@qwen-code/qwen-code 0.19.12-preview.0 → 0.19.12

package/chunks/{chunk-6TDA4EVC.js → chunk-GCY7QTCE.js}

@@ -149,7 +149,7 @@ import {
   isFallbackEligible,
   isUnattendedMode,
   retryWithBackoff
-} from "./chunk-7KS72E2N.js";
+} from "./chunk-6ETOSWAO.js";
 import {
   openBrowserSecurely,
   shouldAttemptBrowserLaunch
@@ -300,7 +300,7 @@ import {
   updateMCPServerStatus,
   writeLine,
   writeLineSync
-} from "./chunk-YN2I5I42.js";
+} from "./chunk-CPU6I5YV.js";
 import {
   E_TIMEOUT,
   Mutex,
@@ -49800,6 +49800,301 @@ __name(doesToolInvocationMatch, "doesToolInvocationMatch");
 // packages/core/src/utils/shellReadOnlyChecker.ts
 init_esbuild_shims();
 var import_shell_quote2 = __toESM(require_shell_quote(), 1);
+
+// packages/core/src/utils/shell-safety-rules.ts
+init_esbuild_shims();
+var SED_ADDRESS = /^\s*(?:(?:\d+|\$)(?:\s*,\s*(?:\d+|\$))?|\/(?:\\[\s\S]|[^/\\])*\/)?\s*/;
+var SED_ADDRESS_AT = /\s*(?:(?:\d+|\$)(?:\s*,\s*(?:\d+|\$))?|\/(?:\\[\s\S]|[^/\\])*\/)?\s*/y;
+var SAFE_SED_COMMAND = /^[dDgGhHlnNpPqQxz=]$/;
+var SAFE_SUBSTITUTION_FLAGS = /^[0-9gIpM]*$/;
+var SAFE_SED_OPTION = /^(?:-[nElrsuz]|--(?:quiet|silent|line-length(?:=.*)?))$/;
+var SED_VALUE_OPTIONS = "-f --file -e --expression -l --line-length".split(
+  " "
+);
+var AWK_STATIC_WRITE = /^\s*(?:print|printf)\b(?!\s*\()(?:(?:"(?:\\[\s\S]|[^"\\])*")|[^">|])*>>?\s*"[^"]*"\s*$/;
+var AWK_UNKNOWN_OPERATION = /(?:system|close)\s*\(|getline\b/;
+var AWK_PRINT = /\b(?:print|printf)\b/;
+function scanDelimitedSection(script, start, delimiter2) {
+  let escaped = false;
+  for (let i2 = start; i2 < script.length; i2++) {
+    const char = script[i2];
+    if (escaped) {
+      escaped = false;
+    } else if (char === "\\") {
+      escaped = true;
+    } else if (char === delimiter2) {
+      return i2 + 1;
+    }
+  }
+  return -1;
+}
+__name(scanDelimitedSection, "scanDelimitedSection");
+function classifySingleSedCommandSafety(script) {
+  const compatibilityUnknown = /(?:^|[^\\])[ewr]\s/.test(script);
+  const commandOffset = SED_ADDRESS.exec(script)?.[0].length ?? 0;
+  if (commandOffset === script.length) return "read-only";
+  const command = script[commandOffset];
+  if (command === "w" || command === "W")
+    return script.slice(commandOffset + 1).trim() ? "write" : "unknown";
+  if (/[eErR]/.test(command)) return "unknown";
+  if (command === "s") {
+    const delimiter2 = script[commandOffset + 1];
+    if (!delimiter2 || delimiter2 === "\\" || /\s/.test(delimiter2))
+      return "unknown";
+    const replacementStart = scanDelimitedSection(
+      script,
+      commandOffset + 2,
+      delimiter2
+    );
+    if (replacementStart < 0) return "unknown";
+    const flagsStart = scanDelimitedSection(
+      script,
+      replacementStart,
+      delimiter2
+    );
+    if (flagsStart < 0) return "unknown";
+    const flags = script.slice(flagsStart).trim();
+    if (/[;\n{}]/.test(flags)) return "unknown";
+    const writeFlag = flags.indexOf("w");
+    if (writeFlag >= 0)
+      return flags.slice(writeFlag + 1).trim() ? "write" : "unknown";
+    if (/[eErRwW]/.test(flags)) return "unknown";
+    if (!SAFE_SUBSTITUTION_FLAGS.test(flags)) return "unknown";
+    return compatibilityUnknown ? "unknown" : "read-only";
+  }
+  if (/[;\n{}]/.test(script.slice(commandOffset + 1))) return "unknown";
+  if (!SAFE_SED_COMMAND.test(command)) return "unknown";
+  return compatibilityUnknown ? "unknown" : "read-only";
+}
+__name(classifySingleSedCommandSafety, "classifySingleSedCommandSafety");
+function nextSedSeparator(script, start) {
+  for (let i2 = start; i2 < script.length; i2++) {
+    if (script[i2] === ";" || script[i2] === "\n") return i2;
+  }
+  return script.length;
+}
+__name(nextSedSeparator, "nextSedSeparator");
+function classifySedScriptSafety(script) {
+  let result = "read-only";
+  let start = 0;
+  while (start < script.length) {
+    SED_ADDRESS_AT.lastIndex = start;
+    const address = SED_ADDRESS_AT.exec(script);
+    if (!address) return "unknown";
+    const commandOffset = SED_ADDRESS_AT.lastIndex;
+    if (commandOffset === script.length) return result;
+    const command = script[commandOffset];
+    if (command === "w" || command === "W") {
+      const writer = classifySingleSedCommandSafety(script.slice(start));
+      return writer === "write" ? "write" : "unknown";
+    }
+    if (/[eErR]/.test(command)) return "unknown";
+    if (command !== "s" && !SAFE_SED_COMMAND.test(command)) return "unknown";
+    let separator;
+    if (command === "s") {
+      const delimiter2 = script[commandOffset + 1];
+      if (!delimiter2 || delimiter2 === "\\" || /\s/.test(delimiter2))
+        return "unknown";
+      const replacementStart = scanDelimitedSection(
+        script,
+        commandOffset + 2,
+        delimiter2
+      );
+      if (replacementStart < 0) return "unknown";
+      const flagsStart = scanDelimitedSection(
+        script,
+        replacementStart,
+        delimiter2
+      );
+      if (flagsStart < 0) return "unknown";
+      separator = nextSedSeparator(script, flagsStart);
+    } else {
+      separator = nextSedSeparator(script, commandOffset + 1);
+    }
+    const current = classifySingleSedCommandSafety(
+      script.slice(start, separator)
+    );
+    if (current === "write") return "write";
+    if (current === "unknown") result = "unknown";
+    if (separator === script.length) return result;
+    start = separator + 1;
+  }
+  return result;
+}
+__name(classifySedScriptSafety, "classifySedScriptSafety");
+function classifySedCommandSafety(args) {
+  const terminator = args.indexOf("--");
+  const options2 = args.slice(0, terminator < 0 ? args.length : terminator);
+  if (options2.some(
+    (arg, index) => /^(?:--help|--version)$/i.test(arg) && !SED_VALUE_OPTIONS.includes(options2[index - 1])
+  ))
+    return "unknown";
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg === "--") break;
+    if (SED_VALUE_OPTIONS.includes(arg)) i2++;
+    else if (/^-[nErsuz]*e.+/.test(arg)) continue;
+    else if (/^(?:-[nErsuz]*[iI]|--in-place(?:=|$))/.test(arg)) return "write";
+  }
+  const scripts = [];
+  const scriptArguments = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg === "--") {
+      if (scripts.length === 0) {
+        const script = args[i2 + 1];
+        if (script === void 0 || script.startsWith("-")) return "unknown";
+        scripts.push(script);
+        scriptArguments.add(i2 + 1);
+      }
+      break;
+    }
+    if (/^(?:-l|--line-length)$/.test(arg) && !args[++i2]) return "unknown";
+    if (/^(?:-f|--file(?:=|$))/.test(arg)) return "unknown";
+    if (arg === "-e" || arg === "--expression") {
+      const script = args[++i2];
+      if (!script || script.startsWith("-")) return "unknown";
+      scripts.push(script);
+      scriptArguments.add(i2);
+    } else if (/^(?:-e.+|--expression=)/.test(arg)) {
+      const script = arg.slice(arg.startsWith("-e") ? 2 : 13);
+      if (script.startsWith("-")) return "unknown";
+      scripts.push(script);
+      scriptArguments.add(i2);
+    } else if (/^--(?!line-length(?:=|$))/.test(arg)) {
+      return "unknown";
+    } else if (arg.startsWith("-") && !SAFE_SED_OPTION.test(arg)) {
+      return "unknown";
+    } else if (!arg.startsWith("-") && scripts.length === 0) {
+      scripts.push(arg);
+      scriptArguments.add(i2);
+    }
+  }
+  let result = "read-only";
+  for (const script of scripts) {
+    const current = classifySedScriptSafety(script);
+    if (current === "write") return "write";
+    if (current === "unknown") result = "unknown";
+  }
+  const remainingArgs = args.filter((_3, index) => !scriptArguments.has(index));
+  return /(?:^|[^\\])[ewr]\s/.test(remainingArgs.join(" ")) ? "unknown" : result;
+}
+__name(classifySedCommandSafety, "classifySedCommandSafety");
+function splitAwkStatements(script) {
+  const statements = [];
+  let ambiguousSlash = false;
+  let unsupportedAt = false;
+  let start = 0;
+  let escaped = false;
+  let inString = false;
+  let inRegex = false;
+  let previousSignificant = "";
+  for (let i2 = 0; i2 < script.length; i2++) {
+    const char = script[i2];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if ((inString || inRegex) && char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (inString) {
+      if (char === '"') inString = false;
+      continue;
+    }
+    if (inRegex) {
+      if (char === "/") inRegex = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      continue;
+    }
+    if (char === "/" && (!previousSignificant || "({[=,:;!~?&|".includes(previousSignificant))) {
+      inRegex = true;
+      continue;
+    }
+    if (char === "/") ambiguousSlash = true;
+    if (char === "@") unsupportedAt = true;
+    if (char === "#") {
+      statements.push(script.slice(start, i2));
+      const newline2 = script.indexOf("\n", i2 + 1);
+      if (newline2 < 0) return { statements, ambiguousSlash, unsupportedAt };
+      start = newline2 + 1;
+      i2 = newline2;
+      previousSignificant = "\n";
+      continue;
+    }
+    if (/[;{}\n]/.test(char)) {
+      statements.push(script.slice(start, i2));
+      start = i2 + 1;
+      previousSignificant = char;
+      continue;
+    }
+    if (!/\s/.test(char)) previousSignificant = char;
+  }
+  statements.push(script.slice(start));
+  return { statements, ambiguousSlash, unsupportedAt };
+}
+__name(splitAwkStatements, "splitAwkStatements");
+function classifyAwkScriptSafety(script) {
+  const { statements, ambiguousSlash, unsupportedAt } = splitAwkStatements(script);
+  if (!ambiguousSlash && statements.some((statement) => AWK_STATIC_WRITE.test(statement)))
+    return "write";
+  if (unsupportedAt || AWK_UNKNOWN_OPERATION.test(script)) return "unknown";
+  return AWK_PRINT.test(script) && /[>|]/.test(script) ? "unknown" : "read-only";
+}
+__name(classifyAwkScriptSafety, "classifyAwkScriptSafety");
+function classifyAwkCommandSafety(args) {
+  let programIndex = -1;
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg === "--") {
+      programIndex = i2 + 1;
+      break;
+    }
+    if (arg === "-F" || arg === "-v") {
+      if (!args[++i2]) return "unknown";
+      continue;
+    }
+    if (/^-[Fv].+/.test(arg)) continue;
+    if (arg.startsWith("-")) return "unknown";
+    programIndex = i2;
+    break;
+  }
+  if (programIndex < 0) return "read-only";
+  const program = args[programIndex];
+  if (program === void 0) return "unknown";
+  const result = classifyAwkScriptSafety(program);
+  if (result !== "read-only") return result;
+  return classifyAwkScriptSafety(args.join(" ")) === "read-only" ? "read-only" : "unknown";
+}
+__name(classifyAwkCommandSafety, "classifyAwkCommandSafety");
+function hasShellBraceExpansion(text) {
+  let braceDepth = 0;
+  let previousDot = false;
+  for (const char of text) {
+    if (char === "{") {
+      braceDepth++;
+      previousDot = false;
+    } else if (char === "}") {
+      braceDepth = Math.max(0, braceDepth - 1);
+      previousDot = false;
+    } else if (braceDepth > 0) {
+      if (char === "," || char === "." && previousDot) return true;
+      previousDot = char === ".";
+    }
+  }
+  return false;
+}
+__name(hasShellBraceExpansion, "hasShellBraceExpansion");
+function hasShellPatternExpansion(text) {
+  return /[[*?]/.test(text) || hasShellBraceExpansion(text);
+}
+__name(hasShellPatternExpansion, "hasShellPatternExpansion");
+
+// packages/core/src/utils/shellReadOnlyChecker.ts
 var READ_ONLY_ROOT_COMMANDS = /* @__PURE__ */ new Set([
   "awk",
   "basename",
@@ -49815,21 +50110,13 @@ var READ_ONLY_ROOT_COMMANDS = /* @__PURE__ */ new Set([
   "git",
   "grep",
   "head",
-  "less",
   "ls",
-  "more",
   "printenv",
-  "printf",
   "ps",
   "pwd",
-  "rg",
-  "ripgrep",
   "sed",
-  "sort",
   "stat",
   "tail",
-  "tree",
-  "uniq",
   "wc",
   "which",
   "where",
@@ -49842,7 +50129,7 @@ var BLOCKED_FIND_FLAGS = /* @__PURE__ */ new Set([
   "-ok",
   "-okdir"
 ]);
-var BLOCKED_FIND_PREFIXES = ["-fprint", "-fprintf"];
+var BLOCKED_FIND_PREFIXES = ["-fls", "-fprint", "-fprintf"];
 var READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "blame",
   "branch",
@@ -49860,56 +50147,18 @@ var READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
 var BLOCKED_GIT_REMOTE_ACTIONS = /* @__PURE__ */ new Set([
   "add",
   "remove",
+  "rm",
   "rename",
+  "set-branches",
+  "set-head",
   "set-url",
   "prune",
   "update"
 ]);
-var BLOCKED_GIT_BRANCH_FLAGS = /* @__PURE__ */ new Set([
-  "-d",
-  "-D",
-  "--delete",
-  "--move",
-  "-m"
-]);
-var BLOCKED_SED_PREFIXES = ["-i"];
-var AWK_SIDE_EFFECT_PATTERNS = [
-  /system\s*\(/,
-  // system() function calls
-  /print\s+[^>|]*>\s*"[^"]*"/,
-  // print > "file"
-  /printf\s+[^>|]*>\s*"[^"]*"/,
-  // printf > "file"
-  /print\s+[^>|]*>>\s*"[^"]*"/,
-  // print >> "file"
-  /printf\s+[^>|]*>>\s*"[^"]*"/,
-  // printf >> "file"
-  /print\s+[^|]*\|\s*"[^"]*"/,
-  // print | "command"
-  /printf\s+[^|]*\|\s*"[^"]*"/,
-  // printf | "command"
-  /getline\s*<\s*"[^"]*"/,
-  // getline < "command"
-  /"[^"]*"\s*\|\s*getline/,
-  // "command" | getline
-  /close\s*\(/
-  // close() can trigger command execution
-];
-var SED_SIDE_EFFECT_PATTERNS = [
-  /[^\\]e\s/,
-  // e command (execute)
-  /^e\s/,
-  // e command at start
-  /[^\\]w\s/,
-  // w command (write)
-  /^w\s/,
-  // w command at start
-  /[^\\]r\s/,
-  // r command (read file)
-  /^r\s/
-  // r command at start
-];
+var GIT_EXTERNAL_HELPER_OPTION = /(?:^--(?:ext-diff|filters|show-signature|textconv|open-files-in-pager)(?:=|$)|%G[?GKFPST])/;
+var SAFE_SED_OPTION2 = /^(?:-[nErsuz]|--(?:quiet|silent))$/;
 var ENV_ASSIGNMENT_REGEX2 = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var MALFORMED_CONTROL_OPERATOR = /(?:^|[({])\s*(?:&&|\|\||\|&|[|;&])|(?:&&|\|\||\|&|[|;&])\s+(?:&&|\|\||\|&|[|;&])|(?!(?:&&|\|\||\|&))[|;&]{2}|[|;&]{3,}|(?:\|&?|&&|\|\|)\s*[)}]*\s*$/;
 function containsWriteRedirection(command) {
   let inSingleQuotes = false;
   let inDoubleQuotes = false;
@@ -49939,11 +50188,13 @@ function containsWriteRedirection(command) {
 }
 __name(containsWriteRedirection, "containsWriteRedirection");
 function normalizeTokens(segment) {
-  const parsed = (0, import_shell_quote2.parse)(segment);
+  const parsed = (0, import_shell_quote2.parse)(segment, (key) => `\0${key}`);
   const tokens = [];
   for (const token of parsed) {
     if (typeof token === "string") {
       tokens.push(token);
+    } else if ("op" in token && token.op === "glob") {
+      tokens.push(`\0${token.pattern}`);
     }
   }
   return tokens;
@@ -49965,6 +50216,7 @@ function skipEnvironmentAssignments(tokens) {
 __name(skipEnvironmentAssignments, "skipEnvironmentAssignments");
 function evaluateFindCommand(tokens) {
   const [, ...rest] = tokens;
+  if (rest.at(-1)?.startsWith("-")) return false;
   for (const token of rest) {
     const lower = token.toLowerCase();
     if (BLOCKED_FIND_FLAGS.has(lower)) {
@@ -49980,56 +50232,38 @@ __name(evaluateFindCommand, "evaluateFindCommand");
 function evaluateSedCommand(tokens) {
   const [, ...rest] = tokens;
   for (const token of rest) {
-    if (BLOCKED_SED_PREFIXES.some((prefix) => token.startsWith(prefix)) || token === "--in-place") {
+    if (["-i", "-I"].some((prefix) => token.startsWith(prefix)) || token === "--in-place" || token.startsWith("--in-place=") || token === "-f" || token === "--file" || token.startsWith("-f") && token.length > 2 || token.startsWith("--file=") || token.startsWith("-") && !SAFE_SED_OPTION2.test(token)) {
       return false;
     }
   }
-  const scriptContent = rest.join(" ");
-  for (const pattern of SED_SIDE_EFFECT_PATTERNS) {
-    if (pattern.test(scriptContent)) {
-      return false;
-    }
-  }
-  return true;
+  return classifySedCommandSafety(rest) === "read-only";
 }
 __name(evaluateSedCommand, "evaluateSedCommand");
 function evaluateAwkCommand(tokens) {
   const [, ...rest] = tokens;
-  const scriptContent = rest.join(" ");
-  for (const pattern of AWK_SIDE_EFFECT_PATTERNS) {
-    if (pattern.test(scriptContent)) {
-      return false;
-    }
-  }
-  return true;
+  return classifyAwkCommandSafety(rest) === "read-only";
 }
 __name(evaluateAwkCommand, "evaluateAwkCommand");
 function evaluateGitRemoteArgs(args) {
+  const action = args.find((arg) => !arg.startsWith("-"))?.toLowerCase();
+  if (action && !["show", "get-url"].includes(action)) return false;
   for (const arg of args) {
-    if (BLOCKED_GIT_REMOTE_ACTIONS.has(arg.toLowerCase())) {
-      return false;
-    }
+    if (BLOCKED_GIT_REMOTE_ACTIONS.has(arg.toLowerCase())) return false;
   }
   return true;
 }
 __name(evaluateGitRemoteArgs, "evaluateGitRemoteArgs");
 function evaluateGitBranchArgs(args) {
-  for (const arg of args) {
-    if (BLOCKED_GIT_BRANCH_FLAGS.has(arg)) {
-      return false;
-    }
-  }
-  return true;
+  return args.length === 0 || args.length === 1 && args[0] === "--list";
 }
 __name(evaluateGitBranchArgs, "evaluateGitBranchArgs");
 function evaluateGitCommand(tokens) {
   let index = 1;
   while (index < tokens.length && tokens[index].startsWith("-")) {
-    const flag = tokens[index].toLowerCase();
-    if (flag === "--version" || flag === "--help") {
-      return true;
-    }
-    index++;
+    const flag = tokens[index++].toLowerCase();
+    if (flag === "--version") return true;
+    if (flag === "--help") return tokens.length === 2;
+    return false;
   }
   if (index >= tokens.length) {
     return true;
@@ -50039,12 +50273,20 @@ function evaluateGitCommand(tokens) {
     return false;
   }
   const args = tokens.slice(index + 1);
+  const end = args.indexOf("--");
+  const options2 = args.slice(0, end < 0 ? args.length : end);
+  if (options2.some((arg) => GIT_EXTERNAL_HELPER_OPTION.test(arg)) || subcommand === "grep" && options2.some((arg) => arg.startsWith("-O")))
+    return false;
+  if (options2.some((arg) => /^(?:--help|--version)$/i.test(arg))) return false;
   if (subcommand === "remote") {
     return evaluateGitRemoteArgs(args);
   }
   if (subcommand === "branch") {
     return evaluateGitBranchArgs(args);
   }
+  if (["blame", "diff", "log", "show"].includes(subcommand)) {
+    return !options2.some((arg) => /^--output(?:=|$)/.test(arg));
+  }
   return true;
 }
 __name(evaluateGitCommand, "evaluateGitCommand");
@@ -50059,6 +50301,7 @@ function evaluateShellSegment(segment) {
   if (!stripped) {
     return true;
   }
+  if (stripped !== segment.trim()) return false;
   if (detectCommandSubstitution(stripped)) {
     return false;
   }
@@ -50073,7 +50316,13 @@ function evaluateShellSegment(segment) {
   if (!root) {
     return true;
   }
+  if (root !== tokens[0]) return false;
   const normalizedRoot = root.toLowerCase();
+  if (root !== normalizedRoot) return false;
+  if (/^(awk|find|git|sed)$/.test(normalizedRoot) && args.some(
+    (arg) => !arg || arg.includes("\0") || hasShellBraceExpansion(arg)
+  ))
+    return false;
   if (!READ_ONLY_ROOT_COMMANDS.has(normalizedRoot)) {
     return false;
   }
@@ -50096,6 +50345,9 @@ function isShellCommandReadOnly(command) {
   if (typeof command !== "string" || !command.trim()) {
     return false;
   }
+  if (MALFORMED_CONTROL_OPERATOR.test(command)) return false;
+  if (/[({;&|]\s*[A-Za-z_][A-Za-z0-9_]*=/.test(command) || /^[A-Za-z_][A-Za-z0-9_]*=.*[;&|]/s.test(command))
+    return false;
   const segments = splitCommands(command);
   for (const segment of segments) {
     if (!evaluateShellSegment(segment)) {
@@ -53527,6 +53779,7 @@ var READ_ONLY_ROOT_COMMANDS2 = /* @__PURE__ */ new Set([
   "where",
   "whoami"
 ]);
+var WRITE_ROOT_COMMAND = /^(chgrp|chmod|chown|cp|install|ln|mkdir|mkfifo|mknod|mv|rename|rm|rmdir|shred|touch|truncate|unlink)$/;
 var READ_ONLY_GIT_SUBCOMMANDS2 = /* @__PURE__ */ new Set([
   "blame",
   "branch",
@@ -53541,50 +53794,17 @@ var READ_ONLY_GIT_SUBCOMMANDS2 = /* @__PURE__ */ new Set([
   "status",
   "describe"
 ]);
-var BLOCKED_GIT_REMOTE_ACTIONS2 = /* @__PURE__ */ new Set([
-  "add",
-  "remove",
-  "rename",
-  "set-url",
-  "prune",
-  "update"
-]);
-var BLOCKED_GIT_BRANCH_FLAGS2 = /* @__PURE__ */ new Set([
-  "-d",
-  "-D",
-  "--delete",
-  "--move",
-  "-m"
-]);
-var BLOCKED_FIND_FLAGS2 = /* @__PURE__ */ new Set([
-  "-delete",
-  "-exec",
-  "-execdir",
-  "-ok",
-  "-okdir"
-]);
-var BLOCKED_FIND_PREFIXES2 = ["-fprint", "-fprintf"];
-var BLOCKED_SED_PREFIXES2 = ["-i"];
-var AWK_SIDE_EFFECT_PATTERNS2 = [
-  /system\s*\(/,
-  /print\s+[^>|]*>\s*"[^"]*"/,
-  /printf\s+[^>|]*>\s*"[^"]*"/,
-  /print\s+[^>|]*>>\s*"[^"]*"/,
-  /printf\s+[^>|]*>>\s*"[^"]*"/,
-  /print\s+[^|]*\|\s*"[^"]*"/,
-  /printf\s+[^|]*\|\s*"[^"]*"/,
-  /getline\s*<\s*"[^"]*"/,
-  /"[^"]*"\s*\|\s*getline/,
-  /close\s*\(/
-];
-var SED_SIDE_EFFECT_PATTERNS2 = [
-  /[^\\]e\s/,
-  /^e\s/,
-  /[^\\]w\s/,
-  /^w\s/,
-  /[^\\]r\s/,
-  /^r\s/
-];
+var WRITE_GIT_SUBCOMMAND = /^(add|am|checkout|cherry-pick|clean|clone|commit|fetch|gc|init|merge|mv|pull|push|rebase|reset|restore|revert|rm|stash|switch)$/;
+var WRITE_GIT_REMOTE_ACTION = /^(add|remove|rm|rename|set-branches|set-head|set-url|update)$/;
+var GIT_EXTERNAL_HELPER_OPTION2 = /^--(?:ext-diff|filters|show-signature|textconv|open-files-in-pager)(?:=|$)/;
+var GIT_COMMIT_VALUE_OPTION = /^(?:-[CcFmt]|--(?:author|cleanup|date|file|fixup|message|pathspec-from-file|reedit-message|reuse-message|squash|template|trailer))$/;
+var WRITE_GIT_BRANCH_FLAG = /^(?:-[cCdDmMu](?:.|$)|--(?:delete|move|copy|set-upstream(?:-to)?|unset-upstream|create-reflog|edit-description)(?:=|$))/;
+var GIT_BRANCH_LIST_FLAG = /^(?:-[alr]|--(?:all|list|remotes|show-current|contains|no-contains|merged|no-merged|points-at))(?:=|$)/;
+var BLOCKED_FIND_PREFIXES2 = ["-fls", "-fprint", "-fprintf"];
+var FIND_VALUE_PREDICATE = /^-(?:[ac]?newer|newer[a-z]{2}|[acm](?:min|time)|context|fstype|gid|group|i?(?:lname|name|path|regex)|inum|links|maxdepth|mindepth|path|perm|printf|regextype|samefile|size|type|uid|used|user|wholename|xtype)$/;
+var UNIQ_VALUE_OPTIONS = new Set(
+  "-f --skip-fields -s --skip-chars -w --check-chars".split(" ")
+);
 var WRITE_REDIRECT_OPERATORS = /* @__PURE__ */ new Set([">", ">>", "&>", "&>>", ">|"]);
 var KNOWN_SUBCOMMANDS = {
   git: /* @__PURE__ */ new Set([
@@ -53990,6 +54210,7 @@ var DOCKER_COMPOSE_SUBCOMMANDS = /* @__PURE__ */ new Set([
 ]);
 var parserInstance = null;
 var bashLanguage = null;
+var parserClass;
 var initPromise = null;
 var parserInitFailed = false;
 async function initParser() {
@@ -54006,16 +54227,24 @@ async function initParser() {
       "web-tree-sitter/tree-sitter.wasm"
     );
     await ParserClass.init({ wasmBinary: treeSitterWasm });
-    parserInstance = new ParserClass();
     const bashWasm = await loadWasmBinary(
       () => import("./tree-sitter-bash-VEJGF5XF.js"),
       "tree-sitter-wasms/out/tree-sitter-bash.wasm"
     );
     bashLanguage = await ParserClass.Language.load(bashWasm);
+    parserClass = ParserClass;
+    parserInstance = new ParserClass();
     parserInstance.setLanguage(bashLanguage);
   })().catch((err) => {
+    const failedParser = parserInstance;
+    parserInstance = null;
+    bashLanguage = null;
     parserInitFailed = true;
     initPromise = null;
+    try {
+      failedParser?.delete();
+    } catch {
+    }
     throw err;
   });
   return initPromise;
@@ -54023,16 +54252,43 @@ async function initParser() {
 __name(initParser, "initParser");
 async function parseShellCommand(command) {
   await initParser();
-  return parserInstance.parse(command);
+  const parser5 = parserInstance;
+  try {
+    return parser5.parse(command);
+  } catch (error) {
+    parserInstance = null;
+    let replacement = null;
+    try {
+      replacement = new parserClass();
+      replacement.setLanguage(bashLanguage);
+      parserInstance = replacement;
+    } catch {
+      try {
+        replacement?.delete();
+      } catch {
+      }
+      bashLanguage = null;
+      parserInitFailed = true;
+      initPromise = null;
+    } finally {
+      parser5.delete();
+    }
+    throw error;
+  }
 }
 __name(parseShellCommand, "parseShellCommand");
-function collectDescendants(node, types2) {
+var SHELL_EXPANSION_TYPES = new Set(
+  "simple_expansion expansion arithmetic_expansion".split(" ")
+);
+var CHILD_STATEMENT = /^(?:pipeline|list|subshell|compound_statement|negated_command)$/;
+function collectDescendants(node, types2, outermostOnly = false) {
   const result = [];
   const stack = [node];
   while (stack.length > 0) {
     const current = stack.pop();
     if (types2.has(current.type)) {
       result.push(current);
+      if (outermostOnly) continue;
     }
     for (let i2 = current.childCount - 1; i2 >= 0; i2--) {
       stack.push(current.child(i2));
@@ -54041,29 +54297,6 @@ function collectDescendants(node, types2) {
   return result;
 }
 __name(collectDescendants, "collectDescendants");
-function containsCommandSubstitutionAST(node) {
-  return collectDescendants(
-    node,
-    /* @__PURE__ */ new Set(["command_substitution", "process_substitution"])
-  ).length > 0;
-}
-__name(containsCommandSubstitutionAST, "containsCommandSubstitutionAST");
-function hasWriteRedirection(node) {
-  if (node.type !== "redirected_statement") return false;
-  for (let i2 = 0; i2 < node.childCount; i2++) {
-    const child = node.child(i2);
-    if (child.type === "file_redirect") {
-      for (let j3 = 0; j3 < child.childCount; j3++) {
-        const op = child.child(j3);
-        if (op.type === "file_descriptor") continue;
-        if (WRITE_REDIRECT_OPERATORS.has(op.type)) return true;
-        break;
-      }
-    }
-  }
-  return false;
-}
-__name(hasWriteRedirection, "hasWriteRedirection");
 function getCommandName(commandNode) {
   const nameNode = commandNode.childForFieldName("name");
   if (!nameNode) return null;
@@ -54090,136 +54323,319 @@ function stripOuterQuotes(text) {
   return text;
 }
 __name(stripOuterQuotes, "stripOuterQuotes");
-function evaluateCommandReadOnly(commandNode) {
-  const root = getCommandName(commandNode);
-  if (!root) return true;
-  const argNodes = getArgumentNodes(commandNode);
-  const argTexts = argNodes.map((n) => stripOuterQuotes(n.text));
-  if (!READ_ONLY_ROOT_COMMANDS2.has(root)) return false;
-  if (root === "git") return evaluateGitReadOnly(argTexts);
-  if (root === "find") return evaluateFindReadOnly(argTexts);
-  if (root === "sed") return evaluateSedReadOnly(argTexts);
-  if (root === "awk") return evaluateAwkReadOnly(argTexts);
-  return true;
-}
-__name(evaluateCommandReadOnly, "evaluateCommandReadOnly");
-function evaluateGitReadOnly(args) {
-  let idx = 0;
-  while (idx < args.length && args[idx].startsWith("-")) {
-    const flag = args[idx].toLowerCase();
-    if (flag === "--version" || flag === "--help") return true;
-    idx++;
-  }
-  if (idx >= args.length) return true;
-  const subcommand = args[idx].toLowerCase();
-  if (!READ_ONLY_GIT_SUBCOMMANDS2.has(subcommand)) return false;
-  const rest = args.slice(idx + 1);
-  if (subcommand === "remote") {
-    return !rest.some((a) => BLOCKED_GIT_REMOTE_ACTIONS2.has(a.toLowerCase()));
-  }
-  if (subcommand === "branch") {
-    return !rest.some((a) => BLOCKED_GIT_BRANCH_FLAGS2.has(a));
-  }
-  return true;
+function hasShellExpansion(node) {
+  return collectDescendants(node, SHELL_EXPANSION_TYPES).length > 0 || ["word", "concatenation"].includes(node.type) && hasShellPatternExpansion(node.text);
+}
+__name(hasShellExpansion, "hasShellExpansion");
+function mergeSafety(...results) {
+  if (results.includes("write")) return "write";
+  if (results.includes("unknown")) return "unknown";
+  return "read-only";
+}
+__name(mergeSafety, "mergeSafety");
+function beforeTerminator(args) {
+  const end = args.indexOf("--");
+  return args.slice(0, end < 0 ? args.length : end);
+}
+__name(beforeTerminator, "beforeTerminator");
+function hasHelp(args, valueOptions = []) {
+  return beforeTerminator(args).some(
+    (arg, index, options2) => /^(?:--help|--version)$/i.test(arg) && !valueOptions.includes(options2[index - 1])
+  );
 }
-__name(evaluateGitReadOnly, "evaluateGitReadOnly");
-function evaluateFindReadOnly(args) {
-  for (const arg of args) {
-    const lower = arg.toLowerCase();
-    if (BLOCKED_FIND_FLAGS2.has(lower)) return false;
-    if (BLOCKED_FIND_PREFIXES2.some((p3) => lower.startsWith(p3))) return false;
+__name(hasHelp, "hasHelp");
+function withoutOptionValues(args, valueOption) {
+  const result = [];
+  for (let i2 = 0; i2 < args.length; i2++) {
+    result.push(args[i2]);
+    if (valueOption.test(args[i2])) i2++;
   }
-  return true;
+  return result;
 }
-__name(evaluateFindReadOnly, "evaluateFindReadOnly");
-function evaluateSedReadOnly(args) {
-  for (const arg of args) {
-    if (BLOCKED_SED_PREFIXES2.some((p3) => arg.startsWith(p3)) || arg === "--in-place") {
-      return false;
+__name(withoutOptionValues, "withoutOptionValues");
+function evaluateOutputOption(args, long = true, short = true) {
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg === "--") break;
+    if (short && arg === "-o" || long && arg === "--output") {
+      return args[i2 + 1] ? "write" : "unknown";
+    }
+    if (short && arg.startsWith("-o") && arg.length > 2) return "write";
+    if (long && arg.startsWith("--output=")) {
+      return arg.length > 9 ? "write" : "unknown";
     }
   }
-  const scriptContent = args.join(" ");
-  return !SED_SIDE_EFFECT_PATTERNS2.some((p3) => p3.test(scriptContent));
-}
-__name(evaluateSedReadOnly, "evaluateSedReadOnly");
-function evaluateAwkReadOnly(args) {
-  const scriptContent = args.join(" ");
-  return !AWK_SIDE_EFFECT_PATTERNS2.some((p3) => p3.test(scriptContent));
+  return null;
 }
-__name(evaluateAwkReadOnly, "evaluateAwkReadOnly");
-function evaluateStatementReadOnly(node) {
-  if (containsCommandSubstitutionAST(node)) return false;
-  switch (node.type) {
-    case "command":
-      return evaluateCommandReadOnly(node);
-    case "pipeline": {
-      for (const child of node.namedChildren) {
-        if (!evaluateStatementReadOnly(child)) return false;
-      }
-      return true;
-    }
-    case "list": {
-      for (const child of node.namedChildren) {
-        if (!evaluateStatementReadOnly(child)) return false;
-      }
-      return true;
+__name(evaluateOutputOption, "evaluateOutputOption");
+function evaluateGitSafety(args) {
+  const first2 = args[0];
+  if (!first2 || first2 === "--version") return "read-only";
+  if (first2 === "--help") return args.length === 1 ? "read-only" : "unknown";
+  if (first2.startsWith("-")) return "unknown";
+  const subcommand = first2.toLowerCase();
+  const rest = args.slice(1);
+  const options2 = beforeTerminator(rest);
+  const invokesHelper = options2.some((arg) => GIT_EXTERNAL_HELPER_OPTION2.test(arg)) || subcommand === "grep" && options2.some((arg) => arg.startsWith("-O")) || ["log", "show"].includes(subcommand) && options2.some((arg) => /%G[?GKFPST]/.test(arg));
+  if (WRITE_GIT_SUBCOMMAND.test(subcommand)) {
+    const effectiveArgs = subcommand === "commit" ? withoutOptionValues(rest, GIT_COMMIT_VALUE_OPTION) : rest;
+    const effectiveOptions = beforeTerminator(effectiveArgs);
+    const help = hasHelp(effectiveArgs);
+    const dryRun = effectiveOptions.includes("--dry-run") || effectiveOptions.includes("-n") && ["add", "clean", "mv", "push", "rm"].includes(subcommand);
+    return help || dryRun ? "unknown" : "write";
+  }
+  if (!READ_ONLY_GIT_SUBCOMMANDS2.has(subcommand)) return "unknown";
+  if (["diff", "log", "show"].includes(subcommand)) {
+    const output = evaluateOutputOption(rest, true, false);
+    if (output) return output;
+  }
+  if (subcommand === "blame" && beforeTerminator(rest).some((arg) => /^--output(?:=|$)/.test(arg)))
+    return "unknown";
+  if (subcommand !== "branch" && hasHelp(rest)) return "unknown";
+  if (subcommand === "remote") {
+    const action = rest.find((arg) => !arg.startsWith("-"))?.toLowerCase();
+    if (!action) return invokesHelper ? "unknown" : "read-only";
+    if (["show", "get-url"].includes(action))
+      return rest.some(
+        (arg) => /^(?:add|remove|rm|rename|set-branches|set-head|set-url|update|prune)$/i.test(
+          arg
+        )
+      ) || invokesHelper ? "unknown" : "read-only";
+    if (WRITE_GIT_REMOTE_ACTION.test(action)) return "write";
+    if (action === "prune")
+      return rest.some((arg) => ["-n", "--dry-run"].includes(arg)) ? "unknown" : "write";
+    return "unknown";
+  }
+  if (subcommand === "branch") {
+    const actions = withoutOptionValues(rest, /^--(?:format|sort)$/);
+    const actionOptions = beforeTerminator(actions);
+    if (hasHelp(actions)) return "unknown";
+    if (actions.some((arg) => WRITE_GIT_BRANCH_FLAG.test(arg)))
+      return actionOptions.some((arg) => WRITE_GIT_BRANCH_FLAG.test(arg)) ? "write" : "unknown";
+    if (actions.length !== rest.length) return "unknown";
+    const lists = actionOptions.some((arg) => GIT_BRANCH_LIST_FLAG.test(arg));
+    if (lists) return "read-only";
+    if (rest.some((arg) => !arg.startsWith("-"))) return "write";
+    if (rest.includes("--")) return "unknown";
+    if (invokesHelper) return "unknown";
+    return rest.length === 0 ? "read-only" : "unknown";
+  }
+  if (invokesHelper) return "unknown";
+  return "read-only";
+}
+__name(evaluateGitSafety, "evaluateGitSafety");
+function evaluateFindSafety(args) {
+  let result = "read-only";
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const lower = args[i2].toLowerCase();
+    if (lower === "--") return mergeSafety(result, "unknown");
+    if (/^--(?:help|version)$/.test(lower)) return "unknown";
+    if (FIND_VALUE_PREDICATE.test(lower)) {
+      if (!args[++i2]?.match(/^[^-]/)) result = mergeSafety(result, "unknown");
+      continue;
     }
-    case "redirected_statement": {
-      if (hasWriteRedirection(node)) return false;
-      const body = node.namedChildren[0];
-      return body ? evaluateStatementReadOnly(body) : true;
+    if (lower === "-delete") {
+      result = "write";
+      continue;
     }
-    case "subshell": {
-      for (const child of node.namedChildren) {
-        if (!evaluateStatementReadOnly(child)) return false;
-      }
-      return true;
+    if (BLOCKED_FIND_PREFIXES2.some((prefix) => lower.startsWith(prefix))) {
+      result = "write";
+      i2 += lower.startsWith("-fprintf") ? 2 : 1;
+      continue;
     }
-    case "compound_statement": {
-      for (const child of node.namedChildren) {
-        if (!evaluateStatementReadOnly(child)) return false;
+    if (["-exec", "-execdir", "-ok", "-okdir"].includes(lower)) {
+      const invoked = args[i2 + 1]?.toLowerCase();
+      let end = -1;
+      for (let index = i2 + 2; index < args.length; index++) {
+        if ([";", "\\;", "+"].includes(args[index])) {
+          end = index;
+          break;
+        }
       }
-      return true;
+      const invokedArgs = args.slice(i2 + 2, end < 0 ? void 0 : end);
+      let nested = "unknown";
+      if (invoked && WRITE_ROOT_COMMAND.test(invoked))
+        nested = hasHelp(invokedArgs) ? "unknown" : "write";
+      else if (invoked && /^(kill|killall|pkill)$/.test(invoked))
+        nested = processSafety(invoked, invokedArgs);
+      result = mergeSafety(result, nested);
+      i2 = end < 0 ? args.length : end;
     }
-    case "variable_assignment":
-    case "variable_assignments":
-      return true;
-    case "negated_command": {
-      const inner = node.namedChildren[0];
-      return inner ? evaluateStatementReadOnly(inner) : true;
+  }
+  return result;
+}
+__name(evaluateFindSafety, "evaluateFindSafety");
+function evaluateSedSafety(args) {
+  return classifySedCommandSafety(args);
+}
+__name(evaluateSedSafety, "evaluateSedSafety");
+function evaluateAwkSafety(args) {
+  return classifyAwkCommandSafety(args);
+}
+__name(evaluateAwkSafety, "evaluateAwkSafety");
+function evaluateUniqSafety(args) {
+  let positional = 0;
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    if (arg === "--") {
+      return args.length - i2 + positional > 2 ? "write" : "read-only";
+    } else if (UNIQ_VALUE_OPTIONS.has(arg)) {
+      if (!args[++i2]) return "unknown";
+    } else if (arg === "-" || !arg.startsWith("-")) positional++;
+  }
+  return positional >= 2 ? "write" : "read-only";
+}
+__name(evaluateUniqSafety, "evaluateUniqSafety");
+function processSafety(root, args) {
+  const options2 = beforeTerminator(args);
+  const signalZero = /^(?:SIG)?0+$/i;
+  const signalValueOptions = [
+    "--signal",
+    ...root === "pkill" ? [] : ["-s"],
+    ...root === "kill" ? ["-n"] : []
+  ];
+  if (args.length === 0 || hasHelp(args) || options2.some((arg) => ["-h", "-V", "-help", "-version"].includes(arg)))
+    return "unknown";
+  if (options2.some(
+    (arg, index) => /[$`*?()[\]{}]/.test(arg) && (arg.startsWith("-") || signalValueOptions.includes(options2[index - 1])) || /^-(?:[lL0]|-(?:.*list|table)(?:=|$))/.test(arg) || /^--signal=/.test(arg) && signalZero.test(arg.slice(9)) || /^-(?:SIG)?0+$/i.test(arg) || root === "kill" && /^-[sn](?:SIG)?0+$/i.test(arg) || root === "killall" && /^-s(?:SIG)?0+$/i.test(arg) || index > 0 && signalValueOptions.includes(options2[index - 1]) && signalZero.test(arg)
+  ))
+    return "unknown";
+  return "write";
+}
+__name(processSafety, "processSafety");
+function evaluateSubstitutions(node) {
+  const substitutions = collectDescendants(
+    node,
+    /* @__PURE__ */ new Set(["command_substitution", "process_substitution"]),
+    true
+  );
+  if (substitutions.length === 0) return "read-only";
+  return mergeSafety(
+    "unknown",
+    ...substitutions.flatMap((substitution) => substitution.namedChildren).map(evaluateStatementSafety)
+  );
+}
+__name(evaluateSubstitutions, "evaluateSubstitutions");
+function evaluateCommandSafety(commandNode) {
+  const rawRoot = commandNode.childForFieldName("name")?.text;
+  const root = getCommandName(commandNode);
+  const argNodes = getArgumentNodes(commandNode);
+  const args = argNodes.map((node) => stripOuterQuotes(node.text));
+  let result;
+  if (!root) result = "read-only";
+  else if (rawRoot !== root) result = "unknown";
+  else if (WRITE_ROOT_COMMAND.test(root)) {
+    result = hasHelp(args) ? "unknown" : "write";
+  } else if (/^(kill|killall|pkill)$/.test(root)) {
+    result = processSafety(root, args);
+  } else if (root === "git") result = evaluateGitSafety(args);
+  else if (root === "find") result = evaluateFindSafety(args);
+  else if (root === "sed") result = evaluateSedSafety(args);
+  else if (root === "awk") result = evaluateAwkSafety(args);
+  else if (root === "sort" || root === "tree") {
+    result = evaluateOutputOption(args, root === "sort") ?? "read-only";
+    if (hasHelp(args, ["-o", "--output"])) result = "unknown";
+    if (beforeTerminator(args).some(
+      (arg) => /^(?:--o|-[^-]+o)/.test(arg) || root === "sort" && arg.startsWith("--co")
+    )) {
+      result = mergeSafety(result, "unknown");
+    }
+  } else if (root === "uniq") {
+    result = hasHelp(args) ? "unknown" : evaluateUniqSafety(args);
+  } else if (root === "tee") {
+    const writesFile = args.some(
+      (arg, index) => !arg.startsWith("-") || args[index - 1] === "--"
+    );
+    result = writesFile ? "write" : "unknown";
+  } else if (root === "dd") {
+    result = args.some((arg) => arg.startsWith("of=")) ? "write" : "unknown";
+  } else if (root === "printf" && beforeTerminator(args).some((arg) => /^-[^-]*v/.test(arg)) || ["less", "more"].includes(root) || ["rg", "ripgrep"].includes(root) && beforeTerminator(args).some(
+    (arg) => /^(?:--(?:hostname-bin|pre)(?:=|$)|--search-zip$|-[^-]*z)/.test(arg)
+  )) {
+    result = "unknown";
+  } else {
+    result = READ_ONLY_ROOT_COMMANDS2.has(root) ? "read-only" : "unknown";
+  }
+  if (result === "read-only" && root && /^(awk|find|git|printf|rg|ripgrep|sed|sort|tree|uniq)$/.test(root) && argNodes.some((node) => hasShellExpansion(node))) {
+    result = "unknown";
+  }
+  if (result === "write" && !["find", "git", "sed", "sort", "tree"].includes(root ?? "") && hasHelp(args))
+    result = "unknown";
+  const hasEnvironment = commandNode.namedChildren.some(
+    (child) => child.type === "variable_assignment"
+  );
+  if (root && hasEnvironment) result = mergeSafety(result, "unknown");
+  return mergeSafety(
+    result,
+    evaluateRedirectionSafety(commandNode),
+    ...commandNode.namedChildren.filter((child) => !child.type.endsWith("_redirect")).map(evaluateSubstitutions)
+  );
+}
+__name(evaluateCommandSafety, "evaluateCommandSafety");
+function evaluateRedirectionSafety(node) {
+  let result = "read-only";
+  for (const redirect of node.namedChildren) {
+    if (!redirect.type.endsWith("_redirect")) continue;
+    result = mergeSafety(result, evaluateSubstitutions(redirect));
+    if (redirect.type !== "file_redirect") continue;
+    const operator = redirect.children.find(
+      (child) => child.type !== "file_descriptor"
+    );
+    if (!operator) return "unknown";
+    if (WRITE_REDIRECT_OPERATORS.has(operator.type)) return "write";
+    if (operator.type === ">&") {
+      const destination = redirect.childForFieldName("destination");
+      if (!destination) return "unknown";
+      const target = stripOuterQuotes(destination.text);
+      if (/^(?:\d+|-)$/.test(target)) continue;
+      result = mergeSafety(
+        result,
+        /[$`*?()[\]{}]/.test(target) ? "unknown" : "write"
+      );
     }
-    case "function_definition":
-      return false;
-    case "if_statement":
-    case "while_statement":
-    case "for_statement":
-    case "case_statement":
-    case "c_style_for_statement":
-      return false;
-    case "declaration_command":
-      return false;
-    default:
-      return false;
   }
+  return result;
 }
-__name(evaluateStatementReadOnly, "evaluateStatementReadOnly");
+__name(evaluateRedirectionSafety, "evaluateRedirectionSafety");
+function childrenSafety(node, floor = "read-only") {
+  return mergeSafety(floor, ...node.namedChildren.map(evaluateStatementSafety));
+}
+__name(childrenSafety, "childrenSafety");
+function evaluateStatementSafety(node) {
+  if (node.type === "command") return evaluateCommandSafety(node);
+  if (CHILD_STATEMENT.test(node.type)) return childrenSafety(node);
+  if (node.type === "redirected_statement")
+    return mergeSafety(
+      ...node.namedChildren.filter((child) => !child.type.endsWith("_redirect")).map((child) => evaluateStatementSafety(child)),
+      evaluateRedirectionSafety(node)
+    );
+  if (/^variable_assignments?$/.test(node.type))
+    return mergeSafety(
+      node.parent?.namedChildCount === 1 ? "read-only" : "unknown",
+      evaluateSubstitutions(node)
+    );
+  if (node.type === "function_definition") return "unknown";
+  return childrenSafety(node, "unknown");
+}
+__name(evaluateStatementSafety, "evaluateStatementSafety");
+async function classifyInternal(command) {
+  const tree = await parseShellCommand(command);
+  try {
+    const root = tree.rootNode;
+    if (root.namedChildCount === 0 || root.hasError) return "unknown";
+    return mergeSafety(...root.namedChildren.map(evaluateStatementSafety));
+  } finally {
+    tree.delete();
+  }
+}
+__name(classifyInternal, "classifyInternal");
 async function isShellCommandReadOnlyAST(command) {
   if (typeof command !== "string" || !command.trim()) return false;
   if (parserInitFailed) {
     return isShellCommandReadOnly(command);
   }
   try {
-    const tree = await parseShellCommand(command);
-    const root = tree.rootNode;
-    if (root.namedChildCount === 0) return false;
-    for (const stmt of root.namedChildren) {
-      if (!evaluateStatementReadOnly(stmt)) {
-        tree.delete();
-        return false;
-      }
-    }
-    tree.delete();
-    return true;
+    return await classifyInternal(command) === "read-only";
   } catch {
     return isShellCommandReadOnly(command);
   }
@@ -138286,7 +138702,7 @@ function isToolCallConcurrencySafe(name, kind, args) {
     const command = args?.command;
     if (typeof command !== "string") return false;
     try {
-      return isShellCommandReadOnly(stripShellWrapper(command));
+      return isShellCommandReadOnly(command);
     } catch {
       return false;
     }
@@ -154801,19 +155217,19 @@ var Config = class {
     }, "registerStructuredOutputIfRequested");
     if (this.getBareMode()) {
       await registerLazy(ToolNames.READ_FILE, async () => {
-        const { ReadFileTool } = await import("./read-file-VLEAEXFP.js");
+        const { ReadFileTool } = await import("./read-file-VSKOE22I.js");
         return new ReadFileTool(this);
       });
       await registerLazy(ToolNames.EDIT, async () => {
-        const { EditTool } = await import("./edit-JN467GIR.js");
+        const { EditTool } = await import("./edit-GORZTX2U.js");
         return new EditTool(this);
       });
       await registerLazy(ToolNames.NOTEBOOK_EDIT, async () => {
-        const { NotebookEditTool } = await import("./notebook-edit-IHGW42QK.js");
+        const { NotebookEditTool } = await import("./notebook-edit-IBEOVZ6A.js");
         return new NotebookEditTool(this);
       });
       await registerLazy(ToolNames.SHELL, async () => {
-        const { ShellTool: ShellTool2 } = await import("./shell-KR3IMYH6.js");
+        const { ShellTool: ShellTool2 } = await import("./shell-2NGEMAVM.js");
         return new ShellTool2(this);
       });
       await registerStructuredOutputIfRequested();
@@ -154823,7 +155239,7 @@ var Config = class {
       return registry;
     }
     await registerLazy(ToolNames.TOOL_SEARCH, async () => {
-      const { ToolSearchTool } = await import("./tool-search-LSSKWZKH.js");
+      const { ToolSearchTool } = await import("./tool-search-5IE2VO7X.js");
       return new ToolSearchTool(this);
     });
     await registerLazy(ToolNames.READ_MCP_RESOURCE, async () => {
@@ -154831,7 +155247,7 @@ var Config = class {
       return new ReadMcpResourceTool(this);
     });
     await registerLazy(ToolNames.AGENT, async () => {
-      const { AgentTool: AgentTool2 } = await import("./agent-BONWC4VY.js");
+      const { AgentTool: AgentTool2 } = await import("./agent-CKSI7BTR.js");
       return new AgentTool2(this);
     });
     await registerLazy(ToolNames.TASK_STOP, async () => {
@@ -154843,7 +155259,7 @@ var Config = class {
       return new SendMessageTool(this);
     });
     await registerLazy(ToolNames.SKILL, async () => {
-      const { SkillTool } = await import("./skill-QLM2LSF7.js");
+      const { SkillTool } = await import("./skill-3U2T6H3E.js");
       return new SkillTool(this);
     });
     await registerLazy(ToolNames.LS, async () => {
@@ -154851,7 +155267,7 @@ var Config = class {
       return new LSTool(this);
     });
     await registerLazy(ToolNames.READ_FILE, async () => {
-      const { ReadFileTool } = await import("./read-file-VLEAEXFP.js");
+      const { ReadFileTool } = await import("./read-file-VSKOE22I.js");
       return new ReadFileTool(this);
     });
     if (this.getUseRipgrep()) {
@@ -154866,7 +155282,7 @@ var Config = class {
       recordStartupEvent("config_initialize_ripgrep_probe_end");
       if (useRipgrep) {
         await registerLazy(ToolNames.GREP, async () => {
-          const { RipGrepTool: RipGrepTool2 } = await import("./ripGrep-MT23EIDD.js");
+          const { RipGrepTool: RipGrepTool2 } = await import("./ripGrep-5V5FLW2A.js");
           return new RipGrepTool2(this);
         });
       } else {
@@ -154879,7 +155295,7 @@ var Config = class {
           )
         );
         await registerLazy(ToolNames.GREP, async () => {
-          const { GrepTool } = await import("./grep-MOGRCYB4.js");
+          const { GrepTool } = await import("./grep-HZLSTX7D.js");
           return new GrepTool(this);
         });
       }
@@ -154887,28 +155303,28 @@ var Config = class {
       recordStartupEvent("config_initialize_ripgrep_probe_start");
       recordStartupEvent("config_initialize_ripgrep_probe_end");
       await registerLazy(ToolNames.GREP, async () => {
-        const { GrepTool } = await import("./grep-MOGRCYB4.js");
+        const { GrepTool } = await import("./grep-HZLSTX7D.js");
         return new GrepTool(this);
       });
     }
     await registerLazy(ToolNames.GLOB, async () => {
-      const { GlobTool } = await import("./glob-FPKAMR6B.js");
+      const { GlobTool } = await import("./glob-GOAPGD6G.js");
       return new GlobTool(this);
     });
     await registerLazy(ToolNames.EDIT, async () => {
-      const { EditTool } = await import("./edit-JN467GIR.js");
+      const { EditTool } = await import("./edit-GORZTX2U.js");
       return new EditTool(this);
     });
     await registerLazy(ToolNames.NOTEBOOK_EDIT, async () => {
-      const { NotebookEditTool } = await import("./notebook-edit-IHGW42QK.js");
+      const { NotebookEditTool } = await import("./notebook-edit-IBEOVZ6A.js");
       return new NotebookEditTool(this);
     });
     await registerLazy(ToolNames.WRITE_FILE, async () => {
-      const { WriteFileTool } = await import("./write-file-E7T3PU3B.js");
+      const { WriteFileTool } = await import("./write-file-DR3HN7IH.js");
       return new WriteFileTool(this);
     });
     await registerLazy(ToolNames.SHELL, async () => {
-      const { ShellTool: ShellTool2 } = await import("./shell-KR3IMYH6.js");
+      const { ShellTool: ShellTool2 } = await import("./shell-2NGEMAVM.js");
       return new ShellTool2(this);
     });
     await registerLazy(ToolNames.TODO_WRITE, async () => {
@@ -154921,24 +155337,24 @@ var Config = class {
     });
     if (!this.sdkMode) {
       await registerLazy(ToolNames.EXIT_PLAN_MODE, async () => {
-        const { ExitPlanModeTool } = await import("./exitPlanMode-EIUETQI6.js");
+        const { ExitPlanModeTool } = await import("./exitPlanMode-U5Z6XBLO.js");
         return new ExitPlanModeTool(this);
       });
       await registerLazy(ToolNames.ENTER_PLAN_MODE, async () => {
-        const { EnterPlanModeTool } = await import("./enterPlanMode-BRZOG4DB.js");
+        const { EnterPlanModeTool } = await import("./enterPlanMode-LIIPP37T.js");
         return new EnterPlanModeTool(this);
       });
     }
     await registerLazy(ToolNames.ENTER_WORKTREE, async () => {
-      const { EnterWorktreeTool } = await import("./enter-worktree-MMO4VBQE.js");
+      const { EnterWorktreeTool } = await import("./enter-worktree-LJB2AW4L.js");
       return new EnterWorktreeTool(this);
     });
     await registerLazy(ToolNames.EXIT_WORKTREE, async () => {
-      const { ExitWorktreeTool } = await import("./exit-worktree-UD7PI5H5.js");
+      const { ExitWorktreeTool } = await import("./exit-worktree-IEP2WHOV.js");
       return new ExitWorktreeTool(this);
     });
     await registerLazy(ToolNames.WEB_FETCH, async () => {
-      const { WebFetchTool } = await import("./web-fetch-7QTEGJI5.js");
+      const { WebFetchTool } = await import("./web-fetch-ZDNE6FF2.js");
       return new WebFetchTool(this);
     });
     if (this.isArtifactEnabled()) {
@@ -154984,7 +155400,7 @@ var Config = class {
     });
     if (this.isAgentTeamEnabled()) {
       await registerLazy(ToolNames.TEAM_CREATE, async () => {
-        const { TeamCreateTool } = await import("./team-create-Q5B5M7UD.js");
+        const { TeamCreateTool } = await import("./team-create-R6AXDYPG.js");
         return new TeamCreateTool(this);
       });
       await registerLazy(ToolNames.TEAM_DELETE, async () => {
@@ -154992,7 +155408,7 @@ var Config = class {
         return new TeamDeleteTool(this);
       });
       await registerLazy(ToolNames.TEAM_PLAN_APPROVAL, async () => {
-        const { TeamPlanApprovalTool } = await import("./team-plan-approval-J55PXNY2.js");
+        const { TeamPlanApprovalTool } = await import("./team-plan-approval-O2ZPPT64.js");
         return new TeamPlanApprovalTool(this);
       });
       await registerLazy(ToolNames.TASK_CREATE, async () => {
@@ -155010,16 +155426,16 @@ var Config = class {
     }
     if (this.isWorkflowsEnabled()) {
       await registerLazy(ToolNames.WORKFLOW, async () => {
-        const { WorkflowTool } = await import("./workflow-G3CZU256.js");
+        const { WorkflowTool } = await import("./workflow-G7U6OQWS.js");
         return new WorkflowTool(this);
       });
     }
     if (this.isComputerUseEnabled()) {
-      const { registerComputerUseTools } = await import("./computer-use-UY4A72X7.js");
+      const { registerComputerUseTools } = await import("./computer-use-4PUGCUQK.js");
       await registerComputerUseTools(registerLazy, this);
     }
     await registerLazy(ToolNames.MONITOR, async () => {
-      const { MonitorTool } = await import("./monitor-KY7YH7TL.js");
+      const { MonitorTool } = await import("./monitor-LMYKCF6R.js");
       return new MonitorTool(this);
     });
     if (this.pendingMcpBudgetCallback) {