pushary 1.9.93 → 1.9.94

package/dist/{chunk-OMN5UCMW.js → chunk-XERTD7VZ.js}

@@ -2062,7 +2062,7 @@ var operandTextsOf = (command) => command.args.flatMap((arg) => {
 });
 var positionalTextsOf = (command) => command.args.filter((arg) => parameterOf(arg) === null).map((arg) => arg.text);
 var firstOperandOf = (command, isSwitch) => command.args.find((arg) => !isSwitch.test(arg.text))?.text;
-var namesASecretPath = (text3, judge) => judge.namesASecretFile(fileNameOf(text3.trim()));
+var namesAPathThatNeedsAPerson = (text3, judge) => judge.namesAFileThatNeedsAPerson(text3.trim());
 var isAssignmentTarget = (word) => POWERSHELL_ASSIGNMENT_TARGET.test(word.text) || word.text === POWERSHELL_ARRAY_SEPARATOR;
 var wordsAfterAnAssignment = (words) => {
   const operator = words.findIndex((word) => isPowerShellAssignmentOperator(word));
@@ -2121,10 +2121,10 @@ var copyDestinationOf = (command) => {
 };
 var writesASecretFileFromPowerShell = (command, judge) => {
   if (command.cmdlet !== COPY_ITEM) {
-    return POWERSHELL_FILE_WRITERS.has(command.cmdlet) && operandTextsOf(command).some((text3) => namesASecretPath(text3, judge));
+    return POWERSHELL_FILE_WRITERS.has(command.cmdlet) && operandTextsOf(command).some((text3) => namesAPathThatNeedsAPerson(text3, judge));
   }
   const destination = copyDestinationOf(command);
-  return destination !== void 0 && namesASecretPath(destination, judge);
+  return destination !== void 0 && namesAPathThatNeedsAPerson(destination, judge);
 };
 var formatsADisk = (command) => DISK_ERASERS.has(command.cmdlet);
 var changesAWindowsService = (command) => {
@@ -2142,7 +2142,7 @@ var stageIsDestructive = (stage, judge) => {
 };
 var stageHasAVisibleConsequence = (stage, judge) => {
   const command = powerShellCommandOf(stage);
-  return stage.redirectTargets.some((target) => namesASecretPath(target.text, judge)) || command !== null && !onlyReads(command, judge) && powerShellCommandChangesSomething(command, judge);
+  return stage.redirectTargets.some((target) => namesAPathThatNeedsAPerson(target.text, judge)) || command !== null && !onlyReads(command, judge) && powerShellCommandChangesSomething(command, judge);
 };
 var fetchesWithPowerShell = (stage, judge) => {
   const command = powerShellCommandOf(stage);
@@ -4538,7 +4538,7 @@ var sqlClientChangesData = (invocation) => {
 var PULL_REQUEST_CLIS = /* @__PURE__ */ new Set(["gh", "glab"]);
 var PULL_REQUEST_NOUNS = /* @__PURE__ */ new Set(["pr", "mr"]);
 var MERGE_SUBCOMMAND = "merge";
-var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/\d+\/merge$/;
+var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/[^/\s]+\/merge(?:[?#]|$)/;
 var mergesAPullRequest = ({ program, args }) => {
   if (program === void 0 || !PULL_REQUEST_CLIS.has(basenameOf(program.text))) return false;
   const words = args.filter((arg) => !arg.text.startsWith("-"));
@@ -4594,13 +4594,127 @@ var DEPLOY_AND_SCHEMA_COMMAND_PATTERNS = [
   "Bash(gcloud run deploy:*)",
   "Bash(gcloud functions deploy:*)"
 ];
+var RELEASE_AND_CLUSTER_PROGRAMS = /* @__PURE__ */ new Set(["kubectl", "fastlane"]);
+var RELEASE_AND_CLUSTER_COMMAND_PATTERNS = [
+  "Bash(kubectl patch:*)",
+  "Bash(kubectl edit:*)",
+  "Bash(kubectl set:*)",
+  "Bash(kubectl create:*)",
+  "Bash(kubectl drain:*)",
+  "Bash(kubectl cordon:*)",
+  "Bash(kubectl taint:*)",
+  "Bash(fastlane deliver:*)",
+  "Bash(fastlane supply:*)",
+  "Bash(fastlane pilot upload:*)",
+  "Bash(fastlane upload_to_app_store:*)",
+  "Bash(fastlane upload_to_testflight:*)",
+  "Bash(fastlane upload_to_play_store:*)"
+];
+var SUBMITS_THE_BUILD_TO_A_STORE = /^--auto-submit(?:-with-profile)?(?:=|$)/;
+var EAS_PROGRAM = /^eas(?:-cli)?(?:@[\w.-]+)?$/;
+var EAS_COMMANDS_THAT_PUBLISH = /^(?:submit|deploy|update|update:(?:republish|rollback|roll-back-to-embedded)|channel:(?:edit|rollout))$/;
+var easCommandPublishes = (invocation) => {
+  const words = wordsOfInvocation(invocation);
+  return words.some((word, index) => EAS_PROGRAM.test(basenameOf(word.text)) && EAS_COMMANDS_THAT_PUBLISH.test(words[index + 1]?.text ?? ""));
+};
+var publishesAnAppBuild = (invocation) => invocation.args.some((arg) => SUBMITS_THE_BUILD_TO_A_STORE.test(arg.text)) || easCommandPublishes(invocation);
+var PUSHES_EVERY_TAG = /* @__PURE__ */ new Set(["--tags", "--follow-tags"]);
+var NAMES_A_TAG = /(?:^|:)\+?refs\/tags\/|^tag$|(?:^|:)v?\d+(?:\.\d+){1,3}$|(?:^|:)v?\d+\.\d+\.\d+[-+][\w.]+$|\/v\d+\.\d+\.\d+(?:\.\d+)?(?:[-+][\w.]+)?$|^v\$/;
+var TAG_HELD_IN_A_VARIABLE = /^v?\$\{?(?:\w+_)?(?:tag|version)(?:_name)?\}?$/i;
+var GIT_PUSH = "push";
+var pushesATag = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT) return false;
+  const [subcommand, ...rest] = argsAfterHarmlessGlobalFlags(args);
+  if (subcommand?.text !== GIT_PUSH) return false;
+  const operands = rest.filter((arg) => !FLAG.test(arg.text));
+  return rest.some((arg) => PUSHES_EVERY_TAG.has(arg.text)) || operands.slice(1).some((operand) => NAMES_A_TAG.test(operand.text) || TAG_HELD_IN_A_VARIABLE.test(operand.text));
+};
 var SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;
+var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/i;
+var AGENT_SETTINGS_FILE = new RegExp(String.raw`(?:^|/)(?:${[
+  String.raw`\.claude/settings(?:\.local)?\.json`,
+  String.raw`\.claude\.json`,
+  String.raw`\.codex/(?:config\.toml|hooks\.json)`,
+  String.raw`\.cursor/hooks\.json`,
+  String.raw`\.gemini/(?:settings\.json|config/hooks\.json)`,
+  String.raw`\.qwen/settings\.json`,
+  String.raw`\.factory/hooks\.json`,
+  String.raw`\.hermes/config\.ya?ml`,
+  String.raw`\.config/opencode/(?:opencode\.jsonc?|plugins?/.+)`,
+  String.raw`\.pushary(?:/.+)?`,
+  String.raw`\.git/hooks(?:/.+)?`,
+  String.raw`\.ssh(?:/(?!known_hosts(?:\.old)?$).+)?`
+].join("|")})$`, "i");
+var withoutDotSegments = (path) => {
+  const kept = [];
+  for (const segment of path.split("/")) {
+    if (segment === "..") kept.pop();
+    else if (segment !== "" && segment !== ".") kept.push(segment);
+  }
+  return `${path.startsWith("/") ? "/" : ""}${kept.join("/")}`;
+};
+var pathNeedsAPersonToChange = (path) => {
+  const written = withoutDotSegments(normalizeSeparators(path));
+  return SECRET_FILE_NAME.test(basenameOf(written)) || CI_WORKFLOW_FILE.test(written) || AGENT_SETTINGS_FILE.test(written);
+};
 var REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;
 var COPIES_ONTO_ITS_LAST_OPERAND = /* @__PURE__ */ new Set(["cp", "install", "ln", "rsync", "scp"]);
-var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate"]);
-var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl"]);
-var IN_PLACE_FLAG = /^(?:-[A-Za-z]*i|--in-place(?:=.*)?)$/;
-var namesASecretFile = (word) => word !== void 0 && SECRET_FILE_NAME.test(basenameOf(word.text));
+var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate", "sponge"]);
+var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl", "yq"]);
+var IN_PLACE_LONG_FLAG = /^--in-?place(?:=|$)/;
+var IN_PLACE_LETTER = "i";
+var SED_FLAGS_THAT_TAKE_THE_REST = /* @__PURE__ */ new Set(["e", "f", "l"]);
+var SHORT_FLAGS_THAT_TAKE_THE_REST = /* @__PURE__ */ new Map([
+  ["sed", SED_FLAGS_THAT_TAKE_THE_REST],
+  ["gsed", SED_FLAGS_THAT_TAKE_THE_REST],
+  ["perl", /* @__PURE__ */ new Set(["M", "m", "I", "e", "E", "x", "F", "C", "d", "D"])]
+]);
+var flagEditsInPlace = (program, flag) => {
+  if (IN_PLACE_LONG_FLAG.test(flag)) return true;
+  if (!SHORT_OPTIONS.test(flag)) return false;
+  const takesTheRest = SHORT_FLAGS_THAT_TAKE_THE_REST.get(program);
+  for (const letter of flag.slice(1)) {
+    if (letter === IN_PLACE_LETTER) return true;
+    if (takesTheRest?.has(letter) === true) return false;
+  }
+  return false;
+};
+var MOVE = "mv";
+var TARGET_DIRECTORY_FLAG = "-t";
+var TARGET_DIRECTORY_ASSIGNMENT = /^--target-directory=(.+)$/;
+var BRACE_ALTERNATIVES = /\{([^{},]*(?:,[^{},]*)+)\}/;
+var MAX_SPELLINGS_OF_A_WORD = 64;
+var hasABraceGroup = (spelling) => BRACE_ALTERNATIVES.test(spelling);
+var spellingsOfAWord = (word) => {
+  if (!word.plain) return [word];
+  let spellings = [word.text];
+  for (let index = spellings.findIndex(hasABraceGroup); index !== -1; index = spellings.findIndex(hasABraceGroup)) {
+    const spelling = spellings[index] ?? "";
+    const braces = BRACE_ALTERNATIVES.exec(spelling);
+    if (braces === null) return null;
+    const choices = (braces[1] ?? "").split(",");
+    if (spellings.length - 1 + choices.length > MAX_SPELLINGS_OF_A_WORD) return null;
+    spellings = [...spellings.slice(0, index), ...choices.map((choice) => spelling.replace(braces[0], choice)), ...spellings.slice(index + 1)];
+  }
+  return spellings.map((text3) => ({ ...word, text: text3 }));
+};
+var namesAFileThatNeedsAPerson = (word) => word !== void 0 && pathNeedsAPersonToChange(word.text);
+var RECURSIVE_COPY_FLAG = /^(?:-[A-Za-z]*[rRa][A-Za-z]*|--recursive|--archive)$/;
+var FOLDER_THAT_NEEDS_A_PERSON = new RegExp(String.raw`(?:^|/)(?:${[
+  String.raw`\.github/workflows`,
+  String.raw`\.claude`,
+  String.raw`\.codex`,
+  String.raw`\.cursor`,
+  String.raw`\.gemini`,
+  String.raw`\.qwen`,
+  String.raw`\.factory`,
+  String.raw`\.hermes`,
+  String.raw`\.pushary`,
+  String.raw`\.git/hooks`,
+  String.raw`\.ssh`,
+  String.raw`\.config/opencode(?:/plugins?)?`
+].join("|")})$`, "i");
+var folderNeedsAPersonToChange = (path) => FOLDER_THAT_NEEDS_A_PERSON.test(withoutDotSegments(normalizeSeparators(path)));
 var NETWORK_SENDERS = /* @__PURE__ */ new Set([
   "curl",
   "wget",
@@ -4618,16 +4732,46 @@ var NETWORK_SENDERS = /* @__PURE__ */ new Set([
   "rclone"
 ]);
 var FILE_REFERENCE_PREFIX = /^(?:[\w.-]+=)?@|^[\w.-]+:/;
-var namesASecretFileReference = (word) => SECRET_FILE_NAME.test(basenameOf(word.text.replace(FILE_REFERENCE_PREFIX, "")));
-var sendsASecretFile = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(namesASecretFileReference);
-var writesASecretFile = ({ program, args }) => {
+var referencesAFileThatNeedsAPerson = (word) => pathNeedsAPersonToChange(word.text.replace(FILE_REFERENCE_PREFIX, ""));
+var sendsAFileThatNeedsAPerson = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(referencesAFileThatNeedsAPerson);
+var targetDirectoryOf = (args) => {
+  const flag = args.findIndex((arg) => arg.text === TARGET_DIRECTORY_FLAG);
+  if (flag !== -1) return args[flag + 1]?.text;
+  return args.map((arg) => TARGET_DIRECTORY_ASSIGNMENT.exec(arg.text)?.[1]).find((directory) => directory !== void 0);
+};
+var copiesOntoAFileThatNeedsAPerson = (args, operands) => {
+  const targetDirectory = targetDirectoryOf(args);
+  const destination = targetDirectory ?? operands.at(-1)?.text;
+  if (destination === void 0) return false;
+  const sources = targetDirectory === void 0 ? operands.slice(0, -1) : operands.filter((operand) => operand.text !== targetDirectory);
+  const landingPaths = [destination, ...sources.map((source) => `${destination}/${basenameOf(source.text)}`)];
+  return landingPaths.some(pathNeedsAPersonToChange) || args.some((arg) => RECURSIVE_COPY_FLAG.test(arg.text)) && landingPaths.some(folderNeedsAPersonToChange);
+};
+var GIT_HOOKS_PATH_SETTING = /^core\.hookspath(?:=|$)/i;
+var GIT_ONE_COMMAND_SETTING_FLAG = "-c";
+var GIT_CONFIG_SUBCOMMAND = "config";
+var GIT_CONFIG_UNSET_FLAGS = /* @__PURE__ */ new Set(["--unset", "--unset-all"]);
+var changesWhereGitLooksForHooks = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT) return false;
+  const setting = args.findIndex((arg) => GIT_HOOKS_PATH_SETTING.test(arg.text));
+  if (setting === -1) return false;
+  if (args[setting - 1]?.text === GIT_ONE_COMMAND_SETTING_FLAG) return true;
+  return args.some((arg) => arg.text === GIT_CONFIG_SUBCOMMAND) && (args[setting + 1] !== void 0 || args.some((arg) => GIT_CONFIG_UNSET_FLAGS.has(arg.text)));
+};
+var writesAFileThatNeedsAPerson = ({ program, args }) => {
   if (program === void 0) return false;
-  if (sendsASecretFile({ program, args })) return true;
+  if (sendsAFileThatNeedsAPerson({ program, args })) return true;
   const name = basenameOf(program.text);
-  const operands = args.filter((arg) => !FLAG.test(arg.text));
-  if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return namesASecretFile(operands.at(-1));
-  if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
-  return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
+  const editsInPlace = EDITS_IN_PLACE.has(name) && args.some((arg) => flagEditsInPlace(name, arg.text));
+  if (!COPIES_ONTO_ITS_LAST_OPERAND.has(name) && !WRITES_EVERY_OPERAND.has(name) && !editsInPlace) return false;
+  const spelled = args.filter((arg) => !FLAG.test(arg.text)).map(spellingsOfAWord);
+  if (spelled.includes(null)) return true;
+  const operands = spelled.flatMap((words) => words ?? []);
+  if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return copiesOntoAFileThatNeedsAPerson(args, operands);
+  if (WRITES_EVERY_OPERAND.has(name)) {
+    return operands.some((operand) => namesAFileThatNeedsAPerson(operand) || folderNeedsAPersonToChange(operand.text)) || name === MOVE && copiesOntoAFileThatNeedsAPerson(args, operands);
+  }
+  return operands.some(namesAFileThatNeedsAPerson);
 };
 var GITHUB_COMMANDS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
   "search",
@@ -4733,7 +4877,7 @@ var AWS_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
   "--cli-binary-format"
 ]);
 var AWS_LOCAL_COMMANDS = /* @__PURE__ */ new Set(["configure", "help", "history", "sso", "login", "logout"]);
-var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help)(?:-|$)/;
+var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help|login|update-kubeconfig|start-query|stop-query|assume-role)(?:-|$)/;
 var AWS_S3_SERVICE = "s3";
 var AWS_S3_COPIES = /* @__PURE__ */ new Set(["cp", "sync"]);
 var S3_URL_PREFIX = "s3://";
@@ -4803,11 +4947,16 @@ var githubCommandOnlyReads = (noun, verb) => {
   const readVerbs = GITHUB_READ_COMMANDS.get(noun.text);
   return readVerbs !== void 0 && (verb === void 0 || readVerbs.has(verb.text));
 };
-var githubCliWrites = (args) => {
+var githubCommandWordsOf = (args) => {
   const meaningful = argsAfterHarmlessGlobalFlags(args);
   const [noun, verb] = positionalWordsOf(meaningful, GITHUB_OPTIONS_WITH_VALUES);
-  if (noun?.text === GITHUB_API_SUBCOMMAND) return githubApiRequestWrites(meaningful.slice(meaningful.indexOf(noun) + 1));
-  return !githubCommandOnlyReads(noun, verb);
+  return { meaningful, noun, verb };
+};
+var githubApiArgsOf = ({ meaningful, noun }) => noun === void 0 ? [] : meaningful.slice(meaningful.indexOf(noun) + 1);
+var githubCliWrites = (args) => {
+  const words = githubCommandWordsOf(args);
+  if (words.noun?.text === GITHUB_API_SUBCOMMAND) return githubApiRequestWrites(githubApiArgsOf(words));
+  return !githubCommandOnlyReads(words.noun, words.verb);
 };
 var stripeCliWrites = (args) => {
   const [command, operation] = positionalWordsOf(args, STRIPE_OPTIONS_WITH_VALUES);
@@ -4826,8 +4975,9 @@ var twilioCliWrites = (args) => {
   if (topic === void 0 || !topic.text.includes(TWILIO_TOPIC_SEPARATOR)) return false;
   return !TWILIO_READ_ACTIONS.has(topic.text.split(TWILIO_TOPIC_SEPARATOR).at(-1) ?? "");
 };
+var GITHUB_CLI = "gh";
 var REMOTE_API_CLI_WRITES = /* @__PURE__ */ new Map([
-  ["gh", githubCliWrites],
+  [GITHUB_CLI, githubCliWrites],
   ["stripe", stripeCliWrites],
   ["aws", awsCliWrites],
   ["twilio", twilioCliWrites]
@@ -4836,6 +4986,191 @@ var invocationWritesThroughARemoteApi = ({ program, args }) => {
   const writes = program === void 0 ? void 0 : REMOTE_API_CLI_WRITES.get(basenameOf(program.text));
   return writes !== void 0 && writes(args);
 };
+var GITHUB_REPO_NOUN = "repo";
+var GITHUB_EDIT_VERB = "edit";
+var GITHUB_CREATE_VERB = "create";
+var GITHUB_PUBLIC_OPTION = /^--public(?:=(?!false$).*)?$/;
+var GITHUB_VISIBILITY_OPTION = /^--visibility(?:=|$)/;
+var GITHUB_COMMANDS_WITH_A_CONSEQUENCE = /* @__PURE__ */ new Map([
+  ["secret", /* @__PURE__ */ new Set(["set"])],
+  ["variable", /* @__PURE__ */ new Set(["set"])],
+  [GITHUB_REPO_NOUN, /* @__PURE__ */ new Set(["archive", "rename"])],
+  ["ssh-key", /* @__PURE__ */ new Set(["add"])],
+  ["gpg-key", /* @__PURE__ */ new Set(["add"])]
+]);
+var HTTP_METHODS_THAT_CHANGE_A_RESOURCE = /* @__PURE__ */ new Set(["DELETE", "PUT", "PATCH"]);
+var GITHUB_API_ENDPOINTS_FOR_EVERYDAY_WORK = /(?:^|\/)(?:issues|pulls|comments|notifications|labels|assignees|reviews|reactions|requested_reviewers)(?:\/|$)/;
+var GITHUB_API_ENDPOINTS_THAT_PUBLISH = /(?:^|\/)(?:merges|releases|dispatches|transfer|keys|deployments|hooks|git\/refs)\/?$/;
+var GRAPHQL_QUERY_FIELD = /^query=/;
+var GRAPHQL_FIELD_WORDS_THAT_DELETE_OR_PUBLISH = /delete|archive|transfer|merge|branchprotectionrule/;
+var GRAPHQL_FIELDS_THAT_PUBLISH = /* @__PURE__ */ new Set([
+  "updaterepository",
+  "createref",
+  "updateref",
+  "updaterefs",
+  "createcommitonbranch"
+]);
+var WORDS_AND_THE_TEXT_BETWEEN = /(\W+)/;
+var OPENS_A_CALL = /^\s*\(/;
+var GRAPHQL_STRING = /"(?:[^"\\]|\\.)*"/g;
+var graphqlFieldsCalledIn = (query) => {
+  const parts = query.replace(GRAPHQL_STRING, '""').split(WORDS_AND_THE_TEXT_BETWEEN);
+  return parts.filter((part, index) => index % 2 === 0 && part !== "" && OPENS_A_CALL.test(parts[index + 1] ?? "")).map((field) => field.toLowerCase());
+};
+var graphqlFieldDeletesOrPublishes = (field) => GRAPHQL_FIELDS_THAT_PUBLISH.has(field) || GRAPHQL_FIELD_WORDS_THAT_DELETE_OR_PUBLISH.test(field);
+var SINGLE_SHORT_OPTION = /^-[A-Za-z]$/;
+var takesTheNextGithubApiWord = (text3) => GITHUB_API_LONG_OPTIONS_WITH_A_VALUE.has(text3) || SINGLE_SHORT_OPTION.test(text3) && GITHUB_API_SHORT_OPTIONS_WITH_A_VALUE.has(text3.charAt(1));
+var githubApiEndpointOf = (args) => (args.find((arg, index) => !FLAG.test(arg.text) && !takesTheNextGithubApiWord(args[index - 1]?.text ?? ""))?.text ?? "").replace(URL_QUERY_OR_FRAGMENT2, "");
+var graphqlQueriesOf = (options) => options.flatMap(({ name, value }) => value !== void 0 && GITHUB_API_BODY_OPTIONS.has(name) && GRAPHQL_QUERY_FIELD.test(value.text) ? [value] : []);
+var graphqlQueryHasAConsequence = (query) => query.expands || GITHUB_API_FILE_FIELD.test(query.text) || GRAPHQL_MUTATION.test(query.text) && graphqlFieldsCalledIn(query.text).some(graphqlFieldDeletesOrPublishes);
+var graphqlRequestHasAConsequence = (options) => {
+  const queries = graphqlQueriesOf(options);
+  return queries.length === 0 || queries.some(graphqlQueryHasAConsequence);
+};
+var HTTP_DELETE = "DELETE";
+var githubApiMethodHasAConsequence = (method, endpoint) => {
+  if (method.expands) return true;
+  const name = method.text.toUpperCase();
+  return name === HTTP_DELETE || HTTP_METHODS_THAT_CHANGE_A_RESOURCE.has(name) && !GITHUB_API_ENDPOINTS_FOR_EVERYDAY_WORK.test(endpoint);
+};
+var githubApiRequestHasAConsequence = (args) => {
+  const options = githubApiOptionsOf(args);
+  if (options === null) return true;
+  const endpoint = githubApiEndpointOf(args);
+  if (endpoint === GITHUB_GRAPHQL_ENDPOINT) return graphqlRequestHasAConsequence(options);
+  if (GITHUB_API_ENDPOINTS_THAT_PUBLISH.test(endpoint)) return githubApiRequestWrites(args);
+  const method = options.filter((option) => HTTP_METHOD_OPTIONS.has(option.name)).at(-1)?.value;
+  return method !== void 0 && githubApiMethodHasAConsequence(method, endpoint);
+};
+var githubCommandHasAConsequence = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GITHUB_CLI) return false;
+  const words = githubCommandWordsOf(args);
+  const { noun, verb } = words;
+  if (noun === void 0) return false;
+  if (noun.text === GITHUB_API_SUBCOMMAND) return githubApiRequestHasAConsequence(githubApiArgsOf(words));
+  if (noun.text === GITHUB_REPO_NOUN && verb?.text === GITHUB_EDIT_VERB) return words.meaningful.some((arg) => GITHUB_VISIBILITY_OPTION.test(arg.text));
+  if (noun.text === GITHUB_REPO_NOUN && verb?.text === GITHUB_CREATE_VERB) return words.meaningful.some((arg) => GITHUB_PUBLIC_OPTION.test(arg.text));
+  return verb !== void 0 && (GITHUB_COMMANDS_WITH_A_CONSEQUENCE.get(noun.text)?.has(verb.text) ?? false);
+};
+var STRIPE_CLI = "stripe";
+var STRIPE_LIVE_MODE = /^--live$|[sr]k_live_/;
+var STRIPE_API_KEY_OPTION = "--api-key";
+var STRIPE_API_KEY_HELD_IN_A_VARIABLE = /^(?:--api-key|STRIPE_API_KEY)=.*\$/;
+var stripeMayUseLiveData = (words) => words.some((word, index) => STRIPE_LIVE_MODE.test(word.text) || STRIPE_API_KEY_HELD_IN_A_VARIABLE.test(word.text) || word.expands && words[index - 1]?.text === STRIPE_API_KEY_OPTION);
+var writesThroughAServiceApi = (invocation) => {
+  const innermost = innermostInvocation(invocation);
+  const name = basenameOf(innermost.program?.text ?? "");
+  if (name === GITHUB_CLI) return false;
+  if (name === STRIPE_CLI && !stripeMayUseLiveData(wordsOfInvocation(invocation))) return false;
+  return invocationWritesThroughARemoteApi(innermost);
+};
+var NO_SHORT_OPTIONS = /* @__PURE__ */ new Set();
+var HTTP_CLIENT_SYNTAX = /* @__PURE__ */ new Map([
+  ["curl", {
+    bodyOption: /^--(?:data(?:-[a-z]+)?|json|form(?:-string)?|upload-file)(?:=|$)/,
+    methodOption: /^--request(?:=|$)/,
+    getOption: /^--get$/,
+    shortOptionsWithAValue: /* @__PURE__ */ new Set([..."AbcCdDeEFHKmoPQrtTuUwxXyYz"]),
+    shortBodyOptions: /* @__PURE__ */ new Set(["d", "F", "T"]),
+    shortMethodOption: "X",
+    shortGetOption: "G"
+  }],
+  ["wget", {
+    bodyOption: /^--(?:post-(?:data|file)|body-(?:data|file))(?:=|$)/,
+    methodOption: /^--method(?:=|$)/,
+    getOption: null,
+    shortOptionsWithAValue: NO_SHORT_OPTIONS,
+    shortBodyOptions: NO_SHORT_OPTIONS,
+    shortMethodOption: null,
+    shortGetOption: null
+  }]
+]);
+var SHORT_OPTIONS = /^-[^-]/;
+var optionValueAt = (args, index, attached) => {
+  const arg = args[index];
+  return attached === "" || arg === void 0 ? args[index + 1] : { ...arg, text: attached };
+};
+var readHttpRequest = (args, syntax) => {
+  let sendsABody = false;
+  let forcesAGet = false;
+  const methods = [];
+  args.forEach((arg, index) => {
+    if (LONG_OPTION.test(arg.text)) {
+      sendsABody ||= syntax.bodyOption.test(arg.text);
+      forcesAGet ||= syntax.getOption?.test(arg.text) ?? false;
+      const separator = arg.text.indexOf(FLAG_VALUE_SEPARATOR);
+      const method = syntax.methodOption.test(arg.text) ? optionValueAt(args, index, separator === -1 ? "" : arg.text.slice(separator + 1)) : void 0;
+      if (method !== void 0) methods.push(method);
+      return;
+    }
+    if (!SHORT_OPTIONS.test(arg.text)) return;
+    for (let position = 1; position < arg.text.length; position += 1) {
+      const letter = arg.text.charAt(position);
+      forcesAGet ||= letter === syntax.shortGetOption;
+      if (!syntax.shortOptionsWithAValue.has(letter)) continue;
+      sendsABody ||= syntax.shortBodyOptions.has(letter);
+      const method = letter === syntax.shortMethodOption ? optionValueAt(args, index, arg.text.slice(position + 1)) : void 0;
+      if (method !== void 0) methods.push(method);
+      return;
+    }
+  });
+  return { sendsABody, forcesAGet, methods };
+};
+var requestSendsData = ({ sendsABody, forcesAGet, methods }) => methods.length === 0 ? sendsABody && !forcesAGet : methods.some((method) => method.expands || !HTTP_READ_METHODS.has(method.text.toUpperCase()));
+var THIS_MACHINE_ADDRESS = /^(?:(?:https?:\/\/)?(?:(?:[\w-]+\.)*localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[::1\]|host\.docker\.internal)|https?:\/\/(?:10(?:\.\d{1,3}){3}|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}))(?::(?:\d+|\$\w+|\$\{[^}]*\}))?(?:[/?#]|$)/i;
+var ROUTES_THE_REQUEST_ELSEWHERE = /^(?:--(?:resolve|connect-to|proxy[\w.]*|preproxy|socks[\w-]*|config)(?:=|$)|-[A-Za-z]*[xK])/;
+var URL_WITH_A_SCHEME = /^[a-z][a-z\d+.-]*:\/\//i;
+var requestStaysOnThisMachine = (args) => {
+  if (args.some((arg) => ROUTES_THE_REQUEST_ELSEWHERE.test(arg.text))) return false;
+  const addresses = args.filter((arg) => !FLAG.test(arg.text) && (URL_WITH_A_SCHEME.test(arg.text) || THIS_MACHINE_ADDRESS.test(arg.text)));
+  return addresses.length > 0 && addresses.every((arg) => THIS_MACHINE_ADDRESS.test(arg.text));
+};
+var sendsDataOffThisMachine = ({ program, args }) => {
+  const syntax = program === void 0 ? void 0 : HTTP_CLIENT_SYNTAX.get(basenameOf(program.text));
+  return syntax !== void 0 && requestSendsData(readHttpRequest(args, syntax)) && !requestStaysOnThisMachine(args);
+};
+var KUBECTL = "kubectl";
+var KUBECTL_EXEC = "exec";
+var kubectlExecRunsMoreThanAReadOnlyCommand = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== KUBECTL) return false;
+  const endOfOptions = args.findIndex((arg) => arg.text === END_OF_OPTIONS3);
+  const kubectlWords = endOfOptions === -1 ? args : args.slice(0, endOfOptions);
+  if (!kubectlWords.some((arg) => arg.text === KUBECTL_EXEC)) return false;
+  const command = endOfOptions === -1 ? [] : args.slice(endOfOptions + 1);
+  return command.length === 0 || command.some((arg) => arg.expands) || !isSafeReadOnlyCommand(posixCommandOf(command.map((arg) => arg.text)));
+};
+var SSH = "ssh";
+var SSH_OPTION_LETTERS_WITH_A_VALUE = /* @__PURE__ */ new Set([..."BbcDEeFIiJLlmOoPpQRSWw"]);
+var SSH_SHORT_OPTION_CLUSTER = /^-[A-Za-z]+$/;
+var SSH_OPTION_THAT_RUNS_A_COMMAND = /(?:proxy|local|remote|knownhosts)command/i;
+var SSH_CONFIG_OPTION = "-o";
+var sshOptionTakesTheNextWord = (text3) => {
+  if (!SSH_SHORT_OPTION_CLUSTER.test(text3)) return false;
+  const letters = text3.slice(1);
+  const firstValueOption = [...letters].findIndex((letter) => SSH_OPTION_LETTERS_WITH_A_VALUE.has(letter));
+  return firstValueOption === letters.length - 1;
+};
+var sshOptionRunsACommand = (args) => args.some((arg, index) => (args[index - 1]?.text === SSH_CONFIG_OPTION || arg.text.startsWith(SSH_CONFIG_OPTION)) && SSH_OPTION_THAT_RUNS_A_COMMAND.test(arg.text));
+var sshRemoteCommandOf = (args) => {
+  let index = 0;
+  while (index < args.length) {
+    const text3 = args[index]?.text ?? "";
+    if (text3 === END_OF_OPTIONS3) {
+      index += 1;
+      break;
+    }
+    if (!FLAG.test(text3)) break;
+    index += sshOptionTakesTheNextWord(text3) ? 2 : 1;
+  }
+  return args.slice(index + 1);
+};
+var sshRunsMoreThanAReadOnlyCommand = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== SSH) return false;
+  if (sshOptionRunsACommand(args)) return true;
+  const command = sshRemoteCommandOf(args);
+  return command.length > 0 && (command.some((arg) => arg.expands) || !isSafeReadOnlyCommand(command.map((arg) => arg.text).join(" ")));
+};
+var changesSomethingHostedElsewhere = (invocation) => githubCommandHasAConsequence(invocation) || writesThroughAServiceApi(invocation) || sendsDataOffThisMachine(invocation) || kubectlExecRunsMoreThanAReadOnlyCommand(invocation) || sshRunsMoreThanAReadOnlyCommand(invocation);
 var segmentWritesThroughARemoteApi = (segment, depth) => {
   const innermost = innermostInvocation(segment.invocation);
   return invocationWritesThroughARemoteApi(innermost) || commandsNestedIn(innermost, inlineScriptsOf(innermost, segment.heredocs)).some((nested) => commandWritesThroughARemoteApiAt(nested, depth + 1));
@@ -4853,6 +5188,7 @@ var commandNeedsAPerson = (toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments === null || classifyDecisionRisk(readingTool, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(readingTool, segment)) || pipesIntoASqlClient(command) || shellDialectOf(toolName) === "powershell" && powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName));
 };
+var sessionGrantMustAskAbout = (toolName, command) => commandNeedsAPerson(toolName, command) || SHELL_DIALECT_BY_TOOL.has(toolName) && commandHasAVisibleConsequence(toolName, command);
 var VISIBLE_DATA_LOSS_PATTERNS = [
   "Bash(git branch -D:*)",
   "Bash(git branch --delete:*)",
@@ -5134,15 +5470,17 @@ var honoursPreviewFlags = ({ program, args }) => {
 };
 var onlyPreviews = (invocation) => invocation.program !== void 0 && honoursPreviewFlags(invocation) && invocation.args.some((arg) => !arg.expands && PREVIEW_FLAG.test(arg.text));
 var changesWhatIsDeployed = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (changesProduction(invocation) || mergesAPullRequest(invocation) || isCoveredByPolicy(DEPLOY_AND_SCHEMA_COMMAND_PATTERNS, toolName, normalized));
+var releasesOrChangesACluster = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (pushesATag(invocation) || publishesAnAppBuild(invocation) || RELEASE_AND_CLUSTER_PROGRAMS.has(basenameOf(invocation.program?.text ?? "")) && isCoveredByPolicy(RELEASE_AND_CLUSTER_COMMAND_PATTERNS, toolName, normalized));
 var invocationHasAVisibleConsequence = (toolName, invocation, depth) => {
   if (depth > MAX_CONSEQUENCE_DEPTH) return true;
   if (invocation.program === void 0) return false;
   const normalized = quotedInvocation(invocation);
   const innermost = innermostInvocation(invocation);
   const script = shellScriptOf(invocation);
-  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || writesASecretFile(invocation) || losesDataVisibly(toolName, invocation, normalized, depth) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1));
+  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || releasesOrChangesACluster(toolName, invocation, normalized) || writesAFileThatNeedsAPerson(invocation) || changesWhereGitLooksForHooks(invocation) || changesSomethingHostedElsewhere(invocation) || losesDataVisibly(toolName, invocation, normalized, depth) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1));
 };
 var RUNS_FETCHED_CODE = /(?:\$\(|`|<\()\s*(?:curl|wget)\b/;
+var RUNS_DECODED_CODE = /(?:^|[;&|(\s])(?:bash|sh|zsh|source|\.|python3?|node|ruby|perl)\s+(?:-[A-Za-z]+\s+)*["']?(?:<\(|\$\()[^)]*\b(?:base64|xxd|openssl)\b/;
 var FETCHING_PROGRAMS = /* @__PURE__ */ new Set(["curl", "wget"]);
 var READS_ITS_SCRIPT_FROM_STANDARD_INPUT = /^-[A-Za-z]*s[A-Za-z]*$/;
 var interpreterNameOf = (program) => basenameOf(program.text).replace(/\d+(?:\.\d+)*$/, "");
@@ -5162,7 +5500,79 @@ var runsADownloadedScript = (invocations) => {
 };
 var pipedSegmentsOf = (command) => (shellSegmentsReadingAPipe(commandForReading(command)) ?? []).map((segment) => innermostInvocation(invocationOf(withoutShellGrouping(segment))));
 var pipesIntoASqlClient = (command) => pipedSegmentsOf(command).some((invocation) => sqlClientSyntaxOf(invocation) !== void 0);
-var pipesFetchedCodeIntoAnInterpreter = (command, invocations) => invocations.some(fetches) && pipedSegmentsOf(command).some(runsWhatItReads);
+var DECODING_FLAGS_BY_PROGRAM = /* @__PURE__ */ new Map([
+  ["base64", /^(?:-[A-Za-z]*[dD]|--decode)$/],
+  ["xxd", /^-[A-Za-z]*r/],
+  ["openssl", /^-d$/]
+]);
+var decodes = (invocation) => {
+  const { program, args } = innermostInvocation(invocation);
+  const decodingFlags = program === void 0 ? void 0 : DECODING_FLAGS_BY_PROGRAM.get(basenameOf(program.text));
+  return decodingFlags !== void 0 && args.some((arg) => decodingFlags.test(arg.text));
+};
+var producesCodeTheCommandDoesNotShow = (invocation) => fetches(invocation) || decodes(invocation);
+var pipesHiddenCodeIntoAnInterpreter = (command, invocations) => invocations.some(producesCodeTheCommandDoesNotShow) && pipedSegmentsOf(command).some(runsWhatItReads);
+var CODE_THAT_DELETES_RECURSIVELY = /\b(?:rmtree|rimraf|rm_rf|rm_r|removedirs)\b|\b(?:rm|rmSync|remove|rmdir|rmdirSync)\s*\([^)]*recursive/;
+var CODE_THAT_DECODES = /\b(?:b64decode|atob|base64)\b/;
+var CODE_THAT_RUNS_CODE_IT_BUILDS = /(?<![.\w])(?:eval|exec)\s*\(/;
+var CODE_THAT_RUNS_COMMANDS = /\b(?:execSync|execFileSync|spawnSync|execFile|spawn|exec|child_process|subprocess|popen|Popen|system)\b/;
+var CODE_THAT_WRITES_A_FILE = /\b(?:writeFile|appendFile|copyFile|cpSync|renameSync|symlinkSync)\w*\s*\(|(?<![\w.])(?:cp|rename|symlink)\s*\(|\bfs(?:\.promises)?\.(?:cp|rename|symlink)\s*\(|\bshutil\.(?:copy\w*|move)\s*\(|\bos\.(?:rename|replace|symlink)\s*\(|\.write_(?:text|bytes)\s*\(|\bopen\s*\([^)]*,\s*['"`][wax]/;
+var CODE_STRING_LITERAL = /'([^'\\\n]*)'|"([^"\\\n]*)"|`([^`\\\n]*)`/g;
+var CODE_PATH_DIVISION = /'\s*\/\s*'/g;
+var DOUBLE_QUOTE2 = /"/g;
+var PATH_WITH_A_DOT = /\./;
+var LONGEST_PATH_SPELLED_IN_PARTS = 4;
+var SHELL_COMMAND_IN_A_STRING = /\S\s+\S/;
+var stringLiteralsOf = (code) => [...code.matchAll(CODE_STRING_LITERAL)].map((literal) => literal[1] ?? literal[2] ?? literal[3] ?? "");
+var pathsSpelledIn = (code) => {
+  const literals = stringLiteralsOf(code.replace(DOUBLE_QUOTE2, "'").replace(CODE_PATH_DIVISION, "/"));
+  return literals.flatMap((_, start) => Array.from({ length: Math.min(LONGEST_PATH_SPELLED_IN_PARTS, literals.length - start) }, (_2, extra) => literals.slice(start, start + extra + 1).join("/"))).filter((spelled) => PATH_WITH_A_DOT.test(spelled));
+};
+var commandsSpelledIn = (code) => [
+  ...stringLiteralsOf(code).filter((literal) => SHELL_COMMAND_IN_A_STRING.test(literal)),
+  ...code.split("\n").map((line) => stringLiteralsOf(line).join(" ")).filter((line) => SHELL_COMMAND_IN_A_STRING.test(line))
+];
+var INTERPRETERS_THAT_TAKE_INLINE_CODE = /* @__PURE__ */ new Set([...INLINE_CODE_INTERPRETERS, "bun", "deno", "tsx", "ts-node"]);
+var RUNNERS_OF_AN_INTERPRETER = /* @__PURE__ */ new Set([
+  "uv",
+  "poetry",
+  "pnpm",
+  "npm",
+  "yarn",
+  "bundle",
+  "pipenv",
+  "hatch",
+  "pdm",
+  "rye",
+  "conda",
+  "mamba"
+]);
+var isAnInterpreter = (word) => INTERPRETERS_THAT_TAKE_INLINE_CODE.has(interpreterNameOf(word));
+var interpreterInvocationOf = (invocation) => {
+  const innermost = innermostInvocation(invocation);
+  const { program, args } = innermost;
+  if (program === void 0) return [];
+  if (isAnInterpreter(program)) return [innermost];
+  if (!RUNNERS_OF_AN_INTERPRETER.has(basenameOf(program.text))) return [];
+  const start = args.findIndex(isAnInterpreter);
+  const interpreter = args[start];
+  return interpreter === void 0 ? [] : [{ program: interpreter, args: args.slice(start + 1) }];
+};
+var inlineCodeOf = ({ args }) => args.flatMap((arg, index) => {
+  const namesInlineCode = (FLAG.test(arg.text) || arg.text === INLINE_CODE_SUBCOMMAND) && arg.text !== STANDARD_INPUT_ARGUMENT;
+  if (!namesInlineCode || !passesInlineCode(arg.text)) return [];
+  const separator = arg.text.indexOf(FLAG_VALUE_SEPARATOR);
+  if (separator !== -1) return [arg.text.slice(separator + 1)];
+  const code = args[index + 1];
+  return code === void 0 ? [] : [code.text];
+});
+var interpreterCodeIn = (command, invocations) => {
+  const interpreters = invocations.flatMap(interpreterInvocationOf);
+  const heredocs = interpreters.some(runsWhatItReads) ? withHeredocBodiesSetAside(command).bodies : [];
+  return [...interpreters.flatMap(inlineCodeOf), ...heredocs];
+};
+var codeNeedsAPerson = (code, depth) => CODE_THAT_DELETES_RECURSIVELY.test(code) || CODE_THAT_RUNS_CODE_IT_BUILDS.test(code) && CODE_THAT_DECODES.test(code) || CODE_THAT_WRITES_A_FILE.test(code) && pathsSpelledIn(code).some(pathNeedsAPersonToChange) || CODE_THAT_RUNS_COMMANDS.test(code) && commandsSpelledIn(code).some((command) => commandHasAVisibleConsequenceAt(SHELL_TOOL, command, depth + 1));
+var runsInterpreterCodeThatNeedsAPerson = (command, invocations, depth) => interpreterCodeIn(command, invocations).some((code) => codeNeedsAPerson(code, depth));
 var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
 var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
 var GROUP_OPENER_BY_CLOSER = /* @__PURE__ */ new Map([[")", "("], ["}", "{"]]);
@@ -5201,7 +5611,7 @@ var withHeredocBodiesSetAside = (command) => {
 };
 var REDIRECTION_TARGET = String.raw`(?:'[^']*'|"[^"]*"|[^\s;|&()<>]+)`;
 var INPUT_REDIRECTION = new RegExp(String.raw`\d*(?:<<<|<(?![<(&>]))\s*${REDIRECTION_TARGET}`, "g");
-var OUTPUT_REDIRECTION = new RegExp(String.raw`(?:\d*|&)(?:>>?|>\||<>|>&|<&)\s*${REDIRECTION_TARGET}`, "g");
+var OUTPUT_REDIRECTION = new RegExp(String.raw`(?<!\d)(?:\d*|&)(?:>>?|>\||<>|>&|<&)\s*(${REDIRECTION_TARGET})`, "g");
 var REDIRECTED_INPUT_MARK = "\uE000";
 var ROUGH_SEPARATORS = ["&&", "||", "$(", "\n", ";", "|", "&", "`", "(", ")", "{", "}"];
 var SEPARATORS_INSIDE_DOUBLE_QUOTES = /* @__PURE__ */ new Set(["$(", "`", ")"]);
@@ -5243,6 +5653,10 @@ var invocationOfRoughPiece = (text3) => {
   const parsed = invocationOf(piece);
   return parsed.program !== void 0 ? parsed : invocationOf(piece.replace(QUOTE_CHARACTERS, ""));
 };
+var substitutionFedTo = (pieces, index) => {
+  const next = pieces[index + 1];
+  return next !== void 0 && SUBSTITUTION_OPENERS.has(next.before) ? next.text : null;
+};
 var roughSegmentsOf = (command) => {
   const { text: text3, bodies } = withHeredocBodiesSetAside(commandForReading(command));
   const pieces = roughPiecesOf(text3.replace(INPUT_REDIRECTION, ` ${REDIRECTED_INPUT_MARK} `).replace(OUTPUT_REDIRECTION, " "));
@@ -5251,34 +5665,88 @@ var roughSegmentsOf = (command) => {
     const heredocCount = occurrencesOf(piece.text, HEREDOC_MARK);
     const heredocs = bodies.slice(heredocsSeen, heredocsSeen + heredocCount);
     heredocsSeen += heredocCount;
+    const substitution = substitutionFedTo(pieces, index);
     return {
       invocation: invocationOfRoughPiece(piece.text),
       readsInput: piece.text.includes(REDIRECTED_INPUT_MARK) || heredocCount > 0 || piece.before === PIPE3,
       readsAPipe: piece.before === PIPE3,
-      feedsASubstitution: SUBSTITUTION_OPENERS.has(pieces[index + 1]?.before ?? ""),
+      feedsASubstitution: substitution !== null,
+      substitution,
+      evalRunsOneEnvironmentSetup: evalRunsOneEnvironmentSetup(pieces, index),
       heredocs
     };
   });
 };
-var roughSegmentHasAVisibleConsequence = (toolName, segment, fetchesCode, depth) => {
+var ENVIRONMENT_SETUP_COMMANDS = [
+  String.raw`fnm\s+env`,
+  String.raw`brew\s+shellenv`,
+  String.raw`(?:py|rb|nod|go|j)env\s+(?:virtualenv-)?init`,
+  String.raw`direnv\s+(?:export|hook)`,
+  "ssh-agent",
+  String.raw`mise\s+(?:activate|env)`,
+  String.raw`rtx\s+activate`,
+  String.raw`zoxide\s+init`,
+  String.raw`starship\s+init`,
+  String.raw`conda\s+shell\.\w+\s+hook`,
+  String.raw`minikube\s+docker-env`,
+  String.raw`docker-machine\s+env`,
+  String.raw`opam\s+env`,
+  String.raw`aws\s+configure\s+export-credentials`,
+  String.raw`poetry\s+env\s+activate`,
+  "dircolors",
+  String.raw`uv\s+generate-shell-completion`,
+  String.raw`fzf\s+--(?:zsh|bash)`,
+  String.raw`thefuck\s+--alias`,
+  String.raw`luarocks\s+path`,
+  String.raw`op\s+signin`,
+  String.raw`(?:gh|kubectl|helm|npm|pnpm|rustup|deno|bun)\s+completion`,
+  String.raw`(?:micro)?mamba\s+shell\s+hook`,
+  "path_helper"
+];
+var SETS_UP_THE_ENVIRONMENT = new RegExp(
+  String.raw`^\s*(?:[^\s()$\x60"';|&]*/)?(?:${ENVIRONMENT_SETUP_COMMANDS.join("|")})(?:\s[^()$\x60"';|&]*)?$`
+);
+var EVAL_BEFORE_ITS_ARGUMENT = /^\s*eval\s+["']?$/;
+var EVAL_AFTER_ITS_ARGUMENT = /^["']?\s*$/;
+var SUBSTITUTION_CLOSERS = /* @__PURE__ */ new Set([")", "`"]);
+var WHAT_MAY_FOLLOW_AN_EVAL = /* @__PURE__ */ new Set(["&&", "||", ";", "\n", "|", "&", ")", "}"]);
+var evalRunsOneEnvironmentSetup = (pieces, index) => {
+  const opening = pieces[index];
+  const substitution = pieces[index + 1];
+  const closing = pieces[index + 2];
+  const next = pieces[index + 3];
+  return opening !== void 0 && EVAL_BEFORE_ITS_ARGUMENT.test(opening.text) && substitution !== void 0 && SUBSTITUTION_OPENERS.has(substitution.before) && SETS_UP_THE_ENVIRONMENT.test(substitution.text) && closing !== void 0 && SUBSTITUTION_CLOSERS.has(closing.before) && EVAL_AFTER_ITS_ARGUMENT.test(closing.text) && (next === void 0 || WHAT_MAY_FOLLOW_AN_EVAL.has(next.before));
+};
+var roughSegmentHasAVisibleConsequence = (toolName, segment, producesHiddenCode, depth) => {
   const innermost = innermostInvocation(segment.invocation);
   const runsAHeredocScript = innermost.program !== void 0 && POSIX_SHELL_PROGRAMS.has(basenameOf(innermost.program.text));
-  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || segment.readsAPipe && fetchesCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1));
+  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || segment.substitution !== null && basenameOf(innermost.program?.text ?? "") === EVAL && !segment.evalRunsOneEnvironmentSetup || segment.readsAPipe && producesHiddenCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1));
 };
 var roughReadingHasAVisibleConsequence = (toolName, command, depth) => {
   const segments = roughSegmentsOf(command);
   const invocations = segments.map((segment) => segment.invocation);
-  const fetchesCode = invocations.some(fetches);
-  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, fetchesCode, depth)) || runsADownloadedScript(invocations);
+  const producesHiddenCode = invocations.some(producesCodeTheCommandDoesNotShow);
+  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, producesHiddenCode, depth)) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
 };
 var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
   if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
   const readable = withHeredocSubstitutionsAsQuotedText(command);
   if (classifyDecisionRisk(toolName, readable) === "destructive" || RUNS_FETCHED_CODE.test(readable) || REDIRECTS_INTO_A_SECRET_FILE.test(readable)) return true;
+  if (RUNS_DECODED_CODE.test(readable) || redirectsIntoAFileThatNeedsAPerson(command)) return true;
   const segments = readableCommandSegments(command);
   if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth);
   const invocations = segments.map((segment) => invocationOf(withoutShellGrouping(segment)));
-  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
+  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesHiddenCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
+};
+var REDIRECTION_OPERATOR_CHARACTER = /[<>]/;
+var redirectsIntoAFileThatNeedsAPerson = (command) => {
+  if (!REDIRECTION_OPERATOR_CHARACTER.test(command)) return false;
+  const text3 = withHeredocBodiesSetAside(commandForReading(command)).text;
+  const visible = shellVisibleText(text3);
+  return [...text3.matchAll(OUTPUT_REDIRECTION)].some((redirection) => {
+    const operator = (redirection.index ?? 0) + redirection[0].search(REDIRECTION_OPERATOR_CHARACTER);
+    return (visible === null || REDIRECTION_OPERATOR_CHARACTER.test(visible.charAt(operator))) && pathNeedsAPersonToChange((redirection[1] ?? "").replace(QUOTE_CHARACTERS, ""));
+  });
 };
 var posixCommandOf = (words) => words.map(asOneShellWord).join(" ");
 var posixShellJudgeFor = (toolName) => ({
@@ -5289,7 +5757,7 @@ var posixShellJudgeFor = (toolName) => ({
   fetches,
   runsWhatItReads,
   runsScripts,
-  namesASecretFile: (fileName) => SECRET_FILE_NAME.test(fileName)
+  namesAFileThatNeedsAPerson: pathNeedsAPersonToChange
 });
 var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : readingsThatCanAct(command).some((reading) => classifyDecisionRisk(toolNameForAPosixReading(toolName), reading) === "destructive");
 var commandHasAVisibleConsequence = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0);
@@ -6493,7 +6961,7 @@ var unmatchedPolicyOf = (config, toolName) => ({
   mode: config.defaultMode ?? "push_first",
   pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
 });
-var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && commandNeedsAPerson(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
+var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && sessionGrantMustAskAbout(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
 var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
@@ -6569,6 +7037,8 @@ var strictestScopeVerdict = (scope, paths) => {
 };
 var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
 var FULL_DEFER_MODES = /* @__PURE__ */ new Set(["plan", "auto", "dontAsk"]);
+var BYPASS_PERMISSION_MODE = "bypassPermissions";
+var isBypassPermissionMode = (permissionMode) => permissionMode === BYPASS_PERMISSION_MODE;
 var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
@@ -6580,7 +7050,7 @@ var shouldDeferToNativeMode = (permissionMode, toolName, options = {}) => {
   if (typeof permissionMode !== "string") return false;
   if (FULL_DEFER_MODES.has(permissionMode)) return true;
   if (permissionMode === "acceptEdits" && FILE_EDIT_TOOLS.has(toolName)) return true;
-  if (permissionMode === "bypassPermissions") return options.deferBypass === true;
+  if (isBypassPermissionMode(permissionMode)) return options.deferBypass === true;
   return false;
 };
 var AGENT_QUESTION_TOOL = "AskUserQuestion";
@@ -6660,6 +7130,17 @@ var PRETOOLUSE_GATED_TOOLS = [
 var PRETOOLUSE_HANDLED_TOOLS = /* @__PURE__ */ new Set([...PRETOOLUSE_GATED_TOOLS, ...ASKED_IN_EVERY_MODE_TOOLS]);
 var isPermissionRequestOwnedByPreToolUse = (toolName, permissionMode, defers = shouldDeferToNativeMode) => PRETOOLUSE_HANDLED_TOOLS.has(toolName) && (isAskedInEveryMode(toolName) || !defers(permissionMode, toolName));
 var CLAUDE_PRETOOLUSE_MATCHER = [...PRETOOLUSE_HANDLED_TOOLS].join("|");
+var LINE_BREAK = /[\r\n]/;
+var bypassModeCovers = (toolName, toolInput) => {
+  const arg = extractPolicyArg(toolName, toolInput);
+  if (SHELL_DIALECT_BY_TOOL.has(toolName)) {
+    return arg !== void 0 && !commandIsDestructive(toolName, arg) && !commandHasAVisibleConsequence(toolName, arg);
+  }
+  if (FILE_EDIT_TOOLS.has(toolName)) return arg !== void 0 && !LINE_BREAK.test(arg) && !fileEditNeedsAPerson(toolName, arg);
+  return mcpToolOnlyReads(toolName) && mcpToolInputOnlyReads(toolName, toolInput);
+};
+var aChosenRuleGovernsInEitherRepository = (input) => aChosenRuleGoverns(input) || input.sharedRepoKey !== void 0 && input.sharedRepoKey !== input.repoKey && aChosenRuleGoverns({ ...input, repoKey: input.sharedRepoKey });
+var bypassModeAllows = (input) => isBypassPermissionMode(input.permissionMode) && !isModeStateDegraded(input.modeState) && noModeOverrideIsActive(input) && input.deletesFiles !== true && input.toolInputs.length > 0 && input.toolInputs.every((toolInput) => bypassModeCovers(input.toolName, toolInput)) && !aChosenRuleGovernsInEitherRepository(input);
 var resolveGate = (input) => {
   const { modeState, config, toolName, toolInputs, cwd, sessionId } = input;
   const repoKey = input.sharedRepoKey ?? input.repoKey;
@@ -6677,8 +7158,9 @@ var resolveGate = (input) => {
   }
   const policy = resolvePolicyAcross(config, toolName, modeState.mode, toolInputs, cwd, repoKey, sessionId);
   const verdict = verdictForPolicy(policy);
-  const autoApproves = verdict === "allow";
   const autoDenies = verdict === "deny";
+  const allowedByBypassMode = !autoDenies && verdict !== "allow" && bypassModeAllows(input);
+  const autoApproves = verdict === "allow" || allowedByBypassMode;
   if (autoDenies) return { kind: "deny", policy, reason: `Denied by policy for ${policy.tool}` };
   if (isAskedInEveryMode(toolName)) return { kind: "gate", policy };
   if (isModeStateDegraded(modeState)) {
@@ -6692,7 +7174,7 @@ var resolveGate = (input) => {
     if (!scopeRequiresHuman(scopeVerdict)) {
       return {
         kind: "allow",
-        policy,
+        policy: allowedByBypassMode ? autoApprove(policy.tool) : policy,
         source: toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly" ? "allowlist" : "policy"
       };
     }
@@ -6718,7 +7200,7 @@ var SCOPE_BATCH_REASON = "This patch exceeds the agreed scope. Split it into sin
 var UNREADABLE_CALL_REASON = "Pushary could not read every target of this call. Use a supported command or a single-file edit.";
 var unapprovedScopeReason = (scopeReason) => `${scopeReason}. Nobody approved this path, so the change was refused.`;
 var NO_RESPONSE_REASON = "No response within timeout";
-var codexRaisesItsOwnPrompts = (permissionMode) => permissionMode !== "bypassPermissions";
+var codexRaisesItsOwnPrompts = (permissionMode) => !isBypassPermissionMode(permissionMode);
 var codexHasNoPromptOfItsOwn = (scopeReason, permissionMode) => scopeReason !== void 0 || !codexRaisesItsOwnPrompts(permissionMode);
 var CODEX_ASK_PASSES = { kind: "pass" };
 var codexAskUnanswered = (ask) => ({ kind: "deny", reason: unansweredRefusalReason(ask.paused) });
@@ -6743,9 +7225,7 @@ var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_B
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
 });
-var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/i;
-var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
-var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && namesASecretOrWorkflowFile(path);
+var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
 var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((toolInput) => {
   const path = extractPolicyArg(toolName, toolInput);
   return path !== void 0 && fileEditNeedsAPerson(toolName, path);