@impeccable/reviews 0.1.0

package/dist/fence.js

@@ -0,0 +1,1071 @@
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
+const deny = (reason) => ({ verdict: 'deny', reason });
+const never = (reason) => ({ verdict: 'never', reason });
+/**
+ * A command line as simple commands, or null when it uses shell syntax the
+ * fence does not read: expansions, substitutions, subshells, brace expansion,
+ * here-documents, background jobs, an unclosed quote.
+ */
+export function parseCommand(command) {
+    const out = [];
+    let words = [];
+    let redirects = [];
+    let word = '';
+    let inWord = false;
+    let redirect = null;
+    const endWord = () => {
+        if (!inWord)
+            return;
+        if (redirect)
+            redirects.push({ op: redirect, target: word });
+        else
+            words.push(word);
+        redirect = null;
+        word = '';
+        inWord = false;
+    };
+    /** The operator before the command being read: '' at the start, then ';', '&&', '||' or '|'. */
+    let before = '';
+    const endCommand = (after = '') => {
+        endWord();
+        if (redirect)
+            return false;
+        if (words.length || redirects.length) {
+            out.push({ words, redirects, certain: (before === '' || before === ';') && after !== '|' });
+            before = after;
+        }
+        words = [];
+        redirects = [];
+        return true;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        if (c === "'") {
+            const end = command.indexOf("'", i + 1);
+            if (end < 0)
+                return null;
+            word += command.slice(i + 1, end);
+            inWord = true;
+            i = end;
+        }
+        else if (c === '"') {
+            let j = i + 1;
+            for (; j < command.length && command[j] !== '"'; j++) {
+                const d = command[j];
+                if (d === '$' || d === '`')
+                    return null;
+                if (d === '\\' && '"\\$`\n'.includes(command[j + 1] ?? ''))
+                    j++;
+                word += command[j];
+            }
+            if (j >= command.length)
+                return null;
+            inWord = true;
+            i = j;
+        }
+        else if (c === '\\') {
+            if (next !== undefined)
+                word += next;
+            inWord = true;
+            i++;
+        }
+        else if ('$`(){}'.includes(c)) {
+            return null;
+        }
+        else if (c === '#' && !inWord) {
+            const newline = command.indexOf('\n', i);
+            if (newline < 0)
+                break;
+            i = newline - 1;
+        }
+        else if (c === ' ' || c === '\t') {
+            endWord();
+        }
+        else if (c === '>' || c === '<' || (c === '&' && next === '>')) {
+            let op;
+            if (c === '&') {
+                endWord();
+                op = '&>';
+                i++;
+            }
+            else if (inWord && /^\d+$/.test(word)) {
+                op = word + c;
+                word = '';
+                inWord = false;
+            }
+            else {
+                endWord();
+                op = c;
+            }
+            if (command[i + 1] === op.at(-1)) {
+                op += op.at(-1);
+                i++;
+            }
+            if (op.endsWith('<<') || command[i + 1] === '(')
+                return null;
+            const dup = /^&(\d+|-)/.exec(command.slice(i + 1));
+            if (dup)
+                i += dup[0].length; // 2>&1: a descriptor, not a file
+            else if (command[i + 1] === '&')
+                return null;
+            else
+                redirect = op;
+        }
+        else if (c === '\n' || c === ';' || c === '|' || c === '&') {
+            if (c === '&' && next !== '&')
+                return null; // a background job
+            const op = c === '\n' || c === ';' ? ';' : next === c ? c + c : c;
+            if (!endCommand(op))
+                return null;
+            if (op.length === 2)
+                i++;
+        }
+        else {
+            word += c;
+            inWord = true;
+        }
+    }
+    return endCommand() ? out : null;
+}
+/** The path with every symlink on it resolved; the part that does not exist yet stays as written. */
+function realPath(path) {
+    const rest = [];
+    for (let at = path;;) {
+        try {
+            return join(realpathSync(at), ...rest.reverse());
+        }
+        catch {
+            const parent = dirname(at);
+            if (parent === at)
+                return path;
+            rest.push(basename(at));
+            at = parent;
+        }
+    }
+}
+const within = (path, dir) => {
+    const rel = relative(dir, path);
+    return !(rel === '..' || rel.startsWith('../') || rel.startsWith('..\\') || isAbsolute(rel));
+};
+/** A path in this run's scratch folder once every symlink on it is resolved, written out: no `~`, no variable, no glob. */
+function inScratch(arg, where) {
+    if (!where.scratch || arg.startsWith('~') || /[$*?[]/.test(arg))
+        return false;
+    return within(realPath(resolve(where.cwd, arg)), where.scratch);
+}
+/** A redirect into this run's scratch folder; never one into the checkout, even a checkout that sits in it. */
+function intoScratch(target, where) {
+    return inScratch(target, where) && !within(realPath(resolve(where.cwd, target)), where.root);
+}
+/** A path argument that leaves the checkout, through `..`, `~`, a symlink, or a `.*` glob that can match `..`. */
+function outside(arg, where) {
+    if (arg.startsWith('~') || arg.split('/').some((part) => /^\.[*?[]/.test(part)))
+        return true;
+    return !within(realPath(resolve(where.cwd, arg)), where.root);
+}
+const isFolder = (path) => {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+};
+/** Positional arguments and the values of --flag=value, which is where paths hide. */
+function pathsOf(args) {
+    return args.flatMap((a) => (a.startsWith('--') && a.includes('=') ? [a.slice(a.indexOf('=') + 1)] : a.startsWith('-') ? [] : [a]));
+}
+const inside = (args, where) => !pathsOf(args).some((a) => outside(a, where));
+/** A .env file, or a pattern that can name one, holds live secrets; the examples next to it do not. */
+export function isSecretFile(path) {
+    const name = basename(path);
+    return name.startsWith('.env') && !/\.(example|sample|template|dist)$/.test(name);
+}
+function rmRecursiveForce(words) {
+    const at = words.indexOf('rm');
+    if (at < 0)
+        return false;
+    const flags = words.slice(at + 1).filter((w) => w.startsWith('-'));
+    const short = flags.filter((f) => !f.startsWith('--')).join('');
+    const recursive = /[rR]/.test(short) || flags.includes('--recursive');
+    const force = short.includes('f') || flags.includes('--force');
+    return recursive && force;
+}
+function forcePush(args) {
+    return args.some((a) => a.startsWith('--force') || (/^-[^-]/.test(a) && a.includes('f')) || (!a.startsWith('-') && a.startsWith('+')));
+}
+const WRITES_EVERY_ARG = new Set(['tee', 'touch', 'mkdir', 'rmdir', 'rm', 'chmod', 'chown', 'truncate']);
+const WRITES_LAST_ARG = new Set(['cp', 'mv', 'ln', 'install', 'rsync', 'scp']);
+/** What npx, pnpm exec, yarn and bunx may run from the checkout's own dependencies. */
+const TOOLS = new Set(['tsc', 'eslint', 'prettier', 'next', 'vite', 'astro', 'nuxt', 'prisma', 'playwright', 'drizzle-kit', 'sequelize', 'knex']);
+const PACKAGE_MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+/** yarn's own commands that change packages, settings or the registry; `yarn <name>` runs these even when a script has the name. */
+const YARN_OWN = new Set(['add', 'remove', 'upgrade', 'up', 'dlx', 'exec', 'node', 'npm', 'global', 'link', 'unlink', 'publish', 'pack', 'version', 'config', 'set', 'cache', 'init', 'create', 'import', 'patch', 'plugin', 'policies', 'workspace', 'workspaces', 'login', 'logout', 'owner', 'tag', 'team', 'access', 'rebuild', 'unplug', 'dedupe']);
+/** `KEY=value` in front of a command. */
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+/** Variables that name a program to run, change what a program loads, or change how git, ssh and the package managers behave. */
+const STEERING = /^(PATH|HOME|SHELL|IFS|ENV|BASH_ENV|CDPATH|PROMPT_COMMAND|EDITOR|VISUAL|PAGER|BROWSER|TERMINAL|\w*_EDITOR|\w*_PAGER|\w*ASKPASS\w*|LESS\w*|SSH_\w+|NODE_OPTIONS|NODE_PATH|PYTHON\w*|RUBY\w*|PERL\w*|\w*JAVA\w*_OPTIONS|LD_\w+|DYLD_\w+|GIT_\w+|NPM_CONFIG_\w+|PNPM_\w+|YARN_\w+|BUN_\w+|COREPACK_\w+)$/i;
+/** What a `KEY=value` may stand in front of: the package managers and the tool runners, which build with the settings. */
+const TAKES_SETTINGS = new Set(['npm', 'pnpm', 'yarn', 'bun', 'npx', 'bunx']);
+/** Database commands that throw data away, in whatever database the checkout points at. */
+function destroysData(tool, args) {
+    const sub = args.filter((a) => !a.startsWith('-')).join(' ');
+    if (args.includes('--force-reset') || args.includes('--accept-data-loss'))
+        return true;
+    return (tool === 'prisma' && /^(migrate reset|db execute)\b/.test(sub))
+        || (tool === 'drizzle-kit' && /^drop\b/.test(sub))
+        || (tool === 'knex' && /^migrate:(rollback|down)\b/.test(sub))
+        || (tool === 'sequelize' && /^db:(drop|migrate:undo|seed:undo)/.test(sub));
+}
+/** How many `KEY=value` words lead the command. */
+function envCount(words) {
+    let n = 0;
+    while (n < words.length && ASSIGNMENT.test(words[n]))
+        n++;
+    return n;
+}
+/** Why a `KEY=value` in front of a command is refused: it steers what runs, its value holds shell characters, or it points out of the checkout. Null when it is a plain setting. */
+function envProblem(assignment, where) {
+    const name = assignment.slice(0, assignment.indexOf('='));
+    const value = assignment.slice(name.length + 1);
+    if (STEERING.test(name))
+        return `sets ${name}, which changes what runs`;
+    if (/[\s;&|<>()$`\\"'*?[\]{}~!#]/.test(value))
+        return `a value for ${name} with shell characters in it`;
+    const path = value.replace(/^file:(\/\/)?/, '');
+    if ((path.startsWith('/') || path.split('/').includes('..')) && outside(path, where) && !inScratch(path, where))
+        return `a value for ${name} outside the checkout`;
+    return null;
+}
+/** The pathspec that leaves every .env file out of a `git add`, in whatever folder it sits: `:!.env*` leaves out only those beside it. */
+export const EXCLUDE_ENV = ':(exclude,glob)**/.env*';
+/** `git add -A` or `-u`, which stage every change in the checkout, wherever they run, or paths read from a file, which the fence does not see; git takes any start of a long option's name (--al is --all). */
+const addsAll = (args) => (args.includes('--') ? args.slice(0, args.indexOf('--')) : args).some((a) => /^-[^-]*[Au]/.test(a) || (a.length > 2 && a.startsWith('--') && ['all', 'update', 'no-ignore-removal', 'pathspec-from-file'].some((o) => o.startsWith(a.slice(2).split('=')[0]))));
+/** The values of git commit's options that read a file (a message, a template, pathspecs) or a commit, which may name a file (`HEAD:.env`). */
+function commitReads(args) {
+    const values = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--')
+            break;
+        if (a.startsWith('--')) {
+            const eq = a.indexOf('=');
+            const name = a.slice(2, eq < 0 ? undefined : eq);
+            if (name === 'message' && eq < 0)
+                i++;
+            else if (name && ['file', 'template', 'reuse-message', 'reedit-message', 'pathspec-from-file'].some((o) => o.startsWith(name)))
+                values.push(eq < 0 ? args[++i] ?? '' : a.slice(eq + 1));
+        }
+        else if (a.startsWith('-')) {
+            // Short options run together (-qm, -aF file); one that takes a value takes the rest of the word, or the next word.
+            for (let j = 1; j < a.length; j++) {
+                if ('uS'.includes(a[j]))
+                    break;
+                if (!'mFtcC'.includes(a[j]))
+                    continue;
+                const value = a.slice(j + 1) || (args[++i] ?? '');
+                if (a[j] !== 'm')
+                    values.push(value);
+                break;
+            }
+        }
+    }
+    return values;
+}
+function git(args, where, protectedBranches) {
+    const [sub, ...rest] = args[0] === '--no-pager' ? args.slice(1) : args;
+    if (sub === 'status' || sub === 'diff' || sub === 'log' || sub === 'show' || sub === 'add') {
+        const excluded = sub === 'add' && rest.includes(EXCLUDE_ENV);
+        const named = excluded ? rest.filter((a) => a !== EXCLUDE_ENV) : rest;
+        // After `--` every word is a path, a dash in front too.
+        const end = named.indexOf('--');
+        const paths = end < 0 ? pathsOf(named) : [...pathsOf(named.slice(0, end)), ...named.slice(end + 1)];
+        // `HEAD:.env` names a file too, and git's own patterns (`:(top).env`, `*env`) match dot files.
+        if (paths.some((a) => /^:[(!^]|[*?[]/.test(a) || isSecretFile(a.slice(a.lastIndexOf(':') + 1))))
+            return deny('names a .env file, or a pattern that can match one');
+        if (paths.some((a) => outside(a, where)) || rest.some((a) => a.startsWith('--output')))
+            return deny('a path outside the checkout');
+        if (sub === 'add' && !excluded && (addsAll(named) || paths.some((a) => isFolder(realPath(resolve(where.cwd, a)))))) {
+            return deny(`a git add of every change or of a folder stages .env files too: name the files, or add '${EXCLUDE_ENV}' to the command`);
+        }
+        // The pathspec leaves out the .env files under the folder the command runs in, and -A reaches past it.
+        if (excluded && addsAll(named) && realPath(where.cwd) !== where.root)
+            return deny('a git add -A or -u from a folder below the top of the checkout: run it from the top');
+        return allow();
+    }
+    if (sub === 'commit') {
+        const read = commitReads(rest).find((v) => /[*?[]/.test(v) || isSecretFile(v.slice(v.lastIndexOf(':') + 1)) || isSecretFile(realPath(resolve(where.cwd, v))) || (outside(v, where) && !inScratch(v, where)));
+        return read === undefined ? allow() : deny('a commit that reads a file outside the checkout or the scratch folder, or a .env file');
+    }
+    if (sub === 'checkout' && rest[0] === '-b' && rest.length >= 2 && rest.length <= 3)
+        return allow();
+    if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
+        const branch = rest[2];
+        return branch.includes(':') || branch === 'HEAD' || protectedBranches.includes(branch) ? deny('a push to the default branch') : allow();
+    }
+    return deny('a git command off the allowlist');
+}
+/** The script names of the package.json in `dir`; none when there is none to read. */
+function scriptsIn(dir) {
+    try {
+        const scripts = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).scripts;
+        return new Set(scripts && typeof scripts === 'object' ? Object.keys(scripts) : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+/**
+ * package.json and the files the scripts and listed tools load from the checkout by convention (`*.config.js`, `.*rc`): once the agent
+ * changes one, what runs is no longer the repository's own code.
+ */
+/** The ci-tunnel case corrects Vite's preview.allowedHosts and proves it with the local preview check, which runs in its own copy and environment: after that edit only the shell stops. */
+const VITE_CONFIG = /(?:^|\/)vite\.config\.[cm]?[jt]s$/i;
+const LOADED = /(?:^|\/)(?:package\.json|[\w.-]+\.config\.[cm]?[jt]s|\.[\w-]+rc(?:\.\w+)*|tsconfig[^/]*\.json|knexfile\.[^/]+|bunfig\.toml|prisma\/seed\.[^/]+|node_modules\/.+)$/i;
+/** Why scripts and tools stop running: the agent changed a package.json (true when it does not say which), or a file named here that they load. */
+function changedReason(changed) {
+    return changed === true || basename(changed) === 'package.json' ? 'runs package.json scripts the agent changed' : `runs scripts and tools that load ${changed}, which the agent changed`;
+}
+/** A script of the package.json where the command runs: the repository's own build steps, but none that publishes or deploys. */
+function script(name, rest, where, scriptsChanged) {
+    if (scriptsChanged)
+        return deny(changedReason(scriptsChanged));
+    if (!scriptsIn(where.cwd).has(name))
+        return deny(`"${name}" is not a script in the package.json there`);
+    if (/publish|release|deploy/i.test(name))
+        return deny('a script that publishes or deploys');
+    return inside(rest, where) ? allow() : deny('a path outside the checkout');
+}
+/** A tool from the list, through npx, pnpm exec, yarn or bunx. */
+function tool(args, where, scriptsChanged = false) {
+    let i = 0;
+    while (['-y', '--yes', '--no', '--no-install', '-q', '--quiet', '--bun'].includes(args[i] ?? ''))
+        i++;
+    // A version or a tag may follow the name; an alias such as next@npm:other is another package, so it stays on.
+    const name = (args[i] ?? '').replace(/@[\w.^~<>=*+-]+$/, '');
+    const rest = args.slice(i + 1);
+    if (!TOOLS.has(name))
+        return deny(`${name || 'that'} is not on the tool list`);
+    if (name === 'playwright' && (rest[0] === 'install-deps' || rest.includes('--with-deps')))
+        return deny('installs system packages');
+    if (destroysData(name, rest))
+        return never('throws away database data');
+    if (scriptsChanged)
+        return deny(changedReason(scriptsChanged));
+    return inside(rest, where) ? allow() : deny('a path outside the checkout');
+}
+/** A package manager's install, script or version; with `tools`, also a tool from the list through pnpm exec or yarn. */
+function packageManager(pm, args, where, scriptsChanged, tools = true) {
+    const [sub = '', ...rest] = args;
+    if ((sub === '--version' || sub === '-v') && !rest.length)
+        return allow();
+    if (args.some((a) => a === '-g' || a === '--global' || a === '--location=global'))
+        return deny('a global install');
+    if (pm === 'pnpm' && sub === 'exec')
+        return tools ? tool(rest, where, scriptsChanged) : deny('a tool outside the preview list');
+    // yarn on its own installs, as it does with only flags after it.
+    const install = ['install', 'i', 'ci'].includes(sub) ? rest : pm === 'yarn' && (!sub || sub.startsWith('-')) ? args : null;
+    if (install) {
+        if (scriptsChanged)
+            return deny(changedReason(scriptsChanged));
+        return install.every((a) => a.startsWith('-')) && inside(install, where) ? allow() : deny(`a ${pm} command off the allowlist`);
+    }
+    if (pm === 'yarn' && !YARN_OWN.has(sub)) {
+        // `yarn build` runs the script, `yarn prisma generate` the tool, and `yarn run` either.
+        const [name = '', ...extra] = sub === 'run' ? rest : args;
+        if (scriptsIn(where.cwd).has(name))
+            return script(name, extra, where, scriptsChanged);
+        return tools ? tool([name, ...extra], where, scriptsChanged) : deny('a tool outside the preview list');
+    }
+    if (sub === 'run' && rest[0] && !rest[0].startsWith('-'))
+        return script(rest[0], rest.slice(1), where, scriptsChanged);
+    return deny(`a ${pm} command off the allowlist`);
+}
+function reader(cmd, args, where) {
+    let paths = pathsOf(args);
+    if (cmd === 'find') {
+        if (args.some((a) => /^-(exec|execdir|ok|okdir|delete|fprint|fprint0|fprintf|fls)$/.test(a)))
+            return deny('find that runs or deletes');
+        const firstExpression = args.findIndex((a) => a.startsWith('-') || a === '!' || a === '(');
+        paths = firstExpression < 0 ? [...args] : args.slice(0, firstExpression);
+    }
+    if (cmd === 'grep') {
+        const recursive = args.some((a) => /^-[^-]*[rR]/.test(a) || a === '--recursive' || a === '--dereference-recursive' || a === '--directories=recurse');
+        // A recursive grep reads files nobody named, .env ones too, unless it leaves them out.
+        if (recursive && !args.includes('--exclude=.env*'))
+            return deny('a recursive grep reads .env files unless it has --exclude=.env*');
+        if (!args.some((a) => a === '-e' || a === '-f' || a.startsWith('--regexp') || a.startsWith('--file')))
+            paths = paths.slice(1);
+    }
+    // The scratch folder holds what this run wrote there, such as a build's log, so it may be read back.
+    if (paths.some((p) => outside(p, where) && !inScratch(p, where)))
+        return deny('reads outside the checkout');
+    // The shell expands `.e*` to .env too.
+    if (cmd !== 'ls' && paths.some((p) => isSecretFile(p) || /^\.[^/]*[*?[]/.test(basename(p))))
+        return deny('reads a .env file, or a pattern that can match one');
+    return allow();
+}
+/** A host's CLI package, by host: the one global install that runs, and only once the person said yes to setting that host up. */
+const HOST_CLIS = { netlify: 'netlify-cli', vercel: 'vercel' };
+/** Whether this is a global install of a host's CLI and nothing else, the person having said yes to setting that host up. */
+function installsHostCli(pm, args, hosts) {
+    const rest = args.filter((a) => !['-g', '--global', '--location=global'].includes(a));
+    const global = pm === 'yarn' ? rest[0] === 'global' : rest.length < args.length;
+    const [verb = '', name = '', ...more] = pm === 'yarn' ? rest.slice(1) : rest;
+    const verbs = { npm: ['install', 'i', 'add'], pnpm: ['add'], yarn: ['add'], bun: ['add', 'install', 'i'] };
+    const cli = name.replace(/@(latest|\d[\w.-]*)$/, '');
+    return global && (verbs[pm] ?? []).includes(verb) && !more.length && Object.entries(HOST_CLIS).some(([host, pkg]) => pkg === cli && hosts.has(host));
+}
+/** The Netlify CLI's options that take a value, of those the rules below allow, so the value is not read as a command. */
+const NETLIFY_VALUES = new Set(['--name', '--context', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
+/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, the one deploy context, a team's slug. */
+const NETLIFY_VALID = {
+    '--name': /^[A-Za-z0-9-]{1,63}$/,
+    '--id': /^[0-9a-f-]{8,64}$/i,
+    '--git-remote-url': /^(?:https:\/\/github\.com\/)?[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}?(?:\.git)?$/,
+    '--git-remote-name': /^[A-Za-z0-9._-]{1,50}$/,
+    '--context': /^deploy-preview$/,
+    '--account-slug': /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/,
+};
+/** Whether the folder is linked to a Netlify site: `.netlify/state.json` names it. */
+function linkedToSite(dir) {
+    try {
+        return typeof JSON.parse(readFileSync(join(dir, '.netlify', 'state.json'), 'utf8')).siteId === 'string';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The Netlify CLI: `--version` and `status` at any time; once the person signed in to Netlify for the setup, the
+ * project's link and creation, in the person's own current team or the one team they chose (`team`), and a built draft
+ * deploy for a deploy preview of a linked folder. The sign-in and the repository's connection are the tools' (a
+ * `netlify login` outside the sign-in screen, and a `netlify init` that asks its questions in a terminal, never run).
+ * Never production or a project's removal, and nothing of its environment variables, its API (which reaches them) or
+ * a token on the command line.
+ */
+function netlify(args, where, agreed, team) {
+    const words = [];
+    const options = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!arg.startsWith('-')) {
+            words.push(arg);
+            continue;
+        }
+        const at = arg.indexOf('=');
+        const name = at > 0 ? arg.slice(0, at) : arg;
+        // A value never starts with a dash, so an option can hide no other behind it.
+        const value = at > 0 ? arg.slice(at + 1) : NETLIFY_VALUES.has(name) && args[i + 1] !== undefined && !args[i + 1].startsWith('-') ? args[++i] : true;
+        options.set(name, value);
+    }
+    const [sub = '', ...rest] = words;
+    if (options.has('--auth'))
+        return deny('puts a Netlify token on the command line');
+    if (options.has('--prod') || options.has('-p') || options.has('--prod-if-unlocked'))
+        return never('deploys to production');
+    if (sub === 'sites:delete' || sub === 'sites:remove')
+        return never('removes a Netlify project');
+    if (/^env:(set|unset|import|clone|migrate)$/.test(sub))
+        return never("changes a Netlify project's environment variables");
+    if ((!sub && options.size === 1 && (options.has('--version') || options.has('-v'))) || (sub === 'status' && !rest.length && [...options.keys()].every((n) => n === '--json')))
+        return allow();
+    if (sub === 'login')
+        return deny('the Netlify sign-in is impeccable_ask\'s, with the id netlify-setup: it opens the browser from the sign-in screen');
+    if (sub === 'init')
+        return deny('netlify init asks its questions in a terminal this run does not have: impeccable_netlify_connect connects the repository');
+    if (!agreed)
+        return deny('sets Netlify up, and the person has not signed in to Netlify for that');
+    /** Only these options, each with a value of its kind. */
+    const only = (...names) => [...options].every(([n, v]) => names.includes(n) && (!NETLIFY_VALUES.has(n) || (typeof v === 'string' && NETLIFY_VALID[n].test(v))));
+    if (options.has('--account-slug') && options.get('--account-slug') !== team)
+        return deny('names a Netlify team the person did not choose');
+    switch (sub) {
+        case 'link':
+            return !rest.length && options.size >= 1 && only('--name', '--id', '--git-remote-url', '--git-remote-name') ? allow() : deny('a netlify link off the allowlist');
+        case 'sites:create':
+            return !rest.length && only('--name', '--json', '--account-slug') ? allow() : deny('a netlify sites:create off the allowlist');
+        case 'deploy':
+            if (rest.length || !options.has('--build') || !options.has('--context') || !only('--build', '--context', '--json'))
+                return deny('a netlify deploy other than a built draft for the deploy-preview context');
+            // Where no site is linked the CLI creates one with a random name, which is not what the person said yes to.
+            return linkedToSite(where.cwd) ? allow() : deny('a netlify deploy in a folder linked to no site');
+        default:
+            return deny(sub.startsWith('env') ? "Netlify's environment variables are the person's" : `netlify ${sub || 'without a command'} is not on the allowlist`);
+    }
+}
+/** The Vercel CLI's options that take a value, of those the rules below allow, so the value is not read as a command. */
+const VERCEL_VALUES = new Set(['--cwd', '--target', '--scope', '-S', '--team']);
+/** The options that name a team: the CLI never picks one without a terminal, so the run names the one the person chose. */
+const VERCEL_TEAM = ['--scope', '-S', '--team'];
+/**
+ * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
+ * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
+ * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
+ * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
+ * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
+ * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
+ * line.
+ */
+function vercel(args, where, agreed, team) {
+    const words = [];
+    const options = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!arg.startsWith('-')) {
+            words.push(arg);
+            continue;
+        }
+        const at = arg.indexOf('=');
+        const name = at > 0 ? arg.slice(0, at) : arg;
+        // A value never starts with a dash, so an option can hide no other behind it.
+        const value = at > 0 ? arg.slice(at + 1) : VERCEL_VALUES.has(name) && args[i + 1] !== undefined && !args[i + 1].startsWith('-') ? args[++i] : true;
+        options.set(name, value);
+    }
+    const [sub = '', ...rest] = words;
+    if ([...options.keys()].some((name) => name === '--token' || /^-t/.test(name)))
+        return deny('puts a Vercel token on the command line');
+    if (options.has('--prod') || (options.has('--target') && options.get('--target') !== 'preview'))
+        return never('deploys to production');
+    if (sub === 'project' && ['rm', 'remove'].includes(rest[0] ?? ''))
+        return never('removes a Vercel project');
+    if ((!sub && options.size === 1 && (options.has('--version') || options.has('-v'))) || (sub === 'whoami' && !rest.length && !options.size))
+        return allow();
+    if (sub === 'login')
+        return deny('the Vercel sign-in is impeccable_ask\'s, with the id vercel-setup: it opens the browser from the sign-in screen');
+    if (!agreed)
+        return deny('sets Vercel up, and the person has not signed in to Vercel for that');
+    const cwd = options.get('--cwd');
+    if (cwd !== undefined && (typeof cwd !== 'string' || outside(cwd, where)))
+        return deny('points the Vercel CLI outside the checkout');
+    if (VERCEL_TEAM.some((name) => options.has(name) && options.get(name) !== team))
+        return deny('names a Vercel team the sign-in did not settle on');
+    /** Only these options, beside the folder and the prompts' absence. */
+    const only = (...names) => [...options.keys()].every((n) => [...names, '--cwd', '--non-interactive'].includes(n));
+    switch (sub) {
+        case 'link':
+            return !rest.length && only('--yes', '-y', ...VERCEL_TEAM) ? allow() : deny('a vercel link off the allowlist');
+        case 'project':
+            return ['add', 'ls', 'list'].includes(rest[0] ?? '') && rest.length <= 2 && only(...VERCEL_TEAM) ? allow() : deny('a vercel project command off the allowlist');
+        case 'git':
+            return rest.join(' ') === 'connect' && only(...VERCEL_TEAM) ? allow() : deny('a vercel git command other than connect');
+        case 'deploy':
+            return rest.length <= 1 && inside(rest, where) && only('--yes', '-y', '--target', ...VERCEL_TEAM) ? allow() : deny('a vercel deploy off the preview allowlist');
+        case 'env':
+            return deny("Vercel's environment variables are the person's");
+        default:
+            return deny(`vercel ${sub || 'without a command'} is not on the allowlist`);
+    }
+}
+function simpleCommand(seg, where, opts) {
+    const env = seg.words.slice(0, envCount(seg.words));
+    const words = seg.words.slice(env.length);
+    for (const r of seg.redirects) {
+        if (r.op.includes('>') && r.target !== '/dev/null' && outside(r.target, where) && !intoScratch(r.target, where))
+            return never('writes outside the checkout');
+    }
+    if (words.includes('sudo'))
+        return never('sudo');
+    if (rmRecursiveForce(words))
+        return never('rm -rf');
+    if (words[0] === 'git' && words.includes('push') && forcePush(words.slice(words.indexOf('push') + 1)))
+        return never('a force push');
+    if (words[0] === 'git' && words.includes('reset') && words.includes('--hard'))
+        return never('git reset --hard');
+    const [cmd = '', ...args] = words;
+    const positional = pathsOf(args);
+    if (WRITES_EVERY_ARG.has(cmd) && positional.some((a) => outside(a, where)))
+        return never('writes outside the checkout');
+    if (WRITES_LAST_ARG.has(cmd) && positional.length && outside(positional[positional.length - 1], where))
+        return never('writes outside the checkout');
+    if (cmd === 'dd' && args.some((a) => a.startsWith('of=') && outside(a.slice(3), where)))
+        return never('writes outside the checkout');
+    // Output may go into the scratch folder, and input may come out of it; /dev/null takes and gives nothing.
+    const scratch = (r) => (r.op.includes('>') ? intoScratch(r.target, where) : inScratch(r.target, where));
+    const redirects = seg.redirects.filter((r) => r.target !== '/dev/null');
+    if (redirects.some((r) => r.op.includes('>') && !scratch(r)))
+        return deny('writes a file through the shell');
+    if (redirects.some((r) => outside(r.target, where) && !scratch(r)))
+        return deny('reads outside the checkout');
+    // Input from a file is a read like a named path, so a .env file stays closed that way too, in the checkout or the scratch folder.
+    if (redirects.some((r) => r.op.includes('<') && isSecretFile(r.target)))
+        return deny('reads a .env file');
+    if (!cmd)
+        return deny(env.length ? 'sets environment variables and runs nothing' : 'a redirection on its own');
+    if (env.length && !TAKES_SETTINGS.has(cmd))
+        return deny(`settings in front of ${cmd}, where only a package manager or a tool runner takes them`);
+    for (const assignment of env) {
+        const problem = envProblem(assignment, where);
+        if (problem)
+            return deny(problem);
+    }
+    switch (cmd) {
+        case 'cd':
+            if (args.length !== 1 || outside(args[0], where))
+                return deny('leaves the checkout');
+            // A cd that may be skipped (after && or ||), runs in a pipe, or goes nowhere leaves what follows where it was.
+            if (!seg.certain)
+                return deny('a cd that runs only sometimes: put it first, or after ;');
+            return isFolder(realPath(resolve(where.cwd, args[0]))) ? allow() : deny('a cd into a folder that is not there');
+        case 'git':
+            return git(args, where, opts.protectedBranches);
+        case 'gh':
+            if (args[0] === 'pr' && (args[1] === 'create' || args[1] === 'view'))
+                return allow();
+            // The test drive opens as a draft where its preview needs the pull request first, and is marked ready once that preview is proven: the test drive's branch by name, nothing else.
+            if (args[0] === 'pr' && args[1] === 'ready')
+                return ghReady(args.slice(2)) !== null ? allow() : deny('gh pr ready takes the test drive branch by name, and --repo');
+            return deny('a gh command off the allowlist');
+        case 'npx':
+        case 'bunx':
+            return tool(args, where, opts.scriptsChanged);
+        case 'node':
+        case 'python':
+        case 'python3':
+        case 'ruby':
+            return args.length === 1 && ['--version', '-V', '-v'].includes(args[0]) ? allow() : deny('only runtime version checks run here');
+        case 'ls':
+        case 'cat':
+        case 'head':
+        case 'grep':
+        case 'find':
+            return reader(cmd, args, where);
+        case 'netlify':
+            return netlify(args, where, opts.hosts.has('netlify'), opts.teams.get('netlify'));
+        case 'vercel':
+            return vercel(args, where, opts.hosts.has('vercel'), opts.teams.get('vercel'));
+        default:
+            if (PACKAGE_MANAGERS.has(cmd) && installsHostCli(cmd, args, opts.hosts))
+                return allow('installs the CLI of the host the person said yes to');
+            return PACKAGE_MANAGERS.has(cmd) ? packageManager(cmd, args, where, opts.scriptsChanged) : deny(`${cmd} is not on the allowlist`);
+    }
+}
+/** The fence's answer for one shell command run from the checkout's top folder. */
+export function classifyCommand(command, root, options = {}) {
+    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map() };
+    const segments = parseCommand(command);
+    if (!segments)
+        return deny('uses shell syntax the fence does not read');
+    if (!segments.length)
+        return deny('an empty command');
+    const where = { root: realPath(root), cwd: root, scratch: options.scratch && realPath(options.scratch) };
+    let result = allow();
+    for (const seg of segments) {
+        const decision = simpleCommand(seg, where, opts);
+        if (decision.verdict === 'never')
+            return decision;
+        if (decision.verdict === 'deny' && result.verdict === 'allow')
+            result = decision;
+        // Only a cd that surely runs, in this shell, into a folder that is there moves what follows, so each later path and script is judged where it runs.
+        if (seg.words[0] === 'cd' && decision.verdict === 'allow')
+            where.cwd = resolve(where.cwd, seg.words[1]);
+    }
+    return result;
+}
+/**
+ * Commands for the disposable local preview verifier only. This is not a new
+ * shell allowlist for the person's checkout: the verifier supplies an isolated
+ * copy, environment, database and process lifetime. No arbitrary evaluators,
+ * deployment commands, redirects or background processes are accepted here.
+ */
+export function classifyPreviewCommand(command, root, options = {}) {
+    const segments = parseCommand(command);
+    if (!segments?.length)
+        return deny('unsupported preview command syntax');
+    const where = { root: realPath(root), cwd: root };
+    const appTool = (name, args) => {
+        if (args.some((a) => a === '--remote' || a.startsWith('--remote=') || isSecretFile(a)))
+            return false;
+        if (!inside(args, where))
+            return false;
+        switch (name) {
+            case 'prisma':
+                return args[0] === 'generate' || (args[0] === 'db' && ['push', 'seed'].includes(args[1] ?? '')) || (args[0] === 'migrate' && args[1] === 'deploy');
+            case 'nuxt': return ['prepare', 'build', 'dev', 'preview'].includes(args[0] ?? '');
+            case 'next': return ['build', 'dev', 'start'].includes(args[0] ?? '');
+            case 'vite': return !args.length || ['build', 'dev', 'preview', '--host'].includes(args[0] ?? '');
+            case 'astro': return ['build', 'dev', 'preview'].includes(args[0] ?? '');
+            case 'wrangler':
+                return args.includes('--local') && !args.some((a) => a.startsWith('--local=')) && (args[0] === 'dev' || (args[0] === 'd1' &&
+                    ((args[1] === 'migrations' && args[2] === 'apply') || (args[1] === 'execute' && args.includes('--file')))));
+            case 'rails':
+            case 'bin/rails': return ['server', 'db:prepare', 'db:migrate', 'db:seed'].includes(args[0] ?? '');
+            case 'rake': return ['db:prepare', 'db:migrate', 'db:seed'].includes(args[0] ?? '');
+            case 'uvicorn': return /^[A-Za-z_][\w.]*:[A-Za-z_]\w*$/.test(args[0] ?? '');
+            default: return false;
+        }
+    };
+    for (const segment of segments) {
+        if (segment.redirects.length)
+            return deny('preview output is managed by the verifier');
+        const [cmd = '', ...args] = segment.words;
+        if (cmd === 'cd') {
+            if (!segment.certain || args.length !== 1 || outside(args[0], where))
+                return deny('preview directory leaves its copy, or may not be entered');
+            where.cwd = resolve(where.cwd, args[0]);
+            continue;
+        }
+        if (args.some(isSecretFile) || !inside(args, where))
+            return deny('preview arguments leave the copy or read live environment files');
+        let permitted = false;
+        if (PACKAGE_MANAGERS.has(cmd)) {
+            if (options.scriptsChanged)
+                return deny('runs package.json scripts the agent changed');
+            // Tools go through appTool's shorter list here, never through the checkout's.
+            permitted = packageManager(cmd, args, where, false, false).verdict === 'allow' ||
+                (args[0] === 'exec' && appTool(args[1] ?? '', args.slice(2)));
+        }
+        else if (cmd === 'npx') {
+            if (options.scriptsChanged)
+                return deny('runs package.json scripts the agent changed');
+            const at = args[0] === '--no-install' ? 1 : 0;
+            permitted = appTool(args[at] ?? '', args.slice(at + 1));
+        }
+        else if (['python', 'python3', '.venv/bin/python', '.venv/bin/python3'].includes(cmd)) {
+            if (args[0] === '-m') {
+                permitted = args[1] === 'venv' && args.length === 3 && args[2] === '.venv';
+                if (args[1] === 'pip')
+                    permitted = args.length === 5 && args[2] === 'install' && args[3] === '-r' && Boolean(args[4]);
+                if (args[1] === 'uvicorn')
+                    permitted = appTool('uvicorn', args.slice(2));
+            }
+            else {
+                permitted = Boolean(args[0]?.endsWith('.py')) && !args[0].startsWith('-');
+                if (basename(args[0] ?? '') === 'manage.py') {
+                    permitted = ['migrate', 'collectstatic', 'runserver', 'check', 'loaddata', 'seed', 'seed_demo'].includes(args[1] ?? '') &&
+                        !args.some((a) => /^(?:--database|--settings|--pythonpath)(?:=|$)/.test(a));
+                }
+            }
+        }
+        else if (cmd === 'bundle') {
+            permitted = args[0] === 'install' && args.slice(1).every((a) => a === '--local' || a === '--quiet');
+            if (args[0] === 'exec')
+                permitted = appTool(args[1] ?? '', args.slice(2));
+        }
+        else if (cmd === 'node') {
+            permitted = Boolean(args[0]) && !args[0].startsWith('-') && args[0] !== '-';
+        }
+        else {
+            permitted = appTool(cmd, args);
+        }
+        if (!permitted)
+            return deny('command is outside the local preview allowlist');
+    }
+    return allow('inside the disposable preview verifier');
+}
+/** The fence's answer for pi's file tools: writes stay in the checkout and out of .git; reads stay in it or in the run's scratch folder, and off .env files. */
+export function classifyFileTool(tool, path, root, scratch) {
+    const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
+    const p = typeof path === 'string' && path ? path : '.';
+    if (tool === 'write' || tool === 'edit') {
+        if (outside(p, where))
+            return never('writes outside the checkout');
+        return within(realPath(resolve(root, p)), join(where.root, '.git')) ? never('writes into .git, where hooks run') : allow();
+    }
+    if (outside(p, where) && !inScratch(p, where))
+        return deny('reads outside the checkout');
+    if ((tool === 'read' || tool === 'grep') && isSecretFile(p))
+        return deny('reads a .env file');
+    return allow();
+}
+const previewRetries = new WeakMap();
+export function previewRetryState(log) {
+    let state = previewRetries.get(log);
+    if (!state) {
+        state = { used: 0, pushReservations: 0, creationReserved: false, drivePushes: 0, driveCreated: false, requireHistory: false, historyKnown: false, observed: new Map() };
+        previewRetries.set(log, state);
+    }
+    return state;
+}
+const setupBranch = (branch) => /^impeccable\/setup(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
+const driveBranch = (branch) => /^impeccable\/test-drive(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
+/** `gh pr ready <the test drive's branch> [--repo <owner>/<name>]`, and nothing else (never `--undo`, a number or another branch): the branch and the repository named, or null. */
+function ghReady(args) {
+    const [branch, ...rest] = args;
+    if (!branch || !driveBranch(branch))
+        return null;
+    if (!rest.length)
+        return { branch };
+    const inline = rest[0]?.startsWith('--repo=') ? rest[0].slice('--repo='.length) : undefined;
+    const repository = inline ?? (rest[0] === '--repo' || rest[0] === '-R' ? rest[1] : undefined);
+    return rest.length === (inline !== undefined ? 1 : 2) && typeof repository === 'string' && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/.test(repository) ? { branch, repository } : null;
+}
+const pushBranch = (words, literal = setupBranch) => words.length === 5 && words[0] === 'git' && words[1] === 'push'
+    && ['-u', '--set-upstream'].includes(words[2]) && words[3] === 'origin' && literal(words[4]) ? words[4] : undefined;
+function createArguments(args) {
+    const values = new Map();
+    const names = {
+        '-H': 'head', '--head': 'head', '-R': 'repo', '--repo': 'repo', '-B': 'base', '--base': 'base',
+        '-t': 'title', '--title': 'title', '-b': 'body', '--body': 'body', '-F': 'body-file', '--body-file': 'body-file',
+        '-a': 'assignee', '--assignee': 'assignee', '-r': 'reviewer', '--reviewer': 'reviewer',
+        '-l': 'label', '--label': 'label', '-m': 'milestone', '--milestone': 'milestone', '-p': 'project', '--project': 'project',
+    };
+    const booleans = new Set(['-d', '--draft', '--no-maintainer-edit', '-f', '--fill', '--fill-first', '--fill-verbose']);
+    const repeatable = new Set(['assignee', 'reviewer', 'label', 'project']);
+    let filled = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (booleans.has(arg)) {
+            filled ||= ['-f', '--fill', '--fill-first', '--fill-verbose'].includes(arg);
+            continue;
+        }
+        const at = arg.startsWith('--') ? arg.indexOf('=') : -1;
+        const name = names[at < 0 ? arg : arg.slice(0, at)];
+        if (!name)
+            return;
+        const value = at < 0 ? args[++i] : arg.slice(at + 1);
+        if (value === undefined || (at < 0 && value.startsWith('-')) || (values.has(name) && !repeatable.has(name)))
+            return;
+        values.set(name, value);
+    }
+    const head = values.get('head'), bodyFile = values.get('body-file');
+    if (head !== undefined && !setupBranch(head) && !driveBranch(head))
+        return;
+    if (!filled && (!values.get('title')?.trim() || (!values.has('body') && !values.has('body-file'))))
+        return;
+    if (values.has('body') && values.has('body-file'))
+        return;
+    if (values.has('body-file') && (!bodyFile || bodyFile === '-'))
+        return;
+    return { head, repository: values.get('repo'), bodyFile };
+}
+/** Called synchronously only after the ordinary fence allows the entire command. */
+export function reservePreviewCommand(state, command, root, scratch) {
+    const segments = parseCommand(command);
+    if (!segments)
+        return deny('unsupported command syntax');
+    const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
+    let used = state.used, pushes = state.pushReservations, create = state.createBranch, reserved = state.creationReserved;
+    let drive = state.driveBranch, drivePushes = state.drivePushes, driveCreated = state.driveCreated;
+    for (const { words } of segments) {
+        if (words[0] === 'cd') {
+            where.cwd = resolve(where.cwd, words[1]);
+            continue;
+        }
+        // The test drive is the run's other pull request: one branch, one pull request, a few pushes, none of the setup pull request's attempts.
+        const drivePush = pushBranch(words, driveBranch);
+        if (drivePush) {
+            if (drive && drivePush !== drive)
+                return deny('keep the test drive on one branch');
+            if (++drivePushes > 3)
+                return deny('the test drive has been pushed three times already');
+            drive = drivePush;
+            continue;
+        }
+        if (words[0] === 'git' && words[1] === 'push') {
+            const branch = pushBranch(words), locked = state.pr?.branch ?? create;
+            if (!branch)
+                return deny('push only a literal setup branch');
+            if (locked && branch !== locked)
+                return deny('keep corrections on the setup pull request branch');
+            if (reserved && !locked)
+                return deny('record the created setup pull request before another push');
+            if (state.recordedPr && !state.pr)
+                return deny('verify the recorded setup pull request before another push');
+            if (state.pr && state.requireHistory && !state.historyKnown)
+                return deny('read the setup preview attempts before another push');
+            if (++used > 3)
+                return deny('three preview attempts have already been reserved or observed');
+            pushes++;
+        }
+        if (words[0] === 'gh' && words[1] === 'pr' && words[2] === 'create') {
+            const parsed = createArguments(words.slice(3));
+            if (!parsed)
+                return deny('create each pull request with a title and a body, or --fill');
+            const body = parsed.bodyFile;
+            if (body && (body.startsWith('~') || /[$*?[]/.test(body) || isSecretFile(body) || isSecretFile(realPath(resolve(where.cwd, body)))
+                || (outside(body, where) && !inScratch(body, where))))
+                return deny('use a non-secret body file inside the checkout or run scratch');
+            if (state.requireHistory && (!parsed.head || !parsed.repository))
+                return deny('name the repository and literal head explicitly for self-hosted previews');
+            if (!state.repository || (parsed.repository !== undefined && parsed.repository.toLowerCase() !== state.repository.toLowerCase())
+                || (!parsed.repository && realPath(where.cwd) !== where.root))
+                return deny('name this repository explicitly when creating a pull request');
+            if (parsed.head && driveBranch(parsed.head)) {
+                if (driveCreated)
+                    return deny('the test drive is already open');
+                if (drive && parsed.head !== drive)
+                    return deny('open the test drive from the branch that was pushed');
+                drive = parsed.head;
+                driveCreated = true;
+                continue;
+            }
+            if (state.recordedPr || state.pr || reserved)
+                return deny('the setup pull request is already created or reserved');
+            // Hosted PR creation is not itself a preview attempt. Self-hosted flows
+            // require --head above, so gh cannot spend an uncounted implicit push there.
+            create = parsed.head;
+            reserved = true;
+        }
+        // Marking a draft ready starts its review: only the test drive this run opened, in this repository (named, or the checkout's own), never another repository's draft.
+        if (words[0] === 'gh' && words[1] === 'pr' && words[2] === 'ready') {
+            const parsed = ghReady(words.slice(3));
+            if (!parsed)
+                return deny('mark ready only the test drive, by its branch name');
+            if (!state.repository || (parsed.repository !== undefined && parsed.repository.toLowerCase() !== state.repository.toLowerCase())
+                || (!parsed.repository && realPath(where.cwd) !== where.root))
+                return deny('name this repository explicitly when marking the test drive ready');
+            if (!driveCreated || parsed.branch !== drive)
+                return deny('mark ready the test drive this run opened');
+        }
+    }
+    // Every segment passes before any reservation becomes visible to the next tool call.
+    if (pushes !== state.pushReservations && state.pr)
+        state.historyKnown = false;
+    state.used = used;
+    state.pushReservations = pushes;
+    state.createBranch = create;
+    state.creationReserved = reserved;
+    state.driveBranch = drive;
+    state.drivePushes = drivePushes;
+    state.driveCreated = driveCreated;
+    return allow();
+}
+function canonicalPreviewPr(state, pr) {
+    if (!state.repository || !Number.isSafeInteger(pr.number) || pr.number < 1 || !URL.canParse(pr.url))
+        return;
+    const url = new URL(pr.url), expected = `/${state.repository}/pull/${pr.number}`;
+    if (url.origin !== 'https://github.com' || url.username || url.password || url.search || url.hash
+        || url.pathname.replace(/\/$/, '').toLowerCase() !== expected.toLowerCase())
+        return;
+    return `https://github.com${expected}`;
+}
+/** The caller has already verified this PR is open and its head belongs to this repository. */
+export function bindPreviewPullRequest(state, pr) {
+    const url = canonicalPreviewPr(state, pr);
+    if (!url || !setupBranch(pr.branch))
+        return deny('record a setup pull request in this repository');
+    if (state.createBranch && state.createBranch !== pr.branch)
+        return deny('record the reserved setup branch');
+    if (state.recordedPr && (state.recordedPr.number !== pr.number || canonicalPreviewPr(state, state.recordedPr) !== url))
+        return deny('the setup pull request cannot change');
+    if (state.pr && (state.pr.number !== pr.number || state.pr.url !== url || state.pr.branch !== pr.branch))
+        return deny('the setup pull request cannot change');
+    state.pr = { ...pr, url };
+    state.recordedPr = { number: pr.number, url };
+    state.createBranch = pr.branch;
+    state.creationReserved = true;
+    return allow();
+}
+/** Only the fixed GitHub observer supplies validated identities, never model arguments. */
+export function observePreviewAttempts(state, runs, historyComplete) {
+    if (runs.length > 100 || runs.some(({ runId, attempt }) => !Number.isSafeInteger(runId) || runId < 1 || !Number.isSafeInteger(attempt) || attempt < 1)) {
+        state.historyKnown = false;
+        return;
+    }
+    if (new Set([...state.observed.keys(), ...runs.map((run) => run.runId)]).size > 20) {
+        state.used = Math.max(state.used, 3);
+        state.historyKnown = false;
+        return;
+    }
+    let reruns = 0;
+    for (const { runId, attempt } of runs) {
+        const previous = state.observed.get(runId);
+        reruns += Math.max(0, attempt - (previous ?? 1));
+        state.observed.set(runId, Math.max(previous ?? 0, attempt));
+    }
+    state.used = Math.max(state.used + reruns, [...state.observed.values()].reduce((sum, n) => sum + n, 0));
+    state.historyKnown = historyComplete;
+}
+/** The hosts the person said yes to setting up in this run, by the run's log. */
+const agreedHosts = new WeakMap();
+function hostsAgreed(log) {
+    let hosts = agreedHosts.get(log);
+    if (!hosts)
+        agreedHosts.set(log, (hosts = new Set()));
+    return hosts;
+}
+/** A yes to impeccable_ask's confirm "<host>-setup", or the host's CLI found signed in there, lets that host's CLI run for the rest of the run. */
+export function agreeToHostSetup(log, questionId) {
+    const host = /^(.+)-setup$/.exec(questionId)?.[1];
+    if (host && Object.hasOwn(HOST_CLIS, host))
+        hostsAgreed(log).add(host);
+}
+/** Whether the person opened this host's setup in this run: the tools that change something on the host ask this, as the fence does for the CLI. */
+export function hostSetupAgreed(log, host) {
+    return hostsAgreed(log).has(host);
+}
+/** The team the person picked for each host's CLI in this run, by the run's log. */
+const chosenTeams = new WeakMap();
+function teamsChosen(log) {
+    let teams = chosenTeams.get(log);
+    if (!teams)
+        chosenTeams.set(log, (teams = new Map()));
+    return teams;
+}
+/** A pick from impeccable_ask's single choice "<host>-team", after the yes to setting that host up, is the one team that host's CLI may name. */
+export function chooseHostTeam(log, questionId, team) {
+    const host = /^(.+)-team$/.exec(questionId)?.[1];
+    if (host && Object.hasOwn(HOST_CLIS, host) && hostsAgreed(log).has(host) && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(team))
+        teamsChosen(log).set(host, team);
+}
+/** Tool calls a run makes before the fence refuses more: a setup takes far fewer, and a run steered elsewhere stops there. */
+export const MAX_TOOL_CALLS = 400;
+/** What still runs past the cap, so the run can say where it got to and end. */
+const FINISHING = new Set(['impeccable_progress', 'impeccable_report']);
+/** Names shaped like a credential, which the agent's shell does not inherit: the scripts it runs are the repository's code, run as the person. */
+const CREDENTIAL = /TOKEN|SECRET|PASSW(?:OR)?D|PASSPHRASE|CREDENTIAL|PRIVATE|(?:^|_)(?:API_?)?KEY(?:_|$)|APIKEY|AUTH(?!OR)|COOKIE|_PWD$|DATABASE_URL$|^(?:AWS|AZURE|ANTHROPIC|OPENAI|OP_SESSION)_/i;
+/**
+ * The environment for the agent's shell: the person's, without credentials, whether by name or as a URL's password (a database's
+ * connection string), a proxy's too. A folder or a socket is a place, not a secret, so VERCEL_AUTH_CONFIG_DIR and SSH_AUTH_SOCK stay; gh
+ * and git sign in from their own config and keychain.
+ */
+export function shellEnvironment(env) {
+    return Object.fromEntries(Object.entries(env).filter(([name, value]) => /_(?:DIR|HOME|SOCK)$/.test(name)
+        || (!CREDENTIAL.test(name) && !/:\/\/[^/@\s:]*:[^/@\s]+@/.test(value ?? ''))));
+}
+export function fenceExtension(root, log, protectedBranches, scratch) {
+    const retry = previewRetryState(log);
+    return (pi) => {
+        /** The first file the agent changed that the scripts and tools load, and the first of those but vite.config, which also stops the local preview check. */
+        let changed;
+        let previewChanged;
+        let calls = 0;
+        pi.on('tool_call', (event) => {
+            if (++calls > MAX_TOOL_CALLS && !FINISHING.has(event.toolName)) {
+                log.write('fence deny (the tool call cap)', event.toolName);
+                return { block: true, reason: `Refused: this run has made ${MAX_TOOL_CALLS} tool calls, its limit. Call impeccable_progress with every task's final status, then impeccable_report with what was done and what was left.` };
+            }
+            const input = event.input;
+            const scriptsChanged = changed ?? false;
+            let decision;
+            let shown;
+            if (event.toolName === 'bash') {
+                shown = String(input.command ?? '');
+                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log) });
+                if (decision.verdict === 'allow')
+                    decision = reservePreviewCommand(retry, shown, root, scratch);
+            }
+            else if (event.toolName === 'impeccable_verify_preview' && previewChanged) {
+                shown = `local preview after an edit of ${previewChanged}`;
+                decision = deny(changedReason(previewChanged));
+            }
+            else if (['read', 'write', 'edit', 'grep', 'find', 'ls'].includes(event.toolName)) {
+                shown = `${event.toolName} ${String(input.path ?? '.')}`;
+                decision = classifyFileTool(event.toolName, input.path, root, scratch);
+                // The name written to and the file it resolves to: through a symlink, a vite.config may be another config.
+                const loaded = [String(input.path), realPath(resolve(root, String(input.path)))].filter((p) => LOADED.test(p));
+                if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow' && loaded.length) {
+                    changed ??= String(input.path);
+                    if (!loaded.every((p) => VITE_CONFIG.test(p)))
+                        previewChanged ??= String(input.path);
+                }
+            }
+            else {
+                return undefined;
+            }
+            log.write(`fence ${decision.verdict} (${decision.reason})`, shown);
+            if (decision.verdict === 'allow')
+                return undefined;
+            if (decision.verdict === 'never')
+                return { block: true, reason: `Blocked: ${decision.reason}. Impeccable never does this; find another way.` };
+            return {
+                block: true,
+                reason: `Refused: ${decision.reason}. The person is never asked to run a command. Find another way with what runs (a package script, a config change, another tool on the list); if there is none, leave the step undone and put it in the report under "What was skipped, and why", with the exact command for the person.`,
+            };
+        });
+    };
+}