@askexenow/exe-os 0.9.409 → 0.9.411

package/dist/{chunk-X4V5ZLNX.js → chunk-A75TAU2I.js}

@@ -1583,7 +1583,7 @@ function settingsTamperDenyMessage(target) {
 var destructiveDataGuardModule = null;
 var destructiveDataGuardImportError = null;
 try {
-  destructiveDataGuardModule = await import("./destructive-data-guard-JDUJ2ULM.js");
+  destructiveDataGuardModule = await import("./destructive-data-guard-3TGAAE7K.js");
 } catch (err) {
   destructiveDataGuardImportError = err instanceof Error ? err.stack ?? err.message : String(err);
 }
@@ -1836,9 +1836,543 @@ function isUnverifiablePathToken(expanded) {
   const residue = expanded.replace(/\$\([^)]*\)/g, "").replace(/`[^`]*`/g, "").replace(/\$\{[^}]*\}/g, "").replace(/\$[^A-Za-z_\s]/g, "");
   return residue.includes("/") || residue.includes("~");
 }
+var QUOTED_LITERAL_PLACEHOLDER = /^\u0001(\d+)\u0001$/;
+function maskSingleQuotedWords(text) {
+  const unchanged = { masked: text, literals: [], commands: [] };
+  if (text.includes("
") || text.includes("`") || text.includes("<<")) return unchanged;
+  const isBreak = (c) => c === void 0 || /[\s;&|()<>]/.test(c);
+  const literals = [];
+  const commands = [];
+  let out = "";
+  let commandStart = 0;
+  let open = [];
+  const closeCommand = () => {
+    for (const k of open) commands[k] = out.slice(commandStart);
+    open = [];
+  };
+  let inDouble = false;
+  let i = 0;
+  while (i < text.length) {
+    const c = text[i];
+    if (inDouble) {
+      if (c === "\\") {
+        out += text.slice(i, i + 2);
+        i += 2;
+        continue;
+      }
+      if (c === "$" && (text[i + 1] === "(" || text[i + 1] === "{")) return unchanged;
+      if (c === '"') inDouble = false;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "\\") {
+      out += text.slice(i, i + 2);
+      i += 2;
+      continue;
+    }
+    if (c === '"') {
+      inDouble = true;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "#" && (i === 0 || isBreak(text[i - 1]))) return unchanged;
+    if (c === "$" && text[i + 1] === "'") {
+      let j = i + 2;
+      while (j < text.length && text[j] !== "'") j += text[j] === "\\" ? 2 : 1;
+      if (j >= text.length) return unchanged;
+      out += text.slice(i, j + 1);
+      i = j + 1;
+      continue;
+    }
+    if (c === "'") {
+      const end = text.indexOf("'", i + 1);
+      if (end < 0) return unchanged;
+      if (/[\r\n]/.test(text.slice(i + 1, end))) return unchanged;
+      const startsWord = i === 0 || isBreak(text[i - 1]) && text[i - 2] !== "\\";
+      if (startsWord && isBreak(text[end + 1])) {
+        open.push(literals.length);
+        out += `
${literals.length}
`;
+        literals.push(text.slice(i + 1, end));
+      } else {
+        out += text.slice(i, end + 1);
+      }
+      i = end + 1;
+      continue;
+    }
+    if (/[;&|()\r\n]/.test(c)) {
+      closeCommand();
+      commandStart = out.length + 1;
+    }
+    out += c;
+    i++;
+  }
+  if (inDouble) return unchanged;
+  closeCommand();
+  return { masked: out, literals, commands };
+}
+var SED_SIMPLE_OPTIONS = /* @__PURE__ */ new Set(["-n", "-E", "-r", "--quiet", "--silent", "--regexp-extended"]);
+function isSimpleSedAwk(program, args, realArgs, placeholder) {
+  let i = 0;
+  if (program === "sed") {
+    while (i < args.length && SED_SIMPLE_OPTIONS.has(args[i])) i++;
+    if (args[i] === "-e" || args[i] === "--expression") i++;
+  } else {
+    while (i < args.length && /^-[Fv]/.test(args[i])) i += args[i] === "-F" || args[i] === "-v" ? 2 : 1;
+  }
+  if (args[i] !== placeholder) return false;
+  if (args.some((a, k) => k !== i && /[$`*?[{]/.test(a))) return false;
+  return realArgs.slice(i + 1).every((a) => a === "-" || !a.startsWith("-"));
+}
+function quotedLiteralIsData(literal, index, command, literals) {
+  const tokens = tokenizeShell(command).tokens;
+  let p = 0;
+  while (p < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[p]) && isInertAssignment(tokens[p])) p++;
+  const args = tokens.slice(p + 1);
+  const realArgs = args.map((a) => a.replace(/\u0001(\d+)\u0001/g, (_m, n) => literals[Number(n)] ?? ""));
+  if (args.some((a) => !/^\u0001\d+\u0001$/.test(a) && /[$`*?[{]/.test(a))) return false;
+  switch (tokens[p]) {
+    case "gh": {
+      const at = args.indexOf(`
${index}
`);
+      return at > 0 && (args[at - 1] === "--jq" || args[at - 1] === "-q");
+    }
+    case "jq":
+    case "grep":
+    case "egrep":
+    case "fgrep":
+    case "printf":
+      return true;
+    case "rg":
+      return !realArgs.some((a) => a === "--pre" || a.startsWith("--pre="));
+    // sed/awk: credited ONLY in one fully-visible shape, see isSimpleSedAwk.
+    case "sed":
+      return isSimpleSedAwk("sed", args, realArgs, `
${index}
`) && !/[wWe]/.test(literal);
+    // awk's ways to write a file or run a command, all refused: output
+    // redirection (`>`, `>>`), pipes (`|`, `|&`, `cmd | getline`),
+    // `system()`, and gawk directives that load code (`@include`, `@load`,
+    // any `@…` — codex, PR #3956 round 11). Code-loading OPTIONS (`-f`, `-E`,
+    // `-i`, `-l`) are already excluded by the strict shape.
+    case "awk":
+      return isSimpleSedAwk("awk", args, realArgs, `
${index}
`) && !/[>|@]|system|getline|fflush/.test(literal);
+    default:
+      return false;
+  }
+}
+var LAUNCHCTL_DOMAIN_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "bootstrap",
+  "bootout",
+  "print",
+  "kickstart",
+  "enable",
+  "disable",
+  "kill",
+  "blame"
+]);
+var LAUNCHCTL_DOMAIN_TARGET = /(^|\s)(?:system|(?:gui|user|login|pid)\/(?:\d+|\$\{?E?UID\}?))(?:\/[A-Za-z0-9._-]+)?(?=\s|$)/g;
+function stripLaunchctlDomainTargets(text) {
+  const m = /^\s*launchctl\s+([a-z]+)(?=\s)/.exec(text);
+  if (!m || !LAUNCHCTL_DOMAIN_SUBCOMMANDS.has(m[1])) return text;
+  if (/[;&|()<>\r\n`]/.test(text)) return text;
+  const head = m[0];
+  return head + text.slice(head.length).replace(LAUNCHCTL_DOMAIN_TARGET, "$1");
+}
+function quotedLiteralNamesAuditLocation(literal, rawLedgerPath, rawAuditDir) {
+  if (!/[*?[\]$`\\]/.test(literal)) return false;
+  if (literal.includes(path2.basename(rawLedgerPath)) || literal.includes("EXE_GATEWAY_LEDGER_DIR")) return true;
+  const dirName = path2.basename(rawAuditDir).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:^|[^A-Za-z0-9_.-])${dirName}(?:[/"'\\\\]|$)`).test(literal);
+}
 function inAuditDir(resolved, auditDir, ledgerFile) {
   return resolved === ledgerFile || resolved === auditDir || resolved.startsWith(auditDir + path2.sep);
 }
+function stripRedirections(segment) {
+  let out = "";
+  let wordStart = -1;
+  let quote = null;
+  const stops = /* @__PURE__ */ new Set([" ", "	", "\n", ";", "|", "&", "<", ">", "(", ")"]);
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      out += ch;
+      if (ch === quote) quote = null;
+      else if (ch === "\\" && quote === '"' && i + 1 < segment.length) out += segment[++i];
+      continue;
+    }
+    const redirectAt = (ch === "<" || ch === ">") && segment[i + 1] !== "(" ? i : ch === "&" && segment[i + 1] === ">" ? i : -1;
+    if (redirectAt < 0) {
+      if (ch === " " || ch === "	") wordStart = -1;
+      else if (wordStart < 0) wordStart = out.length;
+      if (ch === "'" || ch === '"') quote = ch;
+      out += ch;
+      if (ch === "\\" && i + 1 < segment.length) out += segment[++i];
+      continue;
+    }
+    if (wordStart >= 0 && /^(?:\d+|\{[A-Za-z_][A-Za-z0-9_]*\})$/.test(out.slice(wordStart))) out = out.slice(0, wordStart);
+    const operator = /^(?:&>>|&>|>>|>\||>&|>|<<<|<<-|<<|<>|<&|<)/.exec(segment.slice(i))[0];
+    let j = i + operator.length;
+    while (segment[j] === " " || segment[j] === "	") j++;
+    let targetQuote = null;
+    for (; j < segment.length; j++) {
+      const c = segment[j];
+      if (targetQuote) {
+        if (c === targetQuote) targetQuote = null;
+        else if (c === "\\" && targetQuote === '"') j++;
+        continue;
+      }
+      if (c === "'" || c === '"') targetQuote = c;
+      else if (c === "\\") j++;
+      else if (stops.has(c)) break;
+    }
+    out += " ";
+    wordStart = -1;
+    i = j - 1;
+  }
+  return out;
+}
+function commandWords(segment) {
+  return tokenizeShell(stripRedirections(segment)).tokens;
+}
+var WRAPPERS3 = {
+  env: {
+    short: { i: "flag", "0": "flag", v: "flag", u: "arg", P: "arg", C: "cwdArg", S: "split" },
+    long: {
+      "--ignore-environment": "flag",
+      "--null": "flag",
+      "--debug": "flag",
+      "--unset": "arg",
+      "--chdir": "cwdArg",
+      "--split-string": "split",
+      "--default-signal": "flag",
+      "--ignore-signal": "flag",
+      "--block-signal": "flag",
+      "--list-signal-handling": "flag",
+      "--help": "noexec",
+      "--version": "noexec"
+    },
+    loneDash: true
+  },
+  sudo: {
+    short: {
+      A: "flag",
+      b: "flag",
+      E: "flag",
+      H: "flag",
+      k: "flag",
+      n: "flag",
+      P: "flag",
+      S: "flag",
+      s: "flag",
+      i: "cwdFlag",
+      C: "arg",
+      g: "arg",
+      h: "arg",
+      p: "arg",
+      r: "arg",
+      t: "arg",
+      T: "arg",
+      u: "arg",
+      U: "arg",
+      D: "cwdArg",
+      l: "noexec",
+      v: "noexec",
+      V: "noexec",
+      K: "noexec"
+    },
+    long: {
+      "--askpass": "flag",
+      "--background": "flag",
+      "--preserve-env": "flag",
+      "--set-home": "flag",
+      "--reset-timestamp": "flag",
+      "--non-interactive": "flag",
+      "--preserve-groups": "flag",
+      "--stdin": "flag",
+      "--shell": "flag",
+      "--login": "cwdFlag",
+      "--close-from": "arg",
+      "--group": "arg",
+      "--host": "arg",
+      "--prompt": "arg",
+      "--role": "arg",
+      "--type": "arg",
+      "--command-timeout": "arg",
+      "--user": "arg",
+      "--other-user": "arg",
+      "--chdir": "cwdArg",
+      "--list": "noexec",
+      "--validate": "noexec",
+      "--version": "noexec",
+      "--help": "noexec",
+      "--remove-timestamp": "noexec"
+    }
+  },
+  command: { short: { p: "flag", v: "noexec", V: "noexec" }, long: {} },
+  builtin: { short: {}, long: {} },
+  exec: { short: { c: "flag", l: "flag", a: "arg" }, long: {} },
+  nohup: { short: {}, long: { "--help": "noexec", "--version": "noexec" } },
+  nice: { short: { n: "arg" }, long: { "--adjustment": "arg", "--help": "noexec", "--version": "noexec" }, numericOption: true },
+  time: {
+    short: { p: "flag", a: "flag", v: "flag", q: "flag", o: "arg", f: "arg" },
+    long: { "--portability": "flag", "--append": "flag", "--verbose": "flag", "--quiet": "flag", "--output": "arg", "--format": "arg" }
+  },
+  timeout: {
+    short: { v: "flag", s: "arg", k: "arg" },
+    long: {
+      "--preserve-status": "flag",
+      "--foreground": "flag",
+      "--verbose": "flag",
+      "--signal": "arg",
+      "--kill-after": "arg",
+      "--help": "noexec",
+      "--version": "noexec"
+    },
+    positional: 1
+  }
+};
+function parseWrapperOptions(spec, tokens, start) {
+  let i = start;
+  let cwdUnknown = false;
+  const apply = (kind, value) => {
+    if (kind === "noexec") return { kind: "noexec" };
+    if (kind === "cwdArg" || kind === "cwdFlag") cwdUnknown = true;
+    if (kind === "split") {
+      if (value === void 0 || !/^[A-Za-z0-9_./=:,+@%\s-]*$/.test(value)) return { kind: "undetermined" };
+      return { kind: "command", index: i, cwdUnknown, split: value.trim().split(/\s+/).filter(Boolean) };
+    }
+    return null;
+  };
+  while (i < tokens.length) {
+    const tok = tokens[i];
+    if (tok === "--") {
+      i++;
+      break;
+    }
+    if (tok === "-" && spec.loneDash) {
+      i++;
+      continue;
+    }
+    if (tok.startsWith("--")) {
+      const eq = tok.indexOf("=");
+      const name = eq < 0 ? tok : tok.slice(0, eq);
+      const kind = spec.long[name];
+      if (kind === void 0) return { kind: "unknown", index: i + 1 };
+      let value = eq < 0 ? void 0 : tok.slice(eq + 1);
+      i++;
+      if (value === void 0 && (kind === "arg" || kind === "cwdArg" || kind === "split")) value = tokens[i++];
+      const result = apply(kind, value);
+      if (result) return result;
+      continue;
+    }
+    if (tok.length > 1 && tok.startsWith("-")) {
+      if (spec.numericOption && /^-\d+$/.test(tok)) {
+        i++;
+        continue;
+      }
+      i++;
+      for (let k = 1; k < tok.length; k++) {
+        const kind = spec.short[tok[k]];
+        if (kind === void 0) return { kind: "unknown", index: i };
+        if (kind === "arg" || kind === "cwdArg" || kind === "split") {
+          const value = k + 1 < tok.length ? tok.slice(k + 1) : tokens[i++];
+          const result2 = apply(kind, value);
+          if (result2) return result2;
+          break;
+        }
+        const result = apply(kind, void 0);
+        if (result) return result;
+      }
+      continue;
+    }
+    break;
+  }
+  i += spec.positional ?? 0;
+  return i <= tokens.length ? { kind: "command", index: i, cwdUnknown } : { kind: "noexec" };
+}
+function unwrapCommand(tokens, budget = { left: 64 }, cwdUnknownIn = false) {
+  const undetermined = [{ argv: [], cwdUnknown: true, undetermined: true }];
+  let words = tokens;
+  let i = 0;
+  let cwdUnknown = cwdUnknownIn;
+  for (; ; ) {
+    if (--budget.left < 0) return undetermined;
+    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) i++;
+    if (i >= words.length) return [];
+    const name = path2.basename(words[i].replace(/^\\/, ""));
+    const spec = Object.hasOwn(WRAPPERS3, name) ? WRAPPERS3[name] : void 0;
+    if (!spec) return [{ argv: words.slice(i), cwdUnknown, undetermined: false }];
+    const parsed = parseWrapperOptions(spec, words, i + 1);
+    switch (parsed.kind) {
+      case "noexec":
+        return [];
+      case "undetermined":
+        return undetermined;
+      case "unknown": {
+        const candidates = [];
+        for (let j = parsed.index; j < words.length; j++) {
+          const found = unwrapCommand(words.slice(j), budget, true);
+          if (found.some((c) => c.undetermined)) return undetermined;
+          candidates.push(...found);
+        }
+        return candidates;
+      }
+      case "command":
+        cwdUnknown ||= parsed.cwdUnknown;
+        if (parsed.split) {
+          words = [words[i], ...parsed.split, ...words.slice(parsed.index)];
+          i = 0;
+        } else {
+          i = parsed.index;
+        }
+    }
+  }
+}
+var TREE_OPTIONS_WITH_ARGUMENT = {
+  mv: /* @__PURE__ */ new Set(["-S", "--suffix", "-t", "--target-directory"]),
+  rsync: /* @__PURE__ */ new Set([
+    "-e",
+    "--rsh",
+    "-f",
+    "--filter",
+    "--exclude",
+    "--include",
+    "--exclude-from",
+    "--include-from",
+    "--files-from",
+    "--rsync-path",
+    "--log-file",
+    "--partial-dir",
+    "-T",
+    "--temp-dir",
+    "--backup-dir",
+    "--compare-dest",
+    "--copy-dest",
+    "--link-dest",
+    "--chmod",
+    "--chown",
+    "--timeout",
+    "--port",
+    "--bwlimit",
+    "--max-size",
+    "--min-size",
+    "--suffix",
+    "--out-format",
+    "--password-file",
+    "-B",
+    "-M"
+  ])
+};
+function treeMutationTargets(segment) {
+  const found = [];
+  for (const command of unwrapCommand(commandWords(segment))) {
+    if (command.undetermined) return [{ path: UNKNOWN_TARGET, cwdUnknown: true }];
+    for (const target of treeTargetsOf(command.argv) ?? []) found.push({ path: target, cwdUnknown: command.cwdUnknown });
+  }
+  return found.length > 0 ? found : null;
+}
+function treeTargetsOf(tokens) {
+  if (tokens.length === 0) return null;
+  const program = path2.basename(tokens[0].replace(/^\\/, ""));
+  const takesArgument = TREE_OPTIONS_WITH_ARGUMENT[program] ?? /* @__PURE__ */ new Set();
+  const options = [];
+  const operands = [];
+  let endOfOptions = false;
+  for (let i = 1; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (!endOfOptions && tok === "--") endOfOptions = true;
+    else if (!endOfOptions && tok.length > 1 && tok.startsWith("-")) {
+      options.push(tok);
+      if (takesArgument.has(tok)) i++;
+    } else operands.push(tok);
+  }
+  const recursive = options.some((o) => o === "--recursive" || /^-[A-Za-z]*[rR]/.test(o));
+  switch (program) {
+    case "rm":
+    case "srm":
+    case "shred":
+      return recursive ? operands : null;
+    case "trash":
+    case "rimraf":
+      return operands;
+    case "mv": {
+      const targetDirectory = options.some((o) => o === "--target-directory" || o.startsWith("--target-directory=") || /^-[A-Za-z]*t/.test(o));
+      return targetDirectory ? operands : operands.slice(0, -1);
+    }
+    case "rsync": {
+      const targets = [
+        ...options.some((o) => o.startsWith("--delete")) ? operands.slice(-1) : [],
+        ...options.includes("--remove-source-files") ? operands.slice(0, -1) : []
+      ];
+      return targets.length > 0 ? targets : null;
+    }
+    default:
+      return null;
+  }
+}
+function isAncestorOrSelf(ancestor, descendant) {
+  const rel = path2.relative(ancestor, descendant);
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + path2.sep) && !path2.isAbsolute(rel);
+}
+var UNKNOWN_TARGET = "\0unknown-mutation-target";
+function targetMayReachAudit(target, cwd, auditDir, ledgerFile, homeDir, env, options = {}) {
+  if (target === UNKNOWN_TARGET) return true;
+  const expanded = expandEnvReferences(target, homeDir, env);
+  if (isUnverifiablePathToken(expanded) || UNRESOLVABLE_EXPANSION.test(expanded)) return true;
+  if (options.cwdUnknown && !path2.isAbsolute(expanded)) return true;
+  let literal = expanded;
+  if (/[*?\[]/.test(expanded)) {
+    const components = expanded.split("/");
+    const firstGlob = components.findIndex((component) => /[*?\[]/.test(component));
+    literal = components.slice(0, firstGlob).join("/") || (path2.isAbsolute(expanded) ? "/" : ".");
+  }
+  const resolved = realResolve(cwd, literal);
+  if (resolved === null) return true;
+  if (isAncestorOrSelf(resolved, auditDir) || isAncestorOrSelf(resolved, ledgerFile) || isAncestorOrSelf(auditDir, resolved)) return true;
+  return options.followsSymlinks === true && followedTreeMayReachAudit(resolved, auditDir, env.HOME ?? homeDir);
+}
+var FOLLOW_WALK_CAP = 2e3;
+function followedTreeMayReachAudit(root, auditDir, homeDir) {
+  const homes = [path2.resolve(homeDir), realDir(path2.resolve(homeDir))];
+  const nearHome = (p) => homes.some((home) => isAncestorOrSelf(home, p) || isAncestorOrSelf(p, home));
+  if (nearHome(root)) return true;
+  let budget = FOLLOW_WALK_CAP;
+  const pending = [root];
+  const seen = /* @__PURE__ */ new Set();
+  while (pending.length > 0) {
+    const dir = pending.pop();
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT" || code === "ENOTDIR") continue;
+      return true;
+    }
+    for (const entry of entries) {
+      if (--budget < 0) return true;
+      const entryPath = path2.join(dir, entry.name);
+      if (entry.isSymbolicLink()) {
+        let real;
+        try {
+          real = fs.realpathSync.native(entryPath);
+        } catch {
+          return true;
+        }
+        if (isAncestorOrSelf(real, auditDir) || isAncestorOrSelf(auditDir, real) || nearHome(real)) return true;
+        try {
+          if (fs.statSync(real).isDirectory()) pending.push(real);
+        } catch {
+          return true;
+        }
+      } else if (entry.isDirectory()) {
+        pending.push(entryPath);
+      }
+    }
+  }
+  return false;
+}
 function findBracketClassEnd(component, start) {
   return component.indexOf("]", component[start] === "]" ? start + 1 : start);
 }
@@ -1927,7 +2461,16 @@ function segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAudit
   const mentions = (s) => s.includes(rawLedgerPath) || s.includes(rawAuditDir);
   if (mentions(text) || mentions(expandEnvReferences(text, homeDir, env))) return "yes";
   let unverified = false;
-  for (const frag of text.split(/\s+/)) {
+  const { masked, literals, commands } = maskSingleQuotedWords(text);
+  const credited = literals.map((literal, k) => quotedLiteralIsData(literal, k, commands[k] ?? "", literals));
+  const scanText = stripLaunchctlDomainTargets(literals.length === 0 ? masked : masked.replace(
+    /\u0001(\d+)\u0001/g,
+    (placeholder, n) => credited[Number(n)] ? placeholder : `'${literals[Number(n)]}'`
+  ));
+  if (literals.some((literal, k) => !credited[k] && quotedLiteralNamesAuditLocation(literal, rawLedgerPath, rawAuditDir))) {
+    unverified = true;
+  }
+  for (const frag of scanText.split(/\s+/)) {
     const expandedFrag = expandEnvReferences(frag, homeDir, env);
     if (isUnverifiablePathToken(expandedFrag)) {
       unverified = true;
@@ -1939,7 +2482,20 @@ function segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAudit
     if (verdict === "yes") return "yes";
     if (verdict === "unverified") unverified = true;
   }
-  for (const tok of tokenizeShell(text).tokens) {
+  for (const tok of tokenizeShell(scanText).tokens) {
+    const placeholder = QUOTED_LITERAL_PLACEHOLDER.exec(tok);
+    if (placeholder && literals[Number(placeholder[1])] !== void 0) {
+      const literal = literals[Number(placeholder[1])];
+      if (fstringIsOpaque(literal)) {
+        unverified = true;
+        continue;
+      }
+      const resolved2 = realResolve(cwd, literal);
+      if (resolved2 === null) unverified = true;
+      else if (inAuditDir(resolved2, auditDir, ledgerFile)) return "yes";
+      else if (quotedLiteralNamesAuditLocation(literal, rawLedgerPath, rawAuditDir)) unverified = true;
+      continue;
+    }
     const stripped = tok.replace(/\/+\*+\/?$/, "");
     const expanded = expandEnvReferences(stripped, homeDir, env);
     if (isUnverifiablePathToken(expanded)) {
@@ -2245,10 +2801,15 @@ function commandMutatesLedger(command, ledgerPath, homeDir, cwd, env, depth = 0)
   });
   const naiveSegments = splitShellSegments(command).flatMap((segment) => {
     const tokens = tokenizeShell(segment).tokens;
-    return tokens.some((_token, index) => shellDashCScriptIndex(tokens, index) >= 0) ? [segment] : splitShellSegmentsNaive(segment);
+    return tokens.some((_token, index) => shellDashCScriptIndex(tokens, index) >= 0) ? [segment] : splitNaiveOutsideSingleQuotedWords(segment);
   });
   return commandMutatesLedgerForSegments(quoteAwareSegments, command, ledgerPath, homeDir, cwd, env, depth) || commandMutatesLedgerForSegments(naiveSegments, command, ledgerPath, homeDir, cwd, env, depth);
 }
+function splitNaiveOutsideSingleQuotedWords(segment) {
+  const { masked, literals } = maskSingleQuotedWords(segment);
+  if (literals.length === 0) return splitShellSegmentsNaive(segment);
+  return splitShellSegmentsNaive(masked).map((piece) => piece.replace(/\u0001(\d+)\u0001/g, (_m, n) => `'${literals[Number(n)]}'`));
+}
 function rejoinSplitFdDuplications(segments) {
   const rejoined = [];
   for (let i = 0; i < segments.length; i++) {
@@ -2272,6 +2833,7 @@ function commandMutatesLedgerForSegments(rawSegments, command, ledgerPath, homeD
   const npmRootGSubstitutionPolluted = npmRootGSubstitutionMayBePolluted(command, env);
   const verdictOf = (text, directory = cwd) => segmentAuditVerdict(text, auditDir, ledgerFile, rawLedgerPath, rawAuditDir, homeDir, directory, env);
   if (segments.length === 0) return verdictOf(command) !== "no";
+  const feedsMutatingXargs = segments.some(xargsRunsMutatingCommand);
   let accountedFor = false;
   const directories = /* @__PURE__ */ new Set([cwd]);
   let unknownDirectory = false;
@@ -2282,10 +2844,14 @@ function commandMutatesLedgerForSegments(rawSegments, command, ledgerPath, homeD
       if (scriptIndex < 0) continue;
       if (unknownDirectory || [...directories].some((directory) => commandMutatesLedger(tokens[scriptIndex], ledgerPath, homeDir, directory, env, depth + 1))) return true;
     }
+    const findRoots = destructiveFindRoots(seg, feedsMutatingXargs);
+    if (findRoots !== null && (unknownDirectory || findRoots.some(({ root, cwdUnknown, followsSymlinks }) => [...directories].some((directory) => targetMayReachAudit(root, directory, auditDir, ledgerFile, homeDir, env, { cwdUnknown, followsSymlinks }))))) return true;
     if (isTrustedNodeBootLine(seg, homeDir, env, npmRootGSubstitutionPolluted)) {
       accountedFor = true;
       continue;
     }
+    const treeTargets = treeMutationTargets(seg);
+    if (treeTargets !== null && treeTargets.some(({ path: target, cwdUnknown }) => [...directories].some((directory) => targetMayReachAudit(target, directory, auditDir, ledgerFile, homeDir, env, { cwdUnknown })))) return true;
     const changesDirectory = ["cd", "pushd", "popd"].includes(tokens[0] ?? "");
     if (changesDirectory && /\$\(|`/.test(seg)) return true;
     if (changesDirectory && !/[<>]/.test(seg)) {
@@ -2311,6 +2877,64 @@ function commandMutatesLedgerForSegments(rawSegments, command, ledgerPath, homeD
   }
   return !accountedFor && verdictOf(command) === "yes";
 }
+var FIND_WRITING_ACTIONS = /* @__PURE__ */ new Set(["-delete", "-fprint", "-fprint0", "-fprintf", "-fls"]);
+var FIND_EXEC_ACTIONS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+var XARGS_OPTIONS_WITH_ARGUMENT = /* @__PURE__ */ new Set(["-I", "-L", "-n", "-P", "-s", "-d", "-E", "-a", "-J", "-R", "-S"]);
+function isMutatingProgram(word) {
+  return word === void 0 || !LEDGER_READ_ONLY_PROGRAMS.has(path2.basename(word));
+}
+function xargsRunsMutatingCommand(segment) {
+  return unwrapCommand(commandWords(segment)).some((command) => !command.undetermined && xargsArgvRunsMutating(command.argv));
+}
+function xargsArgvRunsMutating(tokens) {
+  if (tokens.length === 0 || path2.basename(tokens[0]) !== "xargs") return false;
+  let index = 1;
+  while (index < tokens.length && tokens[index].startsWith("-")) {
+    index += XARGS_OPTIONS_WITH_ARGUMENT.has(tokens[index]) ? 2 : 1;
+  }
+  return index < tokens.length && isMutatingProgram(tokens[index]);
+}
+function destructiveFindRoots(segment, feedsMutatingXargs) {
+  const found = [];
+  for (const command of unwrapCommand(commandWords(segment))) {
+    if (command.undetermined) return [{ root: UNKNOWN_TARGET, cwdUnknown: true, followsSymlinks: false }];
+    const plan = destructiveFindPlan(command.argv, feedsMutatingXargs);
+    if (plan) found.push(...plan.roots.map((root) => ({ root, cwdUnknown: command.cwdUnknown, followsSymlinks: plan.followsSymlinks })));
+  }
+  return found.length > 0 ? found : null;
+}
+function destructiveFindPlan(tokens, feedsMutatingXargs) {
+  if (tokens.length === 0 || path2.basename(tokens[0]) !== "find") return null;
+  let index = 1;
+  const roots = [];
+  let followsSymlinks = false;
+  while (index < tokens.length) {
+    const tok = tokens[index];
+    if (/^-O\d*$/.test(tok)) {
+      index++;
+      continue;
+    }
+    if (tok === "-D") {
+      index += 2;
+      continue;
+    }
+    if (tok === "-f") {
+      if (index + 1 < tokens.length) roots.push(tokens[index + 1]);
+      index += 2;
+      continue;
+    }
+    if (!/^-[HLPEXdsx]+$/.test(tok)) break;
+    for (const flag of tok.slice(1)) if (flag === "L" || flag === "H" || flag === "P") followsSymlinks = flag === "L";
+    index++;
+  }
+  while (index < tokens.length && !/^[-(!),]/.test(tokens[index])) roots.push(tokens[index++]);
+  const expression = tokens.slice(index);
+  const writes = feedsMutatingXargs || expression.some((token, i) => FIND_WRITING_ACTIONS.has(token) || FIND_EXEC_ACTIONS.has(token) && isMutatingProgram(expression[i + 1]));
+  if (!writes) return null;
+  if (expression.includes("-follow")) followsSymlinks = true;
+  if (expression.includes("-files0-from")) return { roots: [UNKNOWN_TARGET], followsSymlinks };
+  return { roots: roots.length > 0 ? roots : ["."], followsSymlinks };
+}
 var ACTION_POLICY = [
   {
     id: "audit.ledger-tamper",