@ordewell/core 0.4.8 → 0.4.9

package/dist/index.js

@@ -166,6 +166,7 @@ __export(index_exports, {
   emptyWarnings: () => emptyWarnings,
   enabledRunners: () => enabledRunners,
   ensureDir: () => ensureDir,
+  ensureStateDirIgnored: () => ensureStateDirIgnored,
   escapeControlCharsInStrings: () => escapeControlCharsInStrings,
   executionLogBlock: () => executionLogBlock,
   executionSummary: () => executionSummary,
@@ -642,13 +643,1233 @@ var AUTO_COMMANDS = [
   "jq",
   "yq"
 ];
+var UNIVERSAL_FLAGS = ["--help", "--version"];
+var COUNT_FLAG = /^-\d+$/;
+var FLAG_POLICY = {
+  ls: {
+    cluster: true,
+    booleans: [
+      "-1",
+      "-a",
+      "-A",
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-D",
+      "-f",
+      "-F",
+      "-g",
+      "-G",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-q",
+      "-Q",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "-t",
+      "-u",
+      "-U",
+      "-v",
+      "-x",
+      "-X",
+      "-Z",
+      "--all",
+      "--almost-all",
+      "--author",
+      "--escape",
+      "--classify",
+      "--file-type",
+      "--full-time",
+      "--no-group",
+      "--human-readable",
+      "--si",
+      "--dereference-command-line",
+      "--inode",
+      "--kibibytes",
+      "--dereference",
+      "--numeric-uid-gid",
+      "--literal",
+      "--hide-control-chars",
+      "--show-control-chars",
+      "--quote-name",
+      "--reverse",
+      "--recursive",
+      "--size",
+      "--directory",
+      "--group-directories-first",
+      "--context",
+      "--zero"
+    ],
+    values: [
+      "-w",
+      "-I",
+      "-T",
+      "--width",
+      "--ignore",
+      "--hide",
+      "--block-size",
+      "--color",
+      "--format",
+      "--sort",
+      "--time",
+      "--time-style",
+      "--indicator-style",
+      "--quoting-style",
+      "--tabsize"
+    ]
+  },
+  tree: {
+    cluster: true,
+    // `-o` is absent on purpose: it is tree's write-to-a-file flag, which the
+    // redirect check never sees because there is no redirect.
+    booleans: [
+      "-a",
+      "-d",
+      "-f",
+      "-i",
+      "-l",
+      "-x",
+      "-C",
+      "-n",
+      "-p",
+      "-s",
+      "-h",
+      "-u",
+      "-g",
+      "-D",
+      "-t",
+      "-c",
+      "-r",
+      "-F",
+      "-q",
+      "-N",
+      "-Q",
+      "-v",
+      "-J",
+      "-X",
+      "-Z",
+      "--noreport",
+      "--dirsfirst",
+      "--du",
+      "--prune",
+      "--matchdirs",
+      "--inodes",
+      "--device",
+      "--si",
+      "--gitignore",
+      "--ignore-case",
+      "--filesfirst",
+      "--nolinks",
+      "--hintro"
+    ],
+    values: [
+      "-L",
+      "-P",
+      "-I",
+      "-H",
+      "--filelimit",
+      "--timefmt",
+      "--charset",
+      "--sort",
+      "--gitfile",
+      "--info",
+      "--prefix"
+    ]
+  },
+  git: {
+    cluster: true,
+    // Absent on purpose, and each for a reason that was demonstrated rather than
+    // guessed at:
+    //   -c, --config-env  set configuration inline, and several configuration
+    //                     keys name a program to run (`core.pager`, `core.editor`,
+    //                     `diff.external`), so this is an execution flag with one
+    //                     indirection in front of it.
+    //   --exec-path       redirects where git finds its helper programs; a
+    //                     fabricated helper ran during an ordinary remote listing.
+    //   -O, --open-files-in-pager  runs an arbitrary named program over search hits.
+    //   --upload-pack, --receive-pack  name the program run on the other end.
+    //   --textconv, --ext-diff  run filters the repository itself configures.
+    //   --git-dir, --work-tree  repoint git at a tree whose configuration is not
+    //                     the one the developer is looking at.
+    //   -o, --output      write a file. `git ls-files -o` is a legitimate spelling
+    //                     of `--others`, but `git archive -o` writes, and the
+    //                     long spelling stays available for the read.
+    booleans: [
+      "-a",
+      "-b",
+      "-E",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-p",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-t",
+      "-u",
+      "-v",
+      "-w",
+      "-z",
+      "--oneline",
+      "--graph",
+      "--stat",
+      "--shortstat",
+      "--numstat",
+      "--dirstat",
+      "--summary",
+      "--name-only",
+      "--name-status",
+      "--raw",
+      "--patch",
+      "--no-patch",
+      "--patch-with-stat",
+      "--cached",
+      "--staged",
+      "--porcelain",
+      "--short",
+      "--long",
+      "--branch",
+      "--show-stash",
+      "--show-current",
+      "--all",
+      "--tags",
+      "--heads",
+      "--remotes",
+      "--list",
+      "--verbose",
+      "--quiet",
+      "--abbrev-ref",
+      "--count",
+      "--reverse",
+      "--first-parent",
+      "--no-merges",
+      "--merges",
+      "--follow",
+      "--full-history",
+      "--simplify-merges",
+      "--sparse",
+      "--dense",
+      "--ancestry-path",
+      "--left-right",
+      "--cherry",
+      "--cherry-pick",
+      "--cherry-mark",
+      "--boundary",
+      "--topo-order",
+      "--date-order",
+      "--author-date-order",
+      "--relative-date",
+      "--parents",
+      "--children",
+      "--timestamp",
+      "--no-walk",
+      "--do-walk",
+      "--decorate",
+      "--no-decorate",
+      "--abbrev-commit",
+      "--no-abbrev-commit",
+      "--abbrev",
+      "--no-abbrev",
+      "--color",
+      "--no-color",
+      "--pretty",
+      "--format",
+      "--expand-tabs",
+      "--no-expand-tabs",
+      "--numbered",
+      "--email",
+      "--no-notes",
+      "--notes",
+      "--show-signature",
+      "--find-renames",
+      "--find-copies",
+      "--find-copies-harder",
+      "--break-rewrites",
+      "--no-renames",
+      "--irreversible-delete",
+      "--full-index",
+      "--binary",
+      "--text",
+      "--check",
+      "--exit-code",
+      "--word-diff",
+      "--function-context",
+      "--ignore-all-space",
+      "--ignore-space-change",
+      "--ignore-space-at-eol",
+      "--ignore-blank-lines",
+      "--ignore-cr-at-eol",
+      "--no-prefix",
+      "--default-prefix",
+      "--no-textconv",
+      "--no-ext-diff",
+      "--submodule",
+      "--ignore-submodules",
+      "--recurse-submodules",
+      "--no-recurse-submodules",
+      "--others",
+      "--deleted",
+      "--modified",
+      "--unmerged",
+      "--stage",
+      "--killed",
+      "--ignored",
+      "--exclude-standard",
+      "--error-unmatch",
+      "--full-name",
+      "--directory",
+      "--no-empty-directory",
+      "--untracked-files",
+      "--no-optional-locks",
+      "--no-pager",
+      "--paginate",
+      "--bare",
+      "--literal-pathspecs",
+      "--glob-pathspecs",
+      "--noglob-pathspecs",
+      "--icase-pathspecs",
+      "--line-number",
+      "--column",
+      "--heading",
+      "--no-index",
+      "--untracked",
+      "--no-recursive",
+      "--name-rev",
+      "--root",
+      "--dirty",
+      "--broken",
+      "--always",
+      "--merged",
+      "--no-merged",
+      "--show-toplevel",
+      "--show-cdup",
+      "--git-common-dir",
+      "--absolute-git-dir",
+      "--is-inside-work-tree",
+      "--is-inside-git-dir",
+      "--is-bare-repository",
+      "--symbolic",
+      "--symbolic-full-name",
+      "--verify",
+      "--short-hash",
+      "--textual",
+      "--batch",
+      "--batch-check",
+      "--batch-all-objects",
+      "--buffer",
+      "--follow-symlinks",
+      "--use-mailmap"
+    ],
+    values: [
+      "-n",
+      "-C",
+      "-B",
+      "-M",
+      "-L",
+      "-S",
+      "-G",
+      "-U",
+      "-e",
+      "-m",
+      "-f",
+      "-g",
+      "-x",
+      "-X",
+      "-W",
+      "--max-count",
+      "--skip",
+      "--since",
+      "--after",
+      "--until",
+      "--before",
+      "--author",
+      "--grep",
+      "--grep-reflog",
+      "--committer",
+      "--date",
+      "--diff-filter",
+      "--unified",
+      "--stat-width",
+      "--stat-name-width",
+      "--stat-count",
+      "--word-diff-regex",
+      "--line-prefix",
+      "--src-prefix",
+      "--dst-prefix",
+      "--pickaxe-regex",
+      "--anchored",
+      "--color-moved",
+      "--color-words",
+      "--inter-hunk-context",
+      "--max-parents",
+      "--min-parents",
+      "--simplify-by-decoration",
+      "--glob",
+      "--exclude",
+      "--sort",
+      "--contains",
+      "--points-at",
+      "--decorate-refs",
+      "--decorate-refs-exclude",
+      "--encoding",
+      "--context",
+      "--max-depth",
+      // `--filters` is absent from this list on purpose: it runs the clean and
+      // smudge filters the repository under research configures, which is the
+      // same execution vector as the configuration flag above with a different
+      // spelling.
+      "--and",
+      "--or",
+      "--not",
+      "--all-match",
+      "--threads",
+      "--path"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  wc: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-l",
+      "-m",
+      "-w",
+      "-L",
+      "--bytes",
+      "--chars",
+      "--lines",
+      "--words",
+      "--max-line-length",
+      "--total"
+    ]
+  },
+  du: {
+    cluster: true,
+    booleans: [
+      "-0",
+      "-a",
+      "-b",
+      "-c",
+      "-D",
+      "-h",
+      "-H",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-P",
+      "-s",
+      "-S",
+      "-x",
+      "--all",
+      "--apparent-size",
+      "--bytes",
+      "--total",
+      "--dereference-args",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--count-links",
+      "--dereference",
+      "--no-dereference",
+      "--separate-dirs",
+      "--summarize",
+      "--one-file-system",
+      "--null"
+    ],
+    values: [
+      "-d",
+      "-t",
+      "-B",
+      "-X",
+      "--max-depth",
+      "--threshold",
+      "--block-size",
+      "--exclude",
+      "--exclude-from",
+      "--time",
+      "--time-style",
+      "--files0-from"
+    ]
+  },
+  df: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-m",
+      "-P",
+      "-T",
+      "-v",
+      "--all",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--local",
+      "--portability",
+      "--print-type",
+      "--total",
+      "--sync",
+      "--no-sync"
+    ],
+    values: ["-B", "-t", "-x", "--block-size", "--type", "--exclude-type"]
+  },
+  file: {
+    cluster: true,
+    // `-C`/`--compile` is absent: it writes a compiled magic file.
+    booleans: [
+      "-b",
+      "-c",
+      "-h",
+      "-i",
+      "-k",
+      "-L",
+      "-n",
+      "-N",
+      "-p",
+      "-r",
+      "-s",
+      "-S",
+      "-v",
+      "-z",
+      "-0",
+      "--brief",
+      "--mime",
+      "--mime-type",
+      "--mime-encoding",
+      "--dereference",
+      "--no-dereference",
+      "--keep-going",
+      "--no-buffer",
+      "--no-pad",
+      "--raw",
+      "--special-files",
+      "--uncompress",
+      "--print0",
+      "--checking-printout"
+    ],
+    values: [
+      "-e",
+      "-m",
+      "-P",
+      "-F",
+      "--exclude",
+      "--magic-file",
+      "--separator",
+      "--parameter",
+      "--extension",
+      "--files-from"
+    ]
+  },
+  head: {
+    cluster: true,
+    booleans: ["-q", "-v", "-z", "--quiet", "--silent", "--verbose", "--zero-terminated"],
+    values: ["-c", "-n", "--bytes", "--lines"],
+    patterns: [COUNT_FLAG]
+  },
+  tail: {
+    cluster: true,
+    booleans: [
+      "-f",
+      "-F",
+      "-q",
+      "-v",
+      "-z",
+      "--follow",
+      "--retry",
+      "--quiet",
+      "--silent",
+      "--verbose",
+      "--zero-terminated"
+    ],
+    values: [
+      "-c",
+      "-n",
+      "-s",
+      "--bytes",
+      "--lines",
+      "--sleep-interval",
+      "--pid",
+      "--max-unchanged-stats"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  cat: {
+    cluster: true,
+    booleans: [
+      "-A",
+      "-b",
+      "-e",
+      "-E",
+      "-n",
+      "-s",
+      "-t",
+      "-T",
+      "-u",
+      "-v",
+      "--show-all",
+      "--number-nonblank",
+      "--show-ends",
+      "--number",
+      "--squeeze-blank",
+      "--show-tabs",
+      "--show-nonprinting"
+    ]
+  },
+  sort: {
+    cluster: true,
+    // Absent on purpose: `-o`/`--output` writes a file with no redirect for the
+    // redirect check to see, and `--compress-program` names a program that sort
+    // runs over its own temporary files — a permitted binary as an interpreter.
+    booleans: [
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-f",
+      "-g",
+      "-h",
+      "-i",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-u",
+      "-V",
+      "-z",
+      "--ignore-leading-blanks",
+      "--check",
+      "--dictionary-order",
+      "--ignore-case",
+      "--general-numeric-sort",
+      "--human-numeric-sort",
+      "--ignore-nonprinting",
+      "--month-sort",
+      "--numeric-sort",
+      "--random-sort",
+      "--reverse",
+      "--stable",
+      "--unique",
+      "--version-sort",
+      "--zero-terminated",
+      "--debug"
+    ],
+    values: [
+      "-k",
+      "-t",
+      "-S",
+      "-T",
+      "--key",
+      "--field-separator",
+      "--buffer-size",
+      "--temporary-directory",
+      "--random-source",
+      "--batch-size",
+      "--parallel",
+      "--sort"
+    ]
+  },
+  uniq: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-d",
+      "-D",
+      "-i",
+      "-u",
+      "-z",
+      "--count",
+      "--repeated",
+      "--all-repeated",
+      "--ignore-case",
+      "--unique",
+      "--zero-terminated"
+    ],
+    values: ["-f", "-s", "-w", "--skip-fields", "--skip-chars", "--check-chars", "--group"]
+  },
+  // No flag on either runs a program or writes a file, and the planner's
+  // commonest use of `echo` is a section marker — `echo --- files changed ---`
+  // is three tokens that all begin with a dash and none of them is a flag.
+  echo: { freeform: true },
+  printf: { freeform: true },
+  date: {
+    cluster: true,
+    // `-s`/`--set` is absent: it sets the system clock.
+    booleans: [
+      "-u",
+      "-R",
+      "-I",
+      "--utc",
+      "--universal",
+      "--rfc-email",
+      "--rfc-3339",
+      "--iso-8601",
+      "--debug"
+    ],
+    values: ["-d", "-f", "-r", "--date", "--file", "--reference"]
+  },
+  stat: {
+    cluster: true,
+    booleans: ["-f", "-L", "-t", "--file-system", "--terse", "--dereference"],
+    values: ["-c", "--format", "--printf", "--cached"]
+  },
+  basename: {
+    cluster: true,
+    booleans: ["-a", "-z", "--multiple", "--zero"],
+    values: ["-s", "--suffix"]
+  },
+  dirname: {
+    cluster: true,
+    booleans: ["-z", "--zero"]
+  },
+  realpath: {
+    cluster: true,
+    booleans: [
+      "-e",
+      "-m",
+      "-L",
+      "-P",
+      "-q",
+      "-s",
+      "-z",
+      "--canonicalize-existing",
+      "--canonicalize-missing",
+      "--logical",
+      "--physical",
+      "--quiet",
+      "--strip",
+      "--no-symlinks",
+      "--zero"
+    ],
+    values: ["--relative-to", "--relative-base"]
+  },
+  pwd: { cluster: true, booleans: ["-L", "-P", "--logical", "--physical"] },
+  which: { cluster: true, booleans: ["-a", "-s", "--all"] },
+  type: { cluster: true, booleans: ["-a", "-f", "-p", "-P", "-t"] },
+  uname: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-i",
+      "-m",
+      "-n",
+      "-o",
+      "-p",
+      "-r",
+      "-s",
+      "-v",
+      "--all",
+      "--kernel-name",
+      "--nodename",
+      "--kernel-release",
+      "--kernel-version",
+      "--machine",
+      "--processor",
+      "--hardware-platform",
+      "--operating-system"
+    ]
+  },
+  whoami: {},
+  cut: {
+    cluster: true,
+    // `--output-delimiter` names a separator string, not a file.
+    booleans: ["-n", "-s", "-z", "--only-delimited", "--complement", "--zero-terminated"],
+    values: [
+      "-b",
+      "-c",
+      "-d",
+      "-f",
+      "--bytes",
+      "--characters",
+      "--delimiter",
+      "--fields",
+      "--output-delimiter"
+    ]
+  },
+  nl: {
+    cluster: true,
+    booleans: ["-p", "--no-renumber"],
+    values: [
+      "-b",
+      "-d",
+      "-f",
+      "-h",
+      "-i",
+      "-l",
+      "-n",
+      "-s",
+      "-v",
+      "-w",
+      "--body-numbering",
+      "--section-delimiter",
+      "--footer-numbering",
+      "--header-numbering",
+      "--join-blank-lines",
+      "--line-increment",
+      "--number-format",
+      "--number-separator",
+      "--starting-line-number",
+      "--number-width"
+    ]
+  },
+  rg: {
+    cluster: true,
+    // `--pre` runs a named preprocessor over every file searched and
+    // `--hostname-bin` runs a named program to resolve the hostname; both are
+    // absent, and `--pre-glob` with them.
+    booleans: [
+      "-a",
+      "-c",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-P",
+      "-q",
+      "-s",
+      "-S",
+      "-u",
+      "-uu",
+      "-uuu",
+      "-U",
+      "-v",
+      "-V",
+      "-w",
+      "-x",
+      "-z",
+      "--text",
+      "--count",
+      "--count-matches",
+      "--fixed-strings",
+      "--files",
+      "--files-with-matches",
+      "--files-without-match",
+      "--follow",
+      "--hidden",
+      "--no-hidden",
+      "--ignore-case",
+      "--case-sensitive",
+      "--smart-case",
+      "--invert-match",
+      "--line-number",
+      "--no-line-number",
+      "--with-filename",
+      "--no-filename",
+      "--heading",
+      "--no-heading",
+      "--column",
+      "--no-column",
+      "--byte-offset",
+      "--vimgrep",
+      "--json",
+      "--stats",
+      "--trim",
+      "--pretty",
+      "--passthru",
+      "--word-regexp",
+      "--line-regexp",
+      "--multiline",
+      "--multiline-dotall",
+      "--no-multiline",
+      "--crlf",
+      "--null",
+      "--null-data",
+      "--binary",
+      "--search-zip",
+      "--no-ignore",
+      "--no-ignore-dot",
+      "--no-ignore-exclude",
+      "--no-ignore-files",
+      "--no-ignore-global",
+      "--no-ignore-parent",
+      "--no-ignore-vcs",
+      "--no-ignore-messages",
+      "--no-messages",
+      "--no-require-git",
+      "--require-git",
+      "--one-file-system",
+      "--pcre2",
+      "--no-pcre2",
+      "--auto-hybrid-regex",
+      "--line-buffered",
+      "--block-buffered",
+      "--unicode",
+      "--no-unicode",
+      "--unrestricted",
+      "--type-list",
+      "--debug",
+      "--trace",
+      "--include-zero",
+      "--no-context-separator",
+      "--stop-on-nonmatch",
+      "--quiet",
+      "--no-binary"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-e",
+      "-E",
+      "-f",
+      "-g",
+      "-j",
+      "-m",
+      "-M",
+      "-r",
+      "-t",
+      "-T",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--context-separator",
+      "--field-context-separator",
+      "--field-match-separator",
+      "--regexp",
+      "--file",
+      "--glob",
+      "--iglob",
+      "--glob-case-insensitive",
+      "--type",
+      "--type-not",
+      "--type-add",
+      "--type-clear",
+      "--max-count",
+      "--max-columns",
+      "--max-depth",
+      "--maxdepth",
+      "--max-filesize",
+      "--replace",
+      "--threads",
+      "--encoding",
+      "--engine",
+      "--sort",
+      "--sortr",
+      "--color",
+      "--colors",
+      "--path-separator",
+      "--ignore-file",
+      "--dfa-size-limit",
+      "--regex-size-limit",
+      "--binary-files",
+      "--max-columns-preview"
+    ]
+  },
+  grep: {
+    cluster: true,
+    // `-o` here is `--only-matching`, which writes nothing. It is the same two
+    // characters as `sort -o`, which writes a file — the reason these sets are
+    // per-binary rather than one shared list.
+    booleans: [
+      "-a",
+      "-b",
+      "-c",
+      "-E",
+      "-F",
+      "-G",
+      "-H",
+      "-h",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-o",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-T",
+      "-U",
+      "-v",
+      "-w",
+      "-x",
+      "-y",
+      "-z",
+      "-Z",
+      "--extended-regexp",
+      "--fixed-strings",
+      "--basic-regexp",
+      "--perl-regexp",
+      "--ignore-case",
+      "--no-ignore-case",
+      "--invert-match",
+      "--word-regexp",
+      "--line-regexp",
+      "--count",
+      "--files-with-matches",
+      "--files-without-match",
+      "--line-number",
+      "--with-filename",
+      "--no-filename",
+      "--only-matching",
+      "--quiet",
+      "--silent",
+      "--no-messages",
+      "--text",
+      "--binary",
+      "--line-buffered",
+      "--null",
+      "--null-data",
+      "--byte-offset",
+      "--recursive",
+      "--dereference-recursive",
+      "--initial-tab",
+      "--unix-byte-offsets",
+      "--no-group-separator",
+      "--color",
+      "--colour"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-D",
+      "-e",
+      "-f",
+      "-m",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--regexp",
+      "--file",
+      "--max-count",
+      "--devices",
+      "--directories",
+      "--binary-files",
+      "--include",
+      "--exclude",
+      "--exclude-dir",
+      "--exclude-from",
+      "--label",
+      "--group-separator"
+    ]
+  },
+  find: {
+    // No clustering: find spells its flags as single-dash words, so walking the
+    // characters of `-name` would read it as five short flags. And its arguments
+    // are an expression, so `--` does not end them.
+    expressionArgs: true,
+    // Absent on purpose: `-exec`, `-execdir`, `-ok` and `-okdir` run an inner
+    // command (also caught by the named guard below, which says so more
+    // precisely), `-delete` removes files, and `-fprint`, `-fprint0`, `-fprintf`
+    // and `-fls` are find's write family — the same write as `> file` with no
+    // redirect for the redirect check to see.
+    booleans: [
+      "-H",
+      "-L",
+      "-P",
+      "-a",
+      "-and",
+      "-o",
+      "-or",
+      "-not",
+      "-d",
+      "-depth",
+      "-daystart",
+      "-empty",
+      "-executable",
+      "-false",
+      "-follow",
+      "-help",
+      "--help",
+      "-ignore_readdir_race",
+      "-noignore_readdir_race",
+      "-ls",
+      "-mount",
+      "-nogroup",
+      "-noleaf",
+      "-nouser",
+      "-print",
+      "-print0",
+      "-prune",
+      "-quit",
+      "-readable",
+      "-true",
+      "-version",
+      "-writable",
+      "-xdev"
+    ],
+    values: [
+      "-maxdepth",
+      "-mindepth",
+      "-name",
+      "-iname",
+      "-path",
+      "-ipath",
+      "-wholename",
+      "-iwholename",
+      "-regex",
+      "-iregex",
+      "-lname",
+      "-ilname",
+      "-type",
+      "-xtype",
+      "-size",
+      "-newer",
+      "-anewer",
+      "-cnewer",
+      "-mtime",
+      "-mmin",
+      "-ctime",
+      "-cmin",
+      "-atime",
+      "-amin",
+      "-used",
+      "-uid",
+      "-gid",
+      "-user",
+      "-group",
+      "-perm",
+      "-links",
+      "-inum",
+      "-samefile",
+      "-fstype",
+      "-regextype",
+      "-files0-from",
+      "-printf",
+      "-context",
+      "-D"
+    ],
+    // `find -O2` glues the optimisation level on, and `-newermt`/`-newerat` and
+    // friends spell the two comparison fields into the flag name.
+    patterns: [/^-O\d$/, /^-newer[acmBt][acmBt]$/]
+  },
+  jq: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-c",
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "--ascii-output",
+      "--compact-output",
+      "--color-output",
+      "--monochrome-output",
+      "--exit-status",
+      "--join-output",
+      "--null-input",
+      "--raw-input",
+      "--raw-output",
+      "--raw-output0",
+      "--slurp",
+      "--sort-keys",
+      "--seq",
+      "--stream",
+      "--stream-errors",
+      "--tab",
+      "--unbuffered",
+      "--args",
+      "--jsonargs"
+    ],
+    values: [
+      "-f",
+      "-L",
+      "--arg",
+      "--argjson",
+      "--slurpfile",
+      "--rawfile",
+      "--indent",
+      "--from-file"
+    ]
+  },
+  yq: {
+    cluster: true,
+    // `-i`/`--inplace`/`--in-place` rewrite the file, and `-s`/`--split-exp`
+    // writes one file per document. All absent — and all bare or near-bare
+    // booleans, which is why exempting booleans was not an option.
+    booleans: [
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-N",
+      "-P",
+      "-r",
+      "-S",
+      "-v",
+      "-y",
+      "-Y",
+      "--colors",
+      "--no-colors",
+      "--exit-status",
+      "--no-doc",
+      "--null-input",
+      "--prettyPrint",
+      "--raw-output",
+      "--sort-keys",
+      "--tojson",
+      "--yaml-output",
+      "--yaml-roundtrip",
+      "--unwrapScalar",
+      "--header-preprocess",
+      "--no-exit-status",
+      "--verbose",
+      "--xml-strict-mode"
+    ],
+    values: [
+      "-I",
+      "-o",
+      "-p",
+      "-L",
+      "--indent",
+      "--output-format",
+      "--input-format",
+      "--expression",
+      "--width",
+      "--xml-attribute-prefix",
+      "--xml-content-name"
+    ]
+  }
+};
 var GIT_READONLY_SUBCOMMANDS = [
   "log",
   "status",
   "diff",
   "show",
   "ls-files",
-  "ls-remote",
   "ls-tree",
   "branch",
   "tag",
@@ -763,6 +1984,26 @@ var REFUSED_SUBCOMMANDS = {
   az: ["login", "logout"],
   terraform: ["apply", "destroy"]
 };
+var SHELL_KEYWORDS = [
+  "{",
+  "}",
+  "if",
+  "then",
+  "elif",
+  "else",
+  "fi",
+  "for",
+  "while",
+  "until",
+  "do",
+  "done",
+  "case",
+  "esac",
+  "select",
+  "function",
+  "time",
+  "export"
+];
 var INTERPRETERS = [
   "sh",
   "bash",
@@ -1206,16 +2447,79 @@ function pathLikeArgs(command, opts = {}) {
     return !a.startsWith("-") && looksLikePath(a) ? [a] : [];
   }));
 }
+function matchFlag(spec, booleans, values, token) {
+  if (token.startsWith("--")) {
+    const eq = token.indexOf("=");
+    const name = eq > 0 ? token.slice(0, eq) : token;
+    if (booleans.has(name)) return "boolean";
+    if (values.has(name)) return eq > 0 ? "boolean" : "value";
+    return void 0;
+  }
+  if (booleans.has(token)) return "boolean";
+  if (values.has(token)) return "value";
+  if (spec.patterns?.some((p) => p.test(token))) return "boolean";
+  if (!spec.cluster) return void 0;
+  for (let i = 1; i < token.length; i++) {
+    const short = `-${token[i]}`;
+    if (booleans.has(short)) continue;
+    if (values.has(short)) return i === token.length - 1 ? "value" : "boolean";
+    return void 0;
+  }
+  return "boolean";
+}
+function takesNextToken(next) {
+  if (next === void 0) return false;
+  return !/^-./.test(next) || /^-\d/.test(next);
+}
+function flagLabel(token) {
+  const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+  return eq > 0 ? token.slice(0, eq) : token;
+}
+function scanFlags(seg) {
+  const spec = FLAG_POLICY[seg.binary];
+  if (!spec || spec.freeform) return void 0;
+  const booleans = /* @__PURE__ */ new Set([...spec.booleans ?? [], ...UNIVERSAL_FLAGS]);
+  const values = new Set(spec.values ?? []);
+  const operands = [];
+  let i = 0;
+  while (i < seg.args.length) {
+    const token = seg.args[i];
+    if (token === "--" && !spec.expressionArgs) {
+      operands.push(...seg.args.slice(i + 1));
+      break;
+    }
+    if (!/^-./.test(token)) {
+      operands.push(token);
+      i++;
+      continue;
+    }
+    const shape = matchFlag(spec, booleans, values, token);
+    if (shape === void 0) return { unknown: flagLabel(token), operands };
+    i += shape === "value" && takesNextToken(seg.args[i + 1]) ? 2 : 1;
+  }
+  return { operands };
+}
+function subcommandOf(seg) {
+  const scan = scanFlags(seg);
+  if (scan) return scan.operands[0];
+  return seg.args.find((a) => !a.startsWith("-"));
+}
+var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
   if (!MULTIPLEXERS.includes(seg.binary)) return seg.binary;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
-  return sub ? `${seg.binary} ${sub}` : seg.binary;
+  const lead = [];
+  for (const arg of seg.args) {
+    if (arg.startsWith("-")) break;
+    lead.push(arg);
+    if (lead.length === SCOPE_LEAD_ARGS) break;
+  }
+  return [seg.binary, ...lead].join(" ");
 }
 function isAuto(seg) {
   if (!AUTO_COMMANDS.includes(seg.binary)) return false;
   if (seg.expandable) return false;
   if (seg.binary !== "git") return true;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
+  const sub = subcommandOf(seg);
   return sub !== void 0 && GIT_READONLY_SUBCOMMANDS.includes(sub);
 }
 function refusalFor(seg) {
@@ -1225,29 +2529,31 @@ function refusalFor(seg) {
   if (seg.binary === "eval" || seg.binary === "exec") {
     return `"${seg.binary}" runs a string as a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
   }
+  if (seg.binary === "source" || seg.binary === ".") {
+    return `"${seg.binary}" runs a file's contents as commands, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
+  }
+  if (SHELL_KEYWORDS.includes(seg.binary)) {
+    return `"${seg.binary}" is a shell keyword or compound-command opener. This classifier only inspects the command that runs first, and a keyword hides the real one from it. Run the inner command directly, or describe it as a task.`;
+  }
   const subs = REFUSED_SUBCOMMANDS[seg.binary];
   if (subs) {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub && subs.includes(sub)) {
       return `"${seg.binary} ${sub}" changes state or reaches outward. You are a read-only planner \u2014 put it in the plan and let the runner do it.`;
     }
   }
   if (seg.binary === "git") {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub === "branch" || sub === "tag") {
       const flag = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a));
       if (flag) {
         return `"git ${sub} ${flag}" mutates refs. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
-    }
-    const execPathFlag = seg.args.find((a) => a === "--exec-path" || a.startsWith("--exec-path="));
-    if (execPathFlag) {
-      return `"git ${execPathFlag}" redirects where git looks for its helper programs, and can make it run an arbitrary one. Use the read-only research tools, or describe the change as a task.`;
-    }
-    if (sub === "grep") {
-      const pagerFlag = seg.args.find((a) => a === "-O" || a === "--open-files-in-pager" || a.startsWith("--open-files-in-pager="));
-      if (pagerFlag) {
-        return `"git grep ${pagerFlag}" opens the results in an arbitrary named program. Use the read-only research tools, or describe the change as a task.`;
+      const listing = seg.args.includes("-l") || seg.args.includes("--list");
+      const scan2 = scanFlags(seg);
+      const target = scan2?.operands[1];
+      if (!listing && target) {
+        return `"git ${sub} ${target}" creates or moves a ref. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
     }
   }
@@ -1275,6 +2581,13 @@ function refusalFor(seg) {
   if (seg.assignments.length > 0) {
     return `The environment assignment "${seg.assignments[0]}" decides what "${seg.binary}" actually does, and this classifier cannot judge the value. Re-run the command without the assignment.`;
   }
+  const scan = scanFlags(seg);
+  if (scan?.unknown) {
+    return `"${scan.unknown}" is not a flag this classifier knows to be read-only on "${seg.binary}", and flags on otherwise read-only binaries can run a helper program or write a file. Re-run with read-only flags only, or describe the work as a task.`;
+  }
+  if (seg.binary === "uniq" && scan && scan.operands.length > 1) {
+    return `"uniq" writes to its second file argument ("${scan.operands[1]}"). You are a read-only planner \u2014 pipe the output instead of naming an output file, or describe the write as a task.`;
+  }
   return void 0;
 }
 function withWrapperNote(reason, wrappers) {
@@ -1661,6 +2974,139 @@ It is outside the auto-allowed read-only set (${scope}). Continue with the read-
   }
 };
 
+// src/utils/redactSecrets.ts
+var REDACTION_MARKER = "REDACTED";
+function marker(kind, length) {
+  return `[${REDACTION_MARKER} ${kind}: ${length} chars]`;
+}
+var LINE_PREFIX = String.raw`(?:[ \t]*\d+\||[^\s:]*:\d+:|)[ \t]*`;
+var LINE_PREFIX_ANCHORED = new RegExp("^" + LINE_PREFIX);
+var CREDENTIAL_WORD = String.raw`(?:api[_-]?keys?|secrets?|passwords?|passwd|passphrase|tokens?|access[_-]?keys?|private[_-]?keys?|client[_-]?secrets?|credentials?|auth)(?![a-z])`;
+var NAMED_CREDENTIAL = new RegExp(
+  String.raw`((?:^|[^A-Za-z0-9_])["']?[A-Za-z0-9_.\-]*` + CREDENTIAL_WORD + String.raw`[A-Za-z0-9_.\-]*["']?[ \t]*(?:=>|[:=])[ \t]*)(["'\x60]?)([A-Za-z0-9_\-./+=:~!@#%^&*]{8,})\2`,
+  "gi"
+);
+var DOTENV_CREDENTIAL = new RegExp(
+  String.raw`^(` + LINE_PREFIX + String.raw`(?:export[ \t]+)?[A-Z0-9_]*` + CREDENTIAL_WORD.toUpperCase() + String.raw`[A-Z0-9_]*[ \t]*=[ \t]*)(["'\x60]?)([^\s"'\x60]{3,})\2[ \t]*$`,
+  "gm"
+);
+var PROVIDER_KEY_PATTERNS = [
+  // OpenAI / Anthropic / OpenRouter and the many `sk-` derivatives
+  /(?<![A-Za-z0-9])sk-(?:ant-|proj-|or-v1-|live-|test-)?[A-Za-z0-9_-]{20,}/g,
+  // GitHub personal-access, OAuth, app and refresh tokens
+  /(?<![A-Za-z0-9])(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{22,}/g,
+  // Slack bot / user / app tokens
+  /(?<![A-Za-z0-9])xox[abprse]-[A-Za-z0-9-]{10,}/g,
+  // Stripe secret and restricted keys
+  /(?<![A-Za-z0-9])[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  // Google API keys and OAuth access tokens
+  /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{30,}/g,
+  /(?<![A-Za-z0-9])ya29\.[A-Za-z0-9_-]{20,}/g,
+  // npm, Hugging Face, Groq, GitLab, DigitalOcean, Shopify
+  /(?<![A-Za-z0-9])(?:npm|hf|gsk|glpat|dop_v1|shpat|shpss)[_-][A-Za-z0-9]{20,}/g,
+  /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}/g,
+  // Three-segment JWTs, whose payload segment is base64 for `{"`
+  /(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+];
+var CLOUD_ACCESS_KEY_ID = /(?<![A-Za-z0-9])(?:A3T[A-Z0-9]{2}|AKIA|ASIA|ABIA|ACCA|AGPA|AIDA|AIPA|ANPA|ANVA|AROA)[A-Z0-9]{16}(?![A-Za-z0-9])/g;
+var PEM_BEGIN = /-----BEGIN ((?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?)-----/;
+var PEM_BODY_LINE = /^[A-Za-z0-9+/=:,.\- \t]*$/;
+function redactPrivateKeyBlocks(text) {
+  if (!PEM_BEGIN.test(text)) return text;
+  const out = [];
+  let label = null;
+  let bodyChars = 0;
+  const closeBlock = () => {
+    if (label === null) return;
+    out.push(marker("private key", bodyChars));
+    label = null;
+    bodyChars = 0;
+  };
+  for (const line of text.split("\n")) {
+    if (label === null) {
+      out.push(line);
+      const begun = PEM_BEGIN.exec(line);
+      if (begun) label = begun[1];
+      continue;
+    }
+    const content = line.replace(LINE_PREFIX_ANCHORED, "");
+    if (content.includes(`-----END ${label}-----`)) {
+      closeBlock();
+      out.push(line);
+    } else if (PEM_BODY_LINE.test(content)) {
+      bodyChars += content.trim().length;
+    } else {
+      closeBlock();
+      out.push(line);
+    }
+  }
+  closeBlock();
+  return out.join("\n");
+}
+var NUMERIC = /^[-+]?\d+(?:\.\d+)?$/;
+var IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var MEMBER_EXPRESSION = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)+$/;
+var SLUG = /^[a-z]+(?:[-_][a-z]+)+$/;
+var PATHISH = /^(?:\.{0,2}\/|~\/)/;
+var URLISH = /^[a-z][a-z0-9+.-]*:\/\//i;
+var CODE_KEYWORDS = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "none",
+  "nil",
+  "undefined",
+  "void",
+  "string",
+  "number",
+  "boolean",
+  "object",
+  "any",
+  "unknown",
+  "bool",
+  "str",
+  "int"
+]);
+var UNAMBIGUOUS_CREDENTIAL_NAME = /(?:password|passwd|passphrase|secret|credentials?|private[_-]?key)/i;
+function looksLikeKeyMaterial(value) {
+  const hasDigit = /\d/.test(value);
+  const hasAlpha = /[A-Za-z]/.test(value);
+  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+  return hasDigit && hasAlpha || mixedCase || value.length >= 24;
+}
+function looksLikeCode(value) {
+  return NUMERIC.test(value) || CODE_KEYWORDS.has(value.toLowerCase()) || MEMBER_EXPRESSION.test(value) || PATHISH.test(value) || URLISH.test(value);
+}
+function trimTrailingPunctuation(value) {
+  const match = /[.:!]+$/.exec(value);
+  if (!match || match.index === 0) return { value, tail: "" };
+  return { value: value.slice(0, match.index), tail: match[0] };
+}
+function redactSecrets(text) {
+  if (!text) return text;
+  let out = redactPrivateKeyBlocks(text);
+  out = out.replace(DOTENV_CREDENTIAL, (full, head, quote, value) => {
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}`;
+  });
+  out = out.replace(NAMED_CREDENTIAL, (full, head, quote, raw) => {
+    const { value, tail } = trimTrailingPunctuation(raw);
+    if (value.length < 8) return full;
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    if (UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && /\d/.test(value)) {
+      return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+    }
+    if (IDENTIFIER.test(value) || SLUG.test(value)) return full;
+    if (!UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && !looksLikeKeyMaterial(value)) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+  });
+  for (const pattern of PROVIDER_KEY_PATTERNS) {
+    out = out.replace(pattern, (hit) => marker("api key", hit.length));
+  }
+  out = out.replace(CLOUD_ACCESS_KEY_ID, (hit) => marker("access key id", hit.length));
+  return out;
+}
+
 // src/services/executeTool.ts
 var GREP_OUTPUT_MODES = ["content", "files", "count"];
 function num(value) {
@@ -1687,6 +3133,10 @@ function grepOptions(args) {
 }
 var STOPPED_TOOL_RESULT = "Stopped by the user \u2014 this call was not executed, and no further tool calls will run this turn.";
 async function executeTool(name, args, fs10, fetcher, signal) {
+  const outcome = await runTool(name, args, fs10, fetcher, signal);
+  return { ...outcome, output: redactSecrets(outcome.output) };
+}
+async function runTool(name, args, fs10, fetcher, signal) {
   if (signal?.aborted) return { success: false, output: STOPPED_TOOL_RESULT, truncated: false };
   switch (name) {
     case "read_file": {
@@ -5955,11 +7405,11 @@ function composeAugmentedPrompt(task, allTasks, opts) {
   if (isHitlTask(task)) {
     blocks.push(renderCheckpointInstruction());
   }
-  const marker = renderCompletionMarker(task);
-  if (blocks.length === 0) return basePrompt + marker;
+  const marker2 = renderCompletionMarker(task);
+  if (blocks.length === 0) return basePrompt + marker2;
   return `${blocks.join("\n\n")}
 
-${basePrompt}${marker}`;
+${basePrompt}${marker2}`;
 }
 
 // src/services/VerdictEngine.ts
@@ -8906,7 +10356,7 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
     throw new WorkspaceNotAProjectError(workspace);
   }
   const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
-    (marker) => exists(path9.join(resolved, marker))
+    (marker2) => exists(path9.join(resolved, marker2))
   );
   if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
 }
@@ -10126,7 +11576,8 @@ var CliAgentAiService = class {
     let stepIndex = 0;
     const truncate = (value) => value.length > LOG_MAX_CHARS ? `${value.slice(0, LOG_MAX_CHARS)}
 [... truncated, total ${value.length} chars]` : value;
-    const settle = (id, output, success, outcome) => {
+    const settle = (id, rawOutput, success, outcome) => {
+      const output = redactSecrets(rawOutput);
       const call = pendingCalls.get(id);
       pendingCalls.delete(id);
       const step = {
@@ -10657,6 +12108,16 @@ function ensureDir(dir) {
 function getStateDir(baseDir) {
   return path10.join(baseDir ?? process.cwd(), STATE_DIR);
 }
+var IGNORE_FILE = ".gitignore";
+function ensureStateDirIgnored(baseDir) {
+  const dir = getStateDir(baseDir);
+  ensureDir(dir);
+  try {
+    fs4.writeFileSync(path10.join(dir, IGNORE_FILE), "*\n", { flag: "wx" });
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+}
 
 // src/utils/sessionId.ts
 var import_crypto = require("crypto");
@@ -10686,6 +12147,7 @@ function sessionFilename(session) {
 function saveSession(plan, goal, baseDir, id) {
   const sessionsDir = getSessionsDir(baseDir);
   ensureDir(sessionsDir);
+  ensureStateDirIgnored(baseDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const meta = {
     id: id || mintSessionId(),
@@ -13765,6 +15227,7 @@ var PlannerModelMemory = class {
   emptyWarnings,
   enabledRunners,
   ensureDir,
+  ensureStateDirIgnored,
   escapeControlCharsInStrings,
   executionLogBlock,
   executionSummary,