| 2895 | `,Aiz=32767,Oiz=200,wiz=21,jiz=100,Hiz,Jiz,Miz,Xiz=4500,Ra1,Piz,kiz,EL6,mQ,Wa;var Da=y(()=>{Df();_8();VB();GL6();l8();Hiz=(Aiz-Oiz)*3/8,Jiz=Hiz-dzK.length-wiz,Miz=Math.max(0,Math.floor(Jiz*3/4)-jiz),Ra1=process.platform==="win32"?Miz:Xiz,Piz={valid:!1,statements:[],variables:[],hasStopParsing:!1};kiz=new Set(["PwshSpawnError","PwshError","PwshTimeout","EmptyOutput","InvalidJson"]),EL6=HP((q)=>{let K=viz(q);return K.then((_)=>{if(!_.valid&&kiz.has(_.errors[0]?.errorId??""))EL6.cache.delete(q)}),K},(q)=>q,256),mQ=Object.assign(Object.create(null),{ls:"Get-ChildItem",dir:"Get-ChildItem",gci:"Get-ChildItem",cat:"Get-Content",type:"Get-Content",gc:"Get-Content",cd:"Set-Location",sl:"Set-Location",chdir:"Set-Location",pushd:"Push-Location",popd:"Pop-Location",pwd:"Get-Location",gl:"Get-Location",gi:"Get-Item",gp:"Get-ItemProperty",ni:"New-Item",mkdir:"New-Item",md:"New-Item",ri:"Remove-Item",del:"Remove-Item",rd:"Remove-Item",rmdir:"Remove-Item",rm:"Remove-Item",erase:"Remove-Item",mi:"Move-Item",mv:"Move-Item",move:"Move-Item",ci:"Copy-Item",cp:"Copy-Item",copy:"Copy-Item",cpi:"Copy-Item",si:"Set-Item",rni:"Rename-Item",ren:"Rename-Item",ps:"Get-Process",gps:"Get-Process",kill:"Stop-Process",spps:"Stop-Process",start:"Start-Process",saps:"Start-Process",sajb:"Start-Job",ipmo:"Import-Module",echo:"Write-Output",write:"Write-Output",sleep:"Start-Sleep",help:"Get-Help",man:"Get-Help",gcm:"Get-Command",gsv:"Get-Service",gv:"Get-Variable",sv:"Set-Variable",h:"Get-History",history:"Get-History",iex:"Invoke-Expression",iwr:"Invoke-WebRequest",irm:"Invoke-RestMethod",icm:"Invoke-Command",ii:"Invoke-Item",nsn:"New-PSSession",etsn:"Enter-PSSession",exsn:"Exit-PSSession",gsn:"Get-PSSession",rsn:"Remove-PSSession",cls:"Clear-Host",clear:"Clear-Host",select:"Select-Object",where:"Where-Object",foreach:"ForEach-Object","%":"ForEach-Object","?":"Where-Object",measure:"Measure-Object",ft:"Format-Table",fl:"Format-List",fw:"Format-Wide",oh:"Out-Host",ogv:"Out-GridView",ac:"Add-Content",clc:"Clear-Content",tee:"Tee-Object",epcsv:"Export-Csv",sp:"Set-ItemProperty",rp:"Remove-ItemProperty",cli:"Clear-Item",epal:"Export-Alias",sls:"Select-String"});Wa=new Set(["-","–","—","―"])});import{basename as Niz,posix as yiz,resolve as Eiz,sep as lzK}from"path";function rzK(q){if(!q.startsWith("../"))return q;let K=Niz(Z8()).toLowerCase();if(!K)return q;let _="../"+K+"/",z=q;while(z.startsWith(_))z=z.slice(_.length);if(z==="../"+K)return".";return z}function ozK(q){let K=q;if(K.length>0&&(Wa.has(K[0])||K[0]==="/")){let _=K.indexOf(":",1);if(_>0)K=K.slice(_+1)}if(K=K.replace(/^['"]|['"]$/g,""),K=K.replace(/`/g,""),K=K.replace(/^(?:[A-Za-z0-9_.]+\\){0,3}FileSystem::/i,""),K=K.replace(/^[A-Za-z]:(?![/\\])/,""),K=K.replace(/\\/g,"/"),K=K.split("/").map((_)=>{if(_==="")return _;let z;do{if(z=_,_=_.replace(/ +$/,""),_==="."||_==="..")return _;_=_.replace(/\.+$/,"")}while(_!==z);return _||"."}).join("/"),K=yiz.normalize(K),K.startsWith("./"))K=K.slice(2);return K.toLowerCase()}function azK(q){let K=Z8(),_=Eiz(K,q),z=K.endsWith(lzK)?K:K+lzK,Y=_.toLowerCase(),$=K.toLowerCase(),A=z.toLowerCase();if(Y===$)return".";if(!Y.startsWith(A))return null;return _.slice(z.length).replace(/\\/g,"/").toLowerCase()}function nzK(q){if(q==="head"||q===".git")return!0;if(q.startsWith(".git/")||/^git~\d+($|\/)/.test(q))return!0;for(let K of Liz){if(K==="head")continue;if(q===K||q.startsWith(K+"/"))return!0}return!1}function l68(q){let K=rzK(ozK(q));if(nzK(K))return!0;if(K.startsWith("../")||K.startsWith("/")||/^[a-z]:/.test(K)){let _=azK(K);if(_!==null&&nzK(_))return!0}return!1}function hI8(q){let K=rzK(ozK(q));if(izK(K))return!0;if(K.startsWith("../")||K.startsWith("/")||/^[a-z]:/.test(K)){let _=azK(K);if(_!==null&&izK(_))return!0}return!1}function izK(q){if(q===".git"||q.startsWith(".git/"))return!0;return/^git~\d+($|\/)/.test(q)}var Liz;var szK=y(()=>{I7();Da();Liz=["head","objects","refs","hooks"]});var xa1,Ia1,tzK;var ua1=y(()=>{xa1=["-verbose","-debug"],Ia1=["-erroraction","-warningaction","-informationaction","-progressaction","-errorvariable","-warningvariable","-informationvariable","-outvariable","-outbuffer","-pipelinevariable"],tzK=new Set([...xa1,...Ia1])});function FX(q,K){let _=(K?.elementTypes??[]).slice(1),z=K?.args??[],Y=K?.children;for(let $=0;$<_.length;$++){if(_[$]!=="StringConstant"&&_[$]!=="Parameter"){if(!/[$(@{[]/.test(z[$]??""))continue;return!0}if(_[$]==="Parameter"){let A=Y?.[$];if(A){if(A.some((O)=>O.type!=="StringConstant"))return!0}else{let O=z[$]??"",w=O.indexOf(":");if(w>0&&/[$(@{[]/.test(O.slice(w+1)))return!0}}}return!1}function PY(q){let K=q.toLowerCase();if(!K.includes("\\")&&!K.includes("/"))K=K.replace(biz,"");let _=mQ[K];if(_)return _.toLowerCase();return K}function n68(q){let K=PY(q);return K==="set-location"||K==="push-location"||K==="pop-location"||K==="new-psdrive"||Z1()==="windows"&&(K==="ndr"||K==="mount")}function xj6(q){let K=PY(q);return hiz.has(K)}function ma1(q,K){let _=PY(q.name);if(!Siz.has(_))return!1;return bj6(q,K)}function pa1(q){if(q.statementType!=="PipelineAst")return!1;if(q.commands.length===0)return!1;for(let K of q.commands)if(K.elementType!=="CommandAst")return!1;return!0}function xiz(q){let K=q.toLowerCase(),_=ezK[K];if(_)return _;let z=PY(K);if(z!==K)return ezK[z];return}function qYK(q){let K=q.trim();if(!K)return!1;if(/\$\(/.test(K))return!0;if(/(?:^|[^\w.])@\w+/.test(K))return!0;if(/\.\w+\s*\(/.test(K))return!0;if(/\$\w+\s*[+\-*/]?=/.test(K))return!0;if(/--%/.test(K))return!0;if(/\\\\/.test(K)||/(?<!:)\/\//.test(K))return!0;if(/::/.test(K))return!0;return!1}function SI8(q,K){if(!q.trim())return!1;if(!K)return!1;if(!K.valid)return!1;let z=Ky(K);if(z.hasScriptBlocks||z.hasSubExpressions||z.hasExpandableStrings||z.hasSplatting||z.hasMemberInvocations||z.hasAssignments||z.hasStopParsing)return!1;let Y=LI8(K);if(Y.length===0)return!1;if(Y.reduce((A,O)=>A+O.commands.length,0)>1){if(Y.some((O)=>O.commands.some((w)=>n68(w.name))))return!1}for(let A of Y){if(!A||A.commands.length===0)return!1;if(A.redirections.length>0){if(A.redirections.some((j)=>!j.isMerging&&!LL6(j.target)))return!1}let O=A.commands[0];if(!O)return!1;if(!bj6(O,q))return!1;for(let w=1;w<A.commands.length;w++){let j=A.commands[w];if(!j||j.nameType==="application")return!1;if(xj6(j.name)&&j.args.length===0)continue;if(!bj6(j,q))return!1}if(A.nestedCommands&&A.nestedCommands.length>0)return!1}return!0}function bj6(q,K){if(q.nameType==="application"){let $=q.text.split(/\s/,1)[0]?.toLowerCase()??"";if(!Ciz.has($))return!1}let _=xiz(q.name);if(!_)return!1;if(_.regex&&!_.regex.test(K))return!1;if(_.additionalCommandIsDangerousCallback?.(K,q))return!1;if(!q.elementTypes)return!1;for(let $=1;$<q.elementTypes.length;$++){let A=q.elementTypes[$];if(A!=="StringConstant"&&A!=="Parameter"){if(!/[$(@{[]/.test(q.args[$-1]??""))continue;return!1}if(A==="Parameter"){let O=q.children?.[$-1];if(O){if(O.some((w)=>w.type!=="StringConstant"))return!1}else{let w=q.args[$-1]??"",j=w.indexOf(":");if(j>0&&/[$(@{[]/.test(w.slice(j+1)))return!1}}}let z=PY(q.name);if(z==="git"||z==="gh"||z==="docker"||z==="dotnet")return Iiz(z,q.args);let Y=z.includes("-");if(_.allowAllFlags)return!0;if(!_.safeFlags||_.safeFlags.length===0)return!q.args.some((A,O)=>{if(Y)return kK6(A,q.elementTypes?.[O+1]);return A.startsWith("-")||process.platform==="win32"&&A.startsWith("/")});for(let $=0;$<q.args.length;$++){let A=q.args[$];if(Y?kK6(A,q.elementTypes?.[$+1]):A.startsWith("-")||process.platform==="win32"&&A.startsWith("/")){let w=Y?"-"+A.slice(1):A,j=w.indexOf(":");if(j>0)w=w.substring(0,j);let H=w.toLowerCase();if(Y&&tzK.has(H))continue;if(!_.safeFlags.some((M)=>M.toLowerCase()===H))return!1}}return!0}function Iiz(q,K){switch(q){case"git":return Biz(K);case"gh":return giz(K);case"docker":return Fiz(K);case"dotnet":return Uiz(K);default:return!1}}function Biz(q){if(q.length===0)return!0;for(let j of q)if(j.includes("$"))return!1;let K=0;while(K<q.length){let j=q[K];if(!j||!j.startsWith("-"))break;for(let M of piz)if(j.length>M.length&&j.startsWith(M)&&(M==="-C"||j[M.length]!=="-"))return!1;let H=j.includes("="),J=H?j.split("=")[0]||"":j;if(uiz.has(J))return!1;if(!H&&miz.has(J))K+=2;else K++}if(K>=q.length)return!0;let _=q[K]?.toLowerCase()||"",z=K+1<q.length?q[K+1]?.toLowerCase()||"":"",Y=`git ${_} ${z}`,$=`git ${_}`,A=Cn6[Y],O=2;if(!A)A=Cn6[$],O=1;if(!A)return!1;let w=q.slice(K+O);if(_==="ls-remote"){for(let j of w)if(!j.startsWith("-")){if(j.includes("://")||j.includes("@")||j.includes(":")||j.includes("$"))return!1}}if(A.additionalCommandIsDangerousCallback&&A.additionalCommandIsDangerousCallback("",w))return!1;return kv6(w,0,A,{commandName:"git"})}function giz(q){return!1}function Fiz(q){if(q.length===0)return!0;for(let Y of q)if(Y.includes("$"))return!1;let K=`docker ${q[0]?.toLowerCase()}`;if(PT8.includes(K))return!0;let _=XT8[K];if(!_)return!1;let z=q.slice(1);if(_.additionalCommandIsDangerousCallback&&_.additionalCommandIsDangerousCallback("",z))return!1;return kv6(z,0,_)}function Uiz(q){if(q.length===0)return!1;for(let K of q)if(!Riz.has(K.toLowerCase()))return!1;return!0}var Riz,ezK,hiz,Siz,Ciz,biz,uiz,miz,piz;var RL6=y(()=>{vK();Da();Vv6();ua1();Riz=new Set(["--version","--info","--list-runtimes","--list-sdks"]);ezK=Object.assign(Object.create(null),{"get-childitem":{safeFlags:["-Path","-LiteralPath","-Filter","-Include","-Exclude","-Recurse","-Depth","-Name","-Force","-Attributes","-Directory","-File","-Hidden","-ReadOnly","-System"]},"get-content":{safeFlags:["-Path","-LiteralPath","-TotalCount","-Head","-Tail","-Raw","-Encoding","-Delimiter","-ReadCount"]},"get-item":{safeFlags:["-Path","-LiteralPath","-Force","-Stream"]},"get-itemproperty":{safeFlags:["-Path","-LiteralPath","-Name"]},"test-path":{safeFlags:["-Path","-LiteralPath","-PathType","-Filter","-Include","-Exclude","-IsValid","-NewerThan","-OlderThan"]},"resolve-path":{safeFlags:["-Path","-LiteralPath","-Relative"]},"get-filehash":{safeFlags:["-Path","-LiteralPath","-Algorithm","-InputStream"]},"get-acl":{safeFlags:["-Path","-LiteralPath","-Audit","-Filter","-Include","-Exclude"]},"set-location":{safeFlags:["-Path","-LiteralPath","-PassThru","-StackName"]},"push-location":{safeFlags:["-Path","-LiteralPath","-PassThru","-StackName"]},"pop-location":{safeFlags:["-PassThru","-StackName"]},"select-string":{safeFlags:["-Path","-LiteralPath","-Pattern","-InputObject","-SimpleMatch","-CaseSensitive","-Quiet","-List","-NotMatch","-AllMatches","-Encoding","-Context","-Raw","-NoEmphasis"]},"convertto-json":{safeFlags:["-InputObject","-Depth","-Compress","-EnumsAsStrings","-AsArray"]},"convertfrom-json":{safeFlags:["-InputObject","-Depth","-AsHashtable","-NoEnumerate"]},"convertto-csv":{safeFlags:["-InputObject","-Delimiter","-NoTypeInformation","-NoHeader","-UseQuotes"]},"convertfrom-csv":{safeFlags:["-InputObject","-Delimiter","-Header","-UseCulture"]},"convertto-xml":{safeFlags:["-InputObject","-Depth","-As","-NoTypeInformation"]},"convertto-html":{safeFlags:["-InputObject","-Property","-Head","-Title","-Body","-Pre","-Post","-As","-Fragment"]},"format-hex":{safeFlags:["-Path","-LiteralPath","-InputObject","-Encoding","-Count","-Offset"]},"get-member":{safeFlags:["-InputObject","-MemberType","-Name","-Static","-View","-Force"]},"get-unique":{safeFlags:["-InputObject","-AsString","-CaseInsensitive","-OnType"]},"compare-object":{safeFlags:["-ReferenceObject","-DifferenceObject","-Property","-SyncWindow","-CaseSensitive","-Culture","-ExcludeDifferent","-IncludeEqual","-PassThru"]},"join-string":{safeFlags:["-InputObject","-Property","-Separator","-OutputPrefix","-OutputSuffix","-SingleQuote","-DoubleQuote","-FormatString"]},"get-random":{safeFlags:["-InputObject","-Minimum","-Maximum","-Count","-SetSeed","-Shuffle"]},"convert-path":{safeFlags:["-Path","-LiteralPath"]},"join-path":{safeFlags:["-Path","-ChildPath","-AdditionalChildPath"]},"split-path":{safeFlags:["-Path","-LiteralPath","-Qualifier","-NoQualifier","-Parent","-Leaf","-LeafBase","-Extension","-IsAbsolute"]},"get-hotfix":{safeFlags:["-Id","-Description"]},"get-itempropertyvalue":{safeFlags:["-Path","-LiteralPath","-Name"]},"get-psprovider":{safeFlags:["-PSProvider"]},"get-process":{safeFlags:["-Name","-Id","-Module","-FileVersionInfo","-IncludeUserName"]},"get-service":{safeFlags:["-Name","-DisplayName","-DependentServices","-RequiredServices","-Include","-Exclude"]},"get-computerinfo":{allowAllFlags:!0},"get-host":{allowAllFlags:!0},"get-date":{safeFlags:["-Date","-Format","-UFormat","-DisplayHint","-AsUTC"]},"get-location":{safeFlags:["-PSProvider","-PSDrive","-Stack","-StackName"]},"get-psdrive":{safeFlags:["-Name","-PSProvider","-Scope"]},"get-module":{safeFlags:["-Name","-ListAvailable","-All","-FullyQualifiedName","-PSEdition"]},"get-alias":{safeFlags:["-Name","-Definition","-Scope","-Exclude"]},"get-history":{safeFlags:["-Id","-Count"]},"get-culture":{allowAllFlags:!0},"get-uiculture":{allowAllFlags:!0},"get-timezone":{safeFlags:["-Name","-Id","-ListAvailable"]},"get-uptime":{allowAllFlags:!0},"write-output":{safeFlags:["-InputObject","-NoEnumerate"],additionalCommandIsDangerousCallback:FX},"write-host":{safeFlags:["-Object","-NoNewline","-Separator","-ForegroundColor","-BackgroundColor"],additionalCommandIsDangerousCallback:FX},"start-sleep":{safeFlags:["-Seconds","-Milliseconds","-Duration"],additionalCommandIsDangerousCallback:FX},"format-table":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"format-list":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"format-wide":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"format-custom":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"measure-object":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"select-object":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"sort-object":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"group-object":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"where-object":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"out-string":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"out-host":{allowAllFlags:!0,additionalCommandIsDangerousCallback:FX},"get-netadapter":{safeFlags:["-Name","-InterfaceDescription","-InterfaceIndex","-Physical"]},"get-netipaddress":{safeFlags:["-InterfaceIndex","-InterfaceAlias","-AddressFamily","-Type"]},"get-netipconfiguration":{safeFlags:["-InterfaceIndex","-InterfaceAlias","-Detailed","-All"]},"get-netroute":{safeFlags:["-InterfaceIndex","-InterfaceAlias","-AddressFamily","-DestinationPrefix"]},"get-dnsclientcache":{safeFlags:["-Entry","-Name","-Type","-Status","-Section","-Data"]},"get-dnsclient":{safeFlags:["-InterfaceIndex","-InterfaceAlias"]},"get-eventlog":{safeFlags:["-LogName","-Newest","-After","-Before","-EntryType","-Index","-InstanceId","-Message","-Source","-UserName","-AsBaseObject","-List"]},"get-winevent":{safeFlags:["-LogName","-ListLog","-ListProvider","-ProviderName","-Path","-MaxEvents","-FilterXPath","-Force","-Oldest"]},"get-cimclass":{safeFlags:["-ClassName","-Namespace","-MethodName","-PropertyName","-QualifierName"]},git:{},gh:{},docker:{},ipconfig:{safeFlags:["/all","/displaydns","/allcompartments"],additionalCommandIsDangerousCallback:(q,K)=>{return(K?.args??[]).some((_)=>!_.startsWith("/")&&!_.startsWith("-"))}},netstat:{safeFlags:["-a","-b","-e","-f","-n","-o","-p","-q","-r","-s","-t","-x","-y"]},systeminfo:{safeFlags:["/FO","/NH"]},tasklist:{safeFlags:["/M","/SVC","/V","/FI","/FO","/NH"]},"where.exe":{allowAllFlags:!0},hostname:{safeFlags:["-a","-d","-f","-i","-I","-s","-y","-A"],additionalCommandIsDangerousCallback:(q,K)=>{return(K?.args??[]).some((_)=>!_.startsWith("-"))}},whoami:{safeFlags:["/user","/groups","/claims","/priv","/logonid","/all","/fo","/nh"]},ver:{allowAllFlags:!0},arp:{safeFlags:["-a","-g","-v","-N"]},route:{safeFlags:["print","PRINT","-4","-6"],additionalCommandIsDangerousCallback:(q,K)=>{if(!K)return!0;return K.args.find((z)=>!z.startsWith("-"))?.toLowerCase()!=="print"}},getmac:{safeFlags:["/FO","/NH","/V"]},file:{safeFlags:["-b","--brief","-i","--mime","-L","--dereference","--mime-type","--mime-encoding","-z","--uncompress","-p","--preserve-date","-k","--keep-going","-r","--raw","-v","--version","-0","--print0","-s","--special-files","-l","-F","--separator","-e","-P","-N","--no-pad","-E","--extension"]},tree:{safeFlags:["/F","/A","/Q","/L"]},findstr:{safeFlags:["/B","/E","/L","/R","/S","/I","/X","/V","/N","/M","/O","/P","/C","/G","/D","/A"]},dotnet:{}}),hiz=new Set(["out-null"]),Siz=new Set(["format-table","format-list","format-wide","format-custom","measure-object","select-object","sort-object","group-object","where-object","out-string","out-host"]),Ciz=new Set(["where.exe"]),biz=/\.(exe|cmd|bat|com)$/;uiz=new Set(["-c","-C","--exec-path","--config-env","--git-dir","--work-tree","--attr-source"]),miz=new Set(["-c","-C","--exec-path","--config-env","--git-dir","--work-tree","--namespace","--super-prefix","--shallow-file"]),piz=["-c","-C"]});function Ba1(q){let K=PY(q);return Qiz.has(K)}function ciz(q){return q.length>=3&&"-itemtype".startsWith(q)||q.length>=3&&"-type".startsWith(q)}function ga1(q){if(PY(q.name)!=="new-item")return!1;for(let _=0;_<q.args.length;_++){let z=q.args[_]??"";if(z.length===0)continue;let $=(Wa.has(z[0])||z[0]==="/"?"-"+z.slice(1):z).toLowerCase(),A=$.indexOf(":",1),w=(A>0?$.slice(0,A):$).replace(/`/g,"");if(!ciz(w))continue;let H=(A>0?$.slice(A+1):q.args[_+1]?.toLowerCase()??"").replace(/`/g,"").replace(/^['"]|['"]$/g,"");if(diz.has(H))return!0}return!1}function Fa1(q,K,_){if(_.mode==="bypassPermissions"||_.mode==="dontAsk")return{behavior:"passthrough",message:"Mode is handled in main permission flow"};if(_.mode!=="acceptEdits")return{behavior:"passthrough",message:"No mode-specific validation required"};if(!K.valid)return{behavior:"passthrough",message:"Cannot validate mode for unparsed command"};let z=Ky(K);if(z.hasSubExpressions||z.hasScriptBlocks||z.hasMemberInvocations||z.hasSplatting||z.hasAssignments||z.hasStopParsing||z.hasExpandableStrings)return{behavior:"passthrough",message:"Command contains subexpressions, script blocks, or member invocations that require approval"};let Y=LI8(K);if(Y.length===0)return{behavior:"passthrough",message:"No commands found to validate for acceptEdits mode"};if(Y.reduce((A,O)=>A+O.commands.length,0)>1){let A=!1,O=!1,w=!1;for(let j of Y)for(let H of j.commands){if(H.elementType!=="CommandAst")continue;if(n68(H.name))A=!0;if(ga1(H))O=!0;if(Ba1(H.name))w=!0}if(A&&w)return{behavior:"passthrough",message:"Compound command contains a directory-changing command (Set-Location/Push-Location/Pop-Location) with a write operation — cannot auto-allow because path validation uses stale cwd"};if(O)return{behavior:"passthrough",message:"Compound command creates a filesystem link (New-Item -ItemType SymbolicLink/Junction/HardLink) — cannot auto-allow because path validation cannot follow just-created links"}}for(let A of Y){for(let O of A.commands){if(O.elementType!=="CommandAst")return{behavior:"passthrough",message:`Pipeline contains expression source (${O.elementType}) that cannot be statically validated`};if(O.nameType==="application")return{behavior:"passthrough",message:`Command '${O.name}' resolved from a path-like name and requires approval`};if(O.elementTypes)for(let w=1;w<O.elementTypes.length;w++){let j=O.elementTypes[w];if(j!=="StringConstant"&&j!=="Parameter")return{behavior:"passthrough",message:`Command argument has unvalidatable type (${j}) — variable paths cannot be statically resolved`};if(j==="Parameter"){let H=O.args[w-1]??"",J=H.indexOf(":");if(J>0&&/[$(@{[]/.test(H.slice(J+1)))return{behavior:"passthrough",message:"Colon-bound parameter contains an expression that cannot be statically validated"}}}if(xj6(O.name)||ma1(O,q.command))continue;if(!Ba1(O.name))return{behavior:"passthrough",message:`No mode-specific handling for '${O.name}' in acceptEdits mode`};if(FX(O.name,O))return{behavior:"passthrough",message:`Arguments in '${O.name}' cannot be statically validated in acceptEdits mode`}}if(A.nestedCommands)for(let O of A.nestedCommands){if(O.elementType!=="CommandAst")return{behavior:"passthrough",message:`Nested expression element (${O.elementType}) cannot be statically validated`};if(O.nameType==="application")return{behavior:"passthrough",message:`Nested command '${O.name}' resolved from a path-like name and requires approval`};if(xj6(O.name)||ma1(O,q.command))continue;if(!Ba1(O.name))return{behavior:"passthrough",message:`No mode-specific handling for '${O.name}' in acceptEdits mode`};if(FX(O.name,O))return{behavior:"passthrough",message:`Arguments in nested '${O.name}' cannot be statically validated in acceptEdits mode`}}}return{behavior:"allow",updatedInput:q,decisionReason:{type:"mode",mode:"acceptEdits"}}}var Qiz,diz;var KYK=y(()=>{Da();RL6();Qiz=new Set(["set-content","add-content","remove-item","clear-content"]);diz=new Set(["symboliclink","junction","hardlink"])});import{homedir as liz}from"os";import{isAbsolute as uI8,resolve as mI8}from"path";function CI8(q,K){for(let _ of K)if(_===q||q.length>1&&_.startsWith(q))return!0;return!1}function bI8(q){return q.includes(",")||q.startsWith("(")||q.startsWith("[")||q.includes("`")||q.includes("@(")||q.startsWith("@{")||q.includes("$")}function xI8(q){let K=q.length;if(K<=Ua1)return q.map((z)=>`'${z}'`).join(", ");return`${q.slice(0,Ua1).map((z)=>`'${z}'`).join(", ")}, and ${K-Ua1} more`}function ca1(q){if(q==="~"||q.startsWith("~/")||q.startsWith("~\\"))return liz()+q.slice(1);return q}function pI8(q){let K=ca1(q.replace(/^['"]|['"]$/g,"")).replace(/\\/g,"/");return Nv6(K)}function hL6(q){return{behavior:"deny",message:`Remove-Item on system path '${q}' is blocked. This path is protected from removal.`,decisionReason:{type:"other",reason:"Removal targets a protected system path"}}}function _YK(q,K,_,z){let Y=_==="read"?"read":"edit",$=VH(q,K,Y,"deny");if($!==null)return{allowed:!1,decisionReason:{type:"rule",rule:$}};if(_!=="read"){let w=un6(q,{});if(w.behavior==="allow")return{allowed:!0,decisionReason:w.decisionReason}}if(_!=="read"){let w=In6(q,z);if(!w.safe)return{allowed:!1,decisionReason:{type:"safetyCheck",reason:w.message,classifierApprovable:w.classifierApprovable}}}let A=XL(q,K,z);if(A){if(_==="read"||K.mode==="acceptEdits")return{allowed:!0}}if(_==="read"){let w=mn6(q,{});if(w.behavior==="allow")return{allowed:!0,decisionReason:w.decisionReason}}if(_!=="read"&&!A&&HS1(q))return{allowed:!0,decisionReason:{type:"other",reason:"Path is in sandbox write allowlist"}};let O=VH(q,K,Y,"allow");if(O!==null)return{allowed:!0,decisionReason:{type:"rule",rule:O}};return{allowed:!1}}function da1(q,K,_,z){if(!q||q.includes("\x00"))return null;let Y=ca1(q),$=uI8(Y)?Y:mI8(K,Y),{resolvedPath:A}=F$(X8(),$),w=VH(A,_,z==="read"?"read":"edit","deny");return w?{resolvedPath:A,rule:w}:null}function II8(q,K,_,z){let $=ca1(q.replace(/^['"]|['"]$/g,"")).replace(/\\/g,"/");if($.includes("`")){let J=$.replace(/`/g,""),M=da1(J,K,_,z);if(M)return{allowed:!1,resolvedPath:M.resolvedPath,decisionReason:{type:"rule",rule:M.rule}};return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:"Backtick escape characters in paths cannot be statically validated and require manual approval"}}}if($.includes("::")){let J=$.slice($.indexOf("::")+2),M=da1(J,K,_,z);if(M)return{allowed:!1,resolvedPath:M.resolvedPath,decisionReason:{type:"rule",rule:M.rule}};return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:"Module-qualified provider paths (::) cannot be statically validated and require manual approval"}}}if($.startsWith("//")||/DavWWWRoot/i.test($)||/@SSL@/i.test($))return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:"UNC paths are blocked because they can trigger network requests and credential leakage"}};if($.includes("$")||$.includes("%"))return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:"Variable expansion syntax in paths requires manual approval"}};if((Z1()==="windows"?/^[a-z0-9]{2,}:/i:/^[a-z0-9]+:/i).test($))return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:`Path '${$}' uses a non-filesystem provider and requires manual approval`}};if(YYK.test($)){if(z==="write"||z==="create")return{allowed:!1,resolvedPath:$,decisionReason:{type:"other",reason:"Glob patterns are not allowed in write operations. Please specify an exact file path."}};if(yB($)){let D=uI8($)?$:mI8(K,$),{resolvedPath:f,isCanonical:G}=F$(X8(),D),Z=_YK(f,_,z,G?[f]:void 0);return{allowed:Z.allowed,resolvedPath:f,decisionReason:Z.decisionReason}}let J=niz($),M=uI8(J)?J:mI8(K,J),{resolvedPath:X}=F$(X8(),M),W=VH(X,_,z==="read"?"read":"edit","deny");if(W!==null)return{allowed:!1,resolvedPath:X,decisionReason:{type:"rule",rule:W}};return{allowed:!1,resolvedPath:X,decisionReason:{type:"other",reason:"Glob patterns in paths cannot be statically validated — symlinks inside the glob expansion are not examined. Requires manual approval."}}}let O=uI8($)?$:mI8(K,$),{resolvedPath:w,isCanonical:j}=F$(X8(),O),H=_YK(w,_,z,j?[w]:void 0);return{allowed:H.allowed,resolvedPath:w,decisionReason:H.decisionReason}}function niz(q){let K=q.match(YYK);if(!K||K.index===void 0)return q;let _=q.substring(0,K.index),z=Math.max(_.lastIndexOf("/"),_.lastIndexOf("\\"));if(z===-1)return".";return _.substring(0,z+1)||"/"}function zYK(q){let K=PY(q.name),_=Qa1[K];if(!_)return{paths:[],operationType:"read",hasUnvalidatablePathArg:!1,optionalWrite:!1};let z=[..._.knownSwitches,...xa1],Y=[..._.knownValueParams,...Ia1],$=[],A=q.args,O=q.elementTypes,w=!1,j=0,H=_.positionalSkip??0;function J(M){if(!O)return;let X=O[M+1];if(X&&!iiz.has(X))w=!0}for(let M=0;M<A.length;M++){let X=A[M];if(!X)continue;let P=O?O[M+1]:void 0;if(kK6(X,P)){let W="-"+X.slice(1),D=W.indexOf(":",1),G=(D>0?W.substring(0,D):W).toLowerCase();if(CI8(G,_.pathParams)){let Z;if(D>0){let T=X.substring(D+1);if(bI8(T))w=!0;else Z=T}else{let T=A[M+1],v=O?O[M+2]:void 0;if(T&&!kK6(T,v))Z=T,J(M+1),M++}if(Z)$.push(Z)}else if(_.leafOnlyPathParams&&CI8(G,_.leafOnlyPathParams)){let Z;if(D>0){let T=X.substring(D+1);if(bI8(T))w=!0;else Z=T}else{let T=A[M+1],v=O?O[M+2]:void 0;if(T&&!kK6(T,v))Z=T,J(M+1),M++}if(Z!==void 0)if(Z.includes("/")||Z.includes("\\")||Z==="."||Z==="..")w=!0;else $.push(Z)}else if(CI8(G,z));else if(CI8(G,Y))if(D>0){let Z=X.substring(D+1);if(bI8(Z))w=!0}else{let Z=A[M+1],T=O?O[M+2]:void 0;if(Z&&!kK6(Z,T))J(M+1),M++}else if(w=!0,D>0){let Z=X.substring(D+1);if(!bI8(Z))$.push(Z)}continue}if(j<H){j++;continue}j++,J(M),$.push(X)}return{paths:$,operationType:_.operationType,hasUnvalidatablePathArg:w,optionalWrite:_.optionalWrite??!1}}function $YK(q,K,_,z=!1){if(!K.valid)return{behavior:"passthrough",message:"Cannot validate paths for unparsed command"};let Y;for(let $ of K.statements){let A=riz($,_,z);if(A.behavior==="deny")return A;if(A.behavior==="ask"&&!Y)Y=A}return Y??{behavior:"passthrough",message:"All path constraints validated successfully"}}function riz(q,K,_=!1){let z=Z8(),Y;if(_)Y={behavior:"ask",message:"Compound command changes working directory (Set-Location/Push-Location/Pop-Location/New-PSDrive) — relative paths cannot be validated against the original cwd and require manual approval",decisionReason:{type:"other",reason:"Compound command contains cd with path operation — manual approval required to prevent path resolution bypass"}};let $=!1,A;for(let O of q.commands){if(O.elementType!=="CommandAst"){$=!0,A=O.text;continue}let{paths:w,operationType:j,hasUnvalidatablePathArg:H,optionalWrite:J}=zYK(O);if($){let X=PY(O.name);if(A!==void 0){let P=A.replace(/^['"]|['"]$/g,""),W=da1(P,z,K,j);if(W)return{behavior:"deny",message:`${X} targeting '${W.resolvedPath}' was blocked by a deny rule`,decisionReason:{type:"rule",rule:W.rule}}}Y??={behavior:"ask",message:`${X} receives its path from a pipeline expression source that cannot be statically validated and requires manual approval`}}if(H){let X=PY(O.name);Y??={behavior:"ask",message:`${X} uses a parameter or complex path expression (array literal, subexpression, unknown parameter, etc.) that cannot be statically validated and requires manual approval`}}if(j!=="read"&&!J&&w.length===0&&Qa1[PY(O.name)]){let X=PY(O.name);Y??={behavior:"ask",message:`${X} is a write operation but no target path could be determined; requires manual approval`};continue}let M=PY(O.name)==="remove-item";for(let X of w){if(M&&pI8(X))return hL6(X);let{allowed:P,resolvedPath:W,decisionReason:D}=II8(X,z,K,j);if(M&&Nv6(W))return hL6(W);if(!P){let f=PY(O.name),G=Array.from(ku(K)),Z=xI8(G),T=D?.type==="other"||D?.type==="safetyCheck"?D.reason:`${f} targeting '${W}' was blocked. For security, Claude Code may only access files in the allowed working directories for this session: ${Z}.`;if(D?.type==="rule")return{behavior:"deny",message:T,decisionReason:D};let v=[];if(W)if(j==="read"){let V=Kw6(IZ(W),"session");if(V)v.push(V)}else v.push({type:"addDirectories",directories:[IZ(W)],destination:"session"});if(j==="write"||j==="create")v.push({type:"setMode",mode:"acceptEdits",destination:"session"});Y??={behavior:"ask",message:T,blockedPath:W,decisionReason:D,suggestions:v}}}}if(q.nestedCommands)for(let O of q.nestedCommands){let{paths:w,operationType:j,hasUnvalidatablePathArg:H,optionalWrite:J}=zYK(O);if(H){let X=PY(O.name);Y??={behavior:"ask",message:`${X} uses a parameter or complex path expression (array literal, subexpression, unknown parameter, etc.) that cannot be statically validated and requires manual approval`}}if(j!=="read"&&!J&&w.length===0&&Qa1[PY(O.name)]){let X=PY(O.name);Y??={behavior:"ask",message:`${X} is a write operation but no target path could be determined; requires manual approval`};continue}let M=PY(O.name)==="remove-item";for(let X of w){if(M&&pI8(X))return hL6(X);let{allowed:P,resolvedPath:W,decisionReason:D}=II8(X,z,K,j);if(M&&Nv6(W))return hL6(W);if(!P){let f=PY(O.name),G=Array.from(ku(K)),Z=xI8(G),T=D?.type==="other"||D?.type==="safetyCheck"?D.reason:`${f} targeting '${W}' was blocked. For security, Claude Code may only access files in the allowed working directories for this session: ${Z}.`;if(D?.type==="rule")return{behavior:"deny",message:T,decisionReason:D};let v=[];if(W)if(j==="read"){let V=Kw6(IZ(W),"session");if(V)v.push(V)}else v.push({type:"addDirectories",directories:[IZ(W)],destination:"session"});if(j==="write"||j==="create")v.push({type:"setMode",mode:"acceptEdits",destination:"session"});Y??={behavior:"ask",message:T,blockedPath:W,decisionReason:D,suggestions:v}}}if($)Y??={behavior:"ask",message:`${PY(O.name)} appears inside a control-flow or chain statement where piped expression sources cannot be statically validated and requires manual approval`}}if(q.nestedCommands){for(let O of q.nestedCommands)if(O.redirections)for(let w of O.redirections){if(w.isMerging)continue;if(!w.target)continue;if(LL6(w.target))continue;let{allowed:j,resolvedPath:H,decisionReason:J}=II8(w.target,z,K,"create");if(!j){let M=Array.from(ku(K)),X=xI8(M),P=J?.type==="other"||J?.type==="safetyCheck"?J.reason:`Output redirection to '${H}' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session: ${X}.`;if(J?.type==="rule")return{behavior:"deny",message:P,decisionReason:J};Y??={behavior:"ask",message:P,blockedPath:H,decisionReason:J,suggestions:[{type:"addDirectories",directories:[IZ(H)],destination:"session"}]}}}}if(q.redirections)for(let O of q.redirections){if(O.isMerging)continue;if(!O.target)continue;if(LL6(O.target))continue;let{allowed:w,resolvedPath:j,decisionReason:H}=II8(O.target,z,K,"create");if(!w){let J=Array.from(ku(K)),M=xI8(J),X=H?.type==="other"||H?.type==="safetyCheck"?H.reason:`Output redirection to '${j}' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session: ${M}.`;if(H?.type==="rule")return{behavior:"deny",message:X,decisionReason:H};Y??={behavior:"ask",message:X,blockedPath:j,decisionReason:H,suggestions:[{type:"addDirectories",directories:[IZ(j)],destination:"session"}]}}}return Y??{behavior:"passthrough",message:"All path constraints validated successfully"}}var Ua1=5,YYK,Qa1,iiz;var AYK=y(()=>{I7();e7();dz();Tz();LH();xn6();vK();Da();ua1();RL6();YYK=/[*?[\]]/,Qa1={"set-content":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-passthru","-force","-whatif","-confirm","-usetransaction","-nonewline","-asbytestream"],knownValueParams:["-value","-filter","-include","-exclude","-credential","-encoding","-stream"]},"add-content":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-passthru","-force","-whatif","-confirm","-usetransaction","-nonewline","-asbytestream"],knownValueParams:["-value","-filter","-include","-exclude","-credential","-encoding","-stream"]},"remove-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-recurse","-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential","-stream"]},"clear-content":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential","-stream"]},"out-file":{operationType:"write",pathParams:["-filepath","-path","-literalpath","-pspath","-lp"],knownSwitches:["-append","-force","-noclobber","-nonewline","-whatif","-confirm"],knownValueParams:["-inputobject","-encoding","-width"]},"tee-object":{operationType:"write",pathParams:["-filepath","-path","-literalpath","-pspath","-lp"],knownSwitches:["-append"],knownValueParams:["-inputobject","-variable","-encoding"]},"export-csv":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-append","-force","-noclobber","-notypeinformation","-includetypeinformation","-useculture","-noheader","-whatif","-confirm"],knownValueParams:["-inputobject","-delimiter","-encoding","-quotefields","-usequotes"]},"export-clixml":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-noclobber","-whatif","-confirm"],knownValueParams:["-inputobject","-depth","-encoding"]},"new-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],leafOnlyPathParams:["-name"],knownSwitches:["-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-itemtype","-value","-credential","-type"]},"copy-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp","-destination"],knownSwitches:["-container","-force","-passthru","-recurse","-whatif","-confirm","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential","-fromsession","-tosession"]},"move-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp","-destination"],knownSwitches:["-force","-passthru","-whatif","-confirm","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential"]},"rename-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-passthru","-whatif","-confirm","-usetransaction"],knownValueParams:["-newname","-credential","-filter","-include","-exclude"]},"set-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-passthru","-whatif","-confirm","-usetransaction"],knownValueParams:["-value","-credential","-filter","-include","-exclude"]},"get-content":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-usetransaction","-wait","-raw","-asbytestream"],knownValueParams:["-readcount","-totalcount","-tail","-first","-head","-last","-filter","-include","-exclude","-credential","-delimiter","-encoding","-stream"]},"get-childitem":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-recurse","-force","-name","-usetransaction","-followsymlink","-directory","-file","-hidden","-readonly","-system"],knownValueParams:["-filter","-include","-exclude","-depth","-attributes","-credential"]},"get-item":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential","-stream"]},"get-itemproperty":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-usetransaction"],knownValueParams:["-name","-filter","-include","-exclude","-credential"]},"get-itempropertyvalue":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-usetransaction"],knownValueParams:["-name","-filter","-include","-exclude","-credential"]},"get-filehash":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:[],knownValueParams:["-algorithm","-inputstream"]},"get-acl":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-audit","-allcentralaccesspolicies","-usetransaction"],knownValueParams:["-inputobject","-filter","-include","-exclude"]},"format-hex":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-raw"],knownValueParams:["-inputobject","-encoding","-count","-offset"]},"test-path":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-isvalid","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-pathtype","-credential","-olderthan","-newerthan"]},"resolve-path":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-relative","-usetransaction","-force"],knownValueParams:["-credential","-relativebasepath"]},"convert-path":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-usetransaction"],knownValueParams:[]},"select-string":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-simplematch","-casesensitive","-quiet","-list","-notmatch","-allmatches","-noemphasis","-raw"],knownValueParams:["-inputobject","-pattern","-include","-exclude","-encoding","-context","-culture"]},"set-location":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-passthru","-usetransaction"],knownValueParams:["-stackname"]},"push-location":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-passthru","-usetransaction"],knownValueParams:["-stackname"]},"pop-location":{operationType:"read",pathParams:[],knownSwitches:["-passthru","-usetransaction"],knownValueParams:["-stackname"]},"select-xml":{operationType:"read",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:[],knownValueParams:["-xml","-content","-xpath","-namespace"]},"get-winevent":{operationType:"read",pathParams:["-path"],knownSwitches:["-force","-oldest"],knownValueParams:["-listlog","-logname","-listprovider","-providername","-maxevents","-computername","-credential","-filterxpath","-filterxml","-filterhashtable"]},"invoke-webrequest":{operationType:"write",pathParams:["-outfile","-infile"],positionalSkip:1,optionalWrite:!0,knownSwitches:["-allowinsecureredirect","-allowunencryptedauthentication","-disablekeepalive","-nobodyprogress","-passthru","-preservefileauthorizationmetadata","-resume","-skipcertificatecheck","-skipheadervalidation","-skiphttperrorcheck","-usebasicparsing","-usedefaultcredentials"],knownValueParams:["-uri","-method","-body","-contenttype","-headers","-maximumredirection","-maximumretrycount","-proxy","-proxycredential","-retryintervalsec","-sessionvariable","-timeoutsec","-token","-transferencoding","-useragent","-websession","-credential","-authentication","-certificate","-certificatethumbprint","-form","-httpversion"]},"invoke-restmethod":{operationType:"write",pathParams:["-outfile","-infile"],positionalSkip:1,optionalWrite:!0,knownSwitches:["-allowinsecureredirect","-allowunencryptedauthentication","-disablekeepalive","-followrellink","-nobodyprogress","-passthru","-preservefileauthorizationmetadata","-resume","-skipcertificatecheck","-skipheadervalidation","-skiphttperrorcheck","-usebasicparsing","-usedefaultcredentials"],knownValueParams:["-uri","-method","-body","-contenttype","-headers","-maximumfollowrellink","-maximumredirection","-maximumretrycount","-proxy","-proxycredential","-responseheaderstvariable","-retryintervalsec","-sessionvariable","-statuscodevariable","-timeoutsec","-token","-transferencoding","-useragent","-websession","-credential","-authentication","-certificate","-certificatethumbprint","-form","-httpversion"]},"expand-archive":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp","-destinationpath"],knownSwitches:["-force","-passthru","-whatif","-confirm"],knownValueParams:[]},"compress-archive":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp","-destinationpath"],knownSwitches:["-force","-update","-passthru","-whatif","-confirm"],knownValueParams:["-compressionlevel"]},"set-itemproperty":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-passthru","-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-name","-value","-type","-filter","-include","-exclude","-credential","-inputobject"]},"new-itemproperty":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-name","-value","-propertytype","-type","-filter","-include","-exclude","-credential"]},"remove-itemproperty":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-name","-filter","-include","-exclude","-credential"]},"clear-item":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-force","-whatif","-confirm","-usetransaction"],knownValueParams:["-filter","-include","-exclude","-credential"]},"export-alias":{operationType:"write",pathParams:["-path","-literalpath","-pspath","-lp"],knownSwitches:["-append","-force","-noclobber","-passthru","-whatif","-confirm"],knownValueParams:["-name","-description","-scope","-as"]}};iiz=new Set(["StringConstant","Parameter"])});var i68,OYK;var la1=y(()=>{i68=["python","python3","python2","node","deno","tsx","ruby","perl","php","lua","npx","bunx","npm run","yarn run","pnpm run","bun run","bash","sh","ssh"],OYK=[...i68,"zsh","fish","eval","exec","env","xargs","sudo",...[]]});function aiz(q){return Object.entries(mQ).filter(([,K])=>q.has(K.toLowerCase())).map(([K])=>K)}var na1,ia1,ra1,oiz,siz,tiz,eiz,qrz,wYK;var oa1=y(()=>{la1();Da();na1=new Set(["invoke-command","start-job","start-threadjob","register-scheduledjob"]),ia1=new Set(["invoke-command","invoke-expression","start-job","start-threadjob","register-scheduledjob","register-engineevent","register-objectevent","register-wmievent","new-pssession","enter-pssession"]),ra1=new Set(["import-module","ipmo","install-module","save-module","update-module","install-script","save-script"]),oiz=["pwsh","powershell","cmd","bash","wsl","sh","start-process","start","add-type","new-object"];siz=new Set(["invoke-webrequest","invoke-restmethod"]),tiz=new Set(["set-alias","sal","new-alias","nal","set-variable","sv","new-variable","nv"]),eiz=new Set(["invoke-wmimethod","iwmi","invoke-cimmethod"]),qrz=new Set(["select-object","sort-object","group-object","where-object","measure-object","write-output","write-host","start-sleep","format-table","format-list","format-wide","format-custom","out-string","out-host","ipconfig","hostname","route"]),wYK=(()=>{let q=new Set([...oiz,...na1,...ia1,...ra1,...siz,...tiz,...eiz,...qrz,"foreach-object",...i68.filter((K)=>!K.includes(" "))]);return new Set([...q,...aiz(q)])})()});function _rz(q){return q.toLowerCase().replace(/\[\]$/,"").replace(/\[.*\]$/,"").trim()}function aa1(q){return Krz.has(_rz(q))}var Krz;var jYK=y(()=>{Krz=new Set(["alias","allowemptycollection","allowemptystring","allownull","argumentcompleter","argumentcompletions","array","bigint","bool","byte","char","cimclass","cimconverter","ciminstance","cimtype","cmdletbinding","cultureinfo","datetime","decimal","double","dsclocalconfigurationmanager","dscproperty","dscresource","experimentaction","experimental","experimentalfeature","float","guid","hashtable","int","int16","int32","int64","ipaddress","ipendpoint","long","mailaddress","norunspaceaffinity","nullstring","objectsecurity","ordered","outputtype","parameter","physicaladdress","pscredential","pscustomobject","psdefaultvalue","pslistmodifier","psobject","psprimitivedictionary","pstypenameattribute","ref","regex","sbyte","securestring","semver","short","single","string","supportswildcards","switch","timespan","uint","uint16","uint32","uint64","ulong","uri","ushort","validatecount","validatedrive","validatelength","validatenotnull","validatenotnullorempty","validatenotnullorwhitespace","validatepattern","validaterange","validatescript","validateset","validatetrusteddata","validateuserdrive","version","void","wildcardpattern","x500distinguishedname","x509certificate","xml","system.array","system.boolean","system.byte","system.char","system.datetime","system.decimal","system.double","system.guid","system.int16","system.int32","system.int64","system.numerics.biginteger","system.sbyte","system.single","system.string","system.timespan","system.uint16","system.uint32","system.uint64","system.uri","system.version","system.void","system.collections.hashtable","system.text.regularexpressions.regex","system.globalization.cultureinfo","system.net.ipaddress","system.net.ipendpoint","system.net.mail.mailaddress","system.net.networkinformation.physicaladdress","system.security.securestring","system.security.cryptography.x509certificates.x509certificate","system.security.cryptography.x509certificates.x500distinguishedname","system.xml.xmldocument","system.management.automation.pscredential","system.management.automation.pscustomobject","system.management.automation.pslistmodifier","system.management.automation.psobject","system.management.automation.psprimitivedictionary","system.management.automation.psreference","system.management.automation.semanticversion","system.management.automation.switchparameter","system.management.automation.wildcardpattern","system.management.automation.language.nullstring","microsoft.management.infrastructure.cimclass","microsoft.management.infrastructure.cimconverter","microsoft.management.infrastructure.ciminstance","microsoft.management.infrastructure.cimtype","system.collections.specialized.ordereddictionary","system.security.accesscontrol.objectsecurity","object","system.object","microsoft.powershell.commands.modulespecification"].map((q)=>q.toLowerCase()))});function sa1(q){let K=q.toLowerCase();if(HYK.has(K))return!0;let _=Math.max(K.lastIndexOf("/"),K.lastIndexOf("\\"));if(_>=0)return HYK.has(K.slice(_+1));return!1}function SL6(q,K,_){if(ba1(q,K,_))return!0;let z={...q,args:q.args.map((Y)=>Y.length>0&&zrz.has(Y[0])?"-"+Y.slice(1):Y)};return ba1(z,K,_)}function Yrz(q){if(Ca1(q,"Invoke-Expression"))return{behavior:"ask",message:"Command uses Invoke-Expression which can execute arbitrary code"};return{behavior:"passthrough"}}function $rz(q){for(let K of gX(q)){if(K.elementType!=="CommandAst")continue;let _=K.elementTypes?.[0];if(_!==void 0&&_!=="StringConstant")return{behavior:"ask",message:"Command name is a dynamic expression which cannot be statically validated"}}return{behavior:"passthrough"}}function Arz(q){for(let K of gX(q))if(sa1(K.name)){if(SL6(K,"-encodedcommand","-e"))return{behavior:"ask",message:"Command uses encoded parameters which obscure intent"}}return{behavior:"passthrough"}}function Orz(q){for(let K of gX(q))if(sa1(K.name))return{behavior:"ask",message:"Command spawns a nested PowerShell process which cannot be validated"};return{behavior:"passthrough"}}function JYK(q){return wrz.has(q.toLowerCase())}function MYK(q){let K=q.toLowerCase();return K==="invoke-expression"||K==="iex"}function jrz(q){for(let _ of q.statements){let z=_.commands;if(z.length<2)continue;let Y=z.some((A)=>JYK(A.name)),$=z.some((A)=>MYK(A.name));if(Y&&$)return{behavior:"ask",message:"Command downloads and executes remote code"}}let K=gX(q);if(K.some((_)=>JYK(_.name))&&K.some((_)=>MYK(_.name)))return{behavior:"ask",message:"Command downloads and executes remote code"};return{behavior:"passthrough"}}function Hrz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(_==="start-bitstransfer")return{behavior:"ask",message:"Command downloads files via BITS transfer"};if(_==="certutil"||_==="certutil.exe"){if(K.args.some((Y)=>{let $=Y.toLowerCase();return $==="-urlcache"||$==="/urlcache"}))return{behavior:"ask",message:"Command uses certutil to download from a URL"}}if(_==="bitsadmin"||_==="bitsadmin.exe"){if(K.args.some((z)=>z.toLowerCase()==="/transfer"))return{behavior:"ask",message:"Command downloads files via BITS transfer"}}}return{behavior:"passthrough"}}function Jrz(q){if(Ca1(q,"Add-Type"))return{behavior:"ask",message:"Command compiles and loads .NET code"};return{behavior:"passthrough"}}function Mrz(q){for(let K of gX(q)){if(K.name.toLowerCase()!=="new-object")continue;if(SL6(K,"-comobject","-com"))return{behavior:"ask",message:"Command instantiates a COM object which may have execution capabilities"};let _;for(let z=0;z<K.args.length;z++){let Y=K.args[z],$=Y.toLowerCase();if($.startsWith("-t")&&$.includes(":")){let A=Y.indexOf(":"),O=$.slice(0,A);if("-typename".startsWith(O)){_=Y.slice(A+1);break}}if($.startsWith("-t")&&"-typename".startsWith($)&&K.args[z+1]!==void 0){_=K.args[z+1];break}}if(_===void 0){let z=new Set(["-argumentlist","-comobject","-property"]),Y=new Set(["-strict"]);for(let $=0;$<K.args.length;$++){let A=K.args[$];if(A.startsWith("-")){let O=A.toLowerCase();if(O.startsWith("-t")&&"-typename".startsWith(O)){$++;continue}if(O.includes(":"))continue;if(Y.has(O))continue;if(z.has(O)){$++;continue}continue}_=A;break}}if(_!==void 0&&!aa1(_))return{behavior:"ask",message:`New-Object instantiates .NET type '${_}' outside the ConstrainedLanguage allowlist`}}return{behavior:"passthrough"}}function Xrz(q){for(let K of gX(q)){let _=K.name.toLowerCase(),z=mQ[_]?.toLowerCase()??_;if(!na1.has(z))continue;if(SL6(K,"-filepath","-f")||SL6(K,"-literalpath","-l"))return{behavior:"ask",message:`${K.name} -FilePath executes an arbitrary script file`};for(let Y=0;Y<K.args.length;Y++){let $=K.elementTypes?.[Y+1],A=K.args[Y];if($==="StringConstant"&&A&&!A.startsWith("-"))return{behavior:"ask",message:`${K.name} with positional string argument binds to -FilePath and executes a script file`}}}return{behavior:"passthrough"}}function Prz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if((mQ[_]?.toLowerCase()??_)!=="foreach-object")continue;if(SL6(K,"-membername","-m"))return{behavior:"ask",message:"ForEach-Object -MemberName invokes methods by string name which cannot be validated"};for(let Y=0;Y<K.args.length;Y++){let $=K.elementTypes?.[Y+1],A=K.args[Y];if($==="StringConstant"&&A&&!A.startsWith("-"))return{behavior:"ask",message:"ForEach-Object with positional string argument binds to -MemberName and invokes methods by name"}}}return{behavior:"passthrough"}}function Wrz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(_!=="start-process"&&_!=="saps"&&_!=="start")continue;if(SL6(K,"-Verb","-v")&&K.args.some((z)=>z.toLowerCase()==="runas"))return{behavior:"ask",message:"Command requests elevated privileges"};if(K.children)for(let z=0;z<K.args.length;z++){let Y=K.args[z].replace(/`/g,"");if(!/^[-\u2013\u2014\u2015/]v[a-z]*:/i.test(Y))continue;let $=K.children[z];if(!$)continue;for(let A of $)if(A.text.replace(/['"`\s]/g,"").toLowerCase()==="runas")return{behavior:"ask",message:"Command requests elevated privileges"}}if(K.args.some((z)=>{let Y=z.replace(/`/g,"");return/^[-\u2013\u2014\u2015/]v[a-z]*:['"` ]*runas['"` ]*$/i.test(Y)}))return{behavior:"ask",message:"Command requests elevated privileges"};for(let z of K.args){let Y=z.replace(/^['"]|['"]$/g,"");if(sa1(Y))return{behavior:"ask",message:"Start-Process launches a nested PowerShell process which cannot be validated"}}}return{behavior:"passthrough"}}function Drz(q){if(!Ky(q).hasScriptBlocks)return{behavior:"passthrough"};for(let z of gX(q)){let Y=z.name.toLowerCase();if(ia1.has(Y))return{behavior:"ask",message:"Command contains script block with dangerous cmdlet that may execute arbitrary code"}}if(gX(q).every((z)=>{let Y=z.name.toLowerCase();if(XYK.has(Y))return!0;let $=mQ[Y];if($&&XYK.has($.toLowerCase()))return!0;return!1}))return{behavior:"passthrough"};return{behavior:"ask",message:"Command contains script block that may execute arbitrary code"}}function frz(q){if(Ky(q).hasSubExpressions)return{behavior:"ask",message:"Command contains subexpressions $()"};return{behavior:"passthrough"}}function Zrz(q){if(Ky(q).hasExpandableStrings)return{behavior:"ask",message:"Command contains expandable strings with embedded expressions"};return{behavior:"passthrough"}}function Grz(q){if(Ky(q).hasSplatting)return{behavior:"ask",message:"Command uses splatting (@variable)"};return{behavior:"passthrough"}}function Trz(q){if(Ky(q).hasStopParsing)return{behavior:"ask",message:"Command uses stop-parsing token (--%)"};return{behavior:"passthrough"}}function vrz(q){if(Ky(q).hasMemberInvocations)return{behavior:"ask",message:"Command invokes .NET methods"};return{behavior:"passthrough"}}function krz(q){for(let K of q.typeLiterals??[])if(!aa1(K))return{behavior:"ask",message:`Command uses .NET type [${K}] outside the ConstrainedLanguage allowlist`};return{behavior:"passthrough"}}function Vrz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(_==="invoke-item"||_==="ii")return{behavior:"ask",message:"Invoke-Item opens files with the default handler (ShellExecute). On executable files this runs arbitrary code."}}return{behavior:"passthrough"}}function yrz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(Nrz.has(_))return{behavior:"ask",message:`${K.name} creates or modifies a scheduled task (persistence primitive)`};if(_==="schtasks"||_==="schtasks.exe"){if(K.args.some((z)=>{let Y=z.toLowerCase();return Y==="/create"||Y==="/change"||Y==="-create"||Y==="-change"}))return{behavior:"ask",message:"schtasks with create/change modifies scheduled tasks (persistence primitive)"}}}return{behavior:"passthrough"}}function Lrz(q){let K=czK(q,"env");if(K.length===0)return{behavior:"passthrough"};for(let _ of gX(q))if(Erz.has(_.name.toLowerCase()))return{behavior:"ask",message:"Command modifies environment variables"};if(Ky(q).hasAssignments&&K.length>0)return{behavior:"ask",message:"Command modifies environment variables"};return{behavior:"passthrough"}}function Rrz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(ra1.has(_))return{behavior:"ask",message:"Command loads, installs, or downloads a PowerShell module or script, which can execute arbitrary code"}}return{behavior:"passthrough"}}function Srz(q){for(let K of gX(q)){let _=K.name.toLowerCase(),z=_.includes("\\")?_.slice(_.lastIndexOf("\\")+1):_;if(hrz.has(z))return{behavior:"ask",message:"Command creates or modifies an alias or variable that can affect future command resolution"}}return{behavior:"passthrough"}}function brz(q){for(let K of gX(q)){let _=K.name.toLowerCase();if(Crz.has(_))return{behavior:"ask",message:`${K.name} can spawn arbitrary processes via WMI/CIM (Win32_Process Create)`}}return{behavior:"passthrough"}}function PYK(q,K){if(!K.valid)return{behavior:"ask",message:"Could not parse command for security analysis"};let _=[Yrz,$rz,Arz,Orz,jrz,Hrz,Jrz,Mrz,Xrz,Vrz,yrz,Prz,Wrz,Drz,frz,Zrz,Grz,Trz,vrz,krz,Lrz,Rrz,Srz,brz];for(let z of _){let Y=z(K);if(Y.behavior==="ask")return Y}return{behavior:"passthrough"}}var HYK,zrz,wrz,XYK,Nrz,Erz,hrz,Crz;var WYK=y(()=>{oa1();Da();jYK();HYK=new Set(["pwsh","pwsh.exe","powershell","powershell.exe"]);zrz=new Set(["/","–","—","―"]);wrz=new Set(["invoke-webrequest","iwr","invoke-restmethod","irm","new-object","start-bitstransfer"]);XYK=new Set(["where-object","sort-object","select-object","group-object","format-table","format-list","format-wide","format-custom"]);Nrz=new Set(["register-scheduledtask","new-scheduledtask","new-scheduledtaskaction","set-scheduledtask"]);Erz=new Set(["set-item","si","new-item","ni","remove-item","ri","del","rm","rd","rmdir","erase","clear-item","cli","set-content","add-content","ac"]);hrz=new Set(["set-alias","sal","new-alias","nal","set-variable","sv","new-variable","nv"]);Crz=new Set(["invoke-wmimethod","iwmi","invoke-cimmethod"])});import{resolve as xrz}from"path";async function fYK(q){let K=q.trim();if(!K)return"";let _=await EL6(K);return Sa1(_)[0]??""}function mrz(q){return WN8(q)}function Ij6(q){if(q.includes(` |