pushary 1.9.94 → 1.9.97

package/dist/{chunk-XERTD7VZ.js → chunk-WOFHN2IZ.js}

@@ -1942,6 +1942,8 @@ var POWERSHELL_FILE_WRITERS = /* @__PURE__ */ new Set([
   "start-bitstransfer"
 ]);
 var POWERSHELL_FETCHERS = /* @__PURE__ */ new Set(["invoke-webrequest", "invoke-restmethod", "start-bitstransfer"]);
+var POWERSHELL_WEB_REQUESTS = /* @__PURE__ */ new Set(["invoke-webrequest", "invoke-restmethod"]);
+var WEB_READ_METHODS = /* @__PURE__ */ new Set(["get", "head", "options"]);
 var DISK_ERASERS = /* @__PURE__ */ new Set(["format-volume", "clear-disk", "initialize-disk", "remove-partition", "format"]);
 var WINDOWS_SERVICE_CHANGERS = /* @__PURE__ */ new Set([
   "start-service",
@@ -2140,9 +2142,29 @@ var stageIsDestructive = (stage, judge) => {
   const command = powerShellCommandOf(stage);
   return DOTNET_RECURSIVE_DELETE.test(stage.source) || command !== null && (removesRecursively(command) || !onlyReads(command, judge) && judge.namesADestructiveAction(keywordTextOf(command)));
 };
+var LOOKS_LIKE_AN_ADDRESS = /^(?:[a-z][a-z\d+.-]*:\/\/|localhost\b|127\.|\[::1\])/i;
+var namesAWebRequestBody = (command) => command.args.some((arg) => {
+  const parameter = parameterOf(arg);
+  return namesTheParameter(parameter, "body", 1) || namesTheParameter(parameter, "infile", 2) || namesTheParameter(parameter, "form", 3);
+});
+var webRequestMethodOf = (command) => parameterValueOf(command, "method", 2) ?? parameterValueOf(command, "custommethod", 2);
+var SPLATTED_PARAMETERS = /^@\w+$/;
+var splatsItsParameters = (command) => command.args.some((arg) => !arg.quoted && SPLATTED_PARAMETERS.test(arg.text));
+var goesThroughAProxy = (command) => command.args.some((arg) => namesTheParameter(parameterOf(arg), "proxy", 5));
+var webRequestSendsData = (command) => {
+  const method = webRequestMethodOf(command);
+  if (splatsItsParameters(command)) return true;
+  return method === void 0 ? namesAWebRequestBody(command) : method.includes("$") || !WEB_READ_METHODS.has(method.toLowerCase());
+};
+var webRequestAddressesOf = (command) => {
+  if (splatsItsParameters(command) || goesThroughAProxy(command)) return [];
+  const uri = parameterValueOf(command, "uri", 2);
+  return uri === void 0 ? positionalTextsOf(command).filter((text3) => LOOKS_LIKE_AN_ADDRESS.test(text3)) : [uri];
+};
+var sendsAWebRequestThatNeedsAPerson = (command, judge) => POWERSHELL_WEB_REQUESTS.has(command.cmdlet) && judge.webRequestNeedsAPerson({ sendsData: webRequestSendsData(command), addresses: webRequestAddressesOf(command) });
 var stageHasAVisibleConsequence = (stage, judge) => {
   const command = powerShellCommandOf(stage);
-  return stage.redirectTargets.some((target) => namesAPathThatNeedsAPerson(target.text, judge)) || command !== null && !onlyReads(command, judge) && powerShellCommandChangesSomething(command, judge);
+  return stage.redirectTargets.some((target) => namesAPathThatNeedsAPerson(target.text, judge)) || command !== null && sendsAWebRequestThatNeedsAPerson(command, judge) || command !== null && !onlyReads(command, judge) && powerShellCommandChangesSomething(command, judge);
 };
 var fetchesWithPowerShell = (stage, judge) => {
   const command = powerShellCommandOf(stage);
@@ -4538,12 +4560,14 @@ var sqlClientChangesData = (invocation) => {
 var PULL_REQUEST_CLIS = /* @__PURE__ */ new Set(["gh", "glab"]);
 var PULL_REQUEST_NOUNS = /* @__PURE__ */ new Set(["pr", "mr"]);
 var MERGE_SUBCOMMAND = "merge";
-var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/[^/\s]+\/merge(?:[?#]|$)/;
+var PULL_REQUEST_MERGE_PATH = /(?:^|\/)pulls\/\d+\/merge$/;
+var PULL_REQUEST_MERGE_PATH_SPELLED_ANY_WAY = /(?:^|\/)pulls\/[^/\s]+\/merge(?:[?#]|$)/;
 var mergesAPullRequest = ({ program, args }) => {
   if (program === void 0 || !PULL_REQUEST_CLIS.has(basenameOf(program.text))) return false;
   const words = args.filter((arg) => !arg.text.startsWith("-"));
   return words.some((word, index) => PULL_REQUEST_NOUNS.has(word.text) && words[index + 1]?.text === MERGE_SUBCOMMAND) || args.some((arg) => PULL_REQUEST_MERGE_PATH.test(arg.text));
 };
+var mergesAPullRequestByAnyPath = ({ program, args }) => program !== void 0 && PULL_REQUEST_CLIS.has(basenameOf(program.text)) && args.some((arg) => PULL_REQUEST_MERGE_PATH_SPELLED_ANY_WAY.test(arg.text));
 var DEPLOY_AND_SCHEMA_COMMAND_PATTERNS = [
   "Bash(kubectl apply:*)",
   "Bash(kubectl replace:*)",
@@ -4622,12 +4646,15 @@ var PUSHES_EVERY_TAG = /* @__PURE__ */ new Set(["--tags", "--follow-tags"]);
 var NAMES_A_TAG = /(?:^|:)\+?refs\/tags\/|^tag$|(?:^|:)v?\d+(?:\.\d+){1,3}$|(?:^|:)v?\d+\.\d+\.\d+[-+][\w.]+$|\/v\d+\.\d+\.\d+(?:\.\d+)?(?:[-+][\w.]+)?$|^v\$/;
 var TAG_HELD_IN_A_VARIABLE = /^v?\$\{?(?:\w+_)?(?:tag|version)(?:_name)?\}?$/i;
 var GIT_PUSH = "push";
+var NAMES_A_MAJOR_VERSION_TAG = /(?:^|:)v\d+$/;
+var SETS_THE_UPSTREAM_BRANCH = /* @__PURE__ */ new Set(["-u", "--set-upstream"]);
 var pushesATag = ({ program, args }) => {
   if (program === void 0 || basenameOf(program.text) !== GIT) return false;
   const [subcommand, ...rest] = argsAfterHarmlessGlobalFlags(args);
   if (subcommand?.text !== GIT_PUSH) return false;
   const operands = rest.filter((arg) => !FLAG.test(arg.text));
-  return rest.some((arg) => PUSHES_EVERY_TAG.has(arg.text)) || operands.slice(1).some((operand) => NAMES_A_TAG.test(operand.text) || TAG_HELD_IN_A_VARIABLE.test(operand.text));
+  const pushesABranch = rest.some((arg) => SETS_THE_UPSTREAM_BRANCH.has(arg.text));
+  return rest.some((arg) => PUSHES_EVERY_TAG.has(arg.text)) || operands.slice(1).some((operand) => NAMES_A_TAG.test(operand.text) || TAG_HELD_IN_A_VARIABLE.test(operand.text) || !pushesABranch && NAMES_A_MAJOR_VERSION_TAG.test(operand.text));
 };
 var SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;
 var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/i;
@@ -4643,7 +4670,24 @@ var AGENT_SETTINGS_FILE = new RegExp(String.raw`(?:^|/)(?:${[
   String.raw`\.config/opencode/(?:opencode\.jsonc?|plugins?/.+)`,
   String.raw`\.pushary(?:/.+)?`,
   String.raw`\.git/hooks(?:/.+)?`,
-  String.raw`\.ssh(?:/(?!known_hosts(?:\.old)?$).+)?`
+  String.raw`\.git/config`,
+  String.raw`\.ssh(?:/(?!known_hosts(?:\.old)?$).+)?`,
+  String.raw`\.mcp\.json`,
+  String.raw`\.cursor/mcp\.json`,
+  String.raw`\.claude/hooks/.+`,
+  String.raw`pushary-(?:policy|mode)-[^/]*\.json`
+].join("|")})$`, "i");
+var HOME_DIRECTORY = String.raw`(?:~|\$HOME|\$\{HOME\}|(?:[A-Za-z]:)?/Users/[^/]+|/home/[^/]+|/root|/var/root)`;
+var FILE_THE_MACHINE_RUNS_LATER = new RegExp(String.raw`^(?:${[
+  String.raw`${HOME_DIRECTORY}/\.(?:zshrc|zshenv|zprofile|zlogin|zlogout|bashrc|bash_profile|bash_login|bash_logout|bash_aliases|profile)(?:\.[\w-]+)?`,
+  String.raw`${HOME_DIRECTORY}/\.gitconfig(?:[-._][\w.-]+)?`,
+  String.raw`${HOME_DIRECTORY}/\.p10k\.zsh`,
+  String.raw`${HOME_DIRECTORY}/\.(?:zsh|zshrc\.d|oh-my-zsh)/.+`,
+  String.raw`${HOME_DIRECTORY}/\.config/(?:fish/config\.fish|fish/conf\.d/.+|git/config|zsh/.+|systemd/user/.+)`,
+  String.raw`(?:.*/)?Library/Launch(?:Agents|Daemons)/[^/]+`,
+  String.raw`(?:.*/)?(?:Windows)?PowerShell/(?:Microsoft\.[\w.]+_)?profile\.ps1`,
+  String.raw`\$profile(?:\.\w+)?`,
+  String.raw`/(?:private/)?etc/.+`
 ].join("|")})$`, "i");
 var withoutDotSegments = (path) => {
   const kept = [];
@@ -4655,12 +4699,15 @@ var withoutDotSegments = (path) => {
 };
 var pathNeedsAPersonToChange = (path) => {
   const written = withoutDotSegments(normalizeSeparators(path));
-  return SECRET_FILE_NAME.test(basenameOf(written)) || CI_WORKFLOW_FILE.test(written) || AGENT_SETTINGS_FILE.test(written);
+  return SECRET_FILE_NAME.test(basenameOf(written)) || CI_WORKFLOW_FILE.test(written) || AGENT_SETTINGS_FILE.test(written) || FILE_THE_MACHINE_RUNS_LATER.test(written);
 };
 var REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;
 var COPIES_ONTO_ITS_LAST_OPERAND = /* @__PURE__ */ new Set(["cp", "install", "ln", "rsync", "scp"]);
-var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate", "sponge"]);
-var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl", "yq"]);
+var WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set(["mv", "tee", "rm", "unlink", "shred", "truncate"]);
+var EDITS_IN_PLACE = /* @__PURE__ */ new Set(["sed", "gsed", "perl"]);
+var IN_PLACE_FLAG = /^(?:-[A-Za-z]*i|--in-place(?:=.*)?)$/;
+var PERMISSIONS_OFF_WRITES_EVERY_OPERAND = /* @__PURE__ */ new Set([...WRITES_EVERY_OPERAND, "sponge"]);
+var PERMISSIONS_OFF_EDITS_IN_PLACE = /* @__PURE__ */ new Set([...EDITS_IN_PLACE, "yq"]);
 var IN_PLACE_LONG_FLAG = /^--in-?place(?:=|$)/;
 var IN_PLACE_LETTER = "i";
 var SED_FLAGS_THAT_TAKE_THE_REST = /* @__PURE__ */ new Set(["e", "f", "l"]);
@@ -4698,6 +4745,7 @@ var spellingsOfAWord = (word) => {
   }
   return spellings.map((text3) => ({ ...word, text: text3 }));
 };
+var namesASecretFile = (word) => word !== void 0 && SECRET_FILE_NAME.test(basenameOf(word.text));
 var namesAFileThatNeedsAPerson = (word) => word !== void 0 && pathNeedsAPersonToChange(word.text);
 var RECURSIVE_COPY_FLAG = /^(?:-[A-Za-z]*[rRa][A-Za-z]*|--recursive|--archive)$/;
 var FOLDER_THAT_NEEDS_A_PERSON = new RegExp(String.raw`(?:^|/)(?:${[
@@ -4712,7 +4760,8 @@ var FOLDER_THAT_NEEDS_A_PERSON = new RegExp(String.raw`(?:^|/)(?:${[
   String.raw`\.pushary`,
   String.raw`\.git/hooks`,
   String.raw`\.ssh`,
-  String.raw`\.config/opencode(?:/plugins?)?`
+  String.raw`\.config/opencode(?:/plugins?)?`,
+  String.raw`Library/Launch(?:Agents|Daemons)`
 ].join("|")})$`, "i");
 var folderNeedsAPersonToChange = (path) => FOLDER_THAT_NEEDS_A_PERSON.test(withoutDotSegments(normalizeSeparators(path)));
 var NETWORK_SENDERS = /* @__PURE__ */ new Set([
@@ -4732,6 +4781,17 @@ var NETWORK_SENDERS = /* @__PURE__ */ new Set([
   "rclone"
 ]);
 var FILE_REFERENCE_PREFIX = /^(?:[\w.-]+=)?@|^[\w.-]+:/;
+var namesASecretFileReference = (word) => SECRET_FILE_NAME.test(basenameOf(word.text.replace(FILE_REFERENCE_PREFIX, "")));
+var sendsASecretFile = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(namesASecretFileReference);
+var writesASecretFile = ({ program, args }) => {
+  if (program === void 0) return false;
+  if (sendsASecretFile({ program, args })) return true;
+  const name = basenameOf(program.text);
+  const operands = args.filter((arg) => !FLAG.test(arg.text));
+  if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return namesASecretFile(operands.at(-1));
+  if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
+  return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
+};
 var referencesAFileThatNeedsAPerson = (word) => pathNeedsAPersonToChange(word.text.replace(FILE_REFERENCE_PREFIX, ""));
 var sendsAFileThatNeedsAPerson = ({ program, args }) => program !== void 0 && NETWORK_SENDERS.has(basenameOf(program.text)) && args.some(referencesAFileThatNeedsAPerson);
 var targetDirectoryOf = (args) => {
@@ -4758,17 +4818,52 @@ var changesWhereGitLooksForHooks = ({ program, args }) => {
   if (args[setting - 1]?.text === GIT_ONE_COMMAND_SETTING_FLAG) return true;
   return args.some((arg) => arg.text === GIT_CONFIG_SUBCOMMAND) && (args[setting + 1] !== void 0 || args.some((arg) => GIT_CONFIG_UNSET_FLAGS.has(arg.text)));
 };
+var GIT_SETTING_THAT_RUNS_A_PROGRAM = new RegExp(`^(?:${[
+  String.raw`core\.(?:fsmonitor|sshcommand|pager|editor|askpass|gitproxy|alternaterefscommand|hookspath)`,
+  String.raw`pager\..+`,
+  String.raw`sequence\.editor`,
+  String.raw`diff\.external`,
+  String.raw`diff\..+\.(?:textconv|command)`,
+  String.raw`merge\..+\.driver`,
+  String.raw`(?:diff|merge)tool\..+\.(?:cmd|path)`,
+  String.raw`interactive\.difffilter`,
+  String.raw`gpg\.ssh\.defaultkeycommand`,
+  String.raw`uploadpack\.packobjectshook`,
+  String.raw`credential\.(?:.+\.)?helper`,
+  String.raw`gpg(?:\.[\w-]+)?\.program`,
+  String.raw`filter\..+\.(?:clean|smudge|process)`,
+  String.raw`remote\..+\.(?:uploadpack|receivepack)`,
+  String.raw`protocol\.(?:.+\.)?allow`,
+  String.raw`include\.path`,
+  String.raw`includeif\..+\.path`
+].join("|")})$`, "i");
+var SWITCHES_A_SETTING_ON_OR_OFF = /^(?:true|false|yes|no|on|off|0|1|never|)$/i;
+var GIT_INCLUDE_SETTING = /^include(?:if\..+)?\.path$/i;
+var GIT_CREDENTIAL_HELPER_SETTING = /^credential\.(?:.+\.)?helper$/i;
+var NAMES_A_KNOWN_CREDENTIAL_HELPER = /^(?:osxkeychain|store|cache|manager|manager-core|libsecret|wincred|gnome-keyring)(?:\s+--[\w-]+(?:=[\w./~:@%+,-]+)?)*$/i;
+var namesNoNewProgram = (setting, value) => !value.expands && !GIT_INCLUDE_SETTING.test(setting) && (SWITCHES_A_SETTING_ON_OR_OFF.test(value.text) || GIT_CREDENTIAL_HELPER_SETTING.test(setting) && NAMES_A_KNOWN_CREDENTIAL_HELPER.test(value.text));
+var GIT_SETTING_THAT_RUNS_A_COMMAND_AFTER_A_BANG = /^(?:alias\..+|submodule\..+\.update)$/i;
+var RUNS_A_SHELL_COMMAND = /^!/;
+var setsAGitSettingThatRunsAProgram = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT || !args.some((arg) => arg.text === GIT_CONFIG_SUBCOMMAND)) return false;
+  const operands = args.filter((arg) => !FLAG.test(arg.text));
+  const setting = operands.findIndex((arg) => GIT_SETTING_THAT_RUNS_A_PROGRAM.test(arg.text) || GIT_SETTING_THAT_RUNS_A_COMMAND_AFTER_A_BANG.test(arg.text));
+  const value = setting === -1 ? void 0 : operands[setting + 1];
+  const name = operands[setting]?.text ?? "";
+  if (value === void 0 || namesNoNewProgram(name, value)) return false;
+  return !GIT_SETTING_THAT_RUNS_A_COMMAND_AFTER_A_BANG.test(name) || value.expands || RUNS_A_SHELL_COMMAND.test(value.text);
+};
 var writesAFileThatNeedsAPerson = ({ program, args }) => {
   if (program === void 0) return false;
   if (sendsAFileThatNeedsAPerson({ program, args })) return true;
   const name = basenameOf(program.text);
-  const editsInPlace = EDITS_IN_PLACE.has(name) && args.some((arg) => flagEditsInPlace(name, arg.text));
-  if (!COPIES_ONTO_ITS_LAST_OPERAND.has(name) && !WRITES_EVERY_OPERAND.has(name) && !editsInPlace) return false;
+  const editsInPlace = PERMISSIONS_OFF_EDITS_IN_PLACE.has(name) && args.some((arg) => flagEditsInPlace(name, arg.text));
+  if (!COPIES_ONTO_ITS_LAST_OPERAND.has(name) && !PERMISSIONS_OFF_WRITES_EVERY_OPERAND.has(name) && !editsInPlace) return false;
   const spelled = args.filter((arg) => !FLAG.test(arg.text)).map(spellingsOfAWord);
   if (spelled.includes(null)) return true;
   const operands = spelled.flatMap((words) => words ?? []);
   if (COPIES_ONTO_ITS_LAST_OPERAND.has(name)) return copiesOntoAFileThatNeedsAPerson(args, operands);
-  if (WRITES_EVERY_OPERAND.has(name)) {
+  if (PERMISSIONS_OFF_WRITES_EVERY_OPERAND.has(name)) {
     return operands.some((operand) => namesAFileThatNeedsAPerson(operand) || folderNeedsAPersonToChange(operand.text)) || name === MOVE && copiesOntoAFileThatNeedsAPerson(args, operands);
   }
   return operands.some(namesAFileThatNeedsAPerson);
@@ -4877,7 +4972,8 @@ var AWS_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
   "--cli-binary-format"
 ]);
 var AWS_LOCAL_COMMANDS = /* @__PURE__ */ new Set(["configure", "help", "history", "sso", "login", "logout"]);
-var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help|login|update-kubeconfig|start-query|stop-query|assume-role)(?:-|$)/;
+var AWS_READ_OPERATION = /^(?:describe|list|get|head|batch-get|lookup|search|filter|scan|query|select|wait|validate|estimate|simulate|tail|ls|presign|help)(?:-|$)/;
+var AWS_SIGN_IN_OR_QUERY_OPERATION = /^(?:login|update-kubeconfig|start-query|stop-query|assume-role)(?:-|$)/;
 var AWS_S3_SERVICE = "s3";
 var AWS_S3_COPIES = /* @__PURE__ */ new Set(["cp", "sync"]);
 var S3_URL_PREFIX = "s3://";
@@ -4976,10 +5072,15 @@ var twilioCliWrites = (args) => {
   return !TWILIO_READ_ACTIONS.has(topic.text.split(TWILIO_TOPIC_SEPARATOR).at(-1) ?? "");
 };
 var GITHUB_CLI = "gh";
+var AWS_CLI = "aws";
+var awsOnlySignsInOrQueries = (args) => {
+  const [service, operation] = positionalWordsOf(args, AWS_OPTIONS_WITH_VALUES);
+  return service !== void 0 && service.text !== AWS_S3_SERVICE && operation !== void 0 && AWS_SIGN_IN_OR_QUERY_OPERATION.test(operation.text);
+};
 var REMOTE_API_CLI_WRITES = /* @__PURE__ */ new Map([
   [GITHUB_CLI, githubCliWrites],
   ["stripe", stripeCliWrites],
-  ["aws", awsCliWrites],
+  [AWS_CLI, awsCliWrites],
   ["twilio", twilioCliWrites]
 ]);
 var invocationWritesThroughARemoteApi = ({ program, args }) => {
@@ -4995,6 +5096,7 @@ var GITHUB_COMMANDS_WITH_A_CONSEQUENCE = /* @__PURE__ */ new Map([
   ["secret", /* @__PURE__ */ new Set(["set"])],
   ["variable", /* @__PURE__ */ new Set(["set"])],
   [GITHUB_REPO_NOUN, /* @__PURE__ */ new Set(["archive", "rename"])],
+  ["workflow", /* @__PURE__ */ new Set(["run", "enable", "disable"])],
   ["ssh-key", /* @__PURE__ */ new Set(["add"])],
   ["gpg-key", /* @__PURE__ */ new Set(["add"])]
 ]);
@@ -5062,6 +5164,7 @@ var writesThroughAServiceApi = (invocation) => {
   const name = basenameOf(innermost.program?.text ?? "");
   if (name === GITHUB_CLI) return false;
   if (name === STRIPE_CLI && !stripeMayUseLiveData(wordsOfInvocation(invocation))) return false;
+  if (name === AWS_CLI && awsOnlySignsInOrQueries(innermost.args)) return false;
   return invocationWritesThroughARemoteApi(innermost);
 };
 var NO_SHORT_OPTIONS = /* @__PURE__ */ new Set();
@@ -5164,13 +5267,210 @@ var sshRemoteCommandOf = (args) => {
   }
   return args.slice(index + 1);
 };
+var PLAIN_REMOTE_COMMAND = /^[\w ./:=,@%+-]+$/;
+var REMOTE_STATUS_COMMAND = new RegExp(`^(?:${[
+  String.raw`(?:uptime|free|who|w|nproc|lscpu|lsblk|last|lsof|netstat)`,
+  String.raw`docker (?:compose )?(?:ps|images|logs|inspect|stats|top|version|info)`,
+  String.raw`systemctl (?:status|is-active|is-enabled|is-failed|list-units|list-timers|show|cat)`,
+  String.raw`journalctl`
+].join("|")})(?: |$)`);
+var JOURNAL_CHANGING_OPTIONS = [
+  "vacuum-size",
+  "vacuum-time",
+  "vacuum-files",
+  "rotate",
+  "flush",
+  "sync",
+  "relinquish-var",
+  "smart-relinquish-var",
+  "setup-keys",
+  "update-catalog",
+  "cursor-file"
+];
+var JOURNAL_READ_OPTIONS_SHARING_A_PREFIX = /* @__PURE__ */ new Set(["cursor"]);
+var LONG_OPTION_NAME = /^--([\w-]+)/;
+var namesAJournalChangingOption = (word) => {
+  const name = LONG_OPTION_NAME.exec(word)?.[1];
+  return name !== void 0 && !JOURNAL_READ_OPTIONS_SHARING_A_PREFIX.has(name) && JOURNAL_CHANGING_OPTIONS.some((option) => option.startsWith(name));
+};
+var onlyReadsTheRemoteStatus = (command) => PLAIN_REMOTE_COMMAND.test(command) && REMOTE_STATUS_COMMAND.test(command) && !command.split(" ").some(namesAJournalChangingOption);
 var sshRunsMoreThanAReadOnlyCommand = ({ program, args }) => {
   if (program === void 0 || basenameOf(program.text) !== SSH) return false;
   if (sshOptionRunsACommand(args)) return true;
   const command = sshRemoteCommandOf(args);
-  return command.length > 0 && (command.some((arg) => arg.expands) || !isSafeReadOnlyCommand(command.map((arg) => arg.text).join(" ")));
+  const remote = command.map((arg) => arg.text).join(" ");
+  return command.length > 0 && (command.some((arg) => arg.expands) || !isSafeReadOnlyCommand(remote) && !onlyReadsTheRemoteStatus(remote));
+};
+var REMOTE_COPY_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Map([
+  ["scp", /* @__PURE__ */ new Set(["-c", "-D", "-F", "-i", "-J", "-l", "-o", "-P", "-S", "-X"])],
+  ["rsync", /* @__PURE__ */ new Set([
+    "-e",
+    "--rsh",
+    "--rsync-path",
+    "--exclude",
+    "--include",
+    "--filter",
+    "-f",
+    "--exclude-from",
+    "--include-from",
+    "--files-from",
+    "--chmod",
+    "--chown",
+    "--log-file",
+    "--password-file",
+    "--port",
+    "--timeout",
+    "--contimeout",
+    "--bwlimit",
+    "--max-size",
+    "--min-size",
+    "--max-delete",
+    "--backup-dir",
+    "--link-dest",
+    "--compare-dest",
+    "--copy-dest",
+    "--partial-dir",
+    "--temp-dir",
+    "-T",
+    "--suffix",
+    "--out-format",
+    "--iconv",
+    "--usermap",
+    "--groupmap",
+    "-M",
+    "--remote-option",
+    "--info",
+    "--debug",
+    "--skip-compress",
+    "--compress-level",
+    "--block-size",
+    "-B",
+    "--modify-window",
+    "--sockopts",
+    "--outbuf",
+    "--copy-as",
+    "--stop-at",
+    "--stop-after",
+    "--time-limit",
+    "--checksum-seed",
+    "--max-alloc",
+    "--early-input",
+    "--address",
+    "--write-batch",
+    "--read-batch",
+    "--only-write-batch"
+  ])]
+]);
+var SSHPASS = "sshpass";
+var SSHPASS_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set(["-p", "-f", "-d", "-P"]);
+var NAMES_ANOTHER_MACHINE = /^(?:(?:rsync|scp|sftp):\/\/|(?:[^\s/:@]+@)?[^\s/:@]+:)/i;
+var SHORT_OPTION_CLUSTER2 = /^-[A-Za-z]+$/;
+var clusterEndsWithAnOptionThatTakesAValue = (text3, withAValue) => {
+  const letters = text3.slice(1);
+  const firstWithAValue = [...letters].findIndex((letter) => withAValue.has(`-${letter}`));
+  return firstWithAValue === letters.length - 1;
+};
+var optionTakesTheNextWord = (text3, withAValue) => withAValue.has(text3) || SHORT_OPTION_CLUSTER2.test(text3) && clusterEndsWithAnOptionThatTakesAValue(text3, withAValue);
+var operandsAfterOptions = (args, withAValue) => {
+  const operands = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const text3 = args[index]?.text ?? "";
+    if (text3 === END_OF_OPTIONS3) return [...operands, ...args.slice(index + 1)];
+    if (!FLAG.test(text3)) operands.push(args[index]);
+    else if (optionTakesTheNextWord(text3, withAValue)) index += 1;
+  }
+  return operands;
+};
+var optionWordsOf = (args, withAValue) => {
+  const options = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const text3 = args[index]?.text ?? "";
+    if (text3 === END_OF_OPTIONS3) break;
+    if (!FLAG.test(text3)) continue;
+    options.push(text3);
+    if (optionTakesTheNextWord(text3, withAValue)) index += 1;
+  }
+  return options;
+};
+var withoutSshpass = (invocation) => {
+  if (invocation.program === void 0 || basenameOf(invocation.program.text) !== SSHPASS) return invocation;
+  const [program, ...args] = operandsAfterOptions(invocation.args, SSHPASS_OPTIONS_WITH_A_VALUE);
+  const start = program === void 0 ? -1 : invocation.args.indexOf(program);
+  return { program, args: start === -1 ? [] : invocation.args.slice(start + 1) };
+};
+var RSYNC = "rsync";
+var RSYNC_DRY_RUN = "--dry-run";
+var RSYNC_DRY_RUN_LETTER = "n";
+var RSYNC_REMOTE_SHELL_LETTER = "e";
+var RSYNC_NAMES_A_PROGRAM = /^--(?:rsh|rsync-path)(?:=|$)/;
+var clusterTurnsOn = (text3, letter, withAValue) => {
+  if (!SHORT_OPTION_CLUSTER2.test(text3)) return false;
+  for (const each of text3.slice(1)) {
+    if (each === letter) return true;
+    if (withAValue.has(`-${each}`)) return false;
+  }
+  return false;
+};
+var rsyncOnlyPreviews = (args, withAValue) => {
+  const options = optionWordsOf(args, withAValue);
+  return options.some((text3) => text3 === RSYNC_DRY_RUN || clusterTurnsOn(text3, RSYNC_DRY_RUN_LETTER, withAValue)) && !options.some((text3) => RSYNC_NAMES_A_PROGRAM.test(text3) || clusterTurnsOn(text3, RSYNC_REMOTE_SHELL_LETTER, withAValue));
+};
+var copiesOntoAnotherMachine = (invocation) => {
+  const { program, args } = withoutSshpass(invocation);
+  const name = program === void 0 ? void 0 : basenameOf(program.text);
+  const withAValue = name === void 0 ? void 0 : REMOTE_COPY_OPTIONS_WITH_A_VALUE.get(name);
+  if (withAValue === void 0 || name === RSYNC && rsyncOnlyPreviews(args, withAValue)) return false;
+  const operands = operandsAfterOptions(args, withAValue);
+  const destination = operands.at(-1);
+  return operands.length > 1 && destination !== void 0 && NAMES_ANOTHER_MACHINE.test(destination.text);
+};
+var HOSTED_SECRET_WRITES = /* @__PURE__ */ new Map([
+  ["doppler", /(?:^| )secrets (?:set|delete|upload)(?: |$)/],
+  ["vercel", /(?:^| )env (?:add|rm|remove|update)(?: |$)/],
+  ["fly", /(?:^| )secrets (?:set|unset|import|deploy)(?: |$)/],
+  ["flyctl", /(?:^| )secrets (?:set|unset|import|deploy)(?: |$)/],
+  ["heroku", /(?:^| )config:(?:set|unset|add|remove)(?: |$)/],
+  ["netlify", /(?:^| )env:(?:set|unset|import|clone)(?: |$)/],
+  ["railway", /(?:^| )variables? (?:set|delete)(?: |$)/],
+  ["supabase", /(?:^| )secrets (?:set|unset)(?: |$)/],
+  ["wrangler", /(?:^| )secret (?:put|delete|bulk)(?: |$)/],
+  ["firebase", /(?:^| )functions:secrets:(?:set|destroy|prune)(?: |$)/],
+  ["gcloud", /(?:^| )secrets (?:create|delete|update|versions (?:add|destroy|disable|enable))(?: |$)/],
+  ["az", /(?:^| )keyvault secret (?:set|set-attributes|delete|purge|recover|restore)(?: |$)/]
+]);
+var RAILWAY_CLI = "railway";
+var RAILWAY_VARIABLES = /(?:^| )variables?(?: |$)/;
+var RAILWAY_SET_FLAG = /^(?:--set(?:=|$)|-s$)/;
+var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "bunx", "pnpx", "pnpm", "yarn", "npm", "bun"]);
+var CLI_OF_A_PACKAGE = /* @__PURE__ */ new Map([
+  ["netlify-cli", "netlify"],
+  ["firebase-tools", "firebase"],
+  ["@railway/cli", "railway"],
+  ["@doppler/cli", "doppler"]
+]);
+var PACKAGE_VERSION = /(?<=.)@[^/@]*$/;
+var cliNameOf = (program) => {
+  const unversioned = program.text.replace(PACKAGE_VERSION, "");
+  return CLI_OF_A_PACKAGE.get(unversioned) ?? basenameOf(unversioned);
+};
+var namesAHostingCli = (word) => {
+  const name = cliNameOf(word);
+  return HOSTED_SECRET_WRITES.has(name) || name === RAILWAY_CLI;
+};
+var withoutAPackageRunner = (invocation) => {
+  const { program, args } = invocation;
+  if (program === void 0 || !PACKAGE_RUNNERS.has(basenameOf(program.text))) return invocation;
+  const start = args.findIndex((arg) => !FLAG.test(arg.text) && namesAHostingCli(arg));
+  return start === -1 ? invocation : { program: args[start], args: args.slice(start + 1) };
+};
+var writesAHostedSecret = (invocation) => {
+  const { program, args } = withoutAPackageRunner(invocation);
+  if (program === void 0) return false;
+  const name = cliNameOf(program);
+  const words = args.filter((arg) => !FLAG.test(arg.text)).map((arg) => arg.text.toLowerCase()).join(" ");
+  return (HOSTED_SECRET_WRITES.get(name)?.test(words) ?? false) || name === RAILWAY_CLI && RAILWAY_VARIABLES.test(words) && args.some((arg) => RAILWAY_SET_FLAG.test(arg.text));
 };
-var changesSomethingHostedElsewhere = (invocation) => githubCommandHasAConsequence(invocation) || writesThroughAServiceApi(invocation) || sendsDataOffThisMachine(invocation) || kubectlExecRunsMoreThanAReadOnlyCommand(invocation) || sshRunsMoreThanAReadOnlyCommand(invocation);
+var changesSomethingHostedElsewhere = (invocation) => githubCommandHasAConsequence(invocation) || writesThroughAServiceApi(invocation) || writesAHostedSecret(invocation) || sendsDataOffThisMachine(invocation) || copiesOntoAnotherMachine(invocation) || kubectlExecRunsMoreThanAReadOnlyCommand(invocation) || sshRunsMoreThanAReadOnlyCommand(invocation);
 var segmentWritesThroughARemoteApi = (segment, depth) => {
   const innermost = innermostInvocation(segment.invocation);
   return invocationWritesThroughARemoteApi(innermost) || commandsNestedIn(innermost, inlineScriptsOf(innermost, segment.heredocs)).some((nested) => commandWritesThroughARemoteApiAt(nested, depth + 1));
@@ -5188,7 +5488,6 @@ var commandNeedsAPerson = (toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments === null || classifyDecisionRisk(readingTool, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(readingTool, segment)) || pipesIntoASqlClient(command) || shellDialectOf(toolName) === "powershell" && powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName));
 };
-var sessionGrantMustAskAbout = (toolName, command) => commandNeedsAPerson(toolName, command) || SHELL_DIALECT_BY_TOOL.has(toolName) && commandHasAVisibleConsequence(toolName, command);
 var VISIBLE_DATA_LOSS_PATTERNS = [
   "Bash(git branch -D:*)",
   "Bash(git branch --delete:*)",
@@ -5300,12 +5599,12 @@ var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"
 var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
 var FIND = "find";
 var commandsRunByFind = ({ program, args }) => program === void 0 || basenameOf(program.text) !== FIND ? [] : args.flatMap((arg, index) => FIND_RUNNERS.has(arg.text) ? [{ program: args[index + 1], args: args.slice(index + 2, findRunnerEnd(args, index + 2)) }] : []);
-var losesDataVisibly = (toolName, invocation, normalized, depth) => {
+var losesDataVisibly = (toolName, invocation, normalized, depth, line) => {
   const { program, args } = invocation;
   if (program === void 0) return false;
   const name = basenameOf(program.text);
   if (name === FIND) {
-    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1));
+    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1, line));
   }
   const destructiveArguments = destructiveArgumentsOf(name, args);
   return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
@@ -5471,13 +5770,14 @@ var honoursPreviewFlags = ({ program, args }) => {
 var onlyPreviews = (invocation) => invocation.program !== void 0 && honoursPreviewFlags(invocation) && invocation.args.some((arg) => !arg.expands && PREVIEW_FLAG.test(arg.text));
 var changesWhatIsDeployed = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (changesProduction(invocation) || mergesAPullRequest(invocation) || isCoveredByPolicy(DEPLOY_AND_SCHEMA_COMMAND_PATTERNS, toolName, normalized));
 var releasesOrChangesACluster = (toolName, invocation, normalized) => !onlyPreviews(invocation) && (pushesATag(invocation) || publishesAnAppBuild(invocation) || RELEASE_AND_CLUSTER_PROGRAMS.has(basenameOf(invocation.program?.text ?? "")) && isCoveredByPolicy(RELEASE_AND_CLUSTER_COMMAND_PATTERNS, toolName, normalized));
-var invocationHasAVisibleConsequence = (toolName, invocation, depth) => {
+var invocationHasAConsequenceOnlyPermissionsOffAsksAbout = (toolName, invocation, normalized) => releasesOrChangesACluster(toolName, invocation, normalized) || mergesAPullRequestByAnyPath(invocation) || writesAFileThatNeedsAPerson(invocation) || changesWhereGitLooksForHooks(invocation) || setsAGitSettingThatRunsAProgram(invocation) || changesSomethingHostedElsewhere(invocation);
+var invocationHasAVisibleConsequence = (toolName, invocation, depth, line) => {
   if (depth > MAX_CONSEQUENCE_DEPTH) return true;
   if (invocation.program === void 0) return false;
   const normalized = quotedInvocation(invocation);
   const innermost = innermostInvocation(invocation);
   const script = shellScriptOf(invocation);
-  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || releasesOrChangesACluster(toolName, invocation, normalized) || writesAFileThatNeedsAPerson(invocation) || changesWhereGitLooksForHooks(invocation) || changesSomethingHostedElsewhere(invocation) || losesDataVisibly(toolName, invocation, normalized, depth) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1));
+  return classifyDecisionRisk(toolName, normalized) === "destructive" || changesWhatIsDeployed(toolName, invocation, normalized) || writesASecretFile(invocation) || line === "permissions_off" && invocationHasAConsequenceOnlyPermissionsOffAsksAbout(toolName, invocation, normalized) || losesDataVisibly(toolName, invocation, normalized, depth, line) || subcommandDestroysVisibly(invocation) || sqlClientChangesData(invocation) || innermost !== invocation && invocationHasAVisibleConsequence(toolName, innermost, depth, line) || script === null && passesAnInlineScript(invocation) || script !== null && commandHasAVisibleConsequenceAt(toolName, script, depth + 1, line) || readingsPastGlobalFlags(invocation).some((reading) => invocationHasAVisibleConsequence(toolName, reading, depth + 1, line));
 };
 var RUNS_FETCHED_CODE = /(?:\$\(|`|<\()\s*(?:curl|wget)\b/;
 var RUNS_DECODED_CODE = /(?:^|[;&|(\s])(?:bash|sh|zsh|source|\.|python3?|node|ruby|perl)\s+(?:-[A-Za-z]+\s+)*["']?(?:<\(|\$\()[^)]*\b(?:base64|xxd|openssl)\b/;
@@ -5511,7 +5811,7 @@ var decodes = (invocation) => {
   return decodingFlags !== void 0 && args.some((arg) => decodingFlags.test(arg.text));
 };
 var producesCodeTheCommandDoesNotShow = (invocation) => fetches(invocation) || decodes(invocation);
-var pipesHiddenCodeIntoAnInterpreter = (command, invocations) => invocations.some(producesCodeTheCommandDoesNotShow) && pipedSegmentsOf(command).some(runsWhatItReads);
+var pipesCodeIntoAnInterpreter = (command, invocations, producesCode) => invocations.some(producesCode) && pipedSegmentsOf(command).some(runsWhatItReads);
 var CODE_THAT_DELETES_RECURSIVELY = /\b(?:rmtree|rimraf|rm_rf|rm_r|removedirs)\b|\b(?:rm|rmSync|remove|rmdir|rmdirSync)\s*\([^)]*recursive/;
 var CODE_THAT_DECODES = /\b(?:b64decode|atob|base64)\b/;
 var CODE_THAT_RUNS_CODE_IT_BUILDS = /(?<![.\w])(?:eval|exec)\s*\(/;
@@ -5571,7 +5871,7 @@ var interpreterCodeIn = (command, invocations) => {
   const heredocs = interpreters.some(runsWhatItReads) ? withHeredocBodiesSetAside(command).bodies : [];
   return [...interpreters.flatMap(inlineCodeOf), ...heredocs];
 };
-var codeNeedsAPerson = (code, depth) => CODE_THAT_DELETES_RECURSIVELY.test(code) || CODE_THAT_RUNS_CODE_IT_BUILDS.test(code) && CODE_THAT_DECODES.test(code) || CODE_THAT_WRITES_A_FILE.test(code) && pathsSpelledIn(code).some(pathNeedsAPersonToChange) || CODE_THAT_RUNS_COMMANDS.test(code) && commandsSpelledIn(code).some((command) => commandHasAVisibleConsequenceAt(SHELL_TOOL, command, depth + 1));
+var codeNeedsAPerson = (code, depth) => CODE_THAT_DELETES_RECURSIVELY.test(code) || CODE_THAT_RUNS_CODE_IT_BUILDS.test(code) && CODE_THAT_DECODES.test(code) || CODE_THAT_WRITES_A_FILE.test(code) && pathsSpelledIn(code).some(pathNeedsAPersonToChange) || CODE_THAT_RUNS_COMMANDS.test(code) && commandsSpelledIn(code).some((command) => commandHasAVisibleConsequenceAt(SHELL_TOOL, command, depth + 1, "permissions_off"));
 var runsInterpreterCodeThatNeedsAPerson = (command, invocations, depth) => interpreterCodeIn(command, invocations).some((code) => codeNeedsAPerson(code, depth));
 var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
 var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
@@ -5717,26 +6017,29 @@ var evalRunsOneEnvironmentSetup = (pieces, index) => {
   const next = pieces[index + 3];
   return opening !== void 0 && EVAL_BEFORE_ITS_ARGUMENT.test(opening.text) && substitution !== void 0 && SUBSTITUTION_OPENERS.has(substitution.before) && SETS_UP_THE_ENVIRONMENT.test(substitution.text) && closing !== void 0 && SUBSTITUTION_CLOSERS.has(closing.before) && EVAL_AFTER_ITS_ARGUMENT.test(closing.text) && (next === void 0 || WHAT_MAY_FOLLOW_AN_EVAL.has(next.before));
 };
-var roughSegmentHasAVisibleConsequence = (toolName, segment, producesHiddenCode, depth) => {
+var evalRunsHiddenCode = (segment, innermost) => segment.substitution !== null && basenameOf(innermost.program?.text ?? "") === EVAL && !segment.evalRunsOneEnvironmentSetup;
+var roughSegmentHasAVisibleConsequence = (toolName, segment, producesHiddenCode, depth, line) => {
   const innermost = innermostInvocation(segment.invocation);
   const runsAHeredocScript = innermost.program !== void 0 && POSIX_SHELL_PROGRAMS.has(basenameOf(innermost.program.text));
-  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || segment.substitution !== null && basenameOf(innermost.program?.text ?? "") === EVAL && !segment.evalRunsOneEnvironmentSetup || segment.readsAPipe && producesHiddenCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1));
+  return invocationHasAVisibleConsequence(toolName, segment.invocation, depth, line) || sqlClientSyntaxOf(innermost) !== void 0 && (segment.readsInput || segment.feedsASubstitution) || line === "permissions_off" && evalRunsHiddenCode(segment, innermost) || segment.readsAPipe && producesHiddenCode && runsWhatItReads(innermost) || runsAHeredocScript && segment.heredocs.some((body) => commandHasAVisibleConsequenceAt(toolName, body, depth + 1, line));
 };
-var roughReadingHasAVisibleConsequence = (toolName, command, depth) => {
+var producesCodeTheLineCannotSee = (line) => line === "permissions_off" ? producesCodeTheCommandDoesNotShow : fetches;
+var roughReadingHasAVisibleConsequence = (toolName, command, depth, line) => {
   const segments = roughSegmentsOf(command);
   const invocations = segments.map((segment) => segment.invocation);
-  const producesHiddenCode = invocations.some(producesCodeTheCommandDoesNotShow);
-  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, producesHiddenCode, depth)) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
+  const producesHiddenCode = invocations.some(producesCodeTheLineCannotSee(line));
+  return segments.some((segment) => roughSegmentHasAVisibleConsequence(toolName, segment, producesHiddenCode, depth, line)) || runsADownloadedScript(invocations) || line === "permissions_off" && runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
 };
-var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
+var commandHidesWhatItWritesOrRuns = (command, readable) => RUNS_DECODED_CODE.test(readable) || redirectsIntoAFileThatNeedsAPerson(command);
+var commandHasAVisibleConsequenceAt = (toolName, command, depth, line) => {
   if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
   const readable = withHeredocSubstitutionsAsQuotedText(command);
   if (classifyDecisionRisk(toolName, readable) === "destructive" || RUNS_FETCHED_CODE.test(readable) || REDIRECTS_INTO_A_SECRET_FILE.test(readable)) return true;
-  if (RUNS_DECODED_CODE.test(readable) || redirectsIntoAFileThatNeedsAPerson(command)) return true;
+  if (line === "permissions_off" && commandHidesWhatItWritesOrRuns(command, readable)) return true;
   const segments = readableCommandSegments(command);
-  if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth);
+  if (segments === null) return roughReadingHasAVisibleConsequence(toolName, command, depth, line);
   const invocations = segments.map((segment) => invocationOf(withoutShellGrouping(segment)));
-  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesHiddenCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations) || runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
+  return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth, line)) || pipesIntoASqlClient(command) || pipesCodeIntoAnInterpreter(command, invocations, producesCodeTheLineCannotSee(line)) || runsADownloadedScript(invocations) || line === "permissions_off" && runsInterpreterCodeThatNeedsAPerson(command, invocations, depth);
 };
 var REDIRECTION_OPERATOR_CHARACTER = /[<>]/;
 var redirectsIntoAFileThatNeedsAPerson = (command) => {
@@ -5749,18 +6052,24 @@ var redirectsIntoAFileThatNeedsAPerson = (command) => {
   });
 };
 var posixCommandOf = (words) => words.map(asOneShellWord).join(" ");
-var posixShellJudgeFor = (toolName) => ({
+var webRequestSendsDataOffThisMachine = ({ sendsData, addresses }) => sendsData && !(addresses.length > 0 && addresses.every((address) => THIS_MACHINE_ADDRESS.test(address)));
+var noWebRequestNeedsAPerson = () => false;
+var namesASecretPowerShellPath = (path) => SECRET_FILE_NAME.test(fileNameOf(path));
+var posixShellJudgeFor = (toolName, line = "standing_allow") => ({
   namesADestructiveAction: (text3) => classifyDecisionRisk(toolName, text3) === "destructive",
-  invocationShowsAConsequence: (invocation) => invocationHasAVisibleConsequence(SHELL_TOOL, invocation, 0),
-  commandShowsAConsequence: (words) => commandHasAVisibleConsequenceAt(SHELL_TOOL, posixCommandOf(words), 1),
+  invocationShowsAConsequence: (invocation) => invocationHasAVisibleConsequence(SHELL_TOOL, invocation, 0, line),
+  commandShowsAConsequence: (words) => commandHasAVisibleConsequenceAt(SHELL_TOOL, posixCommandOf(words), 1, line),
   onlyReads: (words) => isSafeReadOnlyCommand(posixCommandOf(words)),
   fetches,
   runsWhatItReads,
   runsScripts,
-  namesAFileThatNeedsAPerson: pathNeedsAPersonToChange
+  namesAFileThatNeedsAPerson: line === "permissions_off" ? pathNeedsAPersonToChange : namesASecretPowerShellPath,
+  webRequestNeedsAPerson: line === "permissions_off" ? webRequestSendsDataOffThisMachine : noWebRequestNeedsAPerson
 });
 var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : readingsThatCanAct(command).some((reading) => classifyDecisionRisk(toolNameForAPosixReading(toolName), reading) === "destructive");
-var commandHasAVisibleConsequence = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0);
+var commandHasAConsequenceOnTheLine = (toolName, command, line) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName, line)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0, line);
+var commandHasAVisibleConsequence = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "standing_allow");
+var commandHasAConsequenceWithPermissionsOff = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "permissions_off");
 var MAX_SPELLING_DEPTH = 3;
 var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
   "-C",
@@ -6961,7 +7270,7 @@ var unmatchedPolicyOf = (config, toolName) => ({
   mode: config.defaultMode ?? "push_first",
   pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
 });
-var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && sessionGrantMustAskAbout(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
+var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && commandNeedsAPerson(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
 var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
@@ -7038,6 +7347,10 @@ var strictestScopeVerdict = (scope, paths) => {
 var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
 var FULL_DEFER_MODES = /* @__PURE__ */ new Set(["plan", "auto", "dontAsk"]);
 var BYPASS_PERMISSION_MODE = "bypassPermissions";
+var BYPASS_STOPS = ["consequences", "nothing"];
+var DEFAULT_BYPASS_STOPS = "consequences";
+var isBypassStops = (value) => typeof value === "string" && BYPASS_STOPS.includes(value);
+var bypassStopsOf = (config) => isBypassStops(config.bypassStops) ? config.bypassStops : DEFAULT_BYPASS_STOPS;
 var isBypassPermissionMode = (permissionMode) => permissionMode === BYPASS_PERMISSION_MODE;
 var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set([
   "Write",
@@ -7134,13 +7447,19 @@ var LINE_BREAK = /[\r\n]/;
 var bypassModeCovers = (toolName, toolInput) => {
   const arg = extractPolicyArg(toolName, toolInput);
   if (SHELL_DIALECT_BY_TOOL.has(toolName)) {
-    return arg !== void 0 && !commandIsDestructive(toolName, arg) && !commandHasAVisibleConsequence(toolName, arg);
+    return arg !== void 0 && !commandIsDestructive(toolName, arg) && !commandHasAConsequenceWithPermissionsOff(toolName, arg);
   }
-  if (FILE_EDIT_TOOLS.has(toolName)) return arg !== void 0 && !LINE_BREAK.test(arg) && !fileEditNeedsAPerson(toolName, arg);
+  if (FILE_EDIT_TOOLS.has(toolName)) return arg !== void 0 && !LINE_BREAK.test(arg) && !fileEditNeedsAPersonWithPermissionsOff(toolName, arg);
   return mcpToolOnlyReads(toolName) && mcpToolInputOnlyReads(toolName, toolInput);
 };
-var aChosenRuleGovernsInEitherRepository = (input) => aChosenRuleGoverns(input) || input.sharedRepoKey !== void 0 && input.sharedRepoKey !== input.repoKey && aChosenRuleGoverns({ ...input, repoKey: input.sharedRepoKey });
-var bypassModeAllows = (input) => isBypassPermissionMode(input.permissionMode) && !isModeStateDegraded(input.modeState) && noModeOverrideIsActive(input) && input.deletesFiles !== true && input.toolInputs.length > 0 && input.toolInputs.every((toolInput) => bypassModeCovers(input.toolName, toolInput)) && !aChosenRuleGovernsInEitherRepository(input);
+var aChosenRuleGovernsInEitherRepository = (input, counts = everyRule) => aChosenRuleGoverns(input, counts) || input.sharedRepoKey !== void 0 && input.sharedRepoKey !== input.repoKey && aChosenRuleGoverns({ ...input, repoKey: input.sharedRepoKey }, counts);
+var ruleAsksOrRefuses = (rule) => !isAutoApprove(rule);
+var bypassModeCoversEveryInput = (input) => input.deletesFiles !== true && input.toolInputs.every((toolInput) => bypassModeCovers(input.toolName, toolInput)) && !aChosenRuleGovernsInEitherRepository(input);
+var bypassModeApplies = (input) => isBypassPermissionMode(input.permissionMode) && !isModeStateDegraded(input.modeState) && noModeOverrideIsActive(input) && input.toolInputs.length > 0;
+var bypassModeAllows = (input) => bypassModeApplies(input) && (bypassStopsOf(input.config) === "nothing" ? !aChosenRuleGovernsInEitherRepository(input, ruleAsksOrRefuses) : bypassModeCoversEveryInput(input));
+var PERMISSIONS_OFF_ASK_REASON = "Permissions are off in your agent, so Pushary only stops for risky steps like this one. You can change this in Settings on pushary.com.";
+var permissionsOffLineAppliesTo = (agentType) => agentType === CLAUDE_CODE_AGENT_TYPE;
+var permissionsOffAskReason = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && !isAskedInEveryMode(input.toolName) && bypassModeApplies(input) && bypassStopsOf(input.config) === "consequences" && !aChosenRuleGovernsInEitherRepository(input) ? PERMISSIONS_OFF_ASK_REASON : void 0;
 var resolveGate = (input) => {
   const { modeState, config, toolName, toolInputs, cwd, sessionId } = input;
   const repoKey = input.sharedRepoKey ?? input.repoKey;
@@ -7225,7 +7544,9 @@ var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_B
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
 });
-var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
+var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
+var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && namesASecretOrWorkflowFile(path);
+var fileEditNeedsAPersonWithPermissionsOff = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && pathNeedsAPersonToChange(path);
 var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((toolInput) => {
   const path = extractPolicyArg(toolName, toolInput);
   return path !== void 0 && fileEditNeedsAPerson(toolName, path);
@@ -7294,14 +7615,16 @@ var approvalRoutesOf = (config) => {
   const routes = config.approvalRoutes ?? [];
   return Array.isArray(routes) && routes.every(isApprovalRoutePattern) ? routes : null;
 };
-var aChosenRuleGoverns = (input) => {
+var everyRule = () => true;
+var aChosenRuleGoverns = (input, counts = everyRule) => {
   const chosen = input.config.policies.filter((policy) => !isDefaultRule(policy));
   const routes = approvalRoutesOf(input.config);
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
     const reading = policyReadingOf(chosen, input.toolName, args);
-    return governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+    const governing = governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId);
+    return governing !== void 0 && counts(governing.policy) || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
 };
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
@@ -7493,6 +7816,7 @@ var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change bef
 var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
 var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
 var UNANSWERED_ASKS_BEFORE_PAUSE = 3;
+var CLAUDE_CODE_AGENT_TYPE = "claude_code";
 var SESSION_PAUSED_REASON = `Phone approvals for this session are paused because ${UNANSWERED_ASKS_BEFORE_PAUSE} of them went unanswered, so this was refused without asking anyone. A notification was sent to your phone: tap Approve on it to resume, then run this again.`;
 var unansweredRefusalReason = (paused) => paused ? SESSION_PAUSED_REASON : NO_RESPONSE_REASON;
 var UNHEARD_PUSH_WINDOW_DAYS = 14;
@@ -7840,6 +8164,8 @@ export {
   PRETOOLUSE_HANDLED_TOOLS,
   isPermissionRequestOwnedByPreToolUse,
   CLAUDE_PRETOOLUSE_MATCHER,
+  permissionsOffLineAppliesTo,
+  permissionsOffAskReason,
   resolveGate,
   editGoesToTheAgentsPrompt,
   SCOPE_BATCH_REASON,