@pushary/agent-hooks 1.9.24 → 1.9.26

package/dist/{chunk-GM2IFDVF.js → chunk-TVP5UU33.js}

@@ -708,12 +708,14 @@ var scanShell = (command) => {
   }
   return quote === null ? lexemes : null;
 };
-var shellCommandSegments = (command) => {
+var PIPE = "|";
+var splitShellSegments = (command) => {
   const lexemes = scanShell(command);
   if (lexemes === null) return null;
   const segments = [];
   let start = 0;
   let consumed = -1;
+  let readsPipe = false;
   for (const lexeme of lexemes) {
     const { index, text, quote, kind } = lexeme;
     if (index <= consumed || kind !== "text" || quote === "'") continue;
@@ -721,14 +723,103 @@ var shellCommandSegments = (command) => {
     if (quote !== null) continue;
     if (UNDECOMPOSABLE.has(text)) return null;
     if (!SEGMENT_SEPARATORS.has(text)) continue;
-    consumed = index + (DOUBLED_SEPARATORS.has(text) && command[index + 1] === text ? 1 : 0);
-    segments.push(trimShellWhitespace(command.slice(start, index)));
+    const doubled = DOUBLED_SEPARATORS.has(text) && command[index + 1] === text;
+    consumed = index + (doubled ? 1 : 0);
+    segments.push({ text: trimShellWhitespace(command.slice(start, index)), readsPipe });
+    readsPipe = text === PIPE && !doubled;
     start = consumed + 1;
   }
-  segments.push(trimShellWhitespace(command.slice(start)));
-  const present = segments.filter((segment) => segment.length > 0);
+  segments.push({ text: trimShellWhitespace(command.slice(start)), readsPipe });
+  const present = segments.filter((segment) => segment.text.length > 0);
   return present.length > 0 ? present : null;
 };
+var shellCommandSegments = (command) => splitShellSegments(command)?.map((segment) => segment.text) ?? null;
+var shellSegmentsReadingAPipe = (command) => splitShellSegments(command)?.filter((segment) => segment.readsPipe).map((segment) => segment.text) ?? null;
+var SUBSTITUTION_OPEN = "$(";
+var QUOTED_HEREDOC_CAT = /^[ \t]*cat[ \t]+<<[ \t]*(?:'([A-Za-z_][A-Za-z0-9_]*)'|"([A-Za-z_][A-Za-z0-9_]*)")[ \t]*\n/;
+var CLOSING_PARENTHESIS = /^\s*\)/;
+var LEADING_TABS = /^\t+/;
+var CHARACTERS_ESCAPED_IN_DOUBLE_QUOTES = /["\\$`]/g;
+var isHeredocTerminator = (line, delimiter) => line.replace(LEADING_TABS, "").trimEnd() === delimiter;
+var mightEndAHeredoc = (line, delimiter) => line.trimStart().startsWith(delimiter);
+var BODY_ESCAPES = /[\\`]/;
+var COMMENT_START = "#";
+var WHITESPACE = /\s/;
+var parenthesesBalanceInBody = (body, readsComments) => {
+  let depth = 0;
+  let quote = null;
+  let comment = false;
+  let wordStart = true;
+  for (const char of body) {
+    if (comment) {
+      comment = char !== "\n";
+      wordStart = true;
+      continue;
+    }
+    if (quote !== null) {
+      if (char === quote) quote = null;
+      wordStart = false;
+      continue;
+    }
+    if (readsComments && wordStart && char === COMMENT_START) {
+      comment = true;
+      continue;
+    }
+    if (char === "'" || char === '"') quote = char;
+    if (char === "(") depth += 1;
+    if (char === ")") depth -= 1;
+    if (depth < 0) return false;
+    wordStart = WHITESPACE.test(char);
+  }
+  return depth === 0 && quote === null;
+};
+var everyBashReadsTheBodyAsText = (body) => !BODY_ESCAPES.test(body) && parenthesesBalanceInBody(body, true) && parenthesesBalanceInBody(body, false);
+var quotedHeredocSubstitutionAt = (command, open) => {
+  const header = QUOTED_HEREDOC_CAT.exec(command.slice(open + SUBSTITUTION_OPEN.length));
+  const delimiter = header?.[1] ?? header?.[2];
+  if (!header || !delimiter) return null;
+  const bodyStart = open + SUBSTITUTION_OPEN.length + header[0].length;
+  for (let lineStart = bodyStart; lineStart <= command.length; ) {
+    const newline = command.indexOf("\n", lineStart);
+    const lineEnd = newline === -1 ? command.length : newline;
+    const line = command.slice(lineStart, lineEnd);
+    if (line === delimiter) {
+      const closing = CLOSING_PARENTHESIS.exec(command.slice(lineEnd));
+      const body = command.slice(bodyStart, Math.max(bodyStart, lineStart - 1));
+      return closing && everyBashReadsTheBodyAsText(body) ? { body, end: lineEnd + closing[0].length } : null;
+    }
+    if (mightEndAHeredoc(line, delimiter)) return null;
+    if (newline === -1) return null;
+    lineStart = newline + 1;
+  }
+  return null;
+};
+var asDoubleQuotedText = (body) => body.replace(CHARACTERS_ESCAPED_IN_DOUBLE_QUOTES, (character) => `\\${character}`);
+var withHeredocSubstitutionsAsQuotedText = (command) => {
+  let result = "";
+  let copied = 0;
+  let quote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command.charAt(index);
+    if (char === "\\" && quote !== "'") {
+      index += 1;
+      continue;
+    }
+    if ((char === "'" || char === '"') && (quote === null || quote === char)) {
+      quote = quote === null ? char : null;
+      continue;
+    }
+    if (quote === "'") continue;
+    if (char === "`") break;
+    if (char !== "$" || command.charAt(index + 1) !== "(") continue;
+    const substitution = quote === '"' ? quotedHeredocSubstitutionAt(command, index) : null;
+    if (substitution === null) break;
+    result += command.slice(copied, index) + asDoubleQuotedText(substitution.body);
+    copied = substitution.end;
+    index = substitution.end - 1;
+  }
+  return result + command.slice(copied);
+};
 var shellVisibleText = (command) => {
   const lexemes = scanShell(command);
   if (lexemes === null) return null;
@@ -1183,11 +1274,12 @@ var PATTERN_INTENT = {
   grant: "grant",
   restrict: "restrict"
 };
+var segmentsForMatching = (command) => shellCommandSegments(withHeredocSubstitutionsAsQuotedText(command));
 var everySegmentMatches = (command, matches) => {
-  const segments = shellCommandSegments(command);
+  const segments = segmentsForMatching(command);
   return segments !== null && segments.every(matches);
 };
-var anySegmentMatches = (command, matches) => (shellCommandSegments(command) ?? [command]).some(matches);
+var anySegmentMatches = (command, matches) => (segmentsForMatching(command) ?? [command]).some(matches);
 var shellSegmentsMatch = (command, intent, matches) => intent === PATTERN_INTENT.restrict ? anySegmentMatches(command, matches) : everySegmentMatches(command, matches);
 var rankWholeOrSegments = (toolName, arg, intent, matches) => {
   const matched = toolName in POLICY_COMMAND_KEYS ? shellSegmentsMatch(arg, intent, matches) : matches(arg);
@@ -1278,7 +1370,6 @@ var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
   "whoami",
   "id",
   "uname",
-  "arch",
   "printenv",
   "locale",
   "tty",
@@ -1629,6 +1720,7 @@ var COMMAND_RUNNERS = /* @__PURE__ */ new Set([
   "script",
   "su",
   "doas",
+  "arch",
   "npx",
   "bunx",
   "pnpx",
@@ -1646,7 +1738,9 @@ var INLINE_CODE_INTERPRETERS = /* @__PURE__ */ new Set([
   "lua",
   "osascript",
   "pwsh",
-  "powershell"
+  "powershell",
+  "mongosh",
+  "mongo"
 ]);
 var INLINE_CODE_LONG_FLAG = /^-{1,2}(?:eval|print|require|import|command|encodedcommand|enc|ec)(?:=|$)/i;
 var INLINE_CODE_SHORT_FLAG_LETTERS = /* @__PURE__ */ new Set(["c", "e", "E", "p", "r"]);
@@ -1669,7 +1763,15 @@ var DESTRUCTIVE_ARGUMENTS_BY_COMMAND = /* @__PURE__ */ new Map([
   ])],
   ["git checkout", /* @__PURE__ */ new Set(["-f", "--force", "--", "-B"])],
   ["git switch", /* @__PURE__ */ new Set(["-f", "--force", "--discard-changes", "-C", "--force-create"])],
-  ["git branch", /* @__PURE__ */ new Set(["-f", "--force", "-D", "-M", "-C"])]
+  ["git branch", /* @__PURE__ */ new Set(["-f", "--force", "-D", "-M", "-C"])],
+  ["git push", /* @__PURE__ */ new Set(["-f", "--force", "--force-with-lease", "--force-if-includes", "--mirror", "-d", "--delete", "--prune"])],
+  ["git clean", /* @__PURE__ */ new Set(["-f", "--force"])],
+  ["rm", /* @__PURE__ */ new Set(["-r", "-R", "--recursive"])],
+  ["pg_restore", /* @__PURE__ */ new Set(["-c", "--clean"])],
+  ["mongorestore", /* @__PURE__ */ new Set(["--drop"])],
+  ["aws s3", /* @__PURE__ */ new Set(["--delete"])],
+  ["gsutil rsync", /* @__PURE__ */ new Set(["-d", "--delete-unmatched-destination-objects"])],
+  ["gcloud storage", /* @__PURE__ */ new Set(["--delete-unmatched-destination-objects"])]
 ]);
 var DESTRUCTIVE_WORDS_IN_ANY_CASE_BY_COMMAND = /* @__PURE__ */ new Map([
   ["redis-cli", /* @__PURE__ */ new Set(["flushall", "flushdb"])]
@@ -1710,7 +1812,8 @@ var SUBCOMMAND_CLIS = /* @__PURE__ */ new Set([
   "heroku",
   "supabase",
   "wrangler",
-  "railway"
+  "railway",
+  "bq"
 ]);
 var DESTRUCTIVE_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "delete",
@@ -1812,33 +1915,833 @@ var argumentsHideTheEffect = (name, args) => {
   return (meaningful[0]?.text.startsWith("-") ?? false) || subcommandWordsOf(meaningful).some((word) => word.expands || RUNNER_SUBCOMMANDS.has(word.text));
 };
 var invocationHidesItsEffect = ({ program, args }) => program !== void 0 && ([program, ...args].some((word) => word.comment) || programHidesItsEffect(program) || argumentsHideTheEffect(basenameOf(program.text), args));
-var readableCommandSegments = (command) => shellCommandSegments(command.replace(SHELL_LINE_CONTINUATION, "").replace(SAFE_REDIRECTION, ""));
-var normalizedInvocation = ({ program, args }) => {
+var commandForReading = (command) => withHeredocSubstitutionsAsQuotedText(command).replace(SHELL_LINE_CONTINUATION, "").replace(SAFE_REDIRECTION, "");
+var readableCommandSegments = (command) => shellCommandSegments(commandForReading(command));
+var invocationTextWith = ({ program, args }, wordText) => {
   if (program === void 0) return "";
   const name = basenameOf(program.text);
   const kept = SUBCOMMAND_CLIS.has(name) ? argsAfterHarmlessGlobalFlags(args) : args;
-  return [name, ...kept.map((arg) => arg.text)].join(" ");
-};
+  return [name, ...kept.map(wordText)].join(" ");
+};
+var normalizedInvocation = (invocation) => invocationTextWith(invocation, (word) => word.text);
+var SHELL_METACHARACTER = /[\s;&|<>()$`\\"'*?[\]#~{}!]/;
+var SINGLE_QUOTE = "'";
+var ESCAPED_SINGLE_QUOTE = `'\\''`;
+var asOneShellWord = (text) => SHELL_METACHARACTER.test(text) ? `${SINGLE_QUOTE}${text.replaceAll(SINGLE_QUOTE, ESCAPED_SINGLE_QUOTE)}${SINGLE_QUOTE}` : text;
+var quotedInvocation = (invocation) => invocationTextWith(invocation, (word) => asOneShellWord(word.text));
 var normalizedCommand = (command) => {
   const segments = readableCommandSegments(command);
   return segments === null ? null : segments.map((segment) => normalizedInvocation(invocationOf(segment))).join("; ");
 };
 var subcommandDestroys = ({ program, args }) => program !== void 0 && SUBCOMMAND_CLIS.has(basenameOf(program.text)) && subcommandWordsOf(argsAfterHarmlessGlobalFlags(args)).some((word) => subcommandWordDestroys(word.text));
+var wordsOfInvocation = ({ program, args }) => program === void 0 ? args : [program, ...args];
+var PRODUCTION_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+var PRODUCTION_FLAGS = /* @__PURE__ */ new Set(["--prod", "--production"]);
+var ENVIRONMENT_FLAGS = /* @__PURE__ */ new Set([
+  "-e",
+  "--env",
+  "--environment",
+  "--stage",
+  "--profile",
+  "--context",
+  "--target"
+]);
+var ENVIRONMENT_VARIABLE = /^[A-Z_]*(?:ENV|ENVIRONMENT|STAGE)$/;
+var FLAG_VALUE_SEPARATOR = "=";
+var DEPLOY_CLIS = /* @__PURE__ */ new Set([
+  "vercel",
+  "netlify",
+  "fly",
+  "flyctl",
+  "heroku",
+  "railway",
+  "firebase",
+  "wrangler",
+  "supabase",
+  "serverless",
+  "sls"
+]);
+var SCHEMA_CHANGE_WORD = /(?:^|[\s:_./-])(?:migrat(?:e|es|ion|ions)|rollback|seed|db[:\s]push)(?=$|[\s:_./-])(?![\s:_./-]+(?:status|version|list|ls|show|check|diff|history|info)(?:$|[\s:_./-]))/i;
+var PRODUCTION_READ_VERBS = /* @__PURE__ */ new Set([
+  "logs",
+  "log",
+  "tail",
+  "status",
+  "list",
+  "ls",
+  "info",
+  "inspect",
+  "describe",
+  "get",
+  "show",
+  "whoami",
+  "build",
+  "dev",
+  "open",
+  "history",
+  "metrics",
+  "help",
+  "version",
+  "login",
+  "link",
+  "pull"
+]);
+var PRODUCTION_SETTING_NAMESPACES = /* @__PURE__ */ new Set(["env", "secret", "secrets", "config", "domains", "dns", "certs"]);
+var deployCliOperandsAfter = (words, cli) => {
+  const after = words.slice(cli + 1);
+  const firstFlag = after.findIndex((word) => FLAG.test(word.text));
+  return (firstFlag === -1 ? after : after.slice(0, firstFlag)).map((word) => word.text.toLowerCase());
+};
+var deployCliOnlyReads = (operands) => {
+  const [first, second] = operands.map((operand) => operand.split(":")[0] ?? "");
+  const verb = PRODUCTION_SETTING_NAMESPACES.has(first ?? "") ? second : first;
+  return verb !== void 0 && PRODUCTION_READ_VERBS.has(verb);
+};
+var deployCliChangesSomething = (words) => words.some((word, index) => DEPLOY_CLIS.has(basenameOf(word.text)) && !deployCliOnlyReads(deployCliOperandsAfter(words, index)));
+var valueSelectsProduction = (name, value, names) => names.has(name) && PRODUCTION_NAMES.has(value.toLowerCase());
+var wordSelectsProduction = (word, previous) => {
+  const separator = word.text.indexOf(FLAG_VALUE_SEPARATOR);
+  const name = separator > 0 ? word.text.slice(0, separator) : "";
+  const value = separator > 0 ? word.text.slice(separator + 1) : "";
+  return PRODUCTION_FLAGS.has(word.text.toLowerCase()) || valueSelectsProduction(name.toLowerCase(), value, ENVIRONMENT_FLAGS) || ENVIRONMENT_VARIABLE.test(name) && PRODUCTION_NAMES.has(value.toLowerCase()) || valueSelectsProduction((previous?.text ?? "").toLowerCase(), word.text, ENVIRONMENT_FLAGS);
+};
+var changesProduction = (invocation) => {
+  const words = wordsOfInvocation(invocation);
+  return words.some((word, index) => wordSelectsProduction(word, words[index - 1])) && (deployCliChangesSomething(words) || SCHEMA_CHANGE_WORD.test(normalizedInvocation(invocation)));
+};
+var MYSQL_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-e", "--execute"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false };
+var SQLITE_SYNTAX = { inlineFlags: /* @__PURE__ */ new Set(["-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-init"]), positionalSql: true };
+var SQL_CLIENT_SYNTAX = /* @__PURE__ */ new Map([
+  ["psql", { inlineFlags: /* @__PURE__ */ new Set(["-c", "--command"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false }],
+  ["mysql", MYSQL_SYNTAX],
+  ["mariadb", MYSQL_SYNTAX],
+  ["sqlite3", SQLITE_SYNTAX],
+  ["sqlite", SQLITE_SYNTAX],
+  ["duckdb", { inlineFlags: /* @__PURE__ */ new Set(["-c", "-s", "-cmd"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "-init"]), positionalSql: true }],
+  ["clickhouse-client", { inlineFlags: /* @__PURE__ */ new Set(["-q", "--query"]), scriptFlags: /* @__PURE__ */ new Set(["--queries-file"]), positionalSql: false }],
+  ["bq", { inlineFlags: /* @__PURE__ */ new Set(), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: true }],
+  ["mongosh", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(["-f", "--file"]), positionalSql: false }],
+  ["mongo", { inlineFlags: /* @__PURE__ */ new Set(["--eval"]), scriptFlags: /* @__PURE__ */ new Set(), positionalSql: false }]
+]);
+var SQL_WRITE_STATEMENT = new RegExp([
+  String.raw`\b(?:insert|update|delete|merge|upsert|alter|create|drop|truncate|grant|revoke|copy|vacuum|reindex|rename|attach|detach)\b`,
+  String.raw`\breplace\s+into\b`,
+  String.raw`\bload\s+data\b`,
+  String.raw`\binto\s+(?:out|dump)file\b`,
+  String.raw`\bset\s+(?:global|persist)\b`,
+  String.raw`\bkill\s+(?:query|connection|\d)`,
+  String.raw`\bcall\s+[\w.]+\s*\(`,
+  String.raw`\bdo\s+(?:\$\w*\$|')`,
+  String.raw`\bpg_terminate_backend\b`,
+  String.raw`\bsetval\b`,
+  String.raw`\bpragma\s+writable_schema\b`,
+  String.raw`\.(?:insert|update|delete|replace|remove|drop|rename|create|bulkwrite|findoneand)\w*\s*\(`
+].join("|"), "i");
+var SQL_READ_PHRASE = /\bshow\s+create\b/gi;
+var SQL_STRING_LITERAL = /'(?:[^']|'')*'/g;
+var EMPTY_SQL_STRING = "''";
+var SQL_COMMENT = /--[^\n]*|\/\*[\s\S]*?\*\//g;
+var writesThroughSql = (sql) => {
+  const statement = sql.replace(SQL_COMMENT, " ").replace(SQL_STRING_LITERAL, EMPTY_SQL_STRING).replace(SQL_READ_PHRASE, "");
+  return SQL_WRITE_STATEMENT.test(statement) || SQL_CLIENT_FILE_COMMAND.test(statement);
+};
+var SQL_CLIENT_FILE_COMMAND = new RegExp([
+  String.raw`(?:^|[\s;=])\\(?:i|ir|include|include_relative|o|out|w|write|gexec|!|\.)(?=\s|$)`,
+  String.raw`(?:^|[\s;=])\\g\s*\|`,
+  String.raw`(?:^|[\s;=])\.(?:read|import|restore|load|output|once|shell|system|backup|save|open)(?=\s|$)`,
+  String.raw`(?:^|[;=])\s*(?:system|source)\s`
+].join("|"), "i");
+var SHORT_FLAG_CLUSTER_ONLY = /^-([A-Za-z0-9]+)$/;
+var NO_SQL = { script: false, sql: null, hidden: false };
+var shortFlagOf = (flags, text) => [...flags].find((flag) => /^-[A-Za-z]$/.test(flag) && text.startsWith(flag) && text.length > flag.length && !text.startsWith("--"));
+var sqlArgumentAt = (args, index, syntax) => {
+  const arg = args[index];
+  if (arg === void 0) return NO_SQL;
+  const next = args[index + 1];
+  const valueOf = (word) => ({ script: false, sql: word?.text ?? null, hidden: word?.expands ?? false });
+  if (syntax.scriptFlags.has(arg.text) || namesALongFlagValue(arg.text, syntax.scriptFlags) || shortFlagOf(syntax.scriptFlags, arg.text)) {
+    return { script: true, sql: null, hidden: false };
+  }
+  if (syntax.inlineFlags.has(arg.text)) return valueOf(next);
+  const longInline = [...syntax.inlineFlags].find((flag) => arg.text.startsWith(`${flag}${FLAG_VALUE_SEPARATOR}`));
+  if (longInline) return { script: false, sql: arg.text.slice(longInline.length + 1), hidden: arg.expands };
+  const shortInline = shortFlagOf(syntax.inlineFlags, arg.text);
+  if (shortInline) return { script: false, sql: arg.text.slice(shortInline.length), hidden: arg.expands };
+  const cluster = SHORT_FLAG_CLUSTER_ONLY.exec(arg.text)?.[1];
+  const last = cluster ? `-${cluster.slice(-1)}` : "";
+  if (cluster && cluster.length > 1 && syntax.scriptFlags.has(last)) return { script: true, sql: null, hidden: false };
+  if (cluster && cluster.length > 1 && syntax.inlineFlags.has(last)) return valueOf(next);
+  return { script: false, sql: arg.text, hidden: false };
+};
+var namesALongFlagValue = (text, flags) => [...flags].some((flag) => flag.startsWith("--") && text.startsWith(`${flag}${FLAG_VALUE_SEPARATOR}`));
+var positionalSqlIsHidden = (args, syntax) => syntax.positionalSql && args.filter((arg) => !arg.text.startsWith("-")).slice(1).some((arg) => arg.expands);
+var sqlClientSyntaxOf = ({ program }) => program === void 0 ? void 0 : SQL_CLIENT_SYNTAX.get(basenameOf(program.text));
+var sqlClientChangesData = (invocation) => {
+  const syntax = sqlClientSyntaxOf(invocation);
+  if (syntax === void 0) return false;
+  return positionalSqlIsHidden(invocation.args, syntax) || invocation.args.some((_, index) => {
+    const { script, sql, hidden } = sqlArgumentAt(invocation.args, index, syntax);
+    return script || hidden || sql !== null && writesThroughSql(sql);
+  });
+};
+var PULL_REQUEST_CLIS = /* @__PURE__ */ new Set(["gh", "glab"]);
+var PULL_REQUEST_NOUNS = /* @__PURE__ */ new Set(["pr", "mr"]);
+var MERGE_SUBCOMMAND = "merge";
+var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/\d+\/merge$/;
+var mergesAPullRequest = ({ program, args }) => {
+  if (program === void 0 || !PULL_REQUEST_CLIS.has(basenameOf(program.text))) return false;
+  const words = args.filter((arg) => !arg.text.startsWith("-"));
+  return words.some((word, index) => PULL_REQUEST_NOUNS.has(word.text) && words[index + 1]?.text === MERGE_SUBCOMMAND) || args.some((arg) => PULL_REQUEST_MERGE_PATH.test(arg.text));
+};
+var DEPLOY_AND_SCHEMA_COMMAND_PATTERNS = [
+  "Bash(kubectl apply:*)",
+  "Bash(kubectl replace:*)",
+  "Bash(kubectl scale:*)",
+  "Bash(kubectl rollout restart:*)",
+  "Bash(kubectl rollout undo:*)",
+  "Bash(helm install:*)",
+  "Bash(helm upgrade:*)",
+  "Bash(helm rollback:*)",
+  "Bash(vercel promote:*)",
+  "Bash(vercel rollback:*)",
+  "Bash(railway up:*)",
+  "Bash(prisma db push:*)",
+  "Bash(prisma migrate reset:*)",
+  "Bash(supabase db push:*)",
+  "Bash(supabase db reset:*)",
+  "Bash(drizzle-kit push:*)",
+  "Bash(docker push:*)",
+  "Bash(podman push:*)",
+  "Bash(twine upload:*)",
+  "Bash(npm publish:*)",
+  "Bash(npm unpublish:*)",
+  "Bash(cargo publish:*)",
+  "Bash(gem push:*)",
+  "Bash(poetry publish:*)",
+  "Bash(uv publish:*)",
+  "Bash(pnpm publish:*)",
+  "Bash(yarn publish:*)",
+  "Bash(yarn npm publish:*)",
+  "Bash(bun publish:*)",
+  "Bash(gh release create:*)",
+  "Bash(pulumi up:*)",
+  "Bash(pulumi destroy:*)",
+  "Bash(cdk deploy:*)",
+  "Bash(cdk destroy:*)",
+  "Bash(tofu apply:*)",
+  "Bash(tofu destroy:*)",
+  "Bash(terraform apply:*)",
+  "Bash(terraform destroy:*)",
+  "Bash(firebase deploy:*)",
+  "Bash(fly deploy:*)",
+  "Bash(flyctl deploy:*)",
+  "Bash(wrangler deploy:*)",
+  "Bash(wrangler publish:*)",
+  "Bash(serverless deploy:*)",
+  "Bash(sls deploy:*)",
+  "Bash(gcloud app deploy:*)",
+  "Bash(gcloud run deploy:*)",
+  "Bash(gcloud functions deploy:*)"
+];
+var SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;
+var REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;
+var COPIES_ONTO_ITS_LAST_OPERAND = /* @__PURE__ */ new Set(["cp", "install", "ln", "rsync", "scp"]);
+var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate"]);
+var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl"]);
+var IN_PLACE_FLAG = /^(?:-[A-Za-z]*i|--in-place(?:=.*)?)$/;
+var namesASecretFile = (word) => word !== void 0 && SECRET_FILE_NAME.test(basenameOf(word.text));
+var NETWORK_SENDERS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "scp",
+  "sftp",
+  "rsync",
+  "nc",
+  "ncat",
+  "http",
+  "https",
+  "xh",
+  "gh",
+  "aws",
+  "gsutil",
+  "rclone"
+]);
+var FILE_REFERENCE_PREFIX = /^(?:[\w.-]+=)?@|^[\w.-]+:/;
+var namesASecretFileReference = (word) => SECRET_FILE_NAME.test(basenameOf(word.text.replace(FILE_REFERENCE_PREFIX, "")));
+var sendsASecretFile = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(namesASecretFileReference);
+var writesASecretFile = ({ program, args }) => {
+  if (program === void 0) return false;
+  if (sendsASecretFile({ program, args })) return true;
+  const name = basenameOf(program.text);
+  const operands = args.filter((arg) => !FLAG.test(arg.text));
+  if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return namesASecretFile(operands.at(-1));
+  if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
+  return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
+};
+var GITHUB_RESOURCE_NOUNS = /* @__PURE__ */ new Set([
+  "pr",
+  "issue",
+  "release",
+  "repo",
+  "gist",
+  "label",
+  "secret",
+  "variable",
+  "workflow",
+  "run",
+  "cache",
+  "project",
+  "ruleset",
+  "codespace",
+  "org",
+  "discussion"
+]);
+var GITHUB_READ_VERBS = /* @__PURE__ */ new Set([
+  "view",
+  "list",
+  "ls",
+  "status",
+  "diff",
+  "checks",
+  "check",
+  "watch",
+  "browse",
+  "download",
+  "clone",
+  "checkout",
+  "get",
+  "field-list",
+  "item-list"
+]);
+var GITHUB_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set(["-R", "--repo", "--hostname"]);
+var GITHUB_API_SUBCOMMAND = "api";
+var GITHUB_GRAPHQL_ENDPOINT = "graphql";
+var HTTP_METHOD_FLAGS = /* @__PURE__ */ new Set(["-X", "--method"]);
+var HTTP_METHOD_ATTACHED = /^(?:-X|--method=)(.+)$/;
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var GITHUB_API_BODY_FLAG = /^(?:-[fF]|--(?:field|raw-field|input)(?:=|$))/;
+var GITHUB_API_FILE_FIELD = /=@|^--input(?:=|$)/;
+var GRAPHQL_MUTATION = /\bmutation\b/i;
+var STRIPE_READ_COMMANDS = /* @__PURE__ */ new Set([
+  "get",
+  "listen",
+  "logs",
+  "status",
+  "version",
+  "help",
+  "login",
+  "logout",
+  "config",
+  "completion",
+  "open",
+  "resources"
+]);
+var STRIPE_REQUEST_COMMANDS_THAT_WRITE = /* @__PURE__ */ new Set(["post", "delete", "trigger", "fixtures"]);
+var STRIPE_READ_OPERATIONS = /* @__PURE__ */ new Set(["list", "retrieve", "search"]);
+var STRIPE_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+  "--api-key",
+  "--project-name",
+  "-p",
+  "--color",
+  "--log-level",
+  "--device-name",
+  "--config",
+  "--stripe-account"
+]);
+var AWS_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+  "--region",
+  "--profile",
+  "--output",
+  "--endpoint-url",
+  "--query",
+  "--color",
+  "--ca-bundle",
+  "--cli-read-timeout",
+  "--cli-connect-timeout",
+  "--cli-binary-format"
+]);
+var AWS_LOCAL_COMMANDS = /* @__PURE__ */ new Set(["configure", "help", "history", "sso", "login", "logout"]);
+var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help)(?:-|$)/;
+var AWS_S3_SERVICE = "s3";
+var AWS_S3_COPIES = /* @__PURE__ */ new Set(["cp", "sync"]);
+var S3_URL_PREFIX = "s3://";
+var TWILIO_TOPIC_SEPARATOR = ":";
+var TWILIO_READ_ACTIONS = /* @__PURE__ */ new Set(["list", "fetch"]);
+var positionalWordsOf = (args, optionsWithValues) => {
+  const endOfOptions = args.findIndex((arg) => arg.text === END_OF_OPTIONS);
+  const options = endOfOptions === -1 ? args : args.slice(0, endOfOptions);
+  const operands = endOfOptions === -1 ? [] : args.slice(endOfOptions + 1);
+  const positional = options.filter((arg, index) => !arg.text.startsWith("-") && !optionsWithValues.has(options[index - 1]?.text ?? ""));
+  return [...positional, ...operands];
+};
+var httpMethodOf = (args) => {
+  for (const [index, arg] of args.entries()) {
+    const attached = HTTP_METHOD_ATTACHED.exec(arg.text);
+    if (attached) return arg.expands ? null : attached[1];
+    if (HTTP_METHOD_FLAGS.has(arg.text)) {
+      const value = args[index + 1];
+      return value === void 0 || value.expands ? null : value.text;
+    }
+  }
+  return void 0;
+};
+var graphqlRequestCanWrite = (args) => args.some((arg) => arg.expands || GRAPHQL_MUTATION.test(arg.text) || GITHUB_API_FILE_FIELD.test(arg.text));
+var githubApiRequestWrites = (args) => {
+  const method = httpMethodOf(args);
+  if (method !== void 0) return method === null || !HTTP_READ_METHODS.has(method.toUpperCase());
+  if (args.some((arg) => arg.text === GITHUB_GRAPHQL_ENDPOINT)) return graphqlRequestCanWrite(args);
+  return args.some((arg) => GITHUB_API_BODY_FLAG.test(arg.text));
+};
+var githubCliWrites = (args) => {
+  const meaningful = argsAfterHarmlessGlobalFlags(args);
+  const [noun, verb] = positionalWordsOf(meaningful, GITHUB_OPTIONS_WITH_VALUES);
+  if (noun?.text === GITHUB_API_SUBCOMMAND) return githubApiRequestWrites(meaningful.slice(meaningful.indexOf(noun) + 1));
+  return noun !== void 0 && GITHUB_RESOURCE_NOUNS.has(noun.text) && verb !== void 0 && !GITHUB_READ_VERBS.has(verb.text);
+};
+var stripeCliWrites = (args) => {
+  const [command, operation] = positionalWordsOf(args, STRIPE_OPTIONS_WITH_VALUES);
+  if (command === void 0 || STRIPE_READ_COMMANDS.has(command.text)) return false;
+  if (STRIPE_REQUEST_COMMANDS_THAT_WRITE.has(command.text)) return true;
+  return operation !== void 0 && !STRIPE_READ_OPERATIONS.has(operation.text);
+};
+var s3CommandWrites = (operation, operands) => !AWS_S3_COPIES.has(operation) ? !AWS_READ_OPERATION.test(operation) : operands.slice(1).some((operand) => operand.expands || operand.text.startsWith(S3_URL_PREFIX));
+var awsCliWrites = (args) => {
+  const [service, operation, ...operands] = positionalWordsOf(args, AWS_OPTIONS_WITH_VALUES);
+  if (service === void 0 || operation === void 0 || AWS_LOCAL_COMMANDS.has(service.text)) return false;
+  return service.text === AWS_S3_SERVICE ? s3CommandWrites(operation.text, operands) : !AWS_READ_OPERATION.test(operation.text);
+};
+var twilioCliWrites = (args) => {
+  const [topic] = positionalWordsOf(args, /* @__PURE__ */ new Set());
+  if (topic === void 0 || !topic.text.includes(TWILIO_TOPIC_SEPARATOR)) return false;
+  return !TWILIO_READ_ACTIONS.has(topic.text.split(TWILIO_TOPIC_SEPARATOR).at(-1) ?? "");
+};
+var REMOTE_API_CLI_WRITES = /* @__PURE__ */ new Map([
+  ["gh", githubCliWrites],
+  ["stripe", stripeCliWrites],
+  ["aws", awsCliWrites],
+  ["twilio", twilioCliWrites]
+]);
+var invocationWritesThroughARemoteApi = ({ program, args }) => {
+  const writes = program === void 0 ? void 0 : REMOTE_API_CLI_WRITES.get(basenameOf(program.text));
+  return writes !== void 0 && writes(args);
+};
+var commandWritesThroughARemoteApi = (command) => {
+  const segments = readableCommandSegments(command);
+  return segments !== null && segments.some((segment) => invocationWritesThroughARemoteApi(invocationOf(segment)));
+};
 var segmentNeedsAPerson = (toolName, segment) => {
   const invocation = invocationOf(segment);
   const normalized = normalizedInvocation(invocation);
-  return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
+  return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || changesWhatIsDeployed(toolName, invocation, normalized) || sqlClientChangesData(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
 };
 var commandNeedsAPerson = (toolName, command) => {
   if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
   const segments = readableCommandSegments(command);
-  return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment));
+  return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment)) || pipesIntoASqlClient(command);
 };
+var VISIBLE_DATA_LOSS_PATTERNS = [
+  "Bash(git branch -D:*)",
+  "Bash(git branch --delete:*)",
+  "Bash(git stash drop:*)",
+  "Bash(git stash clear:*)",
+  "Bash(git filter-branch:*)",
+  "Bash(git update-ref -d:*)",
+  "Bash(git reflog expire:*)",
+  "Bash(git prune:*)",
+  "Bash(dd :*)",
+  "Bash(shred:*)",
+  "Bash(chmod -R:*)",
+  "Bash(chown -R:*)",
+  "Bash(dropdb:*)",
+  "Bash(mkfs:*)",
+  "Bash(rclone sync:*)",
+  "Bash(rclone delete:*)",
+  "Bash(rclone purge:*)",
+  "Bash(diskutil eraseDisk:*)",
+  "Bash(diskutil eraseVolume:*)",
+  "Bash(diskutil zeroDisk:*)",
+  "Bash(diskutil secureErase:*)",
+  "Bash(diskutil partitionDisk:*)",
+  "Bash(diskutil reformat:*)"
+];
+var NEW_BRANCH_FLAGS = /* @__PURE__ */ new Set(["-b", "--orphan"]);
+var CHECKOUT_PATH_FLAGS = /* @__PURE__ */ new Set(["-p", "--patch", "--ours", "--theirs", "--pathspec-from-file"]);
+var UNSTAGE_ONLY_FLAGS = /* @__PURE__ */ new Set(["--staged", "-S"]);
+var WORKTREE_FLAGS = /* @__PURE__ */ new Set(["--worktree", "-W"]);
+var DISCARDING_RESET_MODES = /* @__PURE__ */ new Set(["--hard", "--merge", "--keep"]);
+var FORCE_FLAGS = /* @__PURE__ */ new Set(["-f", "--force"]);
+var REFSPEC_THAT_FORCES_OR_DELETES = /^[+:]/;
+var LOOKS_LIKE_A_PATH = /^\.{1,2}$|\/$|[*?[]|(?:^|\/)[^/]+\.[A-Za-z][A-Za-z0-9]*$/;
+var GIT_WORK_DISCARDERS = /* @__PURE__ */ new Map([
+  ["checkout", (flags, operands) => !flags.some((flag) => NEW_BRANCH_FLAGS.has(flag)) && (flags.some((flag) => CHECKOUT_PATH_FLAGS.has(flag)) || operands.length > 1 || operands.some((operand) => LOOKS_LIKE_A_PATH.test(operand)))],
+  ["restore", (flags) => !flags.some((flag) => UNSTAGE_ONLY_FLAGS.has(flag)) || flags.some((flag) => WORKTREE_FLAGS.has(flag))],
+  ["reset", (flags) => flags.some((flag) => DISCARDING_RESET_MODES.has(flag))],
+  ["push", (_flags, operands) => operands.some((operand) => REFSPEC_THAT_FORCES_OR_DELETES.test(operand))],
+  ["worktree", (flags, operands) => operands[0] === "remove" && flags.some((flag) => FORCE_FLAGS.has(flag))]
+]);
+var gitDiscardsWork = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== "git") return false;
+  const [subcommand, ...rest] = argsAfterHarmlessGlobalFlags(args);
+  const discards = GIT_WORK_DISCARDERS.get(subcommand?.text ?? "");
+  const texts = rest.map((arg) => arg.text);
+  return discards !== void 0 && discards(texts.filter((text) => FLAG.test(text)), texts.filter((text) => !FLAG.test(text)));
+};
+var PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "pip",
+  "pip3",
+  "cargo",
+  "brew",
+  "gem",
+  "uv",
+  "poetry"
+]);
+var GIT = "git";
+var removesAPackage = ({ program, args }) => program !== void 0 && PACKAGE_MANAGERS.has(basenameOf(program.text)) && subcommandWordDestroys(subcommandWordsOf(argsAfterHarmlessGlobalFlags(args))[0]?.text ?? "");
+var subcommandDestroysVisibly = (invocation) => subcommandDestroys(invocation) && basenameOf(invocation.program?.text ?? "") !== GIT && !removesAPackage(invocation);
+var SERVICE_MANAGER_READ_VERBS = /* @__PURE__ */ new Map([
+  ["systemctl", /* @__PURE__ */ new Set([
+    "status",
+    "show",
+    "cat",
+    "help",
+    "list-units",
+    "list-unit-files",
+    "list-timers",
+    "list-sockets",
+    "list-dependencies",
+    "list-jobs",
+    "is-active",
+    "is-enabled",
+    "is-failed",
+    "is-system-running",
+    "get-default"
+  ])],
+  ["launchctl", /* @__PURE__ */ new Set([
+    "list",
+    "print",
+    "print-disabled",
+    "print-cache",
+    "blame",
+    "help",
+    "version",
+    "getenv",
+    "managerpid",
+    "managername",
+    "manageruid",
+    "hostinfo",
+    "dumpstate"
+  ])]
+]);
+var changesAService = ({ program, args }) => {
+  const readVerbs = program === void 0 ? void 0 : SERVICE_MANAGER_READ_VERBS.get(basenameOf(program.text));
+  const verb = args.find((arg) => !FLAG.test(arg.text))?.text;
+  return readVerbs !== void 0 && verb !== void 0 && !readVerbs.has(verb);
+};
+var CRONTAB = "crontab";
+var CRONTAB_USER_FLAG = "-u";
+var CRONTAB_REMOVE_FLAG = "-r";
+var replacesTheCrontab = ({ program, args }) => program !== void 0 && basenameOf(program.text) === CRONTAB && args.some((arg, index) => arg.text === CRONTAB_REMOVE_FLAG || arg.text === STANDARD_INPUT_ARGUMENT || !FLAG.test(arg.text) && args[index - 1]?.text !== CRONTAB_USER_FLAG);
+var FIND_DELETE = "-delete";
+var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
+var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
+var losesDataVisibly = (toolName, invocation, normalized, depth) => {
+  const { program, args } = invocation;
+  if (program === void 0) return false;
+  const name = basenameOf(program.text);
+  if (name === "find") {
+    return args.some((arg) => arg.text === FIND_DELETE) || args.some((arg, index) => FIND_RUNNERS.has(arg.text) && invocationHasAVisibleConsequence(toolName, {
+      program: args[index + 1],
+      args: args.slice(index + 2, findRunnerEnd(args, index + 2))
+    }, depth + 1));
+  }
+  const destructiveArguments = destructiveArgumentsOf(name, args);
+  return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
+};
+var findRunnerEnd = (args, from) => {
+  const end = args.findIndex((arg, index) => index >= from && FIND_RUNNER_END.has(arg.text));
+  return end === -1 ? args.length : end;
+};
+var wrapperSyntax = (optionsWithAValue = [], operandsBeforeTheCommand = 0) => ({ optionsWithAValue: new Set(optionsWithAValue), operandsBeforeTheCommand });
+var ENVIRONMENT_ASSIGNMENTS = wrapperSyntax();
+var WRAPPER_SYNTAX = /* @__PURE__ */ new Map([
+  ["env", wrapperSyntax(["-u", "--unset", "-C", "--chdir", "-S", "--split-string", "-P"])],
+  ["xargs", wrapperSyntax([
+    "-I",
+    "-J",
+    "-R",
+    "-S",
+    "-n",
+    "-L",
+    "-P",
+    "-s",
+    "-d",
+    "-E",
+    "-a",
+    "--max-args",
+    "--max-lines",
+    "--max-procs",
+    "--max-chars",
+    "--delimiter",
+    "--arg-file",
+    "--eof",
+    "--replace"
+  ])],
+  ["timeout", wrapperSyntax(["-s", "--signal", "-k", "--kill-after"], 1)],
+  ["nice", wrapperSyntax(["-n", "--adjustment"])],
+  ["ionice", wrapperSyntax(["-c", "--class", "-n", "--classdata"])],
+  ["stdbuf", wrapperSyntax(["-i", "-o", "-e", "--input", "--output", "--error"])],
+  ["flock", wrapperSyntax(["-w", "--wait", "--timeout", "-E", "--conflict-exit-code"], 1)],
+  ["caffeinate", wrapperSyntax(["-t", "-w"])],
+  ["arch", wrapperSyntax(["-arch", "-d", "-e"])],
+  ["sudo", wrapperSyntax([
+    "-u",
+    "--user",
+    "-g",
+    "--group",
+    "-C",
+    "--close-from",
+    "-h",
+    "--host",
+    "-p",
+    "--prompt",
+    "-U",
+    "--other-user",
+    "-r",
+    "--role",
+    "-t",
+    "--type",
+    "-D",
+    "--chdir"
+  ])],
+  ["doas", wrapperSyntax(["-u", "-C"])],
+  ["time", wrapperSyntax(["-f", "--format", "-o", "--output"])],
+  ["watch", wrapperSyntax(["-n", "--interval"])],
+  ["nohup", wrapperSyntax()],
+  ["command", wrapperSyntax()],
+  ["builtin", wrapperSyntax()],
+  ["exec", wrapperSyntax(["-a"])],
+  ["unbuffer", wrapperSyntax()],
+  ["npx", wrapperSyntax(["-p", "--package", "-c", "--call"])],
+  ["bunx", wrapperSyntax(["-p", "--package"])],
+  ["pnpx", wrapperSyntax()],
+  ["uvx", wrapperSyntax(["--from", "--with", "-p", "--python"])]
+]);
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var SCRIPT_FLAG_CLUSTER = /^-[A-Za-z]*c$/;
+var EVAL = "eval";
+var MAX_CONSEQUENCE_DEPTH = 4;
+var commandStartAfterWrapper = (words, syntax) => {
+  let index = 0;
+  while (index < words.length) {
+    const text = words[index]?.text ?? "";
+    if (text === END_OF_OPTIONS) return index + 1 + syntax.operandsBeforeTheCommand;
+    if (!SHELL_ENV_ASSIGNMENT.test(text) && (!FLAG.test(text) || text === STANDARD_INPUT_ARGUMENT)) break;
+    index += syntax.optionsWithAValue.has(text) ? 2 : 1;
+  }
+  return index + syntax.operandsBeforeTheCommand;
+};
+var wrappedInvocation = ({ program, args }) => {
+  if (program === void 0) return null;
+  const assigns = SHELL_ENV_ASSIGNMENT.test(program.text);
+  const syntax = assigns ? ENVIRONMENT_ASSIGNMENTS : WRAPPER_SYNTAX.get(basenameOf(program.text));
+  if (syntax === void 0) return null;
+  const words = assigns ? [program, ...args] : args;
+  const start = commandStartAfterWrapper(words, syntax);
+  const command = words[start];
+  return command === void 0 ? null : { program: command, args: words.slice(start + 1) };
+};
+var innermostInvocation = (invocation, depth = 0) => {
+  const wrapped = depth < MAX_CONSEQUENCE_DEPTH ? wrappedInvocation(invocation) : null;
+  return wrapped === null ? invocation : innermostInvocation(wrapped, depth + 1);
+};
+var shellScriptOf = ({ program, args }) => {
+  if (program === void 0) return null;
+  if (basenameOf(program.text) === EVAL) return args.some((arg) => arg.expands) ? null : args.map((arg) => arg.text).join(" ");
+  if (!SHELLS.has(basenameOf(program.text))) return null;
+  const flag = args.findIndex((arg) => SCRIPT_FLAG_CLUSTER.test(arg.text));
+  const script = flag === -1 ? void 0 : args[flag + 1];
+  return script === void 0 || script.expands ? null : script.text;
+};
+var FLAG = /^-/;
+var FLAG_WITH_ATTACHED_VALUE = /^-[^=]*=/;
+var withoutLeadingFlags = (args, flagsTakeAValue) => {
+  let index = 0;
+  while (index < args.length && FLAG.test(args[index]?.text ?? "")) {
+    const takesNext = flagsTakeAValue && !FLAG_WITH_ATTACHED_VALUE.test(args[index]?.text ?? "") && !FLAG.test(args[index + 1]?.text ?? "-");
+    index += takesNext ? 2 : 1;
+  }
+  return args.slice(index);
+};
+var readingsPastGlobalFlags = ({ program, args }) => {
+  const meaningful = argsAfterHarmlessGlobalFlags(args);
+  if (program === void 0 || !SUBCOMMAND_CLIS.has(basenameOf(program.text)) || !FLAG.test(meaningful[0]?.text ?? "")) return [];
+  return [false, true].map((flagsTakeAValue) => ({ program, args: withoutLeadingFlags(meaningful, flagsTakeAValue) }));
+};
+var PREVIEW_FLAG = /^--(?:help|dry-?run(?:=(?:client|server|true))?)$/;
+var TASK_RUNNERS = /* @__PURE__ */ new Set(["make", "just", "rake", "task"]);
+var PUBLISH_SUBCOMMAND = "publish";
+var honoursPreviewFlags = ({ program, args }) => {
+  const name = basenameOf(program?.text ?? "");
+  if (TASK_RUNNERS.has(name)) return false;
+  return !PACKAGE_MANAGERS.has(name) || subcommandWordsOf(argsAfterHarmlessGlobalFlags(args))[0]?.text === PUBLISH_SUBCOMMAND;
+};
+var onlyPreviews = (invocation) => invocation.program !== void 0 && honoursPreviewFlags(invocation) && invocation.args.some((arg) => !arg.expands && PREVIEW_FLAG.test(arg.text));
+var changesWhatIsDeployed = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (changesProduction(invocation) || mergesAPullRequest(invocation) || isCoveredByPolicy(DEPLOY_AND_SCHEMA_COMMAND_PATTERNS, toolName, normalized));
+var invocationHasAVisibleConsequence = (toolName, invocation, depth) => {
+  if (invocation.program === void 0 || depth > MAX_CONSEQUENCE_DEPTH) return false;
+  const normalized = quotedInvocation(invocation);
+  const wrapped = wrappedInvocation(invocation);
+  const script = shellScriptOf(invocation);
+  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || writesASecretFile(invocation) || losesDataVisibly(toolName, invocation, normalized, depth) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || wrapped !== null && invocationHasAVisibleConsequence(toolName, wrapped, depth + 1) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1));
+};
+var RUNS_FETCHED_CODE = /(?:\$\(|`|<\()\s*(?:curl|wget)\b/;
+var FETCHING_PROGRAMS = /* @__PURE__ */ new Set(["curl", "wget"]);
+var READS_ITS_SCRIPT_FROM_STANDARD_INPUT = /^-[A-Za-z]*s[A-Za-z]*$/;
+var interpreterNameOf = (program) => basenameOf(program.text).replace(/\d+(?:\.\d+)*$/, "");
+var runsScripts = (program) => SHELLS.has(basenameOf(program.text)) || INLINE_CODE_INTERPRETERS.has(interpreterNameOf(program));
+var runsWhatItReads = ({ program, args }) => program !== void 0 && runsScripts(program) && (args.length === 0 || args.every((arg) => arg.text.startsWith("-")) || args.some((arg) => arg.text === STANDARD_INPUT_ARGUMENT) || SHELLS.has(basenameOf(program.text)) && args.some((arg) => READS_ITS_SCRIPT_FROM_STANDARD_INPUT.test(arg.text)));
+var fetches = (invocation) => FETCHING_PROGRAMS.has(basenameOf(innermostInvocation(invocation).program?.text ?? ""));
+var URL_QUERY_OR_FRAGMENT = /[?#].*$/;
+var SOURCES_A_SCRIPT = /* @__PURE__ */ new Set(["source", "."]);
+var downloadedNamesOf = (invocations) => new Set(invocations.filter(fetches).flatMap((invocation) => innermostInvocation(invocation).args.filter((arg) => !FLAG.test(arg.text)).map((arg) => basenameOf(arg.text.replace(URL_QUERY_OR_FRAGMENT, "")))));
+var runsADownloadedScript = (invocations) => {
+  const downloaded = downloadedNamesOf(invocations);
+  return downloaded.size > 0 && invocations.map((invocation) => innermostInvocation(invocation)).some(({ program, args }) => {
+    if (program === void 0) return false;
+    const script = args.find((arg) => !FLAG.test(arg.text))?.text;
+    return downloaded.has(basenameOf(program.text)) || (runsScripts(program) || SOURCES_A_SCRIPT.has(program.text)) && script !== void 0 && downloaded.has(basenameOf(script));
+  });
+};
+var pipedSegmentsOf = (command) => (shellSegmentsReadingAPipe(commandForReading(command)) ?? []).map((segment) => innermostInvocation(invocationOf(withoutShellGrouping(segment))));
+var pipesIntoASqlClient = (command) => pipedSegmentsOf(command).some((invocation) => sqlClientSyntaxOf(invocation) !== void 0);
+var pipesFetchedCodeIntoAnInterpreter = (command, invocations) => invocations.some(fetches) && pipedSegmentsOf(command).some(runsWhatItReads);
+var SHELL_GROUPING_PREFIX = /^\s*(?:(?:if|then|elif|else|do|while|until|!)\s+|[({]\s*)+/;
+var GROUP_OPENER_BY_CLOSER = /* @__PURE__ */ new Map([[")", "("], ["}", "{"]]);
+var occurrencesOf = (text, character) => text.split(character).length - 1;
+var closesAGroupItDidNotOpen = (text) => {
+  const last = text.at(-1) ?? "";
+  const opener = GROUP_OPENER_BY_CLOSER.get(last);
+  return opener !== void 0 && occurrencesOf(text, last) > occurrencesOf(text, opener);
+};
+var withoutShellGrouping = (segment) => {
+  let text = segment.replace(SHELL_GROUPING_PREFIX, "").trimEnd();
+  while (closesAGroupItDidNotOpen(text)) text = text.slice(0, -1).trimEnd();
+  return text;
+};
+var HEREDOC_OPERATOR = /(?<!<)\d*<<(?!<)-?[ \t]*(?:'([A-Za-z_]\w*)'|"([A-Za-z_]\w*)"|\\?([A-Za-z_]\w*))/g;
+var HEREDOC_MARK = "\uE001";
+var withHeredocBodiesSetAside = (command) => {
+  const lines = command.split("\n");
+  const kept = [];
+  const bodies = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    const delimiters = [...line.matchAll(HEREDOC_OPERATOR)].map((match) => match[1] ?? match[2] ?? match[3] ?? "");
+    kept.push(line.replace(HEREDOC_OPERATOR, ` ${HEREDOC_MARK} `));
+    for (const delimiter of delimiters) {
+      const body = [];
+      for (index += 1; index < lines.length && !mightEndAHeredoc(lines[index] ?? "", delimiter); index += 1) {
+        body.push(lines[index] ?? "");
+      }
+      bodies.push(body.join("\n"));
+      const ending = lines[index];
+      if (ending !== void 0 && !isHeredocTerminator(ending, delimiter)) kept.push(ending);
+    }
+  }
+  return { text: kept.join("\n"), bodies };
+};
+var REDIRECTION_TARGET = String.raw`(?:'[^']*'|"[^"]*"|[^\s;|&()<>]+)`;
+var INPUT_REDIRECTION = new RegExp(String.raw`\d*(?:<<<|<(?![<(&>]))\s*${REDIRECTION_TARGET}`, "g");
+var OUTPUT_REDIRECTION = new RegExp(String.raw`(?:\d*|&)(?:>>?|>\||<>|>&|<&)\s*${REDIRECTION_TARGET}`, "g");
+var REDIRECTED_INPUT_MARK = "\uE000";
+var ROUGH_SEPARATORS = ["&&", "||", "$(", "\n", ";", "|", "&", "`", "(", ")", "{", "}"];
+var SEPARATORS_INSIDE_DOUBLE_QUOTES = /* @__PURE__ */ new Set(["$(", "`", ")"]);
+var PIPE2 = "|";
+var SUBSTITUTION_OPENERS = /* @__PURE__ */ new Set(["$(", "`"]);
+var QUOTE_CHARACTERS = /['"]/g;
+var roughPiecesOf = (text) => {
+  const pieces = [];
+  let current = "";
+  let before = "";
+  let quote = null;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text.charAt(index);
+    if (quote === "'") {
+      current += char;
+      if (char === "'") quote = null;
+      continue;
+    }
+    if (char === "\\") {
+      current += text.slice(index, index + 2);
+      index += 1;
+      continue;
+    }
+    const separator = ROUGH_SEPARATORS.find((candidate) => text.startsWith(candidate, index) && (quote === null || SEPARATORS_INSIDE_DOUBLE_QUOTES.has(candidate)));
+    if (separator !== void 0) {
+      pieces.push({ text: current, before });
+      current = "";
+      before = separator;
+      index += separator.length - 1;
+      continue;
+    }
+    if (char === '"' || char === "'") quote = quote === char ? null : quote ?? char;
+    current += char;
+  }
+  return [...pieces, { text: current, before }];
+};
+var invocationOfRoughPiece = (text) => {
+  const piece = withoutShellGrouping(text.replaceAll(REDIRECTED_INPUT_MARK, "").replaceAll(HEREDOC_MARK, ""));
+  const parsed = invocationOf(piece);
+  return parsed.program !== void 0 ? parsed : invocationOf(piece.replace(QUOTE_CHARACTERS, ""));
+};
+var roughSegmentsOf = (command) => {
+  const { text, bodies } = withHeredocBodiesSetAside(commandForReading(command));
+  const pieces = roughPiecesOf(text.replace(INPUT_REDIRECTION, ` ${REDIRECTED_INPUT_MARK} `).replace(OUTPUT_REDIRECTION, " "));
+  let heredocsSeen = 0;
+  return pieces.map((piece, index) => {
+    const heredocCount = occurrencesOf(piece.text, HEREDOC_MARK);
+    const heredocs = bodies.slice(heredocsSeen, heredocsSeen + heredocCount);
+    heredocsSeen += heredocCount;
+    return {
+      invocation: invocationOfRoughPiece(piece.text),
+      readsInput: piece.text.includes(REDIRECTED_INPUT_MARK) || heredocCount > 0 || piece.before === PIPE2,
+      readsAPipe: piece.before === PIPE2,
+      feedsASubstitution: SUBSTITUTION_OPENERS.has(pieces[index + 1]?.before ?? ""),
+      heredocs
+    };
+  });
+};
+var roughSegmentHasAVisibleConsequence = (toolName, segment, fetchesCode, depth) => {
+  const innermost = innermostInvocation(segment.invocation);
+  const runsAHeredocScript = innermost.program !== void 0 && SHELLS.has(basenameOf(innermost.program.text));
+  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || segment.readsAPipe && fetchesCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1));
+};
+var roughReadingHasAVisibleConsequence = (toolName, command, depth) => {
+  const segments = roughSegmentsOf(command);
+  const invocations = segments.map((segment) => segment.invocation);
+  const fetchesCode = invocations.some(fetches);
+  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, fetchesCode, depth)) || runsADownloadedScript(invocations);
+};
+var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
+  if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
+  const readable = withHeredocSubstitutionsAsQuotedText(command);
+  if (classifyDecisionRisk(toolName, readable) === "destructive" || RUNS_FETCHED_CODE.test(readable) || REDIRECTS_INTO_A_SECRET_FILE.test(readable)) return true;
+  const segments = readableCommandSegments(command);
+  if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth);
+  const invocations = segments.map((segment) => invocationOf(withoutShellGrouping(segment)));
+  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
+};
+var commandHasAVisibleConsequence = (toolName, command) => commandHasAVisibleConsequenceAt(toolName, command, 0);
 var withoutSessionToolGrants = (config) => ({
   ...config,
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
 });
 var SESSION_TOOL_GRANT_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+var isStandingShellAllow = (policy) => !policy.origin && !isSessionToolGrant(policy) && SESSION_TOOL_GRANT_TOOLS.has(policy.tool) && isAutoApprove(policy);
 var MCP_TOOL_PREFIX = "mcp__";
 var parseMcpToolName = (toolName) => {
   if (!toolName.startsWith(MCP_TOOL_PREFIX)) return void 0;
@@ -2460,6 +3363,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
   };
   const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
   const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
+  const governedByStandingShellAllow = match?.rank === "tool" && isStandingShellAllow(match.policy);
   const governingMode = base.mode;
   const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
@@ -2469,7 +3373,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
     base = autoApprove(base.tool);
   }
   const wouldAutoApprove = isAutoApprove(base);
-  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && classifyDecisionRisk(toolName, arg) === "destructive") {
+  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && (classifyDecisionRisk(toolName, arg) === "destructive" || governedByStandingShellAllow && commandHasAVisibleConsequence(toolName, arg))) {
     base = {
       tool: base.tool,
       timeoutSeconds: config.defaultTimeoutSeconds,
@@ -2646,9 +3550,16 @@ var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(
 var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
 var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => toolName === "Bash" && toolInputs.some((toolInput) => {
   const command = extractPolicyArg(toolName, toolInput);
-  return command !== void 0 && commandNeedsAPerson(toolName, command);
+  return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
+});
+var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/;
+var FILE_WRITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
+var writesASecretOrWorkflowFile = ({ toolName, toolInputs }) => FILE_WRITING_TOOLS.has(toolName) && toolInputs.some((toolInput) => {
+  const path = extractPolicyArg(toolName, toolInput);
+  return path !== void 0 && namesASecretOrWorkflowFile(path);
 });
-var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input));
+var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || writesASecretOrWorkflowFile(input));
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -2888,6 +3799,9 @@ var WITHDRAWN_APPROVAL_REASON = "The phone question was withdrawn. Approve in th
 var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change before coding.";
 var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
 var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
+var UNHEARD_PUSH_WINDOW_DAYS = 14;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNHEARD_PUSH_WINDOW_MS = UNHEARD_PUSH_WINDOW_DAYS * DAY_MS;
 var ELICITATION_ANSWERABLE_MODE = "form";
 var ELICITATION_MIN_OPTIONS = 2;
 var ELICITATION_MAX_MULTI_QUESTIONS = 4;