fullcourtdefense-cli 1.36.0 → 1.36.2

package/dist/cloudGrantTools.js

@@ -0,0 +1,1112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolArgv = toolArgv;
+exports.awsDefaultsFrom = awsDefaultsFrom;
+exports.awsUses = awsUses;
+exports.azDefaultsFrom = azDefaultsFrom;
+exports.azUses = azUses;
+exports.tfDefaultsFrom = tfDefaultsFrom;
+exports.tfUses = tfUses;
+exports.isTfTool = isTfTool;
+exports.isRemoteTool = isRemoteTool;
+exports.remoteUses = remoteUses;
+exports.sqlHow = sqlHow;
+exports.isSqlTool = isSqlTool;
+exports.sqlUses = sqlUses;
+exports.currentGitBranch = currentGitBranch;
+exports.gitPushUse = gitPushUse;
+exports.kubeDefaultsFrom = kubeDefaultsFrom;
+exports.kubeUses = kubeUses;
+/**
+ * WHAT + HOW + WHERE for aws and the Kubernetes CLIs (kubectl, oc, helm) —
+ * the entries `cloudGrant.ts` adds to a shell grant, same format as gcloud:
+ * `<tool>|<how>|<where>`.
+ *
+ *   aws   how    from service + operation: `rm` / `rb` / `delete-*` / `terminate-*` /
+ *                `remove-*` / `deregister-*` / `purge-*` = delete; `iam`, `sso-admin`,
+ *                `identitystore`, `*-policy` / `*-permission` / `*-acl` / `*-grant` writes,
+ *                `create-access-key`, `authorize-*` / `revoke-*` = permissions;
+ *                `describe-*` / `list-*` / `get-*` / `ls` / `head-*` / `wait` = read; else change.
+ *         where  `profile=<p>,region=<r>` (+ `,account=<12 digits>` from an ARN,
+ *                + `,bucket=<a>+<b>` from `s3://…` / `--bucket`).
+ *   kube  how    from the verb: delete / uninstall = delete; `create (cluster)role(binding)` /
+ *                `create token` / `auth` / `certificate approve|deny` / `oc adm policy` /
+ *                `oc policy` = permissions; get / describe / logs / top / … = read;
+ *                exec / attach / cp / port-forward / debug / proxy = `exec` (a shell or a
+ *                tunnel into a workload: its own class, a change grant never covers it);
+ *                apply / scale / rollout / patch / set / … = change; an unknown verb (a
+ *                plugin such as `kubectl ctx`) is bound to its exact word, `cmd:<verb>`.
+ *         where  `context=<c>,namespace=<n>` (+ `,kubeconfig=<path>` with `--kubeconfig`).
+ *
+ * A value that cannot be read is `?` and the entry gets no Always allow. Defaults
+ * come from the caller's environment and the tool's own files, never from an
+ * assignment on the same line (`AWS_PROFILE=prod aws …`, `$env:KUBECONFIG=…`):
+ * such a line makes every default `?`, like `gcloud config set` does for gcloud.
+ * Deterministic words and flags only; the I/O is reading `~/.aws/config`,
+ * `~/.aws/credentials` and the kubeconfig files, never running a CLI.
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const credentialGrant_1 = require("./credentialGrant");
+const shellQuoteMask_1 = require("./shellQuoteMask");
+/** An unquoted redirection word: `2>&1`, `>out.txt`, `2>$null`, `*>>log`, `<in` (target attached). */
+const REDIRECT_ATTACHED_RE = /^(?:\d|\*|&)?(?:>>?|<)(?:&\d|&-)?\S+$/;
+/** A bare redirection operator whose target is the next word: `>`, `2>`, `>>`, `*>`, `<`. */
+const REDIRECT_BARE_RE = /^(?:\d|\*|&)?(?:>>?|<)$/;
+/**
+ * The words after the program on one use's text; empty when the program is not found.
+ * Redirections are the shell's, not arguments to the program: `git push origin x 2>&1`
+ * pushes the same branch as `git push origin x`.
+ */
+function toolArgv(text, dialect, names) {
+    const words = (0, shellQuoteMask_1.shellWords)(text.trim(), dialect);
+    const at = words.findIndex(w => names.includes((0, credentialGrant_1.unquote)(w).toLowerCase().replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/, '')));
+    if (at < 0)
+        return [];
+    const argv = [];
+    for (let k = at + 1; k < words.length; k++) {
+        const word = words[k];
+        if (REDIRECT_BARE_RE.test(word)) {
+            k++;
+            continue;
+        }
+        if (REDIRECT_ATTACHED_RE.test(word))
+            continue;
+        argv.push(word);
+    }
+    return argv;
+}
+const WORD_RE = /^[a-z0-9][a-z0-9-]*$/;
+const UNSAFE_VALUE_RE = /[\s|,$`(){}%<>;&"']/;
+/** `[section]` → key/value, lowercase section and key. Any read error = null. */
+function readIni(file) {
+    try {
+        const sections = new Map();
+        let current;
+        for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+            const row = raw.trim();
+            if (!row || row.startsWith('#') || row.startsWith(';'))
+                continue;
+            const header = row.match(/^\[([^\]]+)\]$/);
+            if (header) {
+                const name = header[1].trim().replace(/\s+/g, ' ');
+                current = sections.get(name) || new Map();
+                sections.set(name, current);
+                continue;
+            }
+            const kv = row.match(/^([A-Za-z0-9_.-]+)\s*=\s*(.*)$/);
+            if (kv && current)
+                current.set(kv[1].toLowerCase(), kv[2].trim());
+        }
+        return sections;
+    }
+    catch {
+        return null;
+    }
+}
+// ---- aws --------------------------------------------------------------------------------
+/** Global options that take a separate value; their value is not a command word. */
+const AWS_VALUED_GLOBALS = new Set(['--profile', '--region', '--output', '--endpoint-url', '--query', '--color', '--cli-read-timeout', '--cli-connect-timeout', '--ca-bundle', '--cli-binary-format']);
+const AWS_PERMISSION_SERVICES = new Set(['iam', 'sso-admin', 'identitystore']);
+const AWS_DELETE_OP_RE = /^(?:rm|rb|delete|terminate|remove|deregister|purge)(?:-|$)/;
+const AWS_READ_OP_RE = /^(?:describe|list|get|ls|head|wait|lookup|search|scan|query|presign)(?:-|$)/;
+const AWS_PERMISSION_OP_RE = /(?:^|-)(?:policy|policies|permission|permissions|acl|grant|grants)(?:-|$)|^create-access-key$|^(?:authorize|revoke)-/;
+/** Configuration names the CLI reads from the environment. A line that sets one overrides every default. */
+const AWS_ENV_ON_LINE_RE = /\baws_(?:profile|default_profile|region|default_region|config_file|shared_credentials_file|access_key_id|secret_access_key|session_token)\b/i;
+const PROFILE_RE = /^[A-Za-z0-9_.+@-]{1,64}$/;
+const REGION_RE = /^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/;
+const BUCKET_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+function awsHow(service, op, rest) {
+    if (service === 's3') {
+        if (op === 'rm' || op === 'rb')
+            return 'delete';
+        // `mv s3://… x` removes the source objects.
+        if (op === 'mv' && (0, credentialGrant_1.unquote)(rest.find(w => !(0, credentialGrant_1.unquote)(w).startsWith('-')) || '').toLowerCase().startsWith('s3://'))
+            return 'delete';
+        if (op === 'sync' && rest.some(w => (0, credentialGrant_1.unquote)(w) === '--delete'))
+            return 'delete';
+        if (op === 'ls' || op === 'presign')
+            return 'read';
+        return 'change';
+    }
+    if (AWS_DELETE_OP_RE.test(op))
+        return 'delete';
+    if (AWS_PERMISSION_SERVICES.has(service))
+        return 'permissions';
+    if (AWS_READ_OP_RE.test(op))
+        return 'read';
+    if (AWS_PERMISSION_OP_RE.test(op))
+        return 'permissions';
+    return 'change';
+}
+/** Buckets and ARN accounts named on the use. `?` = one of them is computed. */
+function awsResources(argv, vars) {
+    const buckets = new Set();
+    const accounts = new Set();
+    for (let k = 0; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare === '--bucket' || bare.startsWith('--bucket=')) {
+            const value = (0, credentialGrant_1.flagValue)(argv.slice(k, k + 2), ['--bucket'], vars);
+            if (!value)
+                return '?';
+            buckets.add(value.toLowerCase());
+        }
+        const s3 = bare.match(/^s3:\/\/([^/]*)/i);
+        if (s3) {
+            if (/[$`(){}%]/.test(s3[1]))
+                return '?';
+            buckets.add(s3[1].toLowerCase());
+        }
+        for (const arn of bare.matchAll(/arn:aws[a-z-]*:[a-z0-9-]*:[a-z0-9-]*:([^:\s]*):/gi)) {
+            if (!/^\d{12}$/.test(arn[1])) {
+                if (arn[1])
+                    return '?';
+                continue;
+            }
+            accounts.add(arn[1]);
+        }
+    }
+    if (accounts.size > 1 || [...buckets].some(b => !BUCKET_RE.test(b)))
+        return '?';
+    return { account: [...accounts][0], buckets: [...buckets].sort() };
+}
+/**
+ * `AWS_PROFILE` (else `AWS_DEFAULT_PROFILE`), else `default` when that profile
+ * exists in `~/.aws/config` or `~/.aws/credentials`. Static keys in the
+ * environment (`AWS_ACCESS_KEY_ID`) beat any profile: unknown. Region:
+ * `AWS_REGION`, else `AWS_DEFAULT_REGION`, else the profile's `region` in the
+ * config file (`AWS_CONFIG_FILE` or `~/.aws/config`).
+ */
+function awsDefaultsFrom(env) {
+    const configFile = (env.AWS_CONFIG_FILE || '').trim() || path.join(os.homedir(), '.aws', 'config');
+    const credentialsFile = (env.AWS_SHARED_CREDENTIALS_FILE || '').trim() || path.join(os.homedir(), '.aws', 'credentials');
+    return {
+        profile() {
+            if ((env.AWS_ACCESS_KEY_ID || '').trim())
+                return null;
+            const named = (env.AWS_PROFILE || '').trim() || (env.AWS_DEFAULT_PROFILE || '').trim();
+            if (named)
+                return named;
+            const config = readIni(configFile);
+            const credentials = readIni(credentialsFile);
+            return config?.has('default') || credentials?.has('default') ? 'default' : null;
+        },
+        region(profile) {
+            const fromEnv = (env.AWS_REGION || '').trim() || (env.AWS_DEFAULT_REGION || '').trim();
+            if (fromEnv)
+                return fromEnv;
+            const config = readIni(configFile);
+            const section = config?.get(profile === 'default' ? 'default' : `profile ${profile}`);
+            return section?.get('region') || null;
+        },
+    };
+}
+function awsUse(argv, vars, defaults, defaultsUnreliable) {
+    const words = [];
+    let opAt = argv.length;
+    for (let k = 0; k < argv.length && words.length < 2; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare.startsWith('-')) {
+            if (AWS_VALUED_GLOBALS.has(bare))
+                k++;
+            continue;
+        }
+        if (!WORD_RE.test(bare.toLowerCase()))
+            break;
+        words.push(bare.toLowerCase());
+        opAt = k;
+    }
+    const [service = '', op = ''] = words;
+    // `aws --version`, `aws help`, `aws sso login`: the local CLI or the sign-in, no environment.
+    if (!service || service === 'help' || op === 'help' || ((service === 'sso' || service === 'sso-oidc') && /^(?:login|logout)$/.test(op))) {
+        return { tool: 'aws', how: 'read', mutatesDefaults: false };
+    }
+    const mutatesDefaults = service === 'configure' && !/^(?:list|list-profiles|get|export-credentials)$/.test(op);
+    const how = service === 'configure' ? (mutatesDefaults ? 'change' : 'read') : awsHow(service, op, argv.slice(opAt + 1));
+    // A parameter file can set any parameter, the bucket and the ARN included.
+    if (argv.some(w => /^--cli-input-(?:json|yaml)(?:=|$)/.test((0, credentialGrant_1.unquote)(w))))
+        return { tool: 'aws', how, where: '?', mutatesDefaults };
+    const flagged = (names) => (0, credentialGrant_1.flagValue)([...argv], names, vars);
+    const profileFlag = flagged(['--profile']);
+    const regionFlag = flagged(['--region']);
+    let profile = profileFlag === undefined ? (defaultsUnreliable ? null : defaults.profile()) : profileFlag;
+    if (profile && !PROFILE_RE.test(profile))
+        profile = null;
+    let region = regionFlag === undefined ? (defaultsUnreliable || !profile ? null : defaults.region(profile)) : regionFlag;
+    if (region)
+        region = region.toLowerCase();
+    if (region && !REGION_RE.test(region))
+        region = null;
+    const resources = awsResources(argv, vars);
+    if (resources === '?')
+        return { tool: 'aws', how, where: '?', mutatesDefaults };
+    const parts = [`profile=${profile || '?'}`, `region=${region || '?'}`];
+    // A default profile is what the hook's environment says; an `$env:AWS_PROFILE` set by an
+    // earlier command in the agent's terminal is invisible here. Only `--profile` binds it.
+    if (profile && profileFlag === undefined)
+        parts.push('profile-from=default');
+    if (resources.account)
+        parts.push(`account=${resources.account}`);
+    if (resources.buckets.length)
+        parts.push(`bucket=${resources.buckets.join('+')}`);
+    return { tool: 'aws', how, where: parts.join(','), mutatesDefaults };
+}
+/** aws uses on the line. `awsLineUnreliable`: the line itself names an AWS_* setting. */
+function awsUses(texts, command, dialect, vars, defaults) {
+    const argvs = texts.map(text => toolArgv(text, dialect, ['aws']));
+    const lineSetsEnv = AWS_ENV_ON_LINE_RE.test(command);
+    const first = argvs.map(argv => awsUse(argv, vars, defaults, lineSetsEnv));
+    if (!first.some(use => use.mutatesDefaults))
+        return first;
+    return argvs.map(argv => awsUse(argv, vars, defaults, true));
+}
+// ---- az ---------------------------------------------------------------------------------
+const AZ_VALUED_GLOBALS = new Set(['--subscription', '--output', '-o', '--query', '--resource-group', '-g', '--name', '-n', '--ids', '--scope', '--location', '-l']);
+/** First words that act on the local CLI or the sign-in, not on a subscription. */
+const AZ_LOCAL = new Set(['login', 'logout', 'version', 'help', 'extension', 'upgrade', 'feedback', 'find', 'interactive', 'init', 'bicep', 'cloud', 'self-test', 'survey']);
+const AZ_DELETE_VERB_RE = /^(?:delete|purge|remove|wipe)(?:-|$)/;
+const AZ_READ_VERB_RE = /^(?:show|list|get|exists|check|query|download|wait|export|browse|tail)(?:-|$)/;
+const AZ_PERMISSION_GROUPS = new Set(['role', 'ad']);
+const AZ_PERMISSION_VERB_RE = /(?:^|-)(?:policy|permission|permissions|grant|assign|access)(?:-|$)|^generate-sas$|^(?:renew|regenerate)(?:-|$)/;
+const AZ_ENV_ON_LINE_RE = /\b(?:azure_config_dir|azure_defaults_group|azure_defaults_location)\b/i;
+const GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const RG_RE = /^[A-Za-z0-9._()-]{1,90}$/;
+/** azureProfile.json / config under AZURE_CONFIG_DIR or `~/.azure`. */
+function azDefaultsFrom(env) {
+    const dir = (env.AZURE_CONFIG_DIR || '').trim() || path.join(os.homedir(), '.azure');
+    const subscriptions = () => {
+        try {
+            const raw = fs.readFileSync(path.join(dir, 'azureProfile.json'), 'utf8').replace(/^\uFEFF/, '');
+            const list = JSON.parse(raw)?.subscriptions;
+            return Array.isArray(list) ? list.filter(s => s && typeof s.id === 'string').map(s => ({ id: String(s.id).toLowerCase(), name: String(s.name || ''), isDefault: s.isDefault === true })) : [];
+        }
+        catch {
+            return [];
+        }
+    };
+    return {
+        subscription() {
+            const defaults = subscriptions().filter(s => s.isDefault);
+            return defaults.length === 1 && GUID_RE.test(defaults[0].id) ? defaults[0].id : null;
+        },
+        subscriptionId(nameOrId) {
+            if (GUID_RE.test(nameOrId))
+                return nameOrId.toLowerCase();
+            const matches = subscriptions().filter(s => s.name.toLowerCase() === nameOrId.toLowerCase());
+            return matches.length === 1 ? matches[0].id : null;
+        },
+        group() {
+            const fromEnv = (env.AZURE_DEFAULTS_GROUP || '').trim();
+            if (fromEnv)
+                return fromEnv;
+            return readIni(path.join(dir, 'config'))?.get('defaults')?.get('group') || null;
+        },
+    };
+}
+/** `/subscriptions/<id>/resourceGroups/<rg>/…` references on the use. `?` when they disagree or are computed. */
+function azResourceIds(argv) {
+    const subs = new Set();
+    const groups = new Set();
+    for (const word of argv) {
+        const bare = (0, credentialGrant_1.unquote)(word);
+        for (const m of bare.matchAll(/\/subscriptions\/([^/\s]+)(?:\/resourceGroups\/([^/\s]+))?/gi)) {
+            if (/[$`(){}%]/.test(m[0]))
+                return '?';
+            subs.add(m[1].toLowerCase());
+            if (m[2])
+                groups.add(m[2].toLowerCase());
+        }
+    }
+    if (subs.size > 1 || groups.size > 1)
+        return '?';
+    return { subscription: [...subs][0], group: [...groups][0] };
+}
+function azUse(argv, vars, defaults, defaultsUnreliable) {
+    const words = commandPathOf(argv, AZ_VALUED_GLOBALS, 5);
+    const [group = '', ...rest] = words;
+    const verb = words[words.length - 1] || '';
+    if (!group || AZ_LOCAL.has(group))
+        return { tool: 'az', how: 'read', mutatesDefaults: false };
+    if (group === 'config' || group === 'configure')
+        return { tool: 'az', how: 'change', mutatesDefaults: !/^(?:get|show|list)$/.test(rest[0] || '') };
+    // `az account …` is the signed-in account (like `gcloud auth`): no subscription entry; `account set` moves the default.
+    if (group === 'account')
+        return { tool: 'az', how: rest[0] === 'set' ? 'change' : 'read', mutatesDefaults: rest[0] === 'set' };
+    const how = AZ_DELETE_VERB_RE.test(verb) ? 'delete'
+        : AZ_PERMISSION_GROUPS.has(group) || words.some(w => AZ_PERMISSION_VERB_RE.test(w)) || words.includes('keys') ? 'permissions'
+            : AZ_READ_VERB_RE.test(verb) ? 'read' : 'change';
+    const ids = azResourceIds(argv);
+    if (ids === '?')
+        return { tool: 'az', how, where: '?', mutatesDefaults: false };
+    const subFlag = (0, credentialGrant_1.flagValue)([...argv], ['--subscription'], vars);
+    let subscription;
+    if (subFlag === null)
+        subscription = null;
+    else if (subFlag !== undefined)
+        subscription = defaults.subscriptionId(subFlag);
+    else
+        subscription = ids.subscription || (defaultsUnreliable ? null : defaults.subscription());
+    if (ids.subscription && subscription && ids.subscription !== subscription)
+        subscription = null;
+    // `az group <verb> --name rg` names the resource group itself.
+    const rgFlag = (0, credentialGrant_1.flagValue)([...argv], group === 'group' ? ['--name', '-n', '--resource-group', '-g'] : ['--resource-group', '-g'], vars);
+    let rg;
+    if (rgFlag === null)
+        rg = null;
+    else if (rgFlag !== undefined)
+        rg = rgFlag.toLowerCase();
+    else if (ids.group)
+        rg = ids.group;
+    else if (group === 'group' && (verb === 'list' || verb === 'create'))
+        rg = verb === 'list' ? '-' : null;
+    else
+        rg = defaultsUnreliable ? null : (defaults.group() || '-').toLowerCase();
+    if (rg && rg !== '-' && !RG_RE.test(rg))
+        rg = null;
+    return { tool: 'az', how, where: `subscription=${subscription || '?'},group=${rg || '?'}`, mutatesDefaults: false };
+}
+/** Command words of a use: non-flag words, skipping the values of `valued` flags. */
+function commandPathOf(argv, valued, max) {
+    const out = [];
+    for (let k = 0; k < argv.length && out.length < max; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare.startsWith('-')) {
+            if (valued.has(bare))
+                k++;
+            if (out.length)
+                break;
+            continue;
+        }
+        if (!WORD_RE.test(bare.toLowerCase()))
+            break;
+        out.push(bare.toLowerCase());
+    }
+    return out;
+}
+/** az uses on the line; a line that sets az defaults (`az account set`, `az config set`, `AZURE_*=`) makes every default unknown. */
+function azUses(texts, command, dialect, vars, defaults) {
+    const argvs = texts.map(text => toolArgv(text, dialect, ['az']));
+    const first = argvs.map(argv => azUse(argv, vars, defaults, AZ_ENV_ON_LINE_RE.test(command)));
+    if (!first.some(use => use.mutatesDefaults))
+        return first;
+    return argvs.map(argv => azUse(argv, vars, defaults, true));
+}
+// ---- terraform / tofu / terragrunt ------------------------------------------------------
+const TF_TOOLS = new Set(['terraform', 'tofu', 'terragrunt']);
+const TF_LOCAL = new Set(['version', 'help', 'fmt', 'validate', 'hclfmt', 'render-json', 'graph-dependencies', '-version', 'login', 'logout', 'metadata']);
+const TF_READ = new Set(['plan', 'show', 'output', 'graph', 'providers', 'console', 'get']);
+const TF_ENV_ON_LINE_RE = /\b(?:tf_workspace|tf_data_dir|tf_cli_args\w*|tf_var_\w+|terragrunt_working_dir)\b/i;
+const TF_DIR_RE = /^[^|,$`(){}%<>;&"'*?]{1,300}$/;
+const TF_WORKSPACE_RE = /^[A-Za-z0-9._-]{1,90}$/;
+function tfDefaultsFrom(env) {
+    return {
+        workspace(dir, cwd) {
+            const fromEnv = (env.TF_WORKSPACE || '').trim();
+            if (fromEnv)
+                return fromEnv;
+            if (!cwd)
+                return null;
+            try {
+                const file = path.join(path.resolve(cwd, dir), (env.TF_DATA_DIR || '').trim() || '.terraform', 'environment');
+                return fs.existsSync(file) ? fs.readFileSync(file, 'utf8').trim() || 'default' : 'default';
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+function tfUse(tool, argv, vars, defaults, cwd, defaultsUnreliable) {
+    let dir = '.';
+    let dirKnown = true;
+    const words = [];
+    const varFiles = [];
+    let inlineVars = false;
+    let destroyFlag = false;
+    for (let k = 0; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        const chdir = bare.match(/^-chdir=(.*)$/) || bare.match(/^--(?:terragrunt-)?working-dir=(.*)$/);
+        if (chdir) {
+            const value = (0, credentialGrant_1.literalWord)(chdir[1], vars);
+            dir = value || '.';
+            dirKnown = Boolean(value);
+            continue;
+        }
+        if (bare === '--terragrunt-working-dir' || bare === '--working-dir') {
+            const value = (0, credentialGrant_1.literalWord)(argv[++k], vars);
+            dir = value || '.';
+            dirKnown = Boolean(value);
+            continue;
+        }
+        if (/^-var-file(?:=|$)/.test(bare)) {
+            varFiles.push((0, credentialGrant_1.literalWord)(bare.includes('=') ? bare.slice(bare.indexOf('=') + 1) : argv[++k], vars));
+            continue;
+        }
+        if (/^-var(?:=|$)/.test(bare)) {
+            inlineVars = true;
+            if (!bare.includes('='))
+                k++;
+            continue;
+        }
+        if (bare === '-destroy') {
+            destroyFlag = true;
+            continue;
+        }
+        if (bare.startsWith('-'))
+            continue;
+        if (words.length < 2 && WORD_RE.test(bare.toLowerCase()))
+            words.push(bare.toLowerCase());
+    }
+    const [verb = '', sub = ''] = words;
+    if (!verb || TF_LOCAL.has(verb))
+        return { tool, how: 'read', mutatesDefaults: false };
+    if (verb === 'run-all' || verb === 'run')
+        return { tool, how: 'change', where: '?', mutatesDefaults: false };
+    let how = 'change';
+    let mutatesDefaults = false;
+    if (verb === 'destroy' || (verb === 'apply' && destroyFlag) || verb === 'force-unlock')
+        how = 'delete';
+    else if (verb === 'import')
+        how = 'permissions';
+    else if (verb === 'state')
+        how = /^(?:list|show|pull)$/.test(sub) ? 'read' : 'delete';
+    else if (verb === 'workspace') {
+        if (sub === 'delete')
+            how = 'delete';
+        else if (sub === 'select' || sub === 'new')
+            mutatesDefaults = true;
+        else
+            return { tool, how: 'read', mutatesDefaults: false };
+    }
+    else if (TF_READ.has(verb))
+        how = 'read';
+    // The directory is bound absolutely: `.` in two repositories is two environments. No working directory = unknown.
+    const absDir = cwd && dirKnown ? path.resolve(cwd, dir).replace(/\\/g, '/').replace(/\/+$/, '') : null;
+    const cleanDir = absDir && process.platform === 'win32' ? absDir.toLowerCase() : absDir;
+    if (!cleanDir || !TF_DIR_RE.test(cleanDir) || inlineVars || varFiles.some(f => f === null))
+        return { tool, how, where: '?', mutatesDefaults };
+    const workspace = defaultsUnreliable ? null : defaults.workspace(dir, cwd);
+    const parts = [`dir=${cleanDir}`, `workspace=${workspace && TF_WORKSPACE_RE.test(workspace) ? workspace : '?'}`];
+    const files = varFiles.map(f => f.replace(/\\/g, '/'));
+    if (files.length)
+        parts.push(`varfile=${files.every(f => TF_DIR_RE.test(f)) ? [...new Set(files)].sort().join('+') : '?'}`);
+    return { tool, how, where: parts.join(','), mutatesDefaults };
+}
+/** terraform / tofu / terragrunt uses; `workspace select` or a `TF_*` assignment on the line makes the workspace unknown. */
+function tfUses(uses, command, dialect, vars, defaults, cwd) {
+    const argvs = uses.map(use => ({ tool: use.tool, argv: toolArgv(use.text, dialect, [use.tool]) }));
+    const first = argvs.map(({ tool, argv }) => tfUse(tool, argv, vars, defaults, cwd, TF_ENV_ON_LINE_RE.test(command)));
+    if (!first.some(use => use.mutatesDefaults))
+        return first;
+    return argvs.map(({ tool, argv }) => tfUse(tool, argv, vars, defaults, cwd, true));
+}
+function isTfTool(name) {
+    return TF_TOOLS.has(name);
+}
+// ---- ssh / scp / sftp / rsync -----------------------------------------------------------
+const REMOTE_TOOLS = new Set(['ssh', 'scp', 'sftp', 'rsync']);
+const SSH_VALUED = new Set(['-p', '-i', '-l', '-o', '-F', '-J', '-L', '-R', '-D', '-b', '-c', '-E', '-e', '-I', '-m', '-O', '-Q', '-S', '-W', '-w', '-B', '-P']);
+const RSYNC_VALUED = new Set(['-e', '--rsh', '--exclude', '--include', '--exclude-from', '--include-from', '--files-from', '--filter', '-f', '--port', '--password-file', '--log-file', '--backup-dir', '--suffix', '--chmod', '--chown', '--timeout', '--contimeout', '--bwlimit', '--compare-dest', '--copy-dest', '--link-dest', '-T', '--temp-dir', '--partial-dir', '--max-size', '--min-size', '--rsync-path']);
+const HOST_RE = /^[A-Za-z0-9_.-]{1,253}$/;
+const USER_RE = /^[A-Za-z0-9_.-]{1,64}$/;
+/** `[user@]host[:path]` / `ssh://[user@]host[:port]/…` / `rsync://host/…`; null when it is not remote, `?` when computed. */
+function remoteEndpoint(word, vars, needsColon) {
+    const value = (0, credentialGrant_1.literalWord)(word, vars);
+    if (value === null)
+        return /[:@]/.test((0, credentialGrant_1.unquote)(word)) ? '?' : null;
+    const url = value.match(/^(?:ssh|rsync|sftp|scp):\/\/(?:([^@/]+)@)?([^:/]+)/i);
+    const plain = url ? null : needsColon ? value.match(/^(?:([^@\s/:]+)@)?([A-Za-z0-9_.-]+):/) : value.match(/^(?:([^@\s/:]+)@)?([^@\s/:]+)$/);
+    if (!url && /^[A-Za-z]:[\\/]/.test(value))
+        return null;
+    const m = url || plain;
+    if (!m)
+        return null;
+    const host = m[2].toLowerCase();
+    if (!HOST_RE.test(host) || (m[1] && !USER_RE.test(m[1])))
+        return '?';
+    return { host, ...(m[1] ? { user: m[1] } : {}) };
+}
+/**
+ * ssh / sftp = the destination host (`exec`: a shell or a command runs there);
+ * scp / rsync = every `host:path` operand, `change` when a remote operand is the
+ * last (destination) one, else `read`; rsync `--delete*` / `--remove-source-files`
+ * = delete. `-o` / `-F` / `-J` / a non-ssh `rsync -e` can send the connection
+ * elsewhere: unknown. Where = `host=<h>[+<h2>][,user=<u>]`.
+ */
+function remoteUse(tool, argv, vars) {
+    const valued = tool === 'rsync' ? RSYNC_VALUED : SSH_VALUED;
+    const operands = [];
+    let unknown = false;
+    let deletes = false;
+    let remoteCommand = [];
+    // `-l user` / `-o User=` name the login like `user@host`; `-p` (ssh) / `-P` (scp, sftp) the port.
+    let loginUser;
+    let port;
+    const optionValue = (k, bare, flag) => (bare.length > flag.length ? (0, credentialGrant_1.literalWord)(bare.slice(flag.length), vars) : (0, credentialGrant_1.literalWord)(argv[k + 1], vars));
+    for (let k = 0; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (tool === 'ssh' && operands.length) {
+            remoteCommand = argv.slice(k);
+            break;
+        } // the rest is the remote command
+        if (bare === '--')
+            continue;
+        if (bare.startsWith('-')) {
+            const flag = bare.split('=')[0];
+            if (/^--(?:delete|remove-source-files)/.test(flag))
+                deletes = true;
+            if (tool !== 'rsync' && /^-F/.test(bare))
+                unknown = true;
+            if ((tool === 'ssh' || tool === 'sftp') && /^-l/.test(bare))
+                loginUser = optionValue(k, bare, '-l');
+            if ((tool === 'ssh' && /^-p/.test(bare)) || ((tool === 'scp' || tool === 'sftp') && /^-P/.test(bare)))
+                port = optionValue(k, bare, bare.slice(0, 2));
+            if (tool !== 'rsync' && /^-o/.test(bare)) {
+                const option = bare.length > 2 ? bare.slice(2) : (0, credentialGrant_1.unquote)(argv[k + 1] || '');
+                if (/^(?:proxycommand|hostname|localcommand|include|permitlocalcommand)\b/i.test(option.trim()))
+                    unknown = true;
+                const user = option.trim().match(/^user\s*[= ]\s*(\S+)$/i);
+                if (user)
+                    loginUser = USER_RE.test(user[1]) ? user[1] : null;
+                const optPort = option.trim().match(/^port\s*[= ]\s*(\S+)$/i);
+                if (optPort)
+                    port = optPort[1];
+            }
+            if (tool === 'rsync' && (flag === '-e' || flag === '--rsh')) {
+                const rsh = bare.includes('=') ? bare.slice(bare.indexOf('=') + 1) : (0, credentialGrant_1.unquote)(argv[k + 1] || '');
+                if (!/^ssh(?:\s|$)/.test(rsh) || /\s-F|proxycommand|hostname=/i.test(rsh))
+                    unknown = true;
+            }
+            if (valued.has(flag) && !bare.includes('=') && bare.length === flag.length)
+                k++;
+            continue;
+        }
+        operands.push(argv[k]);
+    }
+    // `ssh -V`, `rsync --version`: no operand, nothing remote.
+    if (!operands.length)
+        return undefined;
+    const ends = operands.map(op => remoteEndpoint(op, vars, tool === 'scp' || tool === 'rsync'));
+    if (tool === 'ssh' || tool === 'sftp')
+        ends.splice(1);
+    const remote = ends.filter(e => e !== null);
+    if (!remote.length)
+        return tool === 'rsync' || tool === 'scp' ? undefined : { tool, how: 'exec', where: '?', mutatesDefaults: false };
+    const how = tool === 'ssh' || tool === 'sftp' ? (remoteCommandHow(remoteCommand) || 'exec') : deletes ? 'delete' : ends[ends.length - 1] !== null ? 'change' : 'read';
+    if (unknown || remote.some(e => e === '?') || loginUser === null || port === null || (port !== undefined && !/^\d{1,5}$/.test(port)))
+        return { tool, how, where: '?', mutatesDefaults: false };
+    const endpoints = remote;
+    // `user@host` and a different `-l` / `-o User=` on one line: which one ssh uses is not read here.
+    if (loginUser && endpoints.some(e => e.user && e.user !== loginUser))
+        return { tool, how, where: '?', mutatesDefaults: false };
+    const hosts = [...new Set(endpoints.map(e => e.host))].sort();
+    const users = [...new Set(endpoints.map(e => e.user || loginUser).filter(Boolean))].sort();
+    const portPart = port && port !== '22' ? `,port=${port}` : '';
+    return { tool, how, where: `host=${hosts.join('+')}${users.length ? `,user=${users.join('+')}` : ''}${portPart}`, mutatesDefaults: false };
+}
+/** Leading programs that change who may do what on the remote machine. */
+const REMOTE_PERMISSION_PROGRAMS = new Set(['chmod', 'chown', 'chgrp', 'setfacl', 'usermod', 'useradd', 'userdel', 'groupmod', 'gpasswd', 'passwd', 'chpasswd', 'visudo', 'icacls', 'takeown']);
+/**
+ * The remote command of `ssh host <command>`: a delete (the engine's operation) or a permission
+ * change (leading program) is its own entry, so an `exec` grant on the host never covers it and
+ * Always allow is refused for it. Anything else stays `exec`.
+ */
+function remoteCommandHow(words) {
+    const text = words.map(credentialGrant_1.unquote).join(' ').trim();
+    if (!text)
+        return undefined;
+    const { operation } = require('./actionPolicyEngine').inferBundledToolContext('shell', { command: text });
+    if (/^(?:DELETE|DROP|TRUNCATE)$/.test(operation))
+        return 'delete';
+    if (/^(?:GRANT|REVOKE)$/.test(operation))
+        return 'permissions';
+    for (const segment of text.split(/;|&&|\|\||\||\n/)) {
+        const program = segment.trim().split(/\s+/).find(w => w && !/^(?:sudo|doas|env|-\S+|[A-Za-z_][A-Za-z0-9_]*=\S*)$/.test(w));
+        if (program && REMOTE_PERMISSION_PROGRAMS.has(program.replace(/^.*\//, '').toLowerCase()))
+            return 'permissions';
+    }
+    return undefined;
+}
+function isRemoteTool(name) {
+    return REMOTE_TOOLS.has(name);
+}
+function remoteUses(uses, dialect, vars) {
+    return uses.map(use => remoteUse(use.tool, toolArgv(use.text, dialect, [use.tool]), vars)).filter((use) => Boolean(use));
+}
+// ---- psql / mysql / mariadb -------------------------------------------------------------
+const SQL_TOOLS = new Set(['psql', 'mysql', 'mariadb']);
+const PSQL_VALUED = new Set(['-h', '--host', '-d', '--dbname', '-U', '--username', '-p', '--port', '-c', '--command', '-f', '--file', '-v', '--set', '--variable', '-o', '--output', '-L', '--log-file', '-P', '--pset', '-F', '--field-separator', '-R', '--record-separator', '-T', '--table-attr']);
+const MYSQL_VALUED = new Set(['-h', '--host', '-D', '--database', '-u', '--user', '-P', '--port', '-e', '--execute', '-S', '--socket', '--protocol', '--default-character-set', '--init-command']);
+const DB_NAME_RE = /^[A-Za-z0-9_.$-]{1,128}$/;
+const SQL_ENV_ON_LINE_RE = /\b(?:pghost|pgdatabase|pgservice|pgport|mysql_host|mysql_pwd)\b/i;
+/** The worst class of the statements in one SQL string. */
+function sqlHow(sql) {
+    let worst = 'read';
+    const rank = ['read', 'change', 'permissions', 'delete'];
+    for (const statement of sql.split(';')) {
+        const words = statement.trim().split(/\s+/).map(w => w.toUpperCase());
+        const [first = '', second = ''] = words;
+        if (!first)
+            continue;
+        let how = 'change';
+        if (/^(?:DROP|TRUNCATE|DELETE)$/.test(first))
+            how = 'delete';
+        else if (/^(?:GRANT|REVOKE)$/.test(first) || (/^(?:CREATE|ALTER)$/.test(first) && /^(?:ROLE|USER|POLICY)$/.test(second)))
+            how = 'permissions';
+        else if (/^(?:SELECT|SHOW|EXPLAIN|DESCRIBE|DESC|WITH|VALUES|TABLE|\\[A-Z]+)$/.test(first) && !/\b(?:INSERT|UPDATE|DELETE|DROP|TRUNCATE)\b/.test(words.join(' ')))
+            how = 'read';
+        if (rank.indexOf(how) > rank.indexOf(worst))
+            worst = how;
+    }
+    return worst;
+}
+/** Quoted SQL is data even with parentheses; only an expansion (`$x`, a backtick) makes it computed. */
+function sqlText(word) {
+    if (word === undefined)
+        return null;
+    if (/^'[\s\S]*'$/.test(word))
+        return word.slice(1, -1);
+    if (/^"[\s\S]*"$/.test(word) && !/[$`]/.test(word))
+        return word.slice(1, -1);
+    return null;
+}
+/** `postgres://user@host:port/db`, `host=x dbname=y` or a bare name. */
+function pgConnection(value) {
+    const url = value.match(/^postgres(?:ql)?:\/\/(?:[^@/]*@)?([^:/?]+)?(?::\d+)?(?:\/([^?]+))?/i);
+    if (url)
+        return { host: url[1], db: url[2] };
+    if (/=/.test(value)) {
+        if (/\bservice\s*=/.test(value))
+            return { unknown: true };
+        return { host: value.match(/\bhost\s*=\s*(\S+)/)?.[1], db: value.match(/\bdbname\s*=\s*(\S+)/)?.[1] };
+    }
+    return { db: value };
+}
+function sqlUse(tool, argv, vars, env, defaultsUnreliable) {
+    const pg = tool === 'psql';
+    const valued = pg ? PSQL_VALUED : MYSQL_VALUED;
+    let host;
+    let db;
+    let sql;
+    let file;
+    let unknown = false;
+    const positional = [];
+    for (let k = 0; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare === '--version' || bare === '-V' || bare === '--help' || bare === '-?')
+            return undefined;
+        if (!pg && /^--(?:defaults-file|defaults-extra-file|login-path)(?:=|$)/.test(bare))
+            unknown = true;
+        const long = bare.match(/^(--[a-z-]+)=(.*)$/s);
+        const shortGlued = !long && /^-[A-Za-z]./.test(bare) && valued.has(bare.slice(0, 2)) ? [bare.slice(0, 2), bare.slice(2)] : null;
+        const flag = long ? long[1] : shortGlued ? shortGlued[0] : bare;
+        let value;
+        if (long)
+            value = (0, credentialGrant_1.literalWord)(long[2], vars);
+        else if (shortGlued)
+            value = (0, credentialGrant_1.literalWord)(shortGlued[1], vars);
+        else if (bare.startsWith('-') && valued.has(bare))
+            value = (0, credentialGrant_1.literalWord)(argv[++k], vars);
+        else if (bare.startsWith('-'))
+            continue;
+        else {
+            positional.push(argv[k]);
+            continue;
+        }
+        if (flag === '-h' || flag === '--host')
+            host = value;
+        else if (flag === '-d' || flag === '--dbname') {
+            if (value === null)
+                db = null;
+            else {
+                const conn = pgConnection(value);
+                if (conn.unknown)
+                    unknown = true;
+                db = conn.db ?? db;
+                if (conn.host)
+                    host = conn.host;
+            }
+        }
+        else if (flag === '-D' || flag === '--database')
+            db = value;
+        else if (flag === '-c' || flag === '--command' || flag === '-e' || flag === '--execute')
+            sql = value ?? sqlText(long ? long[2] : shortGlued ? shortGlued[1] : argv[k]);
+        else if (flag === '-f' || flag === '--file')
+            file = value;
+    }
+    if (db === undefined && positional.length) {
+        const value = (0, credentialGrant_1.literalWord)(positional[0], vars);
+        if (value === null)
+            db = null;
+        else if (pg) {
+            const conn = pgConnection(value);
+            if (conn.unknown)
+                unknown = true;
+            db = conn.db;
+            if (conn.host && host === undefined)
+                host = conn.host;
+        }
+        else
+            db = value;
+    }
+    const how = sql !== undefined ? (sql === null ? '?' : sqlHow(sql)) : file !== undefined ? (file ? `script:${file.replace(/\\/g, '/')}` : '?') : 'session';
+    if (how === '?')
+        return { tool, how: 'change', where: '?', mutatesDefaults: false };
+    if (host === undefined)
+        host = defaultsUnreliable ? null : ((pg ? env.PGHOST : env.MYSQL_HOST) || '').trim() || 'local';
+    if (db === undefined)
+        db = defaultsUnreliable || !pg ? null : (env.PGDATABASE || '').trim() || null;
+    if (pg && (env.PGSERVICE || '').trim())
+        unknown = true;
+    const hostOk = host && (host === 'local' || HOST_RE.test(host)) ? host.toLowerCase() : null;
+    const dbOk = db && DB_NAME_RE.test(db) ? db : null;
+    if (unknown)
+        return { tool, how, where: '?', mutatesDefaults: false };
+    return { tool, how, where: `host=${hostOk || '?'},database=${dbOk || '?'}`, mutatesDefaults: false };
+}
+function isSqlTool(name) {
+    return SQL_TOOLS.has(name);
+}
+function sqlUses(uses, command, dialect, vars, env) {
+    const unreliable = SQL_ENV_ON_LINE_RE.test(command);
+    return uses.map(use => sqlUse(use.tool, toolArgv(use.text, dialect, [use.tool]), vars, env, unreliable)).filter((use) => Boolean(use));
+}
+// ---- git push ---------------------------------------------------------------------------
+const GIT_VALUED_GLOBALS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path']);
+const GIT_PUSH_VALUED = new Set(['--repo', '-o', '--push-option', '--receive-pack', '--exec']);
+/** Branches a standing grant never covers: the ones a release or production deploy is cut from. */
+const PROTECTED_BRANCH_RE = /^(?:main|master|release.*|prod.*)$/i;
+const BRANCH_RE = /^[A-Za-z0-9._][A-Za-z0-9._/-]{0,199}$/;
+/** The branch `HEAD` names in the repository at `dir` (walking up to `.git`), or null. */
+function currentGitBranch(dir) {
+    try {
+        let at = path.resolve(dir);
+        for (let depth = 0; depth < 40; depth++) {
+            const dotGit = path.join(at, '.git');
+            if (fs.existsSync(dotGit)) {
+                let gitDir = dotGit;
+                if (fs.statSync(dotGit).isFile()) {
+                    const pointer = fs.readFileSync(dotGit, 'utf8').match(/^gitdir:\s*(.+)$/m);
+                    if (!pointer)
+                        return null;
+                    gitDir = path.resolve(at, pointer[1].trim());
+                }
+                const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim().match(/^ref:\s*refs\/heads\/(.+)$/);
+                return head && BRANCH_RE.test(head[1]) ? head[1] : null;
+            }
+            const up = path.dirname(at);
+            if (up === at)
+                return null;
+            at = up;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * `git push`: how = change, or `protected` (a force push, `--all` / `--tags` /
+ * `--follow-tags`, a push to main / master / release* / prod*), or delete
+ * (`--delete`, `:branch`, `--mirror`, `--prune`); `--dry-run` = read. Where =
+ * `remote=<name>,branch=<destination>` — the remote and refspecs on the command;
+ * `HEAD` / no refspec is the current branch, read from `.git/HEAD` only when the
+ * working directory is known (`cwd`), else unknown.
+ */
+function gitPushUse(argv, vars, cwd) {
+    let k = 0;
+    let dir = cwd;
+    for (; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (!bare.startsWith('-'))
+            break;
+        if (bare === '-C') {
+            const value = (0, credentialGrant_1.literalWord)(argv[k + 1], vars);
+            dir = value && dir ? path.resolve(dir, value) : undefined;
+        }
+        if (GIT_VALUED_GLOBALS.has(bare))
+            k++;
+    }
+    if ((0, credentialGrant_1.unquote)(argv[k] || '').toLowerCase() !== 'push')
+        return undefined;
+    let how = 'change';
+    let remote;
+    const refspecs = [];
+    const mark = (next) => { if (next === 'delete' || (next === 'protected' && how !== 'delete') || (next === 'read' && how === 'change'))
+        how = next; };
+    for (k++; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare === '--')
+            continue;
+        if (bare.startsWith('--')) {
+            const flag = bare.split('=')[0];
+            if (/^--force(?:-with-lease|-if-includes)?$/.test(flag) || flag === '--all' || flag === '--branches' || flag === '--tags' || flag === '--follow-tags')
+                mark('protected');
+            else if (flag === '--delete' || flag === '--mirror' || flag === '--prune')
+                mark('delete');
+            else if (flag === '--dry-run')
+                mark('read');
+            else if (flag === '--repo')
+                remote = bare.includes('=') ? (0, credentialGrant_1.literalWord)(bare.slice(7), vars) : (0, credentialGrant_1.literalWord)(argv[++k], vars);
+            else if (GIT_PUSH_VALUED.has(flag) && !bare.includes('='))
+                k++;
+            continue;
+        }
+        if (bare.startsWith('-') && bare.length > 1) {
+            if (/f/.test(bare.slice(1)))
+                mark('protected');
+            if (/d/.test(bare.slice(1)))
+                mark('delete');
+            if (/n/.test(bare.slice(1)))
+                mark('read');
+            if (bare === '-o')
+                k++;
+            continue;
+        }
+        if (remote === undefined) {
+            remote = (0, credentialGrant_1.literalWord)(argv[k], vars);
+            continue;
+        }
+        refspecs.push((0, credentialGrant_1.literalWord)(argv[k], vars));
+    }
+    const branches = [];
+    const head = () => (dir ? currentGitBranch(dir) : null);
+    if (!refspecs.length)
+        branches.push(remote ? head() : null);
+    for (const spec of refspecs) {
+        if (spec === null) {
+            branches.push(null);
+            continue;
+        }
+        let ref = spec;
+        if (ref.startsWith('+')) {
+            mark('protected');
+            ref = ref.slice(1);
+        }
+        const colon = ref.indexOf(':');
+        if (colon === 0) {
+            mark('delete');
+            ref = ref.slice(1);
+        }
+        else if (colon > 0)
+            ref = ref.slice(colon + 1);
+        if (ref.startsWith('refs/tags/')) {
+            mark('protected');
+            ref = ref.slice(10);
+        }
+        ref = ref.replace(/^refs\/heads\//, '');
+        branches.push(ref === 'HEAD' || ref === '@' ? head() : ref);
+    }
+    for (const branch of branches)
+        if (branch && PROTECTED_BRANCH_RE.test(branch))
+            mark('protected');
+    const remoteOk = remote && BRANCH_RE.test(remote) && !/[:/@]/.test(remote) ? remote : null;
+    const known = branches.every(b => b && BRANCH_RE.test(b));
+    const where = `remote=${remoteOk || '?'},branch=${known ? [...new Set(branches)].sort().join('+') : '?'}`;
+    return { tool: 'git', how, where, mutatesDefaults: false };
+}
+// ---- kubectl / oc / helm ---------------------------------------------------------------
+const KUBE_VALUED_GLOBALS = new Set(['-n', '--namespace', '--context', '--kube-context', '--kubeconfig', '--cluster', '--user', '-s', '--server', '--token', '--as', '--as-group', '--as-uid', '--request-timeout', '-v', '--v', '--kube-apiserver', '--kube-token', '--kube-as-user', '--kube-as-group', '--kube-ca-file', '--registry-config', '--repository-config', '--repository-cache']);
+/** Flags that point the use at another cluster or identity than the context says. */
+const KUBE_TARGET_OVERRIDES = ['--cluster', '--user', '-s', '--server', '--token', '--as', '--as-group', '--as-uid', '--kube-apiserver', '--kube-token', '--kube-as-user', '--kube-as-group'];
+const KUBE_READ_VERBS = new Set(['get', 'describe', 'logs', 'log', 'top', 'explain', 'api-resources', 'api-versions', 'version', 'cluster-info', 'events', 'diff', 'wait', 'status', 'history', 'projects', 'whoami']);
+const KUBE_EXEC_VERBS = new Set(['exec', 'attach', 'cp', 'port-forward', 'debug', 'proxy', 'rsh', 'rsync']);
+const KUBE_CHANGE_VERBS = new Set(['apply', 'create', 'scale', 'rollout', 'patch', 'set', 'label', 'annotate', 'edit', 'expose', 'run', 'autoscale', 'cordon', 'uncordon', 'drain', 'taint', 'replace', 'kustomize', 'install', 'upgrade', 'rollback', 'test', 'new-app', 'new-project', 'new-build', 'start-build', 'import-image', 'tag', 'adm', 'process']);
+const KUBE_DELETE_VERBS = new Set(['delete', 'uninstall', 'del', 'un']);
+/** helm commands that never talk to a cluster. */
+const HELM_LOCAL = new Set(['template', 'lint', 'package', 'repo', 'search', 'show', 'inspect', 'version', 'env', 'dependency', 'dep', 'plugin', 'completion', 'create', 'pull', 'fetch', 'push', 'registry', 'verify', 'help']);
+/** kubectl / oc commands that act on the local client or the sign-in, not a cluster. */
+const KUBE_LOCAL = new Set(['help', 'completion', 'plugin', 'login', 'logout', 'kustomize', 'options', 'alpha']);
+const KUBE_CONFIG_READ = new Set(['view', 'current-context', 'get-contexts', 'get-clusters', 'get-users']);
+const KUBE_ENV_ON_LINE_RE = /\b(?:kubeconfig|helm_kubecontext|helm_namespace|helm_kubeapiserver|helm_kubetoken|helm_kubeasuser)\s*=|\$env:(?:kubeconfig|helm_\w+)\b|\bexport\s+(?:kubeconfig|helm_\w+)\b/i;
+const KUBE_NAME_RE = /^[^\s|,$`(){}%<>;&"']{1,253}$/;
+const NAMESPACE_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+function readKubeconfigs(files) {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const YAML = require('yaml');
+        const merged = { namespaces: new Map() };
+        let readAny = false;
+        for (const file of files) {
+            if (!fs.existsSync(file))
+                continue;
+            const doc = YAML.parse(fs.readFileSync(file, 'utf8'));
+            readAny = true;
+            if (!doc || typeof doc !== 'object')
+                continue;
+            // First file to set a value wins (kubectl's merge rule).
+            if (merged.current === undefined && typeof doc['current-context'] === 'string' && doc['current-context'])
+                merged.current = doc['current-context'];
+            for (const entry of Array.isArray(doc.contexts) ? doc.contexts : []) {
+                const name = entry && typeof entry.name === 'string' ? entry.name : undefined;
+                if (!name || merged.namespaces.has(name))
+                    continue;
+                const ns = entry.context && typeof entry.context.namespace === 'string' ? entry.context.namespace : undefined;
+                merged.namespaces.set(name, ns);
+            }
+        }
+        return readAny ? merged : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** `--kubeconfig`, else KUBECONFIG (a path list), else `~/.kube/config`. */
+function kubeDefaultsFrom(env) {
+    const filesFor = (kubeconfig) => kubeconfig
+        ? [kubeconfig]
+        : (env.KUBECONFIG || '').trim()
+            ? env.KUBECONFIG.split(path.delimiter).map(f => f.trim()).filter(Boolean)
+            : [path.join(os.homedir(), '.kube', 'config')];
+    const helmValue = (key) => (env[key] || '').trim() || undefined;
+    return {
+        helm: {
+            context: helmValue('HELM_KUBECONTEXT'),
+            namespace: helmValue('HELM_NAMESPACE'),
+            unknown: Boolean(helmValue('HELM_KUBEAPISERVER') || helmValue('HELM_KUBETOKEN') || helmValue('HELM_KUBEASUSER')),
+        },
+        context(kubeconfig) {
+            return readKubeconfigs(filesFor(kubeconfig))?.current || null;
+        },
+        namespace(context, kubeconfig) {
+            const config = readKubeconfigs(filesFor(kubeconfig));
+            if (!config || !config.namespaces.has(context))
+                return null;
+            return config.namespaces.get(context) || 'default';
+        },
+    };
+}
+function kubeHow(tool, verb, rest) {
+    const next = rest.map(w => (0, credentialGrant_1.unquote)(w).toLowerCase()).find(w => !w.startsWith('-')) || '';
+    if (tool === 'helm') {
+        if (HELM_LOCAL.has(verb))
+            return { how: 'read', local: true };
+        if (KUBE_DELETE_VERBS.has(verb))
+            return { how: 'delete' };
+        if (verb === 'list' || verb === 'ls' || verb === 'status' || verb === 'get' || verb === 'history')
+            return { how: 'read' };
+        if (KUBE_CHANGE_VERBS.has(verb))
+            return { how: 'change' };
+        return { how: `cmd:${verb}`, mutatesDefaults: true };
+    }
+    if (verb === 'config')
+        return KUBE_CONFIG_READ.has(next) ? { how: 'read', local: true } : { how: 'change', local: true, mutatesDefaults: true };
+    if (tool === 'oc' && verb === 'project')
+        return next ? { how: 'change', local: true, mutatesDefaults: true } : { how: 'read' };
+    if (KUBE_LOCAL.has(verb))
+        return { how: 'read', local: true };
+    if (verb === 'delete')
+        return { how: 'delete' };
+    if (verb === 'replace' && rest.some(w => (0, credentialGrant_1.unquote)(w) === '--force'))
+        return { how: 'delete' };
+    if (verb === 'auth' || verb === 'policy')
+        return { how: 'permissions' };
+    if (verb === 'certificate' && /^(?:approve|deny)$/.test(next))
+        return { how: 'permissions' };
+    if (verb === 'create' && /^(?:role|clusterrole|rolebinding|clusterrolebinding|token)$/.test(next))
+        return { how: 'permissions' };
+    if (tool === 'oc' && verb === 'adm' && next === 'policy')
+        return { how: 'permissions' };
+    if (KUBE_READ_VERBS.has(verb))
+        return { how: 'read' };
+    if (KUBE_EXEC_VERBS.has(verb))
+        return { how: 'exec' };
+    if (KUBE_CHANGE_VERBS.has(verb))
+        return { how: 'change' };
+    // A plugin (`kubectl ctx`, `kubectl ns`) can switch the context itself.
+    return { how: `cmd:${verb}`, mutatesDefaults: true };
+}
+function kubeUse(tool, argv, vars, defaults, defaultsUnreliable) {
+    let verb = '';
+    let verbAt = -1;
+    for (let k = 0; k < argv.length; k++) {
+        const bare = (0, credentialGrant_1.unquote)(argv[k]);
+        if (bare.startsWith('-')) {
+            if (KUBE_VALUED_GLOBALS.has(bare))
+                k++;
+            continue;
+        }
+        if (WORD_RE.test(bare.toLowerCase())) {
+            verb = bare.toLowerCase();
+            verbAt = k;
+        }
+        break;
+    }
+    if (!verb)
+        return { tool, how: 'read', mutatesDefaults: false };
+    const { how, local, mutatesDefaults = false } = kubeHow(tool, verb, argv.slice(verbAt + 1));
+    if (local)
+        return { tool, how, mutatesDefaults };
+    const words = [...argv];
+    const helm = tool === 'helm';
+    if (KUBE_TARGET_OVERRIDES.some(flag => (0, credentialGrant_1.flagValue)(words, [flag], vars) !== undefined) || (helm && defaults.helm.unknown))
+        return { tool, how, where: '?', mutatesDefaults };
+    const kubeconfigFlag = (0, credentialGrant_1.flagValue)(words, ['--kubeconfig'], vars);
+    if (kubeconfigFlag === null)
+        return { tool, how, where: '?', mutatesDefaults };
+    const contextFlag = (0, credentialGrant_1.flagValue)(words, helm ? ['--kube-context'] : ['--context'], vars);
+    const contextDefault = () => defaultsUnreliable ? null : (helm && defaults.helm.context) || defaults.context(kubeconfigFlag);
+    let context = contextFlag === undefined ? contextDefault() : contextFlag;
+    if (context && !KUBE_NAME_RE.test(context))
+        context = null;
+    let namespace;
+    if (words.some(w => /^(?:-A|--all-namespaces(?:=true)?)$/.test((0, credentialGrant_1.unquote)(w))))
+        namespace = '*';
+    else {
+        const glued = words.map(credentialGrant_1.unquote).find(w => /^-n[a-z0-9]/.test(w));
+        const nsFlag = glued ? (0, credentialGrant_1.literalWord)(glued.slice(2), vars) : (0, credentialGrant_1.flagValue)(words, ['-n', '--namespace'], vars);
+        const nsDefault = () => !context || defaultsUnreliable ? null : (helm && defaults.helm.namespace) || defaults.namespace(context, kubeconfigFlag);
+        namespace = nsFlag === undefined ? nsDefault() : nsFlag;
+    }
+    if (namespace && namespace !== '*' && !NAMESPACE_RE.test(namespace))
+        namespace = null;
+    const parts = [`context=${context || '?'}`, `namespace=${namespace || '?'}`];
+    if (kubeconfigFlag) {
+        const file = kubeconfigFlag.replace(/\\/g, '/');
+        parts.push(`kubeconfig=${UNSAFE_VALUE_RE.test(file) ? '?' : file}`);
+    }
+    return { tool, how, where: parts.join(','), mutatesDefaults };
+}
+/** kubectl / oc / helm uses on the line, in order. */
+function kubeUses(uses, command, dialect, vars, defaults) {
+    const argvs = uses.map(use => ({ tool: use.tool, argv: toolArgv(use.text, dialect, [use.tool]) }));
+    const lineSetsEnv = KUBE_ENV_ON_LINE_RE.test(command);
+    const first = argvs.map(({ tool, argv }) => kubeUse(tool, argv, vars, defaults, lineSetsEnv));
+    if (!first.some(use => use.mutatesDefaults))
+        return first;
+    return argvs.map(({ tool, argv }) => kubeUse(tool, argv, vars, defaults, true));
+}