b){let Me=n[De];if(!Me)break;if(Q&&Me===Q)return Oe(),Sm(ee,le),{nodes:ee,issues:le,next:De+1,closed:!0,limited:!1,pendingHeredocs:ve};if(Si(Me)){if(Me.charCodeAt(0)>127)le.push(Rm);if(Me===`
 `||Me==="\r"){Oe();let Rt=Me==="\r"&&n[De+1]===`
-`?De+2:De+1,Tt=ee.at(-1);if(Tt?.kind!=="connector"||!Sm.has(Tt.operator))ee.push({kind:"connector",operator:n.slice(De,Rt),span:{start:De,end:Rt}});if(ve.length>0){let kt=Wl(n,Rt,b,ve.splice(0));le.push(...kt.issues),De=kt.next;continue}De=Rt;continue}De++;continue}if(Me==="\\"&&n[De+1]===`
+`?De+2:De+1,Tt=ee.at(-1);if(Tt?.kind!=="connector"||!Cm.has(Tt.operator))ee.push({kind:"connector",operator:n.slice(De,Rt),span:{start:De,end:Rt}});if(ve.length>0){let kt=Wl(n,Rt,b,ve.splice(0));le.push(...kt.issues),De=kt.next;continue}De=Rt;continue}De++;continue}if(Me==="\\"&&n[De+1]===`
 `){De+=2;continue}if(Me==="#"){while(De<b&&n[De]!==`
-`&&n[De]!=="\r")De++;continue}let Ne=ue.start===-1?Zb(n,De,b):void 0;if(Ne){if(Gl(ee,le),B>=W.maxDepth)return _o(ee,le,De,"depth-limit",W.maxDepth);if(!Fl(z))return _o(ee,le,De,"word-limit",W.maxWords);let Rt=Is(n,Ne.braceIndex+1,b,W,z,B+1,"}"),Tt=Rt.next,kt={start:Ne.braceIndex+1,end:Rt.closed?Tt-1:Tt},lt=pm(n,kt,Rt);if(ee.push({kind:"function",name:Ne.name,span:{start:De,end:Tt},body:lt}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||Ci(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ve.push(...Rt.pendingHeredocs),Rt.limited)return Ts(ee,le,Rt.next);if(!Rt.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});De=Tt;continue}let Le=ks(n,De);if(Le){if(Oe(),!Im(ee.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});ee.push({kind:"connector",operator:Le,span:{start:De,end:De+Le.length}}),De+=Le.length;continue}if(Me===")"){Oe(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),ee.push({kind:"unknown",source:Me,span:{start:De,end:De+1}}),De++;continue}if((Me==="("||Me==="{"&&Wb(n,De,b))&&ue.start===-1){if(Gl(ee,le),B>=W.maxDepth)return _o(ee,le,De,"depth-limit",W.maxDepth);let Rt=Me==="("?")":"}",Tt=Is(n,De+1,b,W,z,B+1,Rt),kt=Tt.next,lt={start:De+1,end:Tt.closed?kt-1:kt},Vt=pm(n,lt,Tt);if(ee.push({kind:"group",style:Me==="("?"subshell":"brace",span:{start:De,end:kt},body:Vt}),le.push(...Tt.issues),Tt.pendingHeredocs.length>0||Ci(Tt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ve.push(...Tt.pendingHeredocs),Tt.limited)return Ts(ee,le,Tt.next);if(!Tt.closed)le.push({code:Me==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Me} group is not closed`});De=kt;continue}let We=(Me==="<"||Me===">")&&n[De+1]!=="("?xb(n,De):null;if(We){let Rt=ue.words.at(-1),Tt=Rt&&Rt.span.end===De&&/^[0-9]+$/.test(Rt.raw)?Number(Rt.raw):void 0;if(Tt!==void 0)ue.words.pop();let kt=Tt===void 0?De:Rt?.span.start??De;ue.start=ue.start===-1?De:ue.start;let lt=De+We.length;while(lt<b&&/[ \t]/.test(n[lt]??""))lt++;let Vt=n[lt],Ut=lt>De+We.length&&Vt==="#",an=!Vt||Si(Vt)||!!ks(n,lt)||Vt===Q||Vt===")"||Ut||(Vt==="<"||Vt===">")&&n[lt+1]!=="(",Sn=We==="<<"||We==="<<-",ut=Sn?Ll(n,lt,b):void 0,zt=ut?{word:wo(n,lt,ut.next,ut.delimiter,"literal",ut.quoted),nested:[],issues:[],next:ut.next,limited:!1}:!an?zl(n,lt,b,W,z,B):void 0;if(zt){if(le.push(...zt.issues),zt.limited)return Ts(ee,le,zt.next);if(!Fl(z))return _o(ee,le,zt.next,"word-limit",W.maxWords)}let Qt=zt?.next??De+We.length,on={kind:"redirection",operator:We,span:{start:kt,end:Qt},...Tt===void 0?{}:{fd:Tt},...zt?{target:zt.word}:{}};if(ue.redirections.push(on),Sn&&!ut)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(ut){if(ut.ambiguous||ut.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let mn=ue.nested;ve.push({delimiter:ut.delimiter,quotedDelimiter:ut.quoted,stripTabs:We==="<<-",attach:(vn)=>{if(on.heredoc=vn,vn.quotedDelimiter)return;let sn=wb(n,vn.bodySpan.start,vn.bodySpan.end,W,z,B+1);mn.push(...sn.programs),le.push(...sn.issues)}})}if(!Sn&&!zt)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(zt)ue.nested.push(...zt.nested);ue.end=Qt,De=Qt;continue}let Be=ue.start===-1;if(Be)Gl(ee,le);let ze=zl(n,De,b,W,z,B);if(le.push(...ze.issues),ze.limited)return Ts(ee,le,ze.next);let it=zb(ue.words)?jb(n,ze.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(it?.limitCode)return _o(ee,le,ze.next,it.limitCode,it.limitCode==="word-limit"?W.maxWords:it.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let at=it?.words??[ze.word];for(let Rt of at){if(!Fl(z))return _o(ee,le,ze.next,"word-limit",W.maxWords);ue.words.push(Rt)}if(ue.start=ue.start===-1?De:ue.start,ue.end=ze.next,ue.nested.push(...ze.nested),Be&&km(ze.word))Oe();De=ze.next>De?ze.next:De+1}return Oe(),ym(ee,le),le.push(...Xb(ve)),{nodes:ee,issues:le,next:De,closed:Q===void 0,limited:!1,pendingHeredocs:[]}}function pm(n,u,b){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:Os(b.issues,b.limited),issues:b.issues,nodes:b.nodes}}function zl(n,u,b,W,z,B){let Q="",ee=u,le=!1,ue="literal",ve=[],Oe=[],De=!1;while(ee<b){let Me=n[ee],Ne=(Me==="<"||Me===">")&&n[ee+1]==="(";if(!Me||Si(Me)||(Me===";"||Me==="|"||Me==="&")&&ks(n,ee)||(Me==="<"||Me===">")&&!Ne)break;if(Me===")")break;if(Me==="'"){le=!0;let Be=n.indexOf("'",ee+1);if(Be===-1||Be>=b){Q+=n.slice(ee+1,b),Oe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),ee=b;break}Q+=n.slice(ee+1,Be),ee=Be+1;continue}if(Me==='"'){le=!0;let Be=Rb(n,ee,b,W,z,B);if(Q+=Be.text,ve.push(...Be.nested),Oe.push(...Be.issues),De||=Be.limited,ue=yi(ue,Be.provenance),ee=Be.next,De)break;continue}if(n.startsWith("$'",ee)){le=!0;let Be=Db(n,ee+2,b);if(Q+=Be.text,Oe.push(...Be.issues),!Be.closed)Oe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});ee=Be.next;continue}if(Me==="\\"){let Be=n[ee+1];if(!Be){Oe.push({code:"trailing-escape",message:"escape has no following character"}),ee++;break}if(Be===`
-`){ee+=2;continue}Q+=Be,ee+=2;continue}if(Vr(n,ee))Oe.push(jr);let Le=Me==="$"||Me==="<"||Me===">"||Me==="`"?bi(n,ee,b,W,z,B):null,We=Le?Bl(Le,ve,Oe):wm(n,ee,b,W,z,B,ve,Oe);if(We){if(We.provenance==="variable")Q+=n.slice(ee,We.next);if(De||=We.limited,ue=yi(ue,We.provenance),ee=We.next,De)break;continue}if(Me==="$"){let Be=xm(n,ee,b,Q,ue);Q=Be.text,ue=Be.provenance,ee=Be.next;continue}if(Me==="*"||Me==="?"||Me==="[")ue=yi(ue,"glob");Q+=Me,ee++}return{word:wo(n,u,ee,Q,ue,le,ue==="literal"?void 0:Lb(n,u,ee)),nested:ve,issues:Oe,next:ee,limited:De}}function Rb(n,u,b,W,z,B){let Q="",ee="literal",le=[],ue=[],ve=!1,Oe=u+1;while(Oe<b){let De=n[Oe];if(De==='"')return{text:Q,provenance:ee,nested:le,issues:ue,next:Oe+1,limited:ve};if(De==="\\"&&n[Oe+1]){let Le=n[Oe+1]??"";if(Le===`
+`&&n[De]!=="\r")De++;continue}let Ne=ue.start===-1?Qb(n,De,b):void 0;if(Ne){if(Gl(ee,le),B>=W.maxDepth)return _o(ee,le,De,"depth-limit",W.maxDepth);if(!Fl(z))return _o(ee,le,De,"word-limit",W.maxWords);let Rt=Is(n,Ne.braceIndex+1,b,W,z,B+1,"}"),Tt=Rt.next,kt={start:Ne.braceIndex+1,end:Rt.closed?Tt-1:Tt},lt=gm(n,kt,Rt);if(ee.push({kind:"function",name:Ne.name,span:{start:De,end:Tt},body:lt}),le.push(...Rt.issues),Rt.pendingHeredocs.length>0||Ci(Rt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ve.push(...Rt.pendingHeredocs),Rt.limited)return Ts(ee,le,Rt.next);if(!Rt.closed)le.push({code:"unclosed-function-body",message:"function body is not closed"});De=Tt;continue}let Le=ks(n,De);if(Le){if(Oe(),!km(ee.at(-1)))le.push({code:"unexpected-connector",message:`connector ${Le} has no preceding command`});ee.push({kind:"connector",operator:Le,span:{start:De,end:De+Le.length}}),De+=Le.length;continue}if(Me===")"){Oe(),le.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),ee.push({kind:"unknown",source:Me,span:{start:De,end:De+1}}),De++;continue}if((Me==="("||Me==="{"&&Gb(n,De,b))&&ue.start===-1){if(Gl(ee,le),B>=W.maxDepth)return _o(ee,le,De,"depth-limit",W.maxDepth);let Rt=Me==="("?")":"}",Tt=Is(n,De+1,b,W,z,B+1,Rt),kt=Tt.next,lt={start:De+1,end:Tt.closed?kt-1:kt},Vt=gm(n,lt,Tt);if(ee.push({kind:"group",style:Me==="("?"subshell":"brace",span:{start:De,end:kt},body:Vt}),le.push(...Tt.issues),Tt.pendingHeredocs.length>0||Ci(Tt.nodes))le.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ve.push(...Tt.pendingHeredocs),Tt.limited)return Ts(ee,le,Tt.next);if(!Tt.closed)le.push({code:Me==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Me} group is not closed`});De=kt;continue}let We=(Me==="<"||Me===">")&&n[De+1]!=="("?Pb(n,De):null;if(We){let Rt=ue.words.at(-1),Tt=Rt&&Rt.span.end===De&&/^[0-9]+$/.test(Rt.raw)?Number(Rt.raw):void 0;if(Tt!==void 0)ue.words.pop();let kt=Tt===void 0?De:Rt?.span.start??De;ue.start=ue.start===-1?De:ue.start;let lt=De+We.length;while(lt<b&&/[ \t]/.test(n[lt]??""))lt++;let Vt=n[lt],Ut=lt>De+We.length&&Vt==="#",an=!Vt||Si(Vt)||!!ks(n,lt)||Vt===Q||Vt===")"||Ut||(Vt==="<"||Vt===">")&&n[lt+1]!=="(",Sn=We==="<<"||We==="<<-",ut=Sn?Ll(n,lt,b):void 0,zt=ut?{word:wo(n,lt,ut.next,ut.delimiter,"literal",ut.quoted),nested:[],issues:[],next:ut.next,limited:!1}:!an?zl(n,lt,b,W,z,B):void 0;if(zt){if(le.push(...zt.issues),zt.limited)return Ts(ee,le,zt.next);if(!Fl(z))return _o(ee,le,zt.next,"word-limit",W.maxWords)}let Qt=zt?.next??De+We.length,on={kind:"redirection",operator:We,span:{start:kt,end:Qt},...Tt===void 0?{}:{fd:Tt},...zt?{target:zt.word}:{}};if(ue.redirections.push(on),Sn&&!ut)le.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(ut){if(ut.ambiguous||ut.delimiter.length===0)le.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let mn=ue.nested;ve.push({delimiter:ut.delimiter,quotedDelimiter:ut.quoted,stripTabs:We==="<<-",attach:(vn)=>{if(on.heredoc=vn,vn.quotedDelimiter)return;let sn=xb(n,vn.bodySpan.start,vn.bodySpan.end,W,z,B+1);mn.push(...sn.programs),le.push(...sn.issues)}})}if(!Sn&&!zt)le.push({code:"missing-redirection-target",message:`redirection ${We} requires a target word`});if(zt)ue.nested.push(...zt.nested);ue.end=Qt,De=Qt;continue}let Be=ue.start===-1;if(Be)Gl(ee,le);let ze=zl(n,De,b,W,z,B);if(le.push(...ze.issues),ze.limited)return Ts(ee,le,ze.next);let it=Bb(ue.words)?qb(n,ze.word,z.maxWords-z.wordsUsed,W.maxDepth,W.maxInputLength):void 0;if(it?.limitCode)return _o(ee,le,ze.next,it.limitCode,it.limitCode==="word-limit"?W.maxWords:it.limitCode==="depth-limit"?W.maxDepth:W.maxInputLength);let at=it?.words??[ze.word];for(let Rt of at){if(!Fl(z))return _o(ee,le,ze.next,"word-limit",W.maxWords);ue.words.push(Rt)}if(ue.start=ue.start===-1?De:ue.start,ue.end=ze.next,ue.nested.push(...ze.nested),Be&&Om(ze.word))Oe();De=ze.next>De?ze.next:De+1}return Oe(),Sm(ee,le),le.push(...Jb(ve)),{nodes:ee,issues:le,next:De,closed:Q===void 0,limited:!1,pendingHeredocs:[]}}function gm(n,u,b){return{kind:"program",dialect:"posix",source:n.slice(u.start,u.end),span:u,status:Os(b.issues,b.limited),issues:b.issues,nodes:b.nodes}}function zl(n,u,b,W,z,B){let Q="",ee=u,le=!1,ue="literal",ve=[],Oe=[],De=!1;while(ee<b){let Me=n[ee],Ne=(Me==="<"||Me===">")&&n[ee+1]==="(";if(!Me||Si(Me)||(Me===";"||Me==="|"||Me==="&")&&ks(n,ee)||(Me==="<"||Me===">")&&!Ne)break;if(Me===")")break;if(Me==="'"){le=!0;let Be=n.indexOf("'",ee+1);if(Be===-1||Be>=b){Q+=n.slice(ee+1,b),Oe.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),ee=b;break}Q+=n.slice(ee+1,Be),ee=Be+1;continue}if(Me==='"'){le=!0;let Be=_b(n,ee,b,W,z,B);if(Q+=Be.text,ve.push(...Be.nested),Oe.push(...Be.issues),De||=Be.limited,ue=yi(ue,Be.provenance),ee=Be.next,De)break;continue}if(n.startsWith("$'",ee)){le=!0;let Be=Lb(n,ee+2,b);if(Q+=Be.text,Oe.push(...Be.issues),!Be.closed)Oe.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});ee=Be.next;continue}if(Me==="\\"){let Be=n[ee+1];if(!Be){Oe.push({code:"trailing-escape",message:"escape has no following character"}),ee++;break}if(Be===`
+`){ee+=2;continue}Q+=Be,ee+=2;continue}if(Vr(n,ee))Oe.push(jr);let Le=Me==="$"||Me==="<"||Me===">"||Me==="`"?bi(n,ee,b,W,z,B):null,We=Le?Bl(Le,ve,Oe):_m(n,ee,b,W,z,B,ve,Oe);if(We){if(We.provenance==="variable")Q+=n.slice(ee,We.next);if(De||=We.limited,ue=yi(ue,We.provenance),ee=We.next,De)break;continue}if(Me==="$"){let Be=Am(n,ee,b,Q,ue);Q=Be.text,ue=Be.provenance,ee=Be.next;continue}if(Me==="*"||Me==="?"||Me==="[")ue=yi(ue,"glob");Q+=Me,ee++}return{word:wo(n,u,ee,Q,ue,le,ue==="literal"?void 0:Fb(n,u,ee)),nested:ve,issues:Oe,next:ee,limited:De}}function _b(n,u,b,W,z,B){let Q="",ee="literal",le=[],ue=[],ve=!1,Oe=u+1;while(Oe<b){let De=n[Oe];if(De==='"')return{text:Q,provenance:ee,nested:le,issues:ue,next:Oe+1,limited:ve};if(De==="\\"&&n[Oe+1]){let Le=n[Oe+1]??"";if(Le===`
 `){Oe+=2;continue}if(Le==="\r"&&n[Oe+2]===`
-`){Oe+=3;continue}Q+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,Oe+=2;continue}if(Vr(n,Oe))ue.push(jr);let Me=bi(n,Oe,b,W,z,B),Ne=Me?Bl(Me,le,ue):wm(n,Oe,b,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")Q+=n.slice(Oe,Ne.next);if(Oe=Ne.next,ve||=Ne.limited,ee=yi(ee,Ne.provenance),ve)return{text:Q,provenance:ee,nested:le,issues:ue,next:Oe,limited:ve};continue}if(De==="$"){let Le=xm(n,Oe,b,Q,ee);Q=Le.text,ee=Le.provenance,Oe=Le.next;continue}Q+=De??"",Oe++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:Q,provenance:ee,nested:le,issues:ue,next:b,limited:ve}}function bi(n,u,b,W,z,B){let Q=Em(n,u);if(!Q)return null;let{length:ee,closing:le}=Q,ue=le==="))",ve=le==="`",Oe=n[u]==="<"||n[u]===">",De=Ul(n,u+ee,b,le),Me=De===-1?b:De,Ne=De===-1?b:De+le.length;if(B>=W.maxDepth)return{program:Yb(n,u+ee,Me,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let at=[],Rt=[],Tt=!1,kt=u+ee;while(kt<Me){let lt=bi(n,kt,Me,W,z,B+1);if(!lt){if(Vr(n,kt))Rt.push(jr);kt++;continue}if(at.push(...lt.program.nodes),Rt.push(...lt.program.issues),Tt||=lt.program.status==="limited",kt=lt.next,Tt)break}if(De===-1)Rt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+ee,Me),span:{start:u+ee,end:Me},status:Os(Rt,Tt),issues:Rt,nodes:at},next:Ne,provenance:"arithmetic"}}let Le=Is(n,u+ee,Me,W,z,B+1),We=De===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+ee)} substitution is not closed`}]:[],Be=(ve||Oe)&&Ci(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],ze=ve&&/\\[\\$`\n]/.test(n.slice(u+ee,Me))?[Mb]:[],it=[...Le.issues,...We,...Be,...ze];return{program:{kind:"program",dialect:"posix",source:n.slice(u+ee,Me),span:{start:u+ee,end:Me},status:Os(it,Le.limited),issues:it,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function wb(n,u,b,W,z,B){let Q=[],ee=[],le=u;while(le<b){let ue=n[le];if(ue==="\\"){le+=2;continue}let ve=ue==="$"||ue==="`"?bi(n,le,b,W,z,B):null;if(!ve){if(Vr(n,le))ee.push(jr);le++;continue}if(Q.push(ve.program),Ab(n,le,ve.next)&&Pb(ve.program))ee.push(jr);le=ve.next}return{programs:Q,issues:ee}}function Bl(n,u,b){return u.push(n.program),b.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function Ul(n,u,b,W){if(W==="`"){for(let ee=u;ee<b;ee++){if(n[ee]==="\\"){ee++;continue}if(n[ee]==="`")return ee}return-1}let z={single:!1,double:!1},B=[],Q=[];for(let ee=u;ee<b;ee++){let le=n[ee];if((le===`
+`){Oe+=3;continue}Q+=["$","`",'"',"\\"].includes(Le)?Le:`\\${Le}`,Oe+=2;continue}if(Vr(n,Oe))ue.push(jr);let Me=bi(n,Oe,b,W,z,B),Ne=Me?Bl(Me,le,ue):_m(n,Oe,b,W,z,B,le,ue);if(Ne){if(Ne.provenance!=="command-substitution")Q+=n.slice(Oe,Ne.next);if(Oe=Ne.next,ve||=Ne.limited,ee=yi(ee,Ne.provenance),ve)return{text:Q,provenance:ee,nested:le,issues:ue,next:Oe,limited:ve};continue}if(De==="$"){let Le=Am(n,Oe,b,Q,ee);Q=Le.text,ee=Le.provenance,Oe=Le.next;continue}Q+=De??"",Oe++}return ue.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:Q,provenance:ee,nested:le,issues:ue,next:b,limited:ve}}function bi(n,u,b,W,z,B){let Q=vm(n,u);if(!Q)return null;let{length:ee,closing:le}=Q,ue=le==="))",ve=le==="`",Oe=n[u]==="<"||n[u]===">",De=Ul(n,u+ee,b,le),Me=De===-1?b:De,Ne=De===-1?b:De+le.length;if(B>=W.maxDepth)return{program:Xb(n,u+ee,Me,"depth-limit"),next:Ne,provenance:ue?"arithmetic":"command-substitution"};if(ue){let at=[],Rt=[],Tt=!1,kt=u+ee;while(kt<Me){let lt=bi(n,kt,Me,W,z,B+1);if(!lt){if(Vr(n,kt))Rt.push(jr);kt++;continue}if(at.push(...lt.program.nodes),Rt.push(...lt.program.issues),Tt||=lt.program.status==="limited",kt=lt.next,Tt)break}if(De===-1)Rt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:{kind:"program",dialect:"posix",source:n.slice(u+ee,Me),span:{start:u+ee,end:Me},status:Os(Rt,Tt),issues:Rt,nodes:at},next:Ne,provenance:"arithmetic"}}let Le=Is(n,u+ee,Me,W,z,B+1),We=De===-1?[{code:"unclosed-command-substitution",message:`${n.slice(u,u+ee)} substitution is not closed`}]:[],Be=(ve||Oe)&&Ci(Le.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[],ze=ve&&/\\[\\$`\n]/.test(n.slice(u+ee,Me))?[Nb]:[],it=[...Le.issues,...We,...Be,...ze];return{program:{kind:"program",dialect:"posix",source:n.slice(u+ee,Me),span:{start:u+ee,end:Me},status:Os(it,Le.limited),issues:it,nodes:Le.nodes},next:Ne,provenance:"command-substitution"}}function xb(n,u,b,W,z,B){let Q=[],ee=[],le=u;while(le<b){let ue=n[le];if(ue==="\\"){le+=2;continue}let ve=ue==="$"||ue==="`"?bi(n,le,b,W,z,B):null;if(!ve){if(Vr(n,le))ee.push(jr);le++;continue}if(Q.push(ve.program),Tb(n,le,ve.next)&&Ib(ve.program))ee.push(jr);le=ve.next}return{programs:Q,issues:ee}}function Bl(n,u,b){return u.push(n.program),b.push(...n.program.issues),{provenance:n.provenance,next:n.next,limited:n.program.status==="limited"}}function Ul(n,u,b,W){if(W==="`"){for(let ee=u;ee<b;ee++){if(n[ee]==="\\"){ee++;continue}if(n[ee]==="`")return ee}return-1}let z={single:!1,double:!1},B=[],Q=[];for(let ee=u;ee<b;ee++){let le=n[ee];if((le===`
 `||le==="\r")&&Q.length>0){let Oe=le==="\r"&&n[ee+1]===`
-`?ee+2:ee+1,De=Wl(n,Oe,b,Q.splice(0));if(!De.terminated)return-1;ee=De.next-1;continue}let ue=bm(n,ee,u,b,z);if(ue!==null){ee=ue;continue}if(!z.double&&n.startsWith("$((",ee)){let Oe=_b(n,ee+3,b);if(Oe===-1)return-1;ee=Oe+1;continue}if(W===")"&&!z.double&&le==="<"&&n[ee+1]==="<"&&n[ee+2]!=="<"){let Oe=n[ee+2]==="-",De=ee+(Oe?3:2);while(De<b&&/[ \t]/.test(n[De]??""))De++;let Me=Ll(n,De,b);if(Me){Q.push({delimiter:Me.delimiter,quotedDelimiter:Me.quoted,stripTabs:Oe,attach:()=>{return}}),ee=Me.next-1;continue}}if(n.startsWith("$(",ee)&&!n.startsWith("$((",ee)){B.push(z),z={single:!1,double:!1},ee++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let ve=B.pop();if(ve){z=ve;continue}return W==="))"&&n[ee+1]!==")"?-1:ee}return-1}function _b(n,u,b){let W=1,z={single:!1,double:!1};for(let B=u;B<b;B++){let Q=n[B],ee=bm(n,B,u,b,z);if(ee!==null){B=ee;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(Q==="("&&!z.double)W++;if(Q!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function bm(n,u,b,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!Qb(n,u,b))return null;let Q=u;while(Q+1<W&&n[Q+1]!==`
-`&&n[Q+1]!=="\r")Q++;return Q}function ks(n,u){let b=n[u];if(b===";")return";";if(b==="&")return n[u+1]==="&"?"&&":"&";if(b==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function xb(n,u){let b=n[u];if(b===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(b!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function Si(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var jr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vr(n,u){if(n[u]!=="$")return!1;let b=gm(n,u+1);if(n[b]!=="{")return!1;let W=n[gm(n,b+1)]??"";return W==="|"||Si(W)}function Ab(n,u,b){for(let W=n.indexOf("$",u);W!==-1&&W<b;W=n.indexOf("$",W+1))if(Vr(n,W))return!0;return!1}function Pb(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===jr.code)}function gm(n,u){let b=u;while(n.startsWith("\\\n",b)||n.startsWith(`\\\r
-`,b))b+=n[b+1]==="\r"?3:2;return b}function Em(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var Tb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Ib=/[\v\f\r]/,vm=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),Rm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),kb=/\$\(|`|[<>]\(/g;function Ob(n,u,b){let W=$l(b);return[...n.slice(u).matchAll(kb)].some((z)=>{let B=u+z.index;return!W.some((Q)=>B>=Q.start&&B<Q.end)})}function $l(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((b)=>b.heredoc?[b.heredoc.bodySpan]:[]),...u.nested.flatMap((b)=>$l(b.nodes))];return u.kind==="group"||u.kind==="function"?$l(u.body.nodes):[]})}var Mb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function wm(n,u,b,W,z,B,Q,ee){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=Ms(n,u+2,b),ue=le.close===-1?b:le.close+1;if(le.close===-1)ee.push(Tb);if(le.quoted&&le.substitutions.length>0||le.continued)ee.push(Rm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let ve=le.substitutions.some((Oe)=>{if(Vr(n,Oe))return ee.push(jr),!1;let De=bi(n,Oe,ue,W,z,B);return De!==null&&Bl(De,Q,ee).limited});return{provenance:"variable",next:ue,limited:ve}}function Ms(n,u,b){let W=[],z=!1,B=!1,Q=1,ee=u;while(ee<b){let le=n[ee];if(le==="$"&&Vr(n,ee))W.push(ee);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[ee+1]===`
-`,ee+=le==="\\"?2:1;continue}let ue=Em(n,ee);if(ue){W.push(ee);let ve=Ul(n,ee+ue.length,b,ue.closing);if(ve===-1)break;ee=ve+ue.closing.length;continue}if(le==="$"&&n[ee+1]==="{"){Q++,ee+=2;continue}if(le==="}"&&--Q===0)return{close:ee,substitutions:W,quoted:z,continued:B};ee++}return{close:-1,substitutions:W,quoted:z,continued:B}}function _m(n,u,b){if(n[u+1]==="{"){let z=Ms(n,u+2,b).close;return z===-1?b:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<b&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function Db(n,u,b){let W="",z=[],B=u;while(B<b){let Q=n[B];if(Q==="'")return{text:W,next:B+1,closed:!0,issues:z};if(Q!=="\\"){W+=Q??"",B++;continue}let ee=Nb(n,B+1,b);if(W+=ee.text,ee.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${ee.invalidCodePoint}`});B=ee.next}return{text:W,next:b,closed:!1,issues:z}}function Nb(n,u,b){let W=n[u];if(!W||u>=b)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return Ps(n,u+1,b,16,2,u+1);if(W==="u")return Ps(n,u+1,b,16,4,u+1);if(W==="U")return Ps(n,u+1,b,16,8,u+1);if(/[0-7]/.test(W))return Ps(n,u,b,8,3,u+1);return{text:W,next:u+1}}function Ps(n,u,b,W,z,B){let Q=W===16?/[0-9a-fA-F]/:/[0-7]/,ee="",le=u;while(le<b&&ee.length<z&&Q.test(n[le]??""))ee+=n[le],le++;if(!ee)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(ee,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function Os(n,u=!1){if(u)return"limited";if(n.some((b)=>b.code==="invalid-ansi-c-code-point"||b.code==="missing-heredoc-delimiter"||b.code==="ambiguous-heredoc-delimiter"||b.code==="unterminated-heredoc"||b.code==="unsupported-heredoc-context"||b.code==="unsupported-function-substitution"||b.code==="unsupported-backtick-escape"||b.code==="unclosed-parameter-expansion"||b.code==="unsupported-parameter-expansion"||b.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function xm(n,u,b,W,z){let B=_m(n,u,b);return{text:W+n.slice(u,B),provenance:yi(z,"variable"),next:B}}function Lb(n,u,b){let W=As(n),z=u,B=!1,Q=!1,ee=u;while(ee<b){let le=n[ee];if(le==="\\"&&!B){ee+=2;continue}if(!Q&&le==="'"){B=!B,ee++;continue}if(!B&&le==='"'){Q=!Q,ee++;continue}if(B){ee++;continue}let ue=n.startsWith("$((",ee),ve=n.startsWith("$(",ee)&&!ue,Oe=!Q&&(n.startsWith("<(",ee)||n.startsWith(">(",ee)),De=le==="`";if(ue||ve||Oe||De){let Me=ue?3:De?1:2,Ne=ue?"))":De?"`":")",Le=Ul(n,ee+Me,b,Ne),We=Le===-1?b:Le+Ne.length;W.push(z,ee,"literal"),W.push(ee,We,ue?"arithmetic":"command-substitution"),ee=We,z=We;continue}if(le==="$"){let Me=_m(n,ee,b);if(Me>ee+1){W.push(z,ee,"literal"),W.push(ee,Me,"variable"),ee=Me,z=Me;continue}}if(!Q&&(le==="*"||le==="?"||le==="[")){W.push(z,ee,"literal"),W.push(ee,ee+1,"glob"),ee++,z=ee;continue}ee++}return W.push(z,b,"literal"),W.parts}function yi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function Wb(n,u,b){return u+1>=b||Si(n[u+1]??"")||ks(n,u+1)!==null}var Fb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Gb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function zb(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let b=$b(n,u);if(b===void 0||b===null)return!1;u=b}return!1}function $b(n,u){let b=n[u]?.text.toLowerCase();if(b==="command")return Bb(n,u);if(b==="env")return Ub(n,u);if(b==="sudo")return Hb(n,u);return}function Bb(n,u){if(n[u+1]?.text==="-v")return null;for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return b}return n.length}function Ub(n,u){for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if(Fb.has(W)){if(n[b+1]===void 0)return null;b++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return b}return n.length}function Hb(n,u){for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if(Gb.has(W)){if(n[b+1]===void 0)return null;b++;continue}if(W.startsWith("-"))continue;return b}return n.length}function Am(n,u,b,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=Pm(n.raw,u,b,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((Q)=>Tm(Q,b));if(B.some((Q)=>Q===null))return{limited:!0};return{words:[...new Set(B.filter((Q)=>Q!==null&&Q!==""))]}}function jb(n,u,b,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=Pm(u.raw,b,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let Q=B.values.map((ee)=>Tm(ee,W));if(Q.some((ee)=>ee===null))return;return{words:Q.filter((ee)=>ee!==null&&ee!=="").map((ee)=>wo(n,u.span.start,u.span.end,ee,"literal",!1))}}function Pm(n,u,b,W,z){let B=[n],Q=n.length,ee=0;while(!0){let le=B.findIndex((Me)=>hm(Me,z));if(le===-1)break;if(++ee>b)return{limited:"expansions"};let ue=B[le]??"",ve=hm(ue,z);if(!ve||ve.kind==="range")return{limited:"expansions"};let Oe=ve.start+ue.length-ve.end,De=ve.alternatives.reduce((Me,Ne)=>Me+Oe+Ne.length,0);if(Q-ue.length+De>W)return{limited:"length"};if(B.length-1+ve.alternatives.length>u)return{limited:"words"};B.splice(le,1,...Vb(ue,ve)),Q+=De-ue.length}return ee===0?void 0:{values:B}}function hm(n,u){let b=[],W,z=null,B=!1;for(let Q=0;Q<n.length;Q++){let ee=n[Q];if(B){B=!1;continue}if(ee==="\\"&&z!=="'"){B=!0;continue}if(ee===z){z=null;continue}if(z===null&&(ee==="'"||ee==='"')){z=ee;continue}if(z!==null)continue;if(ee==="{"){b.push({start:Q,commas:[]});continue}if(ee===","&&b.length>0){b.at(-1)?.commas.push(Q);continue}if(ee!=="}"||b.length===0)continue;let le=b.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:Q+1,commas:le.commas}:u&&Kb(n.slice(le.start+1,Q))?{kind:"range",start:le.start,end:Q+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:qb(n,W)}}function Vb(n,u){return u.alternatives.map((b)=>`${n.slice(0,u.start)}${b}${n.slice(u.end)}`)}function qb(n,u){let b=[u.start,...u.commas,u.end-1];return b.slice(0,-1).map((W,z)=>n.slice(W+1,b[z+1]))}function Kb(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function Tm(n,u){let b=`x${n}`,W=zl(b,0,b.length,{maxInputLength:b.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==b.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function Yb(n,u,b,W){return{kind:"program",dialect:"posix",source:n.slice(u,b),span:{start:u,end:b},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function _o(n,u,b,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:b,closed:!1,limited:!0,pendingHeredocs:[]}}function Ts(n,u,b){return{nodes:n,issues:u,next:b,closed:!1,limited:!0,pendingHeredocs:[]}}function Fl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function Zb(n,u,b){let W=n.slice(u,b),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function Ci(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((b)=>b.heredoc)||u.nested.some((b)=>Ci(b.nodes));return(u.kind==="group"||u.kind==="function")&&Ci(u.body.nodes)})}function Xb(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function Im(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function ym(n,u){let b=n.at(-1);if(b?.kind!=="connector"||!Sm.has(b.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${b.operator} requires a following command`})}function km(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&vb.has(n.text)}function Gl(n,u){let b=n.at(-1);if(!Im(b))return;if(b?.kind==="command"&&km(b.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Qb(n,u,b){return u===b||/[\s;&|()]/u.test(n[u-1]??"")}var Dm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object","iex","invoke-expression"]),Jb=new Set(["gc","cat","type","cp","mv","rm"]),Nm=["-rec","-for","-path","-literalpath","-whatif"],eE=/^\$env:\w/i,tE=/^(?:\$\{?\w+\}?|~)\\./;function Lm(n,u){let b=n.toLowerCase().replaceAll("`","");if(![...Dm].some((z)=>b.includes(z))&&!(b.includes("rm")&&Nm.some((z)=>b.includes(z)))&&!b.includes("<#")&&!nE(b))return!1;let W=ql(n,u);if(Wm(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||Vl(W).some(rE)}function Wm(n){return n.nodes.some((u)=>{if(u.kind==="group")return Wm(u.body);if(u.kind!=="command")return!1;return u.redirections.some((b)=>b.operator==="<<")})}function nE(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function rE(n){let u=n[0]==="&"||n[0]==="."?1:0,b=n[u]?.toLowerCase();if(b&&Dm.has(b))return!0;let W=n.slice(u+1);if(b&&Jb.has(b)&&W.some(oE))return!0;if(b!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return Nm.some((Q)=>B.startsWith(Q))})}function oE(n){return eE.test(n)||tE.test(n)}function ql(n,u){let b={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:b,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=Kl(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:b,status:dE(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function Kl(n,u,b,W,z,B=!1){let Q=[],ee=[],le=_s(),ue=0,ve=!1,Oe=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Me={start:le.start,end:le.end};xs(Q,le,{kind:"command",dialect:"powershell",source:n.slice(Me.start,Me.end),span:Me,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},De=u;while(De<b){let Me=n[De];if(!Me)break;if(B&&Me==="}")return Oe(),{nodes:Q,issues:ee,next:De+1,closed:!0,words:ue,limited:ve};let Ne=cE(n,De,b,W.maxDepth);if(Ne){if(Ne.issue)ee.push(Ne.issue);if(Ne.limited)return Oe(),{nodes:Q,issues:ee,next:Ne.next,closed:!1,words:ue,limited:!0};De=Ne.next;continue}if(/\s/.test(Me)){if(Me==="\r"||Me===`
+`?ee+2:ee+1,De=Wl(n,Oe,b,Q.splice(0));if(!De.terminated)return-1;ee=De.next-1;continue}let ue=Em(n,ee,u,b,z);if(ue!==null){ee=ue;continue}if(!z.double&&n.startsWith("$((",ee)){let Oe=Ab(n,ee+3,b);if(Oe===-1)return-1;ee=Oe+1;continue}if(W===")"&&!z.double&&le==="<"&&n[ee+1]==="<"&&n[ee+2]!=="<"){let Oe=n[ee+2]==="-",De=ee+(Oe?3:2);while(De<b&&/[ \t]/.test(n[De]??""))De++;let Me=Ll(n,De,b);if(Me){Q.push({delimiter:Me.delimiter,quotedDelimiter:Me.quoted,stripTabs:Oe,attach:()=>{return}}),ee=Me.next-1;continue}}if(n.startsWith("$(",ee)&&!n.startsWith("$((",ee)){B.push(z),z={single:!1,double:!1},ee++;continue}if(le==="("&&!z.double){B.push(z),z={single:!1,double:!1};continue}if(le!==")"||z.double)continue;let ve=B.pop();if(ve){z=ve;continue}return W==="))"&&n[ee+1]!==")"?-1:ee}return-1}function Ab(n,u,b){let W=1,z={single:!1,double:!1};for(let B=u;B<b;B++){let Q=n[B],ee=Em(n,B,u,b,z);if(ee!==null){B=ee;continue}if(n.startsWith("$(",B)&&!n.startsWith("$((",B)){W++,B++;continue}if(Q==="("&&!z.double)W++;if(Q!==")"||z.double)continue;if(W--,W===0)return n[B+1]===")"?B:-1}return-1}function Em(n,u,b,W,z){let B=n[u];if(B==="\\"&&!z.single)return u+1;if(!z.double&&B==="'")z.single=!z.single;if(!z.single&&B==='"')z.double=!z.double;if(z.single)return u;if(z.double||B!=="#"||!eE(n,u,b))return null;let Q=u;while(Q+1<W&&n[Q+1]!==`
+`&&n[Q+1]!=="\r")Q++;return Q}function ks(n,u){let b=n[u];if(b===";")return";";if(b==="&")return n[u+1]==="&"?"&&":"&";if(b==="|")return n[u+1]==="|"?"||":n[u+1]==="&"?"|&":"|";return null}function Pb(n,u){let b=n[u];if(b===">"){if(n[u+1]===">")return">>";if(n[u+1]==="&")return">&";return n[u+1]==="|"?">|":">"}if(b!=="<")return null;if(n.startsWith("<<<",u))return"<<<";if(n.startsWith("<<-",u))return"<<-";if(n[u+1]==="<")return"<<";if(n[u+1]==="&")return"<&";if(n[u+1]===">")return"<>";return"<"}function Si(n){let u=n.charCodeAt(0);if(u===32||u>=9&&u<=13)return!0;if(u<128)return!1;return/\s/u.test(n)}var jr=Object.freeze({code:"unsupported-function-substitution",message:"${ list; } function substitutions run in the current shell and cannot be analyzed"});function Vr(n,u){if(n[u]!=="$")return!1;let b=hm(n,u+1);if(n[b]!=="{")return!1;let W=n[hm(n,b+1)]??"";return W==="|"||Si(W)}function Tb(n,u,b){for(let W=n.indexOf("$",u);W!==-1&&W<b;W=n.indexOf("$",W+1))if(Vr(n,W))return!0;return!1}function Ib(n){return n?.status==="limited"||(n?.issues??[]).some((u)=>u.code===jr.code)}function hm(n,u){let b=u;while(n.startsWith("\\\n",b)||n.startsWith(`\\\r
+`,b))b+=n[b+1]==="\r"?3:2;return b}function vm(n,u){if(n.startsWith("$((",u))return{length:3,closing:"))"};if(n.startsWith("$(",u)||n.startsWith("<(",u)||n.startsWith(">(",u))return{length:2,closing:")"};return n[u]==="`"?{length:1,closing:"`"}:null}var kb=Object.freeze({code:"unclosed-parameter-expansion",message:"${ parameter expansion is not closed"}),Ob=/[\v\f\r]/,Rm=Object.freeze({code:"unsupported-blank",message:"a vertical tab, form feed, carriage return or Unicode space is part of a word in bash and zsh, not a separator"}),wm=Object.freeze({code:"unsupported-parameter-expansion",message:"a line continuation inside ${ }, or a quote or backslash inside ${ } with a substitution in or after it, cannot be analyzed"}),Mb=/\$\(|`|[<>]\(/g;function Db(n,u,b){let W=$l(b);return[...n.slice(u).matchAll(Mb)].some((z)=>{let B=u+z.index;return!W.some((Q)=>B>=Q.start&&B<Q.end)})}function $l(n){return n.flatMap((u)=>{if(u.kind==="command")return[...u.redirections.flatMap((b)=>b.heredoc?[b.heredoc.bodySpan]:[]),...u.nested.flatMap((b)=>$l(b.nodes))];return u.kind==="group"||u.kind==="function"?$l(u.body.nodes):[]})}var Nb=Object.freeze({code:"unsupported-backtick-escape",message:"a backslash escape inside backticks changes the command the shell runs and cannot be analyzed"});function _m(n,u,b,W,z,B,Q,ee){if(n[u]!=="$"||n[u+1]!=="{")return null;let le=Ms(n,u+2,b),ue=le.close===-1?b:le.close+1;if(le.close===-1)ee.push(kb);if(le.quoted&&le.substitutions.length>0||le.continued)ee.push(wm);if(le.quoted)z.quotedExpansionEnd=Math.min(z.quotedExpansionEnd,ue);let ve=le.substitutions.some((Oe)=>{if(Vr(n,Oe))return ee.push(jr),!1;let De=bi(n,Oe,ue,W,z,B);return De!==null&&Bl(De,Q,ee).limited});return{provenance:"variable",next:ue,limited:ve}}function Ms(n,u,b){let W=[],z=!1,B=!1,Q=1,ee=u;while(ee<b){let le=n[ee];if(le==="$"&&Vr(n,ee))W.push(ee);if(le==="\\"||le==="'"||le==='"'){z=!0,B||=le==="\\"&&n[ee+1]===`
+`,ee+=le==="\\"?2:1;continue}let ue=vm(n,ee);if(ue){W.push(ee);let ve=Ul(n,ee+ue.length,b,ue.closing);if(ve===-1)break;ee=ve+ue.closing.length;continue}if(le==="$"&&n[ee+1]==="{"){Q++,ee+=2;continue}if(le==="}"&&--Q===0)return{close:ee,substitutions:W,quoted:z,continued:B};ee++}return{close:-1,substitutions:W,quoted:z,continued:B}}function xm(n,u,b){if(n[u+1]==="{"){let z=Ms(n,u+2,b).close;return z===-1?b:z+1}if(n[u+1]==="$")return u+2;let W=u+1;while(W<b&&/[A-Za-z0-9_?@#!*-]/.test(n[W]??""))W++;return W===u+1?u+1:W}function Lb(n,u,b){let W="",z=[],B=u;while(B<b){let Q=n[B];if(Q==="'")return{text:W,next:B+1,closed:!0,issues:z};if(Q!=="\\"){W+=Q??"",B++;continue}let ee=Wb(n,B+1,b);if(W+=ee.text,ee.invalidCodePoint!==void 0)z.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${ee.invalidCodePoint}`});B=ee.next}return{text:W,next:b,closed:!1,issues:z}}function Wb(n,u,b){let W=n[u];if(!W||u>=b)return{text:"\\",next:u};let z=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(z.has(W))return{text:z.get(W)??W,next:u+1};if(W==="x")return Ps(n,u+1,b,16,2,u+1);if(W==="u")return Ps(n,u+1,b,16,4,u+1);if(W==="U")return Ps(n,u+1,b,16,8,u+1);if(/[0-7]/.test(W))return Ps(n,u,b,8,3,u+1);return{text:W,next:u+1}}function Ps(n,u,b,W,z,B){let Q=W===16?/[0-9a-fA-F]/:/[0-7]/,ee="",le=u;while(le<b&&ee.length<z&&Q.test(n[le]??""))ee+=n[le],le++;if(!ee)return{text:n[B-1]??"",next:B};let ue=Number.parseInt(ee,W);return ue>1114111||ue>=55296&&ue<=57343?{text:"�",next:le,invalidCodePoint:ue}:{text:String.fromCodePoint(ue),next:le}}function Os(n,u=!1){if(u)return"limited";if(n.some((b)=>b.code==="invalid-ansi-c-code-point"||b.code==="missing-heredoc-delimiter"||b.code==="ambiguous-heredoc-delimiter"||b.code==="unterminated-heredoc"||b.code==="unsupported-heredoc-context"||b.code==="unsupported-function-substitution"||b.code==="unsupported-backtick-escape"||b.code==="unclosed-parameter-expansion"||b.code==="unsupported-parameter-expansion"||b.code==="unsupported-blank"))return"invalid";return n.length>0?"partial":"complete"}function Am(n,u,b,W,z){let B=xm(n,u,b);return{text:W+n.slice(u,B),provenance:yi(z,"variable"),next:B}}function Fb(n,u,b){let W=As(n),z=u,B=!1,Q=!1,ee=u;while(ee<b){let le=n[ee];if(le==="\\"&&!B){ee+=2;continue}if(!Q&&le==="'"){B=!B,ee++;continue}if(!B&&le==='"'){Q=!Q,ee++;continue}if(B){ee++;continue}let ue=n.startsWith("$((",ee),ve=n.startsWith("$(",ee)&&!ue,Oe=!Q&&(n.startsWith("<(",ee)||n.startsWith(">(",ee)),De=le==="`";if(ue||ve||Oe||De){let Me=ue?3:De?1:2,Ne=ue?"))":De?"`":")",Le=Ul(n,ee+Me,b,Ne),We=Le===-1?b:Le+Ne.length;W.push(z,ee,"literal"),W.push(ee,We,ue?"arithmetic":"command-substitution"),ee=We,z=We;continue}if(le==="$"){let Me=xm(n,ee,b);if(Me>ee+1){W.push(z,ee,"literal"),W.push(ee,Me,"variable"),ee=Me,z=Me;continue}}if(!Q&&(le==="*"||le==="?"||le==="[")){W.push(z,ee,"literal"),W.push(ee,ee+1,"glob"),ee++,z=ee;continue}ee++}return W.push(z,b,"literal"),W.parts}function yi(n,u){if(u==="command-substitution"||n==="command-substitution")return"command-substitution";if(u==="arithmetic"||n==="arithmetic")return"arithmetic";if(u==="variable"||n==="variable")return"variable";if(u==="glob"||n==="glob")return"glob";return n}function Gb(n,u,b){return u+1>=b||Si(n[u+1]??"")||ks(n,u+1)!==null}var zb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),$b=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Bb(n){let u=0;while(u<=n.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(n[u]?.text??""))u++;if(u===n.length)return!0;let b=Ub(n,u);if(b===void 0||b===null)return!1;u=b}return!1}function Ub(n,u){let b=n[u]?.text.toLowerCase();if(b==="command")return Hb(n,u);if(b==="env")return jb(n,u);if(b==="sudo")return Vb(n,u);return}function Hb(n,u){if(n[u+1]?.text==="-v")return null;for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if(W==="-p"||W==="-v"||W==="-V"||/^-[pvV]+$/.test(W))continue;return b}return n.length}function jb(n,u){for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if(zb.has(W)){if(n[b+1]===void 0)return null;b++;continue}if(W.startsWith("-u=")||W.startsWith("--unset=")||W.startsWith("-C")&&W.length>2||W.startsWith("--chdir=")||W.startsWith("-S")&&W.length>2||W.startsWith("--split-string=")||W.startsWith("-P"))continue;if(W.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(W))continue;return b}return n.length}function Vb(n,u){for(let b=u+1;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return b+1;if($b.has(W)){if(n[b+1]===void 0)return null;b++;continue}if(W.startsWith("-"))continue;return b}return n.length}function Pm(n,u,b,W){if(n.provenance!=="literal"||!n.raw.includes("{"))return;let z=Tm(n.raw,u,b,W,!0);if(!z)return;if("limited"in z)return{limited:!0};let B=z.values.map((Q)=>Im(Q,b));if(B.some((Q)=>Q===null))return{limited:!0};return{words:[...new Set(B.filter((Q)=>Q!==null&&Q!==""))]}}function qb(n,u,b,W,z){if(u.provenance!=="literal"||!u.raw.includes("{"))return;let B=Tm(u.raw,b,W,z,!1);if(!B)return;if("limited"in B){if(B.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:B.limited==="length"?"brace-expansion-limit":"word-limit"}}let Q=B.values.map((ee)=>Im(ee,W));if(Q.some((ee)=>ee===null))return;return{words:Q.filter((ee)=>ee!==null&&ee!=="").map((ee)=>wo(n,u.span.start,u.span.end,ee,"literal",!1))}}function Tm(n,u,b,W,z){let B=[n],Q=n.length,ee=0;while(!0){let le=B.findIndex((Me)=>ym(Me,z));if(le===-1)break;if(++ee>b)return{limited:"expansions"};let ue=B[le]??"",ve=ym(ue,z);if(!ve||ve.kind==="range")return{limited:"expansions"};let Oe=ve.start+ue.length-ve.end,De=ve.alternatives.reduce((Me,Ne)=>Me+Oe+Ne.length,0);if(Q-ue.length+De>W)return{limited:"length"};if(B.length-1+ve.alternatives.length>u)return{limited:"words"};B.splice(le,1,...Kb(ue,ve)),Q+=De-ue.length}return ee===0?void 0:{values:B}}function ym(n,u){let b=[],W,z=null,B=!1;for(let Q=0;Q<n.length;Q++){let ee=n[Q];if(B){B=!1;continue}if(ee==="\\"&&z!=="'"){B=!0;continue}if(ee===z){z=null;continue}if(z===null&&(ee==="'"||ee==='"')){z=ee;continue}if(z!==null)continue;if(ee==="{"){b.push({start:Q,commas:[]});continue}if(ee===","&&b.length>0){b.at(-1)?.commas.push(Q);continue}if(ee!=="}"||b.length===0)continue;let le=b.pop();if(!le)continue;let ue=le.commas.length>0?{kind:"alternatives",start:le.start,end:Q+1,commas:le.commas}:u&&Zb(n.slice(le.start+1,Q))?{kind:"range",start:le.start,end:Q+1}:void 0;if(ue&&(!W||ue.start<W.start))W=ue}if(!W||W.kind==="range")return W;return{kind:W.kind,start:W.start,end:W.end,alternatives:Yb(n,W)}}function Kb(n,u){return u.alternatives.map((b)=>`${n.slice(0,u.start)}${b}${n.slice(u.end)}`)}function Yb(n,u){let b=[u.start,...u.commas,u.end-1];return b.slice(0,-1).map((W,z)=>n.slice(W+1,b[z+1]))}function Zb(n){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(n)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(n)}function Im(n,u){let b=`x${n}`,W=zl(b,0,b.length,{maxInputLength:b.length,maxWords:1,maxDepth:u},{wordsUsed:0,maxWords:1,quotedExpansionEnd:1/0},0);if(W.limited||W.issues.length>0||W.next!==b.length||W.word.provenance!=="literal")return null;return W.word.text.slice(1)}function Xb(n,u,b,W){return{kind:"program",dialect:"posix",source:n.slice(u,b),span:{start:u,end:b},status:"limited",issues:[{code:W,message:"command structure exceeds parser limit"}],nodes:[]}}function _o(n,u,b,W,z){return{nodes:n,issues:[...u,{code:W,message:`command structure exceeds parser limit ${z}`}],next:b,closed:!1,limited:!0,pendingHeredocs:[]}}function Ts(n,u,b){return{nodes:n,issues:u,next:b,closed:!1,limited:!0,pendingHeredocs:[]}}function Fl(n){return n.wordsUsed++,n.wordsUsed<=n.maxWords}function Qb(n,u,b){let W=n.slice(u,b),z=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(W)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(W),B=z?.[1];if(!z||!B)return;return{name:B,braceIndex:u+z[0].lastIndexOf("{")}}function Ci(n){return n.some((u)=>{if(u.kind==="command")return u.redirections.some((b)=>b.heredoc)||u.nested.some((b)=>Ci(b.nodes));return(u.kind==="group"||u.kind==="function")&&Ci(u.body.nodes)})}function Jb(n){return n.map((u)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${u.delimiter} was not found`}))}function km(n){return n?.kind==="command"||n?.kind==="group"||n?.kind==="function"}function Sm(n,u){let b=n.at(-1);if(b?.kind!=="connector"||!Cm.has(b.operator))return;u.push({code:"missing-command-after-connector",message:`connector ${b.operator} requires a following command`})}function Om(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&wb.has(n.text)}function Gl(n,u){let b=n.at(-1);if(!km(b))return;if(b?.kind==="command"&&Om(b.words[0]))return;u.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function eE(n,u,b){return u===b||/[\s;&|()]/u.test(n[u-1]??"")}var Nm=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item","foreach-object","where-object","iex","invoke-expression"]),tE=new Set(["gc","cat","type","cp","mv","rm"]),Lm=["-rec","-for","-path","-literalpath","-whatif"],nE=/^\$env:\w/i,rE=/^(?:\$\{?\w+\}?|~)\\./;function Wm(n,u){let b=n.toLowerCase().replaceAll("`","");if(![...Nm].some((z)=>b.includes(z))&&!(b.includes("rm")&&Lm.some((z)=>b.includes(z)))&&!b.includes("<#")&&!oE(b))return!1;let W=ql(n,u);if(Fm(W))return!1;return W.issues.some((z)=>z.code==="unclosed-block-comment"||z.code==="comment-depth-limit")||Vl(W).some(iE)}function Fm(n){return n.nodes.some((u)=>{if(u.kind==="group")return Fm(u.body);if(u.kind!=="command")return!1;return u.redirections.some((b)=>b.operator==="<<")})}function oE(n){if(n.includes("$env:"))return!0;return n.includes("\\")&&(n.includes("$")||n.includes("~"))}function iE(n){let u=n[0]==="&"||n[0]==="."?1:0,b=n[u]?.toLowerCase();if(b&&Nm.has(b))return!0;let W=n.slice(u+1);if(b&&tE.has(b)&&W.some(sE))return!0;if(b!=="rm")return!1;return W.some((z)=>{let B=z.toLowerCase().split(":",1)[0]??"";return Lm.some((Q)=>B.startsWith(Q))})}function sE(n){return nE.test(n)||rE.test(n)}function ql(n,u){let b={start:0,end:n.length};if(n.length>u.maxInputLength)return{kind:"program",dialect:"powershell",source:n,span:b,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${u.maxInputLength} UTF-16 code units`}],nodes:[]};let W=Kl(n,0,n.length,u,0);return{kind:"program",dialect:"powershell",source:n,span:b,status:mE(W.issues,W.limited),issues:W.issues,nodes:W.nodes}}function Kl(n,u,b,W,z,B=!1){let Q=[],ee=[],le=_s(),ue=0,ve=!1,Oe=()=>{if(le.words.length===0&&le.redirections.length===0)return;let Me={start:le.start,end:le.end};xs(Q,le,{kind:"command",dialect:"powershell",source:n.slice(Me.start,Me.end),span:Me,words:le.words,redirections:le.redirections,nested:le.nested,displayText:le.words.map((Ne)=>Ne.text).join(" ")})},De=u;while(De<b){let Me=n[De];if(!Me)break;if(B&&Me==="}")return Oe(),{nodes:Q,issues:ee,next:De+1,closed:!0,words:ue,limited:ve};let Ne=uE(n,De,b,W.maxDepth);if(Ne){if(Ne.issue)ee.push(Ne.issue);if(Ne.limited)return Oe(),{nodes:Q,issues:ee,next:Ne.next,closed:!1,words:ue,limited:!0};De=Ne.next;continue}if(/\s/.test(Me)){if(Me==="\r"||Me===`
 `){Oe();let Be=Me==="\r"&&n[De+1]===`
-`?De+2:De+1;Q.push(Hl(n,De,Be)),De=Be;continue}De++;continue}let Le=zm(n,De);if(Le){Oe(),Q.push(Hl(n,De,De+Le.length)),De+=Le.length;continue}if(Me==="{"){if(Oe(),z>=W.maxDepth)return ee.push(Gm(W.maxDepth)),{nodes:Q,issues:ee,next:b,closed:!1,words:ue,limited:!0};let Be=Kl(n,De+1,b,W,z+1,!0),ze=Be.closed?Be.next-1:Be.next,it={kind:"program",dialect:"powershell",source:n.slice(De+1,ze),span:{start:De+1,end:ze},status:Be.limited?"limited":Be.issues.length>0?"partial":"complete",issues:Be.issues,nodes:Be.nodes};if(Q.push({kind:"group",style:"brace",span:{start:De,end:Be.next},body:it}),ee.push(...Be.issues),!Be.closed)ee.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=Be.words,ve||=Be.limited,De=Be.next;continue}if(Me==="}"){Oe(),Q.push(Hl(n,De,De+1)),De++;continue}if(Me===">"||Me==="<"){le.start=le.start===-1?De:le.start;let Be=n[De+1]===Me?De+2:De+1,ze=Be;while(/[ \t]/.test(n[ze]??""))ze++;let it=ze<b?Om(n,ze,b,W,z):void 0,at=it?.next??Be;if(le.redirections.push({kind:"redirection",operator:n.slice(De,Be),span:{start:De,end:at},...it?{target:it.word}:{}}),it)ee.push(...it.issues),le.nested.push(...it.nested),ue+=it.words,ve||=it.limited;le.end=at,De=at;continue}if(Me===","){le.start=le.start===-1?De:le.start,le.words.push(Nl({text:",",raw:",",span:{start:De,end:De+1},provenance:"literal",quoted:!1})),le.end=++De;continue}let We=Om(n,De,b,W,z);if(le.start=le.start===-1?De:le.start,le.end=We.next,le.words.push(We.word),ee.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,ve||=We.limited,ue>W.maxWords)return ee.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),Oe(),{nodes:Q,issues:ee,next:We.next,closed:!1,words:ue,limited:!0};De=We.next>De?We.next:De+1}return Oe(),{nodes:Q,issues:ee,next:De,closed:!B,words:ue,limited:ve}}function Om(n,u,b,W,z){let B="",Q="literal",ee=!1,le=[],ue=[],ve=0,Oe=!1,De=(Ne)=>{let Le=sE(n,Ne,b,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),ve+=jl(Le.program),Oe||=Le.program.status==="limited",Q="command-substitution",Le.next},Me=u;while(Me<b){let Ne=n[Me];if(!Ne||/\s/.test(Ne)||zm(n,Me)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let We=n[Me+1];if(!We){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Me++;break}B+=We,Me+=2;continue}if(n.startsWith("$(",Me)){Me=De(Me);continue}let Le=iE(n,Me,Me===u);if(Le?.quote==="'"){ee=!0,Me=Le.bodyStart;let We=!1;while(Me<n.length){if(!Le.hereString&&n[Me]==="'"&&n[Me+1]==="'"){B+="'",Me+=2;continue}let Be=Mm(n,Me,Le);if(Be>0){We=!0,Me+=Be;break}B+=n[Me]??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Le?.quote==='"'){ee=!0,Me=Le.bodyStart;let We=!1;while(Me<b){let Be=n[Me];if(Be==="`"&&n[Me+1]){B+=n[Me+1],Me+=2;continue}let ze=Mm(n,Me,Le);if(ze>0){We=!0,Me+=ze;break}if(n.startsWith("$(",Me)){Me=De(Me);continue}if(Be==="$")Q=n[Me+1]==="("?"command-substitution":"variable";B+=Be??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")Q=n[Me+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Me===u)Q="variable";B+=Ne,Me++}return{word:wo(n,u,Me,B,Q,ee,Q==="literal"?void 0:aE(n,u,Me)),next:Me,issues:le,nested:ue,words:ve,limited:Oe}}function iE(n,u,b){let W=n[u];if(W==="'"||W==='"')return{quote:W,bodyStart:u+1,hereString:!1};let z=b?Ro(n,u):null;return z?{...z,hereString:!0}:void 0}function Mm(n,u,b){if(!b.hereString)return n[u]===b.quote?1:0;return(u===b.bodyStart||n[u-1]===`
-`||n[u-1]==="\r")&&n.startsWith(`${b.quote}@`,u)?2:0}function sE(n,u,b,W,z){let B=Fm(n,u+2,b),Q=B===-1?b:B,ee=B===-1?b:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,Q),span:{start:u+2,end:Q},status:"limited",issues:[Gm(W.maxDepth)],nodes:[]},next:ee};let le=Kl(n,u+2,Q,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,Q),span:{start:u+2,end:Q},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:ee}}function Fm(n,u,b){let W=1,z=!1,B=!1;for(let Q=u;Q<b;Q++){let ee=n[Q];if(ee==="`"){Q++;continue}if(!B&&ee==="'"){if(z&&n[Q+1]==="'"){Q++;continue}z=!z;continue}if(!z&&ee==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",Q)){W++,Q++;continue}if(!B&&ee==="(")W++;if(ee!==")")continue;if(W--,W===0)return Q}return-1}function jl(n){let u=0;for(let b of n.nodes){if(b.kind==="group")u+=jl(b.body);if(b.kind==="command"){u+=b.words.length;for(let W of b.nested)u+=jl(W)}}return u}function aE(n,u,b){let W=As(n),z=Ro(n,u),B=u,Q=!1,ee=z?.bodyStart??u;while(ee<b){let le=n[ee];if(le==="`"){ee+=2;continue}if(le==="'"&&!z){if(Q&&n[ee+1]==="'"){ee+=2;continue}Q=!Q,ee++;continue}if(Q){ee++;continue}if(n.startsWith("$(",ee)){let ue=Fm(n,ee+2,b),ve=ue===-1?b:ue+1;W.push(B,ee,"literal"),W.push(ee,ve,"command-substitution"),ee=ve,B=ve;continue}if(le==="$"||le==="@"&&ee===u){let ue=lE(n,ee+1,b);W.push(B,ee,"literal"),W.push(ee,ue,"variable"),ee=ue,B=ue;continue}ee++}return W.push(B,b,"literal"),W.parts}function lE(n,u,b){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=b?b:z+1}let W=u;while(W<b&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function Gm(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function Vl(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return Vl(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((b)=>b.target?[b.target]:[])].sort((b,W)=>b.span.start-W.span.start).filter((b)=>b.text!==""&&b.raw!==",").map((b)=>b.text),...u.nested.flatMap(Vl)]})}function zm(n,u){for(let b of["&&","||",";","|"])if(n.startsWith(b,u))return b;return null}function cE(n,u,b,W){if(n[u]==="#"&&n[u+1]!==">"){let Q=u+1;while(Q<b&&n[Q]!=="\r"&&n[Q]!==`
-`)Q++;return{next:Q,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<b){if(n.startsWith("<#",B)){if(z++,z>W)return{next:b,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:b,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function dE(n,u){if(u)return"limited";if(n.some((b)=>b.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function Hl(n,u,b){return{kind:"connector",operator:n.slice(u,b),span:{start:u,end:b}}}function C(n,u="auto",b=xr){if(u==="powershell"||u==="auto"&&Lm(n.slice(0,b.maxInputLength),b))return ql(n,b);return Cm(n,b)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:tn(u.map((b)=>b.text))}function xo(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function tn(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Yl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function rn(n){return n.value.length}function Ei(n,u,b=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*b)}function Tn(n,u){Ei(n,u)}function qr(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Jt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function Zl(n){return n===`
+`?De+2:De+1;Q.push(Hl(n,De,Be)),De=Be;continue}De++;continue}let Le=$m(n,De);if(Le){Oe(),Q.push(Hl(n,De,De+Le.length)),De+=Le.length;continue}if(Me==="{"){if(Oe(),z>=W.maxDepth)return ee.push(zm(W.maxDepth)),{nodes:Q,issues:ee,next:b,closed:!1,words:ue,limited:!0};let Be=Kl(n,De+1,b,W,z+1,!0),ze=Be.closed?Be.next-1:Be.next,it={kind:"program",dialect:"powershell",source:n.slice(De+1,ze),span:{start:De+1,end:ze},status:Be.limited?"limited":Be.issues.length>0?"partial":"complete",issues:Be.issues,nodes:Be.nodes};if(Q.push({kind:"group",style:"brace",span:{start:De,end:Be.next},body:it}),ee.push(...Be.issues),!Be.closed)ee.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ue+=Be.words,ve||=Be.limited,De=Be.next;continue}if(Me==="}"){Oe(),Q.push(Hl(n,De,De+1)),De++;continue}if(Me===">"||Me==="<"){le.start=le.start===-1?De:le.start;let Be=n[De+1]===Me?De+2:De+1,ze=Be;while(/[ \t]/.test(n[ze]??""))ze++;let it=ze<b?Mm(n,ze,b,W,z):void 0,at=it?.next??Be;if(le.redirections.push({kind:"redirection",operator:n.slice(De,Be),span:{start:De,end:at},...it?{target:it.word}:{}}),it)ee.push(...it.issues),le.nested.push(...it.nested),ue+=it.words,ve||=it.limited;le.end=at,De=at;continue}if(Me===","){le.start=le.start===-1?De:le.start,le.words.push(Nl({text:",",raw:",",span:{start:De,end:De+1},provenance:"literal",quoted:!1})),le.end=++De;continue}let We=Mm(n,De,b,W,z);if(le.start=le.start===-1?De:le.start,le.end=We.next,le.words.push(We.word),ee.push(...We.issues),le.nested.push(...We.nested),ue+=1+We.words,ve||=We.limited,ue>W.maxWords)return ee.push({code:"word-limit",message:`command exceeds ${W.maxWords} words`}),Oe(),{nodes:Q,issues:ee,next:We.next,closed:!1,words:ue,limited:!0};De=We.next>De?We.next:De+1}return Oe(),{nodes:Q,issues:ee,next:De,closed:!B,words:ue,limited:ve}}function Mm(n,u,b,W,z){let B="",Q="literal",ee=!1,le=[],ue=[],ve=0,Oe=!1,De=(Ne)=>{let Le=lE(n,Ne,b,W,z);return B+=n.slice(Ne,Le.next),ue.push(Le.program),le.push(...Le.program.issues),ve+=jl(Le.program),Oe||=Le.program.status==="limited",Q="command-substitution",Le.next},Me=u;while(Me<b){let Ne=n[Me];if(!Ne||/\s/.test(Ne)||$m(n,Me)||Ne===">"||Ne==="<"||Ne==="#")break;if(Ne===",")break;if(Ne==="`"){let We=n[Me+1];if(!We){le.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),Me++;break}B+=We,Me+=2;continue}if(n.startsWith("$(",Me)){Me=De(Me);continue}let Le=aE(n,Me,Me===u);if(Le?.quote==="'"){ee=!0,Me=Le.bodyStart;let We=!1;while(Me<n.length){if(!Le.hereString&&n[Me]==="'"&&n[Me+1]==="'"){B+="'",Me+=2;continue}let Be=Dm(n,Me,Le);if(Be>0){We=!0,Me+=Be;break}B+=n[Me]??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(Le?.quote==='"'){ee=!0,Me=Le.bodyStart;let We=!1;while(Me<b){let Be=n[Me];if(Be==="`"&&n[Me+1]){B+=n[Me+1],Me+=2;continue}let ze=Dm(n,Me,Le);if(ze>0){We=!0,Me+=ze;break}if(n.startsWith("$(",Me)){Me=De(Me);continue}if(Be==="$")Q=n[Me+1]==="("?"command-substitution":"variable";B+=Be??"",Me++}if(Le.hereString)B=B.replace(/(?:\r\n|[\r\n])$/,"");if(!We)le.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(Ne==="$")Q=n[Me+1]==="("?"command-substitution":"variable";if(Ne==="@"&&Me===u)Q="variable";B+=Ne,Me++}return{word:wo(n,u,Me,B,Q,ee,Q==="literal"?void 0:cE(n,u,Me)),next:Me,issues:le,nested:ue,words:ve,limited:Oe}}function aE(n,u,b){let W=n[u];if(W==="'"||W==='"')return{quote:W,bodyStart:u+1,hereString:!1};let z=b?Ro(n,u):null;return z?{...z,hereString:!0}:void 0}function Dm(n,u,b){if(!b.hereString)return n[u]===b.quote?1:0;return(u===b.bodyStart||n[u-1]===`
+`||n[u-1]==="\r")&&n.startsWith(`${b.quote}@`,u)?2:0}function lE(n,u,b,W,z){let B=Gm(n,u+2,b),Q=B===-1?b:B,ee=B===-1?b:B+1;if(z>=W.maxDepth)return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,Q),span:{start:u+2,end:Q},status:"limited",issues:[zm(W.maxDepth)],nodes:[]},next:ee};let le=Kl(n,u+2,Q,W,z+1),ue=B===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:{kind:"program",dialect:"powershell",source:n.slice(u+2,Q),span:{start:u+2,end:Q},status:le.limited?"limited":le.issues.length+ue.length>0?"partial":"complete",issues:[...le.issues,...ue],nodes:le.nodes},next:ee}}function Gm(n,u,b){let W=1,z=!1,B=!1;for(let Q=u;Q<b;Q++){let ee=n[Q];if(ee==="`"){Q++;continue}if(!B&&ee==="'"){if(z&&n[Q+1]==="'"){Q++;continue}z=!z;continue}if(!z&&ee==='"'){B=!B;continue}if(z)continue;if(n.startsWith("$(",Q)){W++,Q++;continue}if(!B&&ee==="(")W++;if(ee!==")")continue;if(W--,W===0)return Q}return-1}function jl(n){let u=0;for(let b of n.nodes){if(b.kind==="group")u+=jl(b.body);if(b.kind==="command"){u+=b.words.length;for(let W of b.nested)u+=jl(W)}}return u}function cE(n,u,b){let W=As(n),z=Ro(n,u),B=u,Q=!1,ee=z?.bodyStart??u;while(ee<b){let le=n[ee];if(le==="`"){ee+=2;continue}if(le==="'"&&!z){if(Q&&n[ee+1]==="'"){ee+=2;continue}Q=!Q,ee++;continue}if(Q){ee++;continue}if(n.startsWith("$(",ee)){let ue=Gm(n,ee+2,b),ve=ue===-1?b:ue+1;W.push(B,ee,"literal"),W.push(ee,ve,"command-substitution"),ee=ve,B=ve;continue}if(le==="$"||le==="@"&&ee===u){let ue=dE(n,ee+1,b);W.push(B,ee,"literal"),W.push(ee,ue,"variable"),ee=ue,B=ue;continue}ee++}return W.push(B,b,"literal"),W.parts}function dE(n,u,b){if(n[u]==="{"){let z=n.indexOf("}",u+1);return z===-1||z>=b?b:z+1}let W=u;while(W<b&&/[A-Za-z0-9_:?]/.test(n[W]??""))W++;return W}function zm(n){return{code:"depth-limit",message:`command structure exceeds parser limit ${n}`}}function Vl(n){return n.nodes.flatMap((u)=>{if(u.kind==="group")return Vl(u.body);if(u.kind!=="command")return[];return[[...u.words,...u.redirections.flatMap((b)=>b.target?[b.target]:[])].sort((b,W)=>b.span.start-W.span.start).filter((b)=>b.text!==""&&b.raw!==",").map((b)=>b.text),...u.nested.flatMap(Vl)]})}function $m(n,u){for(let b of["&&","||",";","|"])if(n.startsWith(b,u))return b;return null}function uE(n,u,b,W){if(n[u]==="#"&&n[u+1]!==">"){let Q=u+1;while(Q<b&&n[Q]!=="\r"&&n[Q]!==`
+`)Q++;return{next:Q,limited:!1}}if(!n.startsWith("<#",u))return null;let z=1,B=u+2;while(B<b){if(n.startsWith("<#",B)){if(z++,z>W)return{next:b,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${W}`},limited:!0};B+=2;continue}if(n.startsWith("#>",B)){if(z--,B+=2,z===0)return{next:B,limited:!1};continue}B++}return{next:b,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function mE(n,u){if(u)return"limited";if(n.some((b)=>b.code==="unclosed-block-comment"))return"invalid";return n.length>0?"partial":"complete"}function Hl(n,u,b){return{kind:"connector",operator:n.slice(u,b),span:{start:u,end:b}}}function C(n,u="auto",b=xr){if(u==="powershell"||u==="auto"&&Wm(n.slice(0,b.maxInputLength),b))return ql(n,b);return bm(n,b)}function t(n){return n.provenance==="command-substitution"?n.raw:n.text}function ce(n,u){return n==="posix"?u:tn(u.map((b)=>b.text))}function xo(n,u){return n&&n.provenance!=="unknown"?n.provenance==="literal":!/[$`*?[\]]/.test(u)}function tn(n){return n.map((u)=>({kind:"word",text:u,raw:u,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Yl(n,u){return{value:n,work:u}}function ct(n,u){if(n.work)n.work.units=Math.min(Number.MAX_SAFE_INTEGER,n.work.units+1);return n.value[u]}function rn(n){return n.value.length}function Ei(n,u,b=1){if(n)n.units=Math.min(Number.MAX_SAFE_INTEGER,n.units+u.length*b)}function Tn(n,u){Ei(n,u)}function qr(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=48&&u<=57||u>=65&&u<=90||u===95||u>=97&&u<=122}function Jt(n){if(!n)return!1;let u=n.charCodeAt(0);return u===9||u===10||u===11||u===12||u===13||u===32||u===160||u===65279||u===5760||u>=8192&&u<=8202||u===8232||u===8233||u===8239||u===8287||u===12288}function Zl(n){return n===`
 `||n==="\r"||n==="\u2028"||n==="\u2029"}function en(n,u,b){if(u+b.length>rn(n))return!1;for(let W=0;W<b.length;W++)if(ct(n,u+W)!==b[W])return!1;return!0}function mr(n,u,b){return!qr(ct(n,u-1))&&en(n,u,b)&&!qr(ct(n,u+b.length))}function fr(n,u){return qr(ct(n,u-1))!==qr(ct(n,u))}function gn(n){return n===`
-`||n===";"||n==="&"||n==="|"}function Ao(n){return n==="|"||n===";"}function Ds(n,u,b){let W=Yl(n,b);if(u==="rm")return uE(W);if(u==="dd")return fE(W);return Vm(W,!0)}function Ns(n,u,b){let W=Yl(n,b);if(u==="rm")return pE(W);if(u==="reset-hard")return Hm(W,"--ha","rd");if(u==="reset-merge")return Hm(W,"--me","rge");if(u==="clean")return SE(W);if(u==="checkout")return bE(W);if(u==="push-force")return EE(W);if(u==="push-refspec")return vE(W);if(u==="push-delete")return RE(W);if(u==="branch")return wE(W);if(u==="tag")return AE(W);if(u==="restore")return PE(W);return Vm(W,!1)}function uE(n){let u=!1,b=!1,W=!1,z=-1;for(let B=0;B<=rn(n);B++){let Q=ct(n,B);if(!u){let le=ct(n,B+2);if(mr(n,B,"rm")&&Jt(le)&&le!==`
-`)u=!0,B++;continue}let ee=mE(n,B);if(Q===`
-`||ee!==-1){if(u=!1,b=!1,W=!1,z=-1,ee!==-1)B=ee-1;continue}if(Q===";"||Q==="&"||Q==="|"||B===rn(n)){if(z>=0){let le=$m(n,z,B);b||=le.recursive,W||=le.force}if(b&&W)return!0;u=!1,b=!1,W=!1,z=-1;continue}if(Jt(Q)){if(z<0)continue;if(en(n,z,"--")&&B-z===2){u=!1,b=!1,W=!1,z=-1;continue}let le=$m(n,z,B);if(b||=le.recursive,W||=le.force,b&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function mE(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(en(n,u,String.raw`\n`))return u+2;if(en(n,u,String.raw`\x0a`)||en(n,u,String.raw`\x0A`))return u+5;if(en(n,u,String.raw`\u000a`)||en(n,u,String.raw`\u000A`))return u+7;return en(n,u,String.raw`\012`)?u+4:-1}function $m(n,u,b){if(Bm(n,u,b,"recursive"))return{recursive:!0,force:!1};if(Bm(n,u,b,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<b;B++){let Q=ct(n,B);W||=Q==="r"||Q==="R",z||=Q==="f"||Q==="F"}return{recursive:W,force:z}}function Bm(n,u,b,W){let z=b-u-2;if(z<1||z>W.length||!en(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function fE(n){let u=!1;for(let b=0;b<rn(n);b++){if(gn(ct(n,b))){u=!1;continue}if(mr(n,b,"dd")){u=!0,b++;continue}if(!u||!mr(n,b,"of")||!en(n,b,"of=/dev/"))continue;let W=b+8;if(W<rn(n)&&!Jt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function pE(n){let u=!1,b=!1,W=!1;for(let z=0;z<=rn(n);){let B=ct(n,z);if(z===rn(n)||gn(B)){u=!1,b=!1,W=!1,z++;continue}let Q=hE(n,z);if(Q>=0){if(gE(n,Q))return!0;let ee=Q,le=!1;while(Jt(ct(n,ee)))le||=ct(n,ee)===`
-`,ee++;if(le)b=!1,W=!1;u=!0,z=ee;continue}if(!u){z++;continue}if(en(n,z,"--")&&(z===0||Jt(ct(n,z-1)))&&(!ct(n,z+2)||Jt(ct(n,z+2))||gn(ct(n,z+2)))){u=!1,b=!1,W=!1,z+=2;continue}if(b||=en(n,z,"--recursive")&&fr(n,z+11)||Xl(n,z,"recursive"),W||=en(n,z,"--force")&&fr(n,z+7)||Xl(n,z,"force"),b&&W)return!0;z++}return!1}function Xl(n,u,b){if(!en(n,u,"--"))return!1;let W=0;while(W<=b.length){let z=ct(n,u+W+2);if(!z||Jt(z)||gn(z))break;if(z!==b[W])return!1;W++}return W>0&&fr(n,u+W+2)}function gE(n,u){let b=u,W=!1,z=!1;while(b<rn(n)){while(Jt(ct(n,b)))b++;let B=b;while(b<rn(n)&&!Jt(ct(n,b)))b++;if(ct(n,B)!=="-"||b-B===2&&en(n,B,"--"))return!1;let Q=Um(n,B,"recursive"),ee=Um(n,B,"force");if(W&&ee||z&&Q)return!0;if(W||=Q,z||=ee,ct(n,B+1)==="-")continue;let le=yE(n,B,b);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Um(n,u,b){return en(n,u,`--${b}`)&&fr(n,u+b.length+2)||Xl(n,u,b)}function hE(n,u){if(u>0&&qr(ct(n,u-1)))return-1;let b=u;if(ct(n,b)==="\\")b++;if(ct(n,b)!=="r")return-1;if(b++,ct(n,b)==="\\")b++;if(ct(n,b)!=="m"||!Jt(ct(n,b+1)))return-1;return b+1}function yE(n,u,b){let W=!1,z=!1,B=!1,Q=!1,ee=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:Q,combined:ee};let le="";for(let ue=u+1;ue<b;ue++){let ve=ct(n,ue)??"",Oe=(ve==="r"||ve==="f")&&fr(n,ue+1);W||=ve==="r",z||=ve==="f",B||=ve==="r"&&Oe,Q||=ve==="f"&&Oe,ee||=(le==="r"&&ve==="f"||le==="f"&&ve==="r")&&Oe,le=ve}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:Q,combined:ee}}function Hm(n,u,b){return Ri(n,"reset",Ao,!0,(W)=>ct(n,W)==="-"&&Po(n,W,u,b)?!0:W)}function SE(n){return Ri(n,"clean",Ao,!0,(u)=>{if(ct(n,u)!=="-")return u;if(Po(n,u,"--fo","rce"))return!0;let b=vi(n,u,Ao);for(let W=u+1;W<b;W++)if(ct(n,W)==="f")return!0;return b-1})}function Ls(n,u,b){if(!mr(n,u,"git"))return null;let W=u+3;if(!Jt(ct(n,W)))return{commandEnd:-1,next:W};while(Jt(ct(n,W)))W++;while(W<rn(n)){if(gn(ct(n,W)))return{commandEnd:-1,next:W};let z=vi(n,W,gn);if(mr(n,W,b))return{commandEnd:W+b.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&en(n,W,"--"),Q=CE(n,W,z);W=z;while(Jt(ct(n,W)))W++;if(B)return{commandEnd:mr(n,W,b)?W+b.length:-1,next:vi(n,W,gn)};if(!Q)continue;if(W>=rn(n)||gn(ct(n,W)))return{commandEnd:-1,next:W};W=vi(n,W,gn);while(Jt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function CE(n,u,b){for(let W of Nn)if(b-u===W.length&&en(n,u,W))return!0;return!1}function bE(n){return jm(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function EE(n){return Ri(n,"push",Ao,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!qr(ct(n,u+2))&&!en(n,u+2,"-with-lease"))return!0;let b=qm(n,u,"--fo","rce");if(b>=0&&!en(n,b,"-with-lease"))return!0;return u})}function vE(n){return Ri(n,"push",gn,!1,(u)=>{if(Jt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<rn(n)&&!gn(ct(n,u+2))&&!Jt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function RE(n){return Ri(n,"push",gn,!1,(u)=>{if(ct(n,u)==="-"&&Po(n,u,"--de","lete"))return!0;if(Jt(ct(n,u))&&ct(n,u+1)===":"&&u+2<rn(n)&&!Jt(ct(n,u+2))&&!gn(ct(n,u+2)))return!0;return u})}function wE(n){let u=!1,b=!1,W=!1;for(let z=0;z<=rn(n);z++){if(z===rn(n)||gn(ct(n,z))){if(b&&W)return!0;u=!1,b=!1,W=!1;continue}if(!u){let ee=Ls(n,z,"branch");if(ee){u=ee.commandEnd>=0,z=Math.max(z,(u?ee.commandEnd:ee.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=vi(n,z,gn),Q=_E(n,z,B);if(b||=Q.deletion,W||=Q.force,b&&W)return!0;z=B-1}return!1}function _E(n,u,b){let W=!1,z=!1;for(let B=u;B<b;B++){if(ct(n,B)!=="-")continue;if(Po(n,B,"--de","lete"))W=!0;if(Po(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let Q=B+1,ee=!1,le=!1,ue=!1;while(Q<b&&xE(ct(n,Q))){let ve=ct(n,Q);ee||=ve==="d"||ve==="D",le||=ve==="f",ue||=ve==="D",Q++}if(!fr(n,Q))continue;W||=ee,z||=le||ue}return{deletion:W,force:z}}function xE(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function AE(n){return jm(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function jm(n,u){let b=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<rn(n);W++){let z=ct(n,W),B=b[b.length-1];if(!B)return!1;let Q=B.escaped;if(B.escaped=!Q&&B.quote!=="'"&&z==="\\",!Q&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!Q&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(b.length===1||!Q&&B.quote!=="'")){b.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!Q&&!B.quote&&b.length>1&&z==="("){B.depth++;continue}if(!Q&&!B.quote&&b.length>1&&z===")"){if(B.depth--,B.depth===0)b.pop();continue}if(Jt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let ee=Ls(n,W,u.command);if(ee){B.outerActive=ee.commandEnd>=0&&Jt(ct(n,ee.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?ee.commandEnd:ee.next)-1);continue}}if(B.outerActive&&z==="-"){if(Po(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&fr(n,W+1))return!0;if(Ao(z))B.outerActive=!1}return!1}function Ri(n,u,b,W,z){let B=!1;for(let Q=0;Q<rn(n);Q++){let ee=ct(n,Q),le=b(ee);if(!B&&!le){let ue=Ls(n,Q,u);if(ue){B=ue.commandEnd>=0&&(!W||Jt(ct(n,ue.commandEnd))),Q=Math.max(Q,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(Q);if(ue===!0)return!0;for(let ve=Q;ve<=ue;ve++)if(b(ct(n,ve)))B=!1;Q=ue}if(le)B=!1}return!1}function PE(n){let u=!1;for(let b=0;b<rn(n);b++){if(Zl(ct(n,b))){if(u)return!0;u=!1;continue}if(!u){let W=Ls(n,b,"restore");if(W){u=W.commandEnd>=0,b=Math.max(b,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,b)==="-"&&ct(n,b+1)==="-"&&(en(n,b+2,"staged")||en(n,b+2,"help")))u=!1}return u}function Vm(n,u){let b=!1;for(let W=0;W<rn(n);W++){let z=ct(n,W),B=u?Zl(z):gn(z);if(b&&Jt(z)&&ct(n,W+1)==="-"&&mr(n,W+2,"delete"))return!0;if(B){b=!1;continue}if(mr(n,W,"find"))b=!0,W+=3}return!1}function vi(n,u,b){let W=u;while(W<rn(n)&&!Jt(ct(n,W))&&!b(ct(n,W)))W++;return W}function qm(n,u,b,W){if(!en(n,u,b))return-1;let z=u+b.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return fr(n,z)?z:-1}function Po(n,u,b,W){return qm(n,u,b,W)>=0}function Un(n,u){Ei(u,n,2);let b=n.toLowerCase(),W=b.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let Q of B){if(Q.skipForEchoRg&&z)continue;let ee=Q.caseSensitive?n:b;if(Q.regex)Tn(u,ee);if((Q.regex?.test(ee)??!1)||Q.scan&&Ns(ee,Q.scan,u))return st("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${Q.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var TE=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ym(n,u,b){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;Ei(b,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return Zm(u.nodes,W,B)}function Zm(n,u,b){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return Zm(W.body.nodes,u,b);if(W.kind==="unknown")return!b.loose.test(W.source);return IE(W,u,b)})}function IE(n,u,b){if(n.nested.some((z)=>b.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!TE.test(z.text));return n.words.every((z,B)=>z===u||Km(z.raw,b.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!b.loose.test(z.heredoc.body))&&(!z.target||Km(z.target.raw,b.anchored,!0)))}function Km(n,u,b){let W=!1,z=!1;for(let B=0;B<n.length;B++){let Q=n[B];if(Q==="\\"&&!W){B++;continue}if(!z&&Q==="'"){W=!W;continue}if(!W&&Q==='"'){z=!z;continue}if(W||Q!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!b)return!1}return!0}var kE="dd writing to a /dev device can destroy a disk or partition. Ask the user to run device writes manually after confirming the target.",OE="mkfs formatting a /dev device erases everything on it. Ask the user to run the format manually after confirming the target.",ME="This erases or repartitions a disk. Ask the user to run disk erase and partition commands manually after confirming the target.",DE="This output redirect overwrites a disk device. Ask the user to run device writes manually after confirming the target.",NE="shred permanently destroys the given target. Use rm for ordinary deletes, or ask the user to run shred manually.",LE=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Xm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,WE=new Set(["diskutil","wipefs","sgdisk","parted"]),FE=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),GE=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,zE=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),$E=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),BE=new Set(["i","b"]),UE=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,HE=new Set([">",">|",">>","<>",">&"]),jE=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Qm(n){return n==="dd"||n==="shred"||Xm.test(n)||WE.has(n)}function VE(n,u){let b=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&FE.has(W.toLowerCase())}if(n==="wipefs")return b&&u.some((W)=>GE.test(W));if(n==="sgdisk")return b&&u.some((W)=>W.startsWith("-")&&!qE(W));return n==="parted"&&b&&u.some((W)=>jE.has(W.toLowerCase()))}function qE(n){if(zE.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return BE.has(u[0]??"")||u.every((b)=>$E.has(b))}function Jm(n,u){let b=u.slice(1);if(n==="dd"&&b.some((W)=>/^of=\/dev\/.+/.test(W)&&!LE.has(W)))return st("dd.device-write",kE);if(Xm.test(n)&&b.some((W)=>W.startsWith("/dev/")))return st("mkfs.device",OE);if(VE(n,b))return st("disk.erase",ME);if(n==="shred"&&b.length>0)return st("shred.target",NE);return null}function ef(n){return n.some((u)=>HE.has(u.operator)&&u.target?.provenance==="literal"&&UE.test(u.target.text))?st("redirect.block-device",DE):null}import{readFileSync as KE,statSync as YE}from"node:fs";import{isAbsolute as ZE,resolve as tf}from"node:path";function Ar(n,u,b,W){let z=ZE(n)?tf(n):u?tf(u,n):void 0;if(!z)return;try{return jt(z,b,W)}catch{return z}}function Ql(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}var nf=262144;function rf(n){if(!Ql(n))return null;try{let u=YE(n,{throwIfNoEntry:!1});if(!u?.isFile()||u.size>nf)return null;let b=KE(n);return b.length>nf||b.includes(0)?null:{text:b.toString("utf8").replaceAll(`\r
+`||n===";"||n==="&"||n==="|"}function Ao(n){return n==="|"||n===";"}function Ds(n,u,b){let W=Yl(n,b);if(u==="rm")return fE(W);if(u==="dd")return gE(W);return qm(W,!0)}function Ns(n,u,b){let W=Yl(n,b);if(u==="rm")return hE(W);if(u==="reset-hard")return jm(W,"--ha","rd");if(u==="reset-merge")return jm(W,"--me","rge");if(u==="clean")return bE(W);if(u==="checkout")return vE(W);if(u==="push-force")return RE(W);if(u==="push-refspec")return wE(W);if(u==="push-delete")return _E(W);if(u==="branch")return xE(W);if(u==="tag")return TE(W);if(u==="restore")return IE(W);return qm(W,!1)}function fE(n){let u=!1,b=!1,W=!1,z=-1;for(let B=0;B<=rn(n);B++){let Q=ct(n,B);if(!u){let le=ct(n,B+2);if(mr(n,B,"rm")&&Jt(le)&&le!==`
+`)u=!0,B++;continue}let ee=pE(n,B);if(Q===`
+`||ee!==-1){if(u=!1,b=!1,W=!1,z=-1,ee!==-1)B=ee-1;continue}if(Q===";"||Q==="&"||Q==="|"||B===rn(n)){if(z>=0){let le=Bm(n,z,B);b||=le.recursive,W||=le.force}if(b&&W)return!0;u=!1,b=!1,W=!1,z=-1;continue}if(Jt(Q)){if(z<0)continue;if(en(n,z,"--")&&B-z===2){u=!1,b=!1,W=!1,z=-1;continue}let le=Bm(n,z,B);if(b||=le.recursive,W||=le.force,b&&W)return!0;z=-1;continue}if(z<0)z=B}return!1}function pE(n,u){if(ct(n,u)!=="\\"||ct(n,u-1)==="\\")return-1;if(en(n,u,String.raw`\n`))return u+2;if(en(n,u,String.raw`\x0a`)||en(n,u,String.raw`\x0A`))return u+5;if(en(n,u,String.raw`\u000a`)||en(n,u,String.raw`\u000A`))return u+7;return en(n,u,String.raw`\012`)?u+4:-1}function Bm(n,u,b){if(Um(n,u,b,"recursive"))return{recursive:!0,force:!1};if(Um(n,u,b,"force"))return{recursive:!1,force:!0};if(ct(n,u)!=="-"||ct(n,u+1)==="-")return{recursive:!1,force:!1};let W=!1,z=!1;for(let B=u+1;B<b;B++){let Q=ct(n,B);W||=Q==="r"||Q==="R",z||=Q==="f"||Q==="F"}return{recursive:W,force:z}}function Um(n,u,b,W){let z=b-u-2;if(z<1||z>W.length||!en(n,u,"--"))return!1;for(let B=0;B<z;B++)if(ct(n,u+B+2)!==W[B])return!1;return!0}function gE(n){let u=!1;for(let b=0;b<rn(n);b++){if(gn(ct(n,b))){u=!1;continue}if(mr(n,b,"dd")){u=!0,b++;continue}if(!u||!mr(n,b,"of")||!en(n,b,"of=/dev/"))continue;let W=b+8;if(W<rn(n)&&!Jt(ct(n,W))&&ct(n,W)!=="'"&&ct(n,W)!=='"')return!0}return!1}function hE(n){let u=!1,b=!1,W=!1;for(let z=0;z<=rn(n);){let B=ct(n,z);if(z===rn(n)||gn(B)){u=!1,b=!1,W=!1,z++;continue}let Q=SE(n,z);if(Q>=0){if(yE(n,Q))return!0;let ee=Q,le=!1;while(Jt(ct(n,ee)))le||=ct(n,ee)===`
+`,ee++;if(le)b=!1,W=!1;u=!0,z=ee;continue}if(!u){z++;continue}if(en(n,z,"--")&&(z===0||Jt(ct(n,z-1)))&&(!ct(n,z+2)||Jt(ct(n,z+2))||gn(ct(n,z+2)))){u=!1,b=!1,W=!1,z+=2;continue}if(b||=en(n,z,"--recursive")&&fr(n,z+11)||Xl(n,z,"recursive"),W||=en(n,z,"--force")&&fr(n,z+7)||Xl(n,z,"force"),b&&W)return!0;z++}return!1}function Xl(n,u,b){if(!en(n,u,"--"))return!1;let W=0;while(W<=b.length){let z=ct(n,u+W+2);if(!z||Jt(z)||gn(z))break;if(z!==b[W])return!1;W++}return W>0&&fr(n,u+W+2)}function yE(n,u){let b=u,W=!1,z=!1;while(b<rn(n)){while(Jt(ct(n,b)))b++;let B=b;while(b<rn(n)&&!Jt(ct(n,b)))b++;if(ct(n,B)!=="-"||b-B===2&&en(n,B,"--"))return!1;let Q=Hm(n,B,"recursive"),ee=Hm(n,B,"force");if(W&&ee||z&&Q)return!0;if(W||=Q,z||=ee,ct(n,B+1)==="-")continue;let le=CE(n,B,b);if(le.combined||W&&le.forceAtBoundary||z&&le.recursiveAtBoundary)return!0;W||=le.recursive,z||=le.force}return!1}function Hm(n,u,b){return en(n,u,`--${b}`)&&fr(n,u+b.length+2)||Xl(n,u,b)}function SE(n,u){if(u>0&&qr(ct(n,u-1)))return-1;let b=u;if(ct(n,b)==="\\")b++;if(ct(n,b)!=="r")return-1;if(b++,ct(n,b)==="\\")b++;if(ct(n,b)!=="m"||!Jt(ct(n,b+1)))return-1;return b+1}function CE(n,u,b){let W=!1,z=!1,B=!1,Q=!1,ee=!1;if(ct(n,u)!=="-")return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:Q,combined:ee};let le="";for(let ue=u+1;ue<b;ue++){let ve=ct(n,ue)??"",Oe=(ve==="r"||ve==="f")&&fr(n,ue+1);W||=ve==="r",z||=ve==="f",B||=ve==="r"&&Oe,Q||=ve==="f"&&Oe,ee||=(le==="r"&&ve==="f"||le==="f"&&ve==="r")&&Oe,le=ve}return{recursive:W,force:z,recursiveAtBoundary:B,forceAtBoundary:Q,combined:ee}}function jm(n,u,b){return Ri(n,"reset",Ao,!0,(W)=>ct(n,W)==="-"&&Po(n,W,u,b)?!0:W)}function bE(n){return Ri(n,"clean",Ao,!0,(u)=>{if(ct(n,u)!=="-")return u;if(Po(n,u,"--fo","rce"))return!0;let b=vi(n,u,Ao);for(let W=u+1;W<b;W++)if(ct(n,W)==="f")return!0;return b-1})}function Ls(n,u,b){if(!mr(n,u,"git"))return null;let W=u+3;if(!Jt(ct(n,W)))return{commandEnd:-1,next:W};while(Jt(ct(n,W)))W++;while(W<rn(n)){if(gn(ct(n,W)))return{commandEnd:-1,next:W};let z=vi(n,W,gn);if(mr(n,W,b))return{commandEnd:W+b.length,next:z};if(ct(n,W)!=="-")return{commandEnd:-1,next:z};let B=z-W===2&&en(n,W,"--"),Q=EE(n,W,z);W=z;while(Jt(ct(n,W)))W++;if(B)return{commandEnd:mr(n,W,b)?W+b.length:-1,next:vi(n,W,gn)};if(!Q)continue;if(W>=rn(n)||gn(ct(n,W)))return{commandEnd:-1,next:W};W=vi(n,W,gn);while(Jt(ct(n,W)))W++}return{commandEnd:-1,next:W}}function EE(n,u,b){for(let W of Nn)if(b-u===W.length&&en(n,u,W))return!0;return!1}function vE(n){return Vm(n,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function RE(n){return Ri(n,"push",Ao,!0,(u)=>{if(ct(n,u)!=="-")return u;if(ct(n,u+1)==="f"&&!qr(ct(n,u+2))&&!en(n,u+2,"-with-lease"))return!0;let b=Km(n,u,"--fo","rce");if(b>=0&&!en(n,b,"-with-lease"))return!0;return u})}function wE(n){return Ri(n,"push",gn,!1,(u)=>{if(Jt(ct(n,u))&&ct(n,u+1)==="+"&&u+2<rn(n)&&!gn(ct(n,u+2))&&!Jt(ct(n,u+2)))return!0;if(ct(n,u)===":"&&ct(n,u+1)==="+")return!0;return u})}function _E(n){return Ri(n,"push",gn,!1,(u)=>{if(ct(n,u)==="-"&&Po(n,u,"--de","lete"))return!0;if(Jt(ct(n,u))&&ct(n,u+1)===":"&&u+2<rn(n)&&!Jt(ct(n,u+2))&&!gn(ct(n,u+2)))return!0;return u})}function xE(n){let u=!1,b=!1,W=!1;for(let z=0;z<=rn(n);z++){if(z===rn(n)||gn(ct(n,z))){if(b&&W)return!0;u=!1,b=!1,W=!1;continue}if(!u){let ee=Ls(n,z,"branch");if(ee){u=ee.commandEnd>=0,z=Math.max(z,(u?ee.commandEnd:ee.next)-1);continue}}if(!u||ct(n,z)!=="-")continue;let B=vi(n,z,gn),Q=AE(n,z,B);if(b||=Q.deletion,W||=Q.force,b&&W)return!0;z=B-1}return!1}function AE(n,u,b){let W=!1,z=!1;for(let B=u;B<b;B++){if(ct(n,B)!=="-")continue;if(Po(n,B,"--de","lete"))W=!0;if(Po(n,B,"--fo","rce"))z=!0;if(ct(n,B+1)==="-")continue;let Q=B+1,ee=!1,le=!1,ue=!1;while(Q<b&&PE(ct(n,Q))){let ve=ct(n,Q);ee||=ve==="d"||ve==="D",le||=ve==="f",ue||=ve==="D",Q++}if(!fr(n,Q))continue;W||=ee,z||=le||ue}return{deletion:W,force:z}}function PE(n){if(!n)return!1;let u=n.charCodeAt(0);return u>=65&&u<=90||u>=97&&u<=122}function TE(n){return Vm(n,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Vm(n,u){let b=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let W=0;W<rn(n);W++){let z=ct(n,W),B=b[b.length-1];if(!B)return!1;let Q=B.escaped;if(B.escaped=!Q&&B.quote!=="'"&&z==="\\",!Q&&z==="'"&&B.quote!=='"')B.quote=B.quote==="'"?"":"'";if(!Q&&z==='"'&&B.quote!=="'")B.quote=B.quote==='"'?"":'"';if(z==="$"&&ct(n,W+1)==="("&&(b.length===1||!Q&&B.quote!=="'")){b.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),W++;continue}if(!Q&&!B.quote&&b.length>1&&z==="("){B.depth++;continue}if(!Q&&!B.quote&&b.length>1&&z===")"){if(B.depth--,B.depth===0)b.pop();continue}if(Jt(z))B.shortActive=!1,B.hasShortFlag=!1;if(!B.outerActive){let ee=Ls(n,W,u.command);if(ee){B.outerActive=ee.commandEnd>=0&&Jt(ct(n,ee.commandEnd)),B.shortActive=!1,B.hasShortFlag=!1,W=Math.max(W,(B.outerActive?ee.commandEnd:ee.next)-1);continue}}if(B.outerActive&&z==="-"){if(Po(n,W,u.longPrefix,u.longOptional))return!0;B.shortActive||=!u.excludedShortStarts.includes(ct(n,W+1)??"")}if(B.hasShortFlag||=B.shortActive&&z===u.shortFlag,B.hasShortFlag&&fr(n,W+1))return!0;if(Ao(z))B.outerActive=!1}return!1}function Ri(n,u,b,W,z){let B=!1;for(let Q=0;Q<rn(n);Q++){let ee=ct(n,Q),le=b(ee);if(!B&&!le){let ue=Ls(n,Q,u);if(ue){B=ue.commandEnd>=0&&(!W||Jt(ct(n,ue.commandEnd))),Q=Math.max(Q,(B?ue.commandEnd:ue.next)-1);continue}}if(B){let ue=z(Q);if(ue===!0)return!0;for(let ve=Q;ve<=ue;ve++)if(b(ct(n,ve)))B=!1;Q=ue}if(le)B=!1}return!1}function IE(n){let u=!1;for(let b=0;b<rn(n);b++){if(Zl(ct(n,b))){if(u)return!0;u=!1;continue}if(!u){let W=Ls(n,b,"restore");if(W){u=W.commandEnd>=0,b=Math.max(b,(u?W.commandEnd:W.next)-1);continue}}if(u&&ct(n,b)==="-"&&ct(n,b+1)==="-"&&(en(n,b+2,"staged")||en(n,b+2,"help")))u=!1}return u}function qm(n,u){let b=!1;for(let W=0;W<rn(n);W++){let z=ct(n,W),B=u?Zl(z):gn(z);if(b&&Jt(z)&&ct(n,W+1)==="-"&&mr(n,W+2,"delete"))return!0;if(B){b=!1;continue}if(mr(n,W,"find"))b=!0,W+=3}return!1}function vi(n,u,b){let W=u;while(W<rn(n)&&!Jt(ct(n,W))&&!b(ct(n,W)))W++;return W}function Km(n,u,b,W){if(!en(n,u,b))return-1;let z=u+b.length;for(let B=0;B<W.length&&ct(n,z)===W[B];B++)z++;return fr(n,z)?z:-1}function Po(n,u,b,W){return Km(n,u,b,W)>=0}function Un(n,u){Ei(u,n,2);let b=n.toLowerCase(),W=b.trimStart(),z=W.startsWith("echo ")||W.startsWith("rg "),B=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let Q of B){if(Q.skipForEchoRg&&z)continue;let ee=Q.caseSensitive?n:b;if(Q.regex)Tn(u,ee);if((Q.regex?.test(ee)??!1)||Q.scan&&Ns(ee,Q.scan,u))return st("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${Q.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var kE=/^[A-Za-z_][A-Za-z0-9_]*=/;function Zm(n,u,b){let W=n.words[0];if(!u||!W||n.words.length!==1||n.dialect!=="posix")return!1;if(!W.quoted||W.provenance!=="literal")return!1;let z=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(W.text)?.[1];if(!z)return!1;Ei(b,u.source,2);let B={anchored:new RegExp(`^\\$\\{?${z}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${z}(?![A-Za-z0-9_])`)};return Xm(u.nodes,W,B)}function Xm(n,u,b){return n.every((W)=>{if(W.kind==="connector")return!0;if(W.kind==="group"||W.kind==="function")return Xm(W.body.nodes,u,b);if(W.kind==="unknown")return!b.loose.test(W.source);return OE(W,u,b)})}function OE(n,u,b){if(n.nested.some((z)=>b.loose.test(z.source)))return!1;let W=n.words.findIndex((z)=>!kE.test(z.text));return n.words.every((z,B)=>z===u||Ym(z.raw,b.anchored,B!==W))&&n.redirections.every((z)=>(!z.heredoc||z.heredoc.quotedDelimiter||!b.loose.test(z.heredoc.body))&&(!z.target||Ym(z.target.raw,b.anchored,!0)))}function Ym(n,u,b){let W=!1,z=!1;for(let B=0;B<n.length;B++){let Q=n[B];if(Q==="\\"&&!W){B++;continue}if(!z&&Q==="'"){W=!W;continue}if(!W&&Q==='"'){z=!z;continue}if(W||Q!=="$")continue;if(!u.test(n.slice(B)))continue;if(!z||!b)return!1}return!0}var ME="dd writing to a /dev device can destroy a disk or partition. Ask the user to run device writes manually after confirming the target.",DE="mkfs formatting a /dev device erases everything on it. Ask the user to run the format manually after confirming the target.",NE="This erases or repartitions a disk. Ask the user to run disk erase and partition commands manually after confirming the target.",LE="This output redirect overwrites a disk device. Ask the user to run device writes manually after confirming the target.",WE="shred permanently destroys the given target. Use rm for ordinary deletes, or ask the user to run shred manually.",FE=new Set(["of=/dev/null","of=/dev/zero","of=/dev/full"]),Qm=/^(?:mkfs(?:\..+)?|mke2fs|newfs(?:_.+)?)$/,GE=new Set(["diskutil","wipefs","sgdisk","parted"]),zE=new Set(["erasedisk","erasevolume","reformat","partitiondisk","zerodisk","randomdisk","secureerase"]),$E=/^(?:-[^-]*[ao]|--all$|--offset(?:=|$))/,BE=new Set(["-p","--print","-i","--info","-v","--verify","-O","--print-mbr","-E","--end-of-largest","-F","--first-in-largest","-f","--first-aligned-in-largest","-D","--display-alignment","-L","--list-types","-P","--pretend","-b","--backup","-V","--version","-?","--help","--usage"]),UE=new Set(["p","v","O","E","F","f","D","L","P","V","?"]),HE=new Set(["i","b"]),jE=/^\/dev\/(?:r?disk\d|sd[a-z]|hd[a-z]|vd[a-z]|xvd[a-z]|nvme\d|mmcblk\d|md\d|dm-\d|loop\d|mapper\/|disk\/)/,VE=new Set([">",">|",">>","<>",">&"]),qE=new Set(["mklabel","mktable","mkpart","rm","resizepart"]);function Jm(n){return n==="dd"||n==="shred"||Qm.test(n)||GE.has(n)}function KE(n,u){let b=u.some((W)=>W.startsWith("/dev/"));if(n==="diskutil"){let W=u.find((z)=>!z.startsWith("-"));return W!==void 0&&zE.has(W.toLowerCase())}if(n==="wipefs")return b&&u.some((W)=>$E.test(W));if(n==="sgdisk")return b&&u.some((W)=>W.startsWith("-")&&!YE(W));return n==="parted"&&b&&u.some((W)=>qE.has(W.toLowerCase()))}function YE(n){if(BE.has(n.split("=",1)[0]??n))return!0;if(n.startsWith("--"))return!1;let u=n.slice(1).split("");return HE.has(u[0]??"")||u.every((b)=>UE.has(b))}function ef(n,u){let b=u.slice(1);if(n==="dd"&&b.some((W)=>/^of=\/dev\/.+/.test(W)&&!FE.has(W)))return st("dd.device-write",ME);if(Qm.test(n)&&b.some((W)=>W.startsWith("/dev/")))return st("mkfs.device",DE);if(KE(n,b))return st("disk.erase",NE);if(n==="shred"&&b.length>0)return st("shred.target",WE);return null}function tf(n){return n.some((u)=>VE.has(u.operator)&&u.target?.provenance==="literal"&&jE.test(u.target.text))?st("redirect.block-device",LE):null}import{readFileSync as ZE,statSync as XE}from"node:fs";import{isAbsolute as QE,resolve as nf}from"node:path";function Ar(n,u,b,W){let z=QE(n)?nf(n):u?nf(u,n):void 0;if(!z)return;try{return jt(z,b,W)}catch{return z}}function Ql(n){return!["/dev","/proc","/sys"].some((u)=>n===u||n.startsWith(`${u}/`))}var rf=262144;function of(n){if(!Ql(n))return null;try{let u=XE(n,{throwIfNoEntry:!1});if(!u?.isFile()||u.size>rf)return null;let b=ZE(n);return b.length>rf||b.includes(0)?null:{text:b.toString("utf8").replaceAll(`\r
 `,`
-`),bytes:b.length}}catch{return null}}import{isAbsolute as Qs,normalize as uR,parse as mR,posix as Hf,resolve as eo,sep as dc}from"node:path";import{isAbsolute as XE,join as of,normalize as lf,parse as QE,sep as sf}from"node:path";var JE=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],ev=` 	
-`;function wi(n,u){if(Kr(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Jl(n.get("TMPDIR")??"",u)}function To(n,u){if(n.has("TMPDIR"))return Jl(n.get("TMPDIR")??"",u);let b=ec(n,u);if(b===void 0)return!0;return Jl(b,u)}function ec(n,u){return df(n,u,"TMPDIR")}function Jl(n,u){if(!n)return!1;if(nv(n))return!1;return Io(n,u)}function Kr(n,u){let b=df(n,u,"IFS");return b!==void 0&&b!==""&&b!==ev}function Io(n,u){let b=Ws(n,u.paths);if(b===null)return!1;return cf(u).some((W)=>Pr(b,W))}function Gs(n,u){let b=Ws(n,u.paths);if(b===null)return!1;return cf(u).some((W)=>Fs(W)===Fs(b))}var af=new WeakMap;function cf(n){let u=af.get(n);if(u)return u;let b=tv(n);return af.set(n,b),b}function tv(n){let u=JE.map((W)=>Ws(W,n.paths)??lf(W)),b=Ws(n.tmpdir,n.paths);if(!b)return u;if(process.platform==="win32")return[...u,b];if(process.platform==="darwin"&&rv(b))return[...u,b];return u}function nv(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function df(n,u,b){return n.has(b)?n.get(b):u.env.get(b)}function rv(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function Ws(n,u){try{let b=lf(n);if(!XE(b))return b;let W=QE(b).root,z=b.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let Q=0;Q<z.length;Q++){let ee=of(B,z[Q]??"");if(u.entryKind(ee)==="missing")return of(ee,...z.slice(Q+1));let le=u.realpath(ee);if(le===null)return null;B=le}return B}catch{return null}}function Pr(n,u){let b=Fs(n),W=Fs(u);if(b===W)return!0;let z=W.endsWith(sf)?W:`${W}${sf}`;return b.startsWith(z)}function Fs(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as tR,readdirSync as nR}from"node:fs";import{basename as rR,isAbsolute as Lf,join as oR,relative as Wf}from"node:path";import{isAbsolute as yf,parse as fv}from"node:path";import{dirname as ov,isAbsolute as iv,parse as sv,sep as av}from"node:path";function Tr(n,u,b){if(dr(u))throw Error("Unsupported Windows namespace path");let W=iv(u)?sv(u).root:"",z=W||n;for(let B of cv(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=ov(z);continue}let Q=lv(z,B),ee=b.entryKind(Q),le=ee==="symlink"?b.realpath(Q):Q;if(ee==="missing"||le===null)throw Error(`Cannot resolve path component: ${Q}`);z=le}return z}function lv(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${av}${u}`}function cv(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var tc=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],dv=new Set(tc),uv=1024,uf=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),mf=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),mv=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function zs(n){return dv.has(n)}function nc(n){return zs(n)||uf.has(n)||mf.has(n)||oi(n)}function pr(n,u,b){return b?.has(n)?b.get(n):u.get(n)}function ff(n,u){let b=pr("GIT_CONFIG_COUNT",n,u);if(b===void 0)return{state:"absent"};if(b==="")return{state:"valid",count:0};if(!/^\d+$/.test(b))return{state:"invalid"};let W=Number(b);return Number.isSafeInteger(W)&&W<=uv?{state:"valid",count:W}:{state:"invalid"}}function $s(n,u,b){let z=n.match(mv)?.[1];if(!z||!nc(z))return null;let B=n.indexOf("=");return{name:z,value:`${pr(z,u,b)??""}${n.slice(B+1)}`}}function pf(n){return hf(n,mf)}function gf(n){return hf(n,uf)}function hf(n,u){if(!n)return!1;for(let b of n.keys())if(u.has(b))return!0;return!1}var Cf=/^[A-Za-z_][A-Za-z0-9_]*=/;function In(n){if(!Cf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function Ae(n){let u=new Map,b=0;while(b<n.length){let W=n[b];if(!W)break;let z=In(t(W));if(!z)break;u.set(z.name,z.value),b++}return{words:n.slice(b),envAssignments:u}}function bf(n){let u=Bt(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function gr(n,u,b,W){if(!bf(ko(n)))return{words:n,envAssignments:new Map,cwd:b,rewritten:!1};let z=new Set(n),B=n,Q=new Map,ee=new Map(W??[]),le=[],ue=b;for(let Oe=0;Oe<l.wrapperPeelIterations.cap;Oe++){let De=Sf(B),Me=Ae(B);for(let[Le,We]of Me.envAssignments)Q.set(Le,We),ee.set(Le,We);if(B=Me.words,B.length===0)break;while(B.length>0&&ko(B).includes("=")&&!gv(B)){let Le=hv(ko(B),ee,u.env)??$s(ko(B),u.env,ee);if(Le)Q.set(Le.name,Le.value),ee.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=Bt(ko(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=Sv(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=Ev(B,ue,ee,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,Be]of Le.envAssignments)Q.set(We,Be),ee.set(We,Be)}if(Ne==="command")B=vv(B);if(Ne==="builtin")B=B.slice(Kn(B,1)==="--"?2:1);if(Sf(B)===De)break}let ve=Ae(B);for(let[Oe,De]of ve.envAssignments)Q.set(Oe,De),ee.set(Oe,De);return{words:ve.words,envAssignments:Q,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:pv(ve.words,z)}}function pv(n,u){return n.some((b)=>!u.has(b))}function Sf(n){return n.map(t).join(" ")}function ko(n){let u=n[0];return u?t(u):""}function Kn(n,u){let b=n[u];return b?t(b):void 0}function gv(n){return Cf.test(ko(n))}function hv(n,u,b){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??b.get("TMPDIR")??""}${n.slice(8)}`}}var yv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Sv(n,u,b){let W=1,z=b;while(W<n.length){let B=Kn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let Q=Kn(n,W+1);z=Q?_i(z,Q,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=_i(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=_i(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(yv.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var Cv=new Set(["-i","-0","--null"]),bv=new Set(["-u","--unset","-C","--chdir","-P"]);function Ev(n,u,b,W){let z=new Map,B=[],Q=u,ee=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:Q,envSplitValues:B.length>0?B:void 0});while(ee<n.length){let ue=Kn(n,ee);if(!ue)break;if(ue==="--")return le(ee+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let Oe of b.keys())z.set(Oe,"");z.set("TMPDIR",""),ee++;continue}if(Cv.has(ue)){ee++;continue}if(ue==="-u"||ue==="--unset"){let Oe=Kn(n,ee+1);if(Oe!==void 0)z.set(Oe,"");ee+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),ee++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),ee++;continue}let ve=ue==="-S"||ue==="--split-string"?{value:Kn(n,ee+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(ve){if(ve.value!==void 0)B.push(ve.value);return Q=null,le(ee+ve.consumed)}if(bv.has(ue)){if(ue==="-C"||ue==="--chdir"){let Oe=Kn(n,ee+1);Q=Oe?_i(Q,Oe,W.paths):null}ee+=2;continue}if(ue.startsWith("-u=")){ee++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let Oe=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);Q=_i(Q,Oe,W.paths),ee++;continue}if(ue.startsWith("-P")){ee++;continue}if(ue.startsWith("-")){ee++;continue}if(!In(ue))break;while(ee<n.length){let Oe=In(Kn(n,ee)??"");if(!Oe)break;z.set(Oe.name,Oe.value),ee++}if(Kn(n,ee)==="--")ee++;return le(ee)}return le(ee)}function _i(n,u,b){if(u==="")return null;if(!n&&!yf(u))return null;let W=yf(u)?fv(u).root:b.realpath(n??"/");if(W===null)return null;try{return Tr(W,u,b)}catch{return null}}function vv(n){if(Kn(n,1)==="-v")return[...tn(["type"]),...n.slice(2)];let u=1;while(u<n.length){let b=Kn(n,u);if(!b)break;if(b==="-p"||b==="-v"||b==="-V"){u++;continue}if(b==="--")return n.slice(u+1);if(b.startsWith("-")&&!b.startsWith("--")&&b.length>1){if(!/^[pvV]+$/.test(b.slice(1)))break;u++;continue}break}return n.slice(u)}var Rv=/['"\\$`{}#]/;function Yr(n,u){if(n.some((W)=>Rv.test(W)))return null;let b=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return b.length<=64?b:null}function or(n,u,b){return Zr(n,u,b).tokens}function wv(n){let u=[],b="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((Q)=>Q.replace(/["']/g,"")).filter((Q)=>Q.length>0);b+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(b.length>0)u.push(b);b="",W++;continue}b+=z,W++}if(b.length>0)u.push(b);return u}function Ir(n,u,b,W=0){let z=Zr(n,u,b),B=(z.envSplitValues??[]).flatMap(wv);if(B.length===0)return z.tokens;let Q=[...B,...z.tokens];if(W>=8)return Q;return Ir(Q,u,b,W+1)}function Zr(n,u,b,W){if(!bf(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:b};let z=gr(tn(n),u,b,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var ic=Symbol("adopt-as-operand"),_v=new Set(["env","sudo","command","builtin"]),xv=new Set(["&&","||","|&","|","&",";"]),Av=new Set(["<<","<<<",">|"]),Ef=new Set(["|","|&"]),Pv=/[*@#?$!_-]/,Tv=/^\w+(?::\w+)*/,Iv=Object.freeze([]),xi=Object.freeze({kind:"scope",edge:"enter"}),Ai=Object.freeze({kind:"scope",edge:"exit"}),kv=Object.freeze([]),Ov=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Pi=new Set(["bash","sh","zsh","dash","ksh"]),Mv=256,xf=new WeakMap;function Af(n,u){let b=u.status==="complete"?new Set(oc(u)):new Set,W=Lv(n,b);if(u.dialect==="powershell"?u.issues.some((le)=>le.code.includes("quote")):ds(W))return Bs("unclosed-quote",W,u);let B={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},Q=Xr(u,{source:W,suppressed:b,flags:B,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(B.limited)return Bs("structural-limit",W,u);if(B.invalid)return Bs("invalid",W,u);let ee=Bs("complete",W,u,B.assignmentFallbacks);return xf.set(ee,Object.freeze(Q)),ee}function Vs(n,u,b,W,z){let B=z.word??((Ne)=>Ne),Q={cwd:u,variables:new Map,previous:null},ee=[],le=new Set,ue=null,ve=[],Oe=Pf(n),De=Oe.findLastIndex((Ne)=>Ne.kind==="operator"&&Ef.has(Ne.operator)),Me=De!==-1&&Oe.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of Oe.entries()){let We=Me||Ne<=De;if(Le.kind==="scope"){if(Le.edge==="enter"){ve.push({state:Q,segment:[...ee],shellWords:new Set(le),pipeProducer:ue});continue}let Be=z.segment(ee,Q,ue,null,le,We);if(Be)return Be;let ze=ve.pop();if(ze===void 0)throw Error("scope exit without a matching enter");Q=ze.state,ee=ze.segment,le=ze.shellWords,ue=ze.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let Be=z.segment(ee,Q,ue,Le.operator,le,We);if(Be)return Be;Q=Dv(ee,Q,b,W),ue=ee.length>0&&Ef.has(Le.operator)?ee:null,ee=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(ee.length-1);if(Le.target===void 0)continue;let Be=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},Q,We);if(Be===ic){le.add(ee.length),ee.push(B(Le.target));continue}if(Be)return Be;continue}ee.push(B(Le.text))}return z.segment(ee,Q,ue,null,le,Me)}function qs(n){return Pf(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function kn(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(b,W,z,B)=>{let Q=u.get(W);if(Q===void 0)return b;let ee=z.startsWith(":")?Q!=="":!0;if(z.endsWith("-"))return ee?Q:kn(B,u);return ee?kn(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(b,W)=>u.get(W)??b).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(b,W)=>u.get(W)??b)}function Ti(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function Dv(n,u,b,W){let z=Ti(n)?new Map([...u.variables,...Nv(n,u.variables)]):u.variables,B=or([...n],b),Q=Wt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!Q)return{...u,variables:z};if(Q==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:bn(kn(Q,z),u.cwd,b,W),variables:z,previous:u.cwd}}function Nv(n,u){return n.flatMap((b)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(b),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],kn(z,u)]]:[]})}function Pf(n){return xf.get(n)??Iv}function Lv(n,u){return[...u].reduce((b,W)=>b.slice(0,W.start)+" ".repeat(W.end-W.start)+b.slice(W.end),n)}function Bs(n,u,b,W=kv){return Object.freeze({status:n,source:u,program:b,assignmentFallbacks:Object.freeze(W)})}function Xr(n,u){return n.nodes.flatMap((b,W)=>Wv(b,n,W,u)).sort((b,W)=>b.start-W.start).flatMap((b)=>[...b.events])}function Wv(n,u,b,W){if(n.kind==="connector")return[{start:n.span.start,events:[Yn(Uv(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Yn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",Q=W.source[n.span.end-1]===(B?"}":")"),ee=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[Us("{"),...Xr(n.body,ee),...Q?[Us("}")]:[]]:[xi,Yn("("),...Xr(n.body,ee),...Q?[Yn(")")]:[],Ai]}]}let z=qv(n,W.functions);if(z){if(W.depth>=xr.maxDepth||++W.flags.expansions>Mv)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...vf(n,W),Us(";"),...Xr(z,{...W,depth:W.depth+1}),Us(";")]},...Rf(n,u,b,W)]}return[{start:n.span.start,events:vf(n,W)},...Rf(n,u,b,W)]}function vf(n,u){return[...n.words.map((b)=>({start:b.span.start,events:If(b,n,u,!1)})),...n.redirections.map((b)=>({start:b.span.start,events:Fv(b,n,u)}))].sort((b,W)=>b.start-W.start).flatMap((b)=>b.events)}function Fv(n,u,b){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?If(n.target,u,b,!0):[],B=z[0],Q=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[js(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:Hv(W),targetOrder:Av.has(W)?"legacy-segment":"immediate",...Q===void 0?{}:{target:Q},...n.heredoc&&b.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:Of(u)}:{}}),...Q===void 0?z:z.slice(1)]}function Rf(n,u,b,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let Q=B.heredoc;if(!Q)return[];let ee=[js(Q.delimiter),.../[\r\n]/.test(W.source[Q.terminatorSpan.end]??"")?[Yn(";")]:[]];if(W.suppressed.has(Q.bodySpan))return[{start:Q.bodySpan.start,events:ee}];return[{start:Q.bodySpan.start,events:[...Tf(W.source.slice(Q.bodySpan.start,Q.bodySpan.end),W),...ee]}]}),...z.some((B)=>!B.heredoc&&B.target)?Gv(u,b,W):[]]}function Gv(n,u,b){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:Tf(b.source.slice(W.span.end,n.span.end),b)}]}function Tf(n,u){if(u.depth>=xr.maxDepth)return u.flags.limited=!0,[];let b=C(n,"posix");if(b.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Xr(b,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function If(n,u,b,W){let z=b.powershell?Ro(n.raw,0):null;if(z&&n.provenance==="literal")return[js(n.text)];let B=[],Q={single:!1,double:z!==null},ee="",le=!1,ue=()=>{let ve=le&&!W?Yn("glob"):ee!==""||n.quoted&&B.length===0?js(ee):void 0;if(ve)B.push(ve);ee="",le=!1};for(let ve of z?zv(n,z.bodyStart):n.parts){if(ve.provenance!=="command-substitution"&&ve.provenance!=="arithmetic"){for(let Ne of rc(ve.raw,Q,b.flags,b.powershell)){if(typeof Ne==="string"){ue(),B.push(Yn(Ne));continue}ee+=Ne.text,le||=Ne.glob}continue}let Oe=u.nested.find((Ne)=>Ne.span.start>=ve.span.start&&Ne.span.end<=ve.span.end);if(Q.double){let Ne=b.source.slice(ve.span.start,ve.span.end);ee+=rc(Ne,{single:!1,double:!0},b.flags,b.powershell).map((We)=>typeof We==="string"?We:We.text).join("");let Le=Oe?Xr(Oe,b).filter((We)=>We.kind==="redirection"&&We.body!==void 0):[];if(Le.length>0)B.push(xi,...Le,Ai);continue}let De=Oe?Xr(Oe,b):[];if(ve.raw.startsWith("`")){ee+="${}",ue(),B.push(xi,...De,Ai);continue}if(ve.raw.startsWith("<(")||ve.raw.startsWith(">(")){ue(),B.push(ve.raw.startsWith("<(")?Yn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),xi,...De,...ve.raw.endsWith(")")?[Yn(")")]:[],Ai);continue}let Me=ve.raw.startsWith("$((")?2:1;ee+="${}",ue(),B.push(...Array.from({length:Me},()=>Yn("(")),...Me===1?[xi]:[],...De,...ve.raw.endsWith(")".repeat(Me))?Array.from({length:Me},()=>Yn(")")):[],...Me===1?[Ai]:[])}return ue(),B}function zv(n,u){let b=n.raw.length-(/(?:\r\n|[\r\n])"@$/.exec(n.raw)?.[0].length??0);return n.parts.flatMap((W)=>{if(W.provenance==="command-substitution")return[W];let z=n.raw.slice(Math.max(W.span.start-n.span.start,u),Math.min(W.span.end-n.span.start,b));return z===""?[]:[{...W,raw:z.replace(/["']/g,"`$&")}]})}function rc(n,u,b,W){let z=[],B="",Q=!1,ee=0;while(ee<n.length){let le=n[ee]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:Q},le),B="",Q=!1,ee++;continue}if(W&&le==="`"&&!u.single){B+=n[ee+1]??"",ee+=2;continue}if(u.single&&le==="'"){u.single=!1,ee++;continue}if(u.single){B+=le,ee++;continue}if(u.double){if(le==='"'){u.double=!1,ee++;continue}if(!W&&le==="\\"){let ue=n[ee+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,ee+=2;continue}if(le==="$"){let ue=wf(n,ee,u,b,W);B+=ue.text,ee=ue.next;continue}B+=le,ee++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',ee++;continue}if(!W&&le==="\\"){let ue=n[ee+1]??"";Q||=ue==="*"||ue==="?",B+=ue,ee+=2;continue}if(le==="$"){let ue=wf(n,ee,u,b,W);B+=ue.text,ee=ue.next;continue}Q||=le==="*"||le==="?",B+=le,ee++}return[...z,{text:B,glob:Q}]}function wf(n,u,b,W,z){let B=n[u+1];if(B==="{"){let ee=z?Bv(n,u+2):Ms(n,u+2,n.length).close;if(ee===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,ee+1);return $v(le,b,W,z),{text:le,next:ee+1}}if(B!==void 0&&Pv.test(B))return{text:`\${${B}}`,next:u+2};let Q=(z?Tv:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${Q}}`,next:u+1+Q.length}}function $v(n,u,b,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let Q=z.slice(B.length),ee=[":=","="].find((ue)=>Q.startsWith(ue));if(!ee)return;let le=rc(Q.slice(ee.length),{...u},b,W);b.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function Bv(n,u){let b=1,W=u;while(b>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")b++;if(n[W]==="}")b--;W++}return b===0?W-1:-1}function Uv(n){return/^[\r\n]+$/.test(n)?";":n}function Yn(n){return Object.freeze({kind:"operator",operator:n,boundary:xv.has(n)})}function Us(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function js(n){return Object.freeze({kind:"word",text:n})}function Hv(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function Oo(n){return Ov.has(n)||/^python\d/.test(n)}var jv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function kf(n,u){let b=u[0];if(b===void 0||!b.startsWith("-"))return u;let W=jv.get(n)?.has(b)??!1;return kf(n,u.slice(W?2:1))}function Hs(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return Hs(n.slice(1));if(u==="uv"&&n[1]==="run")return Hs(n.slice(2));if(!_v.has(u))return[...n];return Hs(kf(u,n.slice(1)))}function Of(n){let u=hi(n),b=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return Hs(b<0?[]:n.words.slice(b).map((W)=>W.text))}function Vv(n){let u=Of(n)[0];if(u===void 0)return!1;let b=Wt(u).toLowerCase();return Oo(b)&&!Pi.has(b)}function oc(n){return n.nodes.flatMap((u,b)=>{if(u.kind==="group"||u.kind==="function")return oc(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((ee)=>oc(ee)),z=u.redirections.flatMap((ee)=>ee.heredoc?.quotedDelimiter?[ee.heredoc.bodySpan]:[]);if(Vv(u))return[...W,...z];let B=n.nodes[b+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!Yv(u))return W;return[...W,...z]})}function qv(n,u){let b=hi(n);return b===void 0?void 0:u.get(b)}function kr(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function Kv(n){if(kr(n.words[0],"git"))return kr(n.words[1],"commit");if(!kr(n.words[0],"gh")||!kr(n.words[2],"create"))return!1;return kr(n.words[1],"pr")||kr(n.words[1],"issue")}function Yv(n){return(kr(n.words[0],"cat")||kr(n.words[0],"tee")||Kv(n))&&!n.words.some(_f)&&!n.redirections.some((b)=>_f(b.target))}function _f(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var ir="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Ks="Unsupported heredoc syntax",Qr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function sr(){return{id:"analysis.dynamic-shell-source",reason:Qr,intent:"stop_and_explain"}}var Mf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var sc=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Zv=new Set([...sc,"dir_path","glob","glob_pattern","include_pattern"]),Xv=new Set([...sc,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(ir)}}function Df(n){let u=Qv(),b=ye(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&b)W.push({usage:"input-candidate",source:b});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,Q)=>{let ee=B.findIndex((ve)=>ve.source===Q.source);if(ee!==-1){let ve=B[ee];if(!ve)return B;return B[ee]={...ve,usages:[...ve.usages,Q.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(Q.source,le);return B.push({usages:[Q.usage],source:Q.source,program:ue,shell:u.getShellSyntax(Q.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:Jv(n),store:u}}function Mo(n,u){return n.commands.find((b)=>b.usages.includes(u))}function hr(n){return Mo(n,"declared-command")??Mo(n,"input-candidate")}function yr(n,u){if(!n.includes("$"))return n;return Ha(n,u)}function Qv(){let n=new Map,u=new WeakMap,b=(z,B)=>{let Q=`${B}\x00${z}`,ee=n.get(Q);if(ee)return ee;let le=C(z,B);return n.set(Q,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let Q=B??b(z,"posix"),ee=u.get(Q);if(ee)return ee;let le=Q.status==="limited"?{status:"structural-limit",source:z,program:Q,assignmentFallbacks:[]}:Af(z,Q);return u.set(Q,le),le},getCommandProgram:b,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function Jv(n){let u=n.route.kind==="grep"?Zv:n.route.kind==="glob"?Xv:sc;return[...Du(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?Wu(n.input):[]]}var eR=new Set(["-S","--suffix"]);function Do(n,u,b,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return Vs(n,u,b,W,{segment:(B,Q)=>z.findSegmentTarget(B,Q),redirection:(B,Q)=>B.role==="file-write"&&z.isRedirectionTarget(kn(B.target,Q.variables),Q)?B.target:null})}function Ys(n){let u=[],b=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){b=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){b=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){b=B.slice(2);continue}if(!W&&eR.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return b?{sources:u,destination:b}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Ff(n,u,b,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(fs(n.invocation.toolName))return null;let ee=n.paths.find((le)=>Nf(le,z,u,b,W,u.entries));return ee?{target:ee}:null}if(n.invocation.route.kind!=="command")return null;let B=hr(n);if(!B)return null;let Q=Do(B.shell,z,b,W,{findSegmentTarget:(ee,le)=>dR(ee,le,u,b,W),isRedirectionTarget:(ee,le)=>Nf(ee,le.cwd,u,b,W,u.markerFiles),findMalformedTarget:()=>null});return Q?{target:Q}:null}function Jr(n,u,b,W,z,B,Q=!1){if(!b)return!1;let ee=Xs(bn(n,u,z,B)),le=ee.replace(/(\/\.?\*+)+$/,"");if(le!==ee&&le!==""){if(ac(le,b))return!0;let ue=Q||ee.slice(le.length).includes("/."),ve=(Oe)=>ue?Zs(Oe,le):iR(Oe,le);if(b.markerFiles.some(ve))return!0;return W&&lc(b).some(ve)}if(ac(ee,b))return!0;return W&&lc(b).some((ue)=>Zs(ue,ee))}function iR(n,u){let b=Wf(u,n);if(b===""||b.startsWith("..")||Lf(b))return!1;return!b.split(/[\\/]/)[0]?.startsWith(".")}function sR(n,u,b,W,z){return Jr(n,u,b,!0,W,z)}function aR(n,u,b,W,z){if(!b)return!1;return ac(Xs(bn(n,u,W,z)),b)}function Nf(n,u,b,W,z,B){let Q=Xs(bn(n,u,W,z));return B.includes(Q)||zf(Q,b)}function Gf(n,u,b,W,z){if(!b)return!1;return b.hooksDirectories.some((B)=>n.some((Q)=>Zs(B,Xs(bn(Q,u,W,z)))))}function ac(n,u){return u.entries.includes(n)||u.directories.includes(n)||zf(n,u)}function zf(n,u){return u.hooksDirectories.some((b)=>Zs(n,b))}var lR=50000;function $f(n,u){let b=[...new Set(lc(n))];if(b.some((z)=>u(rR(z))))return!0;let W=0;while(b.length>0){let z=b.pop()??"",B=cR(z);if(!B)return!0;if(W+=B.length,W>lR)return!0;if(B.some((Q)=>u(Q.name)))return!0;b.push(...B.filter((Q)=>Q.isDirectory()).map((Q)=>oR(z,Q.name)))}return!1}function cR(n){try{let u=tR(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return nR(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function lc(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function Zs(n,u){let b=Wf(u,n);return b===""||!/^\.\.(?:[\\/]|$)/.test(b)&&!Lf(b)}function Xs(n){return process.platform==="win32"?n.toLowerCase():n}function dR(n,u,b,W,z){if(Ti(n))return null;let B=Ir([...n],W);if(Wt(B[0]??"").toLowerCase()!=="mv")return null;let Q=Ys(B.slice(1)),ee=Q.sources.find((le)=>sR(kn(le,u.variables),u.cwd,b,W,z));if(ee)return ee;return Q.destination&&aR(kn(Q.destination,u.variables),u.cwd,b,W,z)?Q.destination:null}var fR=process.platform==="win32",Bf=64,pR=16384;function uc(n,u,b,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!un(b,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!un(b,z.id,u.paranoid))return null;return st(z.id,z.reason)}function No(n,u,b,W,z={}){return gR(n,u,z).map((B)=>Gt(uc(B,u,b,W),b)).find((B)=>B!==null)??null}function gR(n,u,b){let W=ar(n,u,b);if(W.kind==="cwd_self_target")return[W,ar(n,u,{...b,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=ar(n,u,{...b,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,ar(n,u,{...b,skipHomeCwd:!0,skipCwdSelf:!0})]}function to(n){let u=Am(n,Bf,Bf,pR);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:hR(n)}}function hR(n){let u=n.parts.filter((b)=>b.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(b.raw));return u.length>0&&u.every((b)=>yR(n.raw,b.span.start-n.span.start))}function yR(n,u){let b=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&b!=="'"){W=!0;continue}if(b===B){b=null;continue}if(b===null&&(B==="'"||B==='"'))b=B}return b==='"'}function Hn(n){let u=n.environment.home,b=n.environment.paths,W=n.budget??xn();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:wR(n.allowPaths,u,b,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function ar(n,u,b={}){let W=b.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!b.tmpdirWordSplittingProtected&&xR(n))return{kind:"outside_anchored_cwd"};let z=!W&&jf(n,u.posixShell);if(dr(n))return{kind:"outside_anchored_cwd"};if(Ii(n,W))return{kind:"root_or_home_target"};if(bR(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Jr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(ER(n,u.trustTmpdirVar,u.posixShell,z,W,b.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z){let Q=u.resolvedCwd??u.anchoredCwd;return!b.skipHomeCwd&&Q!==null&&Uf(Q,u.environment.home,u.environment.paths,u.budget)?{kind:"home_cwd_target"}:{kind:"dynamic_target"}}if(_R(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!b.skipHomeCwd&&[B,u.resolvedCwd??B].some((Q)=>Uf(Q,u.environment.home,u.environment.paths,u.budget)))return{kind:"home_cwd_target"};if(!b.skipCwdSelf&&[u.resolvedCwd??B,B].some((Q)=>IR(n,u.resolvedCwd??B,u.environment.paths,u.budget,Q)))return{kind:"cwd_self_target"};if(kR(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(SR(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function SR(n,u,b){let W=n.trim();if(b||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if(Qs(W)||W.startsWith("~"))return!1;if(mc(W))return!1;if(Vf(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return Io(eo(u.resolvedCwd,W),u.environment)}function CR(n,u,b={}){let{containmentTarget:W,...z}=b;if(ar(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(RR(B))return!1;if(Gs(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((Q)=>Vf(W??B,Q,u.environment.paths,u.budget))}function Ii(n,u=!1){let b=n.trim(),W=Hf.normalize(b),z=b.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((Q)=>/^\*+$/.test(Q)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function bR(n,u,b){let W=n.trim(),z=b?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=Qs(z)?z:u.resolvedCwd?eo(u.resolvedCwd,z):null;if(!B)return!1;let Q=On(jt(B,u.environment.paths,u.budget));if(Q===mR(Q).root)return!0;return Q===On(jt(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function On(n){let u=uR(n);if(fR){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function ER(n,u,b,W,z,B,Q,ee){let le=n.trim();if(mc(le))return!1;if(!W&&Io(le,ee))return!0;return(u||B&&Q)&&b&&!z&&vR(le,b)}function vR(n,u){return["$TMPDIR","${TMPDIR}"].some((b)=>{if(n===b)return!0;if(!n.startsWith(`${b}/`))return!1;return!jf(n.slice(b.length+1),u)})}function RR(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return Hf.normalize(`/${u[1]??""}`)==="/"}function mc(n){return n.split(/[\\/]+/).includes("..")}function wR(n,u,b,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=mi(z.trim(),u);if(!Qs(B))return[];try{let Q=jt(B,b,W);if(fi(Q,jt(u,b,W)))return[];return[On(Q)]}catch{return[]}})}function _R(n,u,b){if(u.allowRoots.length===0)return!1;let W=n.trim();if(mc(W))return!1;let z=b?W:mi(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,Q=Qs(z)?z:B?eo(B,z):null;if(!Q)return!1;try{let ee=On(jt(Q,u.environment.paths,u.budget));return u.allowRoots.some((le)=>ee===le||ee.startsWith(le.endsWith(dc)?le:`${le}${dc}`))}catch{return!1}}function xR(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function jf(n,u=!1){return n.includes("$")||n.includes("`")||AR(n)||u&&PR(n)}function AR(n){let u=!1;for(let b of n){if(u){u=!1;continue}if(b==="\\"){u=!0;continue}if(b==="*"||b==="?"||b==="[")return!0}return!1}function PR(n){let u=!1;for(let b=0;b<n.length;b++){let W=n[b];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&TR(n,b)||(W==="+"||W==="@"||W==="!")&&n[b+1]==="(")return!0}return!1}function TR(n,u){let b=n.indexOf("}",u+1);if(b===-1)return!1;let W=n.slice(u+1,b);return W.includes(",")||W.includes("..")}function Uf(n,u,b,W){try{return On(jt(n,b,W))===On(jt(u,b,W))}catch{try{return On(n)===On(u)}catch{return!1}}}function IR(n,u,b,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return On(jt(eo(u,n),b,W))===On(jt(z,b,W))}catch{try{return On(eo(u,n))===On(z)}catch{return!1}}}function kR(n,u,b,W,z,B,Q){let ee=b??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return cc(n,u,B,Q)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return cc(eo(ee,n),u,B,Q)}catch{return!1}if(n.startsWith("../"))return!1;try{return cc(eo(ee,n),u,B,Q)}catch{return!1}}function cc(n,u,b,W){try{return qf(jt(n,b,W),jt(u,b,W))}catch{return!1}}function Vf(n,u,b,W){if(!u)return!1;try{return qf(jt(u,b,W),jt(n,b,W))}catch{return!0}}function qf(n,u){let b=On(n),W=On(u);return b.startsWith(`${W}${dc}`)||b===W}function Js(n,u){let b=u.envAssignments??new Map,W=ec(b,u.environment),z=u.trustedTmpdirValue??To(b,u.environment),B=u.allowTmpdirVar??!wi(b,u.environment),Q={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??Kr(b,u.environment),trustedTmpdirValue:z,budget:u.budget},ee=Hn(Q),le=Hn({...Q,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),ve=u.cwd&&u.environment.paths.realpath(u.cwd),Oe=ue&&ve&&!Pr(ve,ue)?u.cwd:void 0;return n.every((De)=>{let Me=to(De);if(Me.unsafeBraceExpansion||Me.expandedTargets?.length===0)return!1;return(Me.expandedTargets??[t(De)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?Oe:void 0,We=Le??Ne,Be={targetIsLiteral:Me.expandedTargets!==void 0||Me.targetIsLiteral,tmpdirWordSplittingProtected:Me.tmpdirWordSplittingProtected};if(!un(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&ar(We,ee,Be).kind==="within_anchored_cwd")return!0;return CR(We,Le?le:ee,{...Be,containmentTarget:OR(We,W)})})})}function OR(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var Lo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ki="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",pc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),MR=new Set(["-p","--print"]),DR=new Map([["node",new Set(["-c","--check"])],["ruby",new Set(["-c"])]]),NR=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),LR=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),WR=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),FR=new Map([["python",new Set(["m"])]]),GR=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),zR=new Set(["always","default","never"]),$R=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),BR=/\\\r?\n/g,Kf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,UR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${Kf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${Kf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],HR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Yf(n){return ta(n).code}function ea(n){return ta(n).sources}function Zf(n){return HR.get(na(n))??[]}function ta(n){let u=na(n[0]??"");if(!pc.has(u))return{code:null,sources:[],optionsOpen:!1};let b=[],W=[],z=!0;for(let B=1;B<n.length;B++){let Q=n[B];if(Q===void 0)break;if(Q==="--")return Zn(u,b,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(Q===""||Q==="-"||!Q.startsWith("-"))return Zn(u,b,W,z,B,Q);if(u==="node"&&MR.has(Q)){let Oe=n[B+1];if(Oe===void 0)return Zn(u,b,W,z);if(Oe.startsWith("-"))continue;b.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),B++;continue}if(VR(u,Q)){let Oe=n[B+1];if(Oe===void 0)return Zn(u,b,W,z);if(b.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),u==="python")return Zn(u,b,W,z);B++;continue}let ee=/^--eval=(.*)$/s.exec(Q);if(qR(u)&&ee){let Oe=ee[1]??"";b.push({tokenIndex:B,value:Oe}),W.push({tokenIndex:B,kind:"inline-code",value:Oe});continue}if(u==="node"){let Oe=jR(Q);if(Oe){if(Oe.attached){if(z&&=Oe.value!=="",Oe.value!=="")W.push({tokenIndex:B,kind:"module-file",value:Oe.value});continue}let De=n[B+1];if(De===void 0||De.startsWith("-"))return z=!1,Zn(u,b,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:De}),B++;continue}}if(u==="python"&&Q.startsWith("--check-hash-based-pycs=")||u==="node"&&(Q==="--conditions="||Q==="--diagnostic-dir="||Q==="--title=")||u==="ruby"&&(Q==="--disable="||Q==="--enable="))return Zn(u,b,W,z);if(GR.get(u)?.has(Q)){let Oe=n[B+1];if(Oe===void 0||Oe.startsWith("-")&&!(u==="ruby"&&$R.has(Q))||u==="python"&&!zR.has(Oe))return Zn(u,b,W,z);B++;continue}if(Q.startsWith("--"))continue;let le,ue=!1;for(let Oe=1;Oe<Q.length;Oe++){let De=Q[Oe];if(De===void 0)break;if(FR.get(u)?.has(De)){let Me=Q.slice(Oe+1),Ne=Me||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});return Zn(u,b,W,z)}if(NR.get(u)?.has(De)){le=Q.slice(Oe+1)||n[B+1],ue=Oe+1===Q.length;break}if(u==="node"&&De==="r"){if(z&&=Q==="-r",Q==="-r"){let Me=n[B+1];if(z&&=Me!==void 0&&!Me.startsWith("-"),z&&Me!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Me});B++}break}if(u==="ruby"&&De==="r"){let Me=Q.slice(Oe+1),Ne=Me||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});if(!Me)B++;break}if(u==="perl"&&(De==="M"||De==="m")){let Me=Q.slice(Oe+1);if(!Me){if(z=!1,Oe+1===Q.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Me});break}if(LR.get(u)?.has(De)){if(Oe+1===Q.length)B++;break}if(WR.get(u)?.has(De)&&Oe+1<Q.length)break}if(le===void 0)continue;let ve=ue?B+1:B;if(b.push({tokenIndex:ve,value:le}),W.push({tokenIndex:ve,kind:"inline-code",value:le}),u==="python")return Zn(u,b,W,z);if(ue)B++}return Zn(u,b,W,z,void 0,void 0,!0)}function Zn(n,u,b,W,z,B,Q=!1){let ee=n==="node"?u.slice(-1):u,le=new Set(ee.map((ve)=>ve.tokenIndex)),ue=b.filter((ve)=>ve.kind!=="inline-code"||le.has(ve.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?ee[0]?.value:ee.map((ve)=>ve.value).join(`
-`))||null,sources:W?ue:[],optionsOpen:W&&Q}}function jR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function gc(n){let u=DR.get(na(n[0]??"")),b=n.findIndex((W,z)=>z>0&&(W==="-"||!W.startsWith("-")));return u!==void 0&&n.slice(1,b===-1?void 0:b).some((W)=>u.has(W))}function hc(n,u){return na(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function na(n){let u=Wt(n).toLowerCase();return as.test(u)?"python":u}function VR(n,u){return pc.get(n)?.has(u)??!1}function qR(n){return pc.get(n)?.has("--eval")??!1}function Oi(n,u,b=!1){let W=ZR(n,u);if(Tn(u,W),UR.some((Q)=>Array.from(W.matchAll(Q)).some((ee)=>ee.groups?.literal===void 0||Ii(ee.groups.literal,!0))))return!0;if(!fc(W,u))return!1;Tn(u,W);let B=YR(W);if(fc(B,u))return!0;if(Tn(u,B),!Xf.test(B))return!1;return!b||KR(W,u)}function KR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let ve=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,Oe=le+ve.length,De=Oe;while(De<n.length&&!n.startsWith(ve,De))De+=n[De]==="\\"?2:1;if(De>=n.length)return!0;z.push({start:Oe,text:n.slice(Oe,De)}),W.fill(" ",le,De+ve.length),le=De+ve.length-1}let B=W.join(""),Q=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>Xf.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:ra(B,ue)}});if(Q.some((le)=>yc(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),ve=Q.some((Oe)=>le.start>=Oe.start&&le.start<Oe.end);return(ue||ve)&&fc(le.text,u)})}function ra(n,u){let b=1;for(let W=u;W<n.length;W++){if(n[W]==="(")b++;if(n[W]===")")b--;if(b===0)return W}return n.length}function yc(n,u){let b=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))b++;if(")]}".includes(z)&&b--===0)return!1;if(z===","&&b===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var Xf=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function YR(n){let u=[],b=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,Q=W+B.length;while(Q<n.length&&!n.startsWith(B,Q))Q+=n[Q]==="\\"?2:1;if(Q>=n.length)break;u.push(n.slice(b,W)," "),W=Q+B.length,b=W}return u.push(n.slice(b)),u.join("")}function fc(n,u){if(Ds(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Tn(u,n),W.test(n))return!0;if(Ds(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Tn(u,n),W.test(n))return!0;if(Ds(n,"find",u))return!0;let b=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(Tn(u,n),b.some((z)=>Ns(z,W))))}function ZR(n,u){return Tn(u,n),n.replace(BR,"")}var XR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Qf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QR="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Jf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",ep="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",JR="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",ew="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",tw={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:ep},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Jf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:JR},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Qf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:QR},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Qf}};function tp(n,u,b){return nw(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,Hn({...b,allowPaths:b.policy?.destructiveCommandAllowPaths}),b.policy)}function nw(n,u,b,W){let z=n.filter((le)=>le.kind==="word"),B=ow(z),Q=z[B];if(!Q||!XR.has(fw(Q.text)))return null;let ee=rw(z.slice(B+1));if(ee.whatIfProtected)return null;if(un(W,"powershell.remove-item-pipeline-dynamic-target",b.strict)&&u&&(ee.targets.length===0||ee.recursive))return st("powershell.remove-item-pipeline-dynamic-target",ew);for(let le of ee.targets)if(!dr(le.text)&&Ii(Mi(le.text)))return st(ee.recursive&&ee.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",ep);for(let le of ee.targets)if(b.resolvedCwd&&Jr(Mi(le.text),b.resolvedCwd,b.protectedGitMetadata,ee.recursive,b.environment,b.budget,!0))return st("powershell.remove-item-git-metadata",y);if(!ee.recursive||!ee.force)return null;if(un(W,"powershell.remove-item-recursive-force-dynamic-target",b.strict)&&(ee.hasDynamicTarget||ee.targets.length===0))return st("powershell.remove-item-recursive-force-dynamic-target",Jf);for(let le of ee.targets){let ue=No(Mi(le.text),b,W,tw);if(ue)return ue}return null}function rw(n){let u=[],b=!1,W=!1,z=!1,B=!1,Q=!1;for(let ee=0;ee<n.length;ee++){let le=n[ee];if(!le||le.kind!=="word")continue;if(iw(le))continue;if(Q){u.push(Sc(le)),B=B||le.dynamic;continue}if(le.text==="--"){Q=!0;continue}let ue=aw(le.text);if(!ue){u.push(Sc(le)),B=B||le.dynamic;continue}if(lw(ue.name)){let ve=ue.value?sw(ue.value,le):n[++ee];if(ve?.kind==="word"){u.push(Sc(ve)),B=B||ve.dynamic;continue}B=!0;continue}if(cw(ue.name)){b=!0;continue}if(dw(ue.name)){W=!0;continue}if(uw(ue.name))z=mw(ue.value)}return{targets:u,recursive:b,force:W,whatIfProtected:z,hasDynamicTarget:B}}function ow(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function Sc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function iw(n){return n.kind==="word"&&n.text===","}function Mi(n){let u=n.replace(/\\/g,"/"),b=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return b?`$HOME${u.slice(b[0].length)}`:u}function sw(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function aw(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),b=u.indexOf(":");if(b===-1)return{name:u.toLowerCase()};return{name:u.slice(0,b).toLowerCase(),value:u.slice(b+1)}}function lw(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function cw(n){return"recurse".startsWith(n)}function dw(n){return n.length>=2&&"force".startsWith(n)}function uw(n){return n==="wi"||"whatif".startsWith(n)}function mw(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function fw(n){return n.toLowerCase()}import{sep as MP}from"node:path";var pw=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),gw=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),hw=new Set(["-o","--output","--query","--subscription"]),yw=new Set;function np(n){if(n==="aws")return pw;if(n==="gcloud")return gw;if(n==="az")return hw;return yw}var Sw=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Cw=new Set;function rp(n){if(n==="git")return Nn;if(n==="docker")return Sw;return Cw}function F(n,u){if(n.length===0||u.length===0)return null;let b=Bt(n[0]??""),W=An(n);for(let z of u){if(!vw(b,z.command))continue;if(z.match){if(bw(b,n,z.match))return op(z);continue}if(!Rw(b,n,z.subcommand))continue;if(_w(n,new Set(z.block_args),W))return op(z)}return null}function op(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function bw(n,u,b){let W=u.slice(1);if(b.exclude_args?.some((z)=>W.includes(z)))return!1;if(b.any_args&&!b.any_args.some((z)=>W.includes(z)))return!1;return Ew(W,b.command_path,np(n))}function Ew(n,u,b){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&b.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function vw(n,u){return n===Bt(u)}function Rw(n,u,b){if(!b)return!0;return ip(u,1,b,rp(n))}function ip(n,u,b,W){let z=!1;for(let B=u;B<n.length;B++){let Q=n[B];if(!Q)continue;if(z){z=!1;continue}if(Q==="--"){let ee=n[B+1];if(ee&&!ee.startsWith("-"))return ee===b;return!1}if(W.has(Q)){z=!0;continue}if(Q.startsWith("-")){if(!Q.includes("=")&&ww(n,B,b,W))return!0;continue}return Q===b}return!1}function ww(n,u,b,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return ip(n,u+2,b,W)}function _w(n,u,b){return n.some((W)=>u.has(W))||[...b].some((W)=>u.has(W))}var xw=new Set(["-e","--source"]),Aw=new Set(["-F","-v","--assign","--field-separator"]),sp=new Set(["-f","--file"]),Pw=new Set(["print","printf","return"]),ap=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Tw="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function lp(n,u,b){let W=!1;for(let z of Iw(n)){let B=kw(z,b);if(!B)continue;for(let Q of B.commands){let ee=u(Q);if(ee)return ee;if(Q.includes("{}")||/[$`]/.test(Q))W=!0}W||=B.dynamic}return W?st("awk.system-dynamic",Tw):null}function bc(n){let u=[],b=!1,W=!1,z=!0,B=!0;for(let Q=1;Q<n.length;Q++){let ee=n[Q];if(ee===void 0)break;if(z&&ee==="--"){z=!1;continue}if(z&&xw.has(ee)){b=!0;let le=n[Q+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:Q+1,kind:"inline-code",value:le});Q++;continue}if(z&&ee.startsWith("--source=")){b=!0,u.push({tokenIndex:Q,kind:"inline-code",value:ee.slice(9)});continue}if(z&&ee.startsWith("-e")&&ee.length>2){b=!0,u.push({tokenIndex:Q,kind:"inline-code",value:ee.slice(2)});continue}if(z&&(Aw.has(ee)||sp.has(ee))){let le=n[Q+1];if(B&&=le!==void 0,sp.has(ee)){if(W=!0,le!==void 0)u.push({tokenIndex:Q+1,kind:"program-file",value:le})}Q++;continue}if(z&&(ee.startsWith("-F")||ee.startsWith("-v")&&ee.slice(2).includes("=")))continue;if(z&&ee.startsWith("-f")&&ee.length>2){W=!0,u.push({tokenIndex:Q,kind:"program-file",value:ee.slice(2)});continue}if(z&&(ee.startsWith("--assign=")||ee.startsWith("--field-separator=")))continue;if(z&&ee.startsWith("--file=")){W=!0,u.push({tokenIndex:Q,kind:"program-file",value:ee.slice(7)});continue}if(z&&ee.startsWith("-")&&ee!=="-")continue;if(!b&&!W)u.push({tokenIndex:Q,kind:"main-program",value:ee});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function Ni(n){return bc(n).sources}function Iw(n){return Ni(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function kw(n,u){Tn(u,n);let b=n.includes("system")?Ec(n,u):null,W=Ow(n,u);if(!b&&!W)return null;return{dynamic:!!b?.dynamic||!!W?.dynamic,commands:[...b?.commands??[],...W?.commands??[]]}}function Ec(n,u){Tn(u,n);let b=[],W=!1,z=!1,B=0;while(B<n.length){let Q=n[B];if(Q==='"'||Q==="'"){B=ia(n,B,Q)?.endIndex??B+1;continue}if(Q==="#"){B=cp(n,B+1);continue}if(Q==="/"&&dp(n,B)){B=up(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let ee=B;if(B+=6,Di(n[ee-1])||Di(n[B]))continue;let le=oa(n,B);if(n[le]!=="(")continue;le=oa(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let ve=ia(n,le,ue);if(!ve){W=!0,z=!0;continue}if(le=oa(n,ve.endIndex),W=!0,n[le]!==")"){z=!0,B=ve.endIndex;continue}b.push(ve.value),B=le+1}if(!W)return null;return{dynamic:z,commands:b}}function Ow(n,u){Tn(u,n);let b=[],W=!1,z=!1,B=0,Q=0,ee=null,le=null,ue=0;while(B<n.length){let ve=n[B];if(!ve)break;if(ve==='"'||ve==="'"){let Me=ia(n,B,ve);if(Me&&ue===Q)le={...Me,startIndex:B};ue=Me?.endIndex??B+1,B=Me?.endIndex??B+1;continue}if(ve==="#"){B=cp(n,B+1),Q=B,ee=null,le=null,ue=B;continue}if(ve==="/"&&dp(n,B)){let Me=up(n,B+1);ue=Me??B+1,B=Me??B+1;continue}if(`;
-{}`.includes(ve)){B++,Q=B,ee=null,le=null,ue=B;continue}if(ee===null&&(Cc(n,B,"print")||Cc(n,B,"printf")))ee=B;if(ve!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(ve))ue=B+1;B++;continue}let Oe=n[B+1]==="&"?B+2:B+1,De=oa(n,Oe);if(Cc(n,De,"getline")){z=!0;let Me=Nw(Q,le,ue);if(W||=Me===null,Me!==null)b.push(Me);ue=Oe,B=Oe;continue}if(Ww(Q,ee)){z=!0;let Me=Dw(n,De);if(!Me){W=!0,ue=Oe,B=Oe;continue}if(!Mw(n,Me.endIndex)){W=!0,ue=Me.endIndex,B=Me.endIndex;continue}b.push(Me.value),ue=Me.endIndex,B=Me.endIndex;continue}ue=Oe,B++}if(!z)return null;return{dynamic:W,commands:b}}function Di(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function oa(n,u){let b=u;while(/\s/.test(n[b]??""))b++;return b}function Mw(n,u){let b=u;while(/[\t\f\v\r ]/.test(n[b]??""))b++;let W=n[b];return!W||`;
-}#`.includes(W)}function ia(n,u,b){let W="",z=!1;for(let B=u+1;B<n.length;B++){let Q=n[B];if(!Q)break;if(z){let ee=Lw(n,B);if(!ee)return null;W+=ee.value,B=ee.endIndex,z=!1;continue}if(Q==="\\"){z=!0;continue}if(Q===b)return{value:W,endIndex:B+1};W+=Q}return null}function Dw(n,u){let b=n[u];if(b!=='"'&&b!=="'")return null;return ia(n,u,b)}function Nw(n,u,b){if(!u)return null;return u.startIndex>=n&&u.endIndex===b?u.value:null}function Lw(n,u){let b=n[u];if(!b)return null;if(b==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(b)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[b]??b,endIndex:u}}function Cc(n,u,b){return n.startsWith(b,u)&&!Di(n[u-1])&&!Di(n[u+b.length])}function Ww(n,u){return u!==null&&u>=n}function cp(n,u){let b=n.indexOf(`
-`,u);return b===-1?n.length:b+1}function dp(n,u){let b=Fw(n,u);if(b===-1)return!0;if("{([,;!~=".includes(n[b]??""))return!0;let W=b;while(Di(n[W-1]))W--;return Pw.has(n.slice(W,b+1))}function Fw(n,u){for(let b=u-1;b>=0;b--)if(!/\s/.test(n[b]??""))return b;return-1}function up(n,u){let b=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(b){b=!1;continue}if(z==="\\"){b=!0;continue}if(z==="/")return W+1}return null}var Gw=new Set(["sudo","env","command","builtin"]),mp=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function fp(n){return mp.has(n)}function sa(n,u){let b=n[0];if(!b||!pp(Wt(b),u))return null;let W=Wt(b),z=n[1]==="--"?2:1,B=zw(n,z,W,u),Q=B[0];if(Q===void 0)return null;return{wrapper:W,tokens:n.slice(Q),childIndex:Q,alternativeChildIndices:B.slice(1)}}function zw(n,u,b,W){let z=n[1]==="--",B=[];for(let Q=u;Q<n.length;Q++){let ee=n[Q];if(!ee)continue;let le=Wt(ee)!==b&&$w(ee,W);if(le)B.push(Q);if(!le&&ls.has(Bt(ee)))break;if(z)break}return B}function $w(n,u){let b=Wt(n),W=Bt(n);return W==="git"||W==="unshare"||b==="busybox"||no(n)||sl.has(b)||Qm(W)||cs.has(W)||pp(b,u)||nn.has(W)||n==="$SHELL"||Ln(W)||Bn.has(W)||u.rules.some((z)=>z.command===b)}function pp(n,u){return mp.has(n)||u.transparentWrappers.includes(n)}function no(n){return Gw.has(n.toLowerCase())}function ro(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function Xn(n,u){let b=u.policy??{rules:[],transparentWrappers:[]};return aa([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),b,{iterations:0},!1)}function*aa(n,u,b,W,z,B,Q,ee,le){let ue=Zr(n,u,b,B);for(let[Me,Ne]of ue.envAssignments)B.set(Me,Ne),z.set(Me,Ne);let{tokens:ve,cwd:Oe}=ue;if(ue.envSplitValues){let Me=Yr(ue.envSplitValues,ve);if(!Me)throw new a("derivedCommandShape");vc(ee),yield*aa(Me,u,Oe,W,z,B,Q,ee,le);return}if(no(ve[0]??""))throw new a("wrapperPeelIterations");let De=sa(ve,Q);if(De){for(let Me of[De.childIndex,...De.alternativeChildIndices])vc(ee),yield*aa(Me===De.childIndex?De.tokens:ve.slice(Me),u,Oe,W,new Map(z),new Map(B),Q,ee,!0);return}if(Uw(ve)){vc(ee),yield*aa(ve.slice(1),u,Oe,W,z,B,Q,ee,le);return}yield Bw(ve,Oe,W,z,B,le)}function Bw(n,u,b,W,z,B){return{tokens:n,cwd:u===null?void 0:u??b,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:Wt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function vc(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function Uw(n){return Wt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function Rc(n,u){let b=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;b.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:b}}function Sr(n){let u=!1,b=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||wc(W,"recursive")){u=!0;continue}if(W==="-f"||wc(W,"force")){b=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))b=!0}}return u&&b}function la(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((b)=>wc(b,"recursive")||/^-[A-Za-z]+$/.test(b)&&/[rR]/.test(b.slice(1)))}function wc(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var Hw=["--init-file","--rcfile"],jw=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function jn(n){for(let u=1;u<n.length;u++){let b=n[u];if(!b)continue;if(b==="-c")return hp(n,u,!0);if(b.startsWith("-")&&b.includes("c")&&!b.startsWith("--")){let W=hp(n,u,!1);if(W!==null)return W}}return null}var gp=/^-[cn]+$/;function Qn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!gp.test(W)))return!1;let b=u.findIndex((W)=>!gp.test(W));return u.slice(0,b===-1?void 0:b).some((W)=>W.includes("n"))}var Vw=/^-[abcefhiklmnprstuvx]+$/;function ca(n){let u=n.findIndex((B,Q)=>Q>0&&!Vw.test(B)),b=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(b.some((B)=>B.startsWith("+")))return!0;let W=b.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=jn(n);if(z===null)return b.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function hp(n,u,b){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!b&&W.startsWith("-"))return null;return W}function yp(n){let u=Wt(n[0]??"").toLowerCase(),b=qw(n,u),W=jw.get(u)??null,z=b.argvSource?.kind!=="absent";return{argvSource:u==="bash"?b.argvSource:null,argvSourceApplies:u==="bash"&&b.interactive&&b.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!b.interactive:W==="ENV"&&b.interactive)}}function qw(n,u){let b=Pn(n),W=b.commandIndex??b.scriptIndex??n.length,z=[],B=!1,Q=!0;for(let ee=1;ee<W;ee++){let le=n[ee];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&Q?Hw.find((De)=>le===De):void 0){let De=n[ee+1];z.push(De===void 0?{kind:"absent"}:{kind:"literal",value:De}),ee++;continue}let Oe=le.split("=",1)[0]??le;if(u==="bash"&&ol.has(Oe)&&!le.includes("="))ee++;continue}if(u==="bash")Q=!1;let ue=il(u,le,n[ee+1],"startup");if(ue.interactive)B=le[0]==="-";ee+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var Kw="find -delete permanently removes files. Use -print first to preview.",Yw="find -exec rm -rf is dangerous. Use explicit file list instead.",Zw=new Set(["-exec","-execdir","-ok","-okdir"]),Xw=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function Sp(n,u){let b=n.map(t),W=Qw(n,b,u);if(W)return W;if(da(b,1)&&!o_(n,b,u)){let Q=Gt(st("find.delete",Kw),u.policy);if(Q)return Q}let z=u.budget??xn(),B=0;while(B<b.length){let Q=b[B],ee=Cr(Q??"");if(ee>0){B+=ee+1;continue}if(!lr(Q)){B++;continue}z.charge("derivedTokens",b.length-B-1);let le=Wo(b,B);B=le.nextIndex;let ue=i_(le.tokens,u.environment);if(ue){let Me=Gt(ue,u.policy);if(Me)return Me}let ve=Q==="-execdir"||Q==="-okdir",Oe=u.analyzeTokens?.(le.tokens,ve?null:u.cwd)??null,De=Oe?.id.startsWith("custom.")?Oe:Gt(Oe,u.policy);if(De)return De}return null}function Qw(n,u,b){if(!da(u,1)&&!_c(u,b.environment))return null;let z=Li(n)??tn(["."]),B=Hn({...b,allowPaths:b.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let Q of z){let ee=to(Q);for(let le of ee.expandedTargets??[t(Q)]){let ue=ar(le,B,{targetIsLiteral:ee.expandedTargets!==void 0||ee.targetIsLiteral,tmpdirWordSplittingProtected:ee.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return st("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!Jw(n,B.protectedGitMetadata,b.environment))return st("find.delete-git-metadata",y)}}if(r_(u)&&B.resolvedCwd&&Gf(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return st("find.delete-git-metadata",y);return null}function Jw(n,u,b){if(!u)return!1;let W=n.map(t),z=[],B=!1,Q=Li(n)?.at(-1),ee=Q?n.indexOf(Q)+1:1;while(ee<W.length){let le=W[ee]??"";if(lr(le)){let ue=Wo(W,ee),ve=Ir([...ue.tokens],b),Oe=la(ve),De=nn.has(Wt(ve[0]??"").toLowerCase()),Me=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&ve.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(Oe||De||Me||Ne)return!1;B=!0,ee=ue.nextIndex;continue}if(le==="-delete"){B=!0,ee++;continue}if(le==="-name"||le==="-iname"){let ue=n[ee+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(t_(ue.text,le==="-iname"));ee+=2;continue}if(!e_.has(le))return!1;ee+=1+Cr(le)}return z.length>0&&!$f(u,(le)=>z.every((ue)=>ue.test(le)))}var e_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function t_(n,u){let b=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${b}$`,u?"isu":"su")}var n_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function _c(n,u){let b=0;while(b<n.length){if(!lr(n[b])){b++;continue}let W=Wo(n,b),z=Ir([...W.tokens],u),B=Wt(z[0]??"").toLowerCase(),Q=nn.has(B)&&n_.test((jn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||Q)&&z.some((le)=>le.includes("{}")))return!0;b=W.nextIndex}return!1}function r_(n){return n.some((u,b)=>{if(!["-name","-iname"].includes(u))return!1;return n[b+1]?.toLowerCase()==="hooks"})}function o_(n,u,b){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=Li(n);return W!==null&&Js(W,b)}function Li(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},b=1;while(u(b)==="-H"||u(b)==="-P")b++;if(u(b)==="--")b++;let W=[];while(b<n.length){let z=u(b),B=n[b];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),b++}return W.length>0?W:null}function i_(n,u){let b=or([...n],u);if(b.length===0)return null;let W=Wt(b[0]??"");if(W==="busybox"&&b.length>1)b=b.slice(1),W=Wt(b[0]??"");if(W==="rm"&&Sr(b))return st("find.exec-rm-recursive-force",Yw);return null}function Wo(n,u){let b=u+1;while(b<n.length&&n[b]!==";"&&!(n[b]==="+"&&n[b-1]==="{}"))b++;return{tokens:n.slice(u+1,b),nextIndex:Math.min(b+1,n.length)}}function da(n,u){let b=u;while(b<n.length){let W=n[b];if(!W){b++;continue}if(lr(W)){b=Wo(n,b).nextIndex;continue}let z=Cr(W);if(z>0){b+=z+1;continue}if(W==="-delete")return!0;b++}return!1}function Cr(n){return Xw.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function lr(n){return n!==void 0&&Zw.has(n)}import{resolve as Lx}from"node:path";function*xc(n){for(let u of n.nodes)yield*s_(u)}function Ac(n){return[...xc(n)]}function Ft(n){return Ac(n).map((u)=>u.words.map((b)=>b.text))}function Wi(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let b=u.nodes[0];if(b?.kind!=="command")return null;if(b.redirections.length>0||b.nested.length>0)return null;if(b.words.some((W)=>W.provenance==="command-substitution"))return null;return b.words.map((W)=>W.text)}function*s_(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*xc(u);return}if(n.kind==="group")yield*xc(n.body)}var a_=5,Pc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function hn(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function bp(n,u,b){let W=Fo(n,u,b),z=l_(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,Q=!1;for(let ee=0;ee<a_;ee++){let{subcommand:le,rest:ue}=Fn(B),ve=le?.toLowerCase();if(!ve||!z.has(ve))return{blockedReason:W.blockedReason,expanded:Q,tokens:B};let Oe=z.get(ve),De=f_(Oe);if(De===null||De.length===0)return{blockedReason:Pc,expanded:!0,tokens:B};B=["git",...De,...ue],Q=!0}return{blockedReason:Pc,expanded:!0,tokens:B}}function Ep(n,u,b){return Fo(n,u,b).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function Fn(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?Wt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=Nn.has(z)?2:1}return{subcommand:null,rest:[]}}function l_(n){let u=new Map;for(let b of n){let W=b.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,b.value)}return u}function Fo(n,u,b){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?Wt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=d_(u,b);return{blockedReason:B.blockedReason,entries:[...B.entries,...c_(n,u,b)]}}function c_(n,u,b){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let Q=Tc(n[z+1]);if(Q)W.push(Q);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let Q=Tc(B.slice(2));if(Q)W.push(Q);z++;continue}if(B==="--config-env"){let Q=Cp(n[z+1],u,b);if(Q)W.push(Q);z+=2;continue}if(B.startsWith("--config-env=")){let Q=Cp(B.slice(13),u,b);if(Q)W.push(Q);z++;continue}if(Nn.has(B)){z+=2;continue}z++}return W}function d_(n,u){let b=u_(n,u),W=m_(n,u);return{blockedReason:b===null||W===null?Pc:null,entries:[...b??[],...W??[]]}}function u_(n,u){let b=pr("GIT_CONFIG_PARAMETERS",n,u);if(b===void 0)return[];let W=[],z=Wi(b);if(!z)return null;for(let B of z){let Q=Tc(B);if(!Q)return null;W.push(Q)}return W}function m_(n,u){let b=ff(n,u);if(b.state==="absent")return[];if(b.state==="invalid")return null;let W=[];for(let z=0;z<b.count;z++){let B=pr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),Q=pr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||Q===void 0)return null;W.push({key:B,value:Q})}return W}function Tc(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function Cp(n,u,b){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:pr(n.slice(W+1),u,b)}}function f_(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return Wi(u)}var p_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",g_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",h_="git checkout --force discards uncommitted changes. Use 'git stash' first.",y_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",S_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",C_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",b_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",E_="git switch --force discards uncommitted changes. Use 'git stash' first.",v_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",R_="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",w_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",__="git reset --merge can lose uncommitted changes. Use 'git stash' first.",x_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",A_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",P_="git push --force destroys remote history. Use --force-with-lease for safer force push.",T_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",I_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",k_="git branch -D force-deletes without merge check. Use -d for safe delete.",O_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",M_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",D_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",N_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",L_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",W_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",F_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",G_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),z_=new Set(["--recurse-submodules","--track","-t"]),Ic=new Set(["-b","-B","-U"]),kc=new Set(["-c","-C"]),$_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ht(n,u){let b=n.split("=",1)[0]??n;return b.length>=4&&u.startsWith(b)&&b.startsWith("--")&&b.slice(2).length>=2}var Go=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Rp(n,u){let{subcommand:b,rest:W}=Fn(n);if(!b)return null;switch(b.toLowerCase()){case"checkout":return Or(B_(W,u));case"switch":return Or(H_(W));case"restore":return Or(V_(W));case"reset":return K_(W);case"clean":return Or(Z_(W));case"rm":return Or(X_(W));case"push":return oo(Q_(W));case"branch":return oo(tx(W));case"stash":return oo(sx(W));case"worktree":return oo(ax(W));case"rebase":return Or(nx(W));case"merge":return Or(rx(W));case"tag":return oo(ox(W));case"reflog":return oo(ix(W));default:return null}}function Or(n){return n?{...n,localDiscard:!0}:null}function oo(n){return n?{...n,localDiscard:!1}:null}function B_(n,u){let{index:b,before:W}=hn(n),z=An(W,{shortOptsWithValue:Ic});if(W.some((ee)=>Ht(ee,"--force"))||z.has("-f"))return st("git.checkout-force",h_);for(let ee of n){if(ee==="-b"||ee==="-B"||ee==="--orphan")return null;if(Ht(ee,"--pathspec-from-file"))return st("git.checkout-pathspec-from-file",S_)}if(b!==-1){if(W.some((le)=>!le.startsWith("-")))return st("git.checkout-ref-path",y_);return st("git.checkout-double-dash",p_)}let B=j_(n);if(B.length>=2)return st("git.checkout-ambiguous",C_);let Q=B[0];if(Q===void 0||z.has("-d")||z.has("-t")||n.some((ee)=>Ht(ee,"--detach")||Ht(ee,"--track")))return null;if(U_(Q)||u(Q))return st("git.checkout-double-dash",g_);return null}function U_(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function H_(n){let{before:u}=hn(n);if(u.some((W)=>Ht(W,"--discard-changes")))return st("git.switch-discard-changes",b_);let b=An(u,{shortOptsWithValue:kc});if(u.some((W)=>Ht(W,"--force"))||b.has("-f"))return st("git.switch-force",E_);return null}function j_(n){let u=[],b=0;while(b<n.length){let W=n[b];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),b++;continue}if(G_.has(W)){b+=2;continue}if(z_.has(W)){let z=n[b+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];b+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}b++}return u}function V_(n){let u=q_(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?st("git.restore-worktree",R_):st("git.restore-unstaged",v_)}function q_(n){let u=!1,b=!1,W=!0,z=!1,B=(Q)=>{if(!z)W=!1,z=!0;if(Q!==void 0)W=Q};for(let Q=0;Q<n.length;Q++){let ee=n[Q];if(ee===void 0)break;if(ee==="--"){u||=Q+1<n.length;break}if(ee==="--pathspec-from-file"){u=!0,Q++;continue}if(ee.startsWith("--pathspec-from-file=")){u=!0;continue}if(ee==="-h"||ee==="--help"||ee==="--version")return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ee==="--staged"){B();continue}if(ee==="--no-staged"){B();continue}if(ee==="--worktree"){B(!0);continue}if(ee==="--no-worktree"){B(!1);continue}if(ee==="--patch"){b=!0;continue}if(ee==="--no-patch"){b=!1;continue}if($_.has(ee)){Q++;continue}if(ee.startsWith("--"))continue;if(ee==="-"){u=!0;continue}if(!ee.startsWith("-")){u=!0;continue}for(let le=1;le<ee.length;le++){let ue=ee.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){b=!0;continue}if(ue==="s"||ue==="U"){if(le===ee.length-1)Q++;break}}}return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function K_(n){let u=null;for(let b of n){if(Ht(b,"--hard")){u=st("git.reset-hard",w_);break}if(Ht(b,"--merge")){u=st("git.reset-merge",__);break}}if(!u)return null;return Y_(n)?oo(u):Or(u)}function Y_(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function Z_(n){for(let b of n)if(b==="-n"||Ht(b,"--dry-run"))return null;let u=An(n.filter((b)=>b!=="--"));if(n.some((b)=>Ht(b,"--force"))||u.has("-f"))return st("git.clean-force",x_);return null}function X_(n){let u=!1,b=!1,W=!1;for(let z of hn(n).before){if(Ht(z,"--no-force")){u=!1;continue}if(Ht(z,"--force")){u=!0;continue}if(Ht(z,"--no-cached")){b=!1;continue}if(Ht(z,"--cached")){b=!0;continue}if(Ht(z,"--no-dry-run")){W=!1;continue}if(Ht(z,"--dry-run")){W=!0;continue}let B=An([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!b&&!W?st("git.rm-force",A_):null}function Q_(n){let{before:u,after:b}=hn(n),W=An(u);if(u.some((Q)=>Ht(Q,"--mirror")))return st("git.push-mirror",I_);if(u.some((Q)=>Ht(Q,"--force"))||W.has("-f")||vp(u,b).some(J_))return st("git.push-force",P_);if(u.some((Q)=>Ht(Q,"--delete"))||W.has("-d")||vp(u,b).some(ex))return st("git.push-delete",T_);return null}function vp(n,u){return[...n.filter((b)=>b!==""&&!b.startsWith("-")),...u]}function J_(n){return n.startsWith("+")||n.includes(":+")}function ex(n){return n.length>1&&n.startsWith(":")}function tx(n){let{before:u}=hn(n),b=An(u),W=b.has("-D")||b.has("-d")||u.some((B)=>Ht(B,"--delete")),z=b.has("-D")||b.has("-f")||u.some((B)=>Ht(B,"--force"));if(W&&z)return st("git.branch-force-delete",k_);return null}function nx(n){let{before:u}=hn(n);return u.some((b)=>Ht(b,"--abort"))?st("git.rebase-abort",O_):null}function rx(n){let{before:u}=hn(n);return u.some((b)=>Ht(b,"--abort"))?st("git.merge-abort",M_):null}function ox(n){let{before:u}=hn(n);return An(u).has("-d")||u.some((W)=>Ht(W,"--delete"))?st("git.tag-delete",D_):null}function ix(n){return n[0]==="delete"?st("git.reflog-delete",N_):null}function sx(n){for(let u of n){if(u==="drop")return st("git.stash-drop",L_);if(u==="clear")return st("git.stash-clear",W_)}return null}function ax(n){let{before:u}=hn(n);if(!u.includes("remove"))return null;let W=An(u);if(u.some((z)=>Ht(z,"--force"))||W.has("-f"))return st("git.worktree-remove-force",F_);return null}import{isAbsolute as kx,join as Ox,resolve as Mx}from"node:path";var Mc="TMPDIR",Dc="IFS",_p=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,xp=/^[A-Za-z_][A-Za-z0-9_]*$/,Ap=new Set(["export","typeset","declare","readonly"]),lx=new Set(["builtin","command","time"]),cx=new Set(["do","then","else"]),dx=new Set(["do","then","case"]),wp=new Set(["done","fi","esac"]),ux=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,mx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function zo(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function $o(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function Pp(n,u,b){let W=zo(u.shellAssignments,b);return n.map((z)=>{if(!Np(z.text))return t(z);if(z.provenance==="variable")return Tp(z.text,W);if(z.provenance==="command-substitution")return px(z,b.darwinUserTempDir)??t(z);return z.provenance==="literal"&&ux.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function Tp(n,u){return n.replace(mx,(b,W,z)=>u.get(W??z??"")??b)}var fx=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function px(n,u){if(n.provenance!=="command-substitution")return null;let b=n.parts.map((z)=>{if(z.provenance==="command-substitution")return fx.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!b.every((z)=>z!==null))return null;let W=b.join("");return/[\s$`*?[]/.test(W)?null:W}function Jn(n,u){let b=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!b)return null;let W=Tp(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function Ip(n,u){return{env:n,effectiveEnvAssignments:Sx(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function kp(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function Nc(n,u){let b=Mp(n,u),W=n[0]??"";if(dx.has(W))u.bodyDepth+=1;if(W==="elif"||wp.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(wp.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((ee)=>{u.shellAssignments.delete(ee)}),u.bodyAssignments.clear();b.assignments.filter((ee)=>ee.persists).forEach((ee)=>{if(u.shellAssignments.set(ee.name,ee.value),u.bodyDepth>0)u.bodyAssignments.add(ee.name);Lc(u,ee)});let z=b.commandIndex;if(z!==-1&&Ap.has(n[z]??""))n.filter((ee)=>xp.test(ee)&&Oc(ee)).forEach((ee)=>{Cx(u,ee)});let B=z===-1?-1:Dp(n,z);if(B===-1||n[B]!=="unset")return;let Q=Ex(n,B);if(Q===null)return;n.slice(Q).forEach((ee)=>{if(u.bodyDepth>0){u.shellAssignments.set(ee,"");return}bx(u,ee)})}function Op(n,u){let b=Mp(n,u).assignments;if(b.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return b.forEach((z)=>{W.set(z.name,z.value)}),W}function Mp(n,u){let b=cx.has(n[0]??"")?1:0,W=n.findIndex((ee,le)=>le>=b&&!Np(ee)),z=W!==-1&&Ap.has(n[Dp(n,W)]??""),B=yx(u);return{assignments:n.flatMap((ee,le)=>{let ue=gx(ee,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!zs(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function Dp(n,u){let b=u;while(lx.has(n[b]??"")){b+=1;while(n[b]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[b]??""))return u;b+=1}}return b}function Np(n){return In(n)!==null||_p.test(n)}function gx(n,u,b){return In(n)??hx(n,u,b)}function hx(n,u,b){let W=$s(n,b,u);if(W)return W;let z=n.match(_p)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):b.get(z)??""}${n.slice(B+1)}`}}function Oc(n){return n===Mc||n===Dc||nc(n)}function yx(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function Sx(n,u){let b=[Mc,Dc].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(b.length===0)return u;return new Map([...b,...u??[]])}function Lc(n,u){let b=new Map(n.effectiveEnvAssignments??[]);b.set(u.name,u.value),n.effectiveEnvAssignments=b}function Cx(n,u){Lc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function bx(n,u){if(!Oc(u)&&!xp.test(u))return;if(n.shellAssignments.set(u,""),zs(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!Oc(u)||u===Mc||u===Dc||oi(u)){Lc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let b=new Map(n.effectiveEnvAssignments);b.delete(u),n.effectiveEnvAssignments=b.size===0?void 0:b}function Ex(n,u){let b=u+1;while(b<n.length){let W=n[b];if(!W)return null;if(W==="--")return b+1;if(W==="-v"){b++;continue}if(W.startsWith("-"))return null;return b}return b}import{dirname as Wp,join as ua,resolve as vx}from"node:path";function ma(n,u){return tc.some((b)=>u?.has(b)||n.has(b))}function Bo(n,u,b){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=b.realpath(vx(u));if(W===null||!b.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,Q=1;while(Q<n.length){let ee=n[Q];if(!ee)break;if(ee==="--")break;if(!ee.startsWith("-"))break;if(ee==="-C"){let le=n[Q+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=Lp(z,le,b);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,Q+=2;continue}if(ee.startsWith("-C")&&ee.length>2){let le=Lp(z,ee.slice(2),b);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,Q++;continue}if(ee==="--git-dir"||ee==="--work-tree"){B=!0,Q+=2;continue}if(ee.startsWith("--git-dir=")||ee.startsWith("--work-tree=")){B=!0,Q++;continue}Q+=Nn.has(ee)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function Lp(n,u,b){try{let W=Tr(n,u,b);return b.isDirectory(W)?W:null}catch{return null}}function Fi(n,u){if(u.entryKind(ua(n,".git"))!=="missing")return n;let b=Wp(n);return b===n?null:Fi(b,u)}function fa(n,u,b,W,z){let B=W.paths,Q=ua(b,".git"),ee=B.isDirectory(Q),le=ee&&!W.isGitDirectory(Q),ue=Fp(u).filter((ve)=>le||ve!==b&&Pr(ve,b));return Fo(n,W.env,z).entries.some((ve)=>ve.key.toLowerCase()==="core.worktree")||ue.some((ve)=>B.entryKind(ua(ve,"HEAD"))!=="missing"||ve!==b&&B.entryKind(ua(ve,".git"))!=="missing")||ee&&W.gitDirectoryRedirects(Q)}function Fp(n){let u=Wp(n);return u===n?[n]:[n,...Fp(u)]}function Gp(n,u,b){if(!u.localDiscard||!b.worktreeMode||ma(b.environment.env,b.envAssignments))return null;let W=Bo(n,b.cwd,b.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=b.environment.worktreeFacts(W.gitCwd),B=Fi(W.gitCwd,b.environment.paths);if(!z||B===null||fa(n,W.gitCwd,B,b.environment,b.envAssignments))return null;if(Wc(n,b,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Wc(n,u,b){let{subcommand:W,rest:z}=Fn(n),B=W?.toLowerCase();if(u.dynamicArguments||Rx(z)||Px(n,u.environment.env,u.envAssignments,b)||xx(z)||wx(B,z))return!0;return B==="clean"&&Ax(z)>1}function Rx(n){return n.some((u)=>/[$*?[]/.test(u))}function wx(n,u){if(n==="checkout"){let{before:b}=hn(u),W=An(b,{shortOptsWithValue:Ic}),z=b.some((Q)=>Ht(Q,"--force"))||W.has("-f"),B=W.has("-B")||b.some((Q)=>Q==="-B"||Q.startsWith("-B"));return z&&B}if(n==="switch"){let{before:b}=hn(u),W=An(b,{shortOptsWithValue:kc}),z=b.some((Q)=>Ht(Q,"--force"))||b.some((Q)=>Ht(Q,"--discard-changes"))||W.has("-f"),B=b.some((Q)=>Q==="-C"||Q.startsWith("-C")||_x(Q))||W.has("-C");return z&&B}return!1}function _x(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function xx(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function Ax(n){let u=0;for(let b of n){if(b==="--force"){u++;continue}if(b.startsWith("-")&&!b.startsWith("--")){for(let W of b.slice(1))if(W==="f")u++}}return u}function Px(n,u,b,W){if(pr("GIT_CONFIG_PARAMETERS",u,b)!==void 0)return!0;let z=Fo(n,u,b);if(z.blockedReason!==null)return!0;let B=z.entries.map((ee)=>({key:ee.key.toLowerCase(),value:ee.value}));if(B.some((ee)=>Ix(ee.key)))return!0;let Q=B.filter((ee)=>ee.key==="submodule.recurse").at(-1);if(Q)return Q.value===void 0||Tx(Q.value);if(gf(b))return!0;return W.recursiveSubmodules}function Tx(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Ix(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function zp(n,u,b){let W=n.map((le)=>Jn(le,b.shellAssignments??new Map)??t(le)),z=b.environment.paths,B=Bo(W,b.cwd,z),Q=b.originalCwd?z.realpath(Mx(b.originalCwd)):null;if(u.id.startsWith("git.push-")||Q===null||B.gitCwd===null||B.hasExplicitGitContext||ma(b.environment.env,b.envAssignments))return null;let ee=u.id==="git.worktree-remove-force"?Nx(n,b.shellAssignments,z):Fi(B.gitCwd,z);if(ee===null||u.id!=="git.worktree-remove-force"&&!Dx(ee,B.gitCwd,W,u,b)||!Io(ee,b.environment)||Gs(ee,b.environment)||Pr(Q,ee)||Pr(ee,Q))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function Dx(n,u,b,W,z){let B=z.environment.paths,Q=Ox(n,".git");if(B.entryKind(Q)!=="present"||fa(b,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(Q))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Wc(b,z,le)}function Nx(n,u,b){let W=Fn(n.map(t)).rest,{before:z,after:B}=hn(W.slice(W.indexOf("remove")+1)),Q=[...z.filter((ve)=>!ve.startsWith("-")),...B],ee=Q.length===1?Q[0]??"":"",le=n.find((ve)=>ve.text===ee),ue=(le&&Jn(le,u??new Map))??ee;if(!kx(ue)||/[\s$`*?[]/.test(ue)||b.entryKind(ue)!=="present"||!b.isDirectory(ue))return null;return b.realpath(ue)}var Wx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Fx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function pa(n,u){return $p(n,u)}function $p(n,u,b){let W=n.map(t),z=bp(W,u.environment.env,u.envAssignments),B=z.blockedReason?Gt(st("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let Q=z.tokens;if((pf(u.envAssignments)||Ep(W,u.environment.env,u.envAssignments))&&Gx(Q))return st("git.ssh-env",Wx);let ee=Rp(Q,(ue)=>{let ve=Bo(W,u.cwd,u.environment.paths).gitCwd;return ve!==null&&u.environment.paths.entryKind(Lx(ve,ue))!=="missing"});if(!ee)return null;if(z.expanded||z.blockedReason)return ee;let le=Gp(W,ee,u)??zp(n,ee,u);if(!le)return ee;return b?.(le),null}function Bp(n,u){let b=null;return{match:$p(n,u,(z)=>{b=z}),relaxation:b}}function Gx(n){let{subcommand:u,rest:b}=Fn(n),W=u?.toLowerCase();if(!W)return!1;if(Fx.has(W))return!0;if(W==="archive")return hn(b).before.some((z)=>Ht(z,"--remote"));return W==="remote"&&zx(b)}function zx(n){return n.find((u)=>!$x(u))?.toLowerCase()==="update"}function $x(n){return n==="-v"||Ht(n,"--verbose")||Ht(n,"--no-verbose")}import{isAbsolute as yA}from"node:path";function Up(n,u,b,W){let z=n.slice(0,u),B=n.slice(u+b);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function ga(n,u,b){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>b(B).some((Q)=>!z.has(W(Q))))}var Hp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Bx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ux="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Hx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",jx="rm -rf in home directory is dangerous. Change to a project directory first.",jp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Hx},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Ux},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:jx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Hp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Bx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Hp}};function ha(n,u){let b=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=la(W),B=Vx(n);for(let Q of B){let ee=to(Q.word);if(z&&ee.unsafeBraceExpansion){let le=Gt(uc({kind:"outside_anchored_cwd"},b,u.policy,jp),u.policy);if(le)return le;continue}for(let le of ee.expandedTargets??[Q.text]){let ue=Cn(le),ve={targetIsLiteral:ee.expandedTargets!==void 0||ee.targetIsLiteral,tmpdirWordSplittingProtected:ee.tmpdirWordSplittingProtected};if(!z&&b.resolvedCwd&&Jr(ue,b.resolvedCwd,b.protectedGitMetadata,z,b.environment,b.budget))return st("rm.git-metadata",y);if(!z)continue;let Oe=No(ue,b,u.policy,jp,ve);if(Oe)return Oe}}return null}function Vx(n){let u=[],b=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){b=!0;continue}if(b){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Mr={kind:"none"},io={kind:"dynamic"},qp=new Set(["<","<<","<<-","<<<","<&","<>"]),Kp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,qx=/^(?:[0-9]+|[@*])$/,Kx=xr.maxWords,Yp=xr.maxInputLength;function Zp(n){if(!n||Wt(Bt(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),b=u[0]?.text;if(b===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(b==="%s")return W.join("");if(b==="%s\\n"||b===`%s
+`),bytes:b.length}}catch{return null}}import{isAbsolute as Qs,normalize as fR,parse as pR,posix as jf,resolve as eo,sep as dc}from"node:path";import{isAbsolute as JE,join as sf,normalize as cf,parse as ev,sep as af}from"node:path";var tv=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],nv=` 	
+`;function wi(n,u){if(Kr(n,u))return!0;if(!n.has("TMPDIR"))return!1;return!Jl(n.get("TMPDIR")??"",u)}function To(n,u){if(n.has("TMPDIR"))return Jl(n.get("TMPDIR")??"",u);let b=ec(n,u);if(b===void 0)return!0;return Jl(b,u)}function ec(n,u){return uf(n,u,"TMPDIR")}function Jl(n,u){if(!n)return!1;if(ov(n))return!1;return Io(n,u)}function Kr(n,u){let b=uf(n,u,"IFS");return b!==void 0&&b!==""&&b!==nv}function Io(n,u){let b=Ws(n,u.paths);if(b===null)return!1;return df(u).some((W)=>Pr(b,W))}function Gs(n,u){let b=Ws(n,u.paths);if(b===null)return!1;return df(u).some((W)=>Fs(W)===Fs(b))}var lf=new WeakMap;function df(n){let u=lf.get(n);if(u)return u;let b=rv(n);return lf.set(n,b),b}function rv(n){let u=tv.map((W)=>Ws(W,n.paths)??cf(W)),b=Ws(n.tmpdir,n.paths);if(!b)return u;if(process.platform==="win32")return[...u,b];if(process.platform==="darwin"&&iv(b))return[...u,b];return u}function ov(n){return/[\s$`*?[]/.test(n)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(n)||/[+@!]\([^)]*\)/.test(n)}function uf(n,u,b){return n.has(b)?n.get(b):u.env.get(b)}function iv(n){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(n)}function Ws(n,u){try{let b=cf(n);if(!JE(b))return b;let W=ev(b).root,z=b.slice(W.length).split(/[\\/]+/).filter(Boolean),B=W;for(let Q=0;Q<z.length;Q++){let ee=sf(B,z[Q]??"");if(u.entryKind(ee)==="missing")return sf(ee,...z.slice(Q+1));let le=u.realpath(ee);if(le===null)return null;B=le}return B}catch{return null}}function Pr(n,u){let b=Fs(n),W=Fs(u);if(b===W)return!0;let z=W.endsWith(af)?W:`${W}${af}`;return b.startsWith(z)}function Fs(n){return process.platform==="win32"?n.toLowerCase():n}import{lstatSync as rR,readdirSync as oR}from"node:fs";import{basename as iR,isAbsolute as Wf,join as sR,relative as Ff}from"node:path";import{isAbsolute as Sf,parse as gv}from"node:path";import{dirname as sv,isAbsolute as av,parse as lv,sep as cv}from"node:path";function Tr(n,u,b){if(dr(u))throw Error("Unsupported Windows namespace path");let W=av(u)?lv(u).root:"",z=W||n;for(let B of uv(W?u.slice(W.length):u)){if(B===""||B===".")continue;if(B===".."){z=sv(z);continue}let Q=dv(z,B),ee=b.entryKind(Q),le=ee==="symlink"?b.realpath(Q):Q;if(ee==="missing"||le===null)throw Error(`Cannot resolve path component: ${Q}`);z=le}return z}function dv(n,u){return n.endsWith("/")||n.endsWith("\\")?`${n}${u}`:`${n}${cv}${u}`}function uv(n){let u=process.platform==="win32"?/[\\/]+/:/\/+/;return n.split(u)}var tc=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],mv=new Set(tc),fv=1024,mf=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ff=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),pv=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function zs(n){return mv.has(n)}function nc(n){return zs(n)||mf.has(n)||ff.has(n)||oi(n)}function pr(n,u,b){return b?.has(n)?b.get(n):u.get(n)}function pf(n,u){let b=pr("GIT_CONFIG_COUNT",n,u);if(b===void 0)return{state:"absent"};if(b==="")return{state:"valid",count:0};if(!/^\d+$/.test(b))return{state:"invalid"};let W=Number(b);return Number.isSafeInteger(W)&&W<=fv?{state:"valid",count:W}:{state:"invalid"}}function $s(n,u,b){let z=n.match(pv)?.[1];if(!z||!nc(z))return null;let B=n.indexOf("=");return{name:z,value:`${pr(z,u,b)??""}${n.slice(B+1)}`}}function gf(n){return yf(n,ff)}function hf(n){return yf(n,mf)}function yf(n,u){if(!n)return!1;for(let b of n.keys())if(u.has(b))return!0;return!1}var bf=/^[A-Za-z_][A-Za-z0-9_]*=/;function In(n){if(!bf.test(n))return null;let u=n.indexOf("=");return{name:n.slice(0,u),value:n.slice(u+1)}}function Ae(n){let u=new Map,b=0;while(b<n.length){let W=n[b];if(!W)break;let z=In(t(W));if(!z)break;u.set(z.name,z.value),b++}return{words:n.slice(b),envAssignments:u}}function Ef(n){let u=Bt(n);return n.includes("=")||u==="sudo"||u==="env"||u==="command"||u==="builtin"}function gr(n,u,b,W){if(!Ef(ko(n)))return{words:n,envAssignments:new Map,cwd:b,rewritten:!1};let z=new Set(n),B=n,Q=new Map,ee=new Map(W??[]),le=[],ue=b;for(let Oe=0;Oe<l.wrapperPeelIterations.cap;Oe++){let De=Cf(B),Me=Ae(B);for(let[Le,We]of Me.envAssignments)Q.set(Le,We),ee.set(Le,We);if(B=Me.words,B.length===0)break;while(B.length>0&&ko(B).includes("=")&&!yv(B)){let Le=Sv(ko(B),ee,u.env)??$s(ko(B),u.env,ee);if(Le)Q.set(Le.name,Le.value),ee.set(Le.name,Le.value);B=B.slice(1)}if(B.length===0)break;let Ne=Bt(ko(B));if(Ne!=="sudo"&&Ne!=="env"&&Ne!=="command"&&Ne!=="builtin")break;if(Ne==="sudo"){let Le=bv(B,u.paths,ue);if(B=Le.words,Le.cwd!==void 0)ue=Le.cwd}if(Ne==="env"){let Le=Rv(B,ue,ee,u);if(le.push(...Le.envSplitValues??[]),B=Le.words,Le.cwd!==void 0)ue=Le.cwd;for(let[We,Be]of Le.envAssignments)Q.set(We,Be),ee.set(We,Be)}if(Ne==="command")B=wv(B);if(Ne==="builtin")B=B.slice(Kn(B,1)==="--"?2:1);if(Cf(B)===De)break}let ve=Ae(B);for(let[Oe,De]of ve.envAssignments)Q.set(Oe,De),ee.set(Oe,De);return{words:ve.words,envAssignments:Q,cwd:ue,envSplitValues:le.length>0?le:void 0,rewritten:hv(ve.words,z)}}function hv(n,u){return n.some((b)=>!u.has(b))}function Cf(n){return n.map(t).join(" ")}function ko(n){let u=n[0];return u?t(u):""}function Kn(n,u){let b=n[u];return b?t(b):void 0}function yv(n){return bf.test(ko(n))}function Sv(n,u,b){if(!n.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${u.get("TMPDIR")??b.get("TMPDIR")??""}${n.slice(8)}`}}var Cv=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function bv(n,u,b){let W=1,z=b;while(W<n.length){let B=Kn(n,W);if(!B)break;if(B==="--")return{words:n.slice(W+1),cwd:z};if(!B.startsWith("-"))break;if(B==="-D"||B==="--chdir"){let Q=Kn(n,W+1);z=Q?_i(z,Q,u):null,W+=2;continue}if(B.startsWith("--chdir=")){z=_i(z,B.slice(8),u),W++;continue}if(B.startsWith("-D")&&B.length>2){z=_i(z,B.slice(2),u),W++;continue}if(B==="-i"||B==="--login"){z=null,W++;continue}if(Cv.has(B)){W+=2;continue}W++}return{words:n.slice(W),cwd:z}}var Ev=new Set(["-i","-0","--null"]),vv=new Set(["-u","--unset","-C","--chdir","-P"]);function Rv(n,u,b,W){let z=new Map,B=[],Q=u,ee=1,le=(ue)=>({words:n.slice(ue),envAssignments:z,cwd:Q,envSplitValues:B.length>0?B:void 0});while(ee<n.length){let ue=Kn(n,ee);if(!ue)break;if(ue==="--")return le(ee+1);if(ue==="-i"||ue==="--ignore-environment"||ue==="-"){z.clear();for(let Oe of b.keys())z.set(Oe,"");z.set("TMPDIR",""),ee++;continue}if(Ev.has(ue)){ee++;continue}if(ue==="-u"||ue==="--unset"){let Oe=Kn(n,ee+1);if(Oe!==void 0)z.set(Oe,"");ee+=2;continue}if(ue.startsWith("-u")&&ue.length>2&&!ue.startsWith("-u=")){z.set(ue.slice(2),""),ee++;continue}if(ue.startsWith("--unset=")){z.set(ue.slice(8),""),ee++;continue}let ve=ue==="-S"||ue==="--split-string"?{value:Kn(n,ee+1),consumed:2}:ue.startsWith("-S")&&ue.length>2?{value:ue.slice(2),consumed:1}:ue.startsWith("--split-string=")?{value:ue.slice(15),consumed:1}:null;if(ve){if(ve.value!==void 0)B.push(ve.value);return Q=null,le(ee+ve.consumed)}if(vv.has(ue)){if(ue==="-C"||ue==="--chdir"){let Oe=Kn(n,ee+1);Q=Oe?_i(Q,Oe,W.paths):null}ee+=2;continue}if(ue.startsWith("-u=")){ee++;continue}if(ue.startsWith("-C")&&ue.length>2||ue.startsWith("--chdir=")){let Oe=ue.startsWith("--chdir=")?ue.slice(8):ue.startsWith("-C=")?ue.slice(3):ue.slice(2);Q=_i(Q,Oe,W.paths),ee++;continue}if(ue.startsWith("-P")){ee++;continue}if(ue.startsWith("-")){ee++;continue}if(!In(ue))break;while(ee<n.length){let Oe=In(Kn(n,ee)??"");if(!Oe)break;z.set(Oe.name,Oe.value),ee++}if(Kn(n,ee)==="--")ee++;return le(ee)}return le(ee)}function _i(n,u,b){if(u==="")return null;if(!n&&!Sf(u))return null;let W=Sf(u)?gv(u).root:b.realpath(n??"/");if(W===null)return null;try{return Tr(W,u,b)}catch{return null}}function wv(n){if(Kn(n,1)==="-v")return[...tn(["type"]),...n.slice(2)];let u=1;while(u<n.length){let b=Kn(n,u);if(!b)break;if(b==="-p"||b==="-v"||b==="-V"){u++;continue}if(b==="--")return n.slice(u+1);if(b.startsWith("-")&&!b.startsWith("--")&&b.length>1){if(!/^[pvV]+$/.test(b.slice(1)))break;u++;continue}break}return n.slice(u)}var _v=/['"\\$`{}#]/;function Yr(n,u){if(n.some((W)=>_v.test(W)))return null;let b=[...n.flatMap((W)=>W.split(/\s+/).filter((z)=>z.length>0)),...u];return b.length<=64?b:null}function or(n,u,b){return Zr(n,u,b).tokens}function xv(n){let u=[],b="",W=0;while(W<n.length){let z=n.charAt(W);if(z==='"'||z==="'"){let B=n.indexOf(z,W+1);if(B===-1)return n.split(/\s+/).map((Q)=>Q.replace(/["']/g,"")).filter((Q)=>Q.length>0);b+=n.slice(W+1,B),W=B+1;continue}if(/\s/.test(z)){if(b.length>0)u.push(b);b="",W++;continue}b+=z,W++}if(b.length>0)u.push(b);return u}function Ir(n,u,b,W=0){let z=Zr(n,u,b),B=(z.envSplitValues??[]).flatMap(xv);if(B.length===0)return z.tokens;let Q=[...B,...z.tokens];if(W>=8)return Q;return Ir(Q,u,b,W+1)}function Zr(n,u,b,W){if(!Ef(n[0]??""))return{tokens:[...n],envAssignments:new Map,cwd:b};let z=gr(tn(n),u,b,W);return{tokens:z.words.map(t),envAssignments:z.envAssignments,cwd:z.cwd,envSplitValues:z.envSplitValues}}var ic=Symbol("adopt-as-operand"),Av=new Set(["env","sudo","command","builtin"]),Pv=new Set(["&&","||","|&","|","&",";"]),Tv=new Set(["<<","<<<",">|"]),vf=new Set(["|","|&"]),Iv=/[*@#?$!_-]/,kv=/^\w+(?::\w+)*/,Ov=Object.freeze([]),xi=Object.freeze({kind:"scope",edge:"enter"}),Ai=Object.freeze({kind:"scope",edge:"exit"}),Mv=Object.freeze([]),Dv=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Pi=new Set(["bash","sh","zsh","dash","ksh"]),Nv=256,Af=new WeakMap;function Pf(n,u){let b=u.status==="complete"?new Set(oc(u)):new Set,W=Fv(n,b);if(u.dialect==="powershell"?u.issues.some((le)=>le.code.includes("quote")):ds(W))return Bs("unclosed-quote",W,u);let B={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},Q=Xr(u,{source:W,suppressed:b,flags:B,depth:0,functions:new Map,powershell:u.dialect==="powershell"});if(B.limited)return Bs("structural-limit",W,u);if(B.invalid)return Bs("invalid",W,u);let ee=Bs("complete",W,u,B.assignmentFallbacks);return Af.set(ee,Object.freeze(Q)),ee}function Vs(n,u,b,W,z){let B=z.word??((Ne)=>Ne),Q={cwd:u,variables:new Map,previous:null},ee=[],le=new Set,ue=null,ve=[],Oe=Tf(n),De=Oe.findLastIndex((Ne)=>Ne.kind==="operator"&&vf.has(Ne.operator)),Me=De!==-1&&Oe.some((Ne)=>Ne.kind==="redirection"&&Ne.operator==="<<"&&Ne.body===void 0);for(let[Ne,Le]of Oe.entries()){let We=Me||Ne<=De;if(Le.kind==="scope"){if(Le.edge==="enter"){ve.push({state:Q,segment:[...ee],shellWords:new Set(le),pipeProducer:ue});continue}let Be=z.segment(ee,Q,ue,null,le,We);if(Be)return Be;let ze=ve.pop();if(ze===void 0)throw Error("scope exit without a matching enter");Q=ze.state,ee=ze.segment,le=ze.shellWords,ue=ze.pipeProducer;continue}if(Le.kind==="operator"){if(!Le.boundary)continue;let Be=z.segment(ee,Q,ue,Le.operator,le,We);if(Be)return Be;Q=Lv(ee,Q,b,W),ue=ee.length>0&&vf.has(Le.operator)?ee:null,ee=[],le=new Set;continue}if(Le.kind==="redirection"){if(Le.fd!==void 0)le.add(ee.length-1);if(Le.target===void 0)continue;let Be=z.redirection({operator:Le.operator,role:Le.role,targetOrder:Le.targetOrder,target:Le.target,...Le.body===void 0?{}:{body:Le.body,consumer:Le.consumer}},Q,We);if(Be===ic){le.add(ee.length),ee.push(B(Le.target));continue}if(Be)return Be;continue}ee.push(B(Le.text))}return z.segment(ee,Q,ue,null,le,Me)}function qs(n){return Tf(n).flatMap((u)=>{if(u.kind==="word")return[{kind:"word",text:u.text}];if(u.kind==="operator")return[{kind:"operator",boundary:u.boundary}];if(u.kind==="redirection")return[{kind:"redirection",target:u.target}];return[]})}function kn(n,u){return n.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(b,W,z,B)=>{let Q=u.get(W);if(Q===void 0)return b;let ee=z.startsWith(":")?Q!=="":!0;if(z.endsWith("-"))return ee?Q:kn(B,u);return ee?kn(B,u):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(b,W)=>u.get(W)??b).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(b,W)=>u.get(W)??b)}function Ti(n){return n.length>0&&n.every((u)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(u))}function Lv(n,u,b,W){let z=Ti(n)?new Map([...u.variables,...Wv(n,u.variables)]):u.variables,B=or([...n],b),Q=Wt(B[0]??"").toLowerCase()==="cd"?B[1]:void 0;if(!Q)return{...u,variables:z};if(Q==="-"){if(u.previous===null)return{...u,variables:z};return{cwd:u.previous,variables:z,previous:u.cwd}}return{cwd:bn(kn(Q,z),u.cwd,b,W),variables:z,previous:u.cwd}}function Wv(n,u){return n.flatMap((b)=>{let W=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(b),z=W?.[2]?.startsWith("=")?W[2].slice(1):void 0;return W?.[1]!==void 0&&z!==void 0?[[W[1],kn(z,u)]]:[]})}function Tf(n){return Af.get(n)??Ov}function Fv(n,u){return[...u].reduce((b,W)=>b.slice(0,W.start)+" ".repeat(W.end-W.start)+b.slice(W.end),n)}function Bs(n,u,b,W=Mv){return Object.freeze({status:n,source:u,program:b,assignmentFallbacks:Object.freeze(W)})}function Xr(n,u){return n.nodes.flatMap((b,W)=>Gv(b,n,W,u)).sort((b,W)=>b.start-W.start).flatMap((b)=>[...b.events])}function Gv(n,u,b,W){if(n.kind==="connector")return[{start:n.span.start,events:[Yn(jv(n.operator))]}];if(n.kind==="unknown")return[{start:n.span.start,events:[Yn(n.source)]}];if(n.kind==="function")return W.functions.set(n.name,n.body),[];if(n.kind==="group"){let B=n.style!=="subshell",Q=W.source[n.span.end-1]===(B?"}":")"),ee=B?W:{...W,functions:new Map(W.functions)};return[{start:n.span.start,events:B?[Us("{"),...Xr(n.body,ee),...Q?[Us("}")]:[]]:[xi,Yn("("),...Xr(n.body,ee),...Q?[Yn(")")]:[],Ai]}]}let z=Yv(n,W.functions);if(z){if(W.depth>=xr.maxDepth||++W.flags.expansions>Nv)return W.flags.limited=!0,[];return[{start:n.span.start,events:[...Rf(n,W),Us(";"),...Xr(z,{...W,depth:W.depth+1}),Us(";")]},...wf(n,u,b,W)]}return[{start:n.span.start,events:Rf(n,W)},...wf(n,u,b,W)]}function Rf(n,u){return[...n.words.map((b)=>({start:b.span.start,events:kf(b,n,u,!1)})),...n.redirections.map((b)=>({start:b.span.start,events:zv(b,n,u)}))].sort((b,W)=>b.start-W.start).flatMap((b)=>b.events)}function zv(n,u,b){let W=n.operator==="<<-"?"<<":n.operator,z=n.target?kf(n.target,u,b,!0):[],B=z[0],Q=B?.kind==="word"?B.text:void 0;return[...n.fd===void 0?[]:[js(String(n.fd))],Object.freeze({kind:"redirection",operator:W,...n.fd===void 0?{}:{fd:n.fd},role:Vv(W),targetOrder:Tv.has(W)?"legacy-segment":"immediate",...Q===void 0?{}:{target:Q},...n.heredoc&&b.suppressed.has(n.heredoc.bodySpan)?{body:n.heredoc.body,consumer:Mf(u)}:{}}),...Q===void 0?z:z.slice(1)]}function wf(n,u,b,W){let z=n.redirections.filter((B)=>B.operator==="<<"||B.operator==="<<-");return[...z.flatMap((B)=>{let Q=B.heredoc;if(!Q)return[];let ee=[js(Q.delimiter),.../[\r\n]/.test(W.source[Q.terminatorSpan.end]??"")?[Yn(";")]:[]];if(W.suppressed.has(Q.bodySpan))return[{start:Q.bodySpan.start,events:ee}];return[{start:Q.bodySpan.start,events:[...If(W.source.slice(Q.bodySpan.start,Q.bodySpan.end),W),...ee]}]}),...z.some((B)=>!B.heredoc&&B.target)?$v(u,b,W):[]]}function $v(n,u,b){let W=n.nodes.slice(u+1).find((z)=>z.kind==="connector");if(!W||W.span.end>=n.span.end)return[];return[{start:W.span.end,events:If(b.source.slice(W.span.end,n.span.end),b)}]}function If(n,u){if(u.depth>=xr.maxDepth)return u.flags.limited=!0,[];let b=C(n,"posix");if(b.status==="limited")return u.flags.limited=!0,[];let W={invalid:!1,limited:!1,expansions:u.flags.expansions,assignmentFallbacks:u.flags.assignmentFallbacks},z=Xr(b,{source:n,suppressed:new Set,flags:W,depth:u.depth+1,functions:new Map,powershell:!1});return u.flags.limited||=W.limited,u.flags.expansions=W.expansions,z}function kf(n,u,b,W){let z=b.powershell?Ro(n.raw,0):null;if(z&&n.provenance==="literal")return[js(n.text)];let B=[],Q={single:!1,double:z!==null},ee="",le=!1,ue=()=>{let ve=le&&!W?Yn("glob"):ee!==""||n.quoted&&B.length===0?js(ee):void 0;if(ve)B.push(ve);ee="",le=!1};for(let ve of z?Bv(n,z.bodyStart):n.parts){if(ve.provenance!=="command-substitution"&&ve.provenance!=="arithmetic"){for(let Ne of rc(ve.raw,Q,b.flags,b.powershell)){if(typeof Ne==="string"){ue(),B.push(Yn(Ne));continue}ee+=Ne.text,le||=Ne.glob}continue}let Oe=u.nested.find((Ne)=>Ne.span.start>=ve.span.start&&Ne.span.end<=ve.span.end);if(Q.double){let Ne=b.source.slice(ve.span.start,ve.span.end);ee+=rc(Ne,{single:!1,double:!0},b.flags,b.powershell).map((We)=>typeof We==="string"?We:We.text).join("");let Le=Oe?Xr(Oe,b).filter((We)=>We.kind==="redirection"&&We.body!==void 0):[];if(Le.length>0)B.push(xi,...Le,Ai);continue}let De=Oe?Xr(Oe,b):[];if(ve.raw.startsWith("`")){ee+="${}",ue(),B.push(xi,...De,Ai);continue}if(ve.raw.startsWith("<(")||ve.raw.startsWith(">(")){ue(),B.push(ve.raw.startsWith("<(")?Yn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),xi,...De,...ve.raw.endsWith(")")?[Yn(")")]:[],Ai);continue}let Me=ve.raw.startsWith("$((")?2:1;ee+="${}",ue(),B.push(...Array.from({length:Me},()=>Yn("(")),...Me===1?[xi]:[],...De,...ve.raw.endsWith(")".repeat(Me))?Array.from({length:Me},()=>Yn(")")):[],...Me===1?[Ai]:[])}return ue(),B}function Bv(n,u){let b=n.raw.length-(/(?:\r\n|[\r\n])"@$/.exec(n.raw)?.[0].length??0);return n.parts.flatMap((W)=>{if(W.provenance==="command-substitution")return[W];let z=n.raw.slice(Math.max(W.span.start-n.span.start,u),Math.min(W.span.end-n.span.start,b));return z===""?[]:[{...W,raw:z.replace(/["']/g,"`$&")}]})}function rc(n,u,b,W){let z=[],B="",Q=!1,ee=0;while(ee<n.length){let le=n[ee]??"";if(!u.single&&!u.double&&(le==="("||le===")")){z.push({text:B,glob:Q},le),B="",Q=!1,ee++;continue}if(W&&le==="`"&&!u.single){B+=n[ee+1]??"",ee+=2;continue}if(u.single&&le==="'"){u.single=!1,ee++;continue}if(u.single){B+=le,ee++;continue}if(u.double){if(le==='"'){u.double=!1,ee++;continue}if(!W&&le==="\\"){let ue=n[ee+1]??"";B+=['"',"\\","$"].includes(ue)?ue:`\\${ue}`,ee+=2;continue}if(le==="$"){let ue=_f(n,ee,u,b,W);B+=ue.text,ee=ue.next;continue}B+=le,ee++;continue}if(le==="'"||le==='"'){u.single=le==="'",u.double=le==='"',ee++;continue}if(!W&&le==="\\"){let ue=n[ee+1]??"";Q||=ue==="*"||ue==="?",B+=ue,ee+=2;continue}if(le==="$"){let ue=_f(n,ee,u,b,W);B+=ue.text,ee=ue.next;continue}Q||=le==="*"||le==="?",B+=le,ee++}return[...z,{text:B,glob:Q}]}function _f(n,u,b,W,z){let B=n[u+1];if(B==="{"){let ee=z?Hv(n,u+2):Ms(n,u+2,n.length).close;if(ee===-1)return W.invalid=!0,{text:"",next:n.length};let le=n.slice(u,ee+1);return Uv(le,b,W,z),{text:le,next:ee+1}}if(B!==void 0&&Iv.test(B))return{text:`\${${B}}`,next:u+2};let Q=(z?kv:/^\w*/).exec(n.slice(u+1))?.[0]??"";return{text:`\${${Q}}`,next:u+1+Q.length}}function Uv(n,u,b,W){let z=n.slice(2,-1),B=/^[A-Za-z_][A-Za-z0-9_]*/.exec(z)?.[0];if(!B)return;let Q=z.slice(B.length),ee=[":=","="].find((ue)=>Q.startsWith(ue));if(!ee)return;let le=rc(Q.slice(ee.length),{...u},b,W);b.assignmentFallbacks.push(...le.flatMap((ue)=>typeof ue==="string"||!ue.text?[]:[ue.text]))}function Hv(n,u){let b=1,W=u;while(b>0&&W<n.length){if(n[W]==="{"&&n[W-1]==="$")b++;if(n[W]==="}")b--;W++}return b===0?W-1:-1}function jv(n){return/^[\r\n]+$/.test(n)?";":n}function Yn(n){return Object.freeze({kind:"operator",operator:n,boundary:Pv.has(n)})}function Us(n){return Object.freeze({kind:"operator",operator:n,boundary:!0})}function js(n){return Object.freeze({kind:"word",text:n})}function Vv(n){if(n==="<<"||n==="<<<")return"here-data";if(n==="<"||n==="<&")return"file-read";return"file-write"}function Oo(n){return Dv.has(n)||/^python\d/.test(n)}var qv=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Of(n,u){let b=u[0];if(b===void 0||!b.startsWith("-"))return u;let W=qv.get(n)?.has(b)??!1;return Of(n,u.slice(W?2:1))}function Hs(n){let u=n[0];if(u===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(u))return Hs(n.slice(1));if(u==="uv"&&n[1]==="run")return Hs(n.slice(2));if(!Av.has(u))return[...n];return Hs(Of(u,n.slice(1)))}function Mf(n){let u=hi(n),b=n.words.findIndex((W)=>W.provenance==="literal"&&W.text===u);return Hs(b<0?[]:n.words.slice(b).map((W)=>W.text))}function Kv(n){let u=Mf(n)[0];if(u===void 0)return!1;let b=Wt(u).toLowerCase();return Oo(b)&&!Pi.has(b)}function oc(n){return n.nodes.flatMap((u,b)=>{if(u.kind==="group"||u.kind==="function")return oc(u.body);if(u.kind!=="command")return[];let W=u.nested.flatMap((ee)=>oc(ee)),z=u.redirections.flatMap((ee)=>ee.heredoc?.quotedDelimiter?[ee.heredoc.bodySpan]:[]);if(Kv(u))return[...W,...z];let B=n.nodes[b+1];if(B?.kind==="connector"&&(B.operator==="|"||B.operator==="|&")||!Xv(u))return W;return[...W,...z]})}function Yv(n,u){let b=hi(n);return b===void 0?void 0:u.get(b)}function kr(n,u){return n!==void 0&&n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.text===u}function Zv(n){if(kr(n.words[0],"git"))return kr(n.words[1],"commit");if(!kr(n.words[0],"gh")||!kr(n.words[2],"create"))return!1;return kr(n.words[1],"pr")||kr(n.words[1],"issue")}function Xv(n){return(kr(n.words[0],"cat")||kr(n.words[0],"tee")||Zv(n))&&!n.words.some(xf)&&!n.redirections.some((b)=>xf(b.target))}function xf(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}var ir="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Ks="Unsupported heredoc syntax",Qr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function sr(){return{id:"analysis.dynamic-shell-source",reason:Qr,intent:"stop_and_explain"}}var Df="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var sc=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Qv=new Set([...sc,"dir_path","glob","glob_pattern","include_pattern"]),Jv=new Set([...sc,"folder","glob","pattern","patterns"]);class E extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}class H extends Error{name="UnparseableCommandError";constructor(){super(ir)}}function Nf(n){let u=eR(),b=ye(n.input),W=[];if((n.route.kind==="command"||n.route.kind==="unknown")&&b)W.push({usage:"input-candidate",source:b});if(n.route.kind==="command"&&"command"in n&&n.command)W.push({usage:"declared-command",source:n.command});let z=W.reduce((B,Q)=>{let ee=B.findIndex((ve)=>ve.source===Q.source);if(ee!==-1){let ve=B[ee];if(!ve)return B;return B[ee]={...ve,usages:[...ve.usages,Q.usage]},B}let le=n.route.kind==="command"?n.route.shell:process.platform==="win32"?"powershell":"posix",ue=u.getCommandProgram(Q.source,le);return B.push({usages:[Q.usage],source:Q.source,program:ue,shell:u.getShellSyntax(Q.source,ue)}),B},[]);return{invocation:{toolName:n.toolName,route:n.route,context:n.context},commands:z,paths:tR(n),store:u}}function Mo(n,u){return n.commands.find((b)=>b.usages.includes(u))}function hr(n){return Mo(n,"declared-command")??Mo(n,"input-candidate")}function yr(n,u){if(!n.includes("$"))return n;return Ha(n,u)}function eR(){let n=new Map,u=new WeakMap,b=(z,B)=>{let Q=`${B}\x00${z}`,ee=n.get(Q);if(ee)return ee;let le=C(z,B);return n.set(Q,le),le};return{getShellSyntax:(z,B)=>{if(B&&B.source!==z)throw TypeError("Shell syntax source does not match command program source.");let Q=B??b(z,"posix"),ee=u.get(Q);if(ee)return ee;let le=Q.status==="limited"?{status:"structural-limit",source:z,program:Q,assignmentFallbacks:[]}:Pf(z,Q);return u.set(Q,le),le},getCommandProgram:b,readsAutoAsPowerShell:()=>[...n].some(([z,B])=>z.startsWith("auto\x00")&&B.dialect==="powershell")}}function tR(n){let u=n.route.kind==="grep"?Qv:n.route.kind==="glob"?Jv:sc;return[...Nu(n.input,u),...n.route.kind==="patch"||typeof n.input==="string"?Fu(n.input):[]]}var nR=new Set(["-S","--suffix"]);function Do(n,u,b,W,z){if(n.status==="structural-limit")throw new E;if(n.status!=="complete")return z.findMalformedTarget(n.source);return Vs(n,u,b,W,{segment:(B,Q)=>z.findSegmentTarget(B,Q),redirection:(B,Q)=>B.role==="file-write"&&z.isRedirectionTarget(kn(B.target,Q.variables),Q)?B.target:null})}function Ys(n){let u=[],b=null,W=!1;for(let z=0;z<n.length;z++){let B=n[z];if(B===void 0)break;if(!W&&B==="--"){W=!0;continue}if(!W&&(B==="-t"||B==="--target-directory")){b=n[++z]??null;continue}if(!W&&B.startsWith("--target-directory=")){b=B.slice(19);continue}if(!W&&B.startsWith("-t")&&B.length>2){b=B.slice(2);continue}if(!W&&nR.has(B)){z++;continue}if(!W&&(B.startsWith("--suffix=")||B.startsWith("--backup=")))continue;if(!W&&B.startsWith("-"))continue;u.push(B)}return b?{sources:u,destination:b}:{sources:u.slice(0,-1),destination:u.at(-1)??null}}var y="Git metadata and hooks are protected. Ask the user before modifying them.";function Gf(n,u,b,W){let z=n.invocation.context.executionCwd;if(!u)return null;if(n.invocation.route.kind==="patch"||n.invocation.route.kind==="path"||n.invocation.route.kind==="unknown"){if(fs(n.invocation.toolName))return null;let ee=n.paths.find((le)=>Lf(le,z,u,b,W,u.entries));return ee?{target:ee}:null}if(n.invocation.route.kind!=="command")return null;let B=hr(n);if(!B)return null;let Q=Do(B.shell,z,b,W,{findSegmentTarget:(ee,le)=>mR(ee,le,u,b,W),isRedirectionTarget:(ee,le)=>Lf(ee,le.cwd,u,b,W,u.markerFiles),findMalformedTarget:()=>null});return Q?{target:Q}:null}function Jr(n,u,b,W,z,B,Q=!1){if(!b)return!1;let ee=Xs(bn(n,u,z,B)),le=ee.replace(/(\/\.?\*+)+$/,"");if(le!==ee&&le!==""){if(ac(le,b))return!0;let ue=Q||ee.slice(le.length).includes("/."),ve=(Oe)=>ue?Zs(Oe,le):aR(Oe,le);if(b.markerFiles.some(ve))return!0;return W&&lc(b).some(ve)}if(ac(ee,b))return!0;return W&&lc(b).some((ue)=>Zs(ue,ee))}function aR(n,u){let b=Ff(u,n);if(b===""||b.startsWith("..")||Wf(b))return!1;return!b.split(/[\\/]/)[0]?.startsWith(".")}function lR(n,u,b,W,z){return Jr(n,u,b,!0,W,z)}function cR(n,u,b,W,z){if(!b)return!1;return ac(Xs(bn(n,u,W,z)),b)}function Lf(n,u,b,W,z,B){let Q=Xs(bn(n,u,W,z));return B.includes(Q)||$f(Q,b)}function zf(n,u,b,W,z){if(!b)return!1;return b.hooksDirectories.some((B)=>n.some((Q)=>Zs(B,Xs(bn(Q,u,W,z)))))}function ac(n,u){return u.entries.includes(n)||u.directories.includes(n)||$f(n,u)}function $f(n,u){return u.hooksDirectories.some((b)=>Zs(n,b))}var dR=50000;function Bf(n,u){let b=[...new Set(lc(n))];if(b.some((z)=>u(iR(z))))return!0;let W=0;while(b.length>0){let z=b.pop()??"",B=uR(z);if(!B)return!0;if(W+=B.length,W>dR)return!0;if(B.some((Q)=>u(Q.name)))return!0;b.push(...B.filter((Q)=>Q.isDirectory()).map((Q)=>sR(z,Q.name)))}return!1}function uR(n){try{let u=rR(n,{throwIfNoEntry:!1});if(!u)return[];if(!u.isDirectory())return u.isSymbolicLink()?null:[];return oR(n,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function lc(n){return[...n.entries,...n.directories,...n.hooksDirectories]}function Zs(n,u){let b=Ff(u,n);return b===""||!/^\.\.(?:[\\/]|$)/.test(b)&&!Wf(b)}function Xs(n){return process.platform==="win32"?n.toLowerCase():n}function mR(n,u,b,W,z){if(Ti(n))return null;let B=Ir([...n],W);if(Wt(B[0]??"").toLowerCase()!=="mv")return null;let Q=Ys(B.slice(1)),ee=Q.sources.find((le)=>lR(kn(le,u.variables),u.cwd,b,W,z));if(ee)return ee;return Q.destination&&cR(kn(Q.destination,u.variables),u.cwd,b,W,z)?Q.destination:null}var gR=process.platform==="win32",Uf=64,hR=16384;function uc(n,u,b,W){if(n.kind==="temp_target")return null;let z=W[n.kind];if(n.kind==="dynamic_target"&&!un(b,z.id,u.strict))return null;if(n.kind==="within_anchored_cwd"&&!un(b,z.id,u.paranoid))return null;return st(z.id,z.reason)}function No(n,u,b,W,z={}){return yR(n,u,z).map((B)=>Gt(uc(B,u,b,W),b)).find((B)=>B!==null)??null}function yR(n,u,b){let W=ar(n,u,b);if(W.kind==="cwd_self_target")return[W,ar(n,u,{...b,skipCwdSelf:!0})];if(W.kind!=="home_cwd_target")return[W];let z=ar(n,u,{...b,skipHomeCwd:!0});if(z.kind!=="cwd_self_target")return[W,z];return[W,z,ar(n,u,{...b,skipHomeCwd:!0,skipCwdSelf:!0})]}function to(n){let u=Pm(n,Uf,Uf,hR);return{expandedTargets:u&&"words"in u?u.words:void 0,unsafeBraceExpansion:u!==void 0&&"limited"in u,targetIsLiteral:u===void 0&&n.provenance==="literal"&&(n.quoted||n.raw!==n.text),tmpdirWordSplittingProtected:SR(n)}}function SR(n){let u=n.parts.filter((b)=>b.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(b.raw));return u.length>0&&u.every((b)=>CR(n.raw,b.span.start-n.span.start))}function CR(n,u){let b=null,W=!1;for(let z=0;z<u;z++){let B=n[z];if(W){W=!1;continue}if(B==="\\"&&b!=="'"){W=!0;continue}if(b===B){b=null;continue}if(b===null&&(B==="'"||B==='"'))b=B}return b==='"'}function Hn(n){let u=n.environment.home,b=n.environment.paths,W=n.budget??xn();return{anchoredCwd:n.originalCwd??n.cwd??null,resolvedCwd:n.cwd??null,strict:n.strict??!1,paranoid:n.paranoid??!1,trustTmpdirVar:n.allowTmpdirVar??!0,posixShell:n.posixShell??!1,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:n.trustedTmpdirValue??n.allowTmpdirVar??!0,environment:n.environment,allowRoots:xR(n.allowPaths,u,b,W),protectedGitMetadata:n.protectedGitMetadata,budget:W}}function ar(n,u,b={}){let W=b.targetIsLiteral??!1;if(!W&&u.tmpdirWordSplittingUnsafe&&!b.tmpdirWordSplittingProtected&&PR(n))return{kind:"outside_anchored_cwd"};let z=!W&&Vf(n,u.posixShell);if(dr(n))return{kind:"outside_anchored_cwd"};if(Ii(n,W))return{kind:"root_or_home_target"};if(vR(n,u,W))return{kind:"root_or_home_target"};if(u.resolvedCwd&&Jr(n,u.resolvedCwd,u.protectedGitMetadata,!0,u.environment,u.budget,!u.posixShell))return{kind:"git_metadata_target"};if(RR(n,u.trustTmpdirVar,u.posixShell,z,W,b.tmpdirWordSplittingProtected??!1,u.trustedTmpdirValue,u.environment))return{kind:"temp_target"};if(z){let Q=u.resolvedCwd??u.anchoredCwd;return!b.skipHomeCwd&&Q!==null&&Hf(Q,u.environment.home,u.environment.paths,u.budget)?{kind:"home_cwd_target"}:{kind:"dynamic_target"}}if(AR(n,u,W))return{kind:"temp_target"};let B=u.anchoredCwd;if(B){if(!b.skipHomeCwd&&[B,u.resolvedCwd??B].some((Q)=>Hf(Q,u.environment.home,u.environment.paths,u.budget)))return{kind:"home_cwd_target"};if(!b.skipCwdSelf&&[u.resolvedCwd??B,B].some((Q)=>OR(n,u.resolvedCwd??B,u.environment.paths,u.budget,Q)))return{kind:"cwd_self_target"};if(MR(n,B,u.resolvedCwd??B,z,W,u.environment.paths,u.budget))return{kind:"within_anchored_cwd"}}if(bR(n,u,z))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function bR(n,u,b){let W=n.trim();if(b||!u.resolvedCwd||!u.anchoredCwd||!W)return!1;if(Qs(W)||W.startsWith("~"))return!1;if(mc(W))return!1;if(qf(u.resolvedCwd,u.anchoredCwd,u.environment.paths,u.budget))return!1;return Io(eo(u.resolvedCwd,W),u.environment)}function ER(n,u,b={}){let{containmentTarget:W,...z}=b;if(ar(n,u,z).kind!=="temp_target")return!1;let B=n.trim();if(_R(B))return!1;if(Gs(B,u.environment))return!1;return![u.anchoredCwd,u.resolvedCwd].some((Q)=>qf(W??B,Q,u.environment.paths,u.budget))}function Ii(n,u=!1){let b=n.trim(),W=jf.normalize(b),z=b.replace(/\\/g,"/"),B=W==="/"?W:W.replace(/\/+$/,"");if(B==="/"||B.startsWith("/")&&B.slice(1).split("/").every((Q)=>/^\*+$/.test(Q)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(z)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(z))return!0;if(!u&&(W==="~"||W==="~/"||W==="~/*"))return!0;if(!u&&(W==="$HOME"||W==="$HOME/"||W==="$HOME/*"))return!0;if(!u&&(W==="${HOME}"||W==="${HOME}/"||W==="${HOME}/*"))return!0;return!1}function vR(n,u,b){let W=n.trim(),z=b?W:W==="*"?".":W.endsWith("/*")?W.slice(0,-2):W;if(!z)return!1;try{let B=Qs(z)?z:u.resolvedCwd?eo(u.resolvedCwd,z):null;if(!B)return!1;let Q=On(jt(B,u.environment.paths,u.budget));if(Q===pR(Q).root)return!0;return Q===On(jt(u.environment.home,u.environment.paths,u.budget))}catch{return!1}}function On(n){let u=fR(n);if(gR){if(u=u.replace(/\//g,"\\").toLowerCase(),u.length>3&&u.endsWith("\\"))u=u.slice(0,-1);return u}if(u.length>1&&u.endsWith("/"))u=u.slice(0,-1);return u}function RR(n,u,b,W,z,B,Q,ee){let le=n.trim();if(mc(le))return!1;if(!W&&Io(le,ee))return!0;return(u||B&&Q)&&b&&!z&&wR(le,b)}function wR(n,u){return["$TMPDIR","${TMPDIR}"].some((b)=>{if(n===b)return!0;if(!n.startsWith(`${b}/`))return!1;return!Vf(n.slice(b.length+1),u)})}function _R(n){let u=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(n);if(!u)return!1;return jf.normalize(`/${u[1]??""}`)==="/"}function mc(n){return n.split(/[\\/]+/).includes("..")}function xR(n,u,b,W){if(!n?.length)return[];return n.flatMap((z)=>{let B=mi(z.trim(),u);if(!Qs(B))return[];try{let Q=jt(B,b,W);if(fi(Q,jt(u,b,W)))return[];return[On(Q)]}catch{return[]}})}function AR(n,u,b){if(u.allowRoots.length===0)return!1;let W=n.trim();if(mc(W))return!1;let z=b?W:mi(W,u.environment.home),B=u.resolvedCwd??u.anchoredCwd,Q=Qs(z)?z:B?eo(B,z):null;if(!Q)return!1;try{let ee=On(jt(Q,u.environment.paths,u.budget));return u.allowRoots.some((le)=>ee===le||ee.startsWith(le.endsWith(dc)?le:`${le}${dc}`))}catch{return!1}}function PR(n){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n)}function Vf(n,u=!1){return n.includes("$")||n.includes("`")||TR(n)||u&&IR(n)}function TR(n){let u=!1;for(let b of n){if(u){u=!1;continue}if(b==="\\"){u=!0;continue}if(b==="*"||b==="?"||b==="[")return!0}return!1}function IR(n){let u=!1;for(let b=0;b<n.length;b++){let W=n[b];if(u){u=!1;continue}if(W==="\\"){u=!0;continue}if(W==="{"&&kR(n,b)||(W==="+"||W==="@"||W==="!")&&n[b+1]==="(")return!0}return!1}function kR(n,u){let b=n.indexOf("}",u+1);if(b===-1)return!1;let W=n.slice(u+1,b);return W.includes(",")||W.includes("..")}function Hf(n,u,b,W){try{return On(jt(n,b,W))===On(jt(u,b,W))}catch{try{return On(n)===On(u)}catch{return!1}}}function OR(n,u,b,W,z=u){if(z===u&&(n==="."||n==="./"||n===".\\"))return!0;try{return On(jt(eo(u,n),b,W))===On(jt(z,b,W))}catch{try{return On(eo(u,n))===On(z)}catch{return!1}}}function MR(n,u,b,W,z,B,Q){let ee=b??u;if(!z&&(n.startsWith("~")||n.startsWith("$HOME")||n.startsWith("${HOME}")))return!1;if(W)return!1;if(n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n))try{return cc(n,u,B,Q)}catch{return!1}if(n.startsWith("./")||n.startsWith(".\\")||!n.includes("/")&&!n.includes("\\"))try{return cc(eo(ee,n),u,B,Q)}catch{return!1}if(n.startsWith("../"))return!1;try{return cc(eo(ee,n),u,B,Q)}catch{return!1}}function cc(n,u,b,W){try{return Kf(jt(n,b,W),jt(u,b,W))}catch{return!1}}function qf(n,u,b,W){if(!u)return!1;try{return Kf(jt(u,b,W),jt(n,b,W))}catch{return!0}}function Kf(n,u){let b=On(n),W=On(u);return b.startsWith(`${W}${dc}`)||b===W}function Js(n,u){let b=u.envAssignments??new Map,W=ec(b,u.environment),z=u.trustedTmpdirValue??To(b,u.environment),B=u.allowTmpdirVar??!wi(b,u.environment),Q={environment:u.environment,protectedGitMetadata:u.protectedGitMetadata,cwd:u.cwd,originalCwd:u.originalCwd,strict:u.strict,allowTmpdirVar:B&&z&&Boolean(W),allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:u.tmpdirWordSplittingUnsafe??Kr(b,u.environment),trustedTmpdirValue:z,budget:u.budget},ee=Hn(Q),le=Hn({...Q,cwd:u.originalCwd??u.cwd}),ue=u.originalCwd&&u.environment.paths.realpath(u.originalCwd),ve=u.cwd&&u.environment.paths.realpath(u.cwd),Oe=ue&&ve&&!Pr(ve,ue)?u.cwd:void 0;return n.every((De)=>{let Me=to(De);if(Me.unsafeBraceExpansion||Me.expandedTargets?.length===0)return!1;return(Me.expandedTargets??[t(De)]).every((Ne)=>{let Le=/^\.\/*$/.test(Ne)?Oe:void 0,We=Le??Ne,Be={targetIsLiteral:Me.expandedTargets!==void 0||Me.targetIsLiteral,tmpdirWordSplittingProtected:Me.tmpdirWordSplittingProtected};if(!un(u.policy,"rm.recursive-force-paranoid",u.paranoid??!1)&&!Le&&ar(We,ee,Be).kind==="within_anchored_cwd")return!0;return ER(We,Le?le:ee,{...Be,containmentTarget:DR(We,W)})})})}function DR(n,u){if(!u)return n;return n.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>u)}var Lo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ki="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",pc=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),NR=new Set(["-p","--print"]),LR=new Map([["node",new Set(["-c","--check"])],["ruby",new Set(["-c"])]]),WR=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),FR=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),GR=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),zR=new Map([["python",new Set(["m"])]]),$R=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),BR=new Set(["always","default","never"]),UR=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),HR=/\\\r?\n/g,Yf=String.raw`\s*\(\s*(?:(?<quote>['"])(?<literal>[^'"\n]{1,256})\k<quote>|(?:os\.path\.)?expanduser\(['"]~/?['"]\)|(?:pathlib\.)?Path\.home\(\)|os\.environ\[['"]HOME['"]\]|os\.getenv\(['"]HOME['"]\)|\$ENV\{['"]?HOME['"]?\}|(?:\w+\.|require\(['"](?:node:)?os['"]\)\.)?homedir\(\)|process\.env\.HOME|Dir\.home(?:\(\))?|ENV\[['"]HOME['"]\])\s*`,jR=[new RegExp(String.raw`\b(?:rmtree|remove_tree|rm_rf|rm_r|remove_dir|remove_entry(?:_secure)?)${Yf}[,)]`,"g"),new RegExp(String.raw`\b(?:rmSync|rmdirSync|rm|rmdir)${Yf},\s*\{[^}]{0,256}?(?:\brecursive|(?<keyQuote>['"])recursive\k<keyQuote>)\s*:\s*true\b`,"g")],VR=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Zf(n){return ta(n).code}function ea(n){return ta(n).sources}function Xf(n){return VR.get(na(n))??[]}function ta(n){let u=na(n[0]??"");if(!pc.has(u))return{code:null,sources:[],optionsOpen:!1};let b=[],W=[],z=!0;for(let B=1;B<n.length;B++){let Q=n[B];if(Q===void 0)break;if(Q==="--")return Zn(u,b,W,z,n[B+1]===void 0?void 0:B+1,n[B+1]);if(Q===""||Q==="-"||!Q.startsWith("-"))return Zn(u,b,W,z,B,Q);if(u==="node"&&NR.has(Q)){let Oe=n[B+1];if(Oe===void 0)return Zn(u,b,W,z);if(Oe.startsWith("-"))continue;b.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),B++;continue}if(KR(u,Q)){let Oe=n[B+1];if(Oe===void 0)return Zn(u,b,W,z);if(b.push({tokenIndex:B+1,value:Oe}),W.push({tokenIndex:B+1,kind:"inline-code",value:Oe}),u==="python")return Zn(u,b,W,z);B++;continue}let ee=/^--eval=(.*)$/s.exec(Q);if(YR(u)&&ee){let Oe=ee[1]??"";b.push({tokenIndex:B,value:Oe}),W.push({tokenIndex:B,kind:"inline-code",value:Oe});continue}if(u==="node"){let Oe=qR(Q);if(Oe){if(Oe.attached){if(z&&=Oe.value!=="",Oe.value!=="")W.push({tokenIndex:B,kind:"module-file",value:Oe.value});continue}let De=n[B+1];if(De===void 0||De.startsWith("-"))return z=!1,Zn(u,b,W,z);W.push({tokenIndex:B+1,kind:"module-file",value:De}),B++;continue}}if(u==="python"&&Q.startsWith("--check-hash-based-pycs=")||u==="node"&&(Q==="--conditions="||Q==="--diagnostic-dir="||Q==="--title=")||u==="ruby"&&(Q==="--disable="||Q==="--enable="))return Zn(u,b,W,z);if($R.get(u)?.has(Q)){let Oe=n[B+1];if(Oe===void 0||Oe.startsWith("-")&&!(u==="ruby"&&UR.has(Q))||u==="python"&&!BR.has(Oe))return Zn(u,b,W,z);B++;continue}if(Q.startsWith("--"))continue;let le,ue=!1;for(let Oe=1;Oe<Q.length;Oe++){let De=Q[Oe];if(De===void 0)break;if(zR.get(u)?.has(De)){let Me=Q.slice(Oe+1),Ne=Me||n[B+1];if(Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});return Zn(u,b,W,z)}if(WR.get(u)?.has(De)){le=Q.slice(Oe+1)||n[B+1],ue=Oe+1===Q.length;break}if(u==="node"&&De==="r"){if(z&&=Q==="-r",Q==="-r"){let Me=n[B+1];if(z&&=Me!==void 0&&!Me.startsWith("-"),z&&Me!==void 0)W.push({tokenIndex:B+1,kind:"module-file",value:Me});B++}break}if(u==="ruby"&&De==="r"){let Me=Q.slice(Oe+1),Ne=Me||n[B+1];if(z&&=Ne!==void 0,Ne!==void 0)W.push({tokenIndex:Me?B:B+1,kind:"module-file",value:Ne});if(!Me)B++;break}if(u==="perl"&&(De==="M"||De==="m")){let Me=Q.slice(Oe+1);if(!Me){if(z=!1,Oe+1===Q.length)B++;break}W.push({tokenIndex:B,kind:"module-file",value:Me});break}if(FR.get(u)?.has(De)){if(Oe+1===Q.length)B++;break}if(GR.get(u)?.has(De)&&Oe+1<Q.length)break}if(le===void 0)continue;let ve=ue?B+1:B;if(b.push({tokenIndex:ve,value:le}),W.push({tokenIndex:ve,kind:"inline-code",value:le}),u==="python")return Zn(u,b,W,z);if(ue)B++}return Zn(u,b,W,z,void 0,void 0,!0)}function Zn(n,u,b,W,z,B,Q=!1){let ee=n==="node"?u.slice(-1):u,le=new Set(ee.map((ve)=>ve.tokenIndex)),ue=b.filter((ve)=>ve.kind!=="inline-code"||le.has(ve.tokenIndex));if(W&&u.length===0&&z!==void 0&&B!==void 0)ue.push({tokenIndex:z,kind:"main-script",value:B});return{code:(n==="node"?ee[0]?.value:ee.map((ve)=>ve.value).join(`
+`))||null,sources:W?ue:[],optionsOpen:W&&Q}}function qR(n){for(let u of["--import","--loader","--experimental-loader","--require"]){if(n===u)return{attached:!1,value:""};if(n.startsWith(`${u}=`))return{attached:!0,value:n.slice(u.length+1)}}return}function gc(n){let u=LR.get(na(n[0]??"")),b=n.findIndex((W,z)=>z>0&&(W==="-"||!W.startsWith("-")));return u!==void 0&&n.slice(1,b===-1?void 0:b).some((W)=>u.has(W))}function hc(n,u){return na(n)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(u)}function na(n){let u=Wt(n).toLowerCase();return as.test(u)?"python":u}function KR(n,u){return pc.get(n)?.has(u)??!1}function YR(n){return pc.get(n)?.has("--eval")??!1}function Oi(n,u,b=!1){let W=QR(n,u);if(Tn(u,W),jR.some((Q)=>Array.from(W.matchAll(Q)).some((ee)=>ee.groups?.literal===void 0||Ii(ee.groups.literal,!0))))return!0;if(!fc(W,u))return!1;Tn(u,W);let B=XR(W);if(fc(B,u))return!0;if(Tn(u,B),!Qf.test(B))return!1;return!b||ZR(W,u)}function ZR(n,u){if(/`|%x|\bqx\b/.test(n))return!0;let W=n.split(""),z=[];for(let le=0;le<n.length;le++){let ue=n[le];if(ue!=="'"&&ue!=='"')continue;let ve=n.startsWith(ue.repeat(3),le)?ue.repeat(3):ue,Oe=le+ve.length,De=Oe;while(De<n.length&&!n.startsWith(ve,De))De+=n[De]==="\\"?2:1;if(De>=n.length)return!0;z.push({start:Oe,text:n.slice(Oe,De)}),W.fill(" ",le,De+ve.length),le=De+ve.length-1}let B=W.join(""),Q=Array.from(B.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((le)=>Qf.test(le[1]??"")).map((le)=>{let ue=le.index+le[0].length;return{start:ue,end:ra(B,ue)}});if(Q.some((le)=>yc(B,le.start)))return!0;return z.some((le)=>{let ue=/\b(?:system|exec|spawn|popen)\s*$/.test(B.slice(0,le.start)),ve=Q.some((Oe)=>le.start>=Oe.start&&le.start<Oe.end);return(ue||ve)&&fc(le.text,u)})}function ra(n,u){let b=1;for(let W=u;W<n.length;W++){if(n[W]==="(")b++;if(n[W]===")")b--;if(b===0)return W}return n.length}function yc(n,u){let b=0;for(let W=u;W<n.length;W++){let z=n[W]??"";if("([{".includes(z))b++;if(")]}".includes(z)&&b--===0)return!1;if(z===","&&b===0)return!1;if(/[A-Za-z_$]/.test(z))return!0}return!1}var Qf=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function XR(n){let u=[],b=0,W=0;while(W<n.length){let z=n[W];if(z!=="'"&&z!=='"'){W++;continue}let B=n.startsWith(z.repeat(3),W)?z.repeat(3):z,Q=W+B.length;while(Q<n.length&&!n.startsWith(B,Q))Q+=n[Q]==="\\"?2:1;if(Q>=n.length)break;u.push(n.slice(b,W)," "),W=Q+B.length,b=W}return u.push(n.slice(b)),u.join("")}function fc(n,u){if(Ds(n,"rm",u))return!0;for(let W of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Tn(u,n),W.test(n))return!0;if(Ds(n,"dd",u))return!0;for(let W of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Tn(u,n),W.test(n))return!0;if(Ds(n,"find",u))return!0;let b=n.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((W)=>(Tn(u,n),b.some((z)=>Ns(z,W))))}function QR(n,u){return Tn(u,n),n.replace(HR,"")}var JR=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Jf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ew="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ep="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",tp="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",tw="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",nw="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",rw={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:tp},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:y},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:ep},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:tw},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Jf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ew},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Jf}};function np(n,u,b){return ow(n.words.map((W)=>({kind:"word",text:W.text,dynamic:W.provenance!=="literal"})),u,Hn({...b,allowPaths:b.policy?.destructiveCommandAllowPaths}),b.policy)}function ow(n,u,b,W){let z=n.filter((le)=>le.kind==="word"),B=sw(z),Q=z[B];if(!Q||!JR.has(gw(Q.text)))return null;let ee=iw(z.slice(B+1));if(ee.whatIfProtected)return null;if(un(W,"powershell.remove-item-pipeline-dynamic-target",b.strict)&&u&&(ee.targets.length===0||ee.recursive))return st("powershell.remove-item-pipeline-dynamic-target",nw);for(let le of ee.targets)if(!dr(le.text)&&Ii(Mi(le.text)))return st(ee.recursive&&ee.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",tp);for(let le of ee.targets)if(b.resolvedCwd&&Jr(Mi(le.text),b.resolvedCwd,b.protectedGitMetadata,ee.recursive,b.environment,b.budget,!0))return st("powershell.remove-item-git-metadata",y);if(!ee.recursive||!ee.force)return null;if(un(W,"powershell.remove-item-recursive-force-dynamic-target",b.strict)&&(ee.hasDynamicTarget||ee.targets.length===0))return st("powershell.remove-item-recursive-force-dynamic-target",ep);for(let le of ee.targets){let ue=No(Mi(le.text),b,W,rw);if(ue)return ue}return null}function iw(n){let u=[],b=!1,W=!1,z=!1,B=!1,Q=!1;for(let ee=0;ee<n.length;ee++){let le=n[ee];if(!le||le.kind!=="word")continue;if(aw(le))continue;if(Q){u.push(Sc(le)),B=B||le.dynamic;continue}if(le.text==="--"){Q=!0;continue}let ue=cw(le.text);if(!ue){u.push(Sc(le)),B=B||le.dynamic;continue}if(dw(ue.name)){let ve=ue.value?lw(ue.value,le):n[++ee];if(ve?.kind==="word"){u.push(Sc(ve)),B=B||ve.dynamic;continue}B=!0;continue}if(uw(ue.name)){b=!0;continue}if(mw(ue.name)){W=!0;continue}if(fw(ue.name))z=pw(ue.value)}return{targets:u,recursive:b,force:W,whatIfProtected:z,hasDynamicTarget:B}}function sw(n){let u=n[0];if(u?.kind==="word"&&u.text==="&"||u?.text===".")return n.length>1?1:0;return 0}function Sc(n){return{text:n.kind==="word"?n.text:"",dynamic:n.kind==="word"&&n.dynamic}}function aw(n){return n.kind==="word"&&n.text===","}function Mi(n){let u=n.replace(/\\/g,"/"),b=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(u);return b?`$HOME${u.slice(b[0].length)}`:u}function lw(n,u){return{kind:"word",text:n,dynamic:u.kind==="word"&&(u.dynamic||n.includes("$"))}}function cw(n){if(!n.startsWith("-")||n==="-")return null;let u=n.slice(1),b=u.indexOf(":");if(b===-1)return{name:u.toLowerCase()};return{name:u.slice(0,b).toLowerCase(),value:u.slice(b+1)}}function dw(n){return"path".startsWith(n)||"literalpath".startsWith(n)}function uw(n){return"recurse".startsWith(n)}function mw(n){return n.length>=2&&"force".startsWith(n)}function fw(n){return n==="wi"||"whatif".startsWith(n)}function pw(n){if(n===void 0||n==="")return!0;let u=n.toLowerCase();return u==="$true"||u==="true"}function gw(n){return n.toLowerCase()}import{sep as NP}from"node:path";var hw=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),yw=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Sw=new Set(["-o","--output","--query","--subscription"]),Cw=new Set;function rp(n){if(n==="aws")return hw;if(n==="gcloud")return yw;if(n==="az")return Sw;return Cw}var bw=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Ew=new Set;function op(n){if(n==="git")return Nn;if(n==="docker")return bw;return Ew}function F(n,u){if(n.length===0||u.length===0)return null;let b=Bt(n[0]??""),W=An(n);for(let z of u){if(!ww(b,z.command))continue;if(z.match){if(vw(b,n,z.match))return ip(z);continue}if(!_w(b,n,z.subcommand))continue;if(Aw(n,new Set(z.block_args),W))return ip(z)}return null}function ip(n){return{id:`custom.${n.name}`,reason:`[${n.name}] ${n.reason}`,intent:n.intent??"manual_only"}}function vw(n,u,b){let W=u.slice(1);if(b.exclude_args?.some((z)=>W.includes(z)))return!1;if(b.any_args&&!b.any_args.some((z)=>W.includes(z)))return!1;return Rw(W,b.command_path,rp(n))}function Rw(n,u,b){let W=0,z=!1;for(let B of n){if(W>=u.length)return!0;if(z){z=!1;continue}if(B.startsWith("-")){z=!B.includes("=")&&b.has(B);continue}if(B!==u[W])return!1;W++}return W>=u.length}function ww(n,u){return n===Bt(u)}function _w(n,u,b){if(!b)return!0;return sp(u,1,b,op(n))}function sp(n,u,b,W){let z=!1;for(let B=u;B<n.length;B++){let Q=n[B];if(!Q)continue;if(z){z=!1;continue}if(Q==="--"){let ee=n[B+1];if(ee&&!ee.startsWith("-"))return ee===b;return!1}if(W.has(Q)){z=!0;continue}if(Q.startsWith("-")){if(!Q.includes("=")&&xw(n,B,b,W))return!0;continue}return Q===b}return!1}function xw(n,u,b,W){let z=n[u+1];if(!z||z.startsWith("-"))return!1;return sp(n,u+2,b,W)}function Aw(n,u,b){return n.some((W)=>u.has(W))||[...b].some((W)=>u.has(W))}var Pw=new Set(["-e","--source"]),Tw=new Set(["-F","-v","--assign","--field-separator"]),ap=new Set(["-f","--file"]),Iw=new Set(["print","printf","return"]),lp=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],kw="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function cp(n,u,b){let W=!1;for(let z of Ow(n)){let B=Mw(z,b);if(!B)continue;for(let Q of B.commands){let ee=u(Q);if(ee)return ee;if(Q.includes("{}")||/[$`]/.test(Q))W=!0}W||=B.dynamic}return W?st("awk.system-dynamic",kw):null}function bc(n){let u=[],b=!1,W=!1,z=!0,B=!0;for(let Q=1;Q<n.length;Q++){let ee=n[Q];if(ee===void 0)break;if(z&&ee==="--"){z=!1;continue}if(z&&Pw.has(ee)){b=!0;let le=n[Q+1];if(B&&=le!==void 0,le!==void 0)u.push({tokenIndex:Q+1,kind:"inline-code",value:le});Q++;continue}if(z&&ee.startsWith("--source=")){b=!0,u.push({tokenIndex:Q,kind:"inline-code",value:ee.slice(9)});continue}if(z&&ee.startsWith("-e")&&ee.length>2){b=!0,u.push({tokenIndex:Q,kind:"inline-code",value:ee.slice(2)});continue}if(z&&(Tw.has(ee)||ap.has(ee))){let le=n[Q+1];if(B&&=le!==void 0,ap.has(ee)){if(W=!0,le!==void 0)u.push({tokenIndex:Q+1,kind:"program-file",value:le})}Q++;continue}if(z&&(ee.startsWith("-F")||ee.startsWith("-v")&&ee.slice(2).includes("=")))continue;if(z&&ee.startsWith("-f")&&ee.length>2){W=!0,u.push({tokenIndex:Q,kind:"program-file",value:ee.slice(2)});continue}if(z&&(ee.startsWith("--assign=")||ee.startsWith("--field-separator=")))continue;if(z&&ee.startsWith("--file=")){W=!0,u.push({tokenIndex:Q,kind:"program-file",value:ee.slice(7)});continue}if(z&&ee.startsWith("-")&&ee!=="-")continue;if(!b&&!W)u.push({tokenIndex:Q,kind:"main-program",value:ee});return{sources:u,optionsOpen:!1}}return{sources:B?u:[],optionsOpen:z&&B}}function Ni(n){return bc(n).sources}function Ow(n){return Ni(n).filter((u)=>u.kind!=="program-file").map((u)=>u.value)}function Mw(n,u){Tn(u,n);let b=n.includes("system")?Ec(n,u):null,W=Dw(n,u);if(!b&&!W)return null;return{dynamic:!!b?.dynamic||!!W?.dynamic,commands:[...b?.commands??[],...W?.commands??[]]}}function Ec(n,u){Tn(u,n);let b=[],W=!1,z=!1,B=0;while(B<n.length){let Q=n[B];if(Q==='"'||Q==="'"){B=ia(n,B,Q)?.endIndex??B+1;continue}if(Q==="#"){B=dp(n,B+1);continue}if(Q==="/"&&up(n,B)){B=mp(n,B+1)??B+1;continue}if(!n.startsWith("system",B)){B++;continue}let ee=B;if(B+=6,Di(n[ee-1])||Di(n[B]))continue;let le=oa(n,B);if(n[le]!=="(")continue;le=oa(n,le+1);let ue=n[le];if(ue!=='"'&&ue!=="'"){W=!0,z=!0;continue}let ve=ia(n,le,ue);if(!ve){W=!0,z=!0;continue}if(le=oa(n,ve.endIndex),W=!0,n[le]!==")"){z=!0,B=ve.endIndex;continue}b.push(ve.value),B=le+1}if(!W)return null;return{dynamic:z,commands:b}}function Dw(n,u){Tn(u,n);let b=[],W=!1,z=!1,B=0,Q=0,ee=null,le=null,ue=0;while(B<n.length){let ve=n[B];if(!ve)break;if(ve==='"'||ve==="'"){let Me=ia(n,B,ve);if(Me&&ue===Q)le={...Me,startIndex:B};ue=Me?.endIndex??B+1,B=Me?.endIndex??B+1;continue}if(ve==="#"){B=dp(n,B+1),Q=B,ee=null,le=null,ue=B;continue}if(ve==="/"&&up(n,B)){let Me=mp(n,B+1);ue=Me??B+1,B=Me??B+1;continue}if(`;
+{}`.includes(ve)){B++,Q=B,ee=null,le=null,ue=B;continue}if(ee===null&&(Cc(n,B,"print")||Cc(n,B,"printf")))ee=B;if(ve!=="|"||n[B-1]==="|"||n[B+1]==="|"){if(!/\s/.test(ve))ue=B+1;B++;continue}let Oe=n[B+1]==="&"?B+2:B+1,De=oa(n,Oe);if(Cc(n,De,"getline")){z=!0;let Me=Ww(Q,le,ue);if(W||=Me===null,Me!==null)b.push(Me);ue=Oe,B=Oe;continue}if(Gw(Q,ee)){z=!0;let Me=Lw(n,De);if(!Me){W=!0,ue=Oe,B=Oe;continue}if(!Nw(n,Me.endIndex)){W=!0,ue=Me.endIndex,B=Me.endIndex;continue}b.push(Me.value),ue=Me.endIndex,B=Me.endIndex;continue}ue=Oe,B++}if(!z)return null;return{dynamic:W,commands:b}}function Di(n){return!!n&&/[A-Za-z0-9_]/.test(n)}function oa(n,u){let b=u;while(/\s/.test(n[b]??""))b++;return b}function Nw(n,u){let b=u;while(/[\t\f\v\r ]/.test(n[b]??""))b++;let W=n[b];return!W||`;
+}#`.includes(W)}function ia(n,u,b){let W="",z=!1;for(let B=u+1;B<n.length;B++){let Q=n[B];if(!Q)break;if(z){let ee=Fw(n,B);if(!ee)return null;W+=ee.value,B=ee.endIndex,z=!1;continue}if(Q==="\\"){z=!0;continue}if(Q===b)return{value:W,endIndex:B+1};W+=Q}return null}function Lw(n,u){let b=n[u];if(b!=='"'&&b!=="'")return null;return ia(n,u,b)}function Ww(n,u,b){if(!u)return null;return u.startIndex>=n&&u.endIndex===b?u.value:null}function Fw(n,u){let b=n[u];if(!b)return null;if(b==="x"){let z=n.slice(u+1,u+3);if(!/^[0-9A-Fa-f]{2}$/.test(z))return null;return{value:String.fromCharCode(Number.parseInt(z,16)),endIndex:u+2}}if(/[0-7]/.test(b)){let z=/^[0-7]{1,3}/.exec(n.slice(u));if(!z)return null;return{value:String.fromCharCode(Number.parseInt(z[0],8)),endIndex:u+z[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[b]??b,endIndex:u}}function Cc(n,u,b){return n.startsWith(b,u)&&!Di(n[u-1])&&!Di(n[u+b.length])}function Gw(n,u){return u!==null&&u>=n}function dp(n,u){let b=n.indexOf(`
+`,u);return b===-1?n.length:b+1}function up(n,u){let b=zw(n,u);if(b===-1)return!0;if("{([,;!~=".includes(n[b]??""))return!0;let W=b;while(Di(n[W-1]))W--;return Iw.has(n.slice(W,b+1))}function zw(n,u){for(let b=u-1;b>=0;b--)if(!/\s/.test(n[b]??""))return b;return-1}function mp(n,u){let b=!1;for(let W=u;W<n.length;W++){let z=n[W];if(!z)break;if(b){b=!1;continue}if(z==="\\"){b=!0;continue}if(z==="/")return W+1}return null}var $w=new Set(["sudo","env","command","builtin"]),fp=new Set(["caffeinate","exec","nice","nohup","setsid","stdbuf","time","timeout"]);function pp(n){return fp.has(n)}function sa(n,u){let b=n[0];if(!b||!gp(Wt(b),u))return null;let W=Wt(b),z=n[1]==="--"?2:1,B=Bw(n,z,W,u),Q=B[0];if(Q===void 0)return null;return{wrapper:W,tokens:n.slice(Q),childIndex:Q,alternativeChildIndices:B.slice(1)}}function Bw(n,u,b,W){let z=n[1]==="--",B=[];for(let Q=u;Q<n.length;Q++){let ee=n[Q];if(!ee)continue;let le=Wt(ee)!==b&&Uw(ee,W);if(le)B.push(Q);if(!le&&ls.has(Bt(ee)))break;if(z)break}return B}function Uw(n,u){let b=Wt(n),W=Bt(n);return W==="git"||W==="unshare"||b==="busybox"||no(n)||sl.has(b)||Jm(W)||cs.has(W)||gp(b,u)||nn.has(W)||n==="$SHELL"||Ln(W)||Bn.has(W)||u.rules.some((z)=>z.command===b)}function gp(n,u){return fp.has(n)||u.transparentWrappers.includes(n)}function no(n){return $w.has(n.toLowerCase())}function ro(n,u){return{embedded:!1,cwd:n.cwd,originalCwd:u.originalCwd,effectiveCwd:n.cwd,envAssignments:n.envAssignments,allowTmpdirVar:u.allowTmpdirVar,worktreeMode:u.worktreeMode,wrappedByTransparent:!1}}function Xn(n,u){let b=u.policy??{rules:[],transparentWrappers:[]};return aa([...n],u.environment,u.cwd,u.cwd,new Map,new Map(u.envAssignments??[]),b,{iterations:0},!1)}function*aa(n,u,b,W,z,B,Q,ee,le){let ue=Zr(n,u,b,B);for(let[Me,Ne]of ue.envAssignments)B.set(Me,Ne),z.set(Me,Ne);let{tokens:ve,cwd:Oe}=ue;if(ue.envSplitValues){let Me=Yr(ue.envSplitValues,ve);if(!Me)throw new a("derivedCommandShape");vc(ee),yield*aa(Me,u,Oe,W,z,B,Q,ee,le);return}if(no(ve[0]??""))throw new a("wrapperPeelIterations");let De=sa(ve,Q);if(De){for(let Me of[De.childIndex,...De.alternativeChildIndices])vc(ee),yield*aa(Me===De.childIndex?De.tokens:ve.slice(Me),u,Oe,W,new Map(z),new Map(B),Q,ee,!0);return}if(jw(ve)){vc(ee),yield*aa(ve.slice(1),u,Oe,W,z,B,Q,ee,le);return}yield Hw(ve,Oe,W,z,B,le)}function Hw(n,u,b,W,z,B){return{tokens:n,cwd:u===null?void 0:u??b,wrapperCwd:u,wrapperEnvAssignments:W,envAssignments:z,head:Wt(n[0]??"").toLowerCase(),wrappedByTransparent:B}}function vc(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function jw(n){return Wt(n[0]??"").toLowerCase()==="busybox"&&n.length>1}function Rc(n,u){let b=[],W=u;while(W<n.length){let z=n[W];if(z===void 0||z===":::")break;b.push(z),W++}return{markerIndex:W<n.length&&n[W]===":::"?W:-1,templateTokens:b}}function Sr(n){let u=!1,b=!1;for(let W of n){if(W==="--")break;if(W==="-r"||W==="-R"||wc(W,"recursive")){u=!0;continue}if(W==="-f"||wc(W,"force")){b=!0;continue}if(W.startsWith("-")&&!W.startsWith("--")){if(W.includes("r")||W.includes("R"))u=!0;if(W.includes("f"))b=!0}}return u&&b}function la(n){let u=n.indexOf("--");return n.slice(1,u===-1?void 0:u).some((b)=>wc(b,"recursive")||/^-[A-Za-z]+$/.test(b)&&/[rR]/.test(b.slice(1)))}function wc(n,u){return n.length>2&&n.startsWith("--")&&u.startsWith(n.slice(2))}var Vw=["--init-file","--rcfile"],qw=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function jn(n){for(let u=1;u<n.length;u++){let b=n[u];if(!b)continue;if(b==="-c")return yp(n,u,!0);if(b.startsWith("-")&&b.includes("c")&&!b.startsWith("--")){let W=yp(n,u,!1);if(W!==null)return W}}return null}var hp=/^-[cn]+$/;function Qn(n){let u=n.slice(1);if(u.some((W)=>/^[-+]./.test(W)&&W!=="--"&&!hp.test(W)))return!1;let b=u.findIndex((W)=>!hp.test(W));return u.slice(0,b===-1?void 0:b).some((W)=>W.includes("n"))}var Kw=/^-[abcefhiklmnprstuvx]+$/;function ca(n){let u=n.findIndex((B,Q)=>Q>0&&!Kw.test(B)),b=u===-1||/^[-+]/.test(n[u]??"")?n.slice(1):n.slice(1,u+1);if(b.some((B)=>B.startsWith("+")))return!0;let W=b.filter((B)=>B.startsWith("-")&&!B.startsWith("--")&&B.includes("c"));if(W.length===0)return!1;let z=jn(n);if(z===null)return b.some((B)=>B.startsWith("-")&&!W.includes(B));return/^[-+]/.test(z)||W.some((B)=>/[oO]/.test(B))}function yp(n,u,b){if(n[u+1]==="--")return n[u+2]||null;let W=n[u+1];if(!W||!b&&W.startsWith("-"))return null;return W}function Sp(n){let u=Wt(n[0]??"").toLowerCase(),b=Yw(n,u),W=qw.get(u)??null,z=b.argvSource?.kind!=="absent";return{argvSource:u==="bash"?b.argvSource:null,argvSourceApplies:u==="bash"&&b.interactive&&b.argvSource?.kind==="literal",envName:W,envSourceApplies:z&&(W==="BASH_ENV"?!b.interactive:W==="ENV"&&b.interactive)}}function Yw(n,u){let b=Pn(n),W=b.commandIndex??b.scriptIndex??n.length,z=[],B=!1,Q=!0;for(let ee=1;ee<W;ee++){let le=n[ee];if(le===void 0||le==="--"||le==="-"||le[0]!=="-"&&le[0]!=="+")break;if(le.startsWith("--")){if(u==="bash"&&Q?Vw.find((De)=>le===De):void 0){let De=n[ee+1];z.push(De===void 0?{kind:"absent"}:{kind:"literal",value:De}),ee++;continue}let Oe=le.split("=",1)[0]??le;if(u==="bash"&&ol.has(Oe)&&!le.includes("="))ee++;continue}if(u==="bash")Q=!1;let ue=il(u,le,n[ee+1],"startup");if(ue.interactive)B=le[0]==="-";ee+=ue.followingValues}return{argvSource:z.at(-1)??null,interactive:B}}var Zw="find -delete permanently removes files. Use -print first to preview.",Xw="find -exec rm -rf is dangerous. Use explicit file list instead.",Qw=new Set(["-exec","-execdir","-ok","-okdir"]),Jw=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((n)=>[n,1]),["-fprintf",2]]);function Cp(n,u){let b=n.map(t),W=e_(n,b,u);if(W)return W;if(da(b,1)&&!s_(n,b,u)){let Q=Gt(st("find.delete",Zw),u.policy);if(Q)return Q}let z=u.budget??xn(),B=0;while(B<b.length){let Q=b[B],ee=Cr(Q??"");if(ee>0){B+=ee+1;continue}if(!lr(Q)){B++;continue}z.charge("derivedTokens",b.length-B-1);let le=Wo(b,B);B=le.nextIndex;let ue=a_(le.tokens,u.environment);if(ue){let Me=Gt(ue,u.policy);if(Me)return Me}let ve=Q==="-execdir"||Q==="-okdir",Oe=u.analyzeTokens?.(le.tokens,ve?null:u.cwd)??null,De=Oe?.id.startsWith("custom.")?Oe:Gt(Oe,u.policy);if(De)return De}return null}function e_(n,u,b){if(!da(u,1)&&!_c(u,b.environment))return null;let z=Li(n)??tn(["."]),B=Hn({...b,allowPaths:b.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let Q of z){let ee=to(Q);for(let le of ee.expandedTargets??[t(Q)]){let ue=ar(le,B,{targetIsLiteral:ee.expandedTargets!==void 0||ee.targetIsLiteral,tmpdirWordSplittingProtected:ee.tmpdirWordSplittingProtected});if(ue.kind==="root_or_home_target")return st("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ue.kind==="git_metadata_target"&&!t_(n,B.protectedGitMetadata,b.environment))return st("find.delete-git-metadata",y)}}if(i_(u)&&B.resolvedCwd&&zf(z.map(t),B.resolvedCwd,B.protectedGitMetadata,B.environment,B.budget))return st("find.delete-git-metadata",y);return null}function t_(n,u,b){if(!u)return!1;let W=n.map(t),z=[],B=!1,Q=Li(n)?.at(-1),ee=Q?n.indexOf(Q)+1:1;while(ee<W.length){let le=W[ee]??"";if(lr(le)){let ue=Wo(W,ee),ve=Ir([...ue.tokens],b),Oe=la(ve),De=nn.has(Wt(ve[0]??"").toLowerCase()),Me=ue.tokens.some((Le)=>Le!=="{}"&&Le.includes("{}")),Ne=(le==="-execdir"||le==="-okdir")&&ve.slice(1).some((Le)=>Le!=="{}"&&!Le.startsWith("-"));if(Oe||De||Me||Ne)return!1;B=!0,ee=ue.nextIndex;continue}if(le==="-delete"){B=!0,ee++;continue}if(le==="-name"||le==="-iname"){let ue=n[ee+1];if(!(ue?.provenance==="literal"&&!/[[\\]/.test(ue.text)))return!1;if(!B)z.push(r_(ue.text,le==="-iname"));ee+=2;continue}if(!n_.has(le))return!1;ee+=1+Cr(le)}return z.length>0&&!Bf(u,(le)=>z.every((ue)=>ue.test(le)))}var n_=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function r_(n,u){let b=n.replace(/[*?]|[.+^${}()|\]/]/g,(W)=>W==="*"?".*":W==="?"?".":`\\${W}`);return new RegExp(`^${b}$`,u?"isu":"su")}var o_=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function _c(n,u){let b=0;while(b<n.length){if(!lr(n[b])){b++;continue}let W=Wo(n,b),z=Ir([...W.tokens],u),B=Wt(z[0]??"").toLowerCase(),Q=nn.has(B)&&o_.test((jn(z)??"").replace(/["'\\]/g,""));if((B==="rm"||B==="rmdir"||Q)&&z.some((le)=>le.includes("{}")))return!0;b=W.nextIndex}return!1}function i_(n){return n.some((u,b)=>{if(!["-name","-iname"].includes(u))return!1;return n[b+1]?.toLowerCase()==="hooks"})}function s_(n,u,b){if(u.includes("-L")||u.includes("-f")||u.includes("-follow"))return!1;let W=Li(n);return W!==null&&Js(W,b)}function Li(n){let u=(z)=>{let B=n[z];return B?t(B):void 0},b=1;while(u(b)==="-H"||u(b)==="-P")b++;if(u(b)==="--")b++;let W=[];while(b<n.length){let z=u(b),B=n[b];if(!z||!B||z.startsWith("-")||["!","(",")"].includes(z))break;W.push(B),b++}return W.length>0?W:null}function a_(n,u){let b=or([...n],u);if(b.length===0)return null;let W=Wt(b[0]??"");if(W==="busybox"&&b.length>1)b=b.slice(1),W=Wt(b[0]??"");if(W==="rm"&&Sr(b))return st("find.exec-rm-recursive-force",Xw);return null}function Wo(n,u){let b=u+1;while(b<n.length&&n[b]!==";"&&!(n[b]==="+"&&n[b-1]==="{}"))b++;return{tokens:n.slice(u+1,b),nextIndex:Math.min(b+1,n.length)}}function da(n,u){let b=u;while(b<n.length){let W=n[b];if(!W){b++;continue}if(lr(W)){b=Wo(n,b).nextIndex;continue}let z=Cr(W);if(z>0){b+=z+1;continue}if(W==="-delete")return!0;b++}return!1}function Cr(n){return Jw.get(n)??(/^-newer[A-Za-z]{2}$/.test(n)?1:0)}function lr(n){return n!==void 0&&Qw.has(n)}import{resolve as Fx}from"node:path";function*xc(n){for(let u of n.nodes)yield*l_(u)}function Ac(n){return[...xc(n)]}function Ft(n){return Ac(n).map((u)=>u.words.map((b)=>b.text))}function Wi(n){let u=C(n,"posix");if(u.status!=="complete"||u.nodes.length!==1)return null;let b=u.nodes[0];if(b?.kind!=="command")return null;if(b.redirections.length>0||b.nested.length>0)return null;if(b.words.some((W)=>W.provenance==="command-substitution"))return null;return b.words.map((W)=>W.text)}function*l_(n){if(n.kind==="command"){yield n;for(let u of n.nested)yield*xc(u);return}if(n.kind==="group")yield*xc(n.body)}var c_=5,Pc="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function hn(n){let u=n.indexOf("--");if(u===-1)return{index:-1,before:n,after:[]};return{index:u,before:n.slice(0,u),after:n.slice(u+1)}}function Ep(n,u,b){let W=Fo(n,u,b),z=d_(W.entries);if(z.size===0)return{blockedReason:W.blockedReason,expanded:!1,tokens:n};let B=n,Q=!1;for(let ee=0;ee<c_;ee++){let{subcommand:le,rest:ue}=Fn(B),ve=le?.toLowerCase();if(!ve||!z.has(ve))return{blockedReason:W.blockedReason,expanded:Q,tokens:B};let Oe=z.get(ve),De=g_(Oe);if(De===null||De.length===0)return{blockedReason:Pc,expanded:!0,tokens:B};B=["git",...De,...ue],Q=!0}return{blockedReason:Pc,expanded:!0,tokens:B}}function vp(n,u,b){return Fo(n,u,b).entries.some((W)=>W.key.toLowerCase()==="core.sshcommand")}function Fn(n){if(n.length===0)return{subcommand:null,rest:[]};let u=n[0];if((u?Wt(u).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--"){let B=n[W+1];if(B&&!B.startsWith("-"))return{subcommand:B,rest:n.slice(W+2)};return{subcommand:null,rest:n.slice(W+1)}}if(!z.startsWith("-"))return{subcommand:z,rest:n.slice(W+1)};W+=Nn.has(z)?2:1}return{subcommand:null,rest:[]}}function d_(n){let u=new Map;for(let b of n){let W=b.key.toLowerCase();if(!W.startsWith("alias."))continue;let z=W.slice(6);if(z!=="")u.set(z,b.value)}return u}function Fo(n,u,b){if(n.length===0)return{blockedReason:null,entries:[]};let W=n[0];if((W?Wt(W).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let B=m_(u,b);return{blockedReason:B.blockedReason,entries:[...B.entries,...u_(n,u,b)]}}function u_(n,u,b){let W=[],z=1;while(z<n.length){let B=n[z];if(!B||B==="--"||!B.startsWith("-"))return W;if(B==="-c"){let Q=Tc(n[z+1]);if(Q)W.push(Q);z+=2;continue}if(B.startsWith("-c")&&B.length>2){let Q=Tc(B.slice(2));if(Q)W.push(Q);z++;continue}if(B==="--config-env"){let Q=bp(n[z+1],u,b);if(Q)W.push(Q);z+=2;continue}if(B.startsWith("--config-env=")){let Q=bp(B.slice(13),u,b);if(Q)W.push(Q);z++;continue}if(Nn.has(B)){z+=2;continue}z++}return W}function m_(n,u){let b=f_(n,u),W=p_(n,u);return{blockedReason:b===null||W===null?Pc:null,entries:[...b??[],...W??[]]}}function f_(n,u){let b=pr("GIT_CONFIG_PARAMETERS",n,u);if(b===void 0)return[];let W=[],z=Wi(b);if(!z)return null;for(let B of z){let Q=Tc(B);if(!Q)return null;W.push(Q)}return W}function p_(n,u){let b=pf(n,u);if(b.state==="absent")return[];if(b.state==="invalid")return null;let W=[];for(let z=0;z<b.count;z++){let B=pr(`GIT_CONFIG_KEY_${z}`,n,u)?.trim(),Q=pr(`GIT_CONFIG_VALUE_${z}`,n,u);if(!B||Q===void 0)return null;W.push({key:B,value:Q})}return W}function Tc(n){if(!n)return null;let u=n.indexOf("=");return{key:(u===-1?n:n.slice(0,u)).trim(),value:u===-1?void 0:n.slice(u+1)}}function bp(n,u,b){let W=n?.indexOf("=")??-1;if(!n||W===-1)return null;return{key:n.slice(0,W).trim(),value:pr(n.slice(W+1),u,b)}}function g_(n){let u=n?.trimStart();if(!u||u.startsWith("!"))return null;return Wi(u)}var h_="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",y_="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",S_="git checkout --force discards uncommitted changes. Use 'git stash' first.",C_="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",b_="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",E_="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",v_="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",R_="git switch --force discards uncommitted changes. Use 'git stash' first.",w_="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",__="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",x_="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",A_="git reset --merge can lose uncommitted changes. Use 'git stash' first.",P_="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",T_="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",I_="git push --force destroys remote history. Use --force-with-lease for safer force push.",k_="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",O_="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",M_="git branch -D force-deletes without merge check. Use -d for safe delete.",D_="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",N_="git merge --abort discards merge conflict resolutions. Use 'git status' first.",L_="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",W_="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",F_="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",G_="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",z_="git worktree remove --force can delete uncommitted changes. Remove --force flag.",$_=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),B_=new Set(["--recurse-submodules","--track","-t"]),Ic=new Set(["-b","-B","-U"]),kc=new Set(["-c","-C"]),U_=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Ht(n,u){let b=n.split("=",1)[0]??n;return b.length>=4&&u.startsWith(b)&&b.startsWith("--")&&b.slice(2).length>=2}var Go=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function wp(n,u){let{subcommand:b,rest:W}=Fn(n);if(!b)return null;switch(b.toLowerCase()){case"checkout":return Or(H_(W,u));case"switch":return Or(V_(W));case"restore":return Or(K_(W));case"reset":return Z_(W);case"clean":return Or(Q_(W));case"rm":return Or(J_(W));case"push":return oo(ex(W));case"branch":return oo(rx(W));case"stash":return oo(lx(W));case"worktree":return oo(cx(W));case"rebase":return Or(ox(W));case"merge":return Or(ix(W));case"tag":return oo(sx(W));case"reflog":return oo(ax(W));default:return null}}function Or(n){return n?{...n,localDiscard:!0}:null}function oo(n){return n?{...n,localDiscard:!1}:null}function H_(n,u){let{index:b,before:W}=hn(n),z=An(W,{shortOptsWithValue:Ic});if(W.some((ee)=>Ht(ee,"--force"))||z.has("-f"))return st("git.checkout-force",S_);for(let ee of n){if(ee==="-b"||ee==="-B"||ee==="--orphan")return null;if(Ht(ee,"--pathspec-from-file"))return st("git.checkout-pathspec-from-file",b_)}if(b!==-1){if(W.some((le)=>!le.startsWith("-")))return st("git.checkout-ref-path",C_);return st("git.checkout-double-dash",h_)}let B=q_(n);if(B.length>=2)return st("git.checkout-ambiguous",E_);let Q=B[0];if(Q===void 0||z.has("-d")||z.has("-t")||n.some((ee)=>Ht(ee,"--detach")||Ht(ee,"--track")))return null;if(j_(Q)||u(Q))return st("git.checkout-double-dash",y_);return null}function j_(n){return n==="."||n===".."||/^\.\.?[/\\]/.test(n)||/^([/\\]|[A-Za-z]:[/\\])/.test(n)||n.endsWith("/")||n.startsWith(":")||/[*?[]/.test(n)}function V_(n){let{before:u}=hn(n);if(u.some((W)=>Ht(W,"--discard-changes")))return st("git.switch-discard-changes",v_);let b=An(u,{shortOptsWithValue:kc});if(u.some((W)=>Ht(W,"--force"))||b.has("-f"))return st("git.switch-force",R_);return null}function q_(n){let u=[],b=0;while(b<n.length){let W=n[b];if(!W)break;if(W==="--")break;if(!W.startsWith("-")){u.push(W),b++;continue}if($_.has(W)){b+=2;continue}if(B_.has(W)){let z=n[b+1],B=W==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];b+=z&&!z.startsWith("-")&&B.includes(z)?2:1;continue}b++}return u}function K_(n){let u=Y_(n);if(u.isTerminal||!u.hasPathspec&&!u.hasPatch||!u.hasWorktree)return null;return u.hasExplicitLocation?st("git.restore-worktree",__):st("git.restore-unstaged",w_)}function Y_(n){let u=!1,b=!1,W=!0,z=!1,B=(Q)=>{if(!z)W=!1,z=!0;if(Q!==void 0)W=Q};for(let Q=0;Q<n.length;Q++){let ee=n[Q];if(ee===void 0)break;if(ee==="--"){u||=Q+1<n.length;break}if(ee==="--pathspec-from-file"){u=!0,Q++;continue}if(ee.startsWith("--pathspec-from-file=")){u=!0;continue}if(ee==="-h"||ee==="--help"||ee==="--version")return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ee==="--staged"){B();continue}if(ee==="--no-staged"){B();continue}if(ee==="--worktree"){B(!0);continue}if(ee==="--no-worktree"){B(!1);continue}if(ee==="--patch"){b=!0;continue}if(ee==="--no-patch"){b=!1;continue}if(U_.has(ee)){Q++;continue}if(ee.startsWith("--"))continue;if(ee==="-"){u=!0;continue}if(!ee.startsWith("-")){u=!0;continue}for(let le=1;le<ee.length;le++){let ue=ee.charAt(le);if(ue==="h")return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!0};if(ue==="S"){B();continue}if(ue==="W"){B(!0);continue}if(ue==="p"){b=!0;continue}if(ue==="s"||ue==="U"){if(le===ee.length-1)Q++;break}}}return{hasPathspec:u,hasPatch:b,hasWorktree:W,hasExplicitLocation:z,isTerminal:!1}}function Z_(n){let u=null;for(let b of n){if(Ht(b,"--hard")){u=st("git.reset-hard",x_);break}if(Ht(b,"--merge")){u=st("git.reset-merge",A_);break}}if(!u)return null;return X_(n)?oo(u):Or(u)}function X_(n){for(let u of n){if(u==="--")return!1;if(!u.startsWith("-"))return!0}return!1}function Q_(n){for(let b of n)if(b==="-n"||Ht(b,"--dry-run"))return null;let u=An(n.filter((b)=>b!=="--"));if(n.some((b)=>Ht(b,"--force"))||u.has("-f"))return st("git.clean-force",P_);return null}function J_(n){let u=!1,b=!1,W=!1;for(let z of hn(n).before){if(Ht(z,"--no-force")){u=!1;continue}if(Ht(z,"--force")){u=!0;continue}if(Ht(z,"--no-cached")){b=!1;continue}if(Ht(z,"--cached")){b=!0;continue}if(Ht(z,"--no-dry-run")){W=!1;continue}if(Ht(z,"--dry-run")){W=!0;continue}let B=An([z]);u||=B.has("-f"),W||=B.has("-n")}return u&&!b&&!W?st("git.rm-force",T_):null}function ex(n){let{before:u,after:b}=hn(n),W=An(u);if(u.some((Q)=>Ht(Q,"--mirror")))return st("git.push-mirror",O_);if(u.some((Q)=>Ht(Q,"--force"))||W.has("-f")||Rp(u,b).some(tx))return st("git.push-force",I_);if(u.some((Q)=>Ht(Q,"--delete"))||W.has("-d")||Rp(u,b).some(nx))return st("git.push-delete",k_);return null}function Rp(n,u){return[...n.filter((b)=>b!==""&&!b.startsWith("-")),...u]}function tx(n){return n.startsWith("+")||n.includes(":+")}function nx(n){return n.length>1&&n.startsWith(":")}function rx(n){let{before:u}=hn(n),b=An(u),W=b.has("-D")||b.has("-d")||u.some((B)=>Ht(B,"--delete")),z=b.has("-D")||b.has("-f")||u.some((B)=>Ht(B,"--force"));if(W&&z)return st("git.branch-force-delete",M_);return null}function ox(n){let{before:u}=hn(n);return u.some((b)=>Ht(b,"--abort"))?st("git.rebase-abort",D_):null}function ix(n){let{before:u}=hn(n);return u.some((b)=>Ht(b,"--abort"))?st("git.merge-abort",N_):null}function sx(n){let{before:u}=hn(n);return An(u).has("-d")||u.some((W)=>Ht(W,"--delete"))?st("git.tag-delete",L_):null}function ax(n){return n[0]==="delete"?st("git.reflog-delete",W_):null}function lx(n){for(let u of n){if(u==="drop")return st("git.stash-drop",F_);if(u==="clear")return st("git.stash-clear",G_)}return null}function cx(n){let{before:u}=hn(n);if(!u.includes("remove"))return null;let W=An(u);if(u.some((z)=>Ht(z,"--force"))||W.has("-f"))return st("git.worktree-remove-force",z_);return null}import{isAbsolute as Mx,join as Dx,resolve as Nx}from"node:path";var Mc="TMPDIR",Dc="IFS",xp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Ap=/^[A-Za-z_][A-Za-z0-9_]*$/,Pp=new Set(["export","typeset","declare","readonly"]),dx=new Set(["builtin","command","time"]),ux=new Set(["do","then","else"]),mx=new Set(["do","then","case"]),_p=new Set(["done","fi","esac"]),fx=/^[A-Za-z_][A-Za-z0-9_]*=~(?:\/|$)/,px=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function zo(n,u){return new Map([["HOME",u.home],...typeof u.cwd==="string"?[["PWD",u.cwd]]:[],...n])}function $o(n,u){return n.provenance==="literal"&&!n.quoted&&n.raw===n.text&&n.raw.startsWith("~/")?`${u}${n.raw.slice(1)}`:null}function Tp(n,u,b){let W=zo(u.shellAssignments,b);return n.map((z)=>{if(!Lp(z.text))return t(z);if(z.provenance==="variable")return Ip(z.text,W);if(z.provenance==="command-substitution")return hx(z,b.darwinUserTempDir)??t(z);return z.provenance==="literal"&&fx.test(z.raw)?z.text.replace("=~",`=${W.get("HOME")}`):t(z)})}function Ip(n,u){return n.replace(px,(b,W,z)=>u.get(W??z??"")??b)}var gx=new Set(["$(getconf DARWIN_USER_TEMP_DIR)","`getconf DARWIN_USER_TEMP_DIR`"]);function hx(n,u){if(n.provenance!=="command-substitution")return null;let b=n.parts.map((z)=>{if(z.provenance==="command-substitution")return gx.has(z.raw)?u():null;return z.provenance==="literal"&&!/[$`\\']/.test(z.raw)?z.raw.replaceAll('"',""):null});if(!b.every((z)=>z!==null))return null;let W=b.join("");return/[\s$`*?[]/.test(W)?null:W}function Jn(n,u){let b=n.parts.every((z)=>z.provenance!=="literal"||!/[$`]/.test(z.raw));if(n.provenance!=="variable"||!b)return null;let W=Ip(n.text,u);return/^[~-]/.test(W)||/[\s$`*?[]/.test(W)?null:W}function kp(n,u){return{env:n,effectiveEnvAssignments:bx(n,u),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Op(n){return{env:n.env,effectiveEnvAssignments:n.effectiveEnvAssignments?new Map(n.effectiveEnvAssignments):void 0,shellAssignments:new Map(n.shellAssignments),bodyDepth:n.bodyDepth,bodyAssignments:new Set(n.bodyAssignments)}}function Nc(n,u){let b=Dp(n,u),W=n[0]??"";if(mx.has(W))u.bodyDepth+=1;if(W==="elif"||_p.has(W))u.bodyDepth=Math.max(0,u.bodyDepth-1);if(_p.has(W)&&u.bodyDepth===0)u.bodyAssignments.forEach((ee)=>{u.shellAssignments.delete(ee)}),u.bodyAssignments.clear();b.assignments.filter((ee)=>ee.persists).forEach((ee)=>{if(u.shellAssignments.set(ee.name,ee.value),u.bodyDepth>0)u.bodyAssignments.add(ee.name);Lc(u,ee)});let z=b.commandIndex;if(z!==-1&&Pp.has(n[z]??""))n.filter((ee)=>Ap.test(ee)&&Oc(ee)).forEach((ee)=>{Ex(u,ee)});let B=z===-1?-1:Np(n,z);if(B===-1||n[B]!=="unset")return;let Q=Rx(n,B);if(Q===null)return;n.slice(Q).forEach((ee)=>{if(u.bodyDepth>0){u.shellAssignments.set(ee,"");return}vx(u,ee)})}function Mp(n,u){let b=Dp(n,u).assignments;if(b.length===0)return u.effectiveEnvAssignments;let W=new Map(u.effectiveEnvAssignments??[]);return b.forEach((z)=>{W.set(z.name,z.value)}),W}function Dp(n,u){let b=ux.has(n[0]??"")?1:0,W=n.findIndex((ee,le)=>le>=b&&!Lp(ee)),z=W!==-1&&Pp.has(n[Np(n,W)]??""),B=Cx(u);return{assignments:n.flatMap((ee,le)=>{let ue=yx(ee,B,u.env);if(!ue)return[];if(W!==-1&&le>W&&!z&&!zs(ue.name))return[];return B.set(ue.name,ue.value),[{...ue,persists:W===-1||z}]}),commandIndex:W}}function Np(n,u){let b=u;while(dx.has(n[b]??"")){b+=1;while(n[b]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(n[b]??""))return u;b+=1}}return b}function Lp(n){return In(n)!==null||xp.test(n)}function yx(n,u,b){return In(n)??Sx(n,u,b)}function Sx(n,u,b){let W=$s(n,b,u);if(W)return W;let z=n.match(xp)?.[1];if(!z)return null;let B=n.indexOf("=");return{name:z,value:`${u.has(z)?u.get(z):b.get(z)??""}${n.slice(B+1)}`}}function Oc(n){return n===Mc||n===Dc||nc(n)}function Cx(n){return new Map([...n.effectiveEnvAssignments??[],...n.shellAssignments])}function bx(n,u){let b=[Mc,Dc].map((W)=>{let z=n.get(W);return z===void 0?null:[W,z]}).filter((W)=>W!==null);if(b.length===0)return u;return new Map([...b,...u??[]])}function Lc(n,u){let b=new Map(n.effectiveEnvAssignments??[]);b.set(u.name,u.value),n.effectiveEnvAssignments=b}function Ex(n,u){Lc(n,{name:u,value:n.shellAssignments.get(u)??n.effectiveEnvAssignments?.get(u)??n.env.get(u)??""})}function vx(n,u){if(!Oc(u)&&!Ap.test(u))return;if(n.shellAssignments.set(u,""),zs(u)&&n.env.has(u)){let W=new Map(n.env);W.delete(u),n.env=W}if(!Oc(u)||u===Mc||u===Dc||oi(u)){Lc(n,{name:u,value:""});return}if(!n.effectiveEnvAssignments?.has(u))return;let b=new Map(n.effectiveEnvAssignments);b.delete(u),n.effectiveEnvAssignments=b.size===0?void 0:b}function Rx(n,u){let b=u+1;while(b<n.length){let W=n[b];if(!W)return null;if(W==="--")return b+1;if(W==="-v"){b++;continue}if(W.startsWith("-"))return null;return b}return b}import{dirname as Fp,join as ua,resolve as wx}from"node:path";function ma(n,u){return tc.some((b)=>u?.has(b)||n.has(b))}function Bo(n,u,b){if(!u)return{gitCwd:null,hasExplicitGitContext:!1};let W=b.realpath(wx(u));if(W===null||!b.isDirectory(W))return{gitCwd:null,hasExplicitGitContext:!1};let z=W,B=!1,Q=1;while(Q<n.length){let ee=n[Q];if(!ee)break;if(ee==="--")break;if(!ee.startsWith("-"))break;if(ee==="-C"){let le=n[Q+1];if(!le)return{gitCwd:null,hasExplicitGitContext:B};let ue=Wp(z,le,b);if(!ue)return{gitCwd:null,hasExplicitGitContext:B};z=ue,Q+=2;continue}if(ee.startsWith("-C")&&ee.length>2){let le=Wp(z,ee.slice(2),b);if(!le)return{gitCwd:null,hasExplicitGitContext:B};z=le,Q++;continue}if(ee==="--git-dir"||ee==="--work-tree"){B=!0,Q+=2;continue}if(ee.startsWith("--git-dir=")||ee.startsWith("--work-tree=")){B=!0,Q++;continue}Q+=Nn.has(ee)?2:1}return{gitCwd:z,hasExplicitGitContext:B}}function Wp(n,u,b){try{let W=Tr(n,u,b);return b.isDirectory(W)?W:null}catch{return null}}function Fi(n,u){if(u.entryKind(ua(n,".git"))!=="missing")return n;let b=Fp(n);return b===n?null:Fi(b,u)}function fa(n,u,b,W,z){let B=W.paths,Q=ua(b,".git"),ee=B.isDirectory(Q),le=ee&&!W.isGitDirectory(Q),ue=Gp(u).filter((ve)=>le||ve!==b&&Pr(ve,b));return Fo(n,W.env,z).entries.some((ve)=>ve.key.toLowerCase()==="core.worktree")||ue.some((ve)=>B.entryKind(ua(ve,"HEAD"))!=="missing"||ve!==b&&B.entryKind(ua(ve,".git"))!=="missing")||ee&&W.gitDirectoryRedirects(Q)}function Gp(n){let u=Fp(n);return u===n?[n]:[n,...Gp(u)]}function zp(n,u,b){if(!u.localDiscard||!b.worktreeMode||ma(b.environment.env,b.envAssignments))return null;let W=Bo(n,b.cwd,b.environment.paths);if(!W.gitCwd||W.hasExplicitGitContext)return null;let z=b.environment.worktreeFacts(W.gitCwd),B=Fi(W.gitCwd,b.environment.paths);if(!z||B===null||fa(n,W.gitCwd,B,b.environment,b.envAssignments))return null;if(Wc(n,b,z))return null;return{kind:"worktree",originalReason:u.reason,gitCwd:W.gitCwd}}function Wc(n,u,b){let{subcommand:W,rest:z}=Fn(n),B=W?.toLowerCase();if(u.dynamicArguments||_x(z)||Ix(n,u.environment.env,u.envAssignments,b)||Px(z)||xx(B,z))return!0;return B==="clean"&&Tx(z)>1}function _x(n){return n.some((u)=>/[$*?[]/.test(u))}function xx(n,u){if(n==="checkout"){let{before:b}=hn(u),W=An(b,{shortOptsWithValue:Ic}),z=b.some((Q)=>Ht(Q,"--force"))||W.has("-f"),B=W.has("-B")||b.some((Q)=>Q==="-B"||Q.startsWith("-B"));return z&&B}if(n==="switch"){let{before:b}=hn(u),W=An(b,{shortOptsWithValue:kc}),z=b.some((Q)=>Ht(Q,"--force"))||b.some((Q)=>Ht(Q,"--discard-changes"))||W.has("-f"),B=b.some((Q)=>Q==="-C"||Q.startsWith("-C")||Ax(Q))||W.has("-C");return z&&B}return!1}function Ax(n){let u=n.split("=",1)[0]??n;return u==="--force-create"||u.length>=9&&"--force-create".startsWith(u)}function Px(n){return n.some((u)=>u.startsWith("--recurse-sub"))}function Tx(n){let u=0;for(let b of n){if(b==="--force"){u++;continue}if(b.startsWith("-")&&!b.startsWith("--")){for(let W of b.slice(1))if(W==="f")u++}}return u}function Ix(n,u,b,W){if(pr("GIT_CONFIG_PARAMETERS",u,b)!==void 0)return!0;let z=Fo(n,u,b);if(z.blockedReason!==null)return!0;let B=z.entries.map((ee)=>({key:ee.key.toLowerCase(),value:ee.value}));if(B.some((ee)=>Ox(ee.key)))return!0;let Q=B.filter((ee)=>ee.key==="submodule.recurse").at(-1);if(Q)return Q.value===void 0||kx(Q.value);if(hf(b))return!0;return W.recursiveSubmodules}function kx(n){let u=n.toLowerCase();return u!=="false"&&u!=="no"&&u!=="off"&&u!=="0"}function Ox(n){return n==="include.path"||n.startsWith("includeif.")&&n.endsWith(".path")}function $p(n,u,b){let W=n.map((le)=>Jn(le,b.shellAssignments??new Map)??t(le)),z=b.environment.paths,B=Bo(W,b.cwd,z),Q=b.originalCwd?z.realpath(Nx(b.originalCwd)):null;if(u.id.startsWith("git.push-")||Q===null||B.gitCwd===null||B.hasExplicitGitContext||ma(b.environment.env,b.envAssignments))return null;let ee=u.id==="git.worktree-remove-force"?Wx(n,b.shellAssignments,z):Fi(B.gitCwd,z);if(ee===null||u.id!=="git.worktree-remove-force"&&!Lx(ee,B.gitCwd,W,u,b)||!Io(ee,b.environment)||Gs(ee,b.environment)||Pr(Q,ee)||Pr(ee,Q))return null;return{kind:"temp-root",originalReason:u.reason,gitCwd:B.gitCwd}}function Lx(n,u,b,W,z){let B=z.environment.paths,Q=Dx(n,".git");if(B.entryKind(Q)!=="present"||fa(b,u,n,z.environment,z.envAssignments))return!1;if(B.isDirectory(Q))return!0;if(!W.localDiscard)return!1;let le=z.environment.worktreeFacts(n);return le!==null&&!Wc(b,z,le)}function Wx(n,u,b){let W=Fn(n.map(t)).rest,{before:z,after:B}=hn(W.slice(W.indexOf("remove")+1)),Q=[...z.filter((ve)=>!ve.startsWith("-")),...B],ee=Q.length===1?Q[0]??"":"",le=n.find((ve)=>ve.text===ee),ue=(le&&Jn(le,u??new Map))??ee;if(!Mx(ue)||/[\s$`*?[]/.test(ue)||b.entryKind(ue)!=="present"||!b.isDirectory(ue))return null;return b.realpath(ue)}var Gx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",zx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function pa(n,u){return Bp(n,u)}function Bp(n,u,b){let W=n.map(t),z=Ep(W,u.environment.env,u.envAssignments),B=z.blockedReason?Gt(st("git.alias-config",z.blockedReason),u.policy):null;if(B)return B;let Q=z.tokens;if((gf(u.envAssignments)||vp(W,u.environment.env,u.envAssignments))&&$x(Q))return st("git.ssh-env",Gx);let ee=wp(Q,(ue)=>{let ve=Bo(W,u.cwd,u.environment.paths).gitCwd;return ve!==null&&u.environment.paths.entryKind(Fx(ve,ue))!=="missing"});if(!ee)return null;if(z.expanded||z.blockedReason)return ee;let le=zp(W,ee,u)??$p(n,ee,u);if(!le)return ee;return b?.(le),null}function Up(n,u){let b=null;return{match:Bp(n,u,(z)=>{b=z}),relaxation:b}}function $x(n){let{subcommand:u,rest:b}=Fn(n),W=u?.toLowerCase();if(!W)return!1;if(zx.has(W))return!0;if(W==="archive")return hn(b).before.some((z)=>Ht(z,"--remote"));return W==="remote"&&Bx(b)}function Bx(n){return n.find((u)=>!Ux(u))?.toLowerCase()==="update"}function Ux(n){return n==="-v"||Ht(n,"--verbose")||Ht(n,"--no-verbose")}import{isAbsolute as CA}from"node:path";function Hp(n,u,b,W){let z=n.slice(0,u),B=n.slice(u+b);return W.startsWith(z)&&W.endsWith(B)?W.slice(z.length,W.length-B.length):null}function ga(n,u,b){let W=(B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`,z=new Set(n.map(W));return Array.from(u).some((B)=>b(B).some((Q)=>!z.has(W(Q))))}var jp="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Hx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",jx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Vx="rm -rf targeting root or home directory is extremely dangerous and always blocked.",qx="rm -rf in home directory is dangerous. Change to a project directory first.",Vp={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Vx},git_metadata_target:{id:"rm.git-metadata",reason:y},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:jx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:qx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:jp},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Hx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:jp}};function ha(n,u){let b=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),W=n.map(t),z=la(W),B=Kx(n);for(let Q of B){let ee=to(Q.word);if(z&&ee.unsafeBraceExpansion){let le=Gt(uc({kind:"outside_anchored_cwd"},b,u.policy,Vp),u.policy);if(le)return le;continue}for(let le of ee.expandedTargets??[Q.text]){let ue=Cn(le),ve={targetIsLiteral:ee.expandedTargets!==void 0||ee.targetIsLiteral,tmpdirWordSplittingProtected:ee.tmpdirWordSplittingProtected};if(!z&&b.resolvedCwd&&Jr(ue,b.resolvedCwd,b.protectedGitMetadata,z,b.environment,b.budget))return st("rm.git-metadata",y);if(!z)continue;let Oe=No(ue,b,u.policy,Vp,ve);if(Oe)return Oe}}return null}function Kx(n){let u=[],b=!1;for(let W of n.slice(1)){let z=t(W);if(!z)continue;if(z==="--"){b=!0;continue}if(b){u.push({text:z,word:W});continue}if(!z.startsWith("-"))u.push({text:z,word:W})}return u}var Mr={kind:"none"},io={kind:"dynamic"},Kp=new Set(["<","<<","<<-","<<<","<&","<>"]),Yp=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Yx=/^(?:[0-9]+|[@*])$/,Zx=xr.maxWords,Zp=xr.maxInputLength;function Xp(n){if(!n||Wt(Bt(n.words[0]?.text??""))!=="printf")return;if(n.words.some((z)=>z.provenance!=="literal"))return;let u=n.words.slice(n.words[1]?.text==="--"?2:1),b=u[0]?.text;if(b===void 0)return"";let W=u.slice(1).map((z)=>z.text);if(b==="%s")return W.join("");if(b==="%s\\n"||b===`%s
 `)return`${W.join(`
 `)}
 `;if(b.includes("%")||/\\(?![\\nrt])/.test(b))return;return b.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Sa(n){let u=Uo(n[1])==="--"?2:1;if(n.length<=u)return Mr;let b=n.slice(u);if(!b.every($i))return io;return{kind:"literal",source:b.map(t).join(" ")}}function Xp(n){let u=Uo(n[1])==="--"?2:1,b=n[u],W=Uo(b);if(b===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Mr;if(!$i(b))return io;return{kind:"literal",source:W}}function Ca(n,u){let b=ng(n);if(b===-1)return Mr;let W=Qx(u);if(!W)return Mr;let z=[],B=W.command?.length??0;for(let Q of W.references){let ee=eA(Q,n,b,W.ifs);if(!ee)return io;if(B+=ee.reduce((le,ue)=>le+ue.length+3,0),z.length+ee.length>Kx||B>Yp)return io;z.push(...ee)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ie)].filter((Q)=>Q!==null).join(" ")}}function Qp(n,u){let b=ng(n),W=n.slice(b+1),z=/\bIFS\b/.test(u);if(b===-1||!W.every($i)||z)return u;let B=W.map(Uo),Q="",ee=null,le=0;while(le<u.length){let ue=u[le]??"",ve=ee==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(ve){let Oe=ve[1]??ve[2],De=Oe==="@"||Oe==="*"?B.slice(1):[B[Number(Oe)]??""];if(ee!=='"'&&De.some((Ne)=>/[*?[]/.test(Ne)))return u;if(Q+=ee==='"'?De.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(Oe==="@"?'" "':" "):De.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ie(Le):"").join(" ")).join(" "),Q.length>Yp)return u;le+=ve[0].length;continue}if(ue==="\\"&&ee!=="'"){Q+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&ee!=='"'||ue==='"'&&ee!=="'")ee=ee?null:ue;Q+=ue,le++}return Q}function Ho(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function Jp(n,u,b,W){if(!Pn(n.map(t)).readsStdinAsCommands)return Mr;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&qp.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return z.heredoc&&Ho(z.heredoc)?{kind:"literal",source:z.heredoc.body}:Mr;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return io;return{kind:"literal",source:z.target.text}}if(!b)return Mr;return W===void 0?io:{kind:"literal",source:W}}function eg(n){return n.some((u)=>(u.fd===void 0||u.fd===0)&&qp.has(u.operator)&&u.operator!=="<&"&&(u.heredoc!==void 0?Ho(u.heredoc):u.target?.provenance==="literal"&&!Yx.has(u.target.text)))}function br(n,u,b=new Map){let W=Pn(n.map(t)).scriptIndex;if(W===null)return Mr;let z=n[W],B=z&&u!==void 0?$o(z,u):null;if(B!==null)return{kind:"literal",source:B};let Q=Uo(z);if(xo(z,Q))return{kind:"literal",source:Q};let ee=z?Jn(z,b):null;return ee===null?io:{kind:"literal",source:ee}}var Yx=new Set(["/dev/stdin","/dev/fd/0","/proc/self/fd/0"]),tg=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function zi(n,u,b){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(Ac).some((W)=>ba(W,b))}var Zx=new Set(["irm","iwr","invoke-restmethod","invoke-webrequest"]);function ya(n,u){let b=Bt(n);return tg.has(b)||u==="powershell"&&Zx.has(b)}function ba(n,u){let b=gr(n.words,u).words.map(t),W=b[0];if(W===void 0)return!1;if(ya(W,n.dialect))return!0;return fp(Bt(W))&&b.slice(1).some((z)=>!Xx(z)&&ya(z,n.dialect))}function Xx(n){return n.includes("/")&&!n.startsWith("/")}function $c(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],b=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!b)return!1;if(!(u.text==="eval"&&b.quoted&&b.parts.length===3&&b.parts[0]?.raw==='"'&&b.parts[1]?.provenance==="command-substitution"&&b.parts[1].raw.startsWith("$(")&&b.parts[2]?.raw==='"'||u.text==="eval"&&!b.quoted&&b.parts.length===1&&b.parts[0]?.provenance==="command-substitution"&&b.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!b.quoted&&b.parts.length===1&&b.parts[0]?.provenance==="command-substitution"&&b.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let Q=B.words[0]?.text;if(Q===void 0||In(Q)!==null)return!1;let ee=Wt(Bt(Q));return!tg.has(ee)&&!nn.has(ee)&&!no(ee)}function ng(n){return Pn(n.map(t)).commandIndex??-1}function Qx(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),b=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(b),z=(W?.[3]??b).split(/\s+/).map(Jx);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
-`}}function Jx(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),b=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??b;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function eA(n,u,b,W){let z=u.slice(b+2);if(n.parameter==="@")return n.quoted?Fc(z):tA(z,W);if(n.parameter==="*"){let ee=Fc(z);if(!ee)return;let le=ee.join(W[0]??"");return n.quoted?[le]:Gc(le,W)}let B=u[b+1+n.parameter];if(B&&!$i(B))return;let Q=Uo(B);return n.quoted?[Q]:Gc(Q,W)}function Fc(n){return n.every($i)?n.map(t):void 0}function tA(n,u){let b=Fc(n);if(!b)return;let W=b.map((z)=>Gc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Gc(n,u){if(["*","?","[","]"].some((b)=>n.includes(b)))return;if(u==="")return n===""?[]:[n];if(u===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Sa(n){let u=Uo(n[1])==="--"?2:1;if(n.length<=u)return Mr;let b=n.slice(u);if(!b.every($i))return io;return{kind:"literal",source:b.map(t).join(" ")}}function Qp(n){let u=Uo(n[1])==="--"?2:1,b=n[u],W=Uo(b);if(b===void 0||n.length<=u+1||W==="-"||W===""||W==="-l"||W==="-p")return Mr;if(!$i(b))return io;return{kind:"literal",source:W}}function Ca(n,u){let b=rg(n);if(b===-1)return Mr;let W=eA(u);if(!W)return Mr;let z=[],B=W.command?.length??0;for(let Q of W.references){let ee=nA(Q,n,b,W.ifs);if(!ee)return io;if(B+=ee.reduce((le,ue)=>le+ue.length+3,0),z.length+ee.length>Zx||B>Zp)return io;z.push(...ee)}if(W.command==="eval")return{kind:"literal",source:z.join(" ")};if(z.length===0||/\s/.test(z[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[W.command,W.command&&W.optionTerminator?"--":null,...z.map(Ie)].filter((Q)=>Q!==null).join(" ")}}function Jp(n,u){let b=rg(n),W=n.slice(b+1),z=/\bIFS\b/.test(u);if(b===-1||!W.every($i)||z)return u;let B=W.map(Uo),Q="",ee=null,le=0;while(le<u.length){let ue=u[le]??"",ve=ee==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(u.slice(le));if(ve){let Oe=ve[1]??ve[2],De=Oe==="@"||Oe==="*"?B.slice(1):[B[Number(Oe)]??""];if(ee!=='"'&&De.some((Ne)=>/[*?[]/.test(Ne)))return u;if(Q+=ee==='"'?De.map((Ne)=>Ne.replace(/["$`\\]/g,"\\$&")).join(Oe==="@"?'" "':" "):De.map((Ne)=>Ne.split(/[ \t\n]+/).map((Le)=>Le?Ie(Le):"").join(" ")).join(" "),Q.length>Zp)return u;le+=ve[0].length;continue}if(ue==="\\"&&ee!=="'"){Q+=u.slice(le,le+2),le+=2;continue}if(ue==="'"&&ee!=='"'||ue==='"'&&ee!=="'")ee=ee?null:ue;Q+=ue,le++}return Q}function Ho(n){return n.quotedDelimiter||!/[$`\\]/.test(n.body)}function eg(n,u,b,W){if(!Pn(n.map(t)).readsStdinAsCommands)return Mr;let z=u.filter((B)=>(B.fd===void 0||B.fd===0)&&Kp.has(B.operator)).at(-1);if(z){if(z.operator==="<<"||z.operator==="<<-")return z.heredoc&&Ho(z.heredoc)?{kind:"literal",source:z.heredoc.body}:Mr;if(z.operator!=="<<<"||z.target?.provenance!=="literal")return io;return{kind:"literal",source:z.target.text}}if(!b)return Mr;return W===void 0?io:{kind:"literal",source:W}}function tg(n){return n.some((u)=>(u.fd===void 0||u.fd===0)&&Kp.has(u.operator)&&u.operator!=="<&"&&(u.heredoc!==void 0?Ho(u.heredoc):u.target?.provenance==="literal"&&!Xx.has(u.target.text)))}function br(n,u,b=new Map){let W=Pn(n.map(t)).scriptIndex;if(W===null)return Mr;let z=n[W],B=z&&u!==void 0?$o(z,u):null;if(B!==null)return{kind:"literal",source:B};let Q=Uo(z);if(xo(z,Q))return{kind:"literal",source:Q};let ee=z?Jn(z,b):null;return ee===null?io:{kind:"literal",source:ee}}var Xx=new Set(["/dev/stdin","/dev/fd/0","/proc/self/fd/0"]),ng=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function zi(n,u,b){return u.filter((W)=>W.span.start>=n.span.start&&W.span.end<=n.span.end).flatMap(Ac).some((W)=>ba(W,b))}var Qx=new Set(["irm","iwr","invoke-restmethod","invoke-webrequest"]);function ya(n,u){let b=Bt(n);return ng.has(b)||u==="powershell"&&Qx.has(b)}function ba(n,u){let b=gr(n.words,u).words.map(t),W=b[0];if(W===void 0)return!1;if(ya(W,n.dialect))return!0;return pp(Bt(W))&&b.slice(1).some((z)=>!Jx(z)&&ya(z,n.dialect))}function Jx(n){return n.includes("/")&&!n.startsWith("/")}function $c(n){if(n.words.length!==2||n.redirections.length!==0||n.nested.length!==1)return!1;let u=n.words[0],b=n.words[1];if(!u||u.provenance!=="literal"||u.quoted||u.raw!==u.text||!b)return!1;if(!(u.text==="eval"&&b.quoted&&b.parts.length===3&&b.parts[0]?.raw==='"'&&b.parts[1]?.provenance==="command-substitution"&&b.parts[1].raw.startsWith("$(")&&b.parts[2]?.raw==='"'||u.text==="eval"&&!b.quoted&&b.parts.length===1&&b.parts[0]?.provenance==="command-substitution"&&b.parts[0].raw.startsWith("$(")||(u.text==="source"||u.text===".")&&!b.quoted&&b.parts.length===1&&b.parts[0]?.provenance==="command-substitution"&&b.parts[0].raw.startsWith("<(")))return!1;let z=n.nested[0];if(z?.status!=="complete"||z.nodes.length!==1)return!1;let B=z.nodes[0];if(B?.kind!=="command"||B.redirections.length!==0||B.nested.length!==0||B.words.some((le)=>le.provenance!=="literal"||le.parts.some((ue)=>ue.provenance!=="literal")))return!1;let Q=B.words[0]?.text;if(Q===void 0||In(Q)!==null)return!1;let ee=Wt(Bt(Q));return!ng.has(ee)&&!nn.has(ee)&&!no(ee)}function rg(n){return Pn(n.map(t)).commandIndex??-1}function eA(n){let u=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(n.trim()),b=u?.[4]??n.trim(),W=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(b),z=(W?.[3]??b).split(/\s+/).map(tA);if(z.length===0||z.some((B)=>B===null))return null;return{command:W?.[1]??null,optionTerminator:W?.[2]!==void 0,references:z.filter((B)=>!!B),ifs:u?u[1]??u[2]??u[3]??"":` 	
+`}}function tA(n){let u=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(n),b=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(n),W=u??b;if(!W)return null;let z=W[1]??W[2];return{parameter:z==="@"||z==="*"?z:Number(z),quoted:u!==null}}function nA(n,u,b,W){let z=u.slice(b+2);if(n.parameter==="@")return n.quoted?Fc(z):rA(z,W);if(n.parameter==="*"){let ee=Fc(z);if(!ee)return;let le=ee.join(W[0]??"");return n.quoted?[le]:Gc(le,W)}let B=u[b+1+n.parameter];if(B&&!$i(B))return;let Q=Uo(B);return n.quoted?[Q]:Gc(Q,W)}function Fc(n){return n.every($i)?n.map(t):void 0}function rA(n,u){let b=Fc(n);if(!b)return;let W=b.map((z)=>Gc(z,u));return W.some((z)=>z===void 0)?void 0:W.flatMap((z)=>z??[])}function Gc(n,u){if(["*","?","[","]"].some((b)=>n.includes(b)))return;if(u==="")return n===""?[]:[n];if(u===` 	
 `)return n.trim().split(/\s+/).filter(Boolean);if(u.length!==1)return;return u===" "||u==="\t"||u===`
-`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function $i(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function Uo(n){return n?t(n):""}function Ie(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function Bc(n,u){return zc(C(n,"posix"),u)}function Bi(n){return Bc(n,new Set(Array.from(n.matchAll(Kp)).flatMap((u)=>{let b=u[1]??u[2];return b===void 0?[]:[b]})))}function zc(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let b=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(zc(W.body,b))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>zc(z,b))||rg(W.words,b))return!0;sA(W,b)}return!1}function rg(n,u){let b=n.findIndex((Q)=>In(Q.text)===null);if(b===-1)return!1;let W=n[b];if(!W)return!1;if(Gi(W,u))return!0;let z=Bt(W.text);if(z==="source"||z==="."){let Q=n[b+1]?.text==="--"?b+2:b+1;return Vp(n[Q],u)}if(nn.has(z)){let Q=n.slice(b),ee=Q.map((ve)=>ve.text),le=Pn(ee),ue=le.commandIndex??le.scriptIndex;return!Qn(ee)&&ue!==null&&Vp(Q[ue],u)}let B=nA(n,b,u);if(B===null)return!1;if(B===-1)return!0;return rg(n.slice(B),u)}function nA(n,u,b){let W=Bt(n[u]?.text??"");if(W==="command")return rA(n,u+1);if(W==="exec")return oA(n,u+1);if(W==="env")return iA(n,u+1,b);return null}function rA(n,u){for(let b=u;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return n[b+1]?b+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return b}return null}function oA(n,u){for(let b=u;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return n[b+1]?b+1:null;if(W==="-a"){b++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return b}return null}function iA(n,u,b){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Gi(n[W+1],b)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Gi(z,b)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(In(B))continue;return W}return null}function sA(n,u){if(!n.words.every((b)=>In(b.text)!==null))return;for(let b of n.words){let W=In(b.text);if(!W)continue;if(Gi(b,u))u.add(W.name)}}function Gi(n,u){if(!n)return!1;return n.parts.filter((b)=>b.provenance==="variable").some((b)=>Array.from(b.raw.matchAll(Kp)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(qx.test(z)||u.has(z))}))}function Vp(n,u){return!!n&&(n.parts.some((b)=>b.provenance!=="literal"&&b.provenance!=="variable")||Gi(n,u))}var Uc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Hc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",aA="__CC_SAFETY_NET_XARGS_INPUT__",Ea="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",va="rm",lA=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,cA=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,dA=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uA=/^(?:[0-9]+|[@*])$/;function sg(n,u){let b=n.map(t),{childStart:W,replacementToken:z}=so(b),B=b.slice(W),Q=st("xargs.shell-dynamic",Hc);if(fA(B,z,u)&&Gt(Q,u.policy))return Gt(Q,u.policy);for(let ee of Xn(B,u)){let le=ee.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Gt(Q,u.policy):null;if(ue)return ue;let ve=mg(le,z,ee.wrapperEnvAssignments),Oe=ee.head==="rm"&&z!==null&&dg(le,z),De=u.analyzeChild(le,{...ro(ee,u),dynamicInput:ve,dynamicSourceInput:Oe||lg(le,ee.head,z,ee.wrapperEnvAssignments,ve,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:Oe,shellDynamicMatch:Q,dynamicSourceMatch:Q,rmDynamicMatch:st("xargs.rm-recursive-force-dynamic",Uc)});if(De)return De;let Me=mA(le,z,u.policy?.rules??[],Gt(Q,u.policy));if(Me)return Me;if(ee.head==="git"){let Le=z===null?[...le,aA]:le,We=z!==null&&(le.some((ze)=>ze.includes(z))||Array.from(ee.envAssignments.values()).some((ze)=>ze.includes(z))),Be=u.analyzeChild(Le,{...ro(ee,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(Be)return Be}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function mA(n,u,b,W){if(b.length===0)return null;if(u===null){for(let B of b){let Q=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],b);if(Q)return Q}return null}let z=Bt(n[0]??"");if(!b.some((B)=>Bt(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function ag(n,u,b){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=Up(n,W,u.length,b);return z===null?[]:[z]}function lg(n,u,b,W,z,B,Q){if(nn.has(u)){if(Qn(n))return!1;if(b!==null&&pA(n,b,Q))return!0;let ee=jn(n);if(!ee){let le=br(tn(n));if(le.kind==="literal")return b!==null&&le.source.includes(b);return le.kind==="none"&&z}if(b!==null&&ee.includes(b)&&!cg(ee,b,Q))return!0;if(Un(ee))return!0;return gA(ee,b,W)}if(Ln(u))return og(n,b,ta,Zf(u));if(Bn.has(u))return og(n,b,bc,ap);if(u==="eval"){let ee=Sa(tn(n));if(ee.kind==="dynamic")return!0;if(b!==null)return ee.kind==="literal"&&ee.source.includes(b);return z}if(u==="find")return hA(n,b,B);if(u==="git"){let ee=Fn(n);return b===null?ee.subcommand===null:(ee.subcommand?.includes(b)??!1)||ee.subcommand!==null&&Go.has(ee.subcommand.toLowerCase())&&ug(ee.rest,b).some((le)=>le.includes(b))}return!1}function cg(n,u,b){if(b===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Un(B)===null&&b(B)===null}function og(n,u,b,W){let z=b(n);if(u===null)return z.optionsOpen||b([...n,Ea]).sources.some((ee)=>ee.value===Ea);if(z.sources.some((ee)=>ee.value.includes(u)))return!0;let B=W.flatMap((ee)=>[ee.selector,...ee.valueForm==="attached-only"||ee.valueForm==="attached-or-separate"?[`${ee.selector}${Ea}`]:[],...ee.valueForm==="equals-or-separate"?[`${ee.selector}=${Ea}`]:[]]),Q=new Set(B.flatMap((ee)=>n.flatMap((le)=>ag(le,u,ee))));return ga(z.sources,Q,(ee)=>b(n.map((le)=>le.replaceAll(u,ee))).sources)}function fA(n,u,b){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(Xn(n,b),(B)=>B.head)),z=u===null?[...n,va]:n.map((B,Q)=>Q===0?B:B.replaceAll(u,va));return Array.from(Xn(z,b)).some((B)=>B.head===va&&!W.has(va))}function dg(n,u){return ug(n.slice(1),u).some((b)=>b.includes(u)&&(b.startsWith("-")||b.startsWith(u)))}function ug(n,u){let b=n.findIndex((W)=>W==="--"&&!W.includes(u));return b===-1?n:n.slice(0,b)}function mg(n,u,b){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(b.values()).some((W)=>W.includes(u))}function pA(n,u,b){let W=Pn(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!cg(z,u,b)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((Q)=>n.some((ee,le)=>{if(le===0||!ee.includes(u))return!1;return ag(ee,u,Q).some((ve)=>{let Oe=n.map((Me,Ne)=>Ne===le?Me.replaceAll(u,ve):Me),De=Pn(Oe);if(De.commandIndex===null&&De.scriptIndex===null)return!1;if(W.commandIndex===null&&De.commandIndex!==null)return!0;if(W.scriptIndex===null&&De.scriptIndex!==null)return!0;if(De.commandIndex!==null&&(Oe[De.commandIndex]??"").includes(ve))return!0;return De.scriptIndex!==null&&(Oe[De.scriptIndex]??"").includes(ve)})}))}function gA(n,u,b){let W=new Set(u===null?[]:Array.from(b).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(lA))if(ig(z,W))return!0;for(let z of n.matchAll(cA))for(let B of(z[1]??"").matchAll(dA))if(ig(B,W))return!0;return Bc(n,W)}function ig(n,u){let b=n[1]??n[2];return b!==void 0&&(uA.test(b)||u.has(b))}function hA(n,u,b){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let Q=n[B]??"";if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){if(Q.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(lr(Q)){let le=Wo(n,B);B=le.nextIndex-1;for(let ue of Xn(le.tokens,{environment:b,cwd:void 0})){let ve=mg(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&dg(ue.tokens,u)||lg(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,ve,b))return!0}continue}let ee=Cr(Q);if(ee>0){if(z=ee,Q.includes(u))return!0;continue}if(Q.includes(u))return!0}return!1}function so(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),b=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:b};if(!z.startsWith("-"))return{childStart:W,replacementToken:b};if(z==="-I"){b=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){b=z.slice(2),W++;continue}if(z==="--replace"){b="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);b=B===""?"{}":B,W++;continue}if(z==="-J"){b=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:b}}var Ui="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Hi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",SA="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",CA="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",wa=/\{[^{}\s]*\}/g,fg=/\{\}|\{-?\d+\}/g,pg=/[\s;&|<>()$`\\"']/,bA=["e","f","source","file","-e","-f","--source","--file"],EA=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],vA=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),RA=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),gg=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),wA=new Set(["--workdir","--wd"]),hg="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Vn(n,u){for(let b of n){let W=u(b);if(W)return W}return null}function Cg(n){return Vn([...n],(u)=>Un(u))}function bg(n,u){let b=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=jo(u);if(Ne)return Ne}if(b.length===2&&(b[1]==="--version"||b[1]==="--help"))return null;let z=Og(b),{template:B,jobs:Q,runsRemotely:ee,readsCommandsFromInput:le,unsupported:ue,workdir:ve,dryRun:Oe}=z;if(ue){let Ne=jo(u);if(Ne)return Ne;let Le=Cg(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=kA(u);if(Ne)return Ne}if(ve!==void 0&&ee){let Ne=jo(u);if(Ne)return Ne}let De=OA(ve,u.cwd,u.environment.paths);if(De===null){let Ne=jo(u);if(Ne)return Ne}let Me=ee?{...u,cwd:void 0,originalCwd:void 0}:De===null||De===void 0||De===u.cwd?u:{...u,cwd:De};if(Oe){if([...Xn(B,Me)].flatMap((Le)=>[...Le.envAssignments.values()]).some(qc)){let Le=jo(u);if(Le)return Le}return null}if(B.length===0){let Ne=Q.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=xg(Me.envAssignments,Me.cwd,ee);return Vn(Ne,(We)=>u.analyzeNested(We,Le))}return Vn(Xn(B,Me),(Ne)=>_A(Ne,z,u,Me))}function _A(n,u,b,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:Q}=u,ee=n.tokens,le=[...n.envAssignments.values()];if(le.some(Ig)){let at=jo(b);if(at)return at}let ue=Cg(le);if(ue)return ue;let ve=le.some(Kt),Oe=z||ve,De=Q&&Oe,Me=xg(n.envAssignments,n.wrapperCwd,B||De),Ne=Oe?{...Me,worktreeMode:!1}:Me,Le=ee.join(" "),We=Kt(Le.split(/[ \t\n=]/,1)[0]??""),Be=!u.quotesCommand&&(We||ee.some((at)=>pg.test(at))),ze=We||pg.test(ee[0]??""),it=Be&&ze&&u.jobs.length>0?null:xA(n,u,b,W,Ne,ve);if(it||!Be)return it;return Eg(Kt(Le)?Le:`${Le} {}`,!We,n,u,b,W,Ne)}function xA(n,u,b,W,z,B){let{jobs:Q,templateHasPlaceholder:ee,runsRemotely:le,usesStdin:ue}=u,ve=n.tokens,Oe=ee||B;if(nn.has(n.head)){let Me=()=>{if(!ee||Q.length===0)return null;return Vn(Q,(We)=>b.analyzeChild(Ra(ve,We,b.budget),ro(n,W)))};if(Qn(ve))return Me();if(ca(ve))return sr();let Ne=jn(ve);if(Ne){if(kg(Ne)){let it=Dr(b);if(it)return it;if(Q.length===0)return null;return Vn(Q,(at)=>b.analyzeNested(Pg(Ne,at,b.budget),z))}if(Kt(Ne))return Eg(Ne,!1,n,u,b,W,z);let We=!B&&(!ee||Q.length>0)?(Q.length>0?Q:[void 0]).map((it)=>Ca(tn(it===void 0?ve:ee?ve.map((at)=>Ag(at,it)):[...ve,...it]),Ne)):[];if(We.some((it)=>it.kind==="dynamic")){let it=Dr(b);if(it)return it}let Be=We.flatMap((it)=>it.kind==="literal"?[it.source]:[]);if(Be.length>0)return b.budget.charge("derivedTokens",Be.length),Vn(Be,(it)=>b.analyzeNested(it,z));if(Bi(Ne)){let it=Dr(b);if(it)return it}let ze=b.analyzeNested(Ne,z);if(ze)return ze;if(Oe)return Dr(b);return null}let Le=br(tn(ve));if(Le.kind==="dynamic"||Le.kind==="literal"&&Kt(Le.source))return Dr(b)??Me();if(Le.kind==="literal")return Me();if(Q.length>0){let We=Dr(b);if(We)return We;let Be=Me();if(Be)return Be;if(ee)return null;let ze=Q.flatMap((it)=>it[0]===void 0?[]:[it[0]]);return b.budget.charge("derivedTokens",ze.length),Vn(ze,(it)=>b.analyzeNested(it,z))}if(Oe||ue)return Dr(b)??Me();return null}if(n.head==="rm"&&Sr(ve)){if(ee&&Q.length>0)return Vn(Q,(Ne)=>jc(Ra(ve,Ne,b.budget,fg),n.cwd,W));if(Q.length>0)return Vn(Q,(Ne)=>jc(Sg(ve,Ne,b.budget),n.cwd,W));let Me=jc(ve.flatMap((Ne,Le)=>{if(Le===0||!Kt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(fg,"")]:[]}),n.cwd,W);if(Me)return Me;return _g(b)}let De=Q.length>0?Q:[void 0];return Vn(De,(Me)=>{let Ne=Me===void 0?ve:ee?Ra(ve,Me,b.budget):Sg(ve,Me,b.budget),Le=st("parallel.shell-dynamic",Hi),We=ue&&n.head==="find"?IA(Ne,W):null,Be=Rg(Ne,ue,b)??We?.customResult??null,ze=Bt(n.head),it=ue&&(ze==="rm"&&Vc(Ne)||ze==="xargs"&&wg(Ne)||We?.rmOptions===!0),at=ue&&(it||We?.executedSource===!0||We===null&&vg(Ne,ze)),Rt=b.analyzeChild(Ne,{...ro(n,W),worktreeMode:le||ue||Oe?!1:b.worktreeMode,dynamicInput:ue||Oe,dynamicRmInput:it,dynamicSourceInput:Be!==null||at,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Ui)});if(at){let Tt=Gt(Le,b.policy);if(Tt)return Tt}return Rt??Be??F(Ne,b.policy?.rules??[])})}function Eg(n,u,b,W,z,B,Q){if(W.jobs.length>0)return Vn(W.jobs,(ue)=>z.analyzeNested(Pg(n,u?ue.map(Ie):ue,z.budget),Q));let ee=Wi(n);if(ee?.[0]&&Bt(ee[0])==="rm"&&Sr(ee)){let ue=_g(z);if(ue)return ue}return(ee?z.analyzeChild(ee,{...ro(b,B),dynamicInput:W.usesStdin,shellDynamicMatch:st("parallel.shell-dynamic",Hi),rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Ui)}):null)??z.analyzeNested(n,Q)}function vg(n,u){if(Kt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(nn.has(u))return TA(n);if(u==="git")return AA(n);if(u==="find")return!0;if(Bn.has(u))return yg(n,bA,Ni);if(Ln(u))return yg(n,EA,ea);return!1}function Vc(n){let u=n.indexOf("--"),b=n.slice(1,u===-1?void 0:u);if(!n.some(Kt))return u===-1;return b.some((z)=>Kt(z)&&(z.startsWith("-")||kg(z)))}function AA(n){if(PA(n))return!0;let u=Fn(n);if(u.subcommand===null||Kt(u.subcommand))return!0;if(!Go.has(u.subcommand.toLowerCase()))return!1;let b=u.rest.indexOf("--"),W=u.rest.slice(0,b===-1?void 0:b);if(!n.some(Kt))return b===-1;return W.some(Kt)}function PA(n){for(let u=1;u<n.length;u++){let b=n[u];if(!b||b==="--"||!b.startsWith("-"))return!1;if(b==="-c"||b==="--config-env"){if(Kt(n[u+1]??""))return!0;u++;continue}if(b.startsWith("-c")&&b.length>2||b.startsWith("--config-env=")){if(Kt(b))return!0;continue}if(Kt(b))return!0}return!1}function TA(n){if(Qn(n))return!1;let u=jn(n);if(u!==null)return Kt(u);let b=br(tn(n));if(b.kind==="literal")return Kt(b.source);if(b.kind==="dynamic")return!0;return!n.some(Kt)}function yg(n,u,b){let W=b(n);if(W.some((z)=>Kt(z.value)))return!0;if(!n.some(Kt))return b([...n,hg]).some((z)=>z.value===hg);return ga(W,u,(z)=>b(n.map((B)=>Ag(B,[z]))))}function Rg(n,u,b){let W=b.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>Bt(B.command)===Bt(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(Kt))return Dr(b);return Vn(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function IA(n,u){let b={customResult:null,executedSource:!n.some(Kt),rmOptions:!1},W=!1,z=0,B=null,Q=()=>{if(!B?.some(Kt))return;for(let ee of Xn(B,u))b.executedSource||=vg(ee.tokens,ee.head),b.rmOptions||=ee.head==="rm"&&Vc(ee.tokens)||ee.head==="xargs"&&wg(ee.tokens),b.customResult??=Rg(ee.tokens,!0,u)};for(let ee of n.slice(1)){if(!W&&!ee.startsWith("-")&&ee!=="!"&&ee!=="("){b.executedSource||=Kt(ee);continue}if(W=!0,B){if(ee===";"||ee==="+"){Q(),B=null;continue}B.push(ee);continue}if(z>0){z--;continue}if(lr(ee)){B=[],b.executedSource||=Kt(ee);continue}let le=Cr(ee);if(le>0){z=le,b.executedSource||=Kt(ee);continue}b.executedSource||=Kt(ee)}return Q(),b}function wg(n){let u=n.slice(so(n).childStart);return Bt(u[0]??"")==="rm"&&Vc(u)}function _a(n,u){return(b)=>Gt(st(n,u),b.policy)}var Dr=_a("parallel.shell-dynamic",Hi),kA=_a("parallel.command-stream-dynamic",SA),jo=_a("parallel.command-stream-dynamic",CA),_g=_a("parallel.rm-recursive-force-dynamic",Ui);function jc(n,u,b){return Gt(ha(tn(n),{environment:b.environment,cwd:u,budget:b.budget,originalCwd:b.originalCwd,strict:b.strict,paranoid:b.paranoidRm,allowTmpdirVar:b.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(b.envAssignments??new Map,b.environment),trustedTmpdirValue:To(b.envAssignments??new Map,b.environment),protectedGitMetadata:b.protectedGitMetadata,policy:b.policy}),b.policy)}function xg(n,u,b){let W={};if(n)W.envAssignments=n;if(b)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function Ag(n,u){return n.replace(wa,(b)=>Tg(b,u))}function Ra(n,u,b,W=wa){return b.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let Q=Tg(B,u);return b.charge("derivedTokens",Math.max(1,Math.ceil(Q.length/64))),Q}))}function Pg(n,u,b){return Ra([n],u,b)[0]??""}function Sg(n,u,b){return b.charge("derivedTokens",n.length+u.length),[...n,...u]}function Tg(n,u){let b=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(b===void 0)return u[0]??"";let W=Number(b);return u[W>0?W-1:u.length+W]??""}function Kt(n){return n.search(wa)!==-1}function Ig(n){if(qc(n))return!0;for(let u of n.matchAll(wa))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function qc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function kg(n){return/^\{[^{}\s]*\}$/.test(n)}function OA(n,u,b){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!yA(n))return null;try{return Tr(u??n,n,b)}catch{return null}}function Og(n){let u=1,b=[],W=n.length,z=-1,B=!1,Q=!1,ee=!1,le,ue=!1,ve=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let at=Rc(n,u+1);b.push(...at.templateTokens),W=u+1,z=at.markerIndex;break}if(!Le.startsWith("-")){let at=Rc(n,u);b.push(...at.templateTokens),W=u,z=at.markerIndex;break}let We=n[u+1],Be=Le.indexOf("="),ze=Be===-1?Le:Le.slice(0,Be),it=Be===-1?void 0:Le.slice(Be+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){ve||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){ve=!0,u+=2;continue}if(ze==="--replace"||Le.startsWith("-i")&&Le.length>2){let at=ze==="--replace"?it:Le.slice(2);ve||=at!==""&&at!=="{}",u++;continue}if(Le==="-a"||RA.has(ze)){ve=!0,u+=it===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){Q=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){ee=!0,u++;continue}if(ze==="--env"){ve=!0,u+=it===void 0?2:1;continue}if(gg.has(ze)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=gg.has(Le)?2:1;continue}if(wA.has(ze)){ve=!0;let at=it??We;if(at===void 0||at===":::"||at==="--"){u++;continue}le=at,u+=it===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&it!==void 0){u++;continue}if(vA.has(Le)){if(We===void 0||We===":::"||We==="--"){ve=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}ve||=b.some(ue?qc:Ig);let Oe=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let Be=n[We];if(Be===":::"){Oe.push(Le),Le=[];continue}if(Be!==void 0)Le.push(Be)}Oe.push(Le)}ve||=Oe.length>1;let De=MA(Oe),Me=b.some(Kt),Ne=b.length===0&&z===-1;return{template:b,jobs:De,childStart:W,templateHasPlaceholder:Me,runsRemotely:B,quotesCommand:Q,usesStdin:ee||z===-1,readsCommandsFromInput:Ne,unsupported:ve,workdir:le,dryRun:ue}}function MA(n){if(n.length===0||n.some((b)=>b.length===0))return[];let u=[[]];for(let[b,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let Q of u)Q.push(B);if(u.length*(b+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let Q of W){if((z.length+1)*(b+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,Q])}u=z}return u}function Mg(n){return Og(n).childStart}var DA="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",xa="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Yc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function Kc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ng(n,u,b,W,z=!1,B){let ee=(gi(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&un(B,"shell.dynamic-executable",z)?st("shell.dynamic-executable",DA):null;return Gt(ee,B)??Lg(n,u,b,z,B)}function Lg(n,u,b,W,z){if(u.length<2)return null;let B=u.flatMap((ee,le)=>Yc(ee)?[le]:[]);if(B.length===0)return null;let Q=Bt(u[0]?.text??"");if(Q==="git"){let ee=ce(n,u),le=LA(ee);if(un(z,"shell.dynamic-structure",W)&&B.some((Oe)=>Oe<=le))return Gt(st("shell.dynamic-structure",xa),z);if(Gt(pa(ee,{environment:b}),z))return null;let ue=u[le]?.text.toLowerCase(),ve=ee.findIndex((Oe,De)=>De>le&&t(Oe)==="--");if(un(z,"shell.dynamic-structure",W)&&ue&&Go.has(ue)&&B.some((Oe)=>Oe>le&&(ve===-1||Oe<ve)))return Gt(st("shell.dynamic-structure",xa),z);return null}if(Q==="find")return un(z,"shell.dynamic-structure",W)&&WA(u)?Gt(st("shell.dynamic-structure",xa),z):null;if(Q==="rm"){let ee=u.findIndex((ue,ve)=>ve>0&&t(ue)==="--"),le=Sr(u.map(t));return un(z,"shell.dynamic-structure",W)&&B.some((ue)=>(ee===-1||ue<ee)&&(ue<u.length-1||!le))?Gt(st("shell.dynamic-structure",xa),z):null}if(Q==="xargs")return Dg(n,u.slice(so(u.map(t)).childStart),"xargs",b,W,z);if(Q==="parallel")return Dg(n,u.slice(Mg(u.map(t))),"parallel",b,W,z);return null}function Dg(n,u,b,W,z,B){if(u.length===0)return null;let Q=NA(u,W);if(gi(n,Q)){let le=Gt(st(`${b}.shell-dynamic`,b==="xargs"?Hc:Hi),B);if(le)return le}let ee=Lg(n,Q,W,z,B);if(ee)return ee;if(Q[0]?.text==="rm"&&Q.slice(1).some((le)=>Yc(le)&&Kc(le)))return Gt(st(`${b}.rm-recursive-force-dynamic`,b==="xargs"?Uc:Ui),B);return null}function NA(n,u){let b=gr(n,u),W=b.rewritten?tn(b.words.map(t)):b.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function LA(n){let u=1;while(u<n.length){let b=n[u],W=b?t(b):"";if(Nn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function WA(n){let u=!1,b=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let Q=n[B];if(!Q)continue;let ee=Yc(Q);if(b>0){b--;continue}if(z){if(Q.text===";"||Q.text==="+"){z=!1,u=!0,W=!1;continue}if(ee&&(W||Kc(Q)))return!0;W=!1;continue}if(!u&&!Q.text.startsWith("-")){if(ee&&(B>1||Kc(Q)))return!0;continue}if(u=!0,ee)return!0;let le=Cr(Q.text);if(le>0){b=le;continue}if(lr(Q.text))z=!0,W=!0}return!1}function Zc(n,u){return n.some((b)=>{if(b.value==="-"&&(b.kind==="main-script"||b.kind==="program-file"))return!0;return!xo(u[b.tokenIndex],b.value)})}var FA="unshare creating a user namespace grants root inside it, a common step toward privilege escalation. Ask the user to run it manually if it is needed.",GA=/^--(?:user|map-root-user|map-current-user|map-auto|map-subids|map-(?:user|group)s?|owner|mount-binfmt|load-interp)(?:=|$)/,zA=/[Urcl]/,$A=/[RwSGl]/,BA=new Set(["--propagation","--setgroups","--root","--wd","--setuid","--setgid","--map-user","--map-group","--map-users","--map-groups","--owner","--whitelist-env","--load-interp"]);function Wg(n){let u=n.slice(1).search($A);return u===-1?n.length:u+1}function UA(n){return BA.has(n)||/^-[^-]/.test(n)&&Wg(n)===n.length-1}function HA(n){return n.startsWith("--")?GA.test(n):zA.test(n.slice(1,Wg(n)+1))}function Fg(n,u){if(n!=="unshare")return null;let b=u.slice(1),W=(B)=>UA(b[B-1]??""),z=b.findIndex((B,Q)=>!W(Q)&&(B==="--"||!B.startsWith("-")));return b.slice(0,z===-1?void 0:z).some((B,Q)=>!W(Q)&&HA(B))?st("unshare.user-namespace",FA):null}var jA="This reaches a cloud metadata endpoint, which hands out instance credentials. Ask the user to run metadata requests manually if they are needed.",VA="This uploads data to a remote host, which can send local files or secrets off the machine. Send it to localhost instead, or ask the user to run the upload manually if it is needed.",qA=/(?<![\w.-])(?:169\.254\.169\.254|169\.254\.170\.23|169\.254\.170\.2|100\.100\.100\.200|metadata\.google\.internal|metadata\.goog)(?![\w-]|\.[\w-])|(?<![\w:])fd00:ec2::(?:254|23)(?![\w:])/i,Xc=new Set(["xargs","find"]),Gg=(n)=>new Map(Object.entries(n).flatMap(([u,b])=>b.map((W)=>[W,u]))),zg=new Map([["curl",Gg({data:["-d","--data","--data-ascii","--data-binary","--data-raw","--data-urlencode","--json"],upload:["-F","--form","--form-string","-T","--upload-file"],url:["--url","-x","--proxy","--preproxy"],source:["-K","--config"],local:["--unix-socket","--abstract-unix-socket"],get:["-G","--get"],value:[..."ACDEHPQUXYbcehmortuwyz".split("").map((n)=>`-${n}`),"--output","--output-dir","--header","--proxy-header","--request","--user-agent","--user","--proxy-user","--max-time","--connect-timeout","--write-out","--cookie","--cookie-jar","--referer","--retry","--retry-delay","--retry-max-time","--cert","--key","--cacert","--capath","--range","--resolve","--connect-to","--limit-rate","--oauth2-bearer","--dump-header","--continue-at","--time-cond","--interface","--max-filesize","--max-redirs","--noproxy","--url-query","--aws-sigv4","--variable","--stderr","--trace","--trace-ascii"]})],["wget",Gg({upload:["--post-data","--post-file","--body-data","--body-file"],source:["-i","--input-file"],value:[..."ABDIOPQRTUXaelotw".split("").map((n)=>`-${n}`),"--output-document","--output-file","--append-output","--header","--user-agent","--method","--timeout","--tries","--user","--password","--directory-prefix","--execute","--wait","--referer","--load-cookies","--save-cookies","--ca-certificate","--certificate","--private-key"]})]]),KA=/^(?:localhost|[a-z\d-]+(?:\.[a-z\d-]+)*\.localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\])$/;function Bg(n,u){if(YA(n,u))return st("network.cloud-metadata",jA);return XA(n,u)?st("network.upload-remote",VA):null}function YA(n,u){return(Xc.has(n)?u.slice(1).some($g):$g(n))&&u.some((W,z)=>!ZA(u[z-1],W)&&qA.test(W))}function $g(n){let u=Qc(n);return cs.has(u)||Ln(u)}function ZA(n,u){return n==="--noproxy"||u.startsWith("--noproxy=")}function XA(n,u){let b=Xc.has(n)?u.findIndex((Me,Ne)=>Ne>0&&zg.has(Qc(Me))):0,W=zg.get(Qc(u[b]??n));if(b<0||W===void 0)return!1;let z=u.slice(b+1),B=z.findIndex((Me)=>Me===";"||Me==="+"),Q=B<0||!Xc.has(n)?z:z.slice(0,B),ee=new Set,le=[],ue=(Me,Ne)=>{if(ee.add(Me),Me==="url"&&Ne!=="")le.push(Ne);if(Me==="source")le.push("")},ve=0,Oe=!1;while(ve<Q.length){let Me=Q[ve]??"";if(ve++,Oe||!Me.startsWith("-")||Me==="-"){le.push(Me);continue}if(Me==="--"){Oe=!0;continue}if(Me.startsWith("--")){let ze=Me.indexOf("="),it=W.get(ze<0?Me:Me.slice(0,ze));if(it===void 0)continue;let at=it!=="get",Rt=ze>=0?Me.slice(ze+1):at?Q[ve]??"":"";if(at&&ze<0)ve++;ue(it,Rt);continue}let Ne=Me.slice(1).split(""),Le=Ne.findIndex((ze)=>{let it=W.get(`-${ze}`);return it!==void 0&&it!=="get"});if((Le<0?Ne:Ne.slice(0,Le)).some((ze)=>W.get(`-${ze}`)==="get"))ee.add("get");if(Le<0)continue;let We=W.get(`-${Me[Le+1]}`)??"value",Be=Me.slice(Le+2);if(Be==="")ve++;ue(We,Be===""?Q[ve-1]??"":Be)}return(ee.has("upload")||ee.has("data")&&!ee.has("get"))&&!ee.has("local")&&!(le.length>0&&le.every(QA))}function Qc(n){return Bt(Wt(n))}function QA(n){let u=n.replace(/^[a-z][a-z\d+.-]*:\/\//i,"").split(/[/?#]/)[0]??"",b=u.slice(u.lastIndexOf("@")+1).toLowerCase(),W=b.startsWith("[")?b.slice(0,b.indexOf("]")+1):b.split(":")[0];return KA.test(W??"")}var Ug="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",JA="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",eP="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",tP="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",nP="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",rP="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",oP={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:tP},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:eP},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:rP},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Ug},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:JA},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Ug}},iP=/^\/\/?[ck]$/i,Hg=/[&|]+/,sP=/(?:"[^"]*"|[^\s"])+/g,aP=/[\^%!]/,lP=/\\"./s,cP=/(^|\/)[*.]*\*[*.]*$/,dP=/^"?[\\/]+[?.][\\/]/,uP=new Set(["rmdir","rd","del","erase"]),mP=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,fP=/\/s(?!\w)/i,pP=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function jg(n,u){let b=n.map(t),W=b.findIndex((De)=>iP.test(De));if(W===-1)return null;let z=b.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,Q=B.split(Hg).map((De)=>{let Me=De.match(sP)??[],Ne=Me.findIndex((We)=>uP.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Me.slice(Ne);return{piece:De,tokens:Me,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),ee=Q.filter((De)=>De.recursiveDelete),le=ee.length>0||mP.test(B)&&fP.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((De)=>lP.test(De))||ee.some((De)=>De.tokens.some((Me)=>dP.test(Me)))))return st("cmd.recursive-delete-escaped-quote",nP);let ue=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),ve=Q.reduce((De,Me)=>De??(Me.recursiveDelete?gP(Me.deleteTokens,ue,u.policy):u.analyzeNested(Me.piece)),null),Oe=le&&(ee.length===0||aP.test(B)||pP.test(B)||B.includes('"')&&Hg.test(B));return ve??(Oe?sr():null)}function gP(n,u,b){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??No(Mi(z.replaceAll('"',"")).replace(cP,"$1*"),u,b,oP),null)}var hP="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",yP=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,SP=/^-(?:executionpolicy|ep)$/i,CP=/^-(?:command|c)$/i,bP=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,EP="encodedcommand",vP=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,RP=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,wP=/[$`]/,_P="--%";function Vg(n,u){let b=n.map(t),W=b.every((B,Q)=>Q===0||B!==_P&&xP(n[Q],B))?ed(b):void 0;if(W!==void 0)return u(W);if(b.some(AP))return sr();let z=b.join(" ");return vP.test(z)&&RP.test(z)?st("powershell.nested-recursive-delete-unread",hP):null}function ed(n){let u=Jc(n,1),b=u===void 0?[]:n.slice(u+1);return b.length>0?b.join(" "):void 0}function Jc(n,u){let b=n[u]??"";if(CP.test(b))return u;if(yP.test(b))return Jc(n,u+1);return SP.test(b)?Jc(n,u+2):void 0}function xP(n,u){return n?.provenance==="unknown"?!wP.test(u):xo(n,u)}function AP(n){let u=bP.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||EP.startsWith(u))}var PP="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",TP="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",IP=/[efBMT@]/,kP=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function qg(n,u){let b=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],ve=ue?t(ue):"";if(B++,!ue)continue;if(z||ve==="-"||!ve.startsWith("-")){b.push(ue);continue}if(ve==="--"){z=!0;continue}if(ve.startsWith("--")){if(W||=ve==="--del"||ve.startsWith("--dele"),!ve.includes("=")&&kP.has(ve.slice(2)))B++;continue}if(ve.slice(1).search(IP)===ve.length-2)B++}let Q=b.slice(1).filter((ue)=>!OP(t(ue)));if(!W||Q.length===0)return null;let ee=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=Q.flatMap((ue)=>{let ve=to(ue);return(ve.expandedTargets??[t(ue)]).map((Oe)=>ar(Oe,ee,{targetIsLiteral:ve.expandedTargets!==void 0||ve.targetIsLiteral,tmpdirWordSplittingProtected:ve.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return st("rm.recursive-force-root-or-home",TP);if(le.includes("git_metadata_target"))return st("rm.git-metadata",y);if(Js(Q,u))return null;return Gt(st("rsync.delete",PP),u.policy)}function OP(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Yg=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>ha(n.words,Aa(n))},{heads:new Set(["cmd"]),analyze:(n)=>jg(n.words,{...Aa(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>Vg(n.parsedWords,(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>pa(n.words,td(n))},{heads:new Set(["find"]),analyze:(n)=>Sp(n.words,{...Aa(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>qg(n.words,{...Aa(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>sg(n.words,{...Kg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,b)=>Nr(n.options.analyzeNested(u,b))})},{heads:new Set(["parallel"]),analyze:(n)=>bg(n.words,{...Kg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,b)=>Nr(n.options.analyzeNested(u,b))})}];function Kg(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Nr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function Aa(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(n.envAssignments,n.options.environment),trustedTmpdirValue:To(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function td(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function Jg(n){return Yg.find((u)=>u.heads.has(n))?.analyze}function qo(n,u,b){let W=b.trace;if(n.length===0)return null;let z=b.commandView?.dialect??"posix",B=(Et)=>Et.map(($t)=>z==="posix"?t($t):$t.text),Q=b.child,ee=Q!==void 0&&!Q.embedded,le=Q?.embedded===!0,ue=b.effectiveCwd===null,ve=Q?Q.cwd:ue?void 0:b.effectiveCwd??b.cwd,Oe=Q?Q.originalCwd:ue?void 0:b.cwd,De=Ae(n);if(De.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...De.envAssignments.keys()],output:B(De.words)});let Me=gr(De.words,b.environment,ve,new Map([...b.envAssignments??[],...De.envAssignments])),Ne=Me.envSplitValues??[];if(Ne.length>0){let Et=[...Ne,...B(Me.words)].join(" "),$t=Un(Et);if($t)return W?.recordSegment({type:"dangerous-text",token:Et,matched:!0,reason:$t.reason}),wn($t);if(b.strict)return En(W);let Xt=Yr(Ne,B(Me.words));if(Xt){b.budget.charge("derivedTokens",Xt.length);let Gn=b.analyzeNested(Xt.join(" "),{effectiveCwd:Me.cwd===void 0?b.effectiveCwd:Me.cwd,envAssignments:new Map([...b.envAssignments??[],...De.envAssignments,...Me.envAssignments])});if(Gn)return Gn}}let Le=Me.rewritten?tn(B(Me.words)):ce(z,Me.words),We=B(Le),Be={...b,wrapperNormalizationBudget:b.wrapperNormalizationBudget??{iterations:0}};if(W&&De.words.length>Le.length){let Et=B(De.words);W.recordSegment({type:"leading-tokens-stripped",input:Et,removed:Et.slice(0,Et.length-Le.length),output:We})}let ze=new Map([...b.envAssignments??[],...De.envAssignments,...Me.envAssignments]),it=We[0];if(!it)return null;if(no(it))throw new a("wrapperPeelIterations");let at=Bt(it),Rt=Me.cwd===null?void 0:Me.cwd??ve,Tt=Me.cwd===null?void 0:Oe,kt=Me.cwd===void 0?b.effectiveCwd:Me.cwd,lt=Me.cwd===void 0?b.effectiveCwd:null,Vt=Q?Q.allowTmpdirVar:!wi(ze,b.environment),Ut=Ng(z,Me.words,b.environment,u===0,b.strict,b.policy);if(Ut)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Ut.reason}),wn(Ut);let an=sa(We,b.policy);if(an){for(let Et of[an.childIndex,...an.alternativeChildIndices]){Xg(Be.wrapperNormalizationBudget);let $t=Le.slice(Et);W?.recordSegment({type:"transparent-wrapper",wrapper:an.wrapper,output:B($t)});let Xt=qo($t,u,{...Be,effectiveCwd:kt,envAssignments:ze});if(Xt)return Xt}return null}let Sn=le?void 0:at==="eval"?Sa(Le):at==="trap"&&!ee?Xp(Le):void 0;if(ee&&Q&&at==="eval"){if(Sn?.kind==="dynamic")return Vo(Q,b.policy);if(Sn?.kind==="literal"){let Et=b.analyzeNested(Sn.source,{effectiveCwd:kt,envAssignments:ze});if(Et)return Et}return Ko(Q,b.policy)}if(Sn?.kind==="dynamic"&&(b.strict||!b.commandView||!$c(b.commandView)))return En(W);if(Sn?.kind==="literal"){W?.recordSegment({type:"recurse",reason:at==="eval"?"shell-eval":"shell-trap",innerCommand:Sn.source,depth:u+1});let Et=b.analyzeNested(Sn.source,{effectiveCwd:kt,envAssignments:ze,functionDefinitions:b.functionDefinitions});if(Et)return Et}if(ee?nn.has(at):rh(it,at)){if(Qn(We))return null;if(ca(We))return En(W);if(ee&&Q){let Et=jn(We);if(Et){if(Q.dynamicSourceInput??Q.dynamicInput){let Xt=Vo(Q,b.policy);if(Xt)return Xt}if(Bi(Et)){let Xt=Vo(Q,b.policy);if(Xt)return Xt}return b.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze})}let $t=br(Le);if($t.kind==="dynamic")return Vo(Q,b.policy);if($t.kind==="literal")return Q.dynamicSourceInput?Vo(Q,b.policy):null;return Q.dynamicSourceInput??Q.dynamicInput?Vo(Q,b.policy):null}if(le){let Et=jn(We),$t=Et?b.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze}):br(Le).kind==="dynamic"?En(W):null;if($t)return $t}if(Q===void 0){let Et=WP(We,ze,kt,b,W,u);if(Et)return Et;let $t=jn(We);if($t){let Rn=Pn(We).commandIndex,cn=Rn===null?void 0:Le[Rn];if(cn&&b.commandView&&zi(cn,b.commandView.nested,b.environment))return En(W);let tr=Ca(Le,$t);if(tr.kind==="dynamic")return En(W);let cr=tr.kind==="literal"?tr.source:Qp(Le,$t),Pd=zP(cr);W?.recordSegment({type:"shell-wrapper",wrapper:at,innerCommand:Pd}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Pd,depth:u+1});let Td=b.analyzeNested(cr,{effectiveCwd:kt,envAssignments:ze});if(Td)return Td;return Bi(cr)?En(W):null}let Xt=br(Le,b.environment.home,b.strict?void 0:zo(b.shellAssignments??new Map,{home:b.environment.home,cwd:lt}));if(Xt.kind==="dynamic")return En(W);if(Xt.kind==="literal")return ji(Xt.source,kt,ze,b,W,u);let Gn=Jp(Le,b.commandView?.redirections??[],b.hasPipelineInput??!1,b.literalShellInput);if(Gn.kind==="dynamic")return En(W);if(Gn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Gn.source,depth:u+1}),b.analyzeNested(Gn.source,{effectiveCwd:kt,envAssignments:ze})}}if(!Q&&(at==="source"||at===".")){let Et=We[1]==="-p"?2:null;if(Et!==null){let cn=b.commandView?Le[Et]:void 0;if(!cn)return null;if(cn.provenance!=="literal")return En(W)}let $t=Et===null?1:3,Xt=We[$t]==="--"?$t+1:$t,Gn=b.commandView?Le[Xt]:void 0;if(!Gn)return null;let Rn=Zg(Gn,b,lt);if(Rn!==null)return ji(Rn,kt,ze,b,W,u);if(b.strict||!b.commandView||!$c(b.commandView))return En(W)}let zt=Le[0];if(!Q&&zt&&it.includes("/")){let Et=Zg(zt,b,lt),$t=Et===null?null:ji(Et,kt,ze,b,W,u,!1,!0);if($t)return $t}if(Bn.has(at)&&!le){if(!Q&&b.strict&&Zc(Ni(We),Le))return En(W);let Et=lp(We,(Xt)=>Nr(b.analyzeNested(Xt,{effectiveCwd:kt,envAssignments:ze}))),$t=Gt(Et,b.policy);if($t)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:$t.reason}),wn($t)}if(Ln(at)&&!le){let Et=ea(We),$t=b.remotePipelineInput===!0&&!eg(b.commandView?.redirections??[])&&!gc(We)&&Et.every((cn)=>cn.kind==="main-script"&&cn.value==="-"),Xt=Et.some((cn)=>{let tr=Le[cn.tokenIndex];return cn.kind!=="module-file"&&tr!==void 0&&b.commandView!==void 0&&zi(tr,b.commandView.nested,b.environment)}),Gn=!gc(We)&&Et.some((cn)=>cn.kind==="main-script"&&Le[cn.tokenIndex]?.provenance==="literal"&&b.downloadedPaths?.has(Ar(cn.value,kt,b.environment.paths,b.budget)??""));if(!Q&&($t||Xt||Gn||b.strict&&Zc(Et,Le)))return En(W);let Rn=Yf(We);if(ee&&Q)return NP(at,Rn,kt,ze,b,Q);if(Rn){let cn=un(b.policy,"interpreter.one-liner-paranoid",!!b.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:at,codeArg:Rn,paranoidBlocked:cn}),cn){let cr=Gt(st("interpreter.one-liner-paranoid",ki),b.policy);if(cr)return wn(cr)}if(hc(at,Rn))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rn,depth:u+1});let tr=b.analyzeNested(Rn,{effectiveCwd:kt,envAssignments:ze});if(tr&&!eh(tr,Rn))return tr;if(Oi(Rn,void 0,!b.strict)){let cr=Gt(st("interpreter.dangerous-command",Lo),b.policy);if(cr)return W?.recordSegment({type:"dangerous-text",token:Rn,matched:!0,reason:Lo}),wn(cr)}W=void 0}}if(at==="busybox"&&We.length>1)return Xg(Be.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),qo(Le.slice(1),u,{...Be,effectiveCwd:kt,envAssignments:ze});let Qt=Q?void 0:[["analyzer/device.ts:analyzeDeviceCommandMatch",Jm(at,We)],["analyzer/network.ts:analyzeNetworkCommandMatch",Bg(at,We)],["analyzer/namespace.ts:analyzeNamespaceCommandMatch",Fg(at,We)]].map(([Et,$t])=>({rule:Et,match:Gt($t,b.policy)})).find((Et)=>Et.match);if(Qt?.match)return W?.recordSegment({type:"rule-check",rule:Qt.rule,matched:!0,reason:Qt.match.reason}),wn(Qt.match);let on=W===Be.trace?Be:{...Be,trace:W},mn={words:Le,parsedWords:Me.words,head:at,cwd:Rt,originalCwd:Tt,envAssignments:ze,allowTmpdirVar:Vt,dynamicArguments:Me.words.some((Et)=>Et.provenance==="command-substitution"),depth:u,effectiveCwd:kt,options:on,analyzeChildTokens:(Et,$t)=>ee&&Q?rd(Et,u,on,{...Q,cwd:$t??void 0,effectiveCwd:$t??void 0}):Nr(qo(tn(Et),u+1,{...on,child:void 0,commandView:void 0,effectiveCwd:$t,envAssignments:ze}))??F(Et,on.policy.rules),analyzeChild:(Et,$t)=>rd(Et,u,on,$t)},vn=Q&&(at==="xargs"||at==="parallel")?void 0:Jg(at);if(at==="rm"||at==="xargs"||at==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:ze.has("TMPDIR")||b.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Vt});let sn=W&&at==="git"?Bp(mn.words,td(mn)):void 0,fn=Qg(sn?sn.match:vn?.(mn)??null,b.policy);if(W)$P(mn,fn,sn?.relaxation??null);if(fn)return wn(fn);if(ee&&Q&&(at==="rm"||at==="rmdir")){if(!(at==="rm"&&(Sr(We)||Q.dynamicRmInput)))return null;return(Q.dynamicRmInput?Ko(Q,b.policy):null)??LP(Q,b.policy)}let fo=vn!==void 0&&!UP.has(at),Wr=!Q&&!fo&&!ls.has(at),Rr=W&&Wr?[]:void 0;if(Wr)for(let Et=1;Et<We.length;Et++){let $t=We[Et];if(!$t)continue;Rr?.push($t);let Xt=Qg(DP(We,Et,u,on,Rt,Tt,kt,ze),b.policy);if(Xt)return W?.recordSegment({type:"fallback-scan",tokensScanned:Rr??[],embeddedCommandFound:Bt($t)}),wn(Xt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:Rr??[]}),le&&Q&&!Q.wrappedByTransparent)return null;let po=F(We,b.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:b.policy.rules.length>0,matched:!!po,reason:po?.reason}),po)return wn(po);return ee&&Q?Ko(Q,b.policy):null}function rd(n,u,b,W){return Nr(qo(tn(n),u+1,{...b,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function DP(n,u,b,W,z,B,Q,ee){for(let le of Xn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:ee,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let ve=Bt(ue);if(rh(ue,ve)||Jg(ve)!==void 0&&ve!=="xargs"&&ve!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let De=rd(le.tokens,b,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?Q:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!wi(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(De)return De}return null}function NP(n,u,b,W,z,B){if(!u)return Ko(B,z.policy);if(un(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let ee=Gt(st("interpreter.one-liner-paranoid",ki),z.policy);if(ee)return wn(ee)}if(hc(n,u))return Ko(B,z.policy);let Q=z.analyzeNested(u,{effectiveCwd:b,envAssignments:W});if(Q&&!eh(Q,u))return Q;if(Oi(u,void 0,!z.strict)){let ee=Gt(st("interpreter.dangerous-command",Lo),z.policy);if(ee)return wn(ee)}return Ko(B,z.policy)}function eh(n,u){let b=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(Ks)||n.reason===ir)&&!ds(u);return b||W}function Vo(n,u){let b=n.shellDynamicMatch?Gt(n.shellDynamicMatch,u):null;return b?wn(b):null}function Ko(n,u){let b=n.dynamicSourceInput&&n.dynamicSourceMatch?Gt(n.dynamicSourceMatch,u):null;return b?wn(b):null}function LP(n,u){let b=n.dynamicInput&&n.rmDynamicMatch?Gt(n.rmDynamicMatch,u):null;return b?wn(b):null}function WP(n,u,b,W,z,B){let Q=yp(n);if(Q.argvSource?.kind==="absent")return En(z);if(Q.argvSourceApplies&&Q.argvSource){let le=ji(Q.argvSource.value,b,u,W,z,B,!0);if(le)return le}if(!Q.envSourceApplies||!Q.envName)return null;let ee=u.get(Q.envName);if(!ee)return null;return ji(ee,b,u,W,z,B,!0)}function Zg(n,u,b){let W=u.environment.home,z=$o(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Jn(n,zo(u.shellAssignments??new Map,{home:W,cwd:b}))}var th=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function ji(n,u,b,W,z,B,Q=!1,ee=!1){if(Q&&/[$`*?[\]]/.test(n))return En(z);let le=Ar(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0&&(Q||le&&W.downloadedPaths?.has(le)))return En(z);if(ue===void 0)return le?FP(n,le,u,b,W,z,ee):null;if(ee&&ue.startsWith("#!")&&!th.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!ee)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:b});let ve=nh(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:b}));return ve?.intent==="stop_and_explain"?null:ve}var od=/^(?:analysis|raw-text)\.|^(?!custom\.).*dynamic|^interpreter\.one-liner-paranoid$/;function FP(n,u,b,W,z,B,Q){if([...z.writtenPaths??[]].some((Ne)=>u===Ne||u.startsWith(`${Ne}${MP}`)))return null;let le=z.scriptReads??{},ue=le.budget??=xn(),ve=(Ne)=>nh(()=>{if(Ne)GP(ue);ue.charge("scriptFiles");let Le=rf(u);if(Le===null)return null;if(Q&&Le.text.startsWith("#!")&&!th.test(Le.text))return null;if(!Ne)B?.recordSegment({type:"script-file",path:n,bytes:Le.bytes});let We=z.analyzeNested(Le.text,{effectiveCwd:b,envAssignments:W,scriptBudget:ue,withoutUncertainCapabilities:Ne,untraced:!0});if(!We||We.scriptLocation)return We;let Be=We.sourceOffset===void 0?"":`:${Le.text.slice(0,We.sourceOffset).split(`
-`).length}`;return{...We,scriptLocation:`${n}${Be}`}}),Oe=(Ne)=>Ne&&!od.test(Ne.ruleId)?Ne:null,De=ve(),Me=z.strict||z.paranoidInterpreters;return Oe(De)??(Me&&De?Oe(ve(!0)):null)}function GP(n){let u=n.counters.get("scriptFiles");if(n.counters.clear(),u!==void 0)n.counters.set("scriptFiles",u)}function nh(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function zP(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function $P(n,u,b){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!b,reason:u?.reason??b?.originalReason}),b)n.options.trace?.recordSegment({type:b.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:b.originalReason,gitCwd:b.gitCwd})}function Xg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function wn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function En(n){return n?.recordSegment({type:"error",message:Qr}),wn(sr())}function rh(n,u){return nn.has(u)||n==="$SHELL"||n==="${SHELL}"||nn.has(Wt(u))}function Qg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Gt(n,u)}var BP=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,UP=new Set(["powershell","pwsh"]),HP=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function jP(n,u){let b=sh(n,u);if(b.length===0)return!1;let W=b[ih(b)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return BP.test(n.join(" "))}function oh(n,u,b,W,z){if(n.dialect==="powershell"){let it=VP(n.words,z);if(it.kind==="none")return;if(!u||it.kind==="unknown")return null;return nd(ZP(it.target),u,b.paths)}let B=n.words.map(t),Q=B.some((it)=>/^CDPATH\+?=/.test(it));if(!jP(B,b))return Q?null:void 0;if(!u)return null;let ee=sh(B,b,u),le=ih(ee);if(le===-1||ee[le]!=="cd")return null;let ue=ee.slice(le+1),ve=ue.findIndex((it)=>it.length<=1||!it.startsWith("-")||it==="--");if((ve===-1?ue:ue.slice(0,ve)).some((it)=>!/^-[LP]+$/.test(it)))return null;let De=ve===-1?[]:ue.slice(ve),Me=De[0]==="--"?De.slice(1):De;if(Me.length>1)return null;let Ne=Me[0],Le=W.get("HOME")||b.home;if(Ne===void 0)return nd(Cn(Le),u,b.paths);let We=n.words.find((it)=>it.provenance==="variable"&&it.text===Ne),Be=n.words.find((it)=>it.text===Ne&&/^~(?:\/|$)/.test(it.raw)),ze=We?Jn(We,new Map([...W,["HOME",Le]])):Be?`${Le}${Ne.slice(1)}`:Ne;if(ze===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(ze)&&(Q||b.env.has("CDPATH")))return null;return nd(Cn(ze),u,b.paths)}function nd(n,u,b){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=Tr(u,n,b);return b.isDirectory(W)?W:null}catch{return null}}function VP(n,u){let b=qP(n[0])?1:0,W=n[b];if(!KP(W,b===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!HP.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return YP(n.slice(b+1),u)}function qP(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function KP(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function YP(n,u){let b;for(let W of n){if(W.provenance!=="literal"||b!==void 0)return{kind:"unknown"};b=W.text}if(b!==void 0)return{kind:"target",target:b};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function ZP(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function ih(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let b=u+1;while(n[b]?.startsWith("-"))b++;return b}function sh(n,u,b){let W=XP(n);return or([...W],u,b)}function XP(n){let u=0;while(u<n.length){let b=n[u];if(b!=="{"&&b!=="("&&b!=="$(")break;u++}return n.slice(u)}var rT="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",ao="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function oT(n){let u=_e({...n,effectiveCapabilities:{...n.effectiveCapabilities,fail_closed:{...n.effectiveCapabilities.fail_closed,enabled:!1},paranoid_interpreters:{...n.effectiveCapabilities.paranoid_interpreters,enabled:!1}}}),b=Object.fromEntries(Object.entries(u.policy.effectiveDestructiveCommandRules).map(([W,z])=>[W,od.test(W)?z:n.policy.effectiveDestructiveCommandRules[W]??z]));return{...u,policy:Object.freeze({...u.policy,effectiveDestructiveCommandRules:Object.freeze(b)})}}function ud(n,u,b,W){if(u>=l.recursionDepth.cap)return b.trace?.recordSegment({type:"error",message:nr}),{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??b.factStore?.getCommandProgram(n,b.shell??"auto")??C(n,b.shell);if(z.status==="limited")return b.trace?.recordSegment({type:"error",message:nr}),{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let ve=z.issues.find((Oe)=>Oe.code.includes("heredoc"));if(ve){if(!b.strict)return dd(n,b);let Oe=`${Ks}: ${ve.message}`;return b.trace?.recordGlobal({type:"error",message:Oe}),{reason:Oe,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return ph(n,b),{reason:ir,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(b.strict&&z.status==="partial")return ph(n,b),{reason:ir,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((ve)=>ve.code.includes("quote")))return dd(n,b);let Q=b.cwd,ee=b.effectiveCwd!==void 0?b.effectiveCwd:b.cwd,le=Ip(b.environment.env,b.envAssignments),ue={...b,rootProgram:z,writtenPaths:b.writtenPaths??new Set,downloadedPaths:b.downloadedPaths??new Set,scriptReads:b.scriptReads??{}};return Ia(z,u,ue,Q,[{effectiveCwd:ee,shellGitContextState:le,literalHeredocFiles:new Map(b.literalHeredocFiles),functionDefinitions:new Map(b.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Ia(n,u,b,W,z){let B=[...z],Q,ee,le,ue=!1;for(let[ve,Oe]of n.nodes.entries()){if(Oe.kind==="connector"){ee=Oe.operator;continue}let De=Er(ee)&&ue;ue=De||Oe.kind==="command"&&(ba(Oe,b.environment)||Oe.dialect==="powershell"&&yh(Oe.words));let Me=n.nodes[ve+1],Ne=Me?.kind==="connector"?Me.operator:void 0,Le=iT(n,ve,Oe,ee,Ne),Be=ee==="&&"||ee==="||"?Q:void 0,ze=ee==="&&"?Be?.success??B:ee==="||"?Be?.failure??B:B,it=ee==="||"?Be?.success??[]:[],at=ee==="&&"?Be?.failure??[]:[],Rt={connector:ee,skippedSuccessStates:it,skippedFailureStates:at};if(Er(Ne)&&!Er(ee))le=Rt;let Tt=Er(Ne)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Er(ee)?le??Rt:Rt,kt=lo(Tt.connector)||lo(Ne);if(Oe.kind==="function"){let on=ze.flatMap((vn)=>{let sn=co(vn);return sn.functionDefinitions.set(Oe.name,Oe.body),id(vn,[sn],Le,Ne==="&",lo(Ne))}),mn=sd(on,[],Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=mn.states,Q=mn.conditionalStates,ee=void 0;continue}if(Oe.kind==="group"){let on=[],mn=[];for(let sn of ze){let fn=Ia(Oe.body,u,b,W,[co(sn)]);if(fn.result)return fn;if(on.push(...id(sn,fn.states,Le,Ne==="&",lo(Ne))),kt)mn.push(sn,...Le?fn.states.map((fo)=>Pa(sn,fo)):fn.states)}let vn=sd(on,mn,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=vn.states,Q=vn.conditionalStates,ee=void 0;continue}if(Oe.kind!=="command")continue;let lt=WT(n.nodes[ve-1]),Vt=b.trace?.flattenNested?b.trace.currentSegmentIndex:b.trace?.allocateSegment(),Ut=n.nodes[ve-2],an=Er(ee)&&Ut?.kind==="command"?Ut:void 0,Sn=an?Zp(an)??aT(an):void 0,ut=[],zt=[];for(let on of ze){let mn=lT(Oe,u,b,W,[co(on)]);if(mn.result)return{result:mn.result,states:B};let vn=n.dialect==="powershell"?mn.states:mn.states.map((sn)=>Pa(on,sn));for(let sn of vn){let fn=co(sn),fo=mT(Oe,u,b.trace?{...b,trace:hh(b.trace,Vt)}:b,W,fn,Er(ee),Sn,De);if(fo)return{result:{...fo,sourceOffset:Oe.span.start},states:B};let Wr=HT(Oe,fn.functionDefinitions);if(Wr)b.budget.charge("derivedTokens",ka(Wr));let Rr=Wr?u+1>=l.recursionDepth.cap?ld(Oe.displayText,b,[fn]):Ia(Wr,u+1,b,W,[fn]):{result:null,states:BT(Oe,fn).flatMap((Et)=>FT(Oe,sn,Et,lt))};if(Rr.result)return Rr;ut.push(...id(on,Rr.states,Le,Ne==="&",lo(Ne)));let po=typeof fn.effectiveCwd==="string"&&fn.effectiveCwd!==sn.effectiveCwd&&Oe.redirections.every((Et)=>["<",">",">>",">|"].includes(Et.operator)&&Et.target?.text==="/dev/null");if(kt&&(lt||!po))zt.push(on),zt.push(...Rr.states.map((Et)=>Le?Pa(on,Et):Et))}}let Qt=sd(ut,zt,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=Qt.states,Q=Qt.conditionalStates,ee=void 0}return{result:null,states:B}}function iT(n,u,b,W,z){if(b.kind==="group"&&b.style==="subshell")return!0;if(n.dialect==="posix"&&(Er(W)||Er(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&b.kind==="group"&&b.style==="brace"&&sT(n,u)}function id(n,u,b,W,z){let B=b?u.map((ee)=>Pa(n,ee)):[...u],Q=z?B.flatMap((ee)=>Yo(n.literalHeredocFiles,ee.literalHeredocFiles)?[ee]:[{...ee,literalHeredocFiles:new Map(n.literalHeredocFiles)},ee]):B;return W?[n,...Q]:Q}function Pa(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function sT(n,u){let b=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!b||b.kind!=="command")return!0;let W=b.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(cT(b))return!0;return b.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Er(n){return n==="|"||n==="|&"}function aT(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function lo(n){return n==="&&"||n==="||"}function sd(n,u,b,W,z,B){let Q={success:Ta([...b,...n]),failure:Ta([...W,...u])},ee=lo(B)?Q:void 0;return{states:lo(z)||ee?Ta([...Q.success,...Q.failure]):Q.success,conditionalStates:ee}}function hh(n,u,b=n.flattenNested){return{currentSegmentIndex:u,flattenNested:b,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function lT(n,u,b,W,z){let B=n.nested.map((Q)=>({program:Q,depth:u}));if(n.dialect==="powershell"){let Q=dT(n);if(Q){if(u+1>=l.recursionDepth.cap)return ld(Q,b,z);let ee=C(Q,"powershell");if(ee.status==="limited")return ld(Q,b,z);if(ee.status!=="complete")return ah(B,b,W,z);b.budget.charge("derivedTokens",ka(ee)),B.push({program:ee,depth:u+1})}}return ah(B,b,W,z)}function cT(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function ah(n,u,b,W){let z=[...W];for(let B of n){let Q=[];for(let ee of z){let le=Ia(B.program,B.depth,u,b,[co(ee)]);if(le.result)return le;Q.push(...le.states)}z=Ta(Q)}return{result:null,states:z}}function dT(n){let u=Sh(n),b=u?.[0];return u?.length===1&&b?.quoted&&b.provenance==="literal"?b.text:void 0}function uT(n,u,b){let W=Sh(n);if(!W)return!1;return u||W.some((z)=>zi(z,n.nested,b))||yh(W)}function yh(n){return n.some((u)=>/\.Download(?:String|Data)\(/i.test(u.raw)||!u.quoted&&ya(/^(?:\$?\(|[&.\s])*([^\s()]*)/.exec(u.raw)?.[1]??"","powershell"))}function Sh(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),b=u?1:0,W=n.words[b];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(b+1);return z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?z.slice(1):z}function ka(n){return n.nodes.reduce((u,b)=>u+(b.kind==="command"?b.words.length+b.nested.reduce((W,z)=>W+ka(z),0):b.kind==="group"||b.kind==="function"?ka(b.body):0),0)}function ld(n,u,b){return u.trace?.recordSegment({type:"error",message:nr}),{result:{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...b]}}function mT(n,u,b,W,z,B,Q,ee){let le={...b,environment:{...b.environment,env:z.shellGitContextState.env,paths:_T(b.environment.paths,z.createdDirectories,b.budget)}},ue=kT(n,!le.strict);if(ue&&le.strict)return le.trace?.recordSegment({type:"error",message:ue}),{reason:ue,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};bT(n,z,le),vT(n,z,le),Ch(n,z,"before-consumer",le.environment.paths,le.budget);let ve=ce(n.dialect,n.words),Oe=ve.map(t),De=n.displayText,Me=Pp(ve,z.shellGitContextState,{home:le.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:le.environment.darwinUserTempDir}),Ne=Op(Me,z.shellGitContextState);if(n.dialect==="powershell"){let ze=Gt(tp(n,B,jT(le,z.effectiveCwd)),le.policy);if(le.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ze,reason:ze?.reason}),ze)return ad(De,ze);if(uT(n,ee,le.environment))return le.trace?.recordSegment({type:"error",message:Qr}),ad(De,sr())}let Le=Gt(ef(n.redirections),le.policy);if(Le)return le.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Le.reason}),ad(De,Le);if(Oe.length===1&&Oe[0]?.includes(" ")&&!gi(n.dialect,n.words)){let ze=Gt(Un(Oe[0]),le.policy),it=ze!==null&&!le.strict&&Ym(n,le.rootProgram);if(ze&&!it)return le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!0,reason:ze.reason}),{reason:ze.reason,segment:De,ruleId:ze.id,intent:ze.intent};le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!1});let at=lh(n,ue,z,Ne,Q,le);if(at)return at;return Nc(Me,z.shellGitContextState),null}let We=qo(n.words,u,{...le,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Ne,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:Q,remotePipelineInput:ee,analyzeNested:(ze,it)=>{let at=it&&Object.hasOwn(it,"effectiveCwd")?it.effectiveCwd:z.effectiveCwd,Rt=ud(ze,u+1,{...le,...it?.withoutUncertainCapabilities?oT(le):{},budget:it?.scriptBudget??le.budget,effectiveCwd:at,envAssignments:it?.envAssignments??Ne,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:it?.functionDefinitions,worktreeMode:it?.worktreeMode??le.worktreeMode,shell:it?.shell??le.shell,trace:le.trace&&!it?.untraced?hh(le.trace,le.trace.currentSegmentIndex,!0):void 0});return Rt?{reason:Rt.reason,ruleId:Rt.ruleId,intent:Rt.intent,sourceOffset:Rt.sourceOffset,scriptLocation:Rt.scriptLocation}:null}});if(We)return{...We,segment:De};let Be=lh(n,ue,z,Ne,Q,le);if(Be)return Be;return Nc(Me,z.shellGitContextState),null}function lh(n,u,b,W,z,B){let Q=OT(n,u,b,W??new Map,B);if(Q)return Q;if(Ch(n,b,"after-consumer",B.environment.paths,B.budget),!gT(n))b.literalHeredocFiles.clear();return RT(n,u,b,B.environment.paths,B.budget,B.environment.home),xT(n,b,B.environment.paths,B.budget,B.environment.home),NT(n,b,z,B.environment,B.trace),null}var fT=new Set([">>","<>"]),pT=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function gT(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>pT.test(u.raw))}var hT=new Set(["cp","mv","install","ln","sed","curl","wget","tee"]),yT=new Set(["cp","mv","install","ln"]),ST=/^-[^-]*i|^--in-place/,ch=/^(?:-t|--target-directory=?)(.*)$/;function CT(n){let u=n.findIndex((Oe)=>hT.has(Wt(Oe.text))),b=Wt(n[u]?.text??""),W=n.slice(u+1).filter((Oe)=>Oe.provenance==="literal").map((Oe)=>Oe.text);if(u===-1)return[];if(b==="sed")return W.some((Oe)=>ST.test(Oe))?W:[];if(!yT.has(b))return W;let z=W.findIndex((Oe)=>ch.test(Oe)),B=W[z]?.match(ch)?.[1],Q=z!==-1&&!B,ee=Q?W[z+1]:B,le=W.filter((Oe,De)=>!Oe.startsWith("-")&&!(Q&&De===z+1)),ue=ee??le.at(-1);if(ue===void 0)return[];return[...ee===void 0?le.slice(1):[ee],...le.map((Oe)=>gh(ue,Wt(Oe)))]}function bT(n,u,b){let W=b.writtenPaths;if(!W)return;let B=[...n.redirections.flatMap((Q)=>Q.operator.includes(">")&&Q.target?[Q.target]:[]).filter((Q)=>Q.provenance==="literal").map((Q)=>Q.text),...CT(n.words)].flatMap((Q)=>[Q,Q.slice(Q.indexOf("=")+1),Wt(Q.split(/[?#]/)[0]??"")]);for(let Q of new Set(B.filter(Boolean))){let ee=Ar(Q,u.effectiveCwd,b.environment.paths,b.budget);if(ee)W.add(ee)}}var dh=new Map([["curl",/^(?:-[^-o]*o|--output(?:=|$))(.*)/],["wget",/^(?:-[^-O]*O|--output-document(?:=|$))(.*)/]]);function ET(n){let u=n.findIndex((W)=>dh.has(Wt(W.text))),b=dh.get(Wt(n[u]?.text??""));return n.slice(u+1).flatMap((W,z,B)=>{let Q=W.provenance==="literal"?b?.exec(W.text)?.[1]:void 0,ee=B[z+1];if(Q)return[Q];return Q===""&&ee?.provenance==="literal"?[ee.text]:[]})}function vT(n,u,b){let W=ba(n,b.environment),z=[...n.redirections.filter(bh).flatMap((B)=>B.target?.provenance==="literal"?[B.target.text]:[]),...W?ET(n.words):[]];for(let B of z.filter((Q)=>Q!=="-")){let Q=Ar(B,u.effectiveCwd,b.environment.paths,b.budget);if(Q&&W)b.downloadedPaths?.add(Q);if(Q&&!W)b.downloadedPaths?.delete(Q)}}function Ch(n,u,b,W,z){for(let Q of n.redirections){if(!(b==="before-consumer"?bh(Q):fT.has(Q.operator)))continue;uh(Q.target,u,W,z)}if(b!=="before-consumer"||!yn(n.words[0],"tee"))return;let B=vh(n.words.slice(1));if(!B)return;for(let Q of B.operands)uh(Q,u,W,z)}function bh(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function uh(n,u,b,W){let z=n?.provenance==="literal"?Ar(n.text,u.effectiveCwd,b,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function RT(n,u,b,W,z,B){if(u)return;let Q=n.redirections.find((ee)=>ee.operator==="<<"||ee.operator==="<<-")?.heredoc;if(!Q)return;for(let ee of wT(n,zo(b.shellGitContextState.shellAssignments,{home:B,cwd:b.effectiveCwd}),B)){let le=Ar(ee,b.effectiveCwd,W,z);if(!le||!Ql(le))continue;if(!b.literalHeredocFiles.has(le)&&b.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");b.literalHeredocFiles.set(le,Q.body)}}function wT(n,u,b){let W=cd(TT(n.redirections)?.target,u,b),z=W===void 0?[]:[W];if(yn(n.words[0],"cat"))return PT(n.words)?z:[];if(!yn(n.words[0],"tee"))return[];let B=vh(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let Q=B.operands.map((ee)=>cd(ee,u,b));if(!Q.every((ee)=>ee!==void 0))return[];return[...Q,...z]}function cd(n,u,b){if(IT(n))return n.text;if(!n)return;return $o(n,b)??Jn(n,u)??void 0}function _T(n,u,b){if(u.size===0)return n;let W=(z)=>{let B=jt(z,n,b);return[...u].some((Q)=>Q===B||Q.startsWith(`${B}${nT}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?jt(z,n,b):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function xT(n,u,b,W,z){if(u.shellGitContextState.bodyDepth>0||!yn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((ve)=>cd(ve,u.shellGitContextState.shellAssignments,z));if(!B.every((ve)=>ve!==void 0))return;let Q=B.findIndex((ve)=>ve==="--"||ve==="-"||!ve.startsWith("-")),ee=B.slice(0,Q);if(Q===-1||!ee.every((ve)=>/^(?:-[pv]+|--parents|--verbose)$/.test(ve)))return;let le=ee.some((ve)=>ve==="--parents"||/^-v*p/.test(ve)),ue=u.effectiveCwd;for(let ve of B.slice(B[Q]==="--"?Q+1:Q)){if(ve.split(/[\\/]/).includes("..")||!JP(ve)&&!ue)continue;let Oe=jt(tT(ue??"",ve),b,W);if(le?AT(Oe,b):b.isDirectory(QP(Oe))&&Eh(Oe,b))u.createdDirectories.add(Oe)}}function AT(n,u){let b=eT(n).root,W=n.slice(b.length).split(/[\\/]+/).filter(Boolean),z=(Q)=>gh(b,...W.slice(0,Q+1)),B=W.findIndex((Q,ee)=>!u.isDirectory(z(ee)));return B===-1||Eh(z(B),u)}function Eh(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function PT(n){let u=!1;for(let b of n.slice(1)){if(u||b.provenance!=="literal")return!1;if(b.text==="--"){u=!0;continue}if(!/^-u+$/.test(b.text))return!1}return!0}function TT(n){let u=n.findLast((b)=>(b.fd??([">",">|",">>",">&"].includes(b.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function vh(n,u=new Map){let b=[],W=!0,z=!1,B=!1;for(let Q of n){if(Q.provenance!=="literal"&&Jn(Q,u)===null)return;if(W&&yn(Q,"--")){W=!1;continue}if(W&&!Q.quoted&&Q.raw===Q.text&&/^-[^-]/.test(Q.text)){z||=Q.text.slice(1).includes("a"),B||=Array.from(Q.text.slice(1)).some((ee)=>ee!=="a"&&ee!=="i");continue}if(W&&!Q.quoted&&Q.raw===Q.text&&Q.text.startsWith("--")){z||=Q.text==="--append",B||=Q.text!=="--append"&&Q.text!=="--ignore-interrupts";continue}b.push(Q)}return{operands:b,append:z,hasUnsupportedOptions:B}}function IT(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function yn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function kT(n,u){let b=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(b.length===0)return;if(b.length!==1)return ao;let W=b[0];if(!W?.heredoc)return ao;let z=/\$\(|`/.test(W.heredoc.body);if(!Ho(W.heredoc)&&(!u||z))return rT;if(W.fd!==void 0&&W.fd!==0)return ao;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return ao;let B=n.redirections.some((le)=>le!==W&&mh(le.target));if(yn(n.words[0],"cat"))return B?ao:void 0;if(yn(n.words[0],"tee"))return B||n.words.slice(1).some(mh)?ao:void 0;let Q=n.words[0],ee=n.words[1];if(yn(Q,"git")&&(yn(ee,"apply")||yn(ee,"commit")))return;if(yn(Q,"gh")&&(yn(ee,"pr")||yn(ee,"issue"))&&yn(n.words[2],"create"))return;return ao}function mh(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function OT(n,u,b,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),Q=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(DT(n,B,b,W,z))return null;let ee=MT(n,B,z);if(ee!==void 0)return ee?{reason:ee.reason,segment:n.displayText,ruleId:ee.id,intent:ee.intent}:null;let le=dd(Q.length===B.length?Q.join(`
-`):n.source,z);return le?{...le,segment:n.displayText}:null}function MT(n,u,b){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!Ho(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=yn(n.words[0],"uv")&&yn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!Ln(B.text))return;let Q=z.findIndex((Oe)=>yn(Oe,"-"));if(!z.slice(1,Q===-1?void 0:Q).every((Oe)=>Oe.provenance==="literal"&&Oe.text.startsWith("-")))return;let le=W.heredoc.body,ue=un(b.policy,"interpreter.one-liner-paranoid",!!b.paranoidInterpreters);if(b.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let Oe=Gt(st("interpreter.one-liner-paranoid",ki),b.policy);if(Oe)return Oe}if(!Oi(le,void 0,!b.strict))return null;let ve=Gt(st("interpreter.dangerous-command",Lo),b.policy);if(!ve)return null;return b.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:ve.reason}),ve}function DT(n,u,b,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!Ho(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let Q=gr(n.words,z.environment,b.effectiveCwd,W),ee=Q.words.map(t),le=Bt(ee[0]??"");if((Q.envSplitValues?.length??0)>0||!nn.has(le)&&!nn.has(Wt(le)))return!1;return Qn(ee)}function NT(n,u,b,W,z){let B=oh(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,b);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var LT=new Set(["fi","done","esac"]);function WT(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function FT(n,u,b,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,Q=b.shellGitContextState.bodyDepth,ee=b.compoundBodies;if(Q>B)return b.compoundBodies=[...ee.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:ee[B]?.branchCwds??[],hasElse:!1}],[b];let le=B>0?ee[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return b.compoundBodies=[...ee.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,b.effectiveCwd],hasElse:z==="else"}],b.effectiveCwd=le.entryCwd,[b];let ue=le!==void 0&&LT.has(z);if(ue)b.compoundBodies=ee.slice(0,Q);return[...new Set([b.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((Oe)=>{if(Oe===b.effectiveCwd)return b;let De=co(b);return De.effectiveCwd=Oe,De})}function GT(n,u){return n.length===u.length&&n.every((b,W)=>{let z=u[W];return z!==void 0&&b.entryCwd===z.entryCwd&&b.hasElse===z.hasElse&&b.branchCwds.length===z.branchCwds.length&&b.branchCwds.every((B,Q)=>B===z.branchCwds[Q])})}var zT=/^[A-Za-z_][A-Za-z0-9_]*$/,$T=8;function BT(n,u){let b=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||b===void 0||!zT.test(b))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=$T&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(b),[u];return W.map((B)=>{let Q=co(u);return Q.shellGitContextState.shellAssignments.set(b,B.text),Q})}function co(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:kp(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function Ta(n){let u=[];for(let b of n){if(!u.some((W)=>UT(W,b)))u.push(b);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function UT(n,u){return n.effectiveCwd===u.effectiveCwd&&GT(n.compoundBodies,u.compoundBodies)&&Yo(n.shellGitContextState.env,u.shellGitContextState.env)&&Yo(n.literalHeredocFiles,u.literalHeredocFiles)&&Yo(n.functionDefinitions,u.functionDefinitions)&&Yo(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&Yo(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&fh(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&fh(n.createdDirectories,u.createdDirectories)}function fh(n,u){return n.size===u.size&&[...n].every((b)=>u.has(b))}function Yo(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([b,W])=>u.get(b)===W&&u.has(b))}function HT(n,u){let b=hi(n);return b===void 0?void 0:u.get(b)}function ad(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function jT(n,u=n.effectiveCwd){let b=u===null;return{environment:n.environment,cwd:b?void 0:u??n.cwd,originalCwd:b?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function dd(n,u){let b=Gt(Un(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!b,reason:b?.reason};if(u.trace?.recordSegment(z,W),!b&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return b?{reason:b.reason,segment:n,ruleId:b.id,intent:b.intent}:null}function ph(n,u){let b={type:"strict-unparseable",rawCommand:n,reason:ir},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(b);if(W!==void 0)u.trace?.recordSegment(b)}var VT=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Rh(n,u,b,W){let z=ud(n,0,{...u,..._e(u),budget:u.budget??xn(),factStore:W},b);if(!z)return null;return{kind:"deny",reason:z.scriptLocation?`${z.scriptLocation}: ${z.reason}`:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function wh(n,u,b){try{return{decision:n()}}catch(W){let z=qT(W,u,b);if(!z)throw W;return z}}function qT(n,u,b){if(!(n instanceof a)||!VT.has(n.kind))return null;let W=l[n.kind];if(b?.currentSegmentIndex!==void 0)b.recordSegment({type:"error",message:W.reason});if(b?.currentSegmentIndex===void 0)b?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var KT=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),fd=new Set(["cc-safety-net","ccsn"]),YT=new Set(["bunx","npx","pnpx"]),ZT=new Set(["pnpm","yarn"]),XT=new Set(["npm","pnpm","yarn"]),QT=new Set(["bun","node"]);function Ma(n,u,b={}){if(fd.has(n))return 0;if(YT.has(n)){if(b.broad)return md(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return Oa(u[z])?z+1:null}let W=b.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&XT.has(n)&&b.broad&&u[W]==="exec"){let z=md(u.slice(W+1));return z===null?null:W+1+z}if(ZT.has(n)){if(n==="yarn"&&!b.broad)return null;if(!b.broad)return u[0]==="dlx"&&Oa(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=md(u.slice(W+1));return z===null?null:W+1+z}if(QT.has(n)){let z=b.broad&&W!==-1?W:0;if(_h(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&_h(u[z+1]))return z+2}return null}function md(n){let u=n.findIndex((W)=>Oa(W));if(u===-1)return null;let b=u;while(b<n.length){let W=n[b]??"";if(!W.startsWith("-")&&!Oa(W))break;b++}return b}function Oa(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return fd.has(n);if(u===0)return!1;let b=n.slice(u+1);if(b===""||b.includes("/")||b.includes(":"))return!1;return fd.has(n.slice(0,u))}function _h(n){let u=n?.replaceAll("\\","/");return[...KT].some((b)=>u===b||u?.endsWith(`/${b}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function xh(n,u,b){let W=hr(n);if(!W)return null;let z=Do(W.shell,n.invocation.context.executionCwd,u,b,{findSegmentTarget:(B)=>JT(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function JT(n,u){let b=or([...n],u),W=b.slice(1),z=Ma(Wt(b[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((Q)=>Q!=="-g"&&Q!=="--global");return B[0]==="policy"&&B[1]==="apply"?b.join(" "):null}import{dirname as Da}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",eI=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Ih(n,u,b){let W=sI(n.invocation.context,u,b);if(n.invocation.route.kind==="patch")return Ah(n.paths,!1,n.invocation.context.executionCwd,W,u,b);let z=hr(n);if(n.invocation.route.kind==="command")return z?Ph(z.shell,n.invocation.context.executionCwd,W,u,b):null;if(n.invocation.route.kind==="unknown"&&z){let B=Ph(z.shell,n.invocation.context.executionCwd,W,u,b);if(B)return B}return Ah(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||fs(n.invocation.toolName),n.invocation.context.executionCwd,W,u,b)}function Ah(n,u,b,W,z,B){if(u)return null;let Q=n.find((ee)=>Vi(ee,b,W,z,B));return Q?{target:Q}:null}function Ph(n,u,b,W,z){let B=Do(n,u,W,z,{findSegmentTarget:(Q,ee)=>tI(Q,ee,b,W,z)?.target??null,isRedirectionTarget:(Q,ee)=>Vi(Q,ee.cwd,b,W,z),findMalformedTarget:(Q)=>iI(Q,u,b,W,z)?.target??null});return B?{target:B}:null}function tI(n,u,b,W,z){if(Ti(n))return null;let B=Ir([...n],W),Q=Wt(B[0]??"").toLowerCase(),ee=B.slice(1);if(Q==="rm"&&nI(ee)){let le=rI(ee).find((ue)=>Th(kn(ue,u.variables),u.cwd,b,W,z));if(le)return{target:le}}if(Q==="find"){if(da(B,1)||_c(B,W)){let ue=(Li(tn(B))??tn(["."])).find((ve)=>{let Oe=kn(ve.text,u.variables);return Vi(Oe,u.cwd,b,W,z)||Th(Oe,u.cwd,b,W,z)})?.text;if(ue)return{target:ue}}}if(Q==="mv"){let le=Ys(ee).sources.find((ue)=>aI(kn(ue,u.variables),u.cwd,b,W,z));if(le)return{target:le}}if(oI(B,Q))return null;for(let le of[...n,...B])for(let ue of kh(le))if(Vi(kn(ue,u.variables),u.cwd,b,W,z))return{target:ue};return null}function nI(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function rI(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((b)=>!b.startsWith("-")),...n.slice(u+1)];return n.filter((b)=>!b.startsWith("-"))}function oI(n,u){if(!eI.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((b)=>b.startsWith("-i")||b==="--in-place"||b.startsWith("--in-place="))}function iI(n,u,b,W,z){for(let B of n.split(/\s+/))for(let Q of kh(B))if(Vi(Q,u,b,W,z))return{target:Q};return null}function kh(n){let u=n.trim().replace(/^['"]|['"]$/g,""),b=u.indexOf("=");return b===-1||b===u.length-1?[u]:[u,u.slice(b+1)]}function sI(n,u,b){let W=(ee)=>qi(bn(ee,n.executionCwd,u,b)),z=W(p(u)),B=[W(x(n.executionCwd)),W(x(n.configCwd))],Q=new Set(B.map((ee)=>Da(ee)));for(let ee=Da(z);;ee=Da(ee))if(Q.add(ee),Da(ee)===ee)break;return{files:new Set([z,...B]),directoriesAndAncestors:Q}}function Vi(n,u,b,W,z){let B=Nd(n,u,W,z,(Q)=>qi(Q)===ss);return B!==null&&b.files.has(qi(B))}function Th(n,u,b,W,z){return b.directoriesAndAncestors.has(qi(bn(n,u,W,z)))}function aI(n,u,b,W,z){let B=qi(bn(n,u,W,z));return b.files.has(B)||b.directoriesAndAncestors.has(B)}function qi(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as Na,posix as jh,resolve as Fa,win32 as lI}from"node:path";import{fileURLToPath as cI}from"node:url";var Vh="Access to a sensitive path is not allowed.",qh=new Set(["echo","printf"]),dI=new Set(["find"]),uI=new Set(["!","do","elif","else","if","then","until","while"]),mI=new Set(["-exec","-execdir"]),fI=new Set([";","+"]),pI=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),gI=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Kh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),hI=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),yI=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Sd=new Set(["-c","-e","-r","-E","--eval","--exec"]),SI=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Cd=new Set(["grep","rg"]),Yh=new Set(["files-with-matches","files-without-match","count","quiet"]),CI=new Set([...Yh,"ignore-case","fixed-strings","hidden"]),bI=new Set(["wc",...Cd]),EI=new Set(["cd","grep","head","openssl","tail","tailscale"]),vI=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,RI=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),wI=new Set(["commit","merge","notes","stash","tag"]),_I=new Set(["-m","--message"]),xI=new Set(["--grep"]),AI=new Set(["powershell","pwsh"]),Oh=new Set(["jq","gojq","jaq"]),Mh="f",Dh="file",PI="files",TI=new Set(["e","f"]),II=new Set(["regexp","file"]),kI=new Set(["e","f","A","B","C","m"]),OI=new Set(["regexp","file","after-context","before-context","context","max-count"]),pd="__CC_SAFETY_NET_PIPE_INPUT__",hd=/[\w./~@+-]*[./~][\w./~@+-]*/g,MI=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,DI=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,NI=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Nh=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Lh=/\b(?:system|exec|spawn|popen)\s*$/,LI=/\b(?:eval|exec)\s*\(/g,WI=/\b(?:eval|exec)\s*$/,FI=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Wh(n,u,b,W,z,B){for(let Q of n){let ee=Q.target;if(rO(ee,Q.cwd,u?.denyPaths??[],b,W,z))return{target:ee,ruleId:"secret.deny-path"};if(B&&!B.has(ee))continue;let le=tO(ee,Q.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(ly(ee,Q.cwd,W,z)))continue;if(ue&&B?.get(ee)==="data")continue;if(ue&&(Q.isRedirectionWriteTarget===!0||B?.get(ee)==="write")&&!ee.includes("$")&&!Wa(ee,Q.cwd,W,z))continue;if(ue&&(Q.isCreatedPath===!0||Q.isCertificateInput===!0))continue;if(ue&&/\s/.test(ee)&&!ee.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(ee)&&!Wa(ee,Q.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&oO(ee,Q.cwd,u?.allowPaths??[],b,W,z))continue;return{target:ee,ruleId:le}}}return null}function Zh(n,u,b,W,z={}){let B=Fh(n,b,W),Q=Wh(B,u,n.invocation.context.configCwd,b,W);if(Q===null||Q.ruleId==="secret.deny-path"||z.strict!==!1)return Q;let ee=Fh(n,b,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;ee.forEach((Ne)=>Xh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),ve=ee.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),Oe=new Set(ve.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),De=new Set(ve.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Me=Wh(B,u,n.invocation.context.configCwd,b,W,new Map(ve.map((Ne)=>[Ne.target,Oe.has(Ne.target)?"path":De.has(Ne.target)?"write":"data"])));return Me?.ruleId!=="secret.deny-path"&&GI(n,b)?null:Me}function GI(n,u){let b=hr(n);if(!b)return!1;if(b.program.nodes.some((Q)=>Q.kind==="command"&&Q.nested.length>0))return!1;let W=[];for(let Q of qs(b.shell)){if(Q.kind==="operator"&&Q.boundary)return!1;if(Q.kind==="redirection")return!1;if(Q.kind==="operator")continue;W.push(yr(Q.text,u))}let z=bd(W,u);if(z===null||z.length===0)return!1;let B=_n(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return b.program.dialect==="powershell"&&(B==="ls"||B==="stat");return Ed(B,z.slice(1))}function Jo(n,u){return bd(n,u)??or(n,u)}function bd(n,u){let b=Zr(n,u);if(b.envSplitValues===void 0)return b.tokens;let W=Yr(b.envSplitValues,b.tokens);return W===null?null:bd(W,u)}function Ed(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((b)=>!b.startsWith("-")||vI.test(b));if(Cd.has(n))return zI(n,u);if(n!=="find")return!1;return!u.some((b)=>pI.has(b))}function zI(n,u){let b=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(b.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),Q=(ue)=>{let ve=b[ue-1]??"";return/^--[^=]+$/.test(ve)&&!CI.has(ve.slice(2))||B(ve)&&ve.slice(1).search(W)===ve.length-2},ee=b.findIndex((ue,ve)=>!ue.startsWith("-")&&!Q(ve));return(n==="grep"&&ee>=0?b.slice(0,ee):b).some((ue,ve)=>{if(Q(ve))return!1;if(ue.startsWith("--"))return Yh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function Fh(n,u,b,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((ee)=>({target:ee,cwd:z}));let Q=hr(n);return[...Q?ei(Q.shell,n.store,W,u,z,b,$I(Q)):[],...B==="unknown"?n.paths.map((ee)=>({target:ee,cwd:z})):[]]}function $I(n){return n.program.dialect==="powershell"}function ei(n,u,b,W,z,B,Q=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let ee=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...Wk(yr(n.source,W),u,b,W,z,B)],le=(We)=>yr(QI(We,Q),W),ue=/[<>=]\(/.test(n.source),ve=/\bcoproc\b|\|&/.test(n.source),Oe=[],De=[],Me=(We)=>({...b,commandHoldsPipe:b.commandHoldsPipe===!0||We||ve});Vs(n,z,W,B,{word:le,segment:(We,Be,ze,it,at,Rt)=>{if(We.length===0)return null;let Tt=Me(Rt);if(Tt.commandHoldsPipe)Oe.push(...We);if(De.push(_n(Qh(Jo(We,W))[0]??"").toLowerCase()),ee.push(...Xo(We,u,ue||it==="|"||it==="|&"?{...Tt,segmentMayFeedReader:!0}:Tt,W,Be.cwd,B,at)),ze!==null)ee.push(...HI(ze,We,u,Tt,W,Be.cwd,B));return null},redirection:(We,Be,ze)=>{if(We.body!==void 0&&We.consumer!==void 0){let it=Me(ze);ee.push(...Jh(We.consumer,[We.body],u,it,W,Be.cwd,B,(at)=>jI(We.consumer??[],at,u,it,W,Be.cwd,B)))}if(We.targetOrder==="legacy-segment")return ic;return ee.push({target:le(We.target),cwd:Be.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(Oe.flatMap(Xh)),Le=ue||/\$\(|`/.test(n.source)||!De.every((We)=>EI.has(We));return ee.map(({loopVariable:We,...Be})=>{if(Be.certificateOutputMayFeedReader===!0&&Le)return{target:Be.target,cwd:Be.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?Be:{...Be,loopVariable:We}})}function Xh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function Yi(n,u,b,W,z,B,Q=!1){let ee=u.getShellSyntax(n,Q?u.getCommandProgram(n,"powershell"):void 0);if(ee.status==="structural-limit")throw new E;return ee.status==="complete"?ei(ee,u,b,W,z,B,Q):null}function Xo(n,u,b,W,z,B,Q){let ee=(ut)=>({target:ut,cwd:z}),le=n.findIndex((ut)=>!uI.has(ut));if(b.skipMetadataOnlySegments===!0&&le>0)return Xo(n.slice(le),u,b,W,z,B,new Set([...Q??[]].map((ut)=>ut-le)));let ue=n[1]??"";if(b.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((ut)=>Dn("for",ut)).map((ut)=>({...ee(ut),loopVariable:ue}));if(Q?.size){let ut=n.filter((zt,Qt)=>!Q.has(Qt));if(Oh.has(_n(Jo(ut,W)[0]??"").toLowerCase()))return[...n.filter((zt,Qt)=>Q.has(Qt)).map(ee),...Xo(ut,u,b,W,z,B)]}let ve=Zr(n,W,z),Oe=typeof ve.cwd==="string"?ve.cwd:z,De=new Set(n.filter((ut,zt)=>Q?.has(zt))),Me=(ut)=>({target:ut,cwd:De.has(ut)?z:Oe}),Ne=ve.tokens,Le=ve.envSplitValues??[],We=[...n.slice(0,n.length-Ne.length).filter((ut)=>!Vk(ut)&&In(ut)===null&&!Le.includes(ut)).flatMap((ut)=>Dn("",ut)).map(ee),...[...ve.envAssignments.values()].filter((ut)=>ut!=="").map(Me)];if(Le.length>0){let ut=Yr(Le,Ne);if(ut!==null)return[...We,...Xo(ut,u,b,W,z,B,new Set([...Q??[]].map((zt)=>zt+ut.length-n.length)))];return[...We,...Le.flatMap((zt)=>Yi(zt,u,b,W,Oe,B)??[Me(zt)]),...Ne.flatMap((zt)=>Dn("",zt)).map(Me)]}if(Ne.length===0)return We;let Be=Ne[0]??"",ze=_n(Be).toLowerCase(),it=Ne.slice(1),at=b.segmentMayFeedReader===!0||b.commandHoldsPipe===!0||b.displayOperandsAreCapturedOutput===!0,Rt=at&&bI.has(ze);if(b.skipMetadataOnlySegments===!0&&!Rt&&Ed(ze,it))return We;let Tt=UI(Be,ze,it);if(Tt)return[...We,...Tt.map(Me)];if(qh.has(ze))return b.displayOperandsAreCapturedOutput===!0?[...We,...ey(Ne).map(Me)]:We;if(ze==="eval")return[...We,...Yi(it.join(" "),u,b,W,Oe,B)??it.map(Me)];let kt=AI.has(Bt(Be))?ed(Ne):void 0;if(kt!==void 0)B.charge("derivedTokens",Ne.length);let lt=kt===void 0?null:Yi(kt,u,b,W,Oe,B,!0);if(lt?.length)return[...We,...lt];if(ze==="export")return[...We,...it.flatMap((ut)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ut)?[ut.slice(ut.indexOf("=")+1)]:Dn(ze,ut)).map(Me)];if(ze==="git")return[...We,...ek(it).map(Me)];if(ze==="gh")return[...We,...yd(ze,it,RI).map(Me)];if(Oh.has(ze))return[...We,...JI(it).map(Me)];if(Cd.has(ze))return[...We,...jk(it).map(Me)];if(dI.has(ze))return[...We,...nk(it,u,b,W,Oe,B).map(Me)];if(ze==="mkdir"||ze==="touch"){let ut=b.segmentMayFeedReader!==!0&&!(ze==="touch"&&it.some((zt)=>/^(?:--r|-[^-]*r)/.test(zt)));return[...We,...it.flatMap((zt)=>Dn(ze,zt).map((Qt)=>ut&&!zt.startsWith("-")&&!De.has(zt)?{...Me(Qt),isCreatedPath:!0}:Me(Qt)))]}if(Bn.has(ze))return[...We,...it.flatMap((ut)=>Dn("awk",ut)).map(Me),...it.flatMap((ut)=>ok(ut,u,b,W,Oe,B)),...it.flatMap(ik).map(Me)];if(ze==="curl")return[...We,...it.filter((ut,zt)=>ny(ut)===null&&ty(it[zt-1])===null).flatMap((ut)=>Dn(ze,ut)).map(Me),...tk(it).map(Me)];if(Oo(ze)){let ut=Pi.has(ze)?Pn([ze,...it]):null;if(ut!==null&&ut.command!==null&&ut.commandIndex!==null){let zt=u.getShellSyntax(ut.command);if(zt.status==="structural-limit")throw new E;if(zt.status==="complete")return[...We,...ei(zt,u,b,W,Oe,B),...it.slice(ut.commandIndex).filter((Qt)=>!Qt.startsWith("-")).map(Me)]}return[...We,...rk(ze,it,u,b,W,Oe,B)]}let Vt=(ut,zt)=>new RegExp(`^--?${ut}=`).test(it[zt]??"")||new RegExp(`^--?${ut}$`).test(it[zt-1]??""),Ut=BI(Ne),an=ze==="openssl"&&it[0]==="x509",Sn=at?{certificateOutputMayFeedReader:!0}:{};return[...We,...it.flatMap((ut,zt)=>Dn(ze,ut).map((Qt)=>Ut&&Vt("(?:cert|key)-file",zt)?{...Me(Qt),isCreatedPath:!0,...Sn}:an&&Vt("in",zt)?{...Me(Qt),isCertificateInput:!0,...Sn}:Me(Qt)))]}function Qh(n){return _n(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function BI(n){let u=Qh(n);return _n(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function UI(n,u,b){let W=Ma(u,b);if(W===null||b[W]!=="explain")return null;let z=[n,...b.slice(0,W)],B=b.slice(W+1);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee==="--json"||ee==="--help"||ee==="-h")continue;if(ee==="--cwd"){let le=B[Q+1];if(le&&!le.startsWith("--"))z.push(le);Q++;continue}return z}return z}function HI(n,u,b,W,z,B,Q){let ee=Jo(n,z);if(YI(u,b,W,z,B,Q)){let le=Ed(_n(ee[0]??"").toLowerCase(),ee.slice(1))?ee.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...ey(ee),...le].map((ue)=>({target:ue,cwd:B}))}return Jh(u,VI(ee),b,W,z,B,Q,()=>[])}function jI(n,u,b,W,z,B,Q){let ee=Jo(n,z);if(!Oo(_n(ee[0]??"").toLowerCase()))return[];return Yi(u,b,W,z,B,Q)??[{target:u,cwd:B}]}function Jh(n,u,b,W,z,B,Q,ee){let le=ZI(n,z);if(le===null)return u.flatMap(ee);return u.flatMap((ue)=>Pi.has(le)?ei(b.getShellSyntax(ue),b,W,z,B,Q):La(le,ue,b,W,z,B,Q))}function ey(n){let u=_n(n[0]??"").toLowerCase();if(!qh.has(u))return[];let b=n[n[1]==="--"?2:1];if(u==="printf"&&b!==void 0&&!b.startsWith("-")&&!b.replaceAll("%%","").includes("%"))return[vd(b.replaceAll("%%","%"))];return n.slice(1)}function VI(n){let u=_n(n[0]??"").toLowerCase(),b=n.slice(1);if(u==="echo"){let W=b.findIndex((z)=>!/^-[neE]+$/.test(z));return[(W===-1?[]:b.slice(W)).join(" ")]}if(u==="printf")return qI(b);return[]}function qI(n){let u=n[0];if(u===void 0)return[];let b=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(b===0||n.length===1)return[vd(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/b)},(z,B)=>KI(u,W.slice(B*b,(B+1)*b)))}function KI(n,u){let b=0;return vd(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[b]??"";return b++,z}))}function vd(n){return n.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function YI(n,u,b,W,z,B){let Q=Jo(n,W);if(Q.length===0||_n(Q[0]??"").toLowerCase()!=="xargs")return!1;let ee=so(Q),le=Q.slice(ee.childStart);if(le.length===0)return!1;if(ee.replacementToken==="")return!1;let ue=ee.replacementToken,ve=ue===null?[...le,pd]:le.map((Oe)=>Oe.split(ue).join(pd));return Xo(ve,u,b,W,z,B).some((Oe)=>Oe.target.includes(pd))}function ZI(n,u){let b=Jo(n,u);if(b.length===0)return null;let W=_n(b[0]??"").toLowerCase();if(!Oo(W))return null;return XI(W,b.slice(1))?W:null}function XI(n,u){let b=Rd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(Sd.has(z)||ry(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(b==="python"&&z==="-m")return!1;if(FI.get(b)?.has(z))W++;continue}return!1}return!0}function Rd(n){return/^python\d/.test(n)?"python":n}var Gh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function QI(n,u){if(!u||!Gh.test(n))return n;return`~${n.replace(Gh,"").replace(/\\/g,"/")}`}function Dn(n,u){if(u==="--")return[];let b=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))b.push(u.slice(W+1));if(u.startsWith("-"))return b;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return b;if(n==="zip"&&/\.zip$/i.test(u))return b;return b.push(u),b}function JI(n){let u=-1,b=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!b&&z==="--"){b=!0;continue}if(b||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>Dn("jq",B))}return n.flatMap((W,z)=>z===u?[]:Dn("jq",W))}function ek(n){let u=[];for(let b=0;b<n.length;b++){let W=n[b]??"";if(W==="--"||!W.startsWith("-"))return[...u,...wI.has(W)?yd("git",n.slice(b).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),_I):yd("git",n.slice(b),xI)];if(u.push(...Dn("git",W)),!Nn.has(W))continue;let z=n[b+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:Dn("git",z)),b++}return u}function yd(n,u,b){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((Q)=>Dn(n,Q))];if(b.has(B)){z++;continue}if(B.includes("=")&&b.has(B.slice(0,B.indexOf("="))))continue;W.push(...Dn(n,B))}return W}function tk(n){return n.flatMap((u,b)=>{let W=ny(u);if(W!==null)return zh(W.flag,W.value);let z=ty(n[b-1]);return z===null?[]:zh(z,u)})}function zh(n,u){if(n==="-F"||n==="--form"){let b=u.indexOf("="),W=b===-1?u:u.slice(b+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return gd(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let b=u.indexOf("@"),W=u.indexOf("=");if(b===-1||W!==-1&&W<b)return[];return gd(u.slice(b+1))}return u.startsWith("@")?gd(u.slice(1)):[]}function ty(n){if(n===void 0)return null;if(Kh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function ny(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let b=n.indexOf("=");if(b===-1)return null;let W=n.slice(0,b);return Kh.has(W)?{flag:W,value:n.slice(b+1)}:null}function gd(n){return n===""||n==="-"?[]:[n]}function nk(n,u,b,W,z,B){let Q=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),ee=[...n.slice(0,Q===-1?n.length:Q),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!mI.has(n[le]??""))continue;let ue=n.slice(le+1),ve=ue.findIndex((Me)=>fI.has(Me)),Oe=ve===-1?ue:ue.slice(0,ve),De=Xo(Oe,u,b,W,z,B).map((Me)=>Me.target);if(ee.push(...De.filter((Me)=>Me!=="{}")),!De.includes("{}"))continue;ee.push(...n.slice(0,le).flatMap((Me,Ne,Le)=>{if(!gI.has(Me))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return ee}function rk(n,u,b,W,z,B,Q){let ee=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(Sd.has(ue)||ry(n,ue)){let Oe=u[le+1];if(Oe!==void 0)ee.push(...La(n,Oe,b,W,z,B,Q)),le++;continue}let ve=/^--(?:eval|exec)=(.*)$/.exec(ue);if(ve!==null&&ve[1]!==void 0){ee.push(...La(n,ve[1],b,W,z,B,Q));continue}if(!ue.startsWith("-"))ee.push({target:ue,cwd:B})}return ee}function ry(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return SI.get(u[u.length-1]??"")?.has(Rd(n))??!1}function ok(n,u,b,W,z,B){if(!n.includes("system"))return[];return Ec(n)?.commands.flatMap((Q)=>ei(u.getShellSyntax(Q),u,b,W,z,B))??[]}function ik(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function sk(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((b)=>b[2]).filter((b)=>b!==void 0&&b!=="");return[...u,...u.flatMap(_d),...n.match(hd)??[]]}function La(n,u,b,W,z,B,Q){let ee=(lt)=>({target:lt,cwd:B}),le=Tk(n),ue=kk(u,le);if(ue.kind==="unmaskable")return sk(u).map(ee);let ve=ue.masked.match(Nh)!==null||ue.literals.some((lt)=>Lh.test(ue.masked.slice(0,lt.start))),Oe=ue.masked.match(LI)!==null||ue.literals.some((lt)=>WI.test(ue.masked.slice(0,lt.start))),De=W.inlineLiteralsPresumedData===!0&&!Pi.has(n),Me=De&&(le==="python"||le==="javascript"),Ne=De&&!(Lk(ue.masked)||ve||Oe)?[]:ue.literals,Le=De?Array.from(ue.masked.matchAll(Nh),(lt)=>{let Vt=lt.index+lt[0].length;return{start:Vt,end:ra(ue.masked,Vt)}}):[],We=!De||Le.some((lt)=>yc(ue.masked,lt.start)&&!pk(ue,lt.start))?ue.literals:ue.literals.filter((lt)=>Lh.test(ue.masked.slice(0,lt.start))||Le.some((Vt)=>lt.start>=Vt.start&&lt.start<Vt.end)),Be=new Set(ve?We:[]),ze=Me&&Ne.length>0&&!dk(ue.masked,le==="python"?"#":"//"),it=ze?gk(ue.masked):[],at=ze?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(lt)=>({name:lt[0],index:lt.index})):[],Rt=mk(at),Tt=!uk(ue.masked,at),kt=at.filter((lt)=>!$h(ue.masked,{start:lt.index,text:lt.name,tokenStart:lt.index,tokenEnd:lt.index+lt.name.length},it,Rt,Tt)).reduce((lt,Vt)=>{let Ut=lt.get(Vt.name)??[];return Ut.push(Vt.index),lt.set(Vt.name,Ut)},new Map);return[...Ne.filter((lt)=>lt.text!=="").map((lt)=>{if(!ze||Be.has(lt))return ee(lt.text);if($h(ue.masked,lt,it,Rt,Tt)||hk(ue.masked,lt,it,kt))return{...ee(lt.text),literalRole:"data"};return xk(ue,lt,it)?{...ee(lt.text),literalRole:"write"}:ee(lt.text)}),...Ne.flatMap((lt)=>_d(lt.text)).map(ee),...De?[]:ue.literals.flatMap((lt)=>lt.text.match(hd)??[]).map(ee),...ve?We.flatMap((lt)=>Yi(lt.text,b,{...W,commandHoldsPipe:!0},z,B,Q)??[ee(lt.text)]):[],...Oe?ue.literals.flatMap((lt)=>La(n,lt.text.replace(/\\(.)/g,(Vt,Ut)=>Ut==="n"?`
-`:Ut),b,W,z,B,Q)):[],...Me?[]:[ue.masked,...ue.comments].flatMap((lt)=>lt.match(hd)??[]).map(ee),...De?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(ee):[]]}var wd={"(":")","[":"]","{":"}"},oy="and|elif|else|if|in|is|not|of|or|return|while|yield",ak=new RegExp(`(?:^|[^\\w$])(?:${oy})$`),lk=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${oy})\\s*\\(|/\\*`),ck=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function dk(n,u){return lk.test(n)||n.split(`
-`).some((b)=>{let W=b.indexOf(u);return W>=0&&/[()[\]{}]/.test(b.slice(W))})}function uk(n,u){return Ck.test(n)||u.some((b)=>{let W=Sk.get(b.name),z=b.index+b.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function mk(n){return n.some((u)=>sy(u.name).some((b)=>ck.test(b)))}var fk=new Set(["cmd","powershell","pwsh"]);function pk(n,u){let b=uo(n.masked,u),W=wd[n.masked[b]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,b+1),B=n.masked.slice(b+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(uo(n.masked,z+1)))&&!n.literals.some((Q)=>Q.tokenStart>b&&Q.tokenStart<z&&(Sd.has(Q.text)||Oo(_n(Q.text).toLowerCase())||fk.has(_n(Q.text).toLowerCase().replace(/\.exe$/,""))))}function gk(n){let u=[];return n.split("").map((b,W)=>{let z=u.at(-1)??-1;if(b in wd)u.push(W);if(b===")"||b==="]"||b==="}")u.pop();return z})}function $h(n,u,b,W,z){let B=b[u.tokenStart]??-1,Q=n[B]??"",ee=Qo(n,u.tokenStart),le=uo(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,ee-3),ee+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(Q==="["||Q==="("))return!1;let ue=n[ee],ve=n[le];if(Q==="{"&&ue===":")return Ak(n,ee);let Oe=(ue===Q||ue===",")&&(ve===","||ve===wd[Q]||Q==="{"&&ve===":");if(Q!=="(")return Oe&&Q!=="";return Oe&&(z&&yk.test(n.slice(Math.max(0,B-20),B))||(ue===","||ve===",")&&Pk(n,B))}function hk(n,u,b,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
-`:""}${n.slice(z,u.tokenStart)}`,Q=bk.exec(B)?.[1],ee=n[b[u.tokenStart]??-1];if(Q===void 0||ee==="("||ee==="[")return!1;let le=uo(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(Q);return(W.get(Q)??[]).every((ve)=>ve===ue)}var yk=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,Sk=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),Ck=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,bk=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,Ek=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,vk=/^\s*\.\s*write_(?:text|bytes)\s*\(/,Rk=/(?:^|[^\w$.])open\s*$/,wk=/^[bt]*[awx][abtwx]*$/,_k=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function xk(n,u,b){let W=b[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Qo(n.masked,u.tokenStart),B=uo(n.masked,u.tokenEnd),Q=n.masked[B],ee=n.masked.slice(Math.max(0,W-40),W);if(Ek.test(ee))return(z===W||n.masked[z]===",")&&(Q===","||Q===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&vk.test(n.masked.slice(ra(n.masked,W+1)+1));if(z!==W||Q!==",")return!1;if(_k.test(ee))return!0;if(!Rk.test(ee))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&wk.test(le.text)&&/^[,)]/.test(n.masked.slice(uo(n.masked,le.tokenEnd)))}function Ak(n,u){let b=Qo(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,b-63),b+1))?.[0]??"",z=n[Qo(n,b+1-W.length)];return z==="{"||z===","}function Pk(n,u){let b=Qo(n,u),W=n.slice(Math.max(0,b-7),b+1);return!/[\w$)\]]$/.test(W)||ak.test(W)}function Tk(n){let u=Rd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var Ik={python:"#",javascript:"/"};function kk(n,u){if(u==="opaque")return{kind:"unmaskable"};let b={masked:n.split(""),literals:[],comments:[]};return iy(n,0,u,b,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:b.masked.join(""),literals:b.literals,comments:b.comments}}function iy(n,u,b,W,z){let B=0;for(let Q=u;Q<n.length;Q++){let ee=n[Q]??"";if(z&&ee==="}"&&B===0)return Q;if(z&&ee===Ik[b])return null;if(b==="python"&&ee==="#"){let Le=n.slice(Q).search(/[\r\n]/),We=Le===-1?n.length:Q+Le;W.comments.push(n.slice(Q,We)),W.masked.fill(" ",Q,We),Q=We-1;continue}if(ee==="{")B++;if(ee==="}")B--;if(b==="simple"&&(ee==="`"||ee==="%"||ee==="<")){if(DI.test(n.slice(Q)))return null}let le=ee==="'"||ee==='"'||b==="javascript"&&ee==="`"?ee:null;if(le===null)continue;if(le==="`"&&Nk(n,Q))return null;let ue=b==="python"?Mk(n,Q):"",ve=b==="python"&&n.startsWith(le.repeat(3),Q)?le.repeat(3):le,Oe=Q+ve.length,De=le==="`"||/[fF]/.test(ue),Me=Q-ue.length,Ne=De?Ok(n,Me,Oe,ve,b,W):Dk(n,Oe,ve);if(Ne===null)return null;if(!De){let Le=n.slice(Oe,Ne);if(b==="simple"&&le==='"'&&NI.test(Le))return null;W.literals.push({start:Oe,text:Le,tokenStart:Me,tokenEnd:Ne+ve.length}),W.masked.fill(" ",Oe,Ne)}W.masked.fill(" ",Q,Oe),W.masked.fill(" ",Ne,Ne+ve.length),Q=Ne+ve.length-1}return z?null:n.length}function Ok(n,u,b,W,z,B){let Q=z==="python"?"{":"${",ee=W==="`"||W.length===3,le="";for(let ue=b;ue<n.length;ue++){let ve=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:b,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!ee&&(ve===`
-`||ve==="\r"))return null;let Oe=z==="python"&&(ve==="{"||ve==="}")&&n[ue+1]===ve;if(!Oe&&n.startsWith(Q,ue)){let Ne=iy(n,ue+Q.length,z,B,!0);if(Ne===null)return null;le+=`${Q}}`,B.masked.fill(" ",ue,ue+Q.length),B.masked[Ne]=" ",ue=Ne;continue}let Me=ve==="\\"&&!(z==="python"&&n[ue+1]==="{")||Oe?2:1;le+=n.slice(ue,ue+Me),B.masked.fill(" ",ue,ue+Me),ue+=Me-1}return null}function Mk(n,u){return MI.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function Dk(n,u,b){let W=b.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
-`||B==="\r"))return null;if(n.startsWith(b,z))return z}return null}function Nk(n,u){for(let b=u-1;b>=0;b--){let W=n[b];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function Lk(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let b=u[0],W=u.index;if(hI.has(b.toLowerCase()))return!0;let z=sy(b);if(!z.some((B)=>yI.has(B)))continue;if(z.length>1)return!0;if(n[Qo(n,W)]===".")return!0;if(n[uo(n,W+b.length)]==="(")return!0}return!1}function sy(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Qo(n,u){for(let b=u-1;b>=0;b--)if(!/\s/.test(n[b]??""))return b;return-1}function uo(n,u){for(let b=u;b<n.length;b++)if(!/\s/.test(n[b]??""))return b;return n.length}function Wk(n,u,b,W,z,B){return Bk(n).flatMap((Q)=>{let ee=u.getShellSyntax(Q);if(ee.status==="invalid")return[];return[...ei(ee,u,{...b,displayOperandsAreCapturedOutput:!0},W,z,B),...Fk(ee,W)?Gk(ee,W).map((le)=>({target:le,cwd:z})):[]]})}function Fk(n,u){let b=qs(n);for(let W=0;W<b.length;W++){let z=b[W];if(z?.kind!=="word"||_n(yr(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<b.length;B++){let Q=b[B];if(Q?.kind==="operator")break;if(Q?.kind!=="word")continue;let ee=yr(Q.text,u);if(ee==="--decode"||!ee.startsWith("--")&&ee.startsWith("-")&&/[dD]/.test(ee))return!0}}return!1}function Gk(n,u){return qs(n).flatMap((b)=>b.kind==="word"?[yr(b.text,u)]:b.kind==="redirection"&&b.target?[yr(b.target,u)]:[]).flatMap(_d)}function _d(n){let u=$k(n);if(u===null)return[];let b=Buffer.from(u,"base64").toString("utf8");if(b===""||zk(b))return[];return Buffer.from(b,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[b]:[]}function zk(n){return Array.from(n).some((u)=>{let b=u.charCodeAt(0);return b<32||b===127})}function $k(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function Bk(n){let u=[],b={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(li(z,b))continue;if(ay(n,W,b)){let B=Uk(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!b.inSingle&&z==="`"){let B=Hk(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function Uk(n,u){let b={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(li(B,b))continue;if(ay(n,z,b)){W++,z++;continue}if(!b.inSingle&&!b.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function Hk(n,u){let b=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(b){b=!1;continue}if(z==="\\"){b=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function ay(n,u,b){return!b.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function jk(n){let u=[],b=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){b.push(ue);continue}let ve=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(ve!==null){let Oe=ve[1]??"",De=ve[2];if(Oe===PI)z=!0;if(II.has(Oe))W=!0;if(De!==void 0){if(Oe===Dh)u.push(De);continue}if(OI.has(Oe)){let Me=n[le+1];if(Oe===Dh&&Me!==void 0)u.push(Me);le++}continue}if(ue.startsWith("-")&&ue.length>1){let Oe=ue.slice(1),De="",Me="";for(let Le=0;Le<Oe.length;Le++){let We=Oe[Le]??"";if(TI.has(We))W=!0;if(kI.has(We)){De=We,Me=Oe.slice(Le+1);break}}if(De==="")continue;if(Me.length>0){if(De===Mh)u.push(Me);continue}let Ne=n[le+1];if(De===Mh&&Ne!==void 0)u.push(Ne);le++;continue}b.push(ue)}let ee=!W&&!z?b.slice(1):b;return[...u,...ee]}function Vk(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var qk=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Bh=".env.",Kk=[".example",".sample",".template",".tpl"],Yk=[".env.example.",".env.sample."];function Zk(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function Xk(n){return n.length>0&&!/\s/.test(n)}function Wa(n,u,b,W){let z=ly(n,u,b,W);return z!==""&&b.paths.entryKind(z)!=="missing"}function ly(n,u,b,W){try{return Zi(n,u,b,W)}catch(z){if(z instanceof a)throw z;return""}}var Qk=/[?&][^?&=/]+=/,Jk=new Set(["node_modules","__pycache__"]),eO=[["vendor","bundle"],["vendor","cache"]];function tO(n,u,b,W,z){if(Zk(n))return null;let B=Mn(n,u,W,z);if(!B)return null;let Q=Yt(B.split("/").pop()??""),ee=Yt(B),le=()=>Xk(Q)||Wa(n,u,W,z),ue=Yt(aO(n,u,W,z));for(let De of yl){let Me=`~/${De.suffixParts.join("/")}`;if((Hh(ee,Me)||Hh(ue,Me))&&vr(De.id,b))return De.id}if(Q===".env.defaults"||Q.startsWith(Bh)&&Kk.some((De)=>Q.endsWith(De))||Yk.some((De)=>Q.startsWith(De)))return null;let ve=nO(B,u,b,W,z);if(ve)return ve;if(qk.has(Q))return null;for(let De of hl)if(Q===De.basename&&vr(De.id,b))return De.id;if(Q.startsWith(Bh)&&vr(gs.id,b)&&le())return gs.id;for(let De of Sl)if(Q.length>De.prefix.length&&Q.startsWith(De.prefix)){let Me=Q.slice(De.prefix.length)[0];if((Me==="-"||Me==="_")&&vr(De.id,b)&&le())return De.id}for(let De of Cl)if(Q.length>De.prefix.length&&Q.startsWith(De.prefix)){if(Q.slice(De.prefix.length)===De.suffix&&vr(De.id,b))return De.id}if(iO(ee))return null;if(!Q.includes(".")&&ui.pattern.test(Q)&&vr(ui.id,b))return ui.id;if(Qk.test(n)&&!Wa(n,u,W,z))return null;let Oe=sO(Q,b);if(Oe)return Oe;return null}function nO(n,u,b,W,z){return hs.find((B)=>{if(!vr(B.id,b))return!1;switch(B.id){case"secret.cli.claude-code":return qt(n,Zt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let Q=Yt(n).split("/");return qt(n,Zt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||Ki(n,"~/.claude.json",u,W,z)||Q.at(-2)===".claude"&&["settings.json","settings.local.json"].includes(Q.at(-1)??"")||Q.at(-1)===".mcp.json"}case"secret.cli.antigravity":return qt(n,Mn("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let Q=Zt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return qt(n,Q,["auth.json",".credentials.json"])||Zo(n,Q,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let Q=Zt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),ee=Yt(n).split("/"),le=ee.at(-1)??"";return qt(n,Q,["config.toml"])||le.endsWith(".config.toml")&&qt(n,Q,[le])||ee.at(-2)===".codex"&&le==="config.toml"}case"secret.cli.gemini":return qt(n,ln(Zt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let Q=Yt(n).split("/"),ee=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[ln(Zt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return qt(n,ln(Zt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||Q.at(-1)==="settings.json"&&Q.at(-2)===".gemini"||(ee?.trim()?Ki(n,ee,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>qt(n,Mn(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let Q=Zt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return qt(n,Q,["config.json"])||Zo(n,Q,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return qt(n,Zt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let Q=Zt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),ee=Zt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return qt(n,Q,["server.token"])||Zo(n,Q,["credentials"])||Zo(n,ee,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let Q=["config.toml","mcp.json"],ee=Yt(n).split("/");return ee.at(-1)==="mcp.json"&&ee.at(-2)===".kimi-code"||qt(n,Zt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q)||qt(n,Zt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...Q,"config.json","config.json.bak"])}case"secret.cli.opencode":{let Q=ln(Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),ee=Yt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return qt(n,Q,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(ee)&&qt(n,Q,[ee])||ue.some((ve)=>Ki(n,ve,u,W,z))}case"secret.cli.opencode.config":{let Q=ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),ee=W.env.get("ProgramData")?[ln(Zt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Yt(n).split("/").at(-1)??"")||qt(n,Q,["config.json"])||(ue?.trim()?Ki(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...ee].some((ve)=>qt(n,Mn(ve,u,W,z),le))}case"secret.cli.pi":return qt(n,Zt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return qt(n,Zt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let Q=Mn("~",u,W,z);return[ln(Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),ln(Q,".local","share","amp")].some((le)=>qt(n,le,["secrets.json"]))||Zo(n,ln(Q,".amp"),["oauth"])}case"secret.cli.amp.config":{let Q=["settings.json","settings.jsonc"],ee=[ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),ln(Mn("~",u,W,z),".config","amp")],le=Yt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return ee.some((ve)=>qt(n,ve,Q))||le.at(-2)===".amp"&&Q.includes(le.at(-1)??"")||(ue?.trim()?Ki(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let Q=ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),ee=ln(Zt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return qt(n,Mn("~/.cursor",u,W,z),["auth.json"])||qt(n,Q,["auth.json"])||Yt(n).split("/").at(-1)==="mcp-auth.json"&&mo(Yt(n),Yt(ee))}case"secret.cli.cursor.config":{let Q=Yt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".cursor"}case"secret.cli.grok-build":return qt(n,Zt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let Q=Yt(n).split("/");return Q.at(-1)==="config.toml"&&Q.at(-2)===".grok"||qt(n,Zt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||qt(n,Mn("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return qt(n,Mn("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let Q=Yt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".factory"||qt(n,Mn("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),Mn("~/.local/share",u,W,z)].some((Q)=>qt(n,ln(Q,"devin"),["credentials.toml"])||Zo(n,ln(Q,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),Mn("~/.config",u,W,z)].some((Q)=>qt(n,ln(Q,"devin"),["config.json"]));default:return!1}})?.id??null}var Uh=new WeakMap;function Zt(n,u,b,W,z){let B=Uh.get(z)??new Map;Uh.set(z,B);let Q=`${b}\x00${n??""}\x00${u}`,ee=B.get(Q);if(ee!==void 0)return ee;let le=Mn(n?.trim()?n:u,b,W,z);return B.set(Q,le),le}function qt(n,u,b){return b.some((W)=>cy(n,ln(u,W)))}function Zo(n,u,b){return b.some((W)=>mo(Yt(n),Yt(ln(u,W))))}function Ki(n,u,b,W,z){return cy(n,Mn(u,b,W,z))}function cy(n,u){return Yt(n)===Yt(u)}function ln(n,...u){return er([n,...u].filter(Boolean).join("/"))}function rO(n,u,b,W,z,B){if(b.length===0)return!1;let Q=Yt(Zi(n,u,z,B));return b.some((ee)=>mo(Q,Yt(Zi(ee,W,z,B))))}function oO(n,u,b,W,z,B){if(b.length===0)return!1;let Q=Yt(Zi(n,u,z,B));if(!Q)return!1;let ee=z.env.get("HOME")??z.home,le=ee?er(jt(Cn(ee),z.paths,B)):"",ue=Yt(le),ve=z.env.get("CC_SAFETY_NET_HOME"),Oe=Yt(ve?er(jt(Fa(Cn(ve)),z.paths,B)):le&&er(jt(`${le}/.cc-safety-net`,z.paths,B)));if(Oe&&mo(Q,Oe))return!1;return b.some((De)=>{let Me=wl(De);if(Me&&jh.basename(Q)!==Yt(Me.name))return!1;let Ne=Yt(Zi(Me?.root??De,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return mo(Q,Ne)&&!(Me&&Q===Ne)})}function iO(n){let u=n.split("/");return u.some((b)=>Jk.has(b))||eO.some(([b,W])=>u.some((z,B)=>z===b&&u[B+1]===W))}function sO(n,u){let b=n.lastIndexOf("."),W=b>0&&b<n.length-1?n.slice(b+1):"";if(W==="")return null;for(let z of bl)if(W===z.extension&&vr(z.id,u))return z.id;for(let z of El)if(z.pattern.test(W)&&vr(z.id,u))return z.id;return null}function Yt(n){return n.toLowerCase()}function vr(n,u){return!u?.disabledRules?.includes(n)}function Mn(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B)return"";if(!z)return B;let Q=Ad(B,z),ee=Na(Q)?Q:er(Fa(u,Q)),le=er(jt(ee,b.paths,W));if(!mo(le,z)){if(Na(Q))return le;return le===ee?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function Hh(n,u){return n===u||n.startsWith(`${u}/`)}function aO(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B||!z)return"";let Q=Ad(B,z),ee=jh.normalize(Na(Q)?Q:er(Fa(u,Q))),le=er(Cn(b.env.get("HOME")??b.home)),ue=(De)=>process.platform==="win32"?De.toLowerCase():De,ve=[z,le].find((De)=>De!==""&&mo(ue(ee),ue(De)));if(ve===void 0)return"";let Oe=ee.slice(ve.length);return Oe?`~${Oe}`:"~"}function Zi(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B)return"";let Q=z?Ad(B,z):B;return er(jt(Na(Q)?Q:Fa(u,Q),b.paths,W))}function xd(n,u,b){let W=u.env.get("HOME")??u.home,z=W?er(jt(Cn(W),u.paths,b)):"",B=er(Cn(lO(yr(n,u))));return{home:z,normalized:B}}function lO(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return cI(n)}catch{return n}}function Ad(n,u){if(n==="~")return u;if(n.startsWith("~/"))return ln(u,n.slice(2));return n}function cO(n){if(process.platform==="win32")return!0;return lI.parse(n).root.length>1}function er(n){let u=n.trim(),b=(u.includes("\\")&&cO(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(b==="/")return b;return b.replace(/\/+$/g,"")}function mo(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function _n(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,b){super(`CC Safety Net ${n} dependency failed`,{cause:b});this.stage=n;this.evaluation=u}}var dO={findPolicyMutation:Ih,findGitMetadataMutation:Ff,resolveGitMetadata:pO,loadPolicySnapshot:w,findSensitiveTarget:Zh,analyzeCommand:Rh,getModes:O},uO=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,mO=["workdir","cwd","working_directory"];function G(n,u){let b={...dO,...u.dependencies},W=yO(n),z=()=>Lr("config-load",W,()=>b.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,Q=B?.policy.commandTools.find((Ut)=>Ut.name===n.toolName),ee=Q&&W?fO(n,W,Q.cwd,u.environment.paths):n;if("decision"in ee)return ee;let le=ee,ue=le===n?{}:{promotedInvocation:le},ve=Xi(le)?le.command:W,Oe=Lr("policy-protection",ve,()=>Df(le)),De=Mo(Oe,"input-candidate"),Me=Mo(Oe,"declared-command");if(Xi(le)&&le.command?.trim()&&Me?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:nr,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(De?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:Mf,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=xn(),Le=Lr("policy-protection",ve,()=>b.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=Lr("policy-protection",ve,()=>b.findPolicyMutation(Oe,u.environment,Ne));if(We){let Ut=ve??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Ut,segment:We.target}}}}let Be=Lr("policy-protection",ve,()=>xh(Oe,u.environment,Ne));if(Be){let Ut=ve??Be.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Ut,segment:Be.target}}}}let ze=Lr("policy-protection",ve,()=>b.findGitMetadataMutation(Oe,Le,u.environment,Ne));if(ze){let Ut=ve??ze.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Ut,segment:ze.target}}}}let it=B??z(),at=it.policy,Rt=b.getModes(at,u.environment.env),Tt={level:Rt.effectiveLevel,...gO(it),...ue},kt=at.secretProtection.enabled===!1?null:Lr("secret-protection",ve,()=>b.findSensitiveTarget(Oe,at.secretProtection,u.environment,Ne,{strict:Xi(le)||De?.program.dialect==="powershell"?Rt.strict:void 0}));if(kt){let Ut=ve??kt.target;return{stage:"secret-protection",...Tt,decision:{kind:"deny",reason:Vh,intent:"hard_stop",ruleId:kt.ruleId,evidence:{command:Ut,segment:kt.target}}}}if(!Xi(le))return{stage:"non-command",...Tt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...uy(ve),...Tt};let lt=Lr("command-analysis",ve,()=>wh(()=>b.analyzeCommand(le.command,{cwd:le.context.configCwd,effectiveCwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:it,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Rt.capabilities,worktreeMode:Rt.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},hO(Oe),Oe.store),le.command,u.trace)),Vt=le.route.shell==="auto"&&Oe.store.readsAutoAsPowerShell()?()=>{let Ut=u.trace?.branch(),an={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...Ut?{trace:Ut.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>it,resolveGitMetadata:()=>Le}}),...ue};return{decision:an.decision,withItsTrace:()=>(Ut?.adopt(),an)}}:void 0;if(lt.decision){let Ut=!Rt.strict&&(lt.decision.ruleId==="raw-text.dangerous-command"||lt.decision.reason===Qr&&!uO.test(lt.decision.evidence?.segment??"")&&Un(le.command)===null),an=Ut?Vt?.():void 0;if(an?.decision.kind==="deny"&&!an.decision.unverifiedByStandardMode)return an.withItsTrace();return{stage:"command-analysis",...Tt,..."errorCode"in lt?{errorCode:lt.errorCode}:{},decision:Ut?{...lt.decision,unverifiedByStandardMode:!0}:lt.decision}}return Vt?.().withItsTrace()??{stage:"command-analysis",...Tt,decision:{kind:"allow"}}}function fO(n,u,b,W){let B=[...new Set((b===!1?[]:b?[b]:mO).flatMap((ue)=>{let ve=Object.getOwnPropertyDescriptor(n.input,ue);return ve?[ve.value]:[]}))],Q=B.filter((ue)=>typeof ue==="string"&&ue.trim()!=="");if(B.length>1||Q.length!==B.length)return uy(u);let ee=Q[0],le=ee===void 0?n.context.configCwd:ju(ee,n.context.configCwd,W);if(!le){let ue=I({directory:"requested",problem:"unusable",cwd:ee??""});return{stage:"command-validation",decision:{kind:"deny",reason:ue.reason,ruleId:ue.ruleId,intent:ue.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:le},u)}function pO(n,u){let b=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(b.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(b.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(b.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(b.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(b.flatMap((W)=>W.hooksDirectories))])})}function gO(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function hO(n){return Mo(n,"declared-command")?.program}function yO(n){try{return ye(n.input)}catch(u){let b=Xi(n)?n.command:void 0;throw new g("policy-protection",dy("policy-protection",u instanceof h?void 0:b,u),u)}}function Lr(n,u,b){try{return b()}catch(W){throw new g(n,dy(n,W instanceof h?void 0:u,W),W)}}function dy(n,u,b){let W=b instanceof H?{reason:ir,ruleId:"analysis.strict-unparseable"}:b instanceof a||b instanceof E?{reason:za,ruleId:"analysis.limit"}:{reason:ti,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function uy(n){let u=q();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Xi(n){return n.route.kind==="command"}
+`?n.trim().split(/\s+/).filter(Boolean):n.split(u).filter(Boolean)}function $i(n){if(!n)return!0;return n.provenance==="unknown"?!/[$`]/.test(t(n)):n.provenance==="literal"}function Uo(n){return n?t(n):""}function Ie(n){return`'${n.replaceAll("'",`'"'"'`)}'`}function Bc(n,u){return zc(C(n,"posix"),u)}function Bi(n){return Bc(n,new Set(Array.from(n.matchAll(Yp)).flatMap((u)=>{let b=u[1]??u[2];return b===void 0?[]:[b]})))}function zc(n,u){if(n.status==="invalid"||n.status==="limited")return!1;let b=new Set(u);for(let W of n.nodes){if(W.kind==="group"){if(zc(W.body,b))return!0;continue}if(W.kind!=="command")continue;if(W.nested.some((z)=>zc(z,b))||og(W.words,b))return!0;lA(W,b)}return!1}function og(n,u){let b=n.findIndex((Q)=>In(Q.text)===null);if(b===-1)return!1;let W=n[b];if(!W)return!1;if(Gi(W,u))return!0;let z=Bt(W.text);if(z==="source"||z==="."){let Q=n[b+1]?.text==="--"?b+2:b+1;return qp(n[Q],u)}if(nn.has(z)){let Q=n.slice(b),ee=Q.map((ve)=>ve.text),le=Pn(ee),ue=le.commandIndex??le.scriptIndex;return!Qn(ee)&&ue!==null&&qp(Q[ue],u)}let B=oA(n,b,u);if(B===null)return!1;if(B===-1)return!0;return og(n.slice(B),u)}function oA(n,u,b){let W=Bt(n[u]?.text??"");if(W==="command")return iA(n,u+1);if(W==="exec")return sA(n,u+1);if(W==="env")return aA(n,u+1,b);return null}function iA(n,u){for(let b=u;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return n[b+1]?b+1:null;if(/^-[p]*[vV][pvV]*$/.test(W))return null;if(/^-p+$/.test(W))continue;return b}return null}function sA(n,u){for(let b=u;b<n.length;b++){let W=n[b]?.text??"";if(W==="--")return n[b+1]?b+1:null;if(W==="-a"){b++;continue}if(/^-a.+/.test(W)||/^-[cl]+$/.test(W))continue;return b}return null}function aA(n,u,b){for(let W=u;W<n.length;W++){let z=n[W],B=z?.text??"";if(B==="--")return n[W+1]?W+1:null;if(B==="-S"||B==="--split-string")return Gi(n[W+1],b)?-1:W+2;if(B.startsWith("-S")||B.startsWith("--split-string="))return Gi(z,b)?-1:W+1;if(B==="-u"||B==="--unset"||B==="-C"||B==="--chdir"||B==="-P"){W++;continue}if(B==="-i"||B==="-0"||B==="--null"||B.startsWith("-u=")||B.startsWith("--unset=")||B.startsWith("-C")||B.startsWith("--chdir=")||B.startsWith("-P"))continue;if(B.startsWith("-"))continue;if(In(B))continue;return W}return null}function lA(n,u){if(!n.words.every((b)=>In(b.text)!==null))return;for(let b of n.words){let W=In(b.text);if(!W)continue;if(Gi(b,u))u.add(W.name)}}function Gi(n,u){if(!n)return!1;return n.parts.filter((b)=>b.provenance==="variable").some((b)=>Array.from(b.raw.matchAll(Yp)).some((W)=>{let z=W[1]??W[2];return z!==void 0&&(Yx.test(z)||u.has(z))}))}function qp(n,u){return!!n&&(n.parts.some((b)=>b.provenance!=="literal"&&b.provenance!=="variable")||Gi(n,u))}var Uc="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Hc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",cA="__CC_SAFETY_NET_XARGS_INPUT__",Ea="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",va="rm",dA=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uA=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,mA=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,fA=/^(?:[0-9]+|[@*])$/;function ag(n,u){let b=n.map(t),{childStart:W,replacementToken:z}=so(b),B=b.slice(W),Q=st("xargs.shell-dynamic",Hc);if(gA(B,z,u)&&Gt(Q,u.policy))return Gt(Q,u.policy);for(let ee of Xn(B,u)){let le=ee.tokens,ue=z!==null&&le[0]!==B[0]&&(le[0]?.includes(z)??!1)?Gt(Q,u.policy):null;if(ue)return ue;let ve=fg(le,z,ee.wrapperEnvAssignments),Oe=ee.head==="rm"&&z!==null&&ug(le,z),De=u.analyzeChild(le,{...ro(ee,u),dynamicInput:ve,dynamicSourceInput:Oe||cg(le,ee.head,z,ee.wrapperEnvAssignments,ve,u.environment,u.strict?void 0:u.analyzeNested),dynamicRmInput:Oe,shellDynamicMatch:Q,dynamicSourceMatch:Q,rmDynamicMatch:st("xargs.rm-recursive-force-dynamic",Uc)});if(De)return De;let Me=pA(le,z,u.policy?.rules??[],Gt(Q,u.policy));if(Me)return Me;if(ee.head==="git"){let Le=z===null?[...le,cA]:le,We=z!==null&&(le.some((ze)=>ze.includes(z))||Array.from(ee.envAssignments.values()).some((ze)=>ze.includes(z))),Be=u.analyzeChild(Le,{...ro(ee,u),worktreeMode:z===null||We?!1:u.worktreeMode});if(Be)return Be}let Ne=F(le,u.policy?.rules??[]);if(Ne)return Ne}return null}function pA(n,u,b,W){if(b.length===0)return null;if(u===null){for(let B of b){let Q=F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],b);if(Q)return Q}return null}let z=Bt(n[0]??"");if(!b.some((B)=>Bt(B.command)===z))return null;return n.slice(1).some((B)=>B.includes(u))?W:null}function lg(n,u,b){let W=n.indexOf(u);if(W===-1||n.indexOf(u,W+u.length)!==-1)return[];let z=Hp(n,W,u.length,b);return z===null?[]:[z]}function cg(n,u,b,W,z,B,Q){if(nn.has(u)){if(Qn(n))return!1;if(b!==null&&hA(n,b,Q))return!0;let ee=jn(n);if(!ee){let le=br(tn(n));if(le.kind==="literal")return b!==null&&le.source.includes(b);return le.kind==="none"&&z}if(b!==null&&ee.includes(b)&&!dg(ee,b,Q))return!0;if(Un(ee))return!0;return yA(ee,b,W)}if(Ln(u))return ig(n,b,ta,Xf(u));if(Bn.has(u))return ig(n,b,bc,lp);if(u==="eval"){let ee=Sa(tn(n));if(ee.kind==="dynamic")return!0;if(b!==null)return ee.kind==="literal"&&ee.source.includes(b);return z}if(u==="find")return SA(n,b,B);if(u==="git"){let ee=Fn(n);return b===null?ee.subcommand===null:(ee.subcommand?.includes(b)??!1)||ee.subcommand!==null&&Go.has(ee.subcommand.toLowerCase())&&mg(ee.rest,b).some((le)=>le.includes(b))}return!1}function dg(n,u,b){if(b===void 0)return!1;let W=u.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${W}`).test(n)||/\bcase\b/.test(n))return!1;let B=n.replaceAll(u,"/");return Un(B)===null&&b(B)===null}function ig(n,u,b,W){let z=b(n);if(u===null)return z.optionsOpen||b([...n,Ea]).sources.some((ee)=>ee.value===Ea);if(z.sources.some((ee)=>ee.value.includes(u)))return!0;let B=W.flatMap((ee)=>[ee.selector,...ee.valueForm==="attached-only"||ee.valueForm==="attached-or-separate"?[`${ee.selector}${Ea}`]:[],...ee.valueForm==="equals-or-separate"?[`${ee.selector}=${Ea}`]:[]]),Q=new Set(B.flatMap((ee)=>n.flatMap((le)=>lg(le,u,ee))));return ga(z.sources,Q,(ee)=>b(n.map((le)=>le.replaceAll(u,ee))).sources)}function gA(n,u,b){if(n.length===0||(n[0]??"").toLowerCase()==="command")return!1;let W=new Set(Array.from(Xn(n,b),(B)=>B.head)),z=u===null?[...n,va]:n.map((B,Q)=>Q===0?B:B.replaceAll(u,va));return Array.from(Xn(z,b)).some((B)=>B.head===va&&!W.has(va))}function ug(n,u){return mg(n.slice(1),u).some((b)=>b.includes(u)&&(b.startsWith("-")||b.startsWith(u)))}function mg(n,u){let b=n.findIndex((W)=>W==="--"&&!W.includes(u));return b===-1?n:n.slice(0,b)}function fg(n,u,b){if(u===null)return!0;return n.some((W)=>W.includes(u))||Array.from(b.values()).some((W)=>W.includes(u))}function hA(n,u,b){let W=Pn(n),z=W.commandIndex===null?"":n[W.commandIndex]??"";if(z.includes(u)&&!dg(z,u,b)||W.scriptIndex!==null&&(n[W.scriptIndex]??"").includes(u))return!0;return["-c","-nc","-cn",`--${u}`,u].some((Q)=>n.some((ee,le)=>{if(le===0||!ee.includes(u))return!1;return lg(ee,u,Q).some((ve)=>{let Oe=n.map((Me,Ne)=>Ne===le?Me.replaceAll(u,ve):Me),De=Pn(Oe);if(De.commandIndex===null&&De.scriptIndex===null)return!1;if(W.commandIndex===null&&De.commandIndex!==null)return!0;if(W.scriptIndex===null&&De.scriptIndex!==null)return!0;if(De.commandIndex!==null&&(Oe[De.commandIndex]??"").includes(ve))return!0;return De.scriptIndex!==null&&(Oe[De.scriptIndex]??"").includes(ve)})}))}function yA(n,u,b){let W=new Set(u===null?[]:Array.from(b).filter(([,z])=>z.includes(u)).map(([z])=>z));for(let z of n.matchAll(dA))if(sg(z,W))return!0;for(let z of n.matchAll(uA))for(let B of(z[1]??"").matchAll(mA))if(sg(B,W))return!0;return Bc(n,W)}function sg(n,u){let b=n[1]??n[2];return b!==void 0&&(fA.test(b)||u.has(b))}function SA(n,u,b){if(u===null)return!0;let W=!1,z=0;for(let B=1;B<n.length;B++){let Q=n[B]??"";if(!W&&!Q.startsWith("-")&&Q!=="!"&&Q!=="("){if(Q.indexOf(u)===0)return!0;continue}if(W=!0,z>0){z--;continue}if(lr(Q)){let le=Wo(n,B);B=le.nextIndex-1;for(let ue of Xn(le.tokens,{environment:b,cwd:void 0})){let ve=fg(ue.tokens,u,ue.wrapperEnvAssignments);if(ue.head==="rm"&&ug(ue.tokens,u)||cg(ue.tokens,ue.head,u,ue.wrapperEnvAssignments,ve,b))return!0}continue}let ee=Cr(Q);if(ee>0){if(z=ee,Q.includes(u))return!0;continue}if(Q.includes(u))return!0}return!1}function so(n){let u=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),b=null,W=1;while(W<n.length){let z=n[W];if(!z)break;if(z==="--")return{childStart:W+1,replacementToken:b};if(!z.startsWith("-"))return{childStart:W,replacementToken:b};if(z==="-I"){b=n[W+1]??"{}",W+=2;continue}if(z.startsWith("-I")&&z.length>2){b=z.slice(2),W++;continue}if(z==="--replace"){b="{}",W++;continue}if(z.startsWith("--replace=")){let B=z.slice(10);b=B===""?"{}":B,W++;continue}if(z==="-J"){b=n[W+1]??"{}",W+=2;continue}W+=u.has(z)?2:1}return{childStart:n.length,replacementToken:b}}var Ui="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Hi="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",bA="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",EA="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",wa=/\{[^{}\s]*\}/g,pg=/\{\}|\{-?\d+\}/g,gg=/[\s;&|<>()$`\\"']/,vA=["e","f","source","file","-e","-f","--source","--file"],RA=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],wA=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),_A=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),hg=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),xA=new Set(["--workdir","--wd"]),yg="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Vn(n,u){for(let b of n){let W=u(b);if(W)return W}return null}function bg(n){return Vn([...n],(u)=>Un(u))}function Eg(n,u){let b=n.map(t);if((u.envAssignments?.has("PARALLEL")?u.envAssignments.get("PARALLEL"):u.environment.env.get("PARALLEL"))?.trim()){let Ne=jo(u);if(Ne)return Ne}if(b.length===2&&(b[1]==="--version"||b[1]==="--help"))return null;let z=Mg(b),{template:B,jobs:Q,runsRemotely:ee,readsCommandsFromInput:le,unsupported:ue,workdir:ve,dryRun:Oe}=z;if(ue){let Ne=jo(u);if(Ne)return Ne;let Le=bg(u.envAssignments?.values()??[]);if(Le)return Le}if(le){let Ne=MA(u);if(Ne)return Ne}if(ve!==void 0&&ee){let Ne=jo(u);if(Ne)return Ne}let De=DA(ve,u.cwd,u.environment.paths);if(De===null){let Ne=jo(u);if(Ne)return Ne}let Me=ee?{...u,cwd:void 0,originalCwd:void 0}:De===null||De===void 0||De===u.cwd?u:{...u,cwd:De};if(Oe){if([...Xn(B,Me)].flatMap((Le)=>[...Le.envAssignments.values()]).some(qc)){let Le=jo(u);if(Le)return Le}return null}if(B.length===0){let Ne=Q.map((We)=>We[0]??"");u.budget.charge("derivedTokens",Ne.length);let Le=Ag(Me.envAssignments,Me.cwd,ee);return Vn(Ne,(We)=>u.analyzeNested(We,Le))}return Vn(Xn(B,Me),(Ne)=>AA(Ne,z,u,Me))}function AA(n,u,b,W){let{templateHasPlaceholder:z,runsRemotely:B,usesStdin:Q}=u,ee=n.tokens,le=[...n.envAssignments.values()];if(le.some(kg)){let at=jo(b);if(at)return at}let ue=bg(le);if(ue)return ue;let ve=le.some(Kt),Oe=z||ve,De=Q&&Oe,Me=Ag(n.envAssignments,n.wrapperCwd,B||De),Ne=Oe?{...Me,worktreeMode:!1}:Me,Le=ee.join(" "),We=Kt(Le.split(/[ \t\n=]/,1)[0]??""),Be=!u.quotesCommand&&(We||ee.some((at)=>gg.test(at))),ze=We||gg.test(ee[0]??""),it=Be&&ze&&u.jobs.length>0?null:PA(n,u,b,W,Ne,ve);if(it||!Be)return it;return vg(Kt(Le)?Le:`${Le} {}`,!We,n,u,b,W,Ne)}function PA(n,u,b,W,z,B){let{jobs:Q,templateHasPlaceholder:ee,runsRemotely:le,usesStdin:ue}=u,ve=n.tokens,Oe=ee||B;if(nn.has(n.head)){let Me=()=>{if(!ee||Q.length===0)return null;return Vn(Q,(We)=>b.analyzeChild(Ra(ve,We,b.budget),ro(n,W)))};if(Qn(ve))return Me();if(ca(ve))return sr();let Ne=jn(ve);if(Ne){if(Og(Ne)){let it=Dr(b);if(it)return it;if(Q.length===0)return null;return Vn(Q,(at)=>b.analyzeNested(Tg(Ne,at,b.budget),z))}if(Kt(Ne))return vg(Ne,!1,n,u,b,W,z);let We=!B&&(!ee||Q.length>0)?(Q.length>0?Q:[void 0]).map((it)=>Ca(tn(it===void 0?ve:ee?ve.map((at)=>Pg(at,it)):[...ve,...it]),Ne)):[];if(We.some((it)=>it.kind==="dynamic")){let it=Dr(b);if(it)return it}let Be=We.flatMap((it)=>it.kind==="literal"?[it.source]:[]);if(Be.length>0)return b.budget.charge("derivedTokens",Be.length),Vn(Be,(it)=>b.analyzeNested(it,z));if(Bi(Ne)){let it=Dr(b);if(it)return it}let ze=b.analyzeNested(Ne,z);if(ze)return ze;if(Oe)return Dr(b);return null}let Le=br(tn(ve));if(Le.kind==="dynamic"||Le.kind==="literal"&&Kt(Le.source))return Dr(b)??Me();if(Le.kind==="literal")return Me();if(Q.length>0){let We=Dr(b);if(We)return We;let Be=Me();if(Be)return Be;if(ee)return null;let ze=Q.flatMap((it)=>it[0]===void 0?[]:[it[0]]);return b.budget.charge("derivedTokens",ze.length),Vn(ze,(it)=>b.analyzeNested(it,z))}if(Oe||ue)return Dr(b)??Me();return null}if(n.head==="rm"&&Sr(ve)){if(ee&&Q.length>0)return Vn(Q,(Ne)=>jc(Ra(ve,Ne,b.budget,pg),n.cwd,W));if(Q.length>0)return Vn(Q,(Ne)=>jc(Cg(ve,Ne,b.budget),n.cwd,W));let Me=jc(ve.flatMap((Ne,Le)=>{if(Le===0||!Kt(Ne))return[Ne];return Ne.startsWith("-")?[Ne.replace(pg,"")]:[]}),n.cwd,W);if(Me)return Me;return xg(b)}let De=Q.length>0?Q:[void 0];return Vn(De,(Me)=>{let Ne=Me===void 0?ve:ee?Ra(ve,Me,b.budget):Cg(ve,Me,b.budget),Le=st("parallel.shell-dynamic",Hi),We=ue&&n.head==="find"?OA(Ne,W):null,Be=wg(Ne,ue,b)??We?.customResult??null,ze=Bt(n.head),it=ue&&(ze==="rm"&&Vc(Ne)||ze==="xargs"&&_g(Ne)||We?.rmOptions===!0),at=ue&&(it||We?.executedSource===!0||We===null&&Rg(Ne,ze)),Rt=b.analyzeChild(Ne,{...ro(n,W),worktreeMode:le||ue||Oe?!1:b.worktreeMode,dynamicInput:ue||Oe,dynamicRmInput:it,dynamicSourceInput:Be!==null||at,shellDynamicMatch:Le,dynamicSourceMatch:Le,rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Ui)});if(at){let Tt=Gt(Le,b.policy);if(Tt)return Tt}return Rt??Be??F(Ne,b.policy?.rules??[])})}function vg(n,u,b,W,z,B,Q){if(W.jobs.length>0)return Vn(W.jobs,(ue)=>z.analyzeNested(Tg(n,u?ue.map(Ie):ue,z.budget),Q));let ee=Wi(n);if(ee?.[0]&&Bt(ee[0])==="rm"&&Sr(ee)){let ue=xg(z);if(ue)return ue}return(ee?z.analyzeChild(ee,{...ro(b,B),dynamicInput:W.usesStdin,shellDynamicMatch:st("parallel.shell-dynamic",Hi),rmDynamicMatch:st("parallel.rm-recursive-force-dynamic",Ui)}):null)??z.analyzeNested(n,Q)}function Rg(n,u){if(Kt(n[0]??""))return!0;if(u==="eval"||u==="source"||u===".")return!0;if(u==="parallel"||u==="xargs")return!0;if(nn.has(u))return kA(n);if(u==="git")return TA(n);if(u==="find")return!0;if(Bn.has(u))return Sg(n,vA,Ni);if(Ln(u))return Sg(n,RA,ea);return!1}function Vc(n){let u=n.indexOf("--"),b=n.slice(1,u===-1?void 0:u);if(!n.some(Kt))return u===-1;return b.some((z)=>Kt(z)&&(z.startsWith("-")||Og(z)))}function TA(n){if(IA(n))return!0;let u=Fn(n);if(u.subcommand===null||Kt(u.subcommand))return!0;if(!Go.has(u.subcommand.toLowerCase()))return!1;let b=u.rest.indexOf("--"),W=u.rest.slice(0,b===-1?void 0:b);if(!n.some(Kt))return b===-1;return W.some(Kt)}function IA(n){for(let u=1;u<n.length;u++){let b=n[u];if(!b||b==="--"||!b.startsWith("-"))return!1;if(b==="-c"||b==="--config-env"){if(Kt(n[u+1]??""))return!0;u++;continue}if(b.startsWith("-c")&&b.length>2||b.startsWith("--config-env=")){if(Kt(b))return!0;continue}if(Kt(b))return!0}return!1}function kA(n){if(Qn(n))return!1;let u=jn(n);if(u!==null)return Kt(u);let b=br(tn(n));if(b.kind==="literal")return Kt(b.source);if(b.kind==="dynamic")return!0;return!n.some(Kt)}function Sg(n,u,b){let W=b(n);if(W.some((z)=>Kt(z.value)))return!0;if(!n.some(Kt))return b([...n,yg]).some((z)=>z.value===yg);return ga(W,u,(z)=>b(n.map((B)=>Pg(B,[z]))))}function wg(n,u,b){let W=b.policy?.rules??[];if(!u||W.length===0)return null;let z=W.filter((B)=>Bt(B.command)===Bt(n[0]??""));if(z.length===0)return null;if(n.slice(1).some(Kt))return Dr(b);return Vn(z,(B)=>F([...n,...B.subcommand?[B.subcommand]:[],...B.block_args],[B]))}function OA(n,u){let b={customResult:null,executedSource:!n.some(Kt),rmOptions:!1},W=!1,z=0,B=null,Q=()=>{if(!B?.some(Kt))return;for(let ee of Xn(B,u))b.executedSource||=Rg(ee.tokens,ee.head),b.rmOptions||=ee.head==="rm"&&Vc(ee.tokens)||ee.head==="xargs"&&_g(ee.tokens),b.customResult??=wg(ee.tokens,!0,u)};for(let ee of n.slice(1)){if(!W&&!ee.startsWith("-")&&ee!=="!"&&ee!=="("){b.executedSource||=Kt(ee);continue}if(W=!0,B){if(ee===";"||ee==="+"){Q(),B=null;continue}B.push(ee);continue}if(z>0){z--;continue}if(lr(ee)){B=[],b.executedSource||=Kt(ee);continue}let le=Cr(ee);if(le>0){z=le,b.executedSource||=Kt(ee);continue}b.executedSource||=Kt(ee)}return Q(),b}function _g(n){let u=n.slice(so(n).childStart);return Bt(u[0]??"")==="rm"&&Vc(u)}function _a(n,u){return(b)=>Gt(st(n,u),b.policy)}var Dr=_a("parallel.shell-dynamic",Hi),MA=_a("parallel.command-stream-dynamic",bA),jo=_a("parallel.command-stream-dynamic",EA),xg=_a("parallel.rm-recursive-force-dynamic",Ui);function jc(n,u,b){return Gt(ha(tn(n),{environment:b.environment,cwd:u,budget:b.budget,originalCwd:b.originalCwd,strict:b.strict,paranoid:b.paranoidRm,allowTmpdirVar:b.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(b.envAssignments??new Map,b.environment),trustedTmpdirValue:To(b.envAssignments??new Map,b.environment),protectedGitMetadata:b.protectedGitMetadata,policy:b.policy}),b.policy)}function Ag(n,u,b){let W={};if(n)W.envAssignments=n;if(b)return W.effectiveCwd=null,W.worktreeMode=!1,W;if(u!==void 0)W.effectiveCwd=u;return Object.keys(W).length>0?W:void 0}function Pg(n,u){return n.replace(wa,(b)=>Ig(b,u))}function Ra(n,u,b,W=wa){return b.charge("derivedTokens",n.reduce((z,B)=>z+1+Math.floor(B.length/64),0)),n.map((z)=>z.replace(W,(B)=>{let Q=Ig(B,u);return b.charge("derivedTokens",Math.max(1,Math.ceil(Q.length/64))),Q}))}function Tg(n,u,b){return Ra([n],u,b)[0]??""}function Cg(n,u,b){return b.charge("derivedTokens",n.length+u.length),[...n,...u]}function Ig(n,u){let b=/^\{(-?\d+)[^{}\s]*\}$/.exec(n)?.[1];if(b===void 0)return u[0]??"";let W=Number(b);return u[W>0?W-1:u.length+W]??""}function Kt(n){return n.search(wa)!==-1}function kg(n){if(qc(n))return!0;for(let u of n.matchAll(wa))if(!/^(?:\{\}|\{\d+\})$/.test(u[0]))return!0;return!1}function qc(n){let u=n.indexOf("{=");return u!==-1&&n.indexOf("=}",u+2)!==-1}function Og(n){return/^\{[^{}\s]*\}$/.test(n)}function DA(n,u,b){if(n===void 0)return;if(n==="..."||/^~|[{}$`*?[]/.test(n))return null;if(!u&&!CA(n))return null;try{return Tr(u??n,n,b)}catch{return null}}function Mg(n){let u=1,b=[],W=n.length,z=-1,B=!1,Q=!1,ee=!1,le,ue=!1,ve=n.some((Le)=>Le==="::::"||Le==="::::+"||Le===":::+");while(u<n.length){let Le=n[u];if(Le===void 0)break;if(Le===":::"){z=u;break}if(Le==="--"){let at=Rc(n,u+1);b.push(...at.templateTokens),W=u+1,z=at.markerIndex;break}if(!Le.startsWith("-")){let at=Rc(n,u);b.push(...at.templateTokens),W=u,z=at.markerIndex;break}let We=n[u+1],Be=Le.indexOf("="),ze=Be===-1?Le:Le.slice(0,Be),it=Be===-1?void 0:Le.slice(Be+1);if(Le==="--dry-run"){ue=!0,u++;continue}if(Le==="-I"||Le.startsWith("-I")&&Le.length>2){ve||=(Le==="-I"?We:Le.slice(2))!=="{}",u+=Le==="-I"?2:1;continue}if(Le==="--replace"||Le==="-i"){ve=!0,u+=2;continue}if(ze==="--replace"||Le.startsWith("-i")&&Le.length>2){let at=ze==="--replace"?it:Le.slice(2);ve||=at!==""&&at!=="{}",u++;continue}if(Le==="-a"||_A.has(ze)){ve=!0,u+=it===void 0?2:1;continue}if(Le==="-q"||Le==="--quote"){Q=!0,u++;continue}if(Le==="--pipe"||Le==="--pipepart"){ee=!0,u++;continue}if(ze==="--env"){ve=!0,u+=it===void 0?2:1;continue}if(hg.has(ze)||Le.startsWith("-S")&&Le.length>2){B=!0,u+=hg.has(Le)?2:1;continue}if(xA.has(ze)){ve=!0;let at=it??We;if(at===void 0||at===":::"||at==="--"){u++;continue}le=at,u+=it===void 0?2:1;continue}if(Le.startsWith("-j")&&Le.length>2&&/^\d+$/.test(Le.slice(2))){u++;continue}if(Le.startsWith("--")&&it!==void 0){u++;continue}if(wA.has(Le)){if(We===void 0||We===":::"||We==="--"){ve=!0,u++;continue}u+=2;continue}u+=Le==="-j"||Le==="--jobs"?2:1}ve||=b.some(ue?qc:kg);let Oe=[];if(z!==-1){let Le=[];for(let We=z+1;We<n.length;We++){let Be=n[We];if(Be===":::"){Oe.push(Le),Le=[];continue}if(Be!==void 0)Le.push(Be)}Oe.push(Le)}ve||=Oe.length>1;let De=NA(Oe),Me=b.some(Kt),Ne=b.length===0&&z===-1;return{template:b,jobs:De,childStart:W,templateHasPlaceholder:Me,runsRemotely:B,quotesCommand:Q,usesStdin:ee||z===-1,readsCommandsFromInput:Ne,unsupported:ve,workdir:le,dryRun:ue}}function NA(n){if(n.length===0||n.some((b)=>b.length===0))return[];let u=[[]];for(let[b,W]of n.entries()){if(W.length===1){let B=W[0];if(B===void 0)return[];for(let Q of u)Q.push(B);if(u.length*(b+1)>l.derivedTokens.cap)throw new a("derivedTokens");continue}let z=[];for(let B of u)for(let Q of W){if((z.length+1)*(b+1)>l.derivedTokens.cap)throw new a("derivedTokens");z.push([...B,Q])}u=z}return u}function Dg(n){return Mg(n).childStart}var LA="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",xa="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Yc(n){return n?.parts.some((u)=>u.provenance==="command-substitution")??!1}function Kc(n){return n?.parts.some((u)=>u.provenance==="literal"&&u.raw.replace(/^["']/,"").startsWith("-"))??!1}function Lg(n,u,b,W,z=!1,B){let ee=(gi(n,u)||W&&n!=="powershell"&&u[0]?.provenance==="variable")&&un(B,"shell.dynamic-executable",z)?st("shell.dynamic-executable",LA):null;return Gt(ee,B)??Wg(n,u,b,z,B)}function Wg(n,u,b,W,z){if(u.length<2)return null;let B=u.flatMap((ee,le)=>Yc(ee)?[le]:[]);if(B.length===0)return null;let Q=Bt(u[0]?.text??"");if(Q==="git"){let ee=ce(n,u),le=FA(ee);if(un(z,"shell.dynamic-structure",W)&&B.some((Oe)=>Oe<=le))return Gt(st("shell.dynamic-structure",xa),z);if(Gt(pa(ee,{environment:b}),z))return null;let ue=u[le]?.text.toLowerCase(),ve=ee.findIndex((Oe,De)=>De>le&&t(Oe)==="--");if(un(z,"shell.dynamic-structure",W)&&ue&&Go.has(ue)&&B.some((Oe)=>Oe>le&&(ve===-1||Oe<ve)))return Gt(st("shell.dynamic-structure",xa),z);return null}if(Q==="find")return un(z,"shell.dynamic-structure",W)&&GA(u)?Gt(st("shell.dynamic-structure",xa),z):null;if(Q==="rm"){let ee=u.findIndex((ue,ve)=>ve>0&&t(ue)==="--"),le=Sr(u.map(t));return un(z,"shell.dynamic-structure",W)&&B.some((ue)=>(ee===-1||ue<ee)&&(ue<u.length-1||!le))?Gt(st("shell.dynamic-structure",xa),z):null}if(Q==="xargs")return Ng(n,u.slice(so(u.map(t)).childStart),"xargs",b,W,z);if(Q==="parallel")return Ng(n,u.slice(Dg(u.map(t))),"parallel",b,W,z);return null}function Ng(n,u,b,W,z,B){if(u.length===0)return null;let Q=WA(u,W);if(gi(n,Q)){let le=Gt(st(`${b}.shell-dynamic`,b==="xargs"?Hc:Hi),B);if(le)return le}let ee=Wg(n,Q,W,z,B);if(ee)return ee;if(Q[0]?.text==="rm"&&Q.slice(1).some((le)=>Yc(le)&&Kc(le)))return Gt(st(`${b}.rm-recursive-force-dynamic`,b==="xargs"?Uc:Ui),B);return null}function WA(n,u){let b=gr(n,u),W=b.rewritten?tn(b.words.map(t)):b.words,z=W[0];return z&&t(z)==="busybox"?W.slice(1):W}function FA(n){let u=1;while(u<n.length){let b=n[u],W=b?t(b):"";if(Nn.has(W)){u+=2;continue}if(W.startsWith("-")){u++;continue}return u}return u}function GA(n){let u=!1,b=0,W=!1,z=!1;for(let B=1;B<n.length;B++){let Q=n[B];if(!Q)continue;let ee=Yc(Q);if(b>0){b--;continue}if(z){if(Q.text===";"||Q.text==="+"){z=!1,u=!0,W=!1;continue}if(ee&&(W||Kc(Q)))return!0;W=!1;continue}if(!u&&!Q.text.startsWith("-")){if(ee&&(B>1||Kc(Q)))return!0;continue}if(u=!0,ee)return!0;let le=Cr(Q.text);if(le>0){b=le;continue}if(lr(Q.text))z=!0,W=!0}return!1}function Zc(n,u){return n.some((b)=>{if(b.value==="-"&&(b.kind==="main-script"||b.kind==="program-file"))return!0;return!xo(u[b.tokenIndex],b.value)})}var zA="unshare creating a user namespace grants root inside it, a common step toward privilege escalation. Ask the user to run it manually if it is needed.",$A=/^--(?:user|map-root-user|map-current-user|map-auto|map-subids|map-(?:user|group)s?|owner|mount-binfmt|load-interp)(?:=|$)/,BA=/[Urcl]/,UA=/[RwSGl]/,HA=new Set(["--propagation","--setgroups","--root","--wd","--setuid","--setgid","--map-user","--map-group","--map-users","--map-groups","--owner","--whitelist-env","--load-interp"]);function Fg(n){let u=n.slice(1).search(UA);return u===-1?n.length:u+1}function jA(n){return HA.has(n)||/^-[^-]/.test(n)&&Fg(n)===n.length-1}function VA(n){return n.startsWith("--")?$A.test(n):BA.test(n.slice(1,Fg(n)+1))}function Gg(n,u){if(n!=="unshare")return null;let b=u.slice(1),W=(B)=>jA(b[B-1]??""),z=b.findIndex((B,Q)=>!W(Q)&&(B==="--"||!B.startsWith("-")));return b.slice(0,z===-1?void 0:z).some((B,Q)=>!W(Q)&&VA(B))?st("unshare.user-namespace",zA):null}var qA="This reaches a cloud metadata endpoint, which hands out instance credentials. Ask the user to run metadata requests manually if they are needed.",KA="This uploads data to a remote host, which can send local files or secrets off the machine. Send it to localhost instead, or ask the user to run the upload manually if it is needed.",YA=/(?<![\w.-])(?:169\.254\.169\.254|169\.254\.170\.23|169\.254\.170\.2|100\.100\.100\.200|metadata\.google\.internal|metadata\.goog)(?![\w-]|\.[\w-])|(?<![\w:])fd00:ec2::(?:254|23)(?![\w:])/i,Xc=new Set(["xargs","find"]),zg=(n)=>new Map(Object.entries(n).flatMap(([u,b])=>b.map((W)=>[W,u]))),$g=new Map([["curl",zg({data:["-d","--data","--data-ascii","--data-binary","--data-raw","--data-urlencode","--json"],upload:["-F","--form","--form-string","-T","--upload-file"],url:["--url","-x","--proxy","--preproxy"],source:["-K","--config"],local:["--unix-socket","--abstract-unix-socket"],get:["-G","--get"],value:[..."ACDEHPQUXYbcehmortuwyz".split("").map((n)=>`-${n}`),"--output","--output-dir","--header","--proxy-header","--request","--user-agent","--user","--proxy-user","--max-time","--connect-timeout","--write-out","--cookie","--cookie-jar","--referer","--retry","--retry-delay","--retry-max-time","--cert","--key","--cacert","--capath","--range","--resolve","--connect-to","--limit-rate","--oauth2-bearer","--dump-header","--continue-at","--time-cond","--interface","--max-filesize","--max-redirs","--noproxy","--url-query","--aws-sigv4","--variable","--stderr","--trace","--trace-ascii"]})],["wget",zg({upload:["--post-data","--post-file","--body-data","--body-file"],source:["-i","--input-file"],value:[..."ABDIOPQRTUXaelotw".split("").map((n)=>`-${n}`),"--output-document","--output-file","--append-output","--header","--user-agent","--method","--timeout","--tries","--user","--password","--directory-prefix","--execute","--wait","--referer","--load-cookies","--save-cookies","--ca-certificate","--certificate","--private-key"]})]]),ZA=/^(?:localhost|[a-z\d-]+(?:\.[a-z\d-]+)*\.localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\])$/;function Ug(n,u){if(XA(n,u))return st("network.cloud-metadata",qA);return JA(n,u)?st("network.upload-remote",KA):null}function XA(n,u){return(Xc.has(n)?u.slice(1).some(Bg):Bg(n))&&u.some((W,z)=>!QA(u[z-1],W)&&YA.test(W))}function Bg(n){let u=Qc(n);return cs.has(u)||Ln(u)}function QA(n,u){return n==="--noproxy"||u.startsWith("--noproxy=")}function JA(n,u){let b=Xc.has(n)?u.findIndex((Me,Ne)=>Ne>0&&$g.has(Qc(Me))):0,W=$g.get(Qc(u[b]??n));if(b<0||W===void 0)return!1;let z=u.slice(b+1),B=z.findIndex((Me)=>Me===";"||Me==="+"),Q=B<0||!Xc.has(n)?z:z.slice(0,B),ee=new Set,le=[],ue=(Me,Ne)=>{if(ee.add(Me),Me==="url"&&Ne!=="")le.push(Ne);if(Me==="source")le.push("")},ve=0,Oe=!1;while(ve<Q.length){let Me=Q[ve]??"";if(ve++,Oe||!Me.startsWith("-")||Me==="-"){le.push(Me);continue}if(Me==="--"){Oe=!0;continue}if(Me.startsWith("--")){let ze=Me.indexOf("="),it=W.get(ze<0?Me:Me.slice(0,ze));if(it===void 0)continue;let at=it!=="get",Rt=ze>=0?Me.slice(ze+1):at?Q[ve]??"":"";if(at&&ze<0)ve++;ue(it,Rt);continue}let Ne=Me.slice(1).split(""),Le=Ne.findIndex((ze)=>{let it=W.get(`-${ze}`);return it!==void 0&&it!=="get"});if((Le<0?Ne:Ne.slice(0,Le)).some((ze)=>W.get(`-${ze}`)==="get"))ee.add("get");if(Le<0)continue;let We=W.get(`-${Me[Le+1]}`)??"value",Be=Me.slice(Le+2);if(Be==="")ve++;ue(We,Be===""?Q[ve-1]??"":Be)}return(ee.has("upload")||ee.has("data")&&!ee.has("get"))&&!ee.has("local")&&!(le.length>0&&le.every(eP))}function Qc(n){return Bt(Wt(n))}function eP(n){let u=n.replace(/^[a-z][a-z\d+.-]*:\/\//i,"").split(/[/?#]/)[0]??"",b=u.slice(u.lastIndexOf("@")+1).toLowerCase(),W=b.startsWith("[")?b.slice(0,b.indexOf("]")+1):b.split(":")[0];return ZA.test(W??"")}var Hg="cmd rmdir /s or del /s outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",tP="cmd rmdir /s or del /s for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nP="cmd rmdir /s or del /s target contains wildcards or variables that cannot be verified safely. Use literal paths within cwd.",rP="cmd rmdir /s or del /s targeting root or home directory is extremely dangerous and always blocked.",oP="cmd rmdir /s or del /s with \\\" quoting or a \\\\?\\ path is blocked: cmd does not treat \\\" as an escape, so the target can split down to the root of the drive. Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.",iP="cmd rmdir /s or del /s in home directory is dangerous. Change to a project directory first.",sP={root_or_home_target:{id:"cmd.recursive-delete-root-or-home",reason:rP},git_metadata_target:{id:"cmd.recursive-delete-git-metadata",reason:y},dynamic_target:{id:"cmd.recursive-delete-dynamic-target",reason:nP},home_cwd_target:{id:"cmd.recursive-delete-home-cwd",reason:iP},cwd_self_target:{id:"cmd.recursive-delete-cwd-self",reason:Hg},within_anchored_cwd:{id:"cmd.recursive-delete-paranoid",reason:tP},outside_anchored_cwd:{id:"cmd.recursive-delete-outside-cwd",reason:Hg}},aP=/^\/\/?[ck]$/i,jg=/[&|]+/,lP=/(?:"[^"]*"|[^\s"])+/g,cP=/[\^%!]/,dP=/\\"./s,uP=/(^|\/)[*.]*\*[*.]*$/,mP=/^"?[\\/]+[?.][\\/]/,fP=new Set(["rmdir","rd","del","erase"]),pP=/(?<![\w-])(?:rmdir|rd|del|erase)(?!\w)/i,gP=/\/s(?!\w)/i,hP=/(?<![\w-])(?:cd|chdir|pushd|popd)(?!\w)/i;function Vg(n,u){let b=n.map(t),W=b.findIndex((De)=>aP.test(De));if(W===-1)return null;let z=b.slice(W+1).join(" "),B=/^".*"$/s.test(z)?z.slice(1,-1):z,Q=B.split(jg).map((De)=>{let Me=De.match(lP)??[],Ne=Me.findIndex((We)=>fP.has(We.replace(/^@/,"").toLowerCase())),Le=Ne===-1?[]:Me.slice(Ne);return{piece:De,tokens:Me,deleteTokens:Le,recursiveDelete:Le.slice(1).some((We)=>We.startsWith("/")&&We.toLowerCase().split("/").includes("s"))}}),ee=Q.filter((De)=>De.recursiveDelete),le=ee.length>0||pP.test(B)&&gP.test(B);if(le&&(B.includes("\\\"")||u.gitBashEscapesBodyQuotes&&B.includes('"')||u.powerShellRawWords.some((De)=>dP.test(De))||ee.some((De)=>De.tokens.some((Me)=>mP.test(Me)))))return st("cmd.recursive-delete-escaped-quote",oP);let ue=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths}),ve=Q.reduce((De,Me)=>De??(Me.recursiveDelete?yP(Me.deleteTokens,ue,u.policy):u.analyzeNested(Me.piece)),null),Oe=le&&(ee.length===0||cP.test(B)||hP.test(B)||B.includes('"')&&jg.test(B));return ve??(Oe?sr():null)}function yP(n,u,b){return n.slice(1).filter((W)=>!W.startsWith("/")).reduce((W,z)=>W??No(Mi(z.replaceAll('"',"")).replace(uP,"$1*"),u,b,sP),null)}var SP="Recursive delete handed to powershell or pwsh in a form CC Safety Net does not read is blocked: pass the script as a single -Command with literal paths, after only -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.",CP=/^-(?:noprofile|nop|noninteractive|noni|nologo)$/i,bP=/^-(?:executionpolicy|ep)$/i,EP=/^-(?:command|c)$/i,vP=/^(?:--?|[/\u2013\u2014\u2015])(\w+)$/,RP="encodedcommand",wP=/(?<![\w-])(?:remove-item|ri|rm|rmdir|rd|del|erase)(?![\w-])/i,_P=/(?<![\w-])(?:[-\u2013\u2014\u2015]{1,2}r(?:e(?:c(?:u(?:r(?:s(?:e|ive?)?)?)?)?)?)?(?!\w)|-[dfipvwx]*r[dfipvwx]*(?!\w))|\/s(?!\w)/i,xP=/[$`]/,AP="--%";function qg(n,u){let b=n.map(t),W=b.every((B,Q)=>Q===0||B!==AP&&PP(n[Q],B))?ed(b):void 0;if(W!==void 0)return u(W);if(b.some(TP))return sr();let z=b.join(" ");return wP.test(z)&&_P.test(z)?st("powershell.nested-recursive-delete-unread",SP):null}function ed(n){let u=Jc(n,1),b=u===void 0?[]:n.slice(u+1);return b.length>0?b.join(" "):void 0}function Jc(n,u){let b=n[u]??"";if(EP.test(b))return u;if(CP.test(b))return Jc(n,u+1);return bP.test(b)?Jc(n,u+2):void 0}function PP(n,u){return n?.provenance==="unknown"?!xP.test(u):xo(n,u)}function TP(n){let u=vP.exec(n)?.[1]?.toLowerCase();return u!==void 0&&(u==="ec"||RP.startsWith(u))}var IP="rsync --delete permanently removes destination files missing from the source. Mirror only into explicit paths inside the current directory or under /tmp, /var/tmp, or $TMPDIR.",kP="rsync --delete targeting root or home directory is extremely dangerous and always blocked.",OP=/[efBMT@]/,MP=new Set(["address","backup-dir","block-size","bwlimit","cc","checksum-choice","checksum-seed","chmod","chown","compare-dest","compress-choice","compress-level","contimeout","copy-as","copy-dest","debug","early-input","exclude","exclude-from","files-from","filter","groupmap","iconv","include","include-from","info","link-dest","log-file","log-file-format","log-format","max-alloc","max-delete","max-size","min-size","modify-window","only-write-batch","out-format","outbuf","partial-dir","password-file","port","protocol","read-batch","remote-option","rsh","rsync-path","skip-compress","sockopts","stderr","stop-after","stop-at","suffix","temp-dir","timeout","usermap","write-batch","zc","zl"]);function Kg(n,u){let b=[],W=!1,z=!1,B=1;while(B<n.length){let ue=n[B],ve=ue?t(ue):"";if(B++,!ue)continue;if(z||ve==="-"||!ve.startsWith("-")){b.push(ue);continue}if(ve==="--"){z=!0;continue}if(ve.startsWith("--")){if(W||=ve==="--del"||ve.startsWith("--dele"),!ve.includes("=")&&MP.has(ve.slice(2)))B++;continue}if(ve.slice(1).search(OP)===ve.length-2)B++}let Q=b.slice(1).filter((ue)=>!DP(t(ue)));if(!W||Q.length===0)return null;let ee=Hn({...u,allowPaths:u.policy?.destructiveCommandAllowPaths,posixShell:!0}),le=Q.flatMap((ue)=>{let ve=to(ue);return(ve.expandedTargets??[t(ue)]).map((Oe)=>ar(Oe,ee,{targetIsLiteral:ve.expandedTargets!==void 0||ve.targetIsLiteral,tmpdirWordSplittingProtected:ve.tmpdirWordSplittingProtected}).kind)});if(le.includes("root_or_home_target"))return st("rm.recursive-force-root-or-home",kP);if(le.includes("git_metadata_target"))return st("rm.git-metadata",y);if(Js(Q,u))return null;return Gt(st("rsync.delete",IP),u.policy)}function DP(n){return!/[$`]/.test(n)&&/^[^/]*:/.test(n)}var Zg=[{heads:new Set(["rm","rmdir"]),analyze:(n)=>ha(n.words,Aa(n))},{heads:new Set(["cmd"]),analyze:(n)=>Vg(n.words,{...Aa(n),powerShellRawWords:n.options.commandView?.dialect==="powershell"?n.options.commandView.words.map((u)=>u.raw):[],gitBashEscapesBodyQuotes:n.options.commandView?.dialect!=="powershell",analyzeNested:(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments}))})},{heads:new Set(["powershell","pwsh"]),analyze:(n)=>qg(n.parsedWords,(u)=>Nr(n.options.analyzeNested(u,{effectiveCwd:n.effectiveCwd,envAssignments:n.envAssignments,shell:"powershell"})))},{heads:new Set(["git"]),analyze:(n)=>pa(n.words,td(n))},{heads:new Set(["find"]),analyze:(n)=>Cp(n.words,{...Aa(n),envAssignments:n.envAssignments,analyzeTokens:n.analyzeChildTokens})},{heads:new Set(["rsync"]),analyze:(n)=>Kg(n.words,{...Aa(n),envAssignments:n.envAssignments})},{heads:new Set(["xargs"]),analyze:(n)=>ag(n.words,{...Yg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,b)=>Nr(n.options.analyzeNested(u,b))})},{heads:new Set(["parallel"]),analyze:(n)=>Eg(n.words,{...Yg(n),analyzeChild:n.analyzeChild,analyzeNested:(u,b)=>Nr(n.options.analyzeNested(u,b))})}];function Yg(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoidRm:n.options.paranoidRm,paranoidInterpreters:n.options.paranoidInterpreters,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.options.protectedGitMetadata,budget:n.options.budget,envAssignments:n.envAssignments,worktreeMode:n.options.worktreeMode,policy:n.options.policy}}function Nr(n){return n?{id:n.ruleId,reason:n.reason,intent:n.intent??"manual_only"}:null}function Aa(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.options.strict,paranoid:n.options.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Kr(n.envAssignments,n.options.environment),trustedTmpdirValue:To(n.envAssignments,n.options.environment),protectedGitMetadata:n.options.protectedGitMetadata,policy:n.options.policy,budget:n.options.budget}}function td(n){return{environment:n.options.environment,cwd:n.cwd,originalCwd:n.originalCwd,dynamicArguments:n.dynamicArguments,envAssignments:n.envAssignments,shellAssignments:n.options.shellAssignments,policy:n.options.policy,worktreeMode:n.options.worktreeMode}}function eh(n){return Zg.find((u)=>u.heads.has(n))?.analyze}function qo(n,u,b){let W=b.trace;if(n.length===0)return null;let z=b.commandView?.dialect??"posix",B=(Et)=>Et.map(($t)=>z==="posix"?t($t):$t.text),Q=b.child,ee=Q!==void 0&&!Q.embedded,le=Q?.embedded===!0,ue=b.effectiveCwd===null,ve=Q?Q.cwd:ue?void 0:b.effectiveCwd??b.cwd,Oe=Q?Q.originalCwd:ue?void 0:b.cwd,De=Ae(n);if(De.envAssignments.size>0)W?.recordSegment({type:"env-strip",input:B(n),envVars:[...De.envAssignments.keys()],output:B(De.words)});let Me=gr(De.words,b.environment,ve,new Map([...b.envAssignments??[],...De.envAssignments])),Ne=Me.envSplitValues??[];if(Ne.length>0){let Et=[...Ne,...B(Me.words)].join(" "),$t=Un(Et);if($t)return W?.recordSegment({type:"dangerous-text",token:Et,matched:!0,reason:$t.reason}),wn($t);if(b.strict)return En(W);let Xt=Yr(Ne,B(Me.words));if(Xt){b.budget.charge("derivedTokens",Xt.length);let Gn=b.analyzeNested(Xt.join(" "),{effectiveCwd:Me.cwd===void 0?b.effectiveCwd:Me.cwd,envAssignments:new Map([...b.envAssignments??[],...De.envAssignments,...Me.envAssignments])});if(Gn)return Gn}}let Le=Me.rewritten?tn(B(Me.words)):ce(z,Me.words),We=B(Le),Be={...b,wrapperNormalizationBudget:b.wrapperNormalizationBudget??{iterations:0}};if(W&&De.words.length>Le.length){let Et=B(De.words);W.recordSegment({type:"leading-tokens-stripped",input:Et,removed:Et.slice(0,Et.length-Le.length),output:We})}let ze=new Map([...b.envAssignments??[],...De.envAssignments,...Me.envAssignments]),it=We[0];if(!it)return null;if(no(it))throw new a("wrapperPeelIterations");let at=Bt(it),Rt=Me.cwd===null?void 0:Me.cwd??ve,Tt=Me.cwd===null?void 0:Oe,kt=Me.cwd===void 0?b.effectiveCwd:Me.cwd,lt=Me.cwd===void 0?b.effectiveCwd:null,Vt=Q?Q.allowTmpdirVar:!wi(ze,b.environment),Ut=Lg(z,Me.words,b.environment,u===0,b.strict,b.policy);if(Ut)return W?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Ut.reason}),wn(Ut);let an=sa(We,b.policy);if(an){for(let Et of[an.childIndex,...an.alternativeChildIndices]){Qg(Be.wrapperNormalizationBudget);let $t=Le.slice(Et);W?.recordSegment({type:"transparent-wrapper",wrapper:an.wrapper,output:B($t)});let Xt=qo($t,u,{...Be,effectiveCwd:kt,envAssignments:ze});if(Xt)return Xt}return null}let Sn=le?void 0:at==="eval"?Sa(Le):at==="trap"&&!ee?Qp(Le):void 0;if(ee&&Q&&at==="eval"){if(Sn?.kind==="dynamic")return Vo(Q,b.policy);if(Sn?.kind==="literal"){let Et=b.analyzeNested(Sn.source,{effectiveCwd:kt,envAssignments:ze});if(Et)return Et}return Ko(Q,b.policy)}if(Sn?.kind==="dynamic"&&(b.strict||!b.commandView||!$c(b.commandView)))return En(W);if(Sn?.kind==="literal"){W?.recordSegment({type:"recurse",reason:at==="eval"?"shell-eval":"shell-trap",innerCommand:Sn.source,depth:u+1});let Et=b.analyzeNested(Sn.source,{effectiveCwd:kt,envAssignments:ze,functionDefinitions:b.functionDefinitions});if(Et)return Et}if(ee?nn.has(at):oh(it,at)){if(Qn(We))return null;if(ca(We))return En(W);if(ee&&Q){let Et=jn(We);if(Et){if(Q.dynamicSourceInput??Q.dynamicInput){let Xt=Vo(Q,b.policy);if(Xt)return Xt}if(Bi(Et)){let Xt=Vo(Q,b.policy);if(Xt)return Xt}return b.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze})}let $t=br(Le);if($t.kind==="dynamic")return Vo(Q,b.policy);if($t.kind==="literal")return Q.dynamicSourceInput?Vo(Q,b.policy):null;return Q.dynamicSourceInput??Q.dynamicInput?Vo(Q,b.policy):null}if(le){let Et=jn(We),$t=Et?b.analyzeNested(Et,{effectiveCwd:kt,envAssignments:ze}):br(Le).kind==="dynamic"?En(W):null;if($t)return $t}if(Q===void 0){let Et=GP(We,ze,kt,b,W,u);if(Et)return Et;let $t=jn(We);if($t){let Rn=Pn(We).commandIndex,cn=Rn===null?void 0:Le[Rn];if(cn&&b.commandView&&zi(cn,b.commandView.nested,b.environment))return En(W);let tr=Ca(Le,$t);if(tr.kind==="dynamic")return En(W);let cr=tr.kind==="literal"?tr.source:Jp(Le,$t),Pd=BP(cr);W?.recordSegment({type:"shell-wrapper",wrapper:at,innerCommand:Pd}),W?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Pd,depth:u+1});let Td=b.analyzeNested(cr,{effectiveCwd:kt,envAssignments:ze});if(Td)return Td;return Bi(cr)?En(W):null}let Xt=br(Le,b.environment.home,b.strict?void 0:zo(b.shellAssignments??new Map,{home:b.environment.home,cwd:lt}));if(Xt.kind==="dynamic")return En(W);if(Xt.kind==="literal")return ji(Xt.source,kt,ze,b,W,u);let Gn=eg(Le,b.commandView?.redirections??[],b.hasPipelineInput??!1,b.literalShellInput);if(Gn.kind==="dynamic")return En(W);if(Gn.kind==="literal")return W?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Gn.source,depth:u+1}),b.analyzeNested(Gn.source,{effectiveCwd:kt,envAssignments:ze})}}if(!Q&&(at==="source"||at===".")){let Et=We[1]==="-p"?2:null;if(Et!==null){let cn=b.commandView?Le[Et]:void 0;if(!cn)return null;if(cn.provenance!=="literal")return En(W)}let $t=Et===null?1:3,Xt=We[$t]==="--"?$t+1:$t,Gn=b.commandView?Le[Xt]:void 0;if(!Gn)return null;let Rn=Xg(Gn,b,lt);if(Rn!==null)return ji(Rn,kt,ze,b,W,u);if(b.strict||!b.commandView||!$c(b.commandView))return En(W)}let zt=Le[0];if(!Q&&zt&&it.includes("/")){let Et=Xg(zt,b,lt),$t=Et===null?null:ji(Et,kt,ze,b,W,u,!1,!0);if($t)return $t}if(Bn.has(at)&&!le){if(!Q&&b.strict&&Zc(Ni(We),Le))return En(W);let Et=cp(We,(Xt)=>Nr(b.analyzeNested(Xt,{effectiveCwd:kt,envAssignments:ze}))),$t=Gt(Et,b.policy);if($t)return W?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:$t.reason}),wn($t)}if(Ln(at)&&!le){let Et=ea(We),$t=b.remotePipelineInput===!0&&!tg(b.commandView?.redirections??[])&&!gc(We)&&Et.every((cn)=>cn.kind==="main-script"&&cn.value==="-"),Xt=Et.some((cn)=>{let tr=Le[cn.tokenIndex];return cn.kind!=="module-file"&&tr!==void 0&&b.commandView!==void 0&&zi(tr,b.commandView.nested,b.environment)}),Gn=!gc(We)&&Et.some((cn)=>cn.kind==="main-script"&&Le[cn.tokenIndex]?.provenance==="literal"&&b.downloadedPaths?.has(Ar(cn.value,kt,b.environment.paths,b.budget)??""));if(!Q&&($t||Xt||Gn||b.strict&&Zc(Et,Le)))return En(W);let Rn=Zf(We);if(ee&&Q)return WP(at,Rn,kt,ze,b,Q);if(Rn){let cn=un(b.policy,"interpreter.one-liner-paranoid",!!b.paranoidInterpreters);if(W?.recordSegment({type:"interpreter",interpreter:at,codeArg:Rn,paranoidBlocked:cn}),cn){let cr=Gt(st("interpreter.one-liner-paranoid",ki),b.policy);if(cr)return wn(cr)}if(hc(at,Rn))return null;W?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rn,depth:u+1});let tr=b.analyzeNested(Rn,{effectiveCwd:kt,envAssignments:ze});if(tr&&!th(tr,Rn))return tr;if(Oi(Rn,void 0,!b.strict)){let cr=Gt(st("interpreter.dangerous-command",Lo),b.policy);if(cr)return W?.recordSegment({type:"dangerous-text",token:Rn,matched:!0,reason:Lo}),wn(cr)}W=void 0}}if(at==="busybox"&&We.length>1)return Qg(Be.wrapperNormalizationBudget),W?.recordSegment({type:"busybox",subcommand:We[1]??"unknown"}),W?.recordSegment({type:"recurse",reason:"busybox",innerCommand:We.slice(1).join(" "),depth:u+1}),qo(Le.slice(1),u,{...Be,effectiveCwd:kt,envAssignments:ze});let Qt=Q?void 0:[["analyzer/device.ts:analyzeDeviceCommandMatch",ef(at,We)],["analyzer/network.ts:analyzeNetworkCommandMatch",Ug(at,We)],["analyzer/namespace.ts:analyzeNamespaceCommandMatch",Gg(at,We)]].map(([Et,$t])=>({rule:Et,match:Gt($t,b.policy)})).find((Et)=>Et.match);if(Qt?.match)return W?.recordSegment({type:"rule-check",rule:Qt.rule,matched:!0,reason:Qt.match.reason}),wn(Qt.match);let on=W===Be.trace?Be:{...Be,trace:W},mn={words:Le,parsedWords:Me.words,head:at,cwd:Rt,originalCwd:Tt,envAssignments:ze,allowTmpdirVar:Vt,dynamicArguments:Me.words.some((Et)=>Et.provenance==="command-substitution"),depth:u,effectiveCwd:kt,options:on,analyzeChildTokens:(Et,$t)=>ee&&Q?rd(Et,u,on,{...Q,cwd:$t??void 0,effectiveCwd:$t??void 0}):Nr(qo(tn(Et),u+1,{...on,child:void 0,commandView:void 0,effectiveCwd:$t,envAssignments:ze}))??F(Et,on.policy.rules),analyzeChild:(Et,$t)=>rd(Et,u,on,$t)},vn=Q&&(at==="xargs"||at==="parallel")?void 0:eh(at);if(at==="rm"||at==="xargs"||at==="parallel")W?.recordSegment({type:"tmpdir-check",tmpdirValue:ze.has("TMPDIR")||b.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Vt});let sn=W&&at==="git"?Up(mn.words,td(mn)):void 0,fn=Jg(sn?sn.match:vn?.(mn)??null,b.policy);if(W)UP(mn,fn,sn?.relaxation??null);if(fn)return wn(fn);if(ee&&Q&&(at==="rm"||at==="rmdir")){if(!(at==="rm"&&(Sr(We)||Q.dynamicRmInput)))return null;return(Q.dynamicRmInput?Ko(Q,b.policy):null)??FP(Q,b.policy)}let fo=vn!==void 0&&!jP.has(at),Wr=!Q&&!fo&&!ls.has(at),Rr=W&&Wr?[]:void 0;if(Wr)for(let Et=1;Et<We.length;Et++){let $t=We[Et];if(!$t)continue;Rr?.push($t);let Xt=Jg(LP(We,Et,u,on,Rt,Tt,kt,ze),b.policy);if(Xt)return W?.recordSegment({type:"fallback-scan",tokensScanned:Rr??[],embeddedCommandFound:Bt($t)}),wn(Xt)}if(W?.recordSegment({type:"fallback-scan",tokensScanned:Rr??[]}),le&&Q&&!Q.wrappedByTransparent)return null;let po=F(We,b.policy.rules);if(W?.recordSegment({type:"custom-rules-check",rulesChecked:b.policy.rules.length>0,matched:!!po,reason:po?.reason}),po)return wn(po);return ee&&Q?Ko(Q,b.policy):null}function rd(n,u,b,W){return Nr(qo(tn(n),u+1,{...b,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:W.originalCwd,effectiveCwd:W.effectiveCwd,envAssignments:W.envAssignments,worktreeMode:W.dynamicInput?!1:W.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:W}))}function LP(n,u,b,W,z,B,Q,ee){for(let le of Xn(n.slice(u),{environment:W.environment,cwd:z,envAssignments:ee,policy:W.policy})){let ue=le.tokens[0];if(!ue)continue;let ve=Bt(ue);if(oh(ue,ve)||eh(ve)!==void 0&&ve!=="xargs"&&ve!=="parallel"||le.wrappedByTransparent&&W.policy.rules.length>0)W.budget.charge("derivedTokens",n.length-u);let De=rd(le.tokens,b,W,{embedded:!0,cwd:le.cwd,originalCwd:le.wrapperCwd===null?void 0:B,effectiveCwd:le.wrapperCwd===void 0?Q:le.wrapperCwd,envAssignments:le.envAssignments,allowTmpdirVar:!wi(le.envAssignments,W.environment),worktreeMode:!1,wrappedByTransparent:le.wrappedByTransparent});if(De)return De}return null}function WP(n,u,b,W,z,B){if(!u)return Ko(B,z.policy);if(un(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters)){let ee=Gt(st("interpreter.one-liner-paranoid",ki),z.policy);if(ee)return wn(ee)}if(hc(n,u))return Ko(B,z.policy);let Q=z.analyzeNested(u,{effectiveCwd:b,envAssignments:W});if(Q&&!th(Q,u))return Q;if(Oi(u,void 0,!z.strict)){let ee=Gt(st("interpreter.dangerous-command",Lo),z.policy);if(ee)return wn(ee)}return Ko(B,z.policy)}function th(n,u){let b=n.ruleId==="raw-text.dangerous-command",W=(n.reason.startsWith(Ks)||n.reason===ir)&&!ds(u);return b||W}function Vo(n,u){let b=n.shellDynamicMatch?Gt(n.shellDynamicMatch,u):null;return b?wn(b):null}function Ko(n,u){let b=n.dynamicSourceInput&&n.dynamicSourceMatch?Gt(n.dynamicSourceMatch,u):null;return b?wn(b):null}function FP(n,u){let b=n.dynamicInput&&n.rmDynamicMatch?Gt(n.rmDynamicMatch,u):null;return b?wn(b):null}function GP(n,u,b,W,z,B){let Q=Sp(n);if(Q.argvSource?.kind==="absent")return En(z);if(Q.argvSourceApplies&&Q.argvSource){let le=ji(Q.argvSource.value,b,u,W,z,B,!0);if(le)return le}if(!Q.envSourceApplies||!Q.envName)return null;let ee=u.get(Q.envName);if(!ee)return null;return ji(ee,b,u,W,z,B,!0)}function Xg(n,u,b){let W=u.environment.home,z=$o(n,W);if(z!==null)return z;if(n.provenance==="literal")return n.text;return u.strict?null:Jn(n,zo(u.shellAssignments??new Map,{home:W,cwd:b}))}var nh=/^#!\s*(?:\S*\/)?(?:env\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh(?:\s|$)/;function ji(n,u,b,W,z,B,Q=!1,ee=!1){if(Q&&/[$`*?[\]]/.test(n))return En(z);let le=Ar(n,u,W.environment.paths,W.budget),ue=le?W.literalHeredocFiles?.get(le):void 0;if(ue===void 0&&(Q||le&&W.downloadedPaths?.has(le)))return En(z);if(ue===void 0)return le?zP(n,le,u,b,W,z,ee):null;if(ee&&ue.startsWith("#!")&&!nh.test(ue))return null;if(W.budget.charge("derivedTokens",1),z?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:ue,depth:B+1}),!ee)return W.analyzeNested(ue,{effectiveCwd:u,envAssignments:b});let ve=rh(()=>W.analyzeNested(ue,{effectiveCwd:u,envAssignments:b}));return ve?.intent==="stop_and_explain"?null:ve}var od=/^(?:analysis|raw-text)\.|^(?!custom\.).*dynamic|^interpreter\.one-liner-paranoid$/;function zP(n,u,b,W,z,B,Q){if([...z.writtenPaths??[]].some((Ne)=>u===Ne||u.startsWith(`${Ne}${NP}`)))return null;let le=z.scriptReads??{},ue=le.budget??=xn(),ve=(Ne)=>rh(()=>{if(Ne)$P(ue);ue.charge("scriptFiles");let Le=of(u);if(Le===null)return null;if(Q&&Le.text.startsWith("#!")&&!nh.test(Le.text))return null;if(!Ne)B?.recordSegment({type:"script-file",path:n,bytes:Le.bytes});let We=z.analyzeNested(Le.text,{effectiveCwd:b,envAssignments:W,scriptBudget:ue,withoutUncertainCapabilities:Ne,untraced:!0});if(!We||We.scriptLocation)return We;let Be=We.sourceOffset===void 0?"":`:${Le.text.slice(0,We.sourceOffset).split(`
+`).length}`;return{...We,scriptLocation:`${n}${Be}`}}),Oe=(Ne)=>Ne&&!od.test(Ne.ruleId)?Ne:null,De=ve(),Me=z.strict||z.paranoidInterpreters;return Oe(De)??(Me&&De?Oe(ve(!0)):null)}function $P(n){let u=n.counters.get("scriptFiles");if(n.counters.clear(),u!==void 0)n.counters.set("scriptFiles",u)}function rh(n){try{return n()}catch(u){if(u instanceof a)return null;throw u}}function BP(n){let u=n[0];return n.length>=2&&(u==='"'||u==="'")&&n.at(-1)===u?n.slice(1,-1):n}function UP(n,u,b){let W={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",cmd:"analyzer/cmd.ts:analyzeCmdMatch",powershell:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",pwsh:"analyzer/powershell-wrapper.ts:analyzePowerShellWrapperMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[n.head];if(!W)return;if(n.options.trace?.recordSegment({type:"rule-check",rule:W,matched:!!u||!!b,reason:u?.reason??b?.originalReason}),b)n.options.trace?.recordSegment({type:b.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:b.originalReason,gitCwd:b.gitCwd})}function Qg(n){if(n.iterations>=l.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");n.iterations++}function wn(n){return{reason:n.reason,ruleId:n.id,intent:n.intent}}function En(n){return n?.recordSegment({type:"error",message:Qr}),wn(sr())}function oh(n,u){return nn.has(u)||n==="$SHELL"||n==="${SHELL}"||nn.has(Wt(u))}function Jg(n,u){return n?.id.startsWith("custom.")||n?.id==="raw-text.dangerous-command"?n:Gt(n,u)}var HP=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,jP=new Set(["powershell","pwsh"]),VP=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function qP(n,u){let b=ah(n,u);if(b.length===0)return!1;let W=b[sh(b)];if(W==="cd"||W==="pushd"||W==="popd")return!0;return HP.test(n.join(" "))}function ih(n,u,b,W,z){if(n.dialect==="powershell"){let it=KP(n.words,z);if(it.kind==="none")return;if(!u||it.kind==="unknown")return null;return nd(QP(it.target),u,b.paths)}let B=n.words.map(t),Q=B.some((it)=>/^CDPATH\+?=/.test(it));if(!qP(B,b))return Q?null:void 0;if(!u)return null;let ee=ah(B,b,u),le=sh(ee);if(le===-1||ee[le]!=="cd")return null;let ue=ee.slice(le+1),ve=ue.findIndex((it)=>it.length<=1||!it.startsWith("-")||it==="--");if((ve===-1?ue:ue.slice(0,ve)).some((it)=>!/^-[LP]+$/.test(it)))return null;let De=ve===-1?[]:ue.slice(ve),Me=De[0]==="--"?De.slice(1):De;if(Me.length>1)return null;let Ne=Me[0],Le=W.get("HOME")||b.home;if(Ne===void 0)return nd(Cn(Le),u,b.paths);let We=n.words.find((it)=>it.provenance==="variable"&&it.text===Ne),Be=n.words.find((it)=>it.text===Ne&&/^~(?:\/|$)/.test(it.raw)),ze=We?Jn(We,new Map([...W,["HOME",Le]])):Be?`${Le}${Ne.slice(1)}`:Ne;if(ze===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(ze)&&(Q||b.env.has("CDPATH")))return null;return nd(Cn(ze),u,b.paths)}function nd(n,u,b){if(!n||n==="-"||n.startsWith("~")||n.includes("$")||n.includes("`"))return null;try{let W=Tr(u,n,b);return b.isDirectory(W)?W:null}catch{return null}}function KP(n,u){let b=YP(n[0])?1:0,W=n[b];if(!ZP(W,b===1))return{kind:"none"};let z=W.text.toLowerCase(),B=z.split(/[\\/]/).pop()??z;if(!VP.has(B))return{kind:"none"};if(z!==B||B==="pop-location"||B==="popd")return{kind:"unknown"};return XP(n.slice(b+1),u)}function YP(n){return n?.provenance==="literal"&&!n.quoted&&n.raw===n.text&&(n.text==="&"||n.text===".")}function ZP(n,u){return n?.provenance==="literal"&&(u||!n.quoted&&n.raw===n.text)}function XP(n,u){let b;for(let W of n){if(W.provenance!=="literal"||b!==void 0)return{kind:"unknown"};b=W.text}if(b!==void 0)return{kind:"target",target:b};return u===void 0?{kind:"unknown"}:{kind:"target",target:u}}function QP(n){return n.includes("::")?void 0:n.replaceAll("\\","/")}function sh(n){let u=0;if(n[0]==="builtin"&&n.length>1)u=1;if(n[u]!=="time")return u;let b=u+1;while(n[b]?.startsWith("-"))b++;return b}function ah(n,u,b){let W=JP(n);return or([...W],u,b)}function JP(n){let u=0;while(u<n.length){let b=n[u];if(b!=="{"&&b!=="("&&b!=="$(")break;u++}return n.slice(u)}var iT="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",ao="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function sT(n){let u=_e({...n,effectiveCapabilities:{...n.effectiveCapabilities,fail_closed:{...n.effectiveCapabilities.fail_closed,enabled:!1},paranoid_interpreters:{...n.effectiveCapabilities.paranoid_interpreters,enabled:!1}}}),b=Object.fromEntries(Object.entries(u.policy.effectiveDestructiveCommandRules).map(([W,z])=>[W,od.test(W)?z:n.policy.effectiveDestructiveCommandRules[W]??z]));return{...u,policy:Object.freeze({...u.policy,effectiveDestructiveCommandRules:Object.freeze(b)})}}function ud(n,u,b,W){if(u>=l.recursionDepth.cap)return b.trace?.recordSegment({type:"error",message:nr}),{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};let z=W??b.factStore?.getCommandProgram(n,b.shell??"auto")??C(n,b.shell);if(z.status==="limited")return b.trace?.recordSegment({type:"error",message:nr}),{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"};if(z.status==="invalid"){let ve=z.issues.find((Oe)=>Oe.code.includes("heredoc"));if(ve){if(!b.strict)return dd(n,b);let Oe=`${Ks}: ${ve.message}`;return b.trace?.recordGlobal({type:"error",message:Oe}),{reason:Oe,segment:n,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"}}return gh(n,b),{reason:ir,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"}}if(b.strict&&z.status==="partial")return gh(n,b),{reason:ir,segment:n,ruleId:"analysis.strict-unparseable",intent:"stop_and_explain"};if(z.issues.some((ve)=>ve.code.includes("quote")))return dd(n,b);let Q=b.cwd,ee=b.effectiveCwd!==void 0?b.effectiveCwd:b.cwd,le=kp(b.environment.env,b.envAssignments),ue={...b,rootProgram:z,writtenPaths:b.writtenPaths??new Set,downloadedPaths:b.downloadedPaths??new Set,scriptReads:b.scriptReads??{}};return Ia(z,u,ue,Q,[{effectiveCwd:ee,shellGitContextState:le,literalHeredocFiles:new Map(b.literalHeredocFiles),functionDefinitions:new Map(b.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function Ia(n,u,b,W,z){let B=[...z],Q,ee,le,ue=!1;for(let[ve,Oe]of n.nodes.entries()){if(Oe.kind==="connector"){ee=Oe.operator;continue}let De=Er(ee)&&ue;ue=De||Oe.kind==="command"&&(ba(Oe,b.environment)||Oe.dialect==="powershell"&&Sh(Oe.words));let Me=n.nodes[ve+1],Ne=Me?.kind==="connector"?Me.operator:void 0,Le=aT(n,ve,Oe,ee,Ne),Be=ee==="&&"||ee==="||"?Q:void 0,ze=ee==="&&"?Be?.success??B:ee==="||"?Be?.failure??B:B,it=ee==="||"?Be?.success??[]:[],at=ee==="&&"?Be?.failure??[]:[],Rt={connector:ee,skippedSuccessStates:it,skippedFailureStates:at};if(Er(Ne)&&!Er(ee))le=Rt;let Tt=Er(Ne)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:Er(ee)?le??Rt:Rt,kt=lo(Tt.connector)||lo(Ne);if(Oe.kind==="function"){let on=ze.flatMap((vn)=>{let sn=co(vn);return sn.functionDefinitions.set(Oe.name,Oe.body),id(vn,[sn],Le,Ne==="&",lo(Ne))}),mn=sd(on,[],Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=mn.states,Q=mn.conditionalStates,ee=void 0;continue}if(Oe.kind==="group"){let on=[],mn=[];for(let sn of ze){let fn=Ia(Oe.body,u,b,W,[co(sn)]);if(fn.result)return fn;if(on.push(...id(sn,fn.states,Le,Ne==="&",lo(Ne))),kt)mn.push(sn,...Le?fn.states.map((fo)=>Pa(sn,fo)):fn.states)}let vn=sd(on,mn,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=vn.states,Q=vn.conditionalStates,ee=void 0;continue}if(Oe.kind!=="command")continue;let lt=GT(n.nodes[ve-1]),Vt=b.trace?.flattenNested?b.trace.currentSegmentIndex:b.trace?.allocateSegment(),Ut=n.nodes[ve-2],an=Er(ee)&&Ut?.kind==="command"?Ut:void 0,Sn=an?Xp(an)??cT(an):void 0,ut=[],zt=[];for(let on of ze){let mn=dT(Oe,u,b,W,[co(on)]);if(mn.result)return{result:mn.result,states:B};let vn=n.dialect==="powershell"?mn.states:mn.states.map((sn)=>Pa(on,sn));for(let sn of vn){let fn=co(sn),fo=pT(Oe,u,b.trace?{...b,trace:yh(b.trace,Vt)}:b,W,fn,Er(ee),Sn,De);if(fo)return{result:{...fo,sourceOffset:Oe.span.start},states:B};let Wr=VT(Oe,fn.functionDefinitions);if(Wr)b.budget.charge("derivedTokens",ka(Wr));let Rr=Wr?u+1>=l.recursionDepth.cap?ld(Oe.displayText,b,[fn]):Ia(Wr,u+1,b,W,[fn]):{result:null,states:HT(Oe,fn).flatMap((Et)=>zT(Oe,sn,Et,lt))};if(Rr.result)return Rr;ut.push(...id(on,Rr.states,Le,Ne==="&",lo(Ne)));let po=typeof fn.effectiveCwd==="string"&&fn.effectiveCwd!==sn.effectiveCwd&&Oe.redirections.every((Et)=>["<",">",">>",">|"].includes(Et.operator)&&Et.target?.text==="/dev/null");if(kt&&(lt||!po))zt.push(on),zt.push(...Rr.states.map((Et)=>Le?Pa(on,Et):Et))}}let Qt=sd(ut,zt,Tt.skippedSuccessStates,Tt.skippedFailureStates,Tt.connector,Ne);B=Qt.states,Q=Qt.conditionalStates,ee=void 0}return{result:null,states:B}}function aT(n,u,b,W,z){if(b.kind==="group"&&b.style==="subshell")return!0;if(n.dialect==="posix"&&(Er(W)||Er(z)))return!0;if(z==="&")return!0;return n.dialect==="powershell"&&b.kind==="group"&&b.style==="brace"&&lT(n,u)}function id(n,u,b,W,z){let B=b?u.map((ee)=>Pa(n,ee)):[...u],Q=z?B.flatMap((ee)=>Yo(n.literalHeredocFiles,ee.literalHeredocFiles)?[ee]:[{...ee,literalHeredocFiles:new Map(n.literalHeredocFiles)},ee]):B;return W?[n,...Q]:Q}function Pa(n,u){return{...n,literalHeredocFiles:new Map(u.literalHeredocFiles),createdDirectories:new Set(u.createdDirectories)}}function lT(n,u){let b=n.nodes.slice(0,u).reverse().find((z)=>z.kind==="command"||z.kind==="connector");if(!b||b.kind!=="command")return!0;let W=b.words[0]?.text.toLowerCase();if(W==="&"||W===".")return!1;if(W==="write-output"||W==="function"||W==="start-job")return!0;if(uT(b))return!0;return b.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Er(n){return n==="|"||n==="|&"}function cT(n){if(n?.dialect!=="powershell")return;if(n.words.length===1&&n.words[0]?.quoted&&n.words[0].provenance==="literal")return n.words[0].text;if(n.words[0]?.text.toLowerCase()==="write-output"&&n.words.length===2&&n.words[1]?.provenance==="literal")return n.words[1].text;return}function lo(n){return n==="&&"||n==="||"}function sd(n,u,b,W,z,B){let Q={success:Ta([...b,...n]),failure:Ta([...W,...u])},ee=lo(B)?Q:void 0;return{states:lo(z)||ee?Ta([...Q.success,...Q.failure]):Q.success,conditionalStates:ee}}function yh(n,u,b=n.flattenNested){return{currentSegmentIndex:u,flattenNested:b,allocateSegment:n.allocateSegment,getNextSegmentIndex:n.getNextSegmentIndex,branch:n.branch,recordGlobal:n.recordGlobal,recordSegment:(W,z=u)=>n.recordSegment(W,z)}}function dT(n,u,b,W,z){let B=n.nested.map((Q)=>({program:Q,depth:u}));if(n.dialect==="powershell"){let Q=mT(n);if(Q){if(u+1>=l.recursionDepth.cap)return ld(Q,b,z);let ee=C(Q,"powershell");if(ee.status==="limited")return ld(Q,b,z);if(ee.status!=="complete")return lh(B,b,W,z);b.budget.charge("derivedTokens",ka(ee)),B.push({program:ee,depth:u+1})}}return lh(B,b,W,z)}function uT(n){let u=n.words[0];return u?.provenance==="variable"&&n.words.at(-1)?.text==="="?u.text.toLowerCase():void 0}function lh(n,u,b,W){let z=[...W];for(let B of n){let Q=[];for(let ee of z){let le=Ia(B.program,B.depth,u,b,[co(ee)]);if(le.result)return le;Q.push(...le.states)}z=Ta(Q)}return{result:null,states:z}}function mT(n){let u=Ch(n),b=u?.[0];return u?.length===1&&b?.quoted&&b.provenance==="literal"?b.text:void 0}function fT(n,u,b){let W=Ch(n);if(!W)return!1;return u||W.some((z)=>zi(z,n.nested,b))||Sh(W)}function Sh(n){return n.some((u)=>/\.Download(?:String|Data)\(/i.test(u.raw)||!u.quoted&&ya(/^(?:\$?\(|[&.\s])*([^\s()]*)/.exec(u.raw)?.[1]??"","powershell"))}function Ch(n){let u=n.words[0]?.provenance==="literal"&&!n.words[0].quoted&&n.words[0].raw===n.words[0].text&&(n.words[0].text==="&"||n.words[0].text==="."),b=u?1:0,W=n.words[b];if(W?.provenance!=="literal"||!u&&(W.quoted||W.raw!==W.text)||!["iex","invoke-expression"].includes(W.text.toLowerCase()))return;let z=n.words.slice(b+1);return z[0]&&!z[0].quoted&&z[0].raw===z[0].text&&["-c","-command"].includes(z[0].text.toLowerCase())?z.slice(1):z}function ka(n){return n.nodes.reduce((u,b)=>u+(b.kind==="command"?b.words.length+b.nested.reduce((W,z)=>W+ka(z),0):b.kind==="group"||b.kind==="function"?ka(b.body):0),0)}function ld(n,u,b){return u.trace?.recordSegment({type:"error",message:nr}),{result:{reason:nr,segment:n,ruleId:"analysis.recursion-limit",intent:"stop_and_explain"},states:[...b]}}function pT(n,u,b,W,z,B,Q,ee){let le={...b,environment:{...b.environment,env:z.shellGitContextState.env,paths:AT(b.environment.paths,z.createdDirectories,b.budget)}},ue=MT(n,!le.strict);if(ue&&le.strict)return le.trace?.recordSegment({type:"error",message:ue}),{reason:ue,segment:n.source,ruleId:"analysis.unsupported-heredoc",intent:"stop_and_explain"};vT(n,z,le),wT(n,z,le),bh(n,z,"before-consumer",le.environment.paths,le.budget);let ve=ce(n.dialect,n.words),Oe=ve.map(t),De=n.displayText,Me=Tp(ve,z.shellGitContextState,{home:le.environment.home,cwd:z.effectiveCwd,darwinUserTempDir:le.environment.darwinUserTempDir}),Ne=Mp(Me,z.shellGitContextState);if(n.dialect==="powershell"){let ze=Gt(np(n,B,qT(le,z.effectiveCwd)),le.policy);if(le.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ze,reason:ze?.reason}),ze)return ad(De,ze);if(fT(n,ee,le.environment))return le.trace?.recordSegment({type:"error",message:Qr}),ad(De,sr())}let Le=Gt(tf(n.redirections),le.policy);if(Le)return le.trace?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceRedirectionMatch",matched:!0,reason:Le.reason}),ad(De,Le);if(Oe.length===1&&Oe[0]?.includes(" ")&&!gi(n.dialect,n.words)){let ze=Gt(Un(Oe[0]),le.policy),it=ze!==null&&!le.strict&&Zm(n,le.rootProgram);if(ze&&!it)return le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!0,reason:ze.reason}),{reason:ze.reason,segment:De,ruleId:ze.id,intent:ze.intent};le.trace?.recordSegment({type:"dangerous-text",token:Oe[0],matched:!1});let at=ch(n,ue,z,Ne,Q,le);if(at)return at;return Nc(Me,z.shellGitContextState),null}let We=qo(n.words,u,{...le,commandView:n,cwd:W,effectiveCwd:z.effectiveCwd,envAssignments:Ne,shellAssignments:z.shellGitContextState.shellAssignments,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:z.functionDefinitions,hasPipelineInput:B,literalShellInput:Q,remotePipelineInput:ee,analyzeNested:(ze,it)=>{let at=it&&Object.hasOwn(it,"effectiveCwd")?it.effectiveCwd:z.effectiveCwd,Rt=ud(ze,u+1,{...le,...it?.withoutUncertainCapabilities?sT(le):{},budget:it?.scriptBudget??le.budget,effectiveCwd:at,envAssignments:it?.envAssignments??Ne,literalHeredocFiles:z.literalHeredocFiles,functionDefinitions:it?.functionDefinitions,worktreeMode:it?.worktreeMode??le.worktreeMode,shell:it?.shell??le.shell,trace:le.trace&&!it?.untraced?yh(le.trace,le.trace.currentSegmentIndex,!0):void 0});return Rt?{reason:Rt.reason,ruleId:Rt.ruleId,intent:Rt.intent,sourceOffset:Rt.sourceOffset,scriptLocation:Rt.scriptLocation}:null}});if(We)return{...We,segment:De};let Be=ch(n,ue,z,Ne,Q,le);if(Be)return Be;return Nc(Me,z.shellGitContextState),null}function ch(n,u,b,W,z,B){let Q=DT(n,u,b,W??new Map,B);if(Q)return Q;if(bh(n,b,"after-consumer",B.environment.paths,B.budget),!yT(n))b.literalHeredocFiles.clear();return _T(n,u,b,B.environment.paths,B.budget,B.environment.home),PT(n,b,B.environment.paths,B.budget,B.environment.home),WT(n,b,z,B.environment,B.trace),null}var gT=new Set([">>","<>"]),hT=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function yT(n){return n.nested.length===0&&n.redirections.length===0&&n.words.length>0&&n.words.every((u)=>hT.test(u.raw))}var ST=new Set(["cp","mv","install","ln","sed","curl","wget","tee"]),CT=new Set(["cp","mv","install","ln"]),bT=/^-[^-]*i|^--in-place/,dh=/^(?:-t|--target-directory=?)(.*)$/;function ET(n){let u=n.findIndex((Oe)=>ST.has(Wt(Oe.text))),b=Wt(n[u]?.text??""),W=n.slice(u+1).filter((Oe)=>Oe.provenance==="literal").map((Oe)=>Oe.text);if(u===-1)return[];if(b==="sed")return W.some((Oe)=>bT.test(Oe))?W:[];if(!CT.has(b))return W;let z=W.findIndex((Oe)=>dh.test(Oe)),B=W[z]?.match(dh)?.[1],Q=z!==-1&&!B,ee=Q?W[z+1]:B,le=W.filter((Oe,De)=>!Oe.startsWith("-")&&!(Q&&De===z+1)),ue=ee??le.at(-1);if(ue===void 0)return[];return[...ee===void 0?le.slice(1):[ee],...le.map((Oe)=>hh(ue,Wt(Oe)))]}function vT(n,u,b){let W=b.writtenPaths;if(!W)return;let B=[...n.redirections.flatMap((Q)=>Q.operator.includes(">")&&Q.target?[Q.target]:[]).filter((Q)=>Q.provenance==="literal").map((Q)=>Q.text),...ET(n.words)].flatMap((Q)=>[Q,Q.slice(Q.indexOf("=")+1),Wt(Q.split(/[?#]/)[0]??"")]);for(let Q of new Set(B.filter(Boolean))){let ee=Ar(Q,u.effectiveCwd,b.environment.paths,b.budget);if(ee)W.add(ee)}}var uh=new Map([["curl",/^(?:-[^-o]*o|--output(?:=|$))(.*)/],["wget",/^(?:-[^-O]*O|--output-document(?:=|$))(.*)/]]);function RT(n){let u=n.findIndex((W)=>uh.has(Wt(W.text))),b=uh.get(Wt(n[u]?.text??""));return n.slice(u+1).flatMap((W,z,B)=>{let Q=W.provenance==="literal"?b?.exec(W.text)?.[1]:void 0,ee=B[z+1];if(Q)return[Q];return Q===""&&ee?.provenance==="literal"?[ee.text]:[]})}function wT(n,u,b){let W=ba(n,b.environment),z=[...n.redirections.filter(Eh).flatMap((B)=>B.target?.provenance==="literal"?[B.target.text]:[]),...W?RT(n.words):[]];for(let B of z.filter((Q)=>Q!=="-")){let Q=Ar(B,u.effectiveCwd,b.environment.paths,b.budget);if(Q&&W)b.downloadedPaths?.add(Q);if(Q&&!W)b.downloadedPaths?.delete(Q)}}function bh(n,u,b,W,z){for(let Q of n.redirections){if(!(b==="before-consumer"?Eh(Q):gT.has(Q.operator)))continue;mh(Q.target,u,W,z)}if(b!=="before-consumer"||!yn(n.words[0],"tee"))return;let B=Rh(n.words.slice(1));if(!B)return;for(let Q of B.operands)mh(Q,u,W,z)}function Eh(n){if(n.operator===">"||n.operator===">|")return!0;return n.operator===">&"&&n.fd===void 0&&n.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(n.target.text)}function mh(n,u,b,W){let z=n?.provenance==="literal"?Ar(n.text,u.effectiveCwd,b,W):void 0;if(!z)return;u.literalHeredocFiles.delete(z)}function _T(n,u,b,W,z,B){if(u)return;let Q=n.redirections.find((ee)=>ee.operator==="<<"||ee.operator==="<<-")?.heredoc;if(!Q)return;for(let ee of xT(n,zo(b.shellGitContextState.shellAssignments,{home:B,cwd:b.effectiveCwd}),B)){let le=Ar(ee,b.effectiveCwd,W,z);if(!le||!Ql(le))continue;if(!b.literalHeredocFiles.has(le)&&b.literalHeredocFiles.size>=l.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");b.literalHeredocFiles.set(le,Q.body)}}function xT(n,u,b){let W=cd(kT(n.redirections)?.target,u,b),z=W===void 0?[]:[W];if(yn(n.words[0],"cat"))return IT(n.words)?z:[];if(!yn(n.words[0],"tee"))return[];let B=Rh(n.words.slice(1),u);if(!B||B.append||B.hasUnsupportedOptions)return[];let Q=B.operands.map((ee)=>cd(ee,u,b));if(!Q.every((ee)=>ee!==void 0))return[];return[...Q,...z]}function cd(n,u,b){if(OT(n))return n.text;if(!n)return;return $o(n,b)??Jn(n,u)??void 0}function AT(n,u,b){if(u.size===0)return n;let W=(z)=>{let B=jt(z,n,b);return[...u].some((Q)=>Q===B||Q.startsWith(`${B}${oT}`))};return{realpath:(z)=>n.realpath(z)??(W(z)?jt(z,n,b):null),entryKind:(z)=>{let B=n.entryKind(z);return B==="missing"&&W(z)?"present":B},isDirectory:(z)=>n.isDirectory(z)||W(z)}}function PT(n,u,b,W,z){if(u.shellGitContextState.bodyDepth>0||!yn(n.words[0],"mkdir"))return;let B=n.words.slice(1).map((ve)=>cd(ve,u.shellGitContextState.shellAssignments,z));if(!B.every((ve)=>ve!==void 0))return;let Q=B.findIndex((ve)=>ve==="--"||ve==="-"||!ve.startsWith("-")),ee=B.slice(0,Q);if(Q===-1||!ee.every((ve)=>/^(?:-[pv]+|--parents|--verbose)$/.test(ve)))return;let le=ee.some((ve)=>ve==="--parents"||/^-v*p/.test(ve)),ue=u.effectiveCwd;for(let ve of B.slice(B[Q]==="--"?Q+1:Q)){if(ve.split(/[\\/]/).includes("..")||!tT(ve)&&!ue)continue;let Oe=jt(rT(ue??"",ve),b,W);if(le?TT(Oe,b):b.isDirectory(eT(Oe))&&vh(Oe,b))u.createdDirectories.add(Oe)}}function TT(n,u){let b=nT(n).root,W=n.slice(b.length).split(/[\\/]+/).filter(Boolean),z=(Q)=>hh(b,...W.slice(0,Q+1)),B=W.findIndex((Q,ee)=>!u.isDirectory(z(ee)));return B===-1||vh(z(B),u)}function vh(n,u){try{return u.entryKind(n)==="missing"}catch{return!1}}function IT(n){let u=!1;for(let b of n.slice(1)){if(u||b.provenance!=="literal")return!1;if(b.text==="--"){u=!0;continue}if(!/^-u+$/.test(b.text))return!1}return!0}function kT(n){let u=n.findLast((b)=>(b.fd??([">",">|",">>",">&"].includes(b.operator)?1:0))===1);return u?.operator===">"||u?.operator===">|"?u:void 0}function Rh(n,u=new Map){let b=[],W=!0,z=!1,B=!1;for(let Q of n){if(Q.provenance!=="literal"&&Jn(Q,u)===null)return;if(W&&yn(Q,"--")){W=!1;continue}if(W&&!Q.quoted&&Q.raw===Q.text&&/^-[^-]/.test(Q.text)){z||=Q.text.slice(1).includes("a"),B||=Array.from(Q.text.slice(1)).some((ee)=>ee!=="a"&&ee!=="i");continue}if(W&&!Q.quoted&&Q.raw===Q.text&&Q.text.startsWith("--")){z||=Q.text==="--append",B||=Q.text!=="--append"&&Q.text!=="--ignore-interrupts";continue}b.push(Q)}return{operands:b,append:z,hasUnsupportedOptions:B}}function OT(n){if(!n||n.provenance!=="literal"||n.text.length===0)return!1;if(n.quoted||n.raw!==n.text)return!0;return!n.raw.startsWith("~")&&!/[{}]/.test(n.raw)}function yn(n,u){return n?.text===u&&n.raw===u&&n.provenance==="literal"&&!n.quoted}function MT(n,u){let b=n.redirections.filter((le)=>le.operator==="<<"||le.operator==="<<-");if(b.length===0)return;if(b.length!==1)return ao;let W=b[0];if(!W?.heredoc)return ao;let z=/\$\(|`/.test(W.heredoc.body);if(!Ho(W.heredoc)&&(!u||z))return iT;if(W.fd!==void 0&&W.fd!==0)return ao;if(n.redirections.some((le)=>le!==W&&["<","<<","<<-","<<<","<&","<>"].includes(le.operator)))return ao;let B=n.redirections.some((le)=>le!==W&&fh(le.target));if(yn(n.words[0],"cat"))return B?ao:void 0;if(yn(n.words[0],"tee"))return B||n.words.slice(1).some(fh)?ao:void 0;let Q=n.words[0],ee=n.words[1];if(yn(Q,"git")&&(yn(ee,"apply")||yn(ee,"commit")))return;if(yn(Q,"gh")&&(yn(ee,"pr")||yn(ee,"issue"))&&yn(n.words[2],"create"))return;return ao}function fh(n){return n?.parts.some((u)=>u.provenance==="command-substitution"&&u.raw.startsWith(">("))??!1}function DT(n,u,b,W,z){if(!u)return null;let B=n.redirections.filter((ue)=>ue.operator==="<<"||ue.operator==="<<-"),Q=B.flatMap((ue)=>ue.heredoc?[ue.heredoc.body]:[]);if(LT(n,B,b,W,z))return null;let ee=NT(n,B,z);if(ee!==void 0)return ee?{reason:ee.reason,segment:n.displayText,ruleId:ee.id,intent:ee.intent}:null;let le=dd(Q.length===B.length?Q.join(`
+`):n.source,z);return le?{...le,segment:n.displayText}:null}function NT(n,u,b){let W=u.length===1?u[0]:void 0;if(!W?.heredoc||!Ho(W.heredoc)||W.fd!==void 0&&W.fd!==0)return;let z=yn(n.words[0],"uv")&&yn(n.words[1],"run")?n.words.slice(2):n.words,B=z[0];if(B?.provenance!=="literal"||!Ln(B.text))return;let Q=z.findIndex((Oe)=>yn(Oe,"-"));if(!z.slice(1,Q===-1?void 0:Q).every((Oe)=>Oe.provenance==="literal"&&Oe.text.startsWith("-")))return;let le=W.heredoc.body,ue=un(b.policy,"interpreter.one-liner-paranoid",!!b.paranoidInterpreters);if(b.trace?.recordSegment({type:"interpreter",interpreter:B.text,codeArg:le,paranoidBlocked:ue}),ue){let Oe=Gt(st("interpreter.one-liner-paranoid",ki),b.policy);if(Oe)return Oe}if(!Oi(le,void 0,!b.strict))return null;let ve=Gt(st("interpreter.dangerous-command",Lo),b.policy);if(!ve)return null;return b.trace?.recordSegment({type:"dangerous-text",token:le,matched:!0,reason:ve.reason}),ve}function LT(n,u,b,W,z){let B=u.length===1?u[0]:void 0;if(!B?.heredoc||!Ho(B.heredoc)||B.fd!==void 0&&B.fd!==0)return!1;let Q=gr(n.words,z.environment,b.effectiveCwd,W),ee=Q.words.map(t),le=Bt(ee[0]??"");if((Q.envSplitValues?.length??0)>0||!nn.has(le)&&!nn.has(Wt(le)))return!1;return Qn(ee)}function WT(n,u,b,W,z){let B=ih(n,u.effectiveCwd,W,u.shellGitContextState.shellAssignments,b);if(B===null)z?.recordSegment({type:"cwd-change",segment:n.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(B!==void 0)u.effectiveCwd=B}var FT=new Set(["fi","done","esac"]);function GT(n){return n?.kind==="command"&&n.words.length===1&&n.words[0]?.raw==="!"}function zT(n,u,b,W){let z=n.words[0]?.text??"",B=u.shellGitContextState.bodyDepth,Q=b.shellGitContextState.bodyDepth,ee=b.compoundBodies;if(Q>B)return b.compoundBodies=[...ee.slice(0,B),{entryCwd:u.effectiveCwd,branchCwds:ee[B]?.branchCwds??[],hasElse:!1}],[b];let le=B>0?ee[B-1]:void 0;if(le&&(z==="else"||z==="elif"))return b.compoundBodies=[...ee.slice(0,B-1),{entryCwd:le.entryCwd,branchCwds:[...le.branchCwds,b.effectiveCwd],hasElse:z==="else"}],b.effectiveCwd=le.entryCwd,[b];let ue=le!==void 0&&FT.has(z);if(ue)b.compoundBodies=ee.slice(0,Q);return[...new Set([b.effectiveCwd,...ue?le.branchCwds:[],...ue&&!le.hasElse?[le.entryCwd]:[],...W?[u.effectiveCwd]:[]])].map((Oe)=>{if(Oe===b.effectiveCwd)return b;let De=co(b);return De.effectiveCwd=Oe,De})}function $T(n,u){return n.length===u.length&&n.every((b,W)=>{let z=u[W];return z!==void 0&&b.entryCwd===z.entryCwd&&b.hasElse===z.hasElse&&b.branchCwds.length===z.branchCwds.length&&b.branchCwds.every((B,Q)=>B===z.branchCwds[Q])})}var BT=/^[A-Za-z_][A-Za-z0-9_]*$/,UT=8;function HT(n,u){let b=n.words[1]?.text;if(n.dialect!=="posix"||n.words[0]?.text!=="for"||b===void 0||!BT.test(b))return[u];let W=n.words.slice(3);if(!(n.words[2]?.text==="in"&&W.length>=1&&W.length<=UT&&W.every((B)=>B.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(B.text))))return u.shellGitContextState.shellAssignments.delete(b),[u];return W.map((B)=>{let Q=co(u);return Q.shellGitContextState.shellAssignments.set(b,B.text),Q})}function co(n){return{effectiveCwd:n.effectiveCwd,shellGitContextState:Op(n.shellGitContextState),literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set(n.createdDirectories),compoundBodies:n.compoundBodies}}function Ta(n){let u=[];for(let b of n){if(!u.some((W)=>jT(W,b)))u.push(b);if(u.length>l.controlFlowStates.cap)throw new a("controlFlowStates")}return u}function jT(n,u){return n.effectiveCwd===u.effectiveCwd&&$T(n.compoundBodies,u.compoundBodies)&&Yo(n.shellGitContextState.env,u.shellGitContextState.env)&&Yo(n.literalHeredocFiles,u.literalHeredocFiles)&&Yo(n.functionDefinitions,u.functionDefinitions)&&Yo(n.shellGitContextState.effectiveEnvAssignments,u.shellGitContextState.effectiveEnvAssignments)&&Yo(n.shellGitContextState.shellAssignments,u.shellGitContextState.shellAssignments)&&n.shellGitContextState.bodyDepth===u.shellGitContextState.bodyDepth&&ph(n.shellGitContextState.bodyAssignments,u.shellGitContextState.bodyAssignments)&&ph(n.createdDirectories,u.createdDirectories)}function ph(n,u){return n.size===u.size&&[...n].every((b)=>u.has(b))}function Yo(n,u){if(n===u)return!0;if(!n||!u||n.size!==u.size)return!1;return[...n].every(([b,W])=>u.get(b)===W&&u.has(b))}function VT(n,u){let b=hi(n);return b===void 0?void 0:u.get(b)}function ad(n,u){if(!u)return null;return{reason:u.reason,segment:n,ruleId:u.id,intent:u.intent}}function qT(n,u=n.effectiveCwd){let b=u===null;return{environment:n.environment,cwd:b?void 0:u??n.cwd,originalCwd:b?void 0:n.cwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,protectedGitMetadata:n.protectedGitMetadata,policy:n.policy,budget:n.budget}}function dd(n,u){let b=Gt(Un(n),u.policy),W=u.trace?.currentSegmentIndex??u.trace?.allocateSegment(),z={type:"dangerous-text",token:n,matched:!!b,reason:b?.reason};if(u.trace?.recordSegment(z,W),!b&&/^(?:cd|pushd)\s/.test(n))u.trace?.recordSegment({type:"cwd-change",segment:n,effectiveCwdNowUnknown:!0},W);return b?{reason:b.reason,segment:n,ruleId:b.id,intent:b.intent}:null}function gh(n,u){let b={type:"strict-unparseable",rawCommand:n,reason:ir},W=u.trace?.currentSegmentIndex;if(W===void 0)u.trace?.recordGlobal(b);if(W!==void 0)u.trace?.recordSegment(b)}var KT=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function wh(n,u,b,W){let z=ud(n,0,{...u,..._e(u),budget:u.budget??xn(),factStore:W},b);if(!z)return null;return{kind:"deny",reason:z.scriptLocation?`${z.scriptLocation}: ${z.reason}`:z.reason,intent:z.intent??"manual_only",ruleId:z.ruleId,evidence:{command:n,segment:z.segment}}}function _h(n,u,b){try{return{decision:n()}}catch(W){let z=YT(W,u,b);if(!z)throw W;return z}}function YT(n,u,b){if(!(n instanceof a)||!KT.has(n.kind))return null;let W=l[n.kind];if(b?.currentSegmentIndex!==void 0)b.recordSegment({type:"error",message:W.reason});if(b?.currentSegmentIndex===void 0)b?.recordGlobal({type:"error",message:W.reason});return{decision:{kind:"deny",reason:W.reason,ruleId:"analysis.derived-command-limit",intent:"stop_and_explain",evidence:{command:u,segment:u}},errorCode:W.errorCode}}var ZT=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),fd=new Set(["cc-safety-net","ccsn"]),XT=new Set(["bunx","npx","pnpx"]),QT=new Set(["pnpm","yarn"]),JT=new Set(["npm","pnpm","yarn"]),eI=new Set(["bun","node"]);function Ma(n,u,b={}){if(fd.has(n))return 0;if(XT.has(n)){if(b.broad)return md(u);let z=u[0]==="-y"||u[0]==="--yes"?1:0;return Oa(u[z])?z+1:null}let W=b.broad?u.findIndex((z)=>!z.startsWith("-")):0;if(W!==-1&&JT.has(n)&&b.broad&&u[W]==="exec"){let z=md(u.slice(W+1));return z===null?null:W+1+z}if(QT.has(n)){if(n==="yarn"&&!b.broad)return null;if(!b.broad)return u[0]==="dlx"&&Oa(u[1])?2:null;if(W===-1||u[W]!=="dlx")return null;let z=md(u.slice(W+1));return z===null?null:W+1+z}if(eI.has(n)){let z=b.broad&&W!==-1?W:0;if(xh(u[z]))return z+1;if(n==="bun"&&u[z]==="run"&&xh(u[z+1]))return z+2}return null}function md(n){let u=n.findIndex((W)=>Oa(W));if(u===-1)return null;let b=u;while(b<n.length){let W=n[b]??"";if(!W.startsWith("-")&&!Oa(W))break;b++}return b}function Oa(n){if(!n)return!1;let u=n.indexOf("@");if(u===-1)return fd.has(n);if(u===0)return!1;let b=n.slice(u+1);if(b===""||b.includes("/")||b.includes(":"))return!1;return fd.has(n.slice(0,u))}function xh(n){let u=n?.replaceAll("\\","/");return[...ZT].some((b)=>u===b||u?.endsWith(`/${b}`))}var rt="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Ah(n,u,b){let W=hr(n);if(!W)return null;let z=Do(W.shell,n.invocation.context.executionCwd,u,b,{findSegmentTarget:(B)=>tI(B,u),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return z?{target:z}:null}function tI(n,u){let b=or([...n],u),W=b.slice(1),z=Ma(Wt(b[0]??"").toLowerCase(),W,{broad:!0});if(z===null)return null;let B=W.slice(z).filter((Q)=>Q!=="-g"&&Q!=="--global");return B[0]==="policy"&&B[1]==="apply"?b.join(" "):null}import{dirname as Da}from"node:path";var ot="This path contains the protected policy config and you must not modify or delete it.",nI=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function kh(n,u,b){let W=lI(n.invocation.context,u,b);if(n.invocation.route.kind==="patch")return Ph(n.paths,!1,n.invocation.context.executionCwd,W,u,b);let z=hr(n);if(n.invocation.route.kind==="command")return z?Th(z.shell,n.invocation.context.executionCwd,W,u,b):null;if(n.invocation.route.kind==="unknown"&&z){let B=Th(z.shell,n.invocation.context.executionCwd,W,u,b);if(B)return B}return Ph(n.paths,n.invocation.route.kind==="grep"||n.invocation.route.kind==="glob"||fs(n.invocation.toolName),n.invocation.context.executionCwd,W,u,b)}function Ph(n,u,b,W,z,B){if(u)return null;let Q=n.find((ee)=>Vi(ee,b,W,z,B));return Q?{target:Q}:null}function Th(n,u,b,W,z){let B=Do(n,u,W,z,{findSegmentTarget:(Q,ee)=>rI(Q,ee,b,W,z)?.target??null,isRedirectionTarget:(Q,ee)=>Vi(Q,ee.cwd,b,W,z),findMalformedTarget:(Q)=>aI(Q,u,b,W,z)?.target??null});return B?{target:B}:null}function rI(n,u,b,W,z){if(Ti(n))return null;let B=Ir([...n],W),Q=Wt(B[0]??"").toLowerCase(),ee=B.slice(1);if(Q==="rm"&&oI(ee)){let le=iI(ee).find((ue)=>Ih(kn(ue,u.variables),u.cwd,b,W,z));if(le)return{target:le}}if(Q==="find"){if(da(B,1)||_c(B,W)){let ue=(Li(tn(B))??tn(["."])).find((ve)=>{let Oe=kn(ve.text,u.variables);return Vi(Oe,u.cwd,b,W,z)||Ih(Oe,u.cwd,b,W,z)})?.text;if(ue)return{target:ue}}}if(Q==="mv"){let le=Ys(ee).sources.find((ue)=>cI(kn(ue,u.variables),u.cwd,b,W,z));if(le)return{target:le}}if(sI(B,Q))return null;for(let le of[...n,...B])for(let ue of Oh(le))if(Vi(kn(ue,u.variables),u.cwd,b,W,z))return{target:ue};return null}function oI(n){return n.some((u)=>u==="--recursive"||u.startsWith("-")&&!u.startsWith("--")&&/[rR]/.test(u.slice(1)))}function iI(n){let u=n.indexOf("--");if(u!==-1)return[...n.slice(0,u).filter((b)=>!b.startsWith("-")),...n.slice(u+1)];return n.filter((b)=>!b.startsWith("-"))}function sI(n,u){if(!nI.has(u))return!1;if(u!=="sed")return!0;return!n.slice(1).some((b)=>b.startsWith("-i")||b==="--in-place"||b.startsWith("--in-place="))}function aI(n,u,b,W,z){for(let B of n.split(/\s+/))for(let Q of Oh(B))if(Vi(Q,u,b,W,z))return{target:Q};return null}function Oh(n){let u=n.trim().replace(/^['"]|['"]$/g,""),b=u.indexOf("=");return b===-1||b===u.length-1?[u]:[u,u.slice(b+1)]}function lI(n,u,b){let W=(ee)=>qi(bn(ee,n.executionCwd,u,b)),z=W(p(u)),B=[W(x(n.executionCwd)),W(x(n.configCwd))],Q=new Set(B.map((ee)=>Da(ee)));for(let ee=Da(z);;ee=Da(ee))if(Q.add(ee),Da(ee)===ee)break;return{files:new Set([z,...B]),directoriesAndAncestors:Q}}function Vi(n,u,b,W,z){let B=Nd(n,u,W,z,(Q)=>qi(Q)===ss);return B!==null&&b.files.has(qi(B))}function Ih(n,u,b,W,z){return b.directoriesAndAncestors.has(qi(bn(n,u,W,z)))}function cI(n,u,b,W,z){let B=qi(bn(n,u,W,z));return b.files.has(B)||b.directoriesAndAncestors.has(B)}function qi(n){return process.platform==="win32"?n.toLowerCase():n}import{isAbsolute as Na,posix as Vh,resolve as Fa,win32 as dI}from"node:path";import{fileURLToPath as uI}from"node:url";var qh="Access to a sensitive path is not allowed.",Kh=new Set(["echo","printf"]),mI=new Set(["find"]),fI=new Set(["!","do","elif","else","if","then","until","while"]),pI=new Set(["-exec","-execdir"]),gI=new Set([";","+"]),hI=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),yI=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Yh=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),SI=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),CI=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Sd=new Set(["-c","-e","-r","-E","--eval","--exec"]),bI=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Cd=new Set(["grep","rg"]),Zh=new Set(["files-with-matches","files-without-match","count","quiet"]),EI=new Set([...Zh,"ignore-case","fixed-strings","hidden"]),vI=new Set(["wc",...Cd]),RI=new Set(["cd","grep","head","openssl","tail","tailscale"]),wI=/^(?:-[lwcm]+|--(?:lines|words|bytes|chars))$/,_I=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),xI=new Set(["commit","merge","notes","stash","tag"]),AI=new Set(["-m","--message"]),PI=new Set(["--grep"]),TI=new Set(["powershell","pwsh"]),Mh=new Set(["jq","gojq","jaq"]),Dh="f",Nh="file",II="files",kI=new Set(["e","f"]),OI=new Set(["regexp","file"]),MI=new Set(["e","f","A","B","C","m"]),DI=new Set(["regexp","file","after-context","before-context","context","max-count"]),pd="__CC_SAFETY_NET_PIPE_INPUT__",hd=/[\w./~@+-]*[./~][\w./~@+-]*/g,NI=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,LI=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,WI=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Lh=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Wh=/\b(?:system|exec|spawn|popen)\s*$/,FI=/\b(?:eval|exec)\s*\(/g,GI=/\b(?:eval|exec)\s*$/,zI=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Fh(n,u,b,W,z,B){for(let Q of n){let ee=Q.target;if(iO(ee,Q.cwd,u?.denyPaths??[],b,W,z))return{target:ee,ruleId:"secret.deny-path"};if(B&&!B.has(ee))continue;let le=rO(ee,Q.cwd,u,W,z);if(le){let ue=B!==void 0&&!le.startsWith("secret.home.")&&!le.startsWith("secret.cli.");if(ue&&W.paths.isDirectory(cy(ee,Q.cwd,W,z)))continue;if(ue&&B?.get(ee)==="data")continue;if(ue&&(Q.isRedirectionWriteTarget===!0||B?.get(ee)==="write")&&!ee.includes("$")&&!Wa(ee,Q.cwd,W,z))continue;if(ue&&(Q.isCreatedPath===!0||Q.isCertificateInput===!0))continue;if(ue&&/\s/.test(ee)&&!ee.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(ee)&&!Wa(ee,Q.cwd,W,z))continue;if(!le.startsWith("secret.cli.")&&sO(ee,Q.cwd,u?.allowPaths??[],b,W,z))continue;return{target:ee,ruleId:le}}}return null}function Xh(n,u,b,W,z={}){let B=Gh(n,b,W),Q=Fh(B,u,n.invocation.context.configCwd,b,W);if(Q===null||Q.ruleId==="secret.deny-path"||z.strict!==!1)return Q;let ee=Gh(n,b,W,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}),le=new Map;ee.forEach((Ne)=>Qh(Ne.target).forEach((Le)=>le.set(Le,(le.get(Le)??new Set).add(Ne.loopVariable))));let ue=(Ne,Le)=>(le.get(Ne)?.size??0)>(le.get(Ne)?.has(Le)?1:0),ve=ee.filter(({loopVariable:Ne})=>Ne===void 0||ue(Ne,Ne)||ue("!",Ne)),Oe=new Set(ve.filter((Ne)=>Ne.literalRole===void 0).map((Ne)=>Ne.target)),De=new Set(ve.filter((Ne)=>Ne.literalRole==="write").map((Ne)=>Ne.target)),Me=Fh(B,u,n.invocation.context.configCwd,b,W,new Map(ve.map((Ne)=>[Ne.target,Oe.has(Ne.target)?"path":De.has(Ne.target)?"write":"data"])));return Me?.ruleId!=="secret.deny-path"&&$I(n,b)?null:Me}function $I(n,u){let b=hr(n);if(!b)return!1;if(b.program.nodes.some((Q)=>Q.kind==="command"&&Q.nested.length>0))return!1;let W=[];for(let Q of qs(b.shell)){if(Q.kind==="operator"&&Q.boundary)return!1;if(Q.kind==="redirection")return!1;if(Q.kind==="operator")continue;W.push(yr(Q.text,u))}let z=bd(W,u);if(z===null||z.length===0)return!1;let B=_n(z[0]??"").toLowerCase();if(n.invocation.route.kind==="unknown")return b.program.dialect==="powershell"&&(B==="ls"||B==="stat");return Ed(B,z.slice(1))}function Jo(n,u){return bd(n,u)??or(n,u)}function bd(n,u){let b=Zr(n,u);if(b.envSplitValues===void 0)return b.tokens;let W=Yr(b.envSplitValues,b.tokens);return W===null?null:bd(W,u)}function Ed(n,u){if(n==="ls"||n==="stat")return!0;if(n==="test")return u.length===2&&(u[0]==="-e"||u[0]==="-f");if(n==="[")return u.length===3&&(u[0]==="-e"||u[0]==="-f")&&u[2]==="]";if(n==="git")return u[0]==="check-ignore";if(n==="wc")return u.every((b)=>!b.startsWith("-")||wI.test(b));if(Cd.has(n))return BI(n,u);if(n!=="find")return!1;return!u.some((b)=>hI.has(b))}function BI(n,u){let b=u.includes("--")?u.slice(0,u.indexOf("--")):u;if(b.some((ue)=>/^--(?:(?:file|pre)(?:=|$)|json|format)/.test(ue)||/^-[^-]*f/.test(ue)))return!1;let W=n==="rg"?/[ABCEMTdegjmrt]/:/[ABCDdefm]/,z=n==="rg"?/[clq]/:/[Lclq]/,B=(ue)=>/^-[^-]/.test(ue),Q=(ue)=>{let ve=b[ue-1]??"";return/^--[^=]+$/.test(ve)&&!EI.has(ve.slice(2))||B(ve)&&ve.slice(1).search(W)===ve.length-2},ee=b.findIndex((ue,ve)=>!ue.startsWith("-")&&!Q(ve));return(n==="grep"&&ee>=0?b.slice(0,ee):b).some((ue,ve)=>{if(Q(ve))return!1;if(ue.startsWith("--"))return Zh.has(ue.slice(2));return B(ue)&&z.test(ue.slice(1).split(W)[0]??"")})}function Gh(n,u,b,W={}){let z=n.invocation.context.executionCwd,B=n.invocation.route.kind;if(B!=="command"&&B!=="unknown")return n.paths.map((ee)=>({target:ee,cwd:z}));let Q=hr(n);return[...Q?ei(Q.shell,n.store,W,u,z,b,UI(Q)):[],...B==="unknown"?n.paths.map((ee)=>({target:ee,cwd:z})):[]]}function UI(n){return n.program.dialect==="powershell"}function ei(n,u,b,W,z,B,Q=!1){if(n.status==="structural-limit")throw new E;if(n.status==="unclosed-quote")return[];if(n.status==="invalid")throw new H;let ee=[...n.assignmentFallbacks.map((We)=>({target:We,cwd:z})),...Gk(yr(n.source,W),u,b,W,z,B)],le=(We)=>yr(ek(We,Q),W),ue=/[<>=]\(/.test(n.source),ve=/\bcoproc\b|\|&/.test(n.source),Oe=[],De=[],Me=(We)=>({...b,commandHoldsPipe:b.commandHoldsPipe===!0||We||ve});Vs(n,z,W,B,{word:le,segment:(We,Be,ze,it,at,Rt)=>{if(We.length===0)return null;let Tt=Me(Rt);if(Tt.commandHoldsPipe)Oe.push(...We);if(De.push(_n(Jh(Jo(We,W))[0]??"").toLowerCase()),ee.push(...Xo(We,u,ue||it==="|"||it==="|&"?{...Tt,segmentMayFeedReader:!0}:Tt,W,Be.cwd,B,at)),ze!==null)ee.push(...VI(ze,We,u,Tt,W,Be.cwd,B));return null},redirection:(We,Be,ze)=>{if(We.body!==void 0&&We.consumer!==void 0){let it=Me(ze);ee.push(...ey(We.consumer,[We.body],u,it,W,Be.cwd,B,(at)=>qI(We.consumer??[],at,u,it,W,Be.cwd,B)))}if(We.targetOrder==="legacy-segment")return ic;return ee.push({target:le(We.target),cwd:Be.cwd,...We.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}});let Ne=new Set(Oe.flatMap(Qh)),Le=ue||/\$\(|`/.test(n.source)||!De.every((We)=>RI.has(We));return ee.map(({loopVariable:We,...Be})=>{if(Be.certificateOutputMayFeedReader===!0&&Le)return{target:Be.target,cwd:Be.cwd};return We===void 0||ue||Ne.has(We)||Ne.has("!")?Be:{...Be,loopVariable:We}})}function Qh(n){return[.../^[A-Za-z_][A-Za-z0-9_]*$/.test(n)?[n]:[],...Array.from(n.matchAll(/\$(?:\{(!)|\{?([A-Za-z_][A-Za-z0-9_]*))/g),(u)=>u[1]??u[2]??"")]}function Yi(n,u,b,W,z,B,Q=!1){let ee=u.getShellSyntax(n,Q?u.getCommandProgram(n,"powershell"):void 0);if(ee.status==="structural-limit")throw new E;return ee.status==="complete"?ei(ee,u,b,W,z,B,Q):null}function Xo(n,u,b,W,z,B,Q){let ee=(ut)=>({target:ut,cwd:z}),le=n.findIndex((ut)=>!fI.has(ut));if(b.skipMetadataOnlySegments===!0&&le>0)return Xo(n.slice(le),u,b,W,z,B,new Set([...Q??[]].map((ut)=>ut-le)));let ue=n[1]??"";if(b.skipMetadataOnlySegments===!0&&n[0]==="for"&&n[2]==="in"&&/^[A-Za-z_][A-Za-z0-9_]*$/.test(ue))return n.slice(3).flatMap((ut)=>Dn("for",ut)).map((ut)=>({...ee(ut),loopVariable:ue}));if(Q?.size){let ut=n.filter((zt,Qt)=>!Q.has(Qt));if(Mh.has(_n(Jo(ut,W)[0]??"").toLowerCase()))return[...n.filter((zt,Qt)=>Q.has(Qt)).map(ee),...Xo(ut,u,b,W,z,B)]}let ve=Zr(n,W,z),Oe=typeof ve.cwd==="string"?ve.cwd:z,De=new Set(n.filter((ut,zt)=>Q?.has(zt))),Me=(ut)=>({target:ut,cwd:De.has(ut)?z:Oe}),Ne=ve.tokens,Le=ve.envSplitValues??[],We=[...n.slice(0,n.length-Ne.length).filter((ut)=>!Kk(ut)&&In(ut)===null&&!Le.includes(ut)).flatMap((ut)=>Dn("",ut)).map(ee),...[...ve.envAssignments.values()].filter((ut)=>ut!=="").map(Me)];if(Le.length>0){let ut=Yr(Le,Ne);if(ut!==null)return[...We,...Xo(ut,u,b,W,z,B,new Set([...Q??[]].map((zt)=>zt+ut.length-n.length)))];return[...We,...Le.flatMap((zt)=>Yi(zt,u,b,W,Oe,B)??[Me(zt)]),...Ne.flatMap((zt)=>Dn("",zt)).map(Me)]}if(Ne.length===0)return We;let Be=Ne[0]??"",ze=_n(Be).toLowerCase(),it=Ne.slice(1),at=b.segmentMayFeedReader===!0||b.commandHoldsPipe===!0||b.displayOperandsAreCapturedOutput===!0,Rt=at&&vI.has(ze);if(b.skipMetadataOnlySegments===!0&&!Rt&&Ed(ze,it))return We;let Tt=jI(Be,ze,it);if(Tt)return[...We,...Tt.map(Me)];if(Kh.has(ze))return b.displayOperandsAreCapturedOutput===!0?[...We,...ty(Ne).map(Me)]:We;if(ze==="eval")return[...We,...Yi(it.join(" "),u,b,W,Oe,B)??it.map(Me)];let kt=TI.has(Bt(Be))?ed(Ne):void 0;if(kt!==void 0)B.charge("derivedTokens",Ne.length);let lt=kt===void 0?null:Yi(kt,u,b,W,Oe,B,!0);if(lt?.length)return[...We,...lt];if(ze==="export")return[...We,...it.flatMap((ut)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(ut)?[ut.slice(ut.indexOf("=")+1)]:Dn(ze,ut)).map(Me)];if(ze==="git")return[...We,...nk(it).map(Me)];if(ze==="gh")return[...We,...yd(ze,it,_I).map(Me)];if(Mh.has(ze))return[...We,...tk(it).map(Me)];if(Cd.has(ze))return[...We,...qk(it).map(Me)];if(mI.has(ze))return[...We,...ok(it,u,b,W,Oe,B).map(Me)];if(ze==="mkdir"||ze==="touch"){let ut=b.segmentMayFeedReader!==!0&&!(ze==="touch"&&it.some((zt)=>/^(?:--r|-[^-]*r)/.test(zt)));return[...We,...it.flatMap((zt)=>Dn(ze,zt).map((Qt)=>ut&&!zt.startsWith("-")&&!De.has(zt)?{...Me(Qt),isCreatedPath:!0}:Me(Qt)))]}if(Bn.has(ze))return[...We,...it.flatMap((ut)=>Dn("awk",ut)).map(Me),...it.flatMap((ut)=>sk(ut,u,b,W,Oe,B)),...it.flatMap(ak).map(Me)];if(ze==="curl")return[...We,...it.filter((ut,zt)=>ry(ut)===null&&ny(it[zt-1])===null).flatMap((ut)=>Dn(ze,ut)).map(Me),...rk(it).map(Me)];if(Oo(ze)){let ut=Pi.has(ze)?Pn([ze,...it]):null;if(ut!==null&&ut.command!==null&&ut.commandIndex!==null){let zt=u.getShellSyntax(ut.command);if(zt.status==="structural-limit")throw new E;if(zt.status==="complete")return[...We,...ei(zt,u,b,W,Oe,B),...it.slice(ut.commandIndex).filter((Qt)=>!Qt.startsWith("-")).map(Me)]}return[...We,...ik(ze,it,u,b,W,Oe,B)]}let Vt=(ut,zt)=>new RegExp(`^--?${ut}=`).test(it[zt]??"")||new RegExp(`^--?${ut}$`).test(it[zt-1]??""),Ut=HI(Ne),an=ze==="openssl"&&it[0]==="x509",Sn=at?{certificateOutputMayFeedReader:!0}:{};return[...We,...it.flatMap((ut,zt)=>Dn(ze,ut).map((Qt)=>Ut&&Vt("(?:cert|key)-file",zt)?{...Me(Qt),isCreatedPath:!0,...Sn}:an&&Vt("in",zt)?{...Me(Qt),isCertificateInput:!0,...Sn}:Me(Qt)))]}function Jh(n){return _n(n[0]??"").toLowerCase()==="timeout"?n.slice(2):n}function HI(n){let u=Jh(n);return _n(u[0]??"").toLowerCase()==="tailscale"&&u[1]==="cert"}function jI(n,u,b){let W=Ma(u,b);if(W===null||b[W]!=="explain")return null;let z=[n,...b.slice(0,W)],B=b.slice(W+1);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee==="--json"||ee==="--help"||ee==="-h")continue;if(ee==="--cwd"){let le=B[Q+1];if(le&&!le.startsWith("--"))z.push(le);Q++;continue}return z}return z}function VI(n,u,b,W,z,B,Q){let ee=Jo(n,z);if(XI(u,b,W,z,B,Q)){let le=Ed(_n(ee[0]??"").toLowerCase(),ee.slice(1))?ee.slice(1).filter((ue)=>!ue.startsWith("-")):[];return[...ty(ee),...le].map((ue)=>({target:ue,cwd:B}))}return ey(u,KI(ee),b,W,z,B,Q,()=>[])}function qI(n,u,b,W,z,B,Q){let ee=Jo(n,z);if(!Oo(_n(ee[0]??"").toLowerCase()))return[];return Yi(u,b,W,z,B,Q)??[{target:u,cwd:B}]}function ey(n,u,b,W,z,B,Q,ee){let le=QI(n,z);if(le===null)return u.flatMap(ee);return u.flatMap((ue)=>Pi.has(le)?ei(b.getShellSyntax(ue),b,W,z,B,Q):La(le,ue,b,W,z,B,Q))}function ty(n){let u=_n(n[0]??"").toLowerCase();if(!Kh.has(u))return[];let b=n[n[1]==="--"?2:1];if(u==="printf"&&b!==void 0&&!b.startsWith("-")&&!b.replaceAll("%%","").includes("%"))return[vd(b.replaceAll("%%","%"))];return n.slice(1)}function KI(n){let u=_n(n[0]??"").toLowerCase(),b=n.slice(1);if(u==="echo"){let W=b.findIndex((z)=>!/^-[neE]+$/.test(z));return[(W===-1?[]:b.slice(W)).join(" ")]}if(u==="printf")return YI(b);return[]}function YI(n){let u=n[0];if(u===void 0)return[];let b=(u.match(/%%|%[bqs]/g)??[]).filter((z)=>z!=="%%").length;if(b===0||n.length===1)return[vd(u)];let W=n.slice(1);return Array.from({length:Math.ceil(W.length/b)},(z,B)=>ZI(u,W.slice(B*b,(B+1)*b)))}function ZI(n,u){let b=0;return vd(n.replace(/%%|%[bqs]/g,(W)=>{if(W==="%%")return"%";let z=u[b]??"";return b++,z}))}function vd(n){return n.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function XI(n,u,b,W,z,B){let Q=Jo(n,W);if(Q.length===0||_n(Q[0]??"").toLowerCase()!=="xargs")return!1;let ee=so(Q),le=Q.slice(ee.childStart);if(le.length===0)return!1;if(ee.replacementToken==="")return!1;let ue=ee.replacementToken,ve=ue===null?[...le,pd]:le.map((Oe)=>Oe.split(ue).join(pd));return Xo(ve,u,b,W,z,B).some((Oe)=>Oe.target.includes(pd))}function QI(n,u){let b=Jo(n,u);if(b.length===0)return null;let W=_n(b[0]??"").toLowerCase();if(!Oo(W))return null;return JI(W,b.slice(1))?W:null}function JI(n,u){let b=Rd(n);for(let W=0;W<u.length;W++){let z=u[W];if(z===void 0)break;if(Sd.has(z)||oy(n,z)||/^--(?:eval|exec)=/.test(z))return!1;if(z==="-")return!0;if(z.startsWith("-")){if(b==="python"&&z==="-m")return!1;if(zI.get(b)?.has(z))W++;continue}return!1}return!0}function Rd(n){return/^python\d/.test(n)?"python":n}var zh=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function ek(n,u){if(!u||!zh.test(n))return n;return`~${n.replace(zh,"").replace(/\\/g,"/")}`}function Dn(n,u){if(u==="--")return[];let b=[],W=u.indexOf("=");if(W>0&&W<u.length-1&&!u.slice(0,W).includes("?"))b.push(u.slice(W+1));if(u.startsWith("-"))return b;if(n==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(u))return b;if(n==="zip"&&/\.zip$/i.test(u))return b;return b.push(u),b}function tk(n){let u=-1,b=!1;for(let W=0;W<n.length;W++){let z=n[W]??"";if(!b&&z==="--"){b=!0;continue}if(b||!/^-(?:[A-Za-z]|-)/.test(z)){if(u===-1)u=W;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(z)){W+=2;continue}if(z==="--indent"||z==="-L"){W++;continue}if(z.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(z)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(z))continue;return n.flatMap((B)=>Dn("jq",B))}return n.flatMap((W,z)=>z===u?[]:Dn("jq",W))}function nk(n){let u=[];for(let b=0;b<n.length;b++){let W=n[b]??"";if(W==="--"||!W.startsWith("-"))return[...u,...xI.has(W)?yd("git",n.slice(b).map((B)=>/^-[aeinopqsv]+m$/.test(B)?"-m":B),AI):yd("git",n.slice(b),PI)];if(u.push(...Dn("git",W)),!Nn.has(W))continue;let z=n[b+1];if(z===void 0)break;u.push(...W==="-c"&&z.includes("=")?[z.slice(z.indexOf("=")+1)]:Dn("git",z)),b++}return u}function yd(n,u,b){let W=[];for(let z=0;z<u.length;z++){let B=u[z]??"";if(B==="--")return[...W,...u.slice(z).flatMap((Q)=>Dn(n,Q))];if(b.has(B)){z++;continue}if(B.includes("=")&&b.has(B.slice(0,B.indexOf("="))))continue;W.push(...Dn(n,B))}return W}function rk(n){return n.flatMap((u,b)=>{let W=ry(u);if(W!==null)return $h(W.flag,W.value);let z=ny(n[b-1]);return z===null?[]:$h(z,u)})}function $h(n,u){if(n==="-F"||n==="--form"){let b=u.indexOf("="),W=b===-1?u:u.slice(b+1);if(!W.startsWith("@")&&!W.startsWith("<"))return[];return gd(W.slice(1).split(";")[0]??"")}if(n==="--data-urlencode"){let b=u.indexOf("@"),W=u.indexOf("=");if(b===-1||W!==-1&&W<b)return[];return gd(u.slice(b+1))}return u.startsWith("@")?gd(u.slice(1)):[]}function ny(n){if(n===void 0)return null;if(Yh.has(n))return n;return/^-[A-Za-z]+[dF]$/.test(n)?`-${n.slice(-1)}`:null}function ry(n){let u=n.slice(0,2);if(n.length>2&&(u==="-d"||u==="-F"))return{flag:u,value:n.slice(2)};let b=n.indexOf("=");if(b===-1)return null;let W=n.slice(0,b);return Yh.has(W)?{flag:W,value:n.slice(b+1)}:null}function gd(n){return n===""||n==="-"?[]:[n]}function ok(n,u,b,W,z,B){let Q=n.findIndex((le)=>le.startsWith("-")||le==="("||le==="!"||le===";"),ee=[...n.slice(0,Q===-1?n.length:Q),...n.flatMap((le,ue)=>le==="-files0-from"&&n[ue+1]!==void 0?[n[ue+1]??""]:[])];for(let le=0;le<n.length;le++){if(!pI.has(n[le]??""))continue;let ue=n.slice(le+1),ve=ue.findIndex((Me)=>gI.has(Me)),Oe=ve===-1?ue:ue.slice(0,ve),De=Xo(Oe,u,b,W,z,B).map((Me)=>Me.target);if(ee.push(...De.filter((Me)=>Me!=="{}")),!De.includes("{}"))continue;ee.push(...n.slice(0,le).flatMap((Me,Ne,Le)=>{if(!yI.has(Me))return[];let We=Le[Ne+1];return We===void 0?[]:[We,We.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return ee}function ik(n,u,b,W,z,B,Q){let ee=[];for(let le=0;le<u.length;le++){let ue=u[le];if(ue===void 0)break;if(Sd.has(ue)||oy(n,ue)){let Oe=u[le+1];if(Oe!==void 0)ee.push(...La(n,Oe,b,W,z,B,Q)),le++;continue}let ve=/^--(?:eval|exec)=(.*)$/.exec(ue);if(ve!==null&&ve[1]!==void 0){ee.push(...La(n,ve[1],b,W,z,B,Q));continue}if(!ue.startsWith("-"))ee.push({target:ue,cwd:B})}return ee}function oy(n,u){if(!u.startsWith("-")||u.startsWith("--")||u.length<=2)return!1;return bI.get(u[u.length-1]??"")?.has(Rd(n))??!1}function sk(n,u,b,W,z,B){if(!n.includes("system"))return[];return Ec(n)?.commands.flatMap((Q)=>ei(u.getShellSyntax(Q),u,b,W,z,B))??[]}function ak(n){return Array.from(n.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((u)=>u[1]).filter((u)=>u!==void 0&&u!=="")}function lk(n){let u=Array.from(n.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((b)=>b[2]).filter((b)=>b!==void 0&&b!=="");return[...u,...u.flatMap(_d),...n.match(hd)??[]]}function La(n,u,b,W,z,B,Q){let ee=(lt)=>({target:lt,cwd:B}),le=kk(n),ue=Mk(u,le);if(ue.kind==="unmaskable")return lk(u).map(ee);let ve=ue.masked.match(Lh)!==null||ue.literals.some((lt)=>Wh.test(ue.masked.slice(0,lt.start))),Oe=ue.masked.match(FI)!==null||ue.literals.some((lt)=>GI.test(ue.masked.slice(0,lt.start))),De=W.inlineLiteralsPresumedData===!0&&!Pi.has(n),Me=De&&(le==="python"||le==="javascript"),Ne=De&&!(Fk(ue.masked)||ve||Oe)?[]:ue.literals,Le=De?Array.from(ue.masked.matchAll(Lh),(lt)=>{let Vt=lt.index+lt[0].length;return{start:Vt,end:ra(ue.masked,Vt)}}):[],We=!De||Le.some((lt)=>yc(ue.masked,lt.start)&&!hk(ue,lt.start))?ue.literals:ue.literals.filter((lt)=>Wh.test(ue.masked.slice(0,lt.start))||Le.some((Vt)=>lt.start>=Vt.start&&lt.start<Vt.end)),Be=new Set(ve?We:[]),ze=Me&&Ne.length>0&&!mk(ue.masked,le==="python"?"#":"//"),it=ze?yk(ue.masked):[],at=ze?Array.from(ue.masked.matchAll(/[A-Za-z_$][\w$]*/g),(lt)=>({name:lt[0],index:lt.index})):[],Rt=pk(at),Tt=!fk(ue.masked,at),kt=at.filter((lt)=>!Bh(ue.masked,{start:lt.index,text:lt.name,tokenStart:lt.index,tokenEnd:lt.index+lt.name.length},it,Rt,Tt)).reduce((lt,Vt)=>{let Ut=lt.get(Vt.name)??[];return Ut.push(Vt.index),lt.set(Vt.name,Ut)},new Map);return[...Ne.filter((lt)=>lt.text!=="").map((lt)=>{if(!ze||Be.has(lt))return ee(lt.text);if(Bh(ue.masked,lt,it,Rt,Tt)||Sk(ue.masked,lt,it,kt))return{...ee(lt.text),literalRole:"data"};return Pk(ue,lt,it)?{...ee(lt.text),literalRole:"write"}:ee(lt.text)}),...Ne.flatMap((lt)=>_d(lt.text)).map(ee),...De?[]:ue.literals.flatMap((lt)=>lt.text.match(hd)??[]).map(ee),...ve?We.flatMap((lt)=>Yi(lt.text,b,{...W,commandHoldsPipe:!0},z,B,Q)??[ee(lt.text)]):[],...Oe?ue.literals.flatMap((lt)=>La(n,lt.text.replace(/\\(.)/g,(Vt,Ut)=>Ut==="n"?`
+`:Ut),b,W,z,B,Q)):[],...Me?[]:[ue.masked,...ue.comments].flatMap((lt)=>lt.match(hd)??[]).map(ee),...De?(u.match(/\$\{[^}]*\}|\$[A-Za-z_]\w*/g)??[]).map(ee):[]]}var wd={"(":")","[":"]","{":"}"},iy="and|elif|else|if|in|is|not|of|or|return|while|yield",ck=new RegExp(`(?:^|[^\\w$])(?:${iy})$`),dk=new RegExp(`(?:\\*|\\.\\.\\.)\\s*[([{]|\\.\\s*(?:${iy})\\s*\\(|/\\*`),uk=/^(?:exec|spawn)|^(?:popen|system|subprocess)$/;function mk(n,u){return dk.test(n)||n.split(`
+`).some((b)=>{let W=b.indexOf(u);return W>=0&&/[()[\]{}]/.test(b.slice(W))})}function fk(n,u){return Ek.test(n)||u.some((b)=>{let W=bk.get(b.name),z=b.index+b.name.length;return W!==void 0&&!W.test(n.slice(z,z+40))})}function pk(n){return n.some((u)=>ay(u.name).some((b)=>uk.test(b)))}var gk=new Set(["cmd","powershell","pwsh"]);function hk(n,u){let b=uo(n.masked,u),W=wd[n.masked[b]??""];if(W===void 0||W==="}")return!1;let z=n.masked.indexOf(W,b+1),B=n.masked.slice(b+1,z);return z!==-1&&/^\s*,[\w\s,]*$/.test(B)&&/^[,)]/.test(n.masked.slice(uo(n.masked,z+1)))&&!n.literals.some((Q)=>Q.tokenStart>b&&Q.tokenStart<z&&(Sd.has(Q.text)||Oo(_n(Q.text).toLowerCase())||gk.has(_n(Q.text).toLowerCase().replace(/\.exe$/,""))))}function yk(n){let u=[];return n.split("").map((b,W)=>{let z=u.at(-1)??-1;if(b in wd)u.push(W);if(b===")"||b==="]"||b==="}")u.pop();return z})}function Bh(n,u,b,W,z){let B=b[u.tokenStart]??-1,Q=n[B]??"",ee=Qo(n,u.tokenStart),le=uo(n,u.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(n.slice(Math.max(0,ee-3),ee+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(n.slice(le,le+8)))return!0;if(W&&(Q==="["||Q==="("))return!1;let ue=n[ee],ve=n[le];if(Q==="{"&&ue===":")return Tk(n,ee);let Oe=(ue===Q||ue===",")&&(ve===","||ve===wd[Q]||Q==="{"&&ve===":");if(Q!=="(")return Oe&&Q!=="";return Oe&&(z&&Ck.test(n.slice(Math.max(0,B-20),B))||(ue===","||ve===",")&&Ik(n,B))}function Sk(n,u,b,W){let z=Math.max(0,u.tokenStart-80),B=`${z===0?`
+`:""}${n.slice(z,u.tokenStart)}`,Q=vk.exec(B)?.[1],ee=n[b[u.tokenStart]??-1];if(Q===void 0||ee==="("||ee==="[")return!1;let le=uo(n,u.tokenEnd)+1;if(!/^\s*(?:[;\n]|$)/.test(n.slice(u.tokenEnd,le)))return!1;let ue=u.tokenStart-B.length+B.lastIndexOf(Q);return(W.get(Q)??[]).every((ve)=>ve===ue)}var Ck=/(?:^|[^\w$.])(?:print|console\s*\.\s*log)\s*$/,bk=new Map([["print",/^\s*\(/],["console",/^\s*\.\s*[\w$]+\s*\(/]]),Ek=/(?:^|[^\w$])(?:as|class|const|def|function|import|let|var)\s+(?:print|console)(?![\w$])/,vk=/[;\n{]\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/,Rk=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,wk=/^\s*\.\s*write_(?:text|bytes)\s*\(/,_k=/(?:^|[^\w$.])open\s*$/,xk=/^[bt]*[awx][abtwx]*$/,Ak=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function Pk(n,u,b){let W=b[u.tokenStart]??-1;if(n.masked[W]!=="(")return!1;let z=Qo(n.masked,u.tokenStart),B=uo(n.masked,u.tokenEnd),Q=n.masked[B],ee=n.masked.slice(Math.max(0,W-40),W);if(Rk.test(ee))return(z===W||n.masked[z]===",")&&(Q===","||Q===")")&&!n.literals.some((ue)=>ue.tokenStart>W&&ue.tokenStart<u.tokenStart)&&wk.test(n.masked.slice(ra(n.masked,W+1)+1));if(z!==W||Q!==",")return!1;if(Ak.test(ee))return!0;if(!_k.test(ee))return!1;let le=n.literals.find((ue)=>/^,\s*(?:mode\s*=\s*)?$/.test(n.masked.slice(B,ue.tokenStart)));return le!==void 0&&xk.test(le.text)&&/^[,)]/.test(n.masked.slice(uo(n.masked,le.tokenEnd)))}function Tk(n,u){let b=Qo(n,u),W=/[\w$]*$/.exec(n.slice(Math.max(0,b-63),b+1))?.[0]??"",z=n[Qo(n,b+1-W.length)];return z==="{"||z===","}function Ik(n,u){let b=Qo(n,u),W=n.slice(Math.max(0,b-7),b+1);return!/[\w$)\]]$/.test(W)||ck.test(W)}function kk(n){let u=Rd(n);if(u==="python")return"python";if(u==="osascript")return"opaque";return u==="node"||u==="bun"||u==="deno"?"javascript":"simple"}var Ok={python:"#",javascript:"/"};function Mk(n,u){if(u==="opaque")return{kind:"unmaskable"};let b={masked:n.split(""),literals:[],comments:[]};return sy(n,0,u,b,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:b.masked.join(""),literals:b.literals,comments:b.comments}}function sy(n,u,b,W,z){let B=0;for(let Q=u;Q<n.length;Q++){let ee=n[Q]??"";if(z&&ee==="}"&&B===0)return Q;if(z&&ee===Ok[b])return null;if(b==="python"&&ee==="#"){let Le=n.slice(Q).search(/[\r\n]/),We=Le===-1?n.length:Q+Le;W.comments.push(n.slice(Q,We)),W.masked.fill(" ",Q,We),Q=We-1;continue}if(ee==="{")B++;if(ee==="}")B--;if(b==="simple"&&(ee==="`"||ee==="%"||ee==="<")){if(LI.test(n.slice(Q)))return null}let le=ee==="'"||ee==='"'||b==="javascript"&&ee==="`"?ee:null;if(le===null)continue;if(le==="`"&&Wk(n,Q))return null;let ue=b==="python"?Nk(n,Q):"",ve=b==="python"&&n.startsWith(le.repeat(3),Q)?le.repeat(3):le,Oe=Q+ve.length,De=le==="`"||/[fF]/.test(ue),Me=Q-ue.length,Ne=De?Dk(n,Me,Oe,ve,b,W):Lk(n,Oe,ve);if(Ne===null)return null;if(!De){let Le=n.slice(Oe,Ne);if(b==="simple"&&le==='"'&&WI.test(Le))return null;W.literals.push({start:Oe,text:Le,tokenStart:Me,tokenEnd:Ne+ve.length}),W.masked.fill(" ",Oe,Ne)}W.masked.fill(" ",Q,Oe),W.masked.fill(" ",Ne,Ne+ve.length),Q=Ne+ve.length-1}return z?null:n.length}function Dk(n,u,b,W,z,B){let Q=z==="python"?"{":"${",ee=W==="`"||W.length===3,le="";for(let ue=b;ue<n.length;ue++){let ve=n[ue]??"";if(n.startsWith(W,ue))return B.literals.push({start:b,text:le,tokenStart:u,tokenEnd:ue+W.length}),ue;if(!ee&&(ve===`
+`||ve==="\r"))return null;let Oe=z==="python"&&(ve==="{"||ve==="}")&&n[ue+1]===ve;if(!Oe&&n.startsWith(Q,ue)){let Ne=sy(n,ue+Q.length,z,B,!0);if(Ne===null)return null;le+=`${Q}}`,B.masked.fill(" ",ue,ue+Q.length),B.masked[Ne]=" ",ue=Ne;continue}let Me=ve==="\\"&&!(z==="python"&&n[ue+1]==="{")||Oe?2:1;le+=n.slice(ue,ue+Me),B.masked.fill(" ",ue,ue+Me),ue+=Me-1}return null}function Nk(n,u){return NI.exec(n.slice(Math.max(0,u-3),u))?.[1]??""}function Lk(n,u,b){let W=b.length===3;for(let z=u;z<n.length;z++){let B=n[z];if(B==="\\"){z++;continue}if(!W&&(B===`
+`||B==="\r"))return null;if(n.startsWith(b,z))return z}return null}function Wk(n,u){for(let b=u-1;b>=0;b--){let W=n[b];if(!W||/\s/.test(W))continue;return/[\w$\])]/.test(W)}return!1}function Fk(n){for(let u of n.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let b=u[0],W=u.index;if(SI.has(b.toLowerCase()))return!0;let z=ay(b);if(!z.some((B)=>CI.has(B)))continue;if(z.length>1)return!0;if(n[Qo(n,W)]===".")return!0;if(n[uo(n,W+b.length)]==="(")return!0}return!1}function ay(n){return n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((u)=>u.toLowerCase())}function Qo(n,u){for(let b=u-1;b>=0;b--)if(!/\s/.test(n[b]??""))return b;return-1}function uo(n,u){for(let b=u;b<n.length;b++)if(!/\s/.test(n[b]??""))return b;return n.length}function Gk(n,u,b,W,z,B){return Hk(n).flatMap((Q)=>{let ee=u.getShellSyntax(Q);if(ee.status==="invalid")return[];return[...ei(ee,u,{...b,displayOperandsAreCapturedOutput:!0},W,z,B),...zk(ee,W)?$k(ee,W).map((le)=>({target:le,cwd:z})):[]]})}function zk(n,u){let b=qs(n);for(let W=0;W<b.length;W++){let z=b[W];if(z?.kind!=="word"||_n(yr(z.text,u)).toLowerCase()!=="base64")continue;for(let B=W+1;B<b.length;B++){let Q=b[B];if(Q?.kind==="operator")break;if(Q?.kind!=="word")continue;let ee=yr(Q.text,u);if(ee==="--decode"||!ee.startsWith("--")&&ee.startsWith("-")&&/[dD]/.test(ee))return!0}}return!1}function $k(n,u){return qs(n).flatMap((b)=>b.kind==="word"?[yr(b.text,u)]:b.kind==="redirection"&&b.target?[yr(b.target,u)]:[]).flatMap(_d)}function _d(n){let u=Uk(n);if(u===null)return[];let b=Buffer.from(u,"base64").toString("utf8");if(b===""||Bk(b))return[];return Buffer.from(b,"utf8").toString("base64").replace(/=+$/g,"")===u.replace(/=+$/g,"")?[b]:[]}function Bk(n){return Array.from(n).some((u)=>{let b=u.charCodeAt(0);return b<32||b===127})}function Uk(n){if(n.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(n))return null;if(/=/.test(n.replace(/=+$/g,"")))return null;let u=n.replace(/=+$/g,"");if(u.length%4===1)return null;return`${u.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-u.length%4)%4)}`}function Hk(n){let u=[],b={inSingle:!1,inDouble:!1,escaped:!1};for(let W=0;W<n.length;W++){let z=n[W];if(!z)break;if(li(z,b))continue;if(ly(n,W,b)){let B=jk(n,W+1);if(B!==null)u.push(B.body),W=B.endIndex;continue}if(!b.inSingle&&z==="`"){let B=Vk(n,W);if(B!==null)u.push(B.body),W=B.endIndex}}return u}function jk(n,u){let b={inSingle:!1,inDouble:!1,escaped:!1},W=1;for(let z=u+1;z<n.length;z++){let B=n[z];if(!B)break;if(li(B,b))continue;if(ly(n,z,b)){W++,z++;continue}if(!b.inSingle&&!b.inDouble&&B===")"){if(W--,W===0)return{body:n.slice(u+1,z),endIndex:z}}}return null}function Vk(n,u){let b=!1;for(let W=u+1;W<n.length;W++){let z=n[W];if(!z)break;if(b){b=!1;continue}if(z==="\\"){b=!0;continue}if(z==="`")return{body:n.slice(u+1,W),endIndex:W}}return null}function ly(n,u,b){return!b.inSingle&&n[u]==="$"&&n[u+1]==="("&&n[u+2]!=="("}function qk(n){let u=[],b=[],W=!1,z=!1,B=!1;for(let le=0;le<n.length;le++){let ue=n[le];if(ue===void 0)break;if(!B&&ue==="--"){B=!0;continue}if(B){b.push(ue);continue}let ve=/^--([^=]+)(?:=(.*))?$/.exec(ue);if(ve!==null){let Oe=ve[1]??"",De=ve[2];if(Oe===II)z=!0;if(OI.has(Oe))W=!0;if(De!==void 0){if(Oe===Nh)u.push(De);continue}if(DI.has(Oe)){let Me=n[le+1];if(Oe===Nh&&Me!==void 0)u.push(Me);le++}continue}if(ue.startsWith("-")&&ue.length>1){let Oe=ue.slice(1),De="",Me="";for(let Le=0;Le<Oe.length;Le++){let We=Oe[Le]??"";if(kI.has(We))W=!0;if(MI.has(We)){De=We,Me=Oe.slice(Le+1);break}}if(De==="")continue;if(Me.length>0){if(De===Dh)u.push(Me);continue}let Ne=n[le+1];if(De===Dh&&Ne!==void 0)u.push(Ne);le++;continue}b.push(ue)}let ee=!W&&!z?b.slice(1):b;return[...u,...ee]}function Kk(n){return n==="env"||n==="command"||n==="builtin"||n==="sudo"}var Yk=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Uh=".env.",Zk=[".example",".sample",".template",".tpl"],Xk=[".env.example.",".env.sample."];function Qk(n){let u;try{u=new URL(n.trim())}catch{return!1}return u.protocol!=="file:"&&u.host!==""}function Jk(n){return n.length>0&&!/\s/.test(n)}function Wa(n,u,b,W){let z=cy(n,u,b,W);return z!==""&&b.paths.entryKind(z)!=="missing"}function cy(n,u,b,W){try{return Zi(n,u,b,W)}catch(z){if(z instanceof a)throw z;return""}}var eO=/[?&][^?&=/]+=/,tO=new Set(["node_modules","__pycache__"]),nO=[["vendor","bundle"],["vendor","cache"]];function rO(n,u,b,W,z){if(Qk(n))return null;let B=Mn(n,u,W,z);if(!B)return null;let Q=Yt(B.split("/").pop()??""),ee=Yt(B),le=()=>Jk(Q)||Wa(n,u,W,z),ue=Yt(cO(n,u,W,z));for(let De of yl){let Me=`~/${De.suffixParts.join("/")}`;if((jh(ee,Me)||jh(ue,Me))&&vr(De.id,b))return De.id}if(Q===".env.defaults"||Q.startsWith(Uh)&&Zk.some((De)=>Q.endsWith(De))||Xk.some((De)=>Q.startsWith(De)))return null;let ve=oO(B,u,b,W,z);if(ve)return ve;if(Yk.has(Q))return null;for(let De of hl)if(Q===De.basename&&vr(De.id,b))return De.id;if(Q.startsWith(Uh)&&vr(gs.id,b)&&le())return gs.id;for(let De of Sl)if(Q.length>De.prefix.length&&Q.startsWith(De.prefix)){let Me=Q.slice(De.prefix.length)[0];if((Me==="-"||Me==="_")&&vr(De.id,b)&&le())return De.id}for(let De of Cl)if(Q.length>De.prefix.length&&Q.startsWith(De.prefix)){if(Q.slice(De.prefix.length)===De.suffix&&vr(De.id,b))return De.id}if(aO(ee))return null;if(!Q.includes(".")&&ui.pattern.test(Q)&&vr(ui.id,b))return ui.id;if(eO.test(n)&&!Wa(n,u,W,z))return null;let Oe=lO(Q,b);if(Oe)return Oe;return null}function oO(n,u,b,W,z){return hs.find((B)=>{if(!vr(B.id,b))return!1;switch(B.id){case"secret.cli.claude-code":return qt(n,Zt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),[".credentials.json"]);case"secret.cli.claude-code.config":{let Q=Yt(n).split("/");return qt(n,Zt(W.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",u,W,z),["settings.json","settings.local.json"])||Ki(n,"~/.claude.json",u,W,z)||Q.at(-2)===".claude"&&["settings.json","settings.local.json"].includes(Q.at(-1)??"")||Q.at(-1)===".mcp.json"}case"secret.cli.antigravity":return qt(n,Mn("~/.gemini/config",u,W,z),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let Q=Zt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z);return qt(n,Q,["auth.json",".credentials.json"])||Zo(n,Q,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let Q=Zt(W.env.get("CODEX_HOME"),"~/.codex",u,W,z),ee=Yt(n).split("/"),le=ee.at(-1)??"";return qt(n,Q,["config.toml"])||le.endsWith(".config.toml")&&qt(n,Q,[le])||ee.at(-2)===".codex"&&le==="config.toml"}case"secret.cli.gemini":return qt(n,ln(Zt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let Q=Yt(n).split("/"),ee=W.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),le=W.env.get("ProgramData")?[ln(Zt(W.env.get("ProgramData"),"",u,W,z),"gemini-cli")]:[];return qt(n,ln(Zt(W.env.get("GEMINI_CLI_HOME"),"~",u,W,z),".gemini"),["settings.json","google_accounts.json"])||Q.at(-1)==="settings.json"&&Q.at(-2)===".gemini"||(ee?.trim()?Ki(n,ee,u,W,z):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...le].some((ue)=>qt(n,Mn(ue,u,W,z),["settings.json"]))}case"secret.cli.copilot-cli":{let Q=Zt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z);return qt(n,Q,["config.json"])||Zo(n,Q,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return qt(n,Zt(W.env.get("COPILOT_HOME"),"~/.copilot",u,W,z),["mcp-config.json"]);case"secret.cli.kimi-code":{let Q=Zt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),ee=Zt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z);return qt(n,Q,["server.token"])||Zo(n,Q,["credentials"])||Zo(n,ee,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let Q=["config.toml","mcp.json"],ee=Yt(n).split("/");return ee.at(-1)==="mcp.json"&&ee.at(-2)===".kimi-code"||qt(n,Zt(W.env.get("KIMI_CODE_HOME"),"~/.kimi-code",u,W,z),Q)||qt(n,Zt(W.env.get("KIMI_SHARE_DIR"),"~/.kimi",u,W,z),[...Q,"config.json","config.json.bak"])}case"secret.cli.opencode":{let Q=ln(Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"opencode"),ee=Yt(n).split("/").at(-1)??"",le=W.env.get("OPENCODE_DB")?.trim(),ue=le&&le!==":memory:"?[le,`${le}-wal`,`${le}-shm`]:[];return qt(n,Q,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(ee)&&qt(n,Q,[ee])||ue.some((ve)=>Ki(n,ve,u,W,z))}case"secret.cli.opencode.config":{let Q=ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"opencode"),ee=W.env.get("ProgramData")?[ln(Zt(W.env.get("ProgramData"),"",u,W,z),"opencode")]:[],le=["opencode.json","opencode.jsonc"],ue=W.env.get("OPENCODE_CONFIG");return le.includes(Yt(n).split("/").at(-1)??"")||qt(n,Q,["config.json"])||(ue?.trim()?Ki(n,ue,u,W,z):!1)||["/Library/Application Support/opencode","/etc/opencode",...ee].some((ve)=>qt(n,Mn(ve,u,W,z),le))}case"secret.cli.pi":return qt(n,Zt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["auth.json"]);case"secret.cli.pi.config":return qt(n,Zt(W.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",u,W,z),["models.json"]);case"secret.cli.amp":{let Q=Mn("~",u,W,z);return[ln(Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),"amp"),ln(Q,".local","share","amp")].some((le)=>qt(n,le,["secrets.json"]))||Zo(n,ln(Q,".amp"),["oauth"])}case"secret.cli.amp.config":{let Q=["settings.json","settings.jsonc"],ee=[ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"amp"),ln(Mn("~",u,W,z),".config","amp")],le=Yt(n).split("/"),ue=W.env.get("AMP_SETTINGS_FILE");return ee.some((ve)=>qt(n,ve,Q))||le.at(-2)===".amp"&&Q.includes(le.at(-1)??"")||(ue?.trim()?Ki(n,ue,u,W,z):!1)}case"secret.cli.cursor":{let Q=ln(Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),"cursor"),ee=ln(Zt(W.env.get("CURSOR_DATA_DIR"),"~/.cursor",u,W,z),"projects");return qt(n,Mn("~/.cursor",u,W,z),["auth.json"])||qt(n,Q,["auth.json"])||Yt(n).split("/").at(-1)==="mcp-auth.json"&&mo(Yt(n),Yt(ee))}case"secret.cli.cursor.config":{let Q=Yt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".cursor"}case"secret.cli.grok-build":return qt(n,Zt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let Q=Yt(n).split("/");return Q.at(-1)==="config.toml"&&Q.at(-2)===".grok"||qt(n,Zt(W.env.get("GROK_HOME"),"~/.grok",u,W,z),["config.toml","managed_config.toml","requirements.toml"])||qt(n,Mn("/etc/grok",u,W,z),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return qt(n,Mn("~/.factory",u,W,z),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let Q=Yt(n).split("/");return Q.at(-1)==="mcp.json"&&Q.at(-2)===".factory"||qt(n,Mn("~/.factory",u,W,z),["settings.json","hooks.json"])}case"secret.cli.devin":return[Zt(W.env.get("XDG_DATA_HOME"),"~/.local/share",u,W,z),Mn("~/.local/share",u,W,z)].some((Q)=>qt(n,ln(Q,"devin"),["credentials.toml"])||Zo(n,ln(Q,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[Zt(W.env.get("XDG_CONFIG_HOME"),"~/.config",u,W,z),Mn("~/.config",u,W,z)].some((Q)=>qt(n,ln(Q,"devin"),["config.json"]));default:return!1}})?.id??null}var Hh=new WeakMap;function Zt(n,u,b,W,z){let B=Hh.get(z)??new Map;Hh.set(z,B);let Q=`${b}\x00${n??""}\x00${u}`,ee=B.get(Q);if(ee!==void 0)return ee;let le=Mn(n?.trim()?n:u,b,W,z);return B.set(Q,le),le}function qt(n,u,b){return b.some((W)=>dy(n,ln(u,W)))}function Zo(n,u,b){return b.some((W)=>mo(Yt(n),Yt(ln(u,W))))}function Ki(n,u,b,W,z){return dy(n,Mn(u,b,W,z))}function dy(n,u){return Yt(n)===Yt(u)}function ln(n,...u){return er([n,...u].filter(Boolean).join("/"))}function iO(n,u,b,W,z,B){if(b.length===0)return!1;let Q=Yt(Zi(n,u,z,B));return b.some((ee)=>mo(Q,Yt(Zi(ee,W,z,B))))}function sO(n,u,b,W,z,B){if(b.length===0)return!1;let Q=Yt(Zi(n,u,z,B));if(!Q)return!1;let ee=z.env.get("HOME")??z.home,le=ee?er(jt(Cn(ee),z.paths,B)):"",ue=Yt(le),ve=z.env.get("CC_SAFETY_NET_HOME"),Oe=Yt(ve?er(jt(Fa(Cn(ve)),z.paths,B)):le&&er(jt(`${le}/.cc-safety-net`,z.paths,B)));if(Oe&&mo(Q,Oe))return!1;return b.some((De)=>{let Me=wl(De);if(Me&&Vh.basename(Q)!==Yt(Me.name))return!1;let Ne=Yt(Zi(Me?.root??De,W,z,B));if(!Ne)return!1;if(ue&&(ue===Ne||ue.startsWith(Ne.endsWith("/")?Ne:`${Ne}/`)))return!1;return mo(Q,Ne)&&!(Me&&Q===Ne)})}function aO(n){let u=n.split("/");return u.some((b)=>tO.has(b))||nO.some(([b,W])=>u.some((z,B)=>z===b&&u[B+1]===W))}function lO(n,u){let b=n.lastIndexOf("."),W=b>0&&b<n.length-1?n.slice(b+1):"";if(W==="")return null;for(let z of bl)if(W===z.extension&&vr(z.id,u))return z.id;for(let z of El)if(z.pattern.test(W)&&vr(z.id,u))return z.id;return null}function Yt(n){return n.toLowerCase()}function vr(n,u){return!u?.disabledRules?.includes(n)}function Mn(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B)return"";if(!z)return B;let Q=Ad(B,z),ee=Na(Q)?Q:er(Fa(u,Q)),le=er(jt(ee,b.paths,W));if(!mo(le,z)){if(Na(Q))return le;return le===ee?B:le}let ue=le.slice(z.length);return ue?`~${ue}`:"~"}function jh(n,u){return n===u||n.startsWith(`${u}/`)}function cO(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B||!z)return"";let Q=Ad(B,z),ee=Vh.normalize(Na(Q)?Q:er(Fa(u,Q))),le=er(Cn(b.env.get("HOME")??b.home)),ue=(De)=>process.platform==="win32"?De.toLowerCase():De,ve=[z,le].find((De)=>De!==""&&mo(ue(ee),ue(De)));if(ve===void 0)return"";let Oe=ee.slice(ve.length);return Oe?`~${Oe}`:"~"}function Zi(n,u,b,W){let{home:z,normalized:B}=xd(n,b,W);if(!B)return"";let Q=z?Ad(B,z):B;return er(jt(Na(Q)?Q:Fa(u,Q),b.paths,W))}function xd(n,u,b){let W=u.env.get("HOME")??u.home,z=W?er(jt(Cn(W),u.paths,b)):"",B=er(Cn(dO(yr(n,u))));return{home:z,normalized:B}}function dO(n){if(!n.trim().toLowerCase().startsWith("file:"))return n;try{return uI(n)}catch{return n}}function Ad(n,u){if(n==="~")return u;if(n.startsWith("~/"))return ln(u,n.slice(2));return n}function uO(n){if(process.platform==="win32")return!0;return dI.parse(n).root.length>1}function er(n){let u=n.trim(),b=(u.includes("\\")&&uO(u)?u.replace(/\\/g,"/"):u).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(b==="/")return b;return b.replace(/\/+$/g,"")}function mo(n,u){return n===u||n.startsWith(u.endsWith("/")?u:`${u}/`)}function _n(n){return n.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??n}class g extends Error{stage;evaluation;name="GuardEvaluationError";constructor(n,u,b){super(`CC Safety Net ${n} dependency failed`,{cause:b});this.stage=n;this.evaluation=u}}var mO={findPolicyMutation:kh,findGitMetadataMutation:Gf,resolveGitMetadata:hO,loadPolicySnapshot:w,findSensitiveTarget:Xh,analyzeCommand:wh,getModes:O},fO=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/,pO=["workdir","cwd","working_directory"];function G(n,u){let b={...mO,...u.dependencies},W=CO(n),z=()=>Lr("config-load",W,()=>b.loadPolicySnapshot(u.environment,{...u.policyOptions,cwd:n.context.configCwd})),B=n.route.kind==="unknown"&&W?z():void 0,Q=B?.policy.commandTools.find((Ut)=>Ut.name===n.toolName),ee=Q&&W?gO(n,W,Q.cwd,u.environment.paths):n;if("decision"in ee)return ee;let le=ee,ue=le===n?{}:{promotedInvocation:le},ve=Xi(le)?le.command:W,Oe=Lr("policy-protection",ve,()=>Nf(le)),De=Mo(Oe,"input-candidate"),Me=Mo(Oe,"declared-command");if(Xi(le)&&le.command?.trim()&&Me?.program.status==="limited")return{stage:"command-analysis",...ue,decision:{kind:"deny",reason:nr,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:le.command,segment:le.command}}};if(De?.program.status==="limited")return{stage:"command-validation",...ue,decision:{kind:"deny",reason:Df,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let Ne=xn(),Le=Lr("policy-protection",ve,()=>b.resolveGitMetadata([le.context.executionCwd,le.context.configCwd],u.environment)),We=Lr("policy-protection",ve,()=>b.findPolicyMutation(Oe,u.environment,Ne));if(We){let Ut=ve??We.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:ot,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:Ut,segment:We.target}}}}let Be=Lr("policy-protection",ve,()=>Ah(Oe,u.environment,Ne));if(Be){let Ut=ve??Be.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:rt,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:Ut,segment:Be.target}}}}let ze=Lr("policy-protection",ve,()=>b.findGitMetadataMutation(Oe,Le,u.environment,Ne));if(ze){let Ut=ve??ze.target;return{stage:"policy-protection",...ue,decision:{kind:"deny",reason:y,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:Ut,segment:ze.target}}}}let it=B??z(),at=it.policy,Rt=b.getModes(at,u.environment.env),Tt={level:Rt.effectiveLevel,...yO(it),...ue},kt=at.secretProtection.enabled===!1?null:Lr("secret-protection",ve,()=>b.findSensitiveTarget(Oe,at.secretProtection,u.environment,Ne,{strict:Xi(le)||De?.program.dialect==="powershell"?Rt.strict:void 0}));if(kt){let Ut=ve??kt.target;return{stage:"secret-protection",...Tt,decision:{kind:"deny",reason:qh,intent:"hard_stop",ruleId:kt.ruleId,evidence:{command:Ut,segment:kt.target}}}}if(!Xi(le))return{stage:"non-command",...Tt,decision:{kind:"allow"}};if(!le.command||le.command.trim()==="")return{...my(ve),...Tt};let lt=Lr("command-analysis",ve,()=>_h(()=>b.analyzeCommand(le.command,{cwd:le.context.configCwd,effectiveCwd:le.context.executionCwd,shell:le.route.shell,policySnapshot:it,environment:u.environment,protectedGitMetadata:Le,effectiveCapabilities:Rt.capabilities,worktreeMode:Rt.worktreeMode,budget:Ne,...u.trace?{trace:u.trace}:{}},SO(Oe),Oe.store),le.command,u.trace)),Vt=le.route.shell==="auto"&&Oe.store.readsAutoAsPowerShell()?()=>{let Ut=u.trace?.branch(),an={...G({...le,route:{kind:"command",shell:"posix"}},{...u,...Ut?{trace:Ut.trace}:{},dependencies:{...u.dependencies,loadPolicySnapshot:()=>it,resolveGitMetadata:()=>Le}}),...ue};return{decision:an.decision,withItsTrace:()=>(Ut?.adopt(),an)}}:void 0;if(lt.decision){let Ut=!Rt.strict&&(lt.decision.ruleId==="raw-text.dangerous-command"||lt.decision.reason===Qr&&!fO.test(lt.decision.evidence?.segment??"")&&Un(le.command)===null),an=Ut?Vt?.():void 0;if(an?.decision.kind==="deny"&&!an.decision.unverifiedByStandardMode)return an.withItsTrace();return{stage:"command-analysis",...Tt,..."errorCode"in lt?{errorCode:lt.errorCode}:{},decision:Ut?{...lt.decision,unverifiedByStandardMode:!0}:lt.decision}}return Vt?.().withItsTrace()??{stage:"command-analysis",...Tt,decision:{kind:"allow"}}}function gO(n,u,b,W){let B=[...new Set((b===!1?[]:b?[b]:pO).flatMap((ue)=>{let ve=Object.getOwnPropertyDescriptor(n.input,ue);return ve?[ve.value]:[]}))],Q=B.filter((ue)=>typeof ue==="string"&&ue.trim()!=="");if(B.length>1||Q.length!==B.length)return my(u);let ee=Q[0],le=ee===void 0?n.context.configCwd:Vu(ee,n.context.configCwd,W);if(!le){let ue=I({directory:"requested",problem:"unusable",cwd:ee??""});return{stage:"command-validation",decision:{kind:"deny",reason:ue.reason,ruleId:ue.ruleId,intent:ue.intent,evidence:{command:u,segment:u}}}}return d(n.toolName,n.input,{kind:"command",shell:"auto"},{configCwd:n.context.configCwd,executionCwd:le},u)}function hO(n,u){let b=[...new Set(n.filter((W)=>typeof W==="string"&&W!==""))].flatMap((W)=>u.gitMetadata(W)??[]);if(b.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(b.flatMap((W)=>W.entries))]),markerFiles:Object.freeze([...new Set(b.flatMap((W)=>W.markerFiles))]),directories:Object.freeze([...new Set(b.flatMap((W)=>W.directories))]),hooksDirectories:Object.freeze([...new Set(b.flatMap((W)=>W.hooksDirectories))])})}function yO(n){if(n.state==="ready")return{};return{configFallback:{reason:n.reason}}}function SO(n){return Mo(n,"declared-command")?.program}function CO(n){try{return ye(n.input)}catch(u){let b=Xi(n)?n.command:void 0;throw new g("policy-protection",uy("policy-protection",u instanceof h?void 0:b,u),u)}}function Lr(n,u,b){try{return b()}catch(W){throw new g(n,uy(n,W instanceof h?void 0:u,W),W)}}function uy(n,u,b){let W=b instanceof H?{reason:ir,ruleId:"analysis.strict-unparseable"}:b instanceof a||b instanceof E?{reason:za,ruleId:"analysis.limit"}:{reason:ti,ruleId:"analysis.failed-closed"};return{stage:n,decision:{kind:"deny",...W,intent:"stop_and_explain",...u?{evidence:{command:u,segment:u}}:{}}}}function my(n){let u=q();return{stage:"command-validation",decision:{kind:"deny",reason:u.reason,ruleId:u.ruleId,intent:u.intent,...n?{evidence:{command:n,segment:n}}:{}}}}function Xi(n){return n.route.kind==="command"}
 export{l,a,te,qe,dt,A,Pt,pt,Fe,ne,q,I,re,_t,c,r,ft,$e,O,k,xe,At,Ve,i,R,s,de,o,v,Se,V,It,Ot,m,we,Ce,Dt,j,oe,pe,T,Nt,D,x,fe,K,p,L,ie,mt,gt,U,P,M,Ee,ke,Ke,me,f,e,Je,je,Ye,Re,ht,yt,ge,Ue,he,Ze,Lt,J,Y,Xe,Te,h,He,S,ye,Pe,Mt,bt,vt,d,Z,xt,X,se,ae,be,St,wt,_,N,Qe,et,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Ft,Ie,rt,ot,g,G};