safe-chains 0.60.0

# Supported Commands

Auto-generated by `safe-chains --list-commands`. These commands, subcommands, and flags are read-only and safe to run individually or in combination.

Any command with only `--version` or `--help` as its sole argument is always allowed.

### `R` (https://cran.r-project.org/manuals.html)

- CMD check <package> (with --as-cran, --no-tests, --no-examples, --no-vignettes, --no-build-vignettes, --no-manual, --output)
- CMD config <var>

### `Rscript` (https://cran.r-project.org/manuals.html)

- --version
- --help

### `agvtool` (https://developer.apple.com/library/archive/qa/qa1827/_index.html)

- **mvers**
- **vers**
- **what-marketing-version**
- **what-version**

### `arch` (https://www.gnu.org/software/coreutils/manual/coreutils.html#arch-invocation)

- Bare invocation allowed.

### `asdf` (https://asdf-vm.com/manage/commands.html)

- **current**
- **help**
- **info**
- **list**
- **plugin list**
- **plugin-list**
- **plugin-list-all**
- **version**
- **which**

### `awk / gawk / mawk / nawk` (https://www.gnu.org/software/gawk/manual/gawk.html)

- Program validated: system, getline, |, > constructs checked
- Allowed standalone flags: --characters-as-bytes, --copyright, --gen-pot, --lint, --no-optimize, --optimize, --posix, --re-interval, --sandbox, --traditional, --use-lc-numeric, --version, -C, -N, -O, -P, -S, -V, -b, -c, -g, -r, -s, -t
- Allowed valued flags: --assign, --field-separator, -F, -v

### `b2sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#b2sum-invocation)

- Allowed standalone flags: --binary, --check, --ignore-missing, --quiet, --status, --strict, --tag, --text, --warn, --zero, -b, -c, -t, -w, -z
- Allowed valued flags: --length, -l
- Bare invocation allowed

### `base64` (https://www.gnu.org/software/coreutils/manual/coreutils.html#base64-invocation)

- Allowed standalone flags: --decode, --ignore-garbage, -D, -d, -i
- Allowed valued flags: --wrap, -b, -w
- Bare invocation allowed

### `basename` (https://www.gnu.org/software/coreutils/manual/coreutils.html#basename-invocation)

- Allowed standalone flags: --multiple, --zero, -a, -z
- Allowed valued flags: --suffix, -s

### `bash / sh` (https://www.gnu.org/software/bash/manual/bash.html)

- Allowed: --version, --help, `bash -c` / `sh -c` with a safe inner command.

### `bat` (https://github.com/sharkdp/bat#readme)

- Allowed standalone flags: --diff, --list-languages, --list-themes, --no-config, --number, --plain, --show-all, -A, -P, -d, -n, -p, -u
- Allowed valued flags: --color, --decorations, --diff-context, --file-name, --highlight-line, --italic-text, --language, --line-range, --map-syntax, --paging, --style, --tabs, --terminal-width, --theme, --wrap, -H, -l, -m, -r
- Bare invocation allowed

### `bc` (https://www.gnu.org/software/bc/manual/html_mono/bc.html)

- Allowed standalone flags: --digit-clamp, --global-stacks, --interactive, --mathlib, --no-digit-clamp, --no-line-length, --no-prompt, --no-read-prompt, --quiet, --standard, --warn, -C, -P, -R, -c, -g, -i, -l, -q, -s, -w
- Allowed valued flags: --expression, --file, --ibase, --obase, --redefine, --scale, --seed, -E, -I, -O, -S, -e, -f, -r
- Bare invocation allowed

### `branchdiff` (https://github.com/nickolasburr/branchdiff#readme)

- Bare invocation allowed

### `brew` (https://docs.brew.sh/Manpage)

- **--prefix**
- **abv**: Flags: --analytics, --cask, --formula, --installed, --json. Valued: --days
- **casks**
- **cat**
- **config**
- **deps**: Flags: --1, --annotate, --cask, --direct, --for-each, --formula, --full-name, --graph, --include-build, --include-optional, --include-test, --installed, --missing, --skip-recommended, --tree, --union
- **desc**: Flags: --cask, --description, --eval-all, --formula, --name, --search
- **doctor**
- **formulae**
- **home**
- **info**: Flags: --analytics, --cask, --formula, --installed, --json. Valued: --days
- **leaves**
- **list**: Flags: --cask, --formula, --full-name, --multiple, --pinned, --versions
- **log**: Flags: --cask, --formula, --oneline. Valued: --max-count
- **ls**: Flags: --cask, --formula, --full-name, --multiple, --pinned, --versions
- **outdated**: Flags: --cask, --fetch-HEAD, --formula, --greedy, --greedy-auto-updates, --greedy-latest, --json
- **search**: Flags: --cask, --closed, --debian, --desc, --fedora, --fink, --formula, --macports, --open, --opensuse, --pull-request, --repology, --ubuntu
- **shellenv**
- **tap**
- **uses**: Flags: --cask, --formula, --include-build, --include-optional, --include-test, --installed, --missing, --recursive, --skip-recommended

### `bun` (https://bun.sh/docs/cli)

- **outdated**
- **pm bin**
- **pm cache**
- **pm hash**
- **pm ls**
- **test**: Flags: --bail, --only, --rerun-each, --todo. Valued: --preload, --timeout
- **x**: x delegates to bunx logic.

### `bundle` (https://bundler.io/man/bundle.1.html)

- **check**: Flags: --dry-run. Valued: --gemfile, --path
- **exec**: exec allowed for: brakeman, cucumber, erb_lint, herb, rspec, standardrb.
- **info**: Flags: --path
- **list**: Flags: --name-only, --paths
- **show**: Flags: --paths

### `bunx` (https://bun.sh/docs/cli/bunx)

- Allowed packages: @herb-tools/linter, eslint, karma.
- tsc allowed with --noEmit.
- Skips flags: --bun/--no-install/--package/-p.

### `cal` (https://man7.org/linux/man-pages/man1/cal.1.html)

- Allowed standalone flags: --monday, --sunday, --three, --year, -1, -3, -h, -j, -m, -s, -w, -y
- Allowed valued flags: -A, -B, -d, -n
- Bare invocation allowed

### `cargo` (https://doc.rust-lang.org/cargo/commands/)

- **audit**: Flags: --deny, --json, --no-fetch, --stale. Valued: --color, --db, --file, --ignore, --target-arch, --target-os
- **bench**: Flags: --all-features, --all-targets, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-fail-fast, --no-run, --offline, --release, --timings, --unit-graph. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test
- **build**: Flags: --all-features, --all-targets, --build-plan, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --offline, --release, --timings, --unit-graph. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test
- **check**: Flags: --all-features, --all-targets, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --offline, --release, --timings, --unit-graph. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test
- **clippy**: Flags: --all-features, --all-targets, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-deps, --offline, --release, --timings, --unit-graph. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test
- **deny**: Flags: --all-features, --no-default-features. Valued: --color, --config, --exclude, --features, --format, --manifest-path, --target, --workspace
- **doc**: Flags: --all-features, --document-private-items, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --locked, --no-default-features, --no-deps, --offline, --open, --release, --timings, --unit-graph. Valued: --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir
- **fmt** (requires --check): Flags: --all, --check. Valued: --manifest-path, --message-format, --package
- **info**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --index, --registry
- **license**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --manifest-path
- **locate-project**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --manifest-path
- **metadata**: Flags: --all-features, --frozen, --locked, --no-default-features, --no-deps, --offline. Valued: --color, --config, --features, --filter-platform, --format-version, --manifest-path
- **package** (requires --list): Flags: --all-features, --frozen, --keep-going, --list, --locked, --no-default-features, --no-metadata, --offline, --workspace. Valued: --color, --config, --exclude, --features, --jobs, --manifest-path, --message-format, --package, --target, --target-dir
- **pkgid**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --manifest-path
- **publish** (requires --dry-run): Flags: --all-features, --dry-run, --frozen, --keep-going, --locked, --no-default-features, --offline, --workspace. Valued: --color, --config, --exclude, --features, --index, --jobs, --manifest-path, --package, --registry, --target, --target-dir
- **read-manifest**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --manifest-path
- **search**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --index, --limit, --registry
- **test**: Flags: --all-features, --all-targets, --doc, --frozen, --future-incompat-report, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-fail-fast, --no-run, --offline, --release, --timings, --unit-graph. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test
- **tree**: Flags: --all-features, --duplicates, --frozen, --ignore-rust-version, --locked, --no-dedupe, --no-default-features, --offline. Valued: --charset, --color, --config, --depth, --edges, --features, --format, --invert, --manifest-path, --package, --prefix, --prune, --target
- **verify-project**: Flags: --frozen, --locked, --offline. Valued: --color, --config, --manifest-path

+toolchain selectors (e.g. +nightly) are skipped.

### `cat` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cat-invocation)

- Allowed standalone flags: --number, --number-nonblank, --show-all, --show-ends, --show-nonprinting, --show-tabs, --squeeze-blank, -A, -E, -T, -b, -e, -l, -n, -s, -t, -u, -v
- Bare invocation allowed

### `cd` (https://man7.org/linux/man-pages/man1/cd.1p.html)

- Allowed standalone flags: -L, -P, -e
- Bare invocation allowed

### `cksum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cksum-invocation)

- Allowed standalone flags: --base64, --check, --raw, --strict, --tag, --untagged, --warn, --zero, -c, -w, -z
- Allowed valued flags: --algorithm, --length, -a, -l
- Bare invocation allowed

### `cloc` (https://github.com/AlDanial/cloc#readme)

- Allowed standalone flags: --3, --autoconf, --by-file, --by-file-by-lang, --by-percent, --categorized, --counted, --diff, --diff-list-file, --docstring-as-code, --follow-links, --force-lang-def, --found-langs, --git, --hide-rate, --ignored, --include-content, --json, --md, --no-autogen, --no3, --opt-match-d, --opt-match-f, --opt-not-match-d, --opt-not-match-f, --original-dir, --progress-rate, --quiet, --sdir, --show-ext, --show-lang, --show-os, --show-stored-lang, --skip-uniqueness, --sql-append, --strip-comments, --sum-one, --sum-reports, --unicode, --use-sloccount, --v, --vcs, --xml, --yaml
- Allowed valued flags: --config, --csv-delimiter, --diff-alignment, --diff-timeout, --exclude-content, --exclude-dir, --exclude-ext, --exclude-lang, --exclude-list-file, --force-lang, --fullpath, --include-ext, --include-lang, --lang-no-ext, --list-file, --match-d, --match-f, --not-match-d, --not-match-f, --out, --read-binary-files, --read-lang-def, --report-file, --script-lang, --skip-archive, --sql, --sql-project, --sql-style, --timeout, --write-lang-def

### `cmake` (https://cmake.org/cmake/help/latest/manual/cmake.1.html)

- Info flags: --system-information, --version

### `codesign` (https://ss64.com/mac/codesign.html)

- Requires --display/-d or --verify/-v.

### `col` (https://man7.org/linux/man-pages/man1/col.1.html)

- Allowed standalone flags: -b, -f, -h, -p, -x
- Allowed valued flags: -l
- Bare invocation allowed

### `colordiff` (https://www.colordiff.org/)

- Allowed standalone flags: --brief, --ed, --expand-tabs, --initial-tab, --left-column, --minimal, --normal, --paginate, --rcs, --report-identical-files, --side-by-side, --speed-large-files, --strip-trailing-cr, --suppress-blank-empty, --suppress-common-lines, --text, -B, -E, -N, -P, -T, -Z, -a, -b, -c, -d, -e, -i, -l, -n, -p, -q, -r, -s, -t, -u, -v, -w, -y
- Allowed valued flags: --changed-group-format, --color, --context, --from-file, --horizon-lines, --ifdef, --ignore-matching-lines, --label, --line-format, --new-group-format, --new-line-format, --old-group-format, --old-line-format, --show-function-line, --starting-file, --tabsize, --to-file, --unchanged-group-format, --unchanged-line-format, --unified, --width, -C, -D, -F, -I, -L, -S, -U, -W

### `column` (https://man7.org/linux/man-pages/man1/column.1.html)

- Allowed standalone flags: --fillrows, --json, --keep-empty-lines, --table, --table-noextreme, --table-noheadings, --table-right-all, -J, -L, -R, -e, -n, -t, -x
- Allowed valued flags: --output-separator, --separator, --table-columns, --table-empty-lines, --table-hide, --table-name, --table-order, --table-right, --table-truncate, --table-wrap, -E, -H, -O, -W, -c, -d, -o, -r, -s
- Bare invocation allowed

### `comm` (https://www.gnu.org/software/coreutils/manual/coreutils.html#comm-invocation)

- Allowed standalone flags: --check-order, --nocheck-order, --total, --zero-terminated, -1, -2, -3, -i, -z
- Allowed valued flags: --output-delimiter

### `command` (https://man7.org/linux/man-pages/man1/command.1p.html)

- Allowed: -v, -V (check if command exists).

### `composer` (https://getcomposer.org/doc/03-cli.md)

- **about**
- **audit**: Flags: --abandoned, --locked, --no-dev. Valued: --format
- **check-platform-reqs**
- **diagnose**
- **fund**
- **help**
- **info**: Flags: --all, --available, --direct, --installed, --latest, --locked, --minor-only, --name-only, --no-dev, --outdated, --path, --platform, --self, --strict, --tree, --versions. Valued: --format, --ignore
- **licenses**
- **outdated**: Flags: --all, --direct, --locked, --minor-only, --no-dev, --strict. Valued: --format, --ignore
- **show**: Flags: --all, --available, --direct, --installed, --latest, --locked, --minor-only, --name-only, --no-dev, --outdated, --path, --platform, --self, --strict, --tree, --versions. Valued: --format, --ignore
- **suggests**

### `conda` (https://docs.conda.io/projects/conda/en/stable/commands/index.html)

- **config**: config (--show/--show-sources only).
- **info**: Flags: --all, --envs, --json, --verbose
- **list**: Flags: --explicit, --export, --full-name, --json, --no-pip, --revisions. Valued: --name, --prefix

### `craft` (https://craftcms.com/docs/5.x/reference/cli.html)

- **env/show**
- **graphql/list-schemas**
- **graphql/print-schema**
- **help**
- **install/check**
- **migrate/history**
- **migrate/new**
- **pc/diff**
- **pc/export**
- **pc/get**
- **plugin/list**
- **queue/info**
- **update/info**
- **users/list-admins**

### `csrutil` (https://ss64.com/mac/csrutil.html)

- **authenticated-root**
- **report**
- **status**

### `cucumber` (https://cucumber.io/docs/cucumber/api/#running-cucumber)

- Allowed standalone flags: --backtrace, --color, --dry-run, --expand, --guess, --i18n-keywords, --i18n-languages, --init, --no-color, --no-diff, --no-multiline, --no-snippets, --no-source, --no-strict, --publish, --publish-quiet, --quiet, --retry, --snippets, --strict, --verbose, --wip, -b, -d, -e, -q
- Allowed valued flags: --ci-environment, --format, --format-options, --language, --lines, --name, --order, --out, --profile, --require, --require-module, --retry, --tags, -f, -i, -l, -n, -o, -p, -r, -t
- Bare invocation allowed

### `curl` (https://curl.se/docs/manpage.html)

- Allowed standalone flags: --compressed, --fail, --globoff, --head, --insecure, --ipv4, --ipv6, --location, --no-buffer, --no-progress-meter, --show-error, --silent, --verbose, -4, -6, -I, -L, -N, -S, -f, -g, -k, -s, -v.
- Allowed valued flags: --connect-timeout, --max-time, --write-out, -m, -w.
- Allowed methods (-X/--request): GET, HEAD, OPTIONS.

### `cut` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cut-invocation)

- Allowed standalone flags: --complement, --only-delimited, --zero-terminated, -n, -s, -w, -z
- Allowed valued flags: --bytes, --characters, --delimiter, --fields, --output-delimiter, -b, -c, -d, -f

### `date` (https://www.gnu.org/software/coreutils/manual/coreutils.html#date-invocation)

- Allowed standalone flags: --rfc-2822, --rfc-email, --universal, --utc, -R, -j, -n, -u
- Allowed valued flags: --date, --iso-8601, --reference, --rfc-3339, -I, -d, -f, -r, -v, -z
- Bare invocation allowed

### `dcli` (https://cli.dashlane.com/)

- **accounts whoami**
- **devices list**: Flags: --json
- **lock**
- **sync**
- **team credentials list**: Flags: --json
- **team dark-web-insights**: Valued: --count, --offset, --order-by
- **team logs**: Flags: --csv, --human-readable. Valued: --end, --start
- **team members**: Flags: --csv, --human-readable
- **team public-api list-keys**: Flags: --json
- **team report**

### `ddev` (https://ddev.readthedocs.io/en/stable/users/usage/commands/)

- **aliases**
- **debug configyaml**
- **debug diagnose**
- **debug mutagen**
- **debug test**
- **describe**: Flags: --json-output
- **list**: Flags: --json-output
- **logs**: Flags: --follow, --time, --timestamps. Valued: --service, --tail
- **snapshot** (requires --list): Flags: --all, --list
- **status**: Flags: --json-output
- **version**

### `defaults` (https://ss64.com/mac/defaults.html)

- **domains**
- **export**: Flags: -g, -globalDomain. Valued: -app
- **find**: Flags: -g, -globalDomain. Valued: -app
- **read**: Flags: -g, -globalDomain. Valued: -app
- **read-type**: Flags: -g, -globalDomain. Valued: -app

### `delta` (https://dandavison.github.io/delta/)

- Allowed standalone flags: --blame-code-style, --blame-palette, --color-only, --dark, --diff-highlight, --diff-so-fancy, --hyperlinks, --keep-plus-minus-markers, --light, --line-numbers, --list-languages, --list-syntax-themes, --navigate, --no-gitconfig, --raw, --relative-paths, --show-config, --show-syntax-themes, --side-by-side, -n, -s
- Allowed valued flags: --commit-decoration-style, --commit-style, --config, --diff-stat-align-width, --features, --file-added-label, --file-decoration-style, --file-modified-label, --file-removed-label, --file-renamed-label, --file-style, --file-transformation, --hunk-header-decoration-style, --hunk-header-file-style, --hunk-header-line-number-style, --hunk-header-style, --hunk-label, --inline-hint-style, --inspect-raw-lines, --line-buffer-size, --line-fill-method, --line-numbers-left-format, --line-numbers-left-style, --line-numbers-minus-style, --line-numbers-plus-style, --line-numbers-right-format, --line-numbers-right-style, --line-numbers-zero-style, --map-styles, --max-line-distance, --max-line-length, --merge-conflict-begin-symbol, --merge-conflict-end-symbol, --merge-conflict-ours-diff-header-decoration-style, --merge-conflict-ours-diff-header-style, --merge-conflict-theirs-diff-header-decoration-style, --merge-conflict-theirs-diff-header-style, --minus-emph-style, --minus-empty-line-marker-style, --minus-non-emph-style, --minus-style, --paging, --plus-emph-style, --plus-empty-line-marker-style, --plus-non-emph-style, --plus-style, --syntax-theme, --tabs, --true-color, --whitespace-error-style, --width, -w
- Bare invocation allowed

### `deno` (https://docs.deno.com/runtime/reference/cli/)

- **check**: Flags: --json, --no-lock, --quiet, --unstable. Valued: --config, --import-map
- **doc**: Flags: --json, --no-lock, --quiet, --unstable. Valued: --config, --import-map
- **fmt** (requires --check): Flags: --check, --no-semicolons, --single-quote, --unstable. Valued: --config, --ext, --ignore, --indent-width, --line-width, --log-level, --prose-wrap
- **info**: Flags: --json, --no-lock, --quiet, --unstable. Valued: --config, --import-map
- **lint**: Flags: --json, --no-lock, --quiet, --unstable. Valued: --config, --import-map
- **test**: Flags: --json, --no-lock, --quiet, --unstable. Valued: --config, --import-map

### `df` (https://www.gnu.org/software/coreutils/manual/coreutils.html#df-invocation)

- Allowed standalone flags: --all, --human-readable, --inodes, --local, --no-sync, --portability, --print-type, --si, --sync, --total, -H, -P, -T, -a, -h, -i, -k, -l
- Allowed valued flags: --block-size, --exclude-type, --output, --type, -B, -t, -x
- Bare invocation allowed

### `diff` (https://www.gnu.org/software/diffutils/manual/diffutils.html)

- Allowed standalone flags: --brief, --ed, --expand-tabs, --ignore-all-space, --ignore-blank-lines, --ignore-case, --ignore-space-change, --ignore-tab-expansion, --left-column, --minimal, --new-file, --no-dereference, --no-ignore-file-name-case, --normal, --paginate, --rcs, --recursive, --report-identical-files, --show-c-function, --side-by-side, --speed-large-files, --strip-trailing-cr, --suppress-blank-empty, --suppress-common-lines, --text, --unidirectional-new-file, -B, -E, -N, -P, -T, -a, -b, -c, -d, -e, -f, -i, -l, -n, -p, -q, -r, -s, -t, -u, -w, -y
- Allowed valued flags: --changed-group-format, --color, --context, --exclude, --exclude-from, --from-file, --ifdef, --ignore-matching-lines, --label, --line-format, --new-group-format, --new-line-format, --old-group-format, --old-line-format, --show-function-line, --starting-file, --tabsize, --to-file, --unchanged-group-format, --unchanged-line-format, --unified, --width, -C, -D, -F, -I, -L, -S, -U, -W, -X, -x

### `dig` (https://man7.org/linux/man-pages/man1/dig.1.html)

- Allowed standalone flags: -4, -6, -m, -r, -u, -v
- Allowed valued flags: -b, -c, -f, -k, -p, -q, -t, -x, -y
- Bare invocation allowed

### `dirname` (https://www.gnu.org/software/coreutils/manual/coreutils.html#dirname-invocation)

- Allowed standalone flags: --zero, -z

### `diskutil` (https://ss64.com/mac/diskutil.html)

- **activity**
- **apfs list**
- **apfs listCryptoUsers**
- **apfs listSnapshots**
- **apfs listVolumeGroups**
- **info**: Flags: -all, -plist
- **list**: Flags: -plist
- **listFilesystems**: Flags: -plist

### `docker / podman` (https://docs.docker.com/reference/cli/docker/)

- **buildx --version**
- **buildx inspect**
- **buildx ls**
- **buildx version**
- **compose --version**
- **compose config**: Flags: --dry-run, --hash, --images, --no-consistency, --no-interpolate, --no-normalize, --no-path-resolution, --profiles, --quiet, --resolve-image-digests, --services, --volumes. Valued: --format, --output
- **compose images**
- **compose ls**
- **compose ps**: Flags: --all, --no-trunc, --orphans, --quiet, --services. Valued: --filter, --format, --status
- **compose top**
- **compose version**
- **container diff**
- **container inspect**: Flags: --size. Valued: --format, --type
- **container list**: Flags: --all, --last, --latest, --no-trunc, --quiet, --size. Valued: --filter, --format
- **container logs**: Flags: --details, --follow, --timestamps. Valued: --since, --tail, --until
- **container ls**: Flags: --all, --last, --latest, --no-trunc, --quiet, --size. Valued: --filter, --format
- **container port**
- **container stats**: Flags: --all, --no-stream, --no-trunc. Valued: --format
- **container top**
- **context inspect**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **context ls**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **context show**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **diff**
- **history**: Flags: --human, --no-trunc, --quiet. Valued: --format
- **image history**: Flags: --human, --no-trunc, --quiet. Valued: --format
- **image inspect**: Flags: --size. Valued: --format, --type
- **image list**: Flags: --all, --digests, --no-trunc, --quiet. Valued: --filter, --format
- **image ls**: Flags: --all, --digests, --no-trunc, --quiet. Valued: --filter, --format
- **images**: Flags: --all, --digests, --no-trunc, --quiet. Valued: --filter, --format
- **info**: Valued: --format
- **inspect**: Flags: --size. Valued: --format, --type
- **logs**: Flags: --details, --follow, --timestamps. Valued: --since, --tail, --until
- **manifest inspect**: Flags: --size. Valued: --format, --type
- **network inspect**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **network ls**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **port**
- **ps**: Flags: --all, --last, --latest, --no-trunc, --quiet, --size. Valued: --filter, --format
- **stats**: Flags: --all, --no-stream, --no-trunc. Valued: --format
- **system df**: Valued: --format
- **system info**: Valued: --format
- **top**
- **version**: Valued: --format
- **volume inspect**: Flags: --no-trunc, --quiet. Valued: --filter, --format
- **volume ls**: Flags: --no-trunc, --quiet. Valued: --filter, --format

### `dotnet` (https://learn.microsoft.com/en-us/dotnet/core/tools/)

- Info flags: --info, --list-runtimes, --list-sdks
- **build**: Flags: --force, --no-dependencies, --no-incremental, --no-restore, --nologo, --self-contained, --tl, --use-current-runtime. Valued: --arch, --artifacts-path, --configuration, --framework, --os, --output, --property, --runtime, --source, --verbosity, --version-suffix
- **list**: Flags: --deprecated, --highest-minor, --highest-patch, --include-prerelease, --include-transitive, --outdated, --vulnerable. Valued: --config, --format, --framework, --source, --verbosity
- **test**: Flags: --blame, --blame-crash, --blame-hang, --force, --list-tests, --no-build, --no-dependencies, --no-restore, --nologo. Valued: --arch, --artifacts-path, --blame-crash-collect-always, --blame-crash-dump-type, --blame-hang-dump-type, --blame-hang-timeout, --collect, --configuration, --diag, --environment, --filter, --framework, --logger, --os, --output, --property, --results-directory, --runtime, --settings, --test-adapter-path, --verbosity

### `du` (https://www.gnu.org/software/coreutils/manual/coreutils.html#du-invocation)

- Allowed standalone flags: --all, --apparent-size, --bytes, --count-links, --dereference, --dereference-args, --human-readable, --inodes, --no-dereference, --null, --one-file-system, --separate-dirs, --si, --summarize, --total, -0, -D, -H, -L, -P, -S, -a, -b, -c, -h, -k, -l, -m, -s, -x
- Allowed valued flags: --block-size, --exclude, --files0-from, --max-depth, --threshold, --time, --time-style, -B, -d, -t
- Bare invocation allowed

### `dust` (https://github.com/bootandy/dust#readme)

- Allowed standalone flags: --bars-on-right, --files0-from, --ignore-all-in-file, --invert-filter, --no-colors, --no-percent-bars, --only-dir, --only-file, --skip-total, -D, -F, -H, -P, -R, -S, -b, -c, -f, -i, -p, -r, -s
- Allowed valued flags: --depth, --exclude, --filter, --terminal_width, -M, -X, -d, -e, -n, -t, -v, -w, -z
- Bare invocation allowed

### `echo` (https://www.gnu.org/software/coreutils/manual/coreutils.html#echo-invocation)

- Allowed standalone flags: -E, -e, -n
- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `egrep` (https://www.gnu.org/software/grep/manual/grep.html)

- Allowed standalone flags: --basic-regexp, --binary, --byte-offset, --color, --colour, --count, --dereference-recursive, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --ignore-case, --initial-tab, --invert-match, --line-buffered, --line-number, --line-regexp, --no-filename, --no-messages, --null, --null-data, --only-matching, --perl-regexp, --quiet, --recursive, --silent, --text, --with-filename, --word-regexp, -E, -F, -G, -H, -I, -J, -L, -P, -R, -S, -T, -U, -V, -Z, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -r, -s, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --binary-files, --color, --colour, --context, --devices, --directories, --exclude, --exclude-dir, --exclude-from, --file, --group-separator, --include, --label, --max-count, --regexp, -A, -B, -C, -D, -d, -e, -f, -m

### `env` (https://www.gnu.org/software/coreutils/manual/coreutils.html#env-invocation)

- Strips flags (-i, -u) and KEY=VALUE pairs, then recursively validates the inner command. Bare invocation allowed.

### `exa` (https://eza.rocks/)

- Allowed standalone flags: --accessed, --all, --binary, --blocks, --blocksize, --bytes, --changed, --classify, --color-scale, --color-scale-mode, --context, --created, --dereference, --extended, --flags, --follow-symlinks, --git, --git-ignore, --git-repos, --git-repos-no-status, --group, --group-directories-first, --header, --hyperlink, --icons, --inode, --links, --list-dirs, --long, --modified, --mounts, --no-filesize, --no-git, --no-icons, --no-permissions, --no-quotes, --no-time, --no-user, --numeric, --octal-permissions, --oneline, --only-dirs, --only-files, --recurse, --reverse, --tree, -1, -@, -A, -B, -D, -F, -G, -H, -I, -M, -R, -S, -T, -U, -Z, -a, -b, -d, -f, -g, -h, -i, -l, -m, -r, -s, -u, -x
- Allowed valued flags: --color, --colour, --git-ignore-glob, --grid-columns, --group-directories-first-dirs, --ignore-glob, --level, --smart-group, --sort, --time, --time-style, --total-size, --width, -L, -X, -t, -w
- Bare invocation allowed

### `expand` (https://www.gnu.org/software/coreutils/manual/coreutils.html#expand-invocation)

- Allowed standalone flags: --initial, -i
- Allowed valued flags: --tabs, -t
- Bare invocation allowed

### `expr` (https://www.gnu.org/software/coreutils/manual/coreutils.html#expr-invocation)

- Hyphen-prefixed positional arguments accepted

### `eza` (https://eza.rocks/)

- Allowed standalone flags: --accessed, --all, --binary, --blocks, --blocksize, --bytes, --changed, --classify, --color-scale, --color-scale-mode, --context, --created, --dereference, --extended, --flags, --follow-symlinks, --git, --git-ignore, --git-repos, --git-repos-no-status, --group, --group-directories-first, --header, --hyperlink, --icons, --inode, --links, --list-dirs, --long, --modified, --mounts, --no-filesize, --no-git, --no-icons, --no-permissions, --no-quotes, --no-time, --no-user, --numeric, --octal-permissions, --oneline, --only-dirs, --only-files, --recurse, --reverse, --tree, -1, -@, -A, -B, -D, -F, -G, -H, -I, -M, -R, -S, -T, -U, -Z, -a, -b, -d, -f, -g, -h, -i, -l, -m, -r, -s, -u, -x
- Allowed valued flags: --color, --colour, --git-ignore-glob, --grid-columns, --group-directories-first-dirs, --ignore-glob, --level, --smart-group, --sort, --time, --time-style, --total-size, --width, -L, -X, -t, -w
- Bare invocation allowed

### `factor` (https://www.gnu.org/software/coreutils/manual/coreutils.html#factor-invocation)

- Allowed standalone flags: --exponents, -h
- Bare invocation allowed

### `false` (https://www.gnu.org/software/coreutils/manual/coreutils.html#false-invocation)

- Bare invocation allowed

### `fd` (https://github.com/sharkdp/fd#readme)

- Safe unless --exec/-x or --exec-batch/-X flags (execute arbitrary commands).

### `fgrep` (https://www.gnu.org/software/grep/manual/grep.html)

- Allowed standalone flags: --basic-regexp, --binary, --byte-offset, --color, --colour, --count, --dereference-recursive, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --ignore-case, --initial-tab, --invert-match, --line-buffered, --line-number, --line-regexp, --no-filename, --no-messages, --null, --null-data, --only-matching, --perl-regexp, --quiet, --recursive, --silent, --text, --with-filename, --word-regexp, -E, -F, -G, -H, -I, -J, -L, -P, -R, -S, -T, -U, -V, -Z, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -r, -s, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --binary-files, --color, --colour, --context, --devices, --directories, --exclude, --exclude-dir, --exclude-from, --file, --group-separator, --include, --label, --max-count, --regexp, -A, -B, -C, -D, -d, -e, -f, -m

### `file` (https://man7.org/linux/man-pages/man1/file.1.html)

- Allowed standalone flags: --brief, --debug, --dereference, --extension, --keep-going, --list, --mime, --mime-encoding, --mime-type, --no-buffer, --no-dereference, --no-pad, --no-sandbox, --preserve-date, --print0, --raw, --special-files, --uncompress, --uncompress-noreport, -0, -D, -I, -L, -N, -S, -Z, -b, -d, -h, -i, -k, -l, -n, -p, -r, -s, -z
- Allowed valued flags: --exclude, --exclude-quiet, --files-from, --magic-file, --parameter, --separator, -F, -P, -e, -f, -m

### `find` (https://www.gnu.org/software/findutils/manual/html_mono/find.html)

- Positional predicates allowed. -exec/-execdir allowed when the executed command is itself safe.

### `fly` (https://fly.io/docs/flyctl/)

- **apps list**
- **config show**: Flags: --json. Valued: --app
- **ips list**: Flags: --json. Valued: --app
- **logs**: Valued: --app, --instance, --region
- **platform regions**
- **regions list**: Flags: --json. Valued: --app
- **releases**: Flags: --json. Valued: --app
- **services list**: Flags: --json. Valued: --app
- **status**: Flags: --json. Valued: --app
- **version**

### `flyctl` (https://fly.io/docs/flyctl/)

- **apps list**
- **config show**: Flags: --json. Valued: --app
- **ips list**: Flags: --json. Valued: --app
- **logs**: Valued: --app, --instance, --region
- **platform regions**
- **regions list**: Flags: --json. Valued: --app
- **releases**: Flags: --json. Valued: --app
- **services list**: Flags: --json. Valued: --app
- **status**: Flags: --json. Valued: --app
- **version**

### `fmt` (https://www.gnu.org/software/coreutils/manual/coreutils.html#fmt-invocation)

- Allowed standalone flags: --crown-margin, --split-only, --tagged-paragraph, --uniform-spacing, -c, -m, -n, -s, -u
- Allowed valued flags: --goal, --prefix, --width, -d, -g, -l, -p, -t, -w
- Bare invocation allowed

### `fnm` (https://github.com/Schniz/fnm#readme)

- **current**
- **default**
- **list**
- **ls-remote**

### `fold` (https://www.gnu.org/software/coreutils/manual/coreutils.html#fold-invocation)

- Allowed standalone flags: --bytes, --spaces, -b, -s
- Allowed valued flags: --width, -w
- Bare invocation allowed

### `gem` (https://guides.rubygems.org/command-reference/)

- **contents**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **dependency**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **environment**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **help**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **info**: Flags: --installed, --prerelease. Valued: --version
- **list**: Flags: --all, --installed, --local, --no-details, --no-versions, --prerelease, --remote, --versions
- **outdated**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **pristine**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **search**: Flags: --all, --details, --exact, --local, --prerelease, --remote, --versions
- **sources**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **specification**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **stale**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version
- **which**: Flags: --all, --local, --prerelease, --remote, --versions. Valued: --version

### `getconf` (https://man7.org/linux/man-pages/man1/getconf.1.html)

- Allowed standalone flags: -a
- Allowed valued flags: -v
- Bare invocation allowed

### `gh` (https://cli.github.com/manual/)

- Subcommands attestation, cache, codespace, extension, gpg-key, issue, label, pr, release, repo, run, ssh-key, variable, workflow are allowed with actions: checks, diff, list, status, verify, view, watch.
- Always safe: --version, search, status.
- auth status, browse (requires --no-browser), api (GET only).

### `git` (https://git-scm.com/docs)

- **blame**: Flags: --color-by-age, --color-lines, --incremental, --line-porcelain, --minimal, --porcelain, --progress, --root, --show-email, --show-name, --show-number, --show-stats, -b, -c, -e, -f, -l, -n, -p, -s, -t, -w. Valued: --abbrev, --contents, --ignore-rev, --ignore-revs-file, -C, -L, -M, -S
- **branch**: branch (read-only flags).
- **cat-file**: Flags: --batch-all-objects, --buffer, --filters, --follow-symlinks, --mailmap, --textconv, --unordered, --use-mailmap, -Z, -e, -p, -s, -t. Valued: --batch, --batch-check, --batch-command, --filter, --path
- **check-ignore**: Flags: --no-index, --non-matching, --quiet, --stdin, --verbose, -n, -q, -v, -z
- **config**: config (--get, --get-all, --get-regexp, --list, -l only).
- **count-objects**: Flags: --human-readable, --verbose, -H, -v
- **describe**: Flags: --all, --always, --contains, --debug, --exact-match, --first-parent, --long, --tags. Valued: --abbrev, --broken, --candidates, --dirty, --exclude, --match
- **diff**: Flags: --cached, --check, --compact-summary, --cumulative, --dirstat-by-file, --exit-code, --find-copies-harder, --full-index, --ignore-all-space, --ignore-blank-lines, --ignore-cr-at-eol, --ignore-space-at-eol, --ignore-space-change, --merge-base, --minimal, --name-only, --name-status, --no-color, --no-ext-diff, --no-index, --no-patch, --no-prefix, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --patience, --pickaxe-all, --raw, --shortstat, --staged, --stat, --summary, --text, -B, -C, -M, -R, -a, -b, -p, -u, -w, -z. Valued: --abbrev, --color, --diff-algorithm, --diff-filter, --dirstat, --dst-prefix, --inter-hunk-context, --line-prefix, --output-indicator-new, --output-indicator-old, --relative, --src-prefix, --stat-width, --unified, --word-diff, --word-diff-regex, -G, -O, -S, -U
- **diff-tree**: Flags: --cc, --combined-all-paths, --find-copies-harder, --full-index, --ignore-all-space, --ignore-space-at-eol, --ignore-space-change, --merge-base, --minimal, --name-only, --name-status, --no-commit-id, --no-ext-diff, --no-patch, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --pickaxe-all, --raw, --root, --shortstat, --stat, --stdin, --summary, --text, -B, -C, -M, -R, -a, -c, -m, -p, -r, -s, -t, -u, -v, -z. Valued: --abbrev, --diff-algorithm, --diff-filter, --pretty, -O, -S
- **fetch**: Flags: --all, --append, --atomic, --dry-run, --force, --ipv4, --ipv6, --keep, --multiple, --negotiate-only, --no-auto-gc, --no-auto-maintenance, --no-show-forced-updates, --no-tags, --no-write-fetch-head, --porcelain, --prefetch, --progress, --prune, --prune-tags, --quiet, --refetch, --set-upstream, --show-forced-updates, --stdin, --tags, --unshallow, --update-head-ok, --update-shallow, --verbose, --write-commit-graph, --write-fetch-head, -4, -6, -P, -a, -f, -k, -m, -n, -p, -q, -t, -u, -v. Valued: --deepen, --depth, --filter, --jobs, --negotiation-tip, --recurse-submodules, --refmap, --server-option, --shallow-exclude, --shallow-since, -j, -o
- **for-each-ref**: Flags: --ignore-case, --include-root-refs, --omit-empty, --perl, --python, --shell, --stdin, --tcl, -p, -s. Valued: --color, --contains, --count, --exclude, --format, --merged, --no-contains, --no-merged, --points-at, --sort
- **grep**: Flags: --all-match, --and, --basic-regexp, --break, --cached, --column, --count, --exclude-standard, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --full-name, --function-context, --heading, --ignore-case, --index, --invert-match, --line-number, --name-only, --no-color, --no-index, --null, --only-matching, --perl-regexp, --quiet, --recurse-submodules, --recursive, --show-function, --text, --textconv, --untracked, --word-regexp, -E, -F, -G, -H, -I, -L, -P, -W, -a, -c, -h, -i, -l, -n, -o, -p, -q, -r, -v, -w, -z. Valued: --after-context, --before-context, --color, --context, --max-count, --max-depth, --open-files-in-pager, --threads, -A, -B, -C, -O, -e, -f, -m
- **help**
- **log**: Flags: --abbrev-commit, --all, --ancestry-path, --author-date-order, --bisect, --boundary, --branches, --cherry, --cherry-mark, --cherry-pick, --children, --clear-decorations, --compact-summary, --cumulative, --date-order, --dense, --do-walk, --early-output, --first-parent, --follow, --full-diff, --full-history, --graph, --ignore-missing, --left-only, --left-right, --log-size, --mailmap, --merges, --minimal, --name-only, --name-status, --no-abbrev-commit, --no-color, --no-decorate, --no-expand-tabs, --no-ext-diff, --no-merges, --no-notes, --no-patch, --no-prefix, --no-renames, --no-walk, --numstat, --oneline, --parents, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --reflog, --relative-date, --remotes, --reverse, --shortstat, --show-linear-break, --show-notes, --show-pulls, --show-signature, --simplify-by-decoration, --simplify-merges, --source, --sparse, --stat, --stdin, --summary, --tags, --text, --topo-order, --use-mailmap, -p, -q, -u. Valued: --abbrev, --after, --author, --before, --color, --committer, --date, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --exclude, --format, --glob, --grep, --max-count, --max-parents, --min-parents, --pretty, --since, --skip, --until, -L, -n
- **ls-files**: Flags: --cached, --debug, --deduplicate, --deleted, --directory, --empty-directory, --eol, --error-unmatch, --exclude-standard, --full-name, --ignored, --killed, --modified, --no-empty-directory, --others, --recurse-submodules, --resolve-undo, --sparse, --stage, --unmerged, -c, -d, -f, -i, -k, -m, -o, -s, -t, -u, -v, -z. Valued: --abbrev, --exclude, --exclude-from, --exclude-per-directory, --format, --with-tree, -X, -x
- **ls-remote**: Flags: --branches, --exit-code, --get-url, --quiet, --refs, --symref, --tags, -b, -q, -t. Valued: --server-option, --sort, -o
- **ls-tree**: Flags: --full-name, --full-tree, --long, --name-only, --name-status, --object-only, -d, -l, -r, -t, -z. Valued: --abbrev, --format
- **merge-base**: Flags: --all, --fork-point, --independent, --is-ancestor, --octopus, -a
- **merge-tree**: Flags: --allow-unrelated-histories, --messages, --name-only, --quiet, --stdin, --trivial-merge, --write-tree, -z. Valued: --merge-base, -X
- **name-rev**: Flags: --all, --always, --annotate-stdin, --name-only, --tags, --undefined. Valued: --exclude, --refs
- **notes**: notes (list, show only).
- **reflog**: Flags: --abbrev-commit, --all, --ancestry-path, --author-date-order, --bisect, --boundary, --branches, --cherry, --cherry-mark, --cherry-pick, --children, --clear-decorations, --compact-summary, --cumulative, --date-order, --dense, --do-walk, --early-output, --first-parent, --follow, --full-diff, --full-history, --graph, --ignore-missing, --left-only, --left-right, --log-size, --mailmap, --merges, --minimal, --name-only, --name-status, --no-abbrev-commit, --no-color, --no-decorate, --no-expand-tabs, --no-ext-diff, --no-merges, --no-notes, --no-patch, --no-prefix, --no-renames, --no-walk, --numstat, --oneline, --parents, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --reflog, --relative-date, --remotes, --reverse, --shortstat, --show-linear-break, --show-notes, --show-pulls, --show-signature, --simplify-by-decoration, --simplify-merges, --source, --sparse, --stat, --stdin, --summary, --tags, --text, --topo-order, --use-mailmap, -p, -q, -u. Valued: --abbrev, --after, --author, --before, --color, --committer, --date, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --exclude, --format, --glob, --grep, --max-count, --max-parents, --min-parents, --pretty, --since, --skip, --until, -L, -n
- **remote**: remote (read-only actions).
- **rev-parse**: Flags: --absolute-git-dir, --all, --branches, --git-common-dir, --git-dir, --git-path, --is-bare-repository, --is-inside-git-dir, --is-inside-work-tree, --is-shallow-repository, --local-env-vars, --quiet, --remotes, --shared-index-path, --show-cdup, --show-prefix, --show-superproject-working-tree, --show-toplevel, --symbolic, --symbolic-full-name, --tags, --verify, -q. Valued: --abbrev-ref, --after, --before, --default, --exclude, --glob, --prefix, --resolve-git-dir, --short, --since, --until. Positional args accepted
- **shortlog**: Flags: --committer, --email, --numbered, --summary, -c, -e, -n, -s. Valued: --format, --group
- **show**: Flags: --abbrev-commit, --compact-summary, --cumulative, --expand-tabs, --full-index, --ignore-all-space, --ignore-blank-lines, --ignore-space-at-eol, --ignore-space-change, --mailmap, --minimal, --name-only, --name-status, --no-color, --no-ext-diff, --no-notes, --no-patch, --no-prefix, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --shortstat, --show-notes, --show-signature, --source, --stat, --summary, --text, --use-mailmap, -p, -q, -u, -w. Valued: --abbrev, --color, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --format, --notes, --pretty, -O
- **stash**: stash (list, show only).
- **status**: Flags: --ahead-behind, --branch, --ignore-submodules, --long, --no-ahead-behind, --no-renames, --null, --renames, --short, --show-stash, --verbose, -b, -s, -v, -z. Valued: --column, --find-renames, --ignored, --porcelain, --untracked-files, -M, -u
- **tag**: tag (list only).
- **verify-commit**: Flags: --raw, --verbose, -v
- **verify-tag**: Flags: --raw, --verbose, -v. Valued: --format
- **worktree**: worktree (list only).

Supports `-C <dir>` prefix.

### `glab` (https://glab.readthedocs.io/en/latest/)

- Subcommands ci, cluster, deploy-key, gpg-key, incident, issue, iteration, label, milestone, mr, release, repo, schedule, snippet, ssh-key, stack, variable are allowed with actions: diff, issues, list, status, view.
- Always safe: --version, -v, check-update, version.
- auth status, api (GET only).

### `go` (https://pkg.go.dev/cmd/go)

- **build**: Flags: -a, -asan, -cover, -linkshared, -modcacherw, -msan, -n, -race, -trimpath, -v, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -compiler, -covermode, -coverpkg, -gccgoflags, -gcflags, -installsuffix, -ldflags, -mod, -modfile, -o, -overlay, -p, -pgo, -pkgdir, -tags
- **doc**: Flags: -all, -c, -cmd, -short, -src, -u
- **env**: Flags: -json
- **help**
- **list**: Flags: -a, -asan, -compiled, -cover, -deps, -e, -export, -find, -linkshared, -m, -modcacherw, -msan, -n, -race, -retract, -test, -trimpath, -u, -v, -versions, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -compiler, -covermode, -coverpkg, -f, -gccgoflags, -gcflags, -installsuffix, -json, -ldflags, -mod, -modfile, -overlay, -p, -pgo, -pkgdir, -reuse, -tags
- **test**: Flags: -a, -asan, -benchmem, -cover, -failfast, -json, -linkshared, -modcacherw, -msan, -n, -race, -short, -trimpath, -v, -work, -x. Valued: -asmflags, -bench, -benchtime, -blockprofile, -blockprofilerate, -buildmode, -buildvcs, -compiler, -count, -covermode, -coverpkg, -coverprofile, -cpu, -cpuprofile, -fuzz, -fuzzminimizetime, -fuzztime, -gccgoflags, -gcflags, -installsuffix, -ldflags, -list, -memprofile, -memprofilerate, -mod, -modfile, -mutexprofile, -mutexprofilefraction, -o, -outputdir, -overlay, -p, -parallel, -pgo, -pkgdir, -run, -shuffle, -skip, -tags, -timeout, -trace
- **version**: Flags: -m, -v
- **vet**: Flags: -a, -asan, -cover, -json, -linkshared, -modcacherw, -msan, -n, -race, -trimpath, -v, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -c, -compiler, -covermode, -coverpkg, -gccgoflags, -gcflags, -installsuffix, -ldflags, -mod, -modfile, -overlay, -p, -pgo, -pkgdir, -tags

### `gradle / gradlew` (https://docs.gradle.org/current/userguide/command_line_interface.html)

- **build**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode. Valued: --exclude-task, --max-workers
- **check**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode. Valued: --exclude-task, --max-workers
- **dependencies**: Flags: --console, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode. Valued: --configuration
- **properties**: Flags: --console, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode
- **tasks**: Flags: --all, --console, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode. Valued: --group
- **test**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode. Valued: --exclude-task, --max-workers

### `grep` (https://www.gnu.org/software/grep/manual/grep.html)

- Allowed standalone flags: --basic-regexp, --binary, --byte-offset, --color, --colour, --count, --dereference-recursive, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --ignore-case, --initial-tab, --invert-match, --line-buffered, --line-number, --line-regexp, --no-filename, --no-messages, --null, --null-data, --only-matching, --perl-regexp, --quiet, --recursive, --silent, --text, --with-filename, --word-regexp, -E, -F, -G, -H, -I, -J, -L, -P, -R, -S, -T, -U, -V, -Z, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -r, -s, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --binary-files, --color, --colour, --context, --devices, --directories, --exclude, --exclude-dir, --exclude-from, --file, --group-separator, --include, --label, --max-count, --regexp, -A, -B, -C, -D, -d, -e, -f, -m

### `groups` (https://www.gnu.org/software/coreutils/manual/coreutils.html#groups-invocation)

- Bare invocation allowed

### `head` (https://www.gnu.org/software/coreutils/manual/coreutils.html#head-invocation)

- Allowed standalone flags: --quiet, --silent, --verbose, --zero-terminated, -q, -v, -z
- Allowed valued flags: --bytes, --lines, -c, -n
- Bare invocation allowed

### `heroku` (https://devcenter.heroku.com/articles/heroku-cli-commands)

- **addons**: Flags: --all, --json. Valued: --app
- **apps**: Flags: --all, --json. Valued: --space, --team
- **apps:info**: Flags: --json, --shell. Valued: --app
- **buildpacks**: Valued: --app
- **config**: Flags: --json, --shell. Valued: --app
- **logs**: Flags: --force-colors, --tail. Valued: --app, --dyno, --num, --source
- **ps**: Flags: --json. Valued: --app
- **regions**: Flags: --json
- **releases**: Flags: --json. Valued: --app, --num
- **status**: Flags: --json

### `hexdump` (https://man7.org/linux/man-pages/man1/hexdump.1.html)

- Allowed standalone flags: -C, -b, -c, -d, -o, -v, -x
- Allowed valued flags: -L, -e, -f, -n, -s
- Bare invocation allowed

### `hf` (https://huggingface.co/docs/huggingface_hub/guides/cli)

- **cache ls**
- **cache verify**
- **collections info**
- **collections ls**: Valued: --limit, --owner
- **datasets info**
- **datasets ls**: Valued: --author, --filter, --limit, --search, --sort
- **datasets parquet**
- **discussions diff**
- **discussions info**
- **discussions list**
- **env**
- **jobs logs**: Valued: --tail
- **jobs ps**
- **models info**
- **models ls**: Valued: --author, --filter, --limit, --search, --sort
- **spaces info**
- **spaces ls**: Valued: --author, --filter, --limit, --search, --sort
- **version**

### `host` (https://man7.org/linux/man-pages/man1/host.1.html)

- Allowed standalone flags: -4, -6, -C, -a, -c, -d, -l, -r, -s, -v
- Allowed valued flags: -D, -N, -R, -T, -W, -i, -m, -t

### `hostname` (https://man7.org/linux/man-pages/man1/hostname.1.html)

- Flags: -A, -I, -d, -f, -i, -s

### `htop` (https://htop.dev/)

- Allowed standalone flags: --no-color, --no-mouse, --no-unicode, --tree, -C, -H, -M, -t
- Allowed valued flags: --delay, --filter, --highlight-changes, --pid, --sort-key, --user, -F, -d, -p, -s, -u
- Bare invocation allowed

### `hyperfine` (https://github.com/sharkdp/hyperfine#readme)

- Recursively validates each benchmarked command.

### `iconv` (https://man7.org/linux/man-pages/man1/iconv.1.html)

- Allowed standalone flags: --list, --silent, -c, -l, -s
- Allowed valued flags: --from-code, --to-code, -f, -t

### `id` (https://www.gnu.org/software/coreutils/manual/coreutils.html#id-invocation)

- Allowed standalone flags: --context, --group, --groups, --name, --real, --user, --zero, -G, -Z, -g, -n, -p, -r, -u, -z
- Bare invocation allowed

### `identify` (https://imagemagick.org/script/identify.php)

- Allowed standalone flags: --verbose, -ping, -quiet, -regard-warnings, -verbose
- Allowed valued flags: -channel, -define, -density, -depth, -features, -format, -fuzz, -interlace, -limit, -list, -log, -moments, -monitor, -precision, -seed, -set, -size, -strip, -unique, -virtual-pixel

### `ifconfig` (https://man7.org/linux/man-pages/man8/ifconfig.8.html)

- Allowed standalone flags: -L, -a, -l, -s, -v
- Bare invocation allowed

### `ioreg` (https://ss64.com/mac/ioreg.html)

- Allowed standalone flags: -S, -a, -b, -f, -i, -l, -r, -t, -x
- Allowed valued flags: -c, -d, -k, -n, -p, -w
- Bare invocation allowed

### `iotop` (https://man7.org/linux/man-pages/man8/iotop.8.html)

- Allowed standalone flags: --accumulated, --batch, --kilobytes, --only, --processes, --quiet, -P, -a, -b, -k, -o, -q, -t
- Allowed valued flags: --delay, --iter, --pid, --user, -d, -n, -p, -u
- Bare invocation allowed

### `jj` (https://jj-vcs.github.io/jj/latest/cli-reference/)

- Subcommands: bookmark list, config get, config list, diff, file list, file show, git fetch, git remote list, help, log, op log, root, show, st, status, version, workspace list
- Flags: --version
- Skips global flags: standalone (--debug, --ignore-immutable, --ignore-working-copy, --no-pager, --quiet, --verbose), valued (--at-op, --at-operation, --color, --repository, -R).

### `jq` (https://jqlang.github.io/jq/manual/)

- Allowed standalone flags: --ascii-output, --color-output, --compact-output, --exit-status, --join-output, --monochrome-output, --null-input, --raw-input, --raw-output, --raw-output0, --seq, --slurp, --sort-keys, --tab, -C, -M, -R, -S, -c, -e, -j, -n, -r, -s
- Allowed valued flags: --arg, --argjson, --args, --from-file, --indent, --jsonargs, --rawfile, --slurpfile, -f
- Bare invocation allowed

### `kubectl` (https://kubernetes.io/docs/reference/kubectl/)

- **api-resources**: Flags: --namespaced, --no-headers. Valued: --api-group, --output, --sort-by, --verbs
- **api-versions**
- **auth can-i**
- **auth whoami**
- **cluster-info**
- **config current-context**
- **config get-contexts**: Flags: --no-headers. Valued: --output
- **config view**: Flags: --flatten, --minify, --raw. Valued: --output
- **describe**: Flags: --all-namespaces, --show-events. Valued: --namespace, --selector
- **events**: Flags: --all-namespaces, --watch. Valued: --for, --namespace, --output, --types
- **explain**: Flags: --recursive. Valued: --api-version
- **get**: Flags: --all-namespaces, --no-headers, --show-labels, --watch. Valued: --field-selector, --label-selector, --namespace, --output, --selector, --sort-by
- **logs**: Flags: --all-containers, --follow, --previous, --timestamps. Valued: --container, --namespace, --since, --tail
- **top node**: Flags: --no-headers. Valued: --selector, --sort-by
- **top pod**: Flags: --all-namespaces, --containers, --no-headers. Valued: --namespace, --selector, --sort-by
- **version**: Flags: --client, --short. Valued: --output

### `last` (https://man7.org/linux/man-pages/man1/last.1.html)

- Allowed standalone flags: --dns, --fullnames, --fulltimes, --hostlast, --ip, --nohostname, --system, --time-format, -F, -R, -a, -d, -i, -w, -x
- Allowed valued flags: --limit, --present, --since, --time-format, --until, -f, -n, -p, -s, -t
- Bare invocation allowed

### `lastlog` (https://man7.org/linux/man-pages/man8/lastlog.8.html)

- Allowed valued flags: --before, --time, --user, -b, -t, -u
- Bare invocation allowed

### `launchctl` (https://ss64.com/mac/launchctl.html)

- **blame**
- **dumpstate**
- **error**
- **examine**
- **help**
- **hostinfo**
- **list**
- **print**
- **print-cache**
- **print-disabled**
- **resolveport**
- **version**

### `lipo` (https://ss64.com/mac/lipo.html)

- Requires a read-only flag (-info, -archs, -detailed_info, -verify_arch).

### `llm` (https://llm.datasette.io/en/stable/)

- **aliases**: Flags: --json
- **collections**: Flags: --json
- **logs**: Flags: --conversation, --json, --no-truncate, --response, --truncate. Valued: --cid, --count, --id, --model, --search
- **models**: Flags: --json, --options
- **plugins**: Flags: --all, --json
- **templates**: Flags: --json

### `locale` (https://man7.org/linux/man-pages/man1/locale.1.html)

- Allowed standalone flags: --all-locales, --category-name, --charmaps, --keyword-name, --verbose, -a, -c, -k, -m, -v
- Bare invocation allowed

### `log` (https://ss64.com/mac/log.html)

- **help**
- **show**: Flags: --backtrace, --debug, --info, --loss, --mach-continuous-time, --no-pager, --signpost. Valued: --color, --end, --last, --predicate, --process, --source, --start, --style, --type
- **stats**
- **stream**: Flags: --backtrace, --debug, --info, --loss, --mach-continuous-time, --signpost. Valued: --color, --level, --predicate, --process, --source, --style, --timeout, --type

### `ls` (https://www.gnu.org/software/coreutils/manual/coreutils.html#ls-invocation)

- Allowed standalone flags: --all, --almost-all, --author, --classify, --context, --dereference, --dereference-command-line, --dereference-command-line-symlink-to-dir, --directory, --escape, --file-type, --full-time, --group-directories-first, --hide-control-chars, --human-readable, --indicator-style, --inode, --kibibytes, --literal, --no-group, --numeric-uid-gid, --quote-name, --recursive, --reverse, --show-control-chars, --si, --size, -1, -A, -B, -C, -F, -G, -H, -L, -N, -Q, -R, -S, -U, -X, -Z, -a, -c, -d, -f, -g, -h, -i, -k, -l, -m, -n, -o, -p, -q, -r, -s, -t, -u, -v, -x
- Allowed valued flags: --block-size, --color, --format, --hide, --hyperlink, --ignore, --quoting-style, --sort, --tabsize, --time, --time-style, --width, -I, -T, -w
- Bare invocation allowed

### `lsof` (https://man7.org/linux/man-pages/man8/lsof.8.html)

- Allowed standalone flags: -C, -G, -M, -N, -O, -P, -R, -U, -V, -X, -b, -h, -l, -n, -t, -w, -x
- Allowed valued flags: -F, -S, -T, -a, -c, -d, -g, -i, -k, -o, -p, -r, -s, -u
- Bare invocation allowed

### `magick` (https://imagemagick.org/script/command-line-tools.php)

- **identify**: Flags: -matte, -moments, -ping, -quiet, -regard-warnings, -unique, -verbose. Valued: -alpha, -colorspace, -define, -density, -depth, -endian, -format, -interlace, -limit, -precision, -sampling-factor, -size, -units, -virtual-pixel

### `man` (https://man7.org/linux/man-pages/man1/man.1.html)

- Allowed standalone flags: --all, --apropos, --default, --local-file, --regex, --update, --whatis, --where, --where-cat, --wildcard, -a, -f, -k, -l, -u, -w
- Allowed valued flags: --config-file, --encoding, --extension, --locale, --manpath, --sections, --systems, -C, -E, -L, -M, -S, -e, -m

### `md5` (https://man7.org/linux/man-pages/man1/md5sum.1.html)

- Allowed standalone flags: -n, -p, -q, -r, -t
- Allowed valued flags: -s
- Bare invocation allowed

### `md5sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#md5sum-invocation)

- Allowed standalone flags: --binary, --check, --ignore-missing, --quiet, --status, --strict, --tag, --text, --warn, --zero, -b, -c, -t, -w, -z
- Bare invocation allowed

### `mdfind` (https://ss64.com/mac/mdfind.html)

- Allowed standalone flags: -0, -count, -interpret, -literal, -live
- Allowed valued flags: -attr, -name, -onlyin, -s

### `mdls` (https://ss64.com/mac/mdls.html)

- Allowed standalone flags: --raw, -r
- Allowed valued flags: --name, --nullMarker, -n

### `mise` (https://mise.jdx.dev/cli/)

- **config list**
- **config ls**
- **current**
- **doctor**
- **env**: Flags: --json. Valued: --shell
- **exec**: exec delegates after --.
- **list**: Flags: --current, --installed, --json, --missing, --no-header, --prefix
- **ls**: Flags: --current, --installed, --json, --missing, --no-header, --prefix
- **reshim**: Flags: --force
- **settings get**
- **which**

### `mvn / mvnw` (https://maven.apache.org/ref/current/maven-embedder/cli.html)

- Phases: compile, dependency:list, dependency:tree, help:describe, test, test-compile, validate, verify.

### `netstat` (https://man7.org/linux/man-pages/man8/netstat.8.html)

- Allowed standalone flags: --all, --continuous, --extend, --groups, --interfaces, --listening, --masquerade, --numeric, --numeric-hosts, --numeric-ports, --numeric-users, --program, --route, --statistics, --symbolic, --tcp, --timers, --udp, --unix, --verbose, --wide, -A, -C, -L, -M, -N, -R, -S, -W, -Z, -a, -b, -c, -d, -e, -f, -g, -i, -l, -m, -n, -o, -p, -q, -r, -s, -t, -u, -v, -w, -x
- Allowed valued flags: -I
- Bare invocation allowed

### `networksetup` (https://ss64.com/mac/networksetup.html)

- Allowed: subcommands starting with -list, -get, -show, -print, plus -version and -help.

### `nice / ionice` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nice-invocation)

- Skips priority flags (-n/--adjustment), then recursively validates the inner command.

### `nl` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nl-invocation)

- Allowed standalone flags: --no-renumber, -p
- Allowed valued flags: --body-numbering, --footer-numbering, --header-numbering, --join-blank-lines, --line-increment, --number-format, --number-separator, --number-width, --section-delimiter, --starting-line-number, -b, -d, -f, -h, -i, -l, -n, -s, -v, -w
- Bare invocation allowed

### `nm` (https://man7.org/linux/man-pages/man1/nm.1.html)

- Allowed standalone flags: --debug-syms, --defined-only, --demangle, --dynamic, --extern-only, --line-numbers, --no-demangle, --no-llvm-bc, --no-sort, --numeric-sort, --portability, --print-armap, --print-file-name, --print-size, --reverse-sort, --special-syms, --undefined-only, -A, -B, -C, -D, -P, -S, -a, -g, -j, -l, -m, -n, -o, -p, -r, -s, -u, -v, -x
- Allowed valued flags: --format, --radix, --size-sort, --target, -f, -t

### `npm` (https://docs.npmjs.com/cli)

- **audit**: Flags: --json, --omit, --production. Valued: --audit-level
- **config get**: Flags: --json, --long
- **config list**: Flags: --json, --long
- **doctor**: Flags: --json
- **explain**: Flags: --json
- **fund**: Flags: --json
- **info**: Flags: --json
- **list**: Flags: --all, --json, --link, --long, --omit, --parseable, --production, --unicode. Valued: --depth, --prefix
- **ls**: Flags: --all, --json, --link, --long, --omit, --parseable, --production, --unicode. Valued: --depth, --prefix
- **outdated**: Flags: --json
- **prefix**: Flags: --json
- **root**: Flags: --json
- **run**: run/run-script (test only).
- **test**
- **view**: Flags: --json
- **why**: Flags: --json

### `nproc` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nproc-invocation)

- Allowed standalone flags: --all
- Allowed valued flags: --ignore
- Bare invocation allowed

### `npx` (https://docs.npmjs.com/cli/commands/npx)

- Allowed packages: @herb-tools/linter, eslint, karma.
- tsc allowed with --noEmit.
- Skips flags: --yes/-y/--no/--package/-p.

### `nroff` (https://man7.org/linux/man-pages/man1/nroff.1.html)

- Allowed standalone flags: -S, -c, -h, -i, -k, -p, -q, -t
- Allowed valued flags: -M, -P, -T, -d, -m, -n, -o, -r, -w

### `nslookup` (https://man7.org/linux/man-pages/man1/nslookup.1.html)

- Allowed: positional args, -debug, -nodebug, -d2, and valued options (-type=, -query=, -port=, -timeout=, -retry=, -class=, -domain=, -querytype=).

### `nvm` (https://github.com/nvm-sh/nvm#readme)

- **current**: Flags: --lts, --no-colors
- **list**: Flags: --lts, --no-colors
- **ls**: Flags: --lts, --no-colors
- **ls-remote**: Flags: --lts, --no-colors
- **version**: Flags: --lts, --no-colors
- **which**: Flags: --lts, --no-colors

### `od` (https://www.gnu.org/software/coreutils/manual/coreutils.html#od-invocation)

- Allowed standalone flags: --output-duplicates, --traditional, -b, -c, -d, -f, -i, -l, -o, -s, -v, -x
- Allowed valued flags: --address-radix, --endian, --format, --read-bytes, --skip-bytes, --strings, --width, -A, -N, -S, -j, -t, -w
- Bare invocation allowed

### `ollama` (https://github.com/ollama/ollama/blob/main/docs/api.md)

- **list**: Flags: --json
- **ps**: Flags: --json
- **show**: Flags: --json, --license, --modelfile, --parameters, --system, --template, --verbose

### `otool` (https://ss64.com/mac/otool.html)

- Allowed standalone flags: -D, -I, -L, -V, -X, -a, -c, -d, -f, -h, -l, -o, -r, -t, -v, -x
- Allowed valued flags: -p, -s

### `paste` (https://www.gnu.org/software/coreutils/manual/coreutils.html#paste-invocation)

- Allowed standalone flags: --serial, --zero-terminated, -s, -z
- Allowed valued flags: --delimiters, -d
- Bare invocation allowed

### `periphery` (https://github.com/peripheryapp/periphery)

- **scan**: Flags: --quiet, --skip-build, --strict, --verbose. Valued: --config, --format, --index-store-path, --project, --schemes, --targets
- **version**

### `perl` (https://perldoc.perl.org/perl)

- Allowed: -e/-E inline one-liners with safe built-in functions, --version, --help, -v, -V. Requires -e/-E flag. Code is validated against a safe identifier allowlist.

### `pgrep` (https://man7.org/linux/man-pages/man1/pgrep.1.html)

- Allowed standalone flags: --count, --delimiter, --full, --inverse, --lightweight, --list-full, --list-name, --newest, --oldest, -L, -a, -c, -f, -i, -l, -n, -o, -v, -w, -x
- Allowed valued flags: --euid, --group, --parent, --pgroup, --pidfile, --session, --terminal, --uid, -F, -G, -P, -U, -d, -g, -s, -t, -u

### `pip / pip3` (https://pip.pypa.io/en/stable/cli/)

- **check**
- **config get**
- **config list**
- **debug**
- **freeze**: Flags: --all, --exclude-editable, --local, --user. Valued: --exclude, --path
- **help**
- **index**
- **inspect**
- **list**: Flags: --editable, --exclude-editable, --include-editable, --local, --not-required, --outdated, --pre, --uptodate, --user. Valued: --exclude, --format, --index-url, --path
- **show**: Flags: --files, --verbose

### `pkgutil` (https://ss64.com/mac/pkgutil.html)

- Requires a read-only flag (--pkgs, --files, --pkg-info, etc.).

### `plutil` (https://ss64.com/mac/plutil.html)

- Info flags: -help
- **-lint**: Flags: -s
- **-p**
- **-type**

### `pmset` (https://ss64.com/mac/pmset.html)

- Allowed: -g (get/display settings only).

### `pnpm` (https://pnpm.io/pnpm-cli)

- **audit**: Flags: --json, --recursive. Valued: --filter
- **list**: Flags: --dev, --json, --long, --no-optional, --parseable, --production, --recursive. Valued: --depth, --filter
- **ls**: Flags: --dev, --json, --long, --no-optional, --parseable, --production, --recursive. Valued: --depth, --filter
- **outdated**: Flags: --json, --recursive. Valued: --filter
- **why**: Flags: --json, --recursive. Valued: --filter

### `pod` (https://guides.cocoapods.org/terminal/commands.html)

- **env**
- **info**
- **list**
- **search**: Flags: --simple, --stats, --web
- **spec cat**: Valued: --version
- **spec which**: Valued: --version

### `poetry` (https://python-poetry.org/docs/cli/)

- **check**: Flags: --lock
- **env info**: Flags: --full-path
- **env list**: Flags: --full-path
- **show**: Flags: --all, --latest, --no-dev, --outdated, --top-level, --tree. Valued: --why

### `printenv` (https://www.gnu.org/software/coreutils/manual/coreutils.html#printenv-invocation)

- Allowed standalone flags: --null, -0
- Bare invocation allowed

### `printf` (https://www.gnu.org/software/coreutils/manual/coreutils.html#printf-invocation)

- Positional arguments only

### `procs` (https://github.com/dalance/procs#readme)

- Allowed standalone flags: --no-header, --or, --tree, --watch-interval, -l, -t
- Allowed valued flags: --color, --completion, --config, --gen-completion, --insert, --only, --pager, --sorta, --sortd, --theme, -i, -w
- Bare invocation allowed

### `ps` (https://man7.org/linux/man-pages/man1/ps.1.html)

- Allowed standalone flags: --cumulative, --deselect, --forest, --headers, --info, --no-headers, -A, -C, -H, -L, -M, -N, -S, -T, -Z, -a, -c, -d, -e, -f, -j, -l, -m, -r, -v, -w, -x
- Allowed valued flags: --cols, --columns, --format, --group, --pid, --ppid, --rows, --sid, --sort, --tty, --user, --width, -G, -O, -U, -g, -n, -o, -p, -s, -t, -u
- Bare invocation allowed

### `pwd` (https://www.gnu.org/software/coreutils/manual/coreutils.html#pwd-invocation)

- Allowed standalone flags: -L, -P
- Bare invocation allowed

### `pyenv` (https://github.com/pyenv/pyenv#readme)

- **help**: Flags: --bare
- **root**: Flags: --bare
- **shims**: Flags: --bare
- **version**: Flags: --bare
- **versions**: Flags: --bare
- **which**: Flags: --bare

### `rbenv` (https://github.com/rbenv/rbenv#readme)

- **help**
- **root**
- **shims**
- **version**
- **versions**
- **which**

### `readlink` (https://www.gnu.org/software/coreutils/manual/coreutils.html#readlink-invocation)

- Allowed standalone flags: --canonicalize, --canonicalize-existing, --canonicalize-missing, --no-newline, --verbose, --zero, -e, -f, -m, -n, -v, -z

### `realpath` (https://www.gnu.org/software/coreutils/manual/coreutils.html#realpath-invocation)

- Allowed standalone flags: --canonicalize-existing, --canonicalize-missing, --logical, --no-symlinks, --physical, --quiet, --strip, --zero, -L, -P, -e, -m, -q, -s, -z
- Allowed valued flags: --relative-base, --relative-to

### `rev` (https://man7.org/linux/man-pages/man1/rev.1.html)

- Bare invocation allowed

### `rg` (https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md)

- Allowed standalone flags: --binary, --block-buffered, --byte-offset, --case-sensitive, --column, --count, --count-matches, --crlf, --debug, --files, --files-with-matches, --files-without-match, --fixed-strings, --follow, --glob-case-insensitive, --heading, --hidden, --ignore-case, --ignore-file-case-insensitive, --include-zero, --invert-match, --json, --line-buffered, --line-number, --line-regexp, --max-columns-preview, --mmap, --multiline, --multiline-dotall, --no-config, --no-filename, --no-heading, --no-ignore, --no-ignore-dot, --no-ignore-exclude, --no-ignore-files, --no-ignore-global, --no-ignore-messages, --no-ignore-parent, --no-ignore-vcs, --no-line-number, --no-messages, --no-mmap, --no-pcre2-unicode, --no-require-git, --no-unicode, --null, --null-data, --one-file-system, --only-matching, --passthru, --pcre2, --pcre2-version, --pretty, --quiet, --search-zip, --smart-case, --sort-files, --stats, --text, --trim, --type-list, --unicode, --unrestricted, --vimgrep, --with-filename, --word-regexp, -F, -H, -I, -L, -N, -P, -S, -U, -V, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -s, -u, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --color, --colors, --context, --context-separator, --dfa-size-limit, --encoding, --engine, --field-context-separator, --field-match-separator, --file, --glob, --iglob, --ignore-file, --max-columns, --max-count, --max-depth, --max-filesize, --path-separator, --regex-size-limit, --regexp, --replace, --sort, --sortr, --threads, --type, --type-add, --type-clear, --type-not, -A, -B, -C, -E, -M, -T, -e, -f, -g, -j, -m, -r, -t

### `route` (https://man7.org/linux/man-pages/man8/route.8.html)

- Allowed subcommands: get, monitor, print, show
- Allowed flags: -4, -6, -n, -v
- Bare invocation allowed

### `rustup` (https://rust-lang.github.io/rustup/)

- **component list**: Flags: --installed. Valued: --toolchain
- **doc**: Flags: --alloc, --book, --cargo, --core, --edition-guide, --embedded-book, --nomicon, --path, --proc_macro, --reference, --rust-by-example, --rustc, --rustdoc, --std, --test, --unstable-book. Valued: --toolchain
- **run**: run <toolchain> delegates to inner command.
- **show**: Flags: --installed
- **target list**: Flags: --installed. Valued: --toolchain
- **toolchain list**: Flags: --installed. Valued: --toolchain
- **which**: Valued: --toolchain

### `safe-chains` (https://github.com/michaeldhopkins/safe-chains#readme)

- Any arguments allowed (safe-chains is this tool).

### `security` (https://ss64.com/mac/security.html)

- **cms**
- **dump-keychain**
- **dump-trust-settings**
- **find-certificate**: Flags: -Z, -a, -p. Valued: -c, -e
- **find-generic-password**: Valued: -D, -a, -c, -d, -j, -l, -r, -s, -t
- **find-identity**: Flags: -v. Valued: -p, -s
- **find-internet-password**: Valued: -D, -a, -c, -d, -j, -l, -r, -s, -t
- **list-keychains**: Flags: -d
- **show-keychain-info**
- **smartcard**
- **verify-cert**: Flags: -L, -l, -q. Valued: -c, -k, -n, -p, -r

### `sed` (https://www.gnu.org/software/sed/manual/sed.html)

- Allowed standalone flags: --debug, --posix, --quiet, --sandbox, --silent, --unbuffered, -E, -n, -r, -u, -z
- Allowed valued flags: --expression, --file, --line-length, -e, -f, -l
- Inline expressions validated for safety

### `seq` (https://www.gnu.org/software/coreutils/manual/coreutils.html#seq-invocation)

- Allowed standalone flags: --equal-width, -w
- Allowed valued flags: --format, --separator, -f, -s, -t

### `sha1sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha1sum-invocation)

- Allowed standalone flags: --binary, --check, --ignore-missing, --quiet, --status, --strict, --tag, --text, --warn, --zero, -b, -c, -t, -w, -z
- Bare invocation allowed

### `sha256sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha2-utilities)

- Allowed standalone flags: --binary, --check, --ignore-missing, --quiet, --status, --strict, --tag, --text, --warn, --zero, -b, -c, -t, -w, -z
- Bare invocation allowed

### `sha512sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha2-utilities)

- Allowed standalone flags: --binary, --check, --ignore-missing, --quiet, --status, --strict, --tag, --text, --warn, --zero, -b, -c, -t, -w, -z
- Bare invocation allowed

### `shasum` (https://perldoc.perl.org/shasum)

- Allowed standalone flags: --binary, --check, --portable, --status, --strict, --tag, --text, --warn, -0, -b, -c, -p, -s, -t
- Allowed valued flags: --algorithm, -a
- Bare invocation allowed

### `shellcheck` (https://www.shellcheck.net/wiki/)

- Allowed standalone flags: --color, --external-sources, --list-optional, --norc, --severity, --wiki-link-count, -C, -a, -x
- Allowed valued flags: --enable, --exclude, --format, --include, --rcfile, --severity, --shell, --source-path, --wiki-link-count, -P, -S, -W, -e, -f, -i, -o, -s

### `simctl` (https://developer.apple.com/documentation/xcode/simctl)

- **list**: Flags: --json, --verbose

### `size` (https://man7.org/linux/man-pages/man1/size.1.html)

- Allowed standalone flags: --common, --totals, -A, -B, -G, -d, -o, -t, -x
- Allowed valued flags: --format, --radix, --target

### `sleep` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sleep-invocation)

- Positional arguments only

### `sort` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sort-invocation)

- Allowed standalone flags: --check, --debug, --dictionary-order, --general-numeric-sort, --human-numeric-sort, --ignore-case, --ignore-leading-blanks, --ignore-nonprinting, --merge, --month-sort, --numeric-sort, --random-sort, --reverse, --stable, --unique, --version-sort, --zero-terminated, -C, -M, -R, -V, -b, -c, -d, -f, -g, -h, -i, -m, -n, -r, -s, -u, -z
- Allowed valued flags: --batch-size, --buffer-size, --field-separator, --files0-from, --key, --parallel, --random-source, --sort, --temporary-directory, -S, -T, -k, -t
- Bare invocation allowed

### `spctl` (https://ss64.com/mac/spctl.html)

- Requires --assess/-a.

### `ss` (https://man7.org/linux/man-pages/man8/ss.8.html)

- Allowed standalone flags: --all, --dccp, --extended, --family, --help, --info, --ipv4, --ipv6, --listening, --memory, --no-header, --numeric, --oneline, --options, --packet, --processes, --raw, --resolve, --sctp, --summary, --tcp, --tipc, --udp, --unix, --version, --vsock, -0, -4, -6, -E, -H, -O, -V, -a, -e, -i, -l, -m, -n, -o, -p, -r, -s, -t, -u, -w, -x
- Allowed valued flags: --filter, --query, -A, -F, -f
- Bare invocation allowed

### `stat` (https://www.gnu.org/software/coreutils/manual/coreutils.html#stat-invocation)

- Allowed standalone flags: --dereference, --file-system, --terse, -F, -L, -l, -n, -q, -r, -s, -x
- Allowed valued flags: --format, --printf, -c, -f, -t

### `strings` (https://man7.org/linux/man-pages/man1/strings.1.html)

- Allowed standalone flags: --all, --include-all-whitespace, --print-file-name, -a, -f, -w
- Allowed valued flags: --bytes, --encoding, --output-separator, --radix, --target, -T, -e, -n, -o, -s, -t

### `sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sum-invocation)

- Allowed standalone flags: --sysv, -r, -s
- Bare invocation allowed

### `sw_vers` (https://ss64.com/mac/sw_vers.html)

- Allowed standalone flags: --buildVersion, --productName, --productVersion, --productVersionExtra
- Bare invocation allowed

### `swift` (https://www.swift.org/documentation/swift-compiler/)

- **build**: Flags: --enable-code-coverage, --show-bin-path, --skip-update, --static-swift-stdlib, --verbose. Valued: --arch, --build-path, --configuration, --jobs, --package-path, --product, --sanitize, --swift-sdk, --target, --triple
- **package describe**: Valued: --package-path, --type
- **package dump-package**: Valued: --package-path
- **package show-dependencies**: Valued: --format, --package-path
- **test**: Flags: --enable-code-coverage, --list-tests, --parallel, --show-codecov-path, --skip-build, --skip-update, --verbose. Valued: --arch, --build-path, --configuration, --filter, --jobs, --num-workers, --package-path, --sanitize, --skip-tests, --swift-sdk, --target, --triple, --xunit-output

### `swiftformat` (https://github.com/nicklockwood/SwiftFormat)

- Requires --lint or --dryrun.

### `swiftlint` (https://github.com/realm/SwiftLint)

- **analyze**: Flags: --quiet, --strict. Valued: --compiler-log-path, --config, --path, --reporter
- **lint**: Flags: --no-cache, --quiet, --strict. Valued: --config, --path, --reporter
- **reporters**
- **rules**: Flags: --disabled, --enabled. Valued: --config, --reporter
- **version**

### `sysctl` (https://man7.org/linux/man-pages/man8/sysctl.8.html)

- Read-only usage.

### `system_profiler` (https://ss64.com/mac/system_profiler.html)

- Allowed standalone flags: --json, --xml, -json, -listDataTypes, -nospinner, -xml
- Allowed valued flags: -detailLevel, -timeout
- Bare invocation allowed

### `tac` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tac-invocation)

- Allowed standalone flags: --before, --regex, -b, -r
- Allowed valued flags: --separator, -s
- Bare invocation allowed

### `tail` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tail-invocation)

- Allowed standalone flags: --follow, --quiet, --retry, --silent, --verbose, --zero-terminated, -F, -f, -q, -r, -v, -z
- Allowed valued flags: --bytes, --lines, --max-unchanged-stats, --pid, --sleep-interval, -b, -c, -n
- Bare invocation allowed

### `tea` (https://gitea.com/gitea/tea)

- Subcommands b, branch, branches, i, issue, issues, label, labels, milestone, milestones, ms, n, notification, notifications, org, organization, organizations, pr, pull, pulls, r, release, releases, repo, repos, t, time, times are allowed with actions: list, view or bare invocation.
- Always safe: --version, -v, whoami.
- logins/login (list only).

### `terraform` (https://developer.hashicorp.com/terraform/cli/commands)

- **fmt** (requires --check): Flags: --check, --diff, --no-color, --recursive
- **graph**: Flags: --draw-cycles. Valued: --plan, --type
- **output**: Flags: --json, --no-color, --raw. Valued: --state
- **providers**
- **show**: Flags: --json, --no-color
- **state list**: Valued: --id, --state
- **state show**: Valued: --state
- **validate**: Flags: --json, --no-color
- **version**: Flags: --json

### `test` (https://www.gnu.org/software/coreutils/manual/coreutils.html#test-invocation)

- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `time` (https://man7.org/linux/man-pages/man1/time.1.html)

- Skips -p flag, then recursively validates the inner command.

### `timeout` (https://www.gnu.org/software/coreutils/manual/coreutils.html#timeout-invocation)

- Skips timeout flags (-s/--signal, -k/--kill-after, --preserve-status), then recursively validates the inner command.

### `tokei` (https://github.com/XAMPPRocky/tokei#readme)

- Allowed standalone flags: --compact, --files, --hidden, --no-ignore, --no-ignore-dot, --no-ignore-parent, --no-ignore-vcs, --verbose, -C, -V, -f
- Allowed valued flags: --columns, --exclude, --input, --languages, --num-format, --output, --sort, --type, -c, -e, -i, -l, -o, -s, -t
- Bare invocation allowed

### `top` (https://man7.org/linux/man-pages/man1/top.1.html)

- Allowed standalone flags: -1, -B, -E, -H, -S, -b, -c, -e, -i
- Allowed valued flags: -F, -O, -U, -d, -f, -l, -n, -o, -p, -s, -u, -w
- Bare invocation allowed

### `tr` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tr-invocation)

- Allowed standalone flags: --complement, --delete, --squeeze-repeats, --truncate-set1, -C, -c, -d, -s

### `tree` (https://man7.org/linux/man-pages/man1/tree.1.html)

- Allowed standalone flags: --dirsfirst, --du, --fromfile, --gitignore, --help, --inodes, --matchdirs, --noreport, --prune, --si, --version, -A, -C, -D, -F, -J, -N, -Q, -S, -X, -a, -d, -f, -g, -h, -i, -l, -n, -p, -q, -r, -s, -t, -u, -v, -x
- Allowed valued flags: --charset, --filelimit, --filesfrom, --sort, --timefmt, -H, -I, -L, -P, -T
- Bare invocation allowed

### `true` (https://www.gnu.org/software/coreutils/manual/coreutils.html#true-invocation)

- Bare invocation allowed

### `tty` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tty-invocation)

- Allowed standalone flags: --quiet, --silent, -s
- Bare invocation allowed

### `tuist` (https://docs.tuist.dev/en/cli/)

- **dump**: Flags: --json, --verbose. Valued: --path
- **graph**: Flags: --json, --verbose. Valued: --format, --path
- **hash cache**: Flags: --json, --verbose. Valued: --path
- **hash selective-testing**: Flags: --json, --verbose. Valued: --path
- **inspect build**: Flags: --json, --verbose. Valued: --path
- **inspect bundle**: Flags: --json, --verbose. Valued: --path
- **inspect dependencies**: Flags: --json, --verbose. Valued: --path
- **inspect implicit-imports**: Flags: --json, --verbose. Valued: --path
- **inspect redundant-imports**: Flags: --json, --verbose. Valued: --path
- **inspect test**: Flags: --json, --verbose. Valued: --path
- **migration check-empty-settings**: Valued: --path
- **migration list-targets**: Valued: --path
- **scaffold list**: Flags: --json. Valued: --path
- **version**

### `type` (https://man7.org/linux/man-pages/man1/type.1p.html)

- Allowed standalone flags: -P, -a, -f, -p, -t

### `uname` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uname-invocation)

- Allowed standalone flags: --all, --kernel-name, --kernel-release, --kernel-version, --machine, --nodename, --operating-system, --processor, -a, -m, -n, -o, -p, -r, -s, -v
- Bare invocation allowed

### `unexpand` (https://www.gnu.org/software/coreutils/manual/coreutils.html#unexpand-invocation)

- Allowed standalone flags: --all, --first-only, -a
- Allowed valued flags: --tabs, -t
- Bare invocation allowed

### `uniq` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uniq-invocation)

- Allowed standalone flags: --count, --ignore-case, --repeated, --unique, --zero-terminated, -D, -c, -d, -i, -u, -z
- Allowed valued flags: --all-repeated, --check-chars, --group, --skip-chars, --skip-fields, -f, -s, -w
- Bare invocation allowed

### `unset` (https://man7.org/linux/man-pages/man1/unset.1p.html)

- Allowed standalone flags: -f, -n, -v
- Bare invocation allowed

### `uptime` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uptime-invocation)

- Allowed standalone flags: --pretty, --since, -p, -s
- Bare invocation allowed

### `uuidgen` (https://man7.org/linux/man-pages/man1/uuidgen.1.html)

- Allowed standalone flags: --random, --time, -r, -t
- Allowed valued flags: --md5, --name, --namespace, --sha1, -N, -m, -n, -s
- Bare invocation allowed

### `uv` (https://docs.astral.sh/uv/reference/cli/)

- **pip check**: Flags: --verbose. Valued: --python
- **pip freeze**: Flags: --verbose. Valued: --python
- **pip list**: Flags: --editable, --exclude-editable, --outdated, --strict. Valued: --exclude, --format, --python
- **pip show**: Flags: --files, --verbose. Valued: --python
- **python list**: Flags: --verbose. Valued: --python
- **tool list**: Flags: --verbose. Valued: --python

### `vercel` (https://vercel.com/docs/cli)

- **inspect**: Flags: --json. Valued: --scope, --timeout
- **list**: Flags: --json. Valued: --meta, --next, --scope
- **project ls**: Flags: --json. Valued: --scope
- **whoami**

### `vm_stat` (https://ss64.com/mac/vm_stat.html)

- Allowed valued flags: -c
- Bare invocation allowed

### `volta` (https://docs.volta.sh/reference)

- **list**: Flags: --current, --default. Valued: --format
- **which**: Flags: --current, --default. Valued: --format

### `w` (https://man7.org/linux/man-pages/man1/w.1.html)

- Allowed standalone flags: --from, --ip-addr, --no-current, --no-header, --old-style, --short, -f, -h, -i, -o, -s, -u
- Bare invocation allowed

### `wc` (https://www.gnu.org/software/coreutils/manual/coreutils.html#wc-invocation)

- Allowed standalone flags: --bytes, --chars, --lines, --max-line-length, --words, --zero-terminated, -L, -c, -l, -m, -w
- Allowed valued flags: --files0-from
- Bare invocation allowed

### `whereis` (https://man7.org/linux/man-pages/man1/whereis.1.html)

- Allowed standalone flags: -b, -l, -m, -s, -u
- Allowed valued flags: -B, -M, -S, -f

### `which` (https://man7.org/linux/man-pages/man1/which.1.html)

- Allowed standalone flags: --all, -a, -s

### `who` (https://www.gnu.org/software/coreutils/manual/coreutils.html#who-invocation)

- Allowed standalone flags: --all, --boot, --count, --dead, --heading, --login, --lookup, --mesg, --message, --process, --runlevel, --short, --time, --users, --writable, -H, -T, -a, -b, -d, -l, -m, -p, -q, -r, -s, -t, -u, -w
- Bare invocation allowed

### `whoami` (https://www.gnu.org/software/coreutils/manual/coreutils.html#whoami-invocation)

- Bare invocation allowed

### `whois` (https://man7.org/linux/man-pages/man1/whois.1.html)

- Allowed standalone flags: -A, -B, -G, -H, -I, -K, -L, -M, -Q, -R, -S, -a, -b, -c, -d, -f, -g, -l, -m, -r, -x
- Allowed valued flags: -T, -V, -h, -i, -p, -s, -t

### `xargs` (https://www.gnu.org/software/findutils/manual/html_mono/find.html#Invoking-xargs)

- Recursively validates the inner command. Skips xargs-specific flags (-I, -L, -n, -P, -s, -E, -d, -0, -r, -t, -p, -x).

### `xcbeautify` (https://github.com/cpisciotta/xcbeautify)

- Allowed standalone flags: --is-ci, --quiet, --quieter
- Allowed valued flags: --renderer
- Bare invocation allowed

### `xcode-select` (https://ss64.com/mac/xcode-select.html)

- Info flags: -p, --print-path, -v, --version

### `xcodebuild` (https://developer.apple.com/documentation/xcode/xcodebuild)

- **-list**: Flags: -json. Valued: -project, -workspace
- **-showBuildSettings**: Flags: -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-showdestinations**: Flags: -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-showsdks**: Flags: -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-version**

### `xcodegen` (https://github.com/yonaskolb/XcodeGen)

- **dump**: Flags: --no-env, --quiet. Valued: --project-root, --spec, --type
- **version**

### `xcrun` (https://ss64.com/mac/xcrun.html)

- Allowed: --find, --show-sdk-*, --show-toolchain-path. Multi-level: notarytool history/info/log, simctl list, stapler validate. Prefix flags --sdk/--toolchain (with arg), -v/-l/-n are skipped.

### `xmllint` (https://gnome.pages.gitlab.gnome.org/libxml2/xmllint.html)

- Allowed standalone flags: --auto, --catalogs, --compress, --copy, --debug, --debugent, --dropdtd, --format, --html, --htmlout, --huge, --load-trace, --loaddtd, --memory, --noblanks, --nocatalogs, --nocdata, --nocompact, --nodefdtd, --noenc, --noent, --nonet, --noout, --nowarning, --nowrap, --nsclean, --oldxml10, --postvalid, --push, --pushsmall, --quiet, --recover, --repeat, --sax, --sax1, --stream, --testIO, --timing, --valid, --version, --walker, --xinclude, --xmlout
- Allowed valued flags: --dtdvalid, --dtdvalidfpi, --encode, --maxmem, --path, --pattern, --pretty, --relaxng, --schema, --schematron, --xpath

### `xxd` (https://man7.org/linux/man-pages/man1/xxd.1.html)

- Allowed standalone flags: --autoskip, --bits, --capitalize, --decimal, --ebcdic, --include, --little-endian, --plain, --postscript, --revert, --uppercase, -C, -E, -a, -b, -d, -e, -i, -p, -r, -u
- Allowed valued flags: --color, --cols, --groupsize, --len, --name, --offset, --seek, -R, -c, -g, -l, -n, -o, -s
- Bare invocation allowed

### `yarn` (https://yarnpkg.com/cli)

- Subcommands: info, list, ls, test, test:*, why.

### `yq` (https://mikefarah.gitbook.io/yq)

- Allowed standalone flags: --colors, --exit-status, --help, --no-colors, --no-doc, --null-input, --prettyPrint, --version, -C, -M, -N, -P, -e, -r
- Allowed valued flags: --arg, --argjson, --expression, --front-matter, --indent, --input-format, --output-format, -I, -p