@wrongstack/plugins 0.300.0 → 0.302.0

package/dist/path-guard.js

@@ -39,11 +39,15 @@ function compilePathGlob(pattern) {
   let source = "";
   for (let i = 0; i < normalized.length; i++) {
     const ch = normalized[i];
+    if (ch === "/" && normalized.slice(i) === "/**") {
+      source += "(?:/(?:[^/]+(?:/[^/]+)*)?)?";
+      break;
+    }
     if (ch === "*") {
       if (normalized[i + 1] === "*") {
-        source += "(?:.*)";
-        i += 1;
-        if (normalized[i + 1] === "/") i += 1;
+        const followedBySlash = normalized[i + 2] === "/";
+        source += followedBySlash ? "(?:[^/]+/)*" : "(?:[^/]+(?:/[^/]+)*)?";
+        i += followedBySlash ? 2 : 1;
       } else {
         source += "[^/]*";
       }
@@ -58,31 +62,1185 @@ function compilePathGlob(pattern) {
   return new RegExp(`(?:^|/)${source}$`, "i");
 }
 function normalizePath(p) {
-  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+  const slashNormalized = p.replace(/\\/g, "/");
+  const drive = /^[a-z]:/i.exec(slashNormalized)?.[0] ?? "";
+  const absolute = slashNormalized.startsWith("/") || drive.length > 0;
+  const body = drive ? slashNormalized.slice(drive.length).replace(/^\//, "") : slashNormalized;
+  const segments = [];
+  for (const segment of body.split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") {
+      if (segments.length > 0 && segments.at(-1) !== "..") {
+        segments.pop();
+      } else if (!absolute) {
+        segments.push(segment);
+      }
+      continue;
+    }
+    segments.push(segment);
+  }
+  const joined = segments.join("/");
+  if (drive) return `${drive}/${joined}`.replace(/\/$/, "");
+  if (slashNormalized.startsWith("/")) return `/${joined}`.replace(/\/$/, "") || "/";
+  return joined;
+}
+function isAbsolutePath(path) {
+  return /^(?:\/|[a-z]:\/)/i.test(path);
+}
+function resolveTargetPath(path, base) {
+  const normalized = normalizePath(path);
+  const target = normalized === "" && /^\.\/?$/.test(path.trim()) ? "." : normalized;
+  return base && !isAbsolutePath(target) ? normalizePath(`${base}/${target}`) : target;
+}
+function relativeToInvocationCwd(path, invocationCwd) {
+  const normalizedPath = normalizePath(path).replace(/\/$/, "");
+  const normalized = normalizedPath === "" && /^\.\/?$/.test(path.trim()) ? "." : normalizedPath;
+  if (!invocationCwd || !isAbsolutePath(normalizePath(invocationCwd))) return normalized;
+  const root = normalizePath(invocationCwd).replace(/\/$/, "");
+  const pathForComparison = /^[a-z]:\//i.test(normalized) ? normalized.toLowerCase() : normalized;
+  const rootForComparison = /^[a-z]:\//i.test(root) ? root.toLowerCase() : root;
+  if (pathForComparison === rootForComparison) return ".";
+  if (pathForComparison.startsWith(`${rootForComparison}/`)) {
+    return normalized.slice(root.length + 1);
+  }
+  return normalized;
+}
+function effectiveToolCwd(toolInputCwd, invocationCwd) {
+  if (typeof toolInputCwd !== "string" || toolInputCwd.length === 0) return invocationCwd;
+  if (!invocationCwd || isAbsolutePath(normalizePath(toolInputCwd))) return toolInputCwd;
+  return resolveTargetPath(toolInputCwd, invocationCwd);
 }
 function matchesAny(path, patterns) {
   const normalized = normalizePath(path);
   return patterns.some((re) => re.test(normalized));
 }
+function isUnresolvedPathScope(path) {
+  return /[*?]/.test(path);
+}
+function isRootPathScope(path) {
+  const normalized = normalizePath(path).replace(/\/$/, "");
+  return normalized === "." || normalized === "";
+}
+function isDirectoryAmbiguousPath(path) {
+  const normalized = normalizePath(path).replace(/\/$/, "");
+  if (isRootPathScope(normalized)) return true;
+  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return path.endsWith("/") || basename.length > 0 && !basename.includes(".");
+}
+function hasConfiguredProtectedDescendant(path, patterns) {
+  const normalized = normalizePath(path).replace(/\/$/, "").toLowerCase();
+  if (!normalized || isUnresolvedPathScope(normalized)) return false;
+  return patterns.some((pattern) => {
+    const prefix = staticPrefix(normalizePath(pattern)).toLowerCase();
+    return prefix.startsWith(`${normalized}/`);
+  });
+}
+function staticPrefix(pattern) {
+  const normalized = normalizePath(pattern);
+  if (normalized === ".") return "";
+  const wildcardIndex = normalized.search(/[*?]/);
+  return (wildcardIndex === -1 ? normalized : normalized.slice(0, wildcardIndex)).replace(
+    /\/$/,
+    ""
+  );
+}
+function hasPartialSegmentWildcard(pattern) {
+  const normalized = normalizePath(pattern);
+  const wildcardIndex = normalized.search(/[*?]/);
+  return wildcardIndex > 0 && normalized[wildcardIndex - 1] !== "/";
+}
+function globWitness(pattern) {
+  return pattern.replace(/\*+/g, "").replace(/\?/g, "x");
+}
+function scopesMayOverlap(left, right) {
+  const normalizedRight = normalizePath(right);
+  if (!normalizedRight.includes("/")) {
+    const leftPrefix2 = staticPrefix(left);
+    const candidate = leftPrefix2 ? `${leftPrefix2}/${globWitness(normalizedRight)}` : globWitness(normalizedRight);
+    if (compilePathGlob(left).test(candidate)) return true;
+    return hasPartialSegmentWildcard(left);
+  }
+  const leftPrefix = staticPrefix(left).toLowerCase();
+  const rightPrefix = staticPrefix(right).toLowerCase();
+  if (!leftPrefix || !rightPrefix) return true;
+  if (leftPrefix === rightPrefix || leftPrefix.startsWith(`${rightPrefix}/`) || rightPrefix.startsWith(`${leftPrefix}/`)) {
+    return true;
+  }
+  return hasPartialSegmentWildcard(left) && rightPrefix.startsWith(leftPrefix) || hasPartialSegmentWildcard(right) && leftPrefix.startsWith(rightPrefix);
+}
+function targetIntersectsPatterns(target, patternTexts, patterns) {
+  if (matchesAny(target.path, patterns)) return true;
+  if (target.kind === "file") return false;
+  const normalized = normalizePath(target.path).replace(/\/$/, "");
+  if (!isUnresolvedPathScope(normalized)) {
+    if (normalized === "." || normalized === "") return patternTexts.length > 0;
+    const descendantScope = `${normalized}/**`;
+    return patternTexts.some(
+      (pattern) => scopesMayOverlap(descendantScope, normalizePath(pattern))
+    );
+  }
+  return patternTexts.some((pattern) => scopesMayOverlap(normalized, normalizePath(pattern)));
+}
+function targetFullyAllowed(target, allowTexts, allowRes) {
+  if (target.kind === "file") return matchesAny(target.path, allowRes);
+  const normalized = normalizePath(target.path).replace(/\/$/, "");
+  if (isUnresolvedPathScope(normalized)) {
+    return allowTexts.some((allow, index) => {
+      const allowNormalized = normalizePath(allow);
+      if (allowNormalized === normalized) return true;
+      const targetPrefix = staticPrefix(normalized);
+      const allowRe = allowRes[index];
+      return targetPrefix.length > 0 && !hasPartialSegmentWildcard(normalized) && allowNormalized.endsWith("/**") && allowRe?.test(targetPrefix);
+    });
+  }
+  return allowTexts.some((allow, index) => {
+    const allowNormalized = normalizePath(allow);
+    const allowRe = allowRes[index];
+    return allowNormalized.endsWith("/**") && allowRe?.test(`${normalized}/.path-guard-probe`);
+  });
+}
+var WRITE_CAPABILITIES = /* @__PURE__ */ new Set(["fs.write", "fs.write.outside-project"]);
+var DISK_MUTATING_CAPABILITIES = /* @__PURE__ */ new Set(["package.install"]);
+var SHELL_CAPABILITIES = /* @__PURE__ */ new Set(["shell.arbitrary", "shell.restricted", "shell.exec"]);
+var LEGACY_SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell", "exec"]);
+var LEGACY_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "write",
+  "edit",
+  "patch",
+  "scaffold",
+  "format",
+  "replace",
+  "design",
+  "install"
+]);
+function writesToDisk(input) {
+  const capabilities = input.toolCapabilities;
+  const capabilitiesUndeclared = !capabilities || capabilities.length === 0;
+  const hasWriteCap = capabilities?.some((capability) => WRITE_CAPABILITIES.has(capability)) ?? false;
+  const hasDiskMutatingCap = capabilities?.some((capability) => DISK_MUTATING_CAPABILITIES.has(capability)) ?? false;
+  const hasCommandString = typeof input.toolInput?.["command"] === "string";
+  if (hasCommandString && executesShell(input) && !hasWriteCap && !hasDiskMutatingCap && !(capabilitiesUndeclared && LEGACY_WRITE_TOOLS.has(input.toolName ?? "")))
+    return false;
+  if (!capabilitiesUndeclared) {
+    if (hasWriteCap || hasDiskMutatingCap) return true;
+    if (capabilities.includes("mcp.proxy")) {
+      const segmentedName = (input.toolName ?? "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9]+/gi, "_").toLowerCase();
+      const filesystemWriter = /(?:^|_)filesystem(?:_|$)/.test(segmentedName) && /(?:^|_)(?:add|append|copy|create|delete|edit|mkdir|move|remove|rename|write)(?:_|$)/.test(
+        segmentedName
+      );
+      const toolInput = input.toolInput ?? {};
+      const hasKnownPath = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some(
+        (field) => toolInput[field] !== void 0
+      );
+      if (filesystemWriter && hasKnownPath) return true;
+    }
+    return false;
+  }
+  if (input.toolMutating !== void 0) return input.toolMutating;
+  return LEGACY_WRITE_TOOLS.has(input.toolName ?? "");
+}
+function executesShell(input) {
+  const toolName = input.toolName ?? "";
+  if (LEGACY_SHELL_TOOLS.has(toolName)) return true;
+  if (toolName === "git") return false;
+  const segmentedName = toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+  const isCommandStringRunner = /(?:^|[_.-])(?:command|exec|execute|shell|terminal)(?:$|[_.-])/i.test(segmentedName);
+  const hasShellCapability = input.toolCapabilities?.some((capability) => SHELL_CAPABILITIES.has(capability)) ?? false;
+  const hasCommandString = typeof input.toolInput?.["command"] === "string";
+  return isCommandStringRunner && hasShellCapability || hasCommandString && input.toolMutating === true;
+}
+var PATH_FIELDS = [
+  "path",
+  "file_path",
+  "filePath",
+  "target",
+  "target_path",
+  "targetPath",
+  "destination",
+  "dest",
+  "output_path",
+  "outputPath",
+  "out",
+  "file"
+];
+var PATH_LIST_FIELDS = ["files", "paths"];
+var SOURCE_PATH_FIELDS = [
+  "source",
+  "from",
+  "src",
+  "input_path",
+  "inputPath",
+  "old_path",
+  "oldPath"
+];
+var MOVE_TOOL_NAME = /(?:^|[_.-])(move|rename)(?:$|[_.-])/i;
+var DIRECTORY_DELETE_TOOL_NAME = /(?:^|[_.-])(?:rmdir|(?:delete|remove)[_.-](?:dir|directory))(?:$|[_.-])/i;
+function segmentedToolName(toolName) {
+  return toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+}
+function isMoveToolName(toolName) {
+  return MOVE_TOOL_NAME.test(segmentedToolName(toolName));
+}
+function isDirectoryDeleteToolName(toolName) {
+  return DIRECTORY_DELETE_TOOL_NAME.test(segmentedToolName(toolName));
+}
+function cleanPatchPath(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed === "/dev/null") return null;
+  const quoted = /^"([^"]+)"(?:\s|$)/.exec(trimmed)?.[1];
+  const withoutTimestamp = quoted ?? trimmed.replace(/(?:\t|\s+)\d{4}-\d{2}-\d{2}(?:\s.*)?$/, "").trim();
+  if (!withoutTimestamp || withoutTimestamp === "/dev/null") return null;
+  return withoutTimestamp.replace(/^[ab]\//, "");
+}
+function pathsFromPatch(patch) {
+  const paths = [];
+  const lines = patch.split(/\r?\n/);
+  for (let index = 0; index + 2 < lines.length; index += 1) {
+    const oldHeader = lines[index];
+    const newHeader = lines[index + 1];
+    const hunkHeader = lines[index + 2];
+    if (!oldHeader?.startsWith("--- ") || !newHeader?.startsWith("+++ ")) continue;
+    if (!hunkHeader?.startsWith("@@ ")) continue;
+    const oldPath = cleanPatchPath(oldHeader.slice(4));
+    const newPath = cleanPatchPath(newHeader.slice(4));
+    if (oldPath) paths.push(oldPath);
+    if (newPath) paths.push(newPath);
+  }
+  return paths;
+}
+function appendTarget(targets, value, kind, base) {
+  if (typeof value !== "string" || value.length === 0) return;
+  targets.push({
+    path: resolveTargetPath(value, base),
+    kind
+  });
+}
+function appendTargetList(targets, value, directoryCapable, base) {
+  const appendPath = (path) => {
+    targets.push({
+      path: resolveTargetPath(path, base),
+      kind: isUnresolvedPathScope(path) || isRootPathScope(path) || directoryCapable && isDirectoryAmbiguousPath(path) ? "scope" : "file"
+    });
+  };
+  if (typeof value === "string") {
+    const paths = value.split(",").map((item) => item.trim()).filter((path) => path.length > 0);
+    for (const path of paths) appendPath(path);
+    return;
+  }
+  if (!Array.isArray(value)) return;
+  for (const item of value) {
+    if (typeof item !== "string") continue;
+    const path = item.trim();
+    if (path.length > 0) appendPath(path);
+  }
+}
+function isReadOnlyInvocation(toolName, toolInput) {
+  if (toolName === "git") {
+    const command = toolInput["command"];
+    if (command === "status" || command === "log" || command === "diff" || command === "fetch" || command === "commit" || command === "branch" || command === "push") {
+      return true;
+    }
+    return command === "worktree" && toolInput["worktreeAction"] === "list";
+  }
+  if (toolName === "design") {
+    const action = toolInput["action"] ?? "list";
+    return action === "list" || action === "foundations" || action === "verify";
+  }
+  if (toolName === "format") return toolInput["check"] === true;
+  if (toolName === "patch" || toolName === "scaffold") return toolInput["dry_run"] === true;
+  if (toolName === "replace") return toolInput["dry_run"] !== false;
+  return false;
+}
+function pathsFromToolInput(toolInput, toolName, invocationCwd) {
+  const targets = [];
+  const effectiveCwd = effectiveToolCwd(toolInput["cwd"], invocationCwd);
+  const directoryDelete = isDirectoryDeleteToolName(toolName);
+  for (const field of PATH_FIELDS) {
+    const value = toolInput[field];
+    appendTarget(
+      targets,
+      value,
+      directoryDelete ? "deletion-scope" : typeof value === "string" && isUnresolvedPathScope(value) ? "scope" : "file",
+      effectiveCwd
+    );
+  }
+  const directoryCapableLists = toolName === "format" || toolName === "replace";
+  for (const field of PATH_LIST_FIELDS) {
+    appendTargetList(
+      targets,
+      toolInput[field],
+      directoryCapableLists && field === "files",
+      effectiveCwd
+    );
+  }
+  if (toolName === "install") {
+    appendTarget(targets, effectiveCwd ?? invocationCwd ?? ".", "scope");
+  }
+  if (toolName === "git") {
+    const command = toolInput["command"];
+    if (command === "worktree" && (toolInput["worktreeAction"] === "add" || toolInput["worktreeAction"] === "remove")) {
+      appendTarget(targets, toolInput["worktreePath"] ?? toolInput["worktree_path"], "file");
+    }
+  }
+  if (toolName === "scaffold") {
+    const cwdValue = toolInput["cwd"];
+    const cwd = typeof cwdValue === "string" && cwdValue.length > 0 ? cwdValue : invocationCwd ?? ".";
+    const base = normalizePath(cwd).replace(/\/$/, "");
+    const name = typeof toolInput["name"] === "string" ? toolInput["name"] : "";
+    const template = toolInput["template"];
+    const filesByTemplate = {
+      "npm-package": ["package.json", "tsconfig.json", "src/index.ts", "src/index.test.ts"],
+      "cli-tool": ["package.json", "src/index.ts"],
+      "react-component": name ? [`${name}.tsx`, `${name}.test.tsx`] : []
+    };
+    for (const file of typeof template === "string" ? filesByTemplate[template] ?? [] : []) {
+      targets.push({ path: `${base}/${file}`, kind: "file" });
+    }
+    targets.push({ path: base, kind: "scope" });
+  }
+  if (isMoveToolName(toolName)) {
+    for (const field of SOURCE_PATH_FIELDS) {
+      appendTarget(targets, toolInput[field], "deletion-scope", effectiveCwd);
+    }
+  }
+  const patch = toolInput["patch"];
+  if (typeof patch === "string") {
+    const patchTargets = pathsFromPatch(patch);
+    const directory = toolInput["directory"];
+    const baseValue = typeof directory === "string" && directory.length > 0 ? directory : invocationCwd;
+    if (baseValue) {
+      const base = normalizePath(baseValue).replace(/\/$/, "");
+      targets.push(
+        ...patchTargets.map((target) => ({ path: `${base}/${target}`, kind: "file" }))
+      );
+    } else {
+      targets.push(...patchTargets.map((path) => ({ path, kind: "file" })));
+    }
+  }
+  if (targets.length === 0) {
+    const cwd = effectiveCwd ?? ".";
+    targets.push({ path: normalizePath(cwd).replace(/\/$/, "") || ".", kind: "scope" });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return targets.map((target) => ({
+    ...target,
+    path: relativeToInvocationCwd(target.path, invocationCwd)
+  })).filter((target) => {
+    const key = `${target.kind}:${target.path}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function operationLabel(toolName) {
+  if (toolName === "write") return "write";
+  if (toolName === "edit") return "edit";
+  return `write via "${toolName}"`;
+}
+var VALUE_TAKING_GIT_OPTIONS = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--super-prefix",
+  "--exec-path",
+  "--config-env",
+  "--attr-source"
+]);
+var MAX_LAUNCHER_TOKENS = 256;
+var MAX_LAUNCHER_LENGTH = 64 * 1024;
+function boundedShellTokens(raw) {
+  const tokens = [];
+  let token = "";
+  let tokenStart = -1;
+  let quote = null;
+  const limit = Math.min(raw.length, MAX_LAUNCHER_LENGTH);
+  for (let index = 0; index < limit && tokens.length < MAX_LAUNCHER_TOKENS; index += 1) {
+    const char = raw[index] ?? "";
+    if (tokenStart < 0 && !/\s/.test(char)) tokenStart = index;
+    if (char === "\\" && quote !== "'" && index + 1 < limit) {
+      const escaped = raw[index + 1] ?? "";
+      const shellEscaped = quote === '"' ? /[$\x60"\\\r\n]/.test(escaped) : /[\s'"\\;&|()`]/.test(escaped);
+      token += shellEscaped ? escaped : `\\${escaped}`;
+      index += 1;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      if (quote === char) quote = null;
+      else if (quote === null) quote = char;
+      else token += char;
+      continue;
+    }
+    if (quote === null && /\s/.test(char)) {
+      if (tokenStart >= 0) tokens.push({ value: token, start: tokenStart, end: index });
+      token = "";
+      tokenStart = -1;
+      continue;
+    }
+    token += char;
+  }
+  if (tokenStart >= 0 && tokens.length < MAX_LAUNCHER_TOKENS) {
+    tokens.push({ value: token, start: tokenStart, end: limit });
+  }
+  return tokens;
+}
+function shellTokens(raw) {
+  return boundedShellTokens(raw).map((token) => token.value);
+}
+function gitInvocationArguments(command) {
+  const argumentsList = [];
+  const quotedIndexes = new Uint8Array(command.length);
+  let activeQuote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index];
+    if (isQuoteBoundary(command, index, activeQuote)) {
+      quotedIndexes[index] = 1;
+      activeQuote = activeQuote === char ? null : char === "'" ? "'" : '"';
+    } else if (activeQuote !== null) {
+      quotedIndexes[index] = 1;
+    }
+  }
+  const gitStart = /(?:^|[;&|\r\n]\s*|\(\s*|`\s*)git\b/gi;
+  let match = gitStart.exec(command);
+  while (match !== null) {
+    const gitOffset = match[0].toLowerCase().lastIndexOf("git");
+    if (gitOffset < 0 || quotedIndexes[match.index + gitOffset] === 1) {
+      match = gitStart.exec(command);
+      continue;
+    }
+    const start = gitStart.lastIndex;
+    let quote = null;
+    let end = start;
+    for (; end < command.length; end += 1) {
+      const char = command[end] ?? "";
+      if (char === "\\" && quote !== "'") {
+        end += 1;
+        continue;
+      }
+      if (char === "'" || char === '"') {
+        if (quote === char) quote = null;
+        else if (quote === null) quote = char;
+        continue;
+      }
+      if (quote === null && /[;&|)`\r\n]/.test(char)) break;
+    }
+    argumentsList.push(command.slice(start, end));
+    gitStart.lastIndex = Math.max(end, start);
+    match = gitStart.exec(command);
+  }
+  return argumentsList;
+}
+function gitSubcommandIndex(tokens) {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index] ?? "";
+    if (token === "--") return index + 1 < tokens.length ? index + 1 : -1;
+    if (!token.startsWith("-")) return index;
+    const optionName = token.startsWith("-C") && token !== "-C" ? "-C" : token.split("=", 1)[0] ?? token;
+    const hasAttachedValue = token.includes("=") || token.startsWith("-C") && token !== "-C";
+    if (VALUE_TAKING_GIT_OPTIONS.has(optionName) && !hasAttachedValue) index += 1;
+  }
+  return -1;
+}
+function commandDeletesImplicitScope(command) {
+  const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
+  for (const rawArguments of gitInvocationArguments(stripped)) {
+    const tokens = shellTokens(rawArguments);
+    const commandIndex = gitSubcommandIndex(tokens);
+    const subcommand = commandIndex >= 0 ? tokens[commandIndex]?.toLowerCase() : void 0;
+    const operands = tokens.slice(commandIndex + 1);
+    if (/^(?:clean|restore|reset|checkout|switch)$/.test(subcommand ?? "")) return true;
+    if (subcommand === "stash") {
+      const action = operands.find((token) => !token.startsWith("-"))?.toLowerCase();
+      if (action === void 0 || /^(?:push|save|pop|apply)$/.test(action)) return true;
+    }
+  }
+  return false;
+}
+function normalizeEnvSplitPayload(payload) {
+  const removeUnbalanced = (value, quote) => {
+    let boundaries = 0;
+    for (let index = 0; index < value.length; index += 1) {
+      if (value[index] === quote && !quoteIsEscaped(value, index)) boundaries += 1;
+    }
+    return boundaries % 2 === 0 ? value : value.replaceAll(quote, "");
+  };
+  return removeUnbalanced(removeUnbalanced(payload, "'"), '"');
+}
+function unwrapEnvSplitStringAtBoundary(command) {
+  const pattern = /(^|[;&|\r\n]\s*|\(\s*|`\s*)(?:[^\s;&|(){}]+[\\/])?env\b/gi;
+  const match = pattern.exec(command);
+  if (!match) return command;
+  const boundary = match[1] ?? "";
+  const afterStart = match.index + match[0].length;
+  const after = command.slice(afterStart);
+  const tokens = boundedShellTokens(after);
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token) continue;
+    const separator = firstUnquotedShellSeparator(after, token.start, token.end);
+    const tokenEnd = separator ?? token.end;
+    const tokenValue = boundedShellTokens(after.slice(token.start, tokenEnd))[0]?.value ?? "";
+    const attachedShort = /^-[i0v]*S(.+)$/.exec(tokenValue)?.[1];
+    const attachedLong = tokenValue.startsWith("--split-string=") ? tokenValue.slice("--split-string=".length) : void 0;
+    const attachedPayload = attachedShort ?? attachedLong;
+    if (attachedPayload !== void 0) {
+      return `${command.slice(0, match.index)}${boundary}${normalizeEnvSplitPayload(attachedPayload)}${after.slice(tokenEnd)}`;
+    }
+    if (!/^-[i0v]*S$/.test(tokenValue) && tokenValue !== "--split-string") {
+      if (separator !== void 0) return command;
+      continue;
+    }
+    const payload = tokens[index + 1];
+    if (!payload) return command;
+    const payloadSeparator = firstUnquotedShellSeparator(after, payload.start, payload.end);
+    const payloadEnd = payloadSeparator ?? payload.end;
+    const payloadValue = boundedShellTokens(after.slice(payload.start, payloadEnd))[0]?.value ?? "";
+    return `${command.slice(0, match.index)}${boundary}${normalizeEnvSplitPayload(payloadValue)}${after.slice(payloadEnd)}`;
+  }
+  return command;
+}
+function stripTransparentLaunchers(command) {
+  let stripped = command;
+  let previous;
+  do {
+    previous = stripped;
+    let beforeUnwrap;
+    do {
+      beforeUnwrap = stripped;
+      stripped = unwrapEnvSplitStringAtBoundary(stripped);
+    } while (stripped !== beforeUnwrap);
+    stripped = stripLauncherAtBoundary(stripped, "env", ENV_VALUE_TAKING);
+    stripped = stripLauncherAtBoundary(stripped, "sudo", SUDO_VALUE_TAKING);
+  } while (stripped !== previous);
+  return stripped;
+}
+var SUDO_VALUE_TAKING = /* @__PURE__ */ new Set([
+  "-u",
+  "-g",
+  "-h",
+  "-p",
+  "-C",
+  "-R",
+  "-D",
+  "-r",
+  "-t",
+  "--user",
+  "--group",
+  "--host",
+  "--prompt",
+  "--close-from",
+  "--chroot",
+  "--chdir",
+  "--role",
+  "--type",
+  "--command-timeout"
+]);
+var ENV_VALUE_TAKING = /* @__PURE__ */ new Set([
+  "-u",
+  "-C",
+  "-P",
+  "-a",
+  "--argv0",
+  "--unset",
+  "--chdir",
+  "--split-string"
+]);
+var ENV_FLAG_OPTIONS = /* @__PURE__ */ new Set([
+  "-i",
+  "-0",
+  "-v",
+  "--ignore-environment",
+  "--null",
+  "--debug",
+  "--help",
+  "--version"
+]);
+function firstUnquotedShellSeparator(raw, start, end) {
+  let quote = null;
+  for (let index = start; index < end; index += 1) {
+    const char = raw[index];
+    if (isQuoteBoundary(raw, index, quote)) {
+      quote = quote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (quote === null && !quoteIsEscaped(raw, index) && /[;&|]/.test(char ?? "")) return index;
+  }
+  return void 0;
+}
+function launcherPrefixLength(after, valueTaking, flagOptions) {
+  const tokens = boundedShellTokens(after);
+  let consumed = 0;
+  for (let i = 0; i < tokens.length; i += 1) {
+    const tok = tokens[i] ?? { value: "", start: 0, end: 0 };
+    const token = tok.value;
+    const separator = firstUnquotedShellSeparator(after, tok.start, tok.end);
+    if (separator !== void 0) return consumed || separator;
+    if (token === "--") return tok.end;
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) {
+      consumed = tok.end;
+      continue;
+    }
+    if (token === "-" || !token.startsWith("-")) break;
+    const optionName = token.split("=", 1)[0] ?? token;
+    const combinedValueOption = [...valueTaking].find(
+      (option) => option.length === 2 && token.startsWith(option) && token !== option
+    );
+    const combinedShortValueOption = token.startsWith("-") && !token.startsWith("--") ? [...valueTaking].find(
+      (option) => option.length === 2 && token.includes(option[1] ?? "", 2)
+    ) : void 0;
+    const hasAttachedValue = token.includes("=") || combinedValueOption !== void 0;
+    if (!hasAttachedValue && (valueTaking.has(optionName) || combinedShortValueOption !== void 0)) {
+      if (i + 1 >= tokens.length) return flagOptions ? void 0 : tok.end;
+      const valueToken = tokens[i + 1] ?? tok;
+      const valueSeparator = firstUnquotedShellSeparator(after, valueToken.start, valueToken.end);
+      if (valueSeparator !== void 0) return consumed || valueSeparator;
+      consumed = valueToken.end;
+      i += 1;
+    } else {
+      const knownFlag = flagOptions?.has(optionName) || flagOptions !== void 0 && /^-[i0v]+$/.test(token);
+      const knownAttachedValue = hasAttachedValue && (valueTaking.has(optionName) || combinedValueOption !== void 0);
+      if (flagOptions && !knownFlag && !knownAttachedValue) return void 0;
+      consumed = tok.end;
+    }
+  }
+  return consumed;
+}
+function stripLauncherAtBoundary(command, launcher, valueTaking) {
+  const pattern = new RegExp(
+    `(^|[;&|\\r\\n]\\s*|\\(\\s*|\`\\s*)(?:[^\\s;&|(){}]+[\\\\/])?${launcher}\\b`,
+    "i"
+  );
+  const match = pattern.exec(command);
+  if (!match) return command;
+  const boundary = match[1] ?? "";
+  const afterStart = match.index + match[0].length;
+  const after = command.slice(afterStart);
+  const consumed = launcherPrefixLength(
+    after,
+    valueTaking,
+    launcher === "env" ? ENV_FLAG_OPTIONS : void 0
+  );
+  if (consumed === void 0) {
+    return `${command.slice(0, match.index)}${boundary}rm -rf **`;
+  }
+  return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
+}
+function commandRecursivelyDeletes(command) {
+  const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
+  if (/(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
+    stripped
+  )) {
+    return true;
+  }
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  let match = destructive.exec(stripped);
+  while (match !== null) {
+    const tool = match[1]?.toLowerCase();
+    if (tool === "rmdir") return true;
+    const tokens = (match[2]?.match(/"[^"]*"|'[^']*'|[^\s]+/g) ?? []).map(
+      (arg) => arg.replace(/^["']|["']$/g, "")
+    );
+    let recursive = false;
+    for (const token of tokens) {
+      if (token === "--") break;
+      if (tool === "rm") {
+        if (token === "--recursive" || /^-[^-]*[rR]/.test(token)) recursive = true;
+      } else if (/^\/[a-z]*s[a-z]*$/i.test(token)) {
+        recursive = true;
+      }
+    }
+    if (recursive) return true;
+    match = destructive.exec(stripped);
+  }
+  return false;
+}
+function quoteIsEscaped(command, index) {
+  let backslashes = 0;
+  for (let cursor = index - 1; cursor >= 0 && command[cursor] === "\\"; cursor -= 1) {
+    backslashes += 1;
+  }
+  return backslashes % 2 === 1;
+}
+function isQuoteBoundary(command, index, activeQuote) {
+  const char = command[index];
+  if (char !== "'" && char !== '"') return false;
+  if (activeQuote === "'") return char === "'";
+  if (activeQuote !== null && char !== activeQuote) return false;
+  return !quoteIsEscaped(command, index);
+}
+function executableCommandSubstitutions(command) {
+  const bodies = [];
+  let outerQuote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index];
+    if (isQuoteBoundary(command, index, outerQuote)) {
+      outerQuote = outerQuote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (outerQuote === "'" || quoteIsEscaped(command, index)) continue;
+    if (char === "`") {
+      let end2 = index + 1;
+      while (end2 < command.length && (command[end2] !== "`" || quoteIsEscaped(command, end2))) {
+        end2 += 1;
+      }
+      if (end2 < command.length) {
+        bodies.push(command.slice(index + 1, end2));
+        index = end2;
+      }
+      continue;
+    }
+    const commandSubstitution = char === "$" && command[index + 1] === "(";
+    const processSubstitution = (char === ">" || char === "<") && command[index + 1] === "(";
+    if (!commandSubstitution && !processSubstitution || // Arithmetic expansion evaluates an expression; it does not execute its
+    // contents as a shell command substitution.
+    commandSubstitution && command[index + 2] === "(")
+      continue;
+    let depth = 1;
+    let innerQuote = null;
+    let end = index + 2;
+    for (; end < command.length; end += 1) {
+      const innerChar = command[end];
+      if (isQuoteBoundary(command, end, innerQuote)) {
+        innerQuote = innerQuote === innerChar ? null : innerChar === "'" ? "'" : '"';
+        continue;
+      }
+      if (innerQuote !== null) continue;
+      if ((innerChar === "(" || innerChar === ")") && quoteIsEscaped(command, end)) continue;
+      if (innerChar === "(") depth += 1;
+      else if (innerChar === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      }
+    }
+    if (depth === 0) {
+      bodies.push(command.slice(index + 2, end));
+      index = end;
+    } else {
+      break;
+    }
+  }
+  return bodies;
+}
+var MAX_DESTRUCTIVE_TARGET_DEPTH = 64;
+function heredocDelimiterOnLine(line) {
+  let quote = null;
+  for (let index = 0; index < line.length - 1; index += 1) {
+    const char = line[index];
+    if (isQuoteBoundary(line, index, quote)) {
+      quote = quote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (quote !== null || quoteIsEscaped(line, index) || char !== "<" || line[index - 1] === "<" || line[index + 1] !== "<" || line[index + 2] === "<")
+      continue;
+    let cursor = index + 2;
+    const stripTabs = line[cursor] === "-";
+    if (stripTabs) cursor += 1;
+    while (line[cursor] === " " || line[cursor] === "	") cursor += 1;
+    let delimiter = "";
+    let delimiterQuote = null;
+    let quoted = false;
+    for (; cursor < line.length; cursor += 1) {
+      const delimiterChar = line[cursor] ?? "";
+      if (delimiterQuote !== null) {
+        if (delimiterChar === delimiterQuote && !quoteIsEscaped(line, cursor)) {
+          delimiterQuote = null;
+          quoted = true;
+        } else if (delimiterChar === "\\" && delimiterQuote === '"' && cursor + 1 < line.length) {
+          quoted = true;
+          cursor += 1;
+          delimiter += line[cursor] ?? "";
+        } else {
+          delimiter += delimiterChar;
+        }
+        continue;
+      }
+      if (delimiterChar === "'" || delimiterChar === '"') {
+        delimiterQuote = delimiterChar;
+        quoted = true;
+        continue;
+      }
+      if (delimiterChar === "\\" && cursor + 1 < line.length) {
+        quoted = true;
+        cursor += 1;
+        delimiter += line[cursor] ?? "";
+        continue;
+      }
+      if (/\s|[;&|<>]/.test(delimiterChar)) break;
+      delimiter += delimiterChar;
+    }
+    return delimiter.length > 0 ? { delimiter, start: index, end: cursor, quoted, stripTabs } : null;
+  }
+  return null;
+}
+function commandSegmentBeforeHeredoc(prefix) {
+  let segmentStart = 0;
+  let quote = null;
+  for (let index = 0; index < prefix.length; index += 1) {
+    const char = prefix[index];
+    if (isQuoteBoundary(prefix, index, quote)) {
+      quote = quote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (quote === null && !quoteIsEscaped(prefix, index) && /[;&|\r\n]/.test(char ?? "")) {
+      segmentStart = index + 1;
+    }
+  }
+  return prefix.slice(segmentStart).trim();
+}
+function maskNonExecutingHeredocBodies(command) {
+  const lines = command.split(/(?<=\n)/);
+  let heredoc = null;
+  const maskBody = (start, end, quoted) => {
+    const body = lines.slice(start, end).join("");
+    const substitutions = quoted ? [] : executableCommandSubstitutions(body);
+    for (let index = start; index < end; index += 1) {
+      const line = lines[index] ?? "";
+      lines[index] = line.endsWith("\r\n") ? "\r\n" : line.endsWith("\n") ? "\n" : "";
+    }
+    if (substitutions.length > 0 && start < end)
+      lines[start] = `${substitutions.join(";")}${lines[start] ?? ""}`;
+  };
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (heredoc !== null) {
+      const content = line.replace(/\r?\n$/, "");
+      const terminator = heredoc.stripTabs ? content.replace(/^\t+/, "") : content;
+      if (terminator === heredoc.delimiter) {
+        maskBody(heredoc.bodyStart, index, heredoc.quoted);
+        heredoc = null;
+      }
+      continue;
+    }
+    const marker = heredocDelimiterOnLine(line);
+    if (!marker) continue;
+    const prefix = line.slice(0, marker.start).trim();
+    const suffix = line.slice(marker.end).trim();
+    const owner = stripTransparentLaunchers(commandSegmentBeforeHeredoc(prefix));
+    const commandBeforeMarker = `${lines.slice(0, index).join("")}${prefix}`;
+    const whileReadLoopOwnsHeredoc = /^done$/i.test(owner) && /(?:^|[;&|\r\n])\s*while\s+read(?:\s|$)[\s\S]*\bdone\s*$/i.test(commandBeforeMarker);
+    const receivesDataWithoutExecuting = /^(?:[^\s;&|]+[\\/])?(?:cat|tee)(?:\s|$)/i.test(owner) || /^(?:while\s+)?read(?:\s|$)/i.test(owner) || whileReadLoopOwnsHeredoc;
+    const redirectedFileMatch = /^(?:>>|>\||>)\s*("[^"]+"|'[^']+'|[^\s;&|<>]+)/.exec(suffix);
+    const redirectedFile = redirectedFileMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+    const remainingCommand = lines.slice(index + 1).join("");
+    const executionSearch = `${suffix}
+${remainingCommand}`;
+    const normalizedRedirectedFile = redirectedFile ? normalizePath(redirectedFile) : void 0;
+    const executesRedirectedFile = normalizedRedirectedFile !== void 0 && boundedShellTokens(executionSearch).some((token) => {
+      if (normalizePath(token.value) !== normalizedRedirectedFile) return false;
+      const segmentStart = Math.max(
+        executionSearch.lastIndexOf(";", token.start - 1),
+        executionSearch.lastIndexOf("&", token.start - 1),
+        executionSearch.lastIndexOf("|", token.start - 1),
+        executionSearch.lastIndexOf("\n", token.start - 1),
+        executionSearch.lastIndexOf("\r", token.start - 1)
+      );
+      const segmentTokens = shellTokens(executionSearch.slice(segmentStart + 1, token.start));
+      const previous = segmentTokens.at(-1)?.toLowerCase();
+      return previous === void 0 || /^(?:(?:ba|z|k)?sh|source|\.)$/.test(previous);
+    });
+    const processSubstitution = /^(?:>>|>\||>)\s*>\s*\(\s*([^)]*)/.exec(suffix);
+    const processCommand = boundedShellTokens(
+      stripTransparentLaunchers(processSubstitution?.[1]?.trim() ?? "")
+    )[0]?.value.replace(/^.*[\\/]/, "").toLowerCase();
+    const executesBody = /^(?:\||;|&|\(|\{)/.test(suffix) || /^(?:(?:ba|z|k)?sh|source|\.)$/.test(processCommand ?? "") || executesRedirectedFile;
+    if (!receivesDataWithoutExecuting || executesBody) continue;
+    heredoc = { ...marker, bodyStart: index + 1 };
+  }
+  if (heredoc !== null) maskBody(heredoc.bodyStart, lines.length, heredoc.quoted);
+  return lines.join("");
+}
 function destructiveTargets(command) {
+  return destructiveTargetsAtDepth(command, 0);
+}
+function destructiveTargetsAtDepth(command, depth) {
+  if (depth >= MAX_DESTRUCTIVE_TARGET_DEPTH) return ["**"];
+  const normalizedCommand = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
   const targets = [];
-  const destructive = /(?:^|[;&|]\s*)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+([^;&|]+)/gi;
-  let m = destructive.exec(command);
+  const quotedIndexes = new Uint8Array(normalizedCommand.length);
+  let activeQuote = null;
+  for (let index = 0; index < normalizedCommand.length; index += 1) {
+    const char = normalizedCommand[index];
+    if (isQuoteBoundary(normalizedCommand, index, activeQuote)) {
+      quotedIndexes[index] = 1;
+      activeQuote = activeQuote === char ? null : char === "'" ? "'" : '"';
+    } else if (activeQuote !== null) {
+      quotedIndexes[index] = 1;
+    }
+  }
+  const tokenIsQuoted = (match, token) => {
+    const offset = match[0].toLowerCase().indexOf(token.toLowerCase());
+    return offset >= 0 && quotedIndexes[match.index + offset] === 1;
+  };
+  const shellOperandTokens = (raw) => {
+    const tokens = shellTokens(raw);
+    const redirectIndex = tokens.findIndex((token) => /^(?:\d*(?:<>|>>?|<)|&>>?)/.test(token));
+    return redirectIndex === -1 ? tokens : tokens.slice(0, redirectIndex);
+  };
+  const shellArgs = (raw) => {
+    const lastNonWhitespace = raw.search(/\s*$/) - 1;
+    let quote2 = null;
+    for (let index = 0; index < lastNonWhitespace; index += 1) {
+      if (isQuoteBoundary(raw, index, quote2)) {
+        const char = raw[index];
+        quote2 = quote2 === char ? null : char === "'" ? "'" : '"';
+      }
+    }
+    const args = raw[lastNonWhitespace] === ")" && quote2 === null && !quoteIsEscaped(raw, lastNonWhitespace) ? raw.slice(0, lastNonWhitespace) : raw;
+    return shellOperandTokens(args).filter((arg) => arg.length > 0 && !arg.startsWith("-"));
+  };
+  for (const body of executableCommandSubstitutions(normalizedCommand)) {
+    let executableBody = body.trim();
+    while (executableBody.startsWith("(") && executableBody.endsWith(")")) {
+      executableBody = executableBody.slice(1, -1).trim();
+    }
+    targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
+  }
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  let m = destructive.exec(normalizedCommand);
   while (m !== null) {
-    const args = (m[2] ?? "").split(/\s+/).filter((a) => a.length > 0 && !a.startsWith("-"));
-    targets.push(...args);
-    m = destructive.exec(command);
-  }
-  const redirect = />{1,2}\s*([^\s;&|>]+)/g;
-  let r = redirect.exec(command);
-  while (r !== null) {
-    const target = r[1];
-    if (target && target !== "/dev/null" && target !== "NUL" && target !== "nul") {
+    if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
+    m = destructive.exec(normalizedCommand);
+  }
+  const copy = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)/gi;
+  let c = copy.exec(normalizedCommand);
+  while (c !== null) {
+    if (tokenIsQuoted(c, c[1] ?? "")) {
+      c = copy.exec(normalizedCommand);
+      continue;
+    }
+    const tokens = shellTokens(c[2] ?? "");
+    let destination;
+    for (let index = 0; index < tokens.length; index += 1) {
+      const token = tokens[index];
+      if (token === "-t" || token === "--target-directory") {
+        destination = tokens[index + 1];
+        break;
+      }
+      if (token?.startsWith("--target-directory=")) {
+        destination = token.slice("--target-directory=".length);
+        break;
+      }
+    }
+    destination ??= tokens.filter((arg) => arg.length > 0 && !arg.startsWith("-")).at(-1);
+    if (destination) targets.push(destination);
+    c = copy.exec(normalizedCommand);
+  }
+  const tee = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)/gi;
+  let t = tee.exec(normalizedCommand);
+  while (t !== null) {
+    if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
+    t = tee.exec(normalizedCommand);
+  }
+  const dd = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)/gi;
+  let d = dd.exec(normalizedCommand);
+  while (d !== null) {
+    if (!tokenIsQuoted(d, d[1] ?? "")) {
+      const outputMatch = /(?:^|\s)of=("[^"]*"|'[^']*'|[^\s]+)/i.exec(d[2] ?? "");
+      const output = outputMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+      if (output) targets.push(output);
+    }
+    d = dd.exec(normalizedCommand);
+  }
+  const overwrite = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)/gi;
+  let o = overwrite.exec(normalizedCommand);
+  while (o !== null) {
+    const rawArgs = o[2] ?? "";
+    const tool = o[1]?.toLowerCase();
+    if (tool && tokenIsQuoted(o, tool)) {
+      o = overwrite.exec(normalizedCommand);
+      continue;
+    }
+    if (tool === "sed" && /(?:^|\s)-i(?:[^\s]*)?(?:\s|$)/.test(rawArgs)) {
+      const args = shellArgs(rawArgs);
+      targets.push(...args.slice(1));
+    } else if (tool === "ln" && /(?:^|\s)-[^\s]*f[^\s]*(?:\s|$)/.test(rawArgs)) {
+      const destination = shellArgs(rawArgs).at(-1);
+      if (destination) targets.push(destination);
+    }
+    o = overwrite.exec(normalizedCommand);
+  }
+  const xargsPipeline = /\b(?:echo|printf)\s+([^|]+)\|\s*xargs(?:\s+-[^\s]+)*\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b/gi;
+  let x = xargsPipeline.exec(normalizedCommand);
+  while (x !== null) {
+    if (!tokenIsQuoted(x, "xargs")) targets.push(...shellArgs(x[1] ?? ""));
+    x = xargsPipeline.exec(normalizedCommand);
+  }
+  for (const rawArguments of gitInvocationArguments(normalizedCommand)) {
+    const invocationTokens = shellOperandTokens(rawArguments);
+    const commandIndex = gitSubcommandIndex(invocationTokens);
+    if (commandIndex >= 0) {
+      let gitCwd = "";
+      let workTree;
+      for (let index = 0; index < commandIndex; index += 1) {
+        const token = invocationTokens[index] ?? "";
+        if (token === "--") continue;
+        const optionName = token.startsWith("-C") && token !== "-C" ? "-C" : token.split("=", 1)[0] ?? token;
+        let optionValue = token.includes("=") ? token.slice(token.indexOf("=") + 1) : void 0;
+        if (token.startsWith("-C") && token !== "-C") optionValue = token.slice(2);
+        if (VALUE_TAKING_GIT_OPTIONS.has(optionName) && optionValue === void 0) {
+          optionValue = invocationTokens[index + 1];
+          index += 1;
+        }
+        if (optionName === "-C" && optionValue)
+          gitCwd = resolveTargetPath(optionValue, gitCwd || void 0);
+        if (optionName === "--work-tree" && optionValue) workTree = optionValue;
+      }
+      const subcommand = invocationTokens[commandIndex]?.toLowerCase();
+      const tokens = invocationTokens.slice(commandIndex + 1);
+      const gitTreeRoot = workTree ? resolveTargetPath(workTree, gitCwd || void 0) : gitCwd;
+      const gitTarget = (target) => {
+        const resolved = resolveTargetPath(target, gitTreeRoot || void 0);
+        return target.endsWith("/") && !resolved.endsWith("/") ? `${resolved}/` : resolved;
+      };
+      const gitPathspecTargets = (pathspec) => {
+        if (isUnresolvedPathScope(pathspec) || !isDirectoryAmbiguousPath(pathspec)) {
+          return [gitTarget(pathspec)];
+        }
+        return [gitTarget(`${pathspec.replace(/\/$/, "")}/**`)];
+      };
+      const fileSourcedPathspecScope = (pathspecTokens) => {
+        const usesPathspecFile = pathspecTokens.some(
+          (token, index) => token.startsWith("--pathspec-from-file=") || token === "--pathspec-from-file" && pathspecTokens[index + 1] !== void 0
+        );
+        return usesPathspecFile ? gitTarget("**") : void 0;
+      };
+      if (subcommand === "clean") {
+        const dryRun = tokens.some((t2) => t2 === "--dry-run" || /^-[^-]*n/.test(t2));
+        if (!dryRun) {
+          const operands = [];
+          for (let i = 0; i < tokens.length; i += 1) {
+            const t2 = tokens[i] ?? "";
+            if (t2 === "-e" || t2 === "--exclude" || t2 === "--exclude-from") {
+              i += 1;
+              continue;
+            }
+            if (t2.startsWith("--exclude=") || t2.startsWith("--exclude-from=") || /^-e.+/.test(t2) || t2.startsWith("-"))
+              continue;
+            operands.push(t2);
+          }
+          targets.push(
+            ...(operands.length ? operands : ["."]).map(
+              (operand) => gitTarget(operand.endsWith("/") ? `${operand}**` : operand)
+            )
+          );
+        }
+      } else if (subcommand === "rm") {
+        const writes = !tokens.includes("--cached") || tokens.includes("--worktree");
+        if (writes) {
+          const recursive = tokens.some((t2) => t2 === "--recursive" || /^-[^-]*r/.test(t2));
+          const operands = tokens.filter((t2) => t2 !== "--" && !t2.startsWith("-"));
+          targets.push(...operands.map((o2) => gitTarget(recursive ? `${o2}/**` : o2)));
+          const unresolvedFileScope = fileSourcedPathspecScope(tokens);
+          if (unresolvedFileScope) targets.push(unresolvedFileScope);
+        }
+      } else if (subcommand === "restore") {
+        const staged = tokens.includes("--staged") || tokens.some((t2) => /^-[^-]*S/.test(t2));
+        const worktree = tokens.includes("--worktree") || tokens.some((t2) => /^-[^-]*W/.test(t2));
+        if (!staged || worktree) {
+          const operands = [];
+          for (let index = 0; index < tokens.length; index += 1) {
+            const token = tokens[index] ?? "";
+            if (token === "--source" || token === "-s") {
+              index += 1;
+              continue;
+            }
+            if (token.startsWith("--source=") || /^-s.+/.test(token) && token !== "--staged") {
+              continue;
+            }
+            if (token !== "--" && !token.startsWith("-")) operands.push(token);
+          }
+          targets.push(...operands.flatMap(gitPathspecTargets));
+          const unresolvedFileScope = fileSourcedPathspecScope(tokens);
+          if (unresolvedFileScope) targets.push(unresolvedFileScope);
+        }
+      } else if (subcommand === "checkout" || subcommand === "switch") {
+        const separator = tokens.indexOf("--");
+        if (separator >= 0) {
+          const paths = tokens.slice(separator + 1);
+          targets.push(...paths.flatMap(gitPathspecTargets));
+        } else {
+          const createFlags = subcommand === "checkout" ? /* @__PURE__ */ new Set(["-b", "-B", "--branch", "--orphan"]) : /* @__PURE__ */ new Set(["-c", "-C", "--create", "--force-create"]);
+          const createIndex = tokens.findIndex((token) => createFlags.has(token));
+          const branchNameIndex = createIndex >= 0 ? createIndex + 1 : -1;
+          const operands = tokens.filter(
+            (token, index) => !token.startsWith("-") && index !== branchNameIndex
+          );
+          if (operands.length > 0) targets.push(gitTarget("."));
+        }
+      } else if (subcommand === "stash") {
+        const action = tokens.find((token) => !token.startsWith("-"))?.toLowerCase();
+        if (action === void 0 || /^(?:push|save|pop|apply)$/.test(action)) {
+          targets.push(gitTarget("."));
+        }
+      } else if (subcommand === "reset" && tokens.some((t2) => t2 === "--hard" || t2 === "--merge" || t2 === "--keep"))
+        targets.push(gitTarget("."));
+    }
+  }
+  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  let f = findDelete.exec(normalizedCommand);
+  while (f !== null) {
+    const tokens = shellTokens(f[1] ?? "");
+    const expressionIndex = tokens.findIndex(
+      (token) => token.startsWith("-") || token === "!" || token === "("
+    );
+    const roots = (expressionIndex === -1 ? tokens : tokens.slice(0, expressionIndex)).filter(
+      (token) => token.length > 0
+    );
+    targets.push(...roots.length > 0 ? roots : ["."]);
+    f = findDelete.exec(normalizedCommand);
+  }
+  const shellWrapper = /\b(?:ba|z|k)?sh\s+-c\s+(['"])(.*?)\1/gi;
+  let w = shellWrapper.exec(normalizedCommand);
+  while (w !== null) {
+    if (w[2] && !tokenIsQuoted(w, w[0].split(/\s/)[0] ?? "")) {
+      targets.push(...destructiveTargetsAtDepth(w[2], depth + 1));
+    }
+    w = shellWrapper.exec(normalizedCommand);
+  }
+  let quote = null;
+  for (let index = 0; index < normalizedCommand.length; index += 1) {
+    const char = normalizedCommand[index];
+    if (char === "\n") {
+      quote = null;
+      continue;
+    }
+    if (isQuoteBoundary(normalizedCommand, index, quote)) {
+      quote = quote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (quote !== null || char !== ">") continue;
+    const redirectsBothStreams = normalizedCommand[index + 1] === "&";
+    const overridesNoclobber = normalizedCommand[index + 1] === "|";
+    if (redirectsBothStreams || overridesNoclobber || normalizedCommand[index + 1] === ">") {
+      index += 1;
+    }
+    while (normalizedCommand[index + 1] === " " || normalizedCommand[index + 1] === "	") {
+      index += 1;
+    }
+    const targetQuote = normalizedCommand[index + 1];
+    let end = index + 1;
+    let target;
+    if (targetQuote === "'" || targetQuote === '"') {
+      end = normalizedCommand.indexOf(targetQuote, index + 2);
+      if (end === -1) continue;
+      target = normalizedCommand.slice(index + 2, end);
+    } else {
+      while (end < normalizedCommand.length && !/[\s;&|>()]/.test(normalizedCommand[end] ?? "")) {
+        end += 1;
+      }
+      target = normalizedCommand.slice(index + 1, end);
+    }
+    if (target && !(redirectsBothStreams && (/^\d+$/.test(target) || target === "-"))) {
       targets.push(target);
     }
-    r = redirect.exec(command);
+    index = end;
   }
-  return targets.map((t) => t.replace(/^['"]|['"]$/g, ""));
+  return [
+    ...new Set(
+      targets.map((target) => target.replace(/^['"]|['"]$/g, "")).filter((target) => target !== "/dev/null" && target.toLowerCase() !== "nul")
+    )
+  ];
 }
 var plugin = {
   name: "path-guard",
@@ -104,7 +1262,7 @@ var plugin = {
       protect: {
         type: "array",
         items: { type: "string" },
-        description: "Glob patterns for protected paths. Replaces the default set when present."
+        description: "Glob patterns for protected paths. Replaces the default set when present. Writer globs whose unresolved scope overlaps protection are blocked; narrow the target or add an `allow` glob."
       },
       allow: {
         type: "array",
@@ -129,21 +1287,23 @@ var plugin = {
     const cfg = readConfig(api.config.extensions?.["path-guard"]);
     const protectRes = cfg.protect.map(compilePathGlob);
     const allowRes = cfg.allow.map(compilePathGlob);
-    const verdict = (path, tool, operation) => {
+    const verdict = (path, tool, operation, isScope = false) => {
+      const subject = isScope ? `write scope "${path}" may include a protected path \u2014 narrow it or add an \`allow\` glob` : `"${path}" is a protected path`;
+      const matchContext = isScope ? 'its unresolved scope overlaps config.extensions["path-guard"].protect' : 'matched by config.extensions["path-guard"].protect';
       if (cfg.mode === "block") {
         state.blocks += 1;
         state.lastBlock = { path, tool, when: (/* @__PURE__ */ new Date()).toISOString() };
         api.metrics.counter("blocks");
         return {
           decision: "block",
-          reason: `path-guard: "${path}" is a protected path (matched by config.extensions["path-guard"].protect) \u2014 ${operation} refused. If this change is intentional, ask the user to do it, add an \`allow\` glob, or set mode: "warn".`
+          reason: `path-guard: ${subject} (${matchContext}) \u2014 ${operation} refused. If this change is intentional, ask the user to do it, add an \`allow\` glob, or set mode: "warn".`
         };
       }
       state.warns += 1;
       api.metrics.counter("warns");
       return {
         decision: "allow",
-        additionalContext: `path-guard (warn mode): "${path}" is a protected path and this ${operation} would modify it. Double-check this is intentional.`
+        additionalContext: `path-guard (warn mode): ${subject} and this ${operation} would modify it. Double-check this is intentional.`
       };
     };
     const hook = (input) => {
@@ -151,28 +1311,56 @@ var plugin = {
       state.invocations += 1;
       const toolName = input.toolName ?? "";
       const ti = input.toolInput ?? {};
-      if (toolName === "write" || toolName === "edit") {
-        const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
-        if (typeof raw !== "string" || raw.length === 0) return;
-        if (matchesAny(raw, allowRes)) return;
-        if (matchesAny(raw, protectRes)) {
-          return verdict(raw, toolName, toolName === "write" ? "write" : "edit");
-        }
-        return;
-      }
-      if (toolName === "bash" || toolName === "exec") {
-        const command = typeof ti["command"] === "string" ? ti["command"] : "";
-        if (!command) return;
-        for (const target of destructiveTargets(command)) {
-          if (matchesAny(target, allowRes)) continue;
-          if (matchesAny(target, protectRes)) {
-            return verdict(target, toolName, "destructive shell command");
+      const command = typeof ti["command"] === "string" ? ti["command"] : "";
+      const commandArgs = Array.isArray(ti["args"]) ? ti["args"].filter((arg) => typeof arg === "string") : [];
+      const commandForInspection = [
+        command,
+        ...commandArgs.map((arg) => /^[\w./:@%+=,-]+$/.test(arg) ? arg : JSON.stringify(arg))
+      ].join(" ");
+      if (command && executesShell({
+        toolName: input.toolName,
+        toolInput: ti,
+        toolCapabilities: input.toolCapabilities,
+        toolMutating: input.toolMutating
+      })) {
+        const shellTargets = destructiveTargets(commandForInspection);
+        const effectiveCwd = effectiveToolCwd(ti["cwd"], input.cwd);
+        const recursivelyDeletes = commandRecursivelyDeletes(commandForInspection);
+        const deletesImplicitScope = commandDeletesImplicitScope(commandForInspection);
+        for (const path of shellTargets) {
+          const target = {
+            path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
+            kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
+          };
+          if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
+          const protectedShellTarget = targetIntersectsPatterns(target, cfg.protect, protectRes) || matchesAny(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes);
+          if (protectedShellTarget) {
+            return verdict(
+              target.path,
+              toolName,
+              "destructive shell command",
+              target.kind !== "file"
+            );
           }
         }
+        const writes = writesToDisk({ ...input, toolInput: ti });
+        const hasStructuredTarget = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some((field) => ti[field] !== void 0) || typeof ti["patch"] === "string";
+        const needsImplicitWriteScope = writes && ((input.toolCapabilities?.some(
+          (capability) => DISK_MUTATING_CAPABILITIES.has(capability)
+        ) ?? false) || (!input.toolCapabilities || input.toolCapabilities.length === 0) && LEGACY_WRITE_TOOLS.has(toolName));
+        if (!writes || !hasStructuredTarget && !needsImplicitWriteScope) return;
+      }
+      if (!writesToDisk({ ...input, toolInput: ti }) || isReadOnlyInvocation(toolName, ti)) return;
+      const targets = pathsFromToolInput(ti, toolName, input.cwd);
+      for (const target of targets) {
+        if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
+        if (targetIntersectsPatterns(target, cfg.protect, protectRes)) {
+          return verdict(target.path, toolName, operationLabel(toolName), target.kind !== "file");
+        }
       }
       return;
     };
-    state.hookUnregister = api.registerHook("PreToolUse", "write|edit|bash|exec", hook, {
+    state.hookUnregister = api.registerHook("PreToolUse", "*", hook, {
       name: "path-guard",
       stage: "validate",
       failurePolicy: "closed",