safe-chains 0.95.0

# Supported Commands

Auto-generated by `safe-chains --list-commands`. These commands, subcommands, and flags are safe to run individually or in combination.

## Glossary

| Term | Meaning |
|------|---------|
| **Allowed standalone flags** | Flags that take no value (`--verbose`, `-v`). Listed on flat commands. |
| **Flags** | Same as standalone flags, but in the shorter format used within subcommand entries. |
| **Allowed valued flags** | Flags that require a value (`--output file`, `-j 4`). |
| **Valued** | Same as valued flags, in shorter format within subcommand entries. |
| **Bare invocation allowed** | The command can be run with no arguments at all. |
| **Subcommands** | Named subcommands that are allowed (e.g. `git log`, `cargo test`). |
| **Positional arguments only** | No specific flags are listed; only positional arguments are accepted. |
| **(requires --flag)** | A guarded subcommand that is only allowed when a specific flag is present (e.g. `cargo fmt` requires `--check`). |

Unlisted flags, subcommands, and commands are not allowed.

### `aapt2` (https://developer.android.com/tools/aapt2)

- Allowed standalone flags: --help, --version, -V, -h
- **dump badging**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump configurations**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump permissions**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump resources**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump strings**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump styleparents**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump xmlstrings**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **dump xmltree**: Flags: --help, --no-values, -h, -v. Valued: --config, --file
- **version**: Flags: --help, -h

### `ack` (https://beyondgrep.com/documentation/)

- Allowed standalone flags: --color, --column, --count, --files-with-matches, --files-without-matches, --flush, --follow, --group, --heading, --help, --ignore-case, --invert-match, --line, --literal, --match, --no-color, --no-filename, --no-follow, --no-group, --no-heading, --nocolor, --noenv, --nofilter, --nofollow, --nogroup, --noheading, --nopager, --nosmart-case, --passthru, --print0, --show-types, --smart-case, --sort-files, --version, --with-filename, --word-regexp, -1, -H, -L, -V, -c, -f, -h, -i, -l, -n, -s, -v, -w, -x
- Allowed valued flags: --after-context, --before-context, --context, --ignore-dir, --max-count, --noignore-dir, --output, --pager, --type, --type-add, --type-del, --type-set, -A, -B, -C, -m

### `adb` (https://developer.android.com/tools/adb)

- Bare subcommands: devices, get-serialno, get-state, help, start-server, version. forward --list, reverse --list. logcat (requires -d). shell: cat, df, dumpsys, getprop, id, ls, pm list/path, ps, settings get, uname, whoami, wm size/density. Prefix flag -s SERIAL is skipped.

### `ag` (https://github.com/ggreer/the_silver_searcher)

- Allowed standalone flags: --ackmate, --all-text, --all-types, --case-sensitive, --color, --column, --count, --filename, --files-with-matches, --files-without-matches, --fixed-strings, --follow, --group, --heading, --help, --hidden, --ignore-case, --invert-match, --line-numbers, --literal, --no-break, --no-color, --no-filename, --no-follow, --no-group, --no-heading, --no-numbers, --nobreak, --nocolor, --nofilename, --nofollow, --nogroup, --noheading, --nonumbers, --null, --numbers, --one-device, --only-matching, --print-all-files, --print-long-lines, --search-binary, --search-files, --search-zip, --silent, --smart-case, --stats, --unrestricted, --version, --vimgrep, --word-regexp, -0, -H, -L, -Q, -S, -U, -V, -a, -c, -f, -h, -i, -l, -n, -s, -u, -v, -w
- Allowed valued flags: --after, --before, --context, --depth, --file-search-regex, --ignore, --max-count, --pager, --path-to-ignore, --workers, -A, -B, -C, -G, -g, -m

### `agvtool` (https://developer.apple.com/library/archive/qa/qa1827/_index.html)

- **mvers**: Flags: --help, -h
- **vers**: Flags: --help, -h
- **what-marketing-version**: Flags: --help, -h
- **what-version**: Flags: --help, -h

### `aider` (https://aider.chat/docs/)

- Allowed standalone flags: --check-update, --help, --just-check-update, --list-models, --models, --show-prompts, --show-release-notes, --show-repo-map, --version, -V, -h

### `alias` (https://man7.org/linux/man-pages/man1/alias.1p.html)

- Allowed standalone flags: -p
- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `apkanalyzer` (https://developer.android.com/tools/apkanalyzer)

- Allowed standalone flags: --help, --version, -V, -h
- **apk compare**: Flags: --help, -h
- **apk download-size**: Flags: --help, -h
- **apk features**: Flags: --help, --not-required, -h
- **apk file-size**: Flags: --help, -h
- **apk summary**: Flags: --help, -h
- **dex code**: Flags: --help, -h
- **dex list**: Flags: --help, -h
- **dex packages**: Flags: --defined-only, --help, -h. Valued: --files, --proguard-folder, --proguard-mappings, --proguard-seeds, --proguard-usages
- **dex references**: Flags: --help, -h
- **files cat**: Flags: --help, -h
- **files list**: Flags: --help, -h
- **manifest application-id**: Flags: --help, -h
- **manifest debuggable**: Flags: --help, -h
- **manifest min-sdk**: Flags: --help, -h
- **manifest permissions**: Flags: --help, -h
- **manifest print**: Flags: --help, -h
- **manifest target-sdk**: Flags: --help, -h
- **manifest version-code**: Flags: --help, -h
- **manifest version-name**: Flags: --help, -h
- **resources configs**: Flags: --help, -h. Valued: --config, --name, --type
- **resources names**: Flags: --help, -h. Valued: --config, --name, --type
- **resources value**: Flags: --help, -h. Valued: --config, --name, --type
- **resources xml**: Flags: --help, -h

### `apksigner` (https://developer.android.com/tools/apksigner)

- Allowed standalone flags: --help, --version, -V, -h
- **help**: Flags: --help, -h
- **verify**: Flags: --help, --print-certs, --verbose, -h, -v. Valued: --in, --max-sdk-version, --min-sdk-version
- **version**: Flags: --help, -h

### `arch` (https://www.gnu.org/software/coreutils/manual/coreutils.html#arch-invocation)

- Bare invocation allowed.

### `asdf` (https://asdf-vm.com/manage/commands.html)

- Allowed standalone flags: --help, --version, -V, -h
- **current**: Flags: --help, -h
- **help**: Flags: --help, -h
- **info**: Flags: --help, -h
- **list**: Flags: --help, -h
- **plugin list**: Flags: --help, -h
- **plugin-list**: Flags: --help, -h
- **plugin-list-all**: Flags: --help, -h
- **version**: Flags: --help, -h
- **which**: Flags: --help, -h

### `avdmanager` (https://developer.android.com/tools/avdmanager)

- Allowed standalone flags: --help, --version, -V, -h
- **list avd**: Flags: --compact, --help, -c, -h
- **list device**: Flags: --compact, --help, -c, -h
- **list target**: Flags: --compact, --help, -c, -h

### `awk / gawk / mawk / nawk` (https://www.gnu.org/software/gawk/manual/gawk.html)

- Program validated: system, getline, |, > constructs checked
- Allowed standalone flags: --characters-as-bytes, --copyright, --gen-pot, --lint, --no-optimize, --optimize, --posix, --re-interval, --sandbox, --traditional, --use-lc-numeric, --version, -C, -N, -O, -P, -S, -V, -b, -c, -g, -r, -s, -t
- Allowed valued flags: --assign, --field-separator, -F, -v

### `b2sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#b2sum-invocation)

- Allowed standalone flags: --binary, --check, --help, --ignore-missing, --quiet, --status, --strict, --tag, --text, --version, --warn, --zero, -V, -b, -c, -h, -t, -w, -z
- Allowed valued flags: --length, -l
- Bare invocation allowed

### `base64` (https://www.gnu.org/software/coreutils/manual/coreutils.html#base64-invocation)

- Allowed standalone flags: --decode, --help, --ignore-garbage, --version, -D, -V, -d, -h, -i
- Allowed valued flags: --wrap, -b, -w
- Bare invocation allowed

### `basename` (https://www.gnu.org/software/coreutils/manual/coreutils.html#basename-invocation)

- Allowed standalone flags: --help, --multiple, --version, --zero, -V, -a, -h, -z
- Allowed valued flags: --suffix, -s

### `bash / sh` (https://www.gnu.org/software/bash/manual/bash.html)

- Allowed: --version, --help, `bash -c` / `sh -c` with a safe inner command.

### `bat` (https://github.com/sharkdp/bat#readme)

- Allowed standalone flags: --diff, --help, --list-languages, --list-themes, --no-config, --number, --plain, --show-all, --version, -A, -P, -V, -d, -h, -n, -p, -u
- Allowed valued flags: --color, --decorations, --diff-context, --file-name, --highlight-line, --italic-text, --language, --line-range, --map-syntax, --paging, --style, --tabs, --terminal-width, --theme, --wrap, -H, -l, -m, -r
- Bare invocation allowed

### `bc` (https://www.gnu.org/software/bc/manual/html_mono/bc.html)

- Allowed standalone flags: --digit-clamp, --global-stacks, --help, --interactive, --mathlib, --no-digit-clamp, --no-line-length, --no-prompt, --no-read-prompt, --quiet, --standard, --version, --warn, -C, -P, -R, -V, -c, -g, -h, -i, -l, -q, -s, -w
- Allowed valued flags: --expression, --file, --ibase, --obase, --redefine, --scale, --seed, -E, -I, -O, -S, -e, -f, -r
- Bare invocation allowed

### `branchdiff` (https://github.com/michaeldhopkins/branchdiff)

- Allowed standalone flags: --diff, --help, --no-auto-fetch, --print, --version, -V, -d, -h, -p
- Bare invocation allowed

### `brew` (https://docs.brew.sh/Manpage)

- Allowed standalone flags: --help, --version, -V, -h
- **--prefix**: Flags: --help, -h, -q, -v
- **--repository**: Flags: --help, -h, -q, -v
- **abv**: Flags: --analytics, --cask, --formula, --help, --installed, --json, -h, -v. Valued: --days
- **casks**: Flags: --help, -h, -q, -v
- **cat**: Flags: --help, -h, -q, -v
- **config**: Flags: --help, -h, -q, -v
- **deps**: Flags: --1, --annotate, --cask, --direct, --for-each, --formula, --full-name, --graph, --help, --include-build, --include-optional, --include-test, --installed, --missing, --skip-recommended, --tree, --union, -h, -n
- **desc**: Flags: --cask, --description, --eval-all, --formula, --help, --name, --search, -d, -h, -n, -s
- **doctor**: Flags: --help, -h, -q, -v
- **formulae**: Flags: --help, -h, -q, -v
- **home**: Flags: --help, -h, -q, -v
- **info**: Flags: --analytics, --cask, --formula, --help, --installed, --json, -h, -v. Valued: --days
- **leaves**: Flags: --help, -h, -q, -v
- **list**: Flags: --cask, --formula, --full-name, --help, --multiple, --pinned, --versions, -1, -h, -l, -r, -t
- **log**: Flags: --cask, --formula, --help, --oneline, -1, -h. Valued: --max-count, -n
- **ls**: Flags: --cask, --formula, --full-name, --help, --multiple, --pinned, --versions, -1, -h, -l, -r, -t
- **outdated**: Flags: --cask, --fetch-HEAD, --formula, --greedy, --greedy-auto-updates, --greedy-latest, --help, --json, -d, -h, -q, -v
- **search**: Flags: --cask, --closed, --debian, --desc, --fedora, --fink, --formula, --help, --macports, --open, --opensuse, --pull-request, --repology, --ubuntu, -h
- **services info**: Flags: --all, --help, --json, -h
- **services list**: Flags: --help, --json, -h
- **shellenv**: Flags: --help, -h, -q, -v
- **tap**: Flags: --help, -h, -q, -v
- **tap-info**: Flags: --help, -h, -q, -v
- **uses**: Flags: --cask, --formula, --help, --include-build, --include-optional, --include-test, --installed, --missing, --recursive, --skip-recommended, -h

### `bun` (https://bun.sh/docs/cli)

- Allowed standalone flags: --help, --version, -V, -h
- **build**: Flags: --bytecode, --compile, --css-chunking, --emit-dce-annotations, --help, --minify, --minify-identifiers, --minify-syntax, --minify-whitespace, --no-bundle, --no-clear-screen, --production, --react-fast-refresh, --splitting, --watch, --windows-hide-console, -h. Valued: --asset-naming, --banner, --chunk-naming, --conditions, --entry-naming, --env, --external, --footer, --format, --outdir, --outfile, --packages, --public-path, --root, --sourcemap, --target, --windows-icon, -e
- **outdated**: Flags: --help, -h
- **pm bin**: Flags: --help, -h
- **pm cache**: Flags: --help, -h
- **pm hash**: Flags: --help, -h
- **pm ls**: Flags: --help, -h
- **test**: Flags: --bail, --help, --only, --rerun-each, --todo, -h. Valued: --preload, --timeout, -t
- **x**: x delegates to bunx logic.

### `bundle` (https://bundler.io/man/bundle.1.html)

- Allowed standalone flags: --help, --version, -V, -h
- **check**: Flags: --dry-run, --help, -h. Valued: --gemfile, --path
- **config**: Bare and single-key lookup allowed. Subcommands: get, list.
- **exec**: exec allowed for: brakeman, cucumber, erb_lint, gem (read-only subcommands), herb, rails (about, assets:reveal, assets:reveal:full, db:migrate:status, db:version, initializers, middleware, notes, routes, secret, stats, test, test:system, time:zones:all, time:zones:local, version), rspec, standardrb.
- **info**: Flags: --help, --path, -h
- **list**: Flags: --help, --name-only, --paths, -h
- **show**: Flags: --help, --paths, -h

### `bundletool` (https://developer.android.com/tools/bundletool)

- Allowed standalone flags: --help, --version, -V, -h
- **dump config**: Flags: --help, -h. Valued: --bundle, --module, --xpath
- **dump manifest**: Flags: --help, -h. Valued: --bundle, --module, --xpath
- **dump resources**: Flags: --help, -h. Valued: --bundle, --module, --xpath
- **get-size total**: Flags: --help, -h. Valued: --apks, --device-spec, --dimensions, --modules
- **validate**: Flags: --help, -h. Valued: --bundle
- **version**: Flags: --help, -h

### `bunx` (https://bun.sh/docs/cli/bunx)

- Allowed packages: @herb-tools/linter, eslint, karma.
- tsc allowed with --noEmit.
- Skips flags: --bun/--no-install/--package/-p.

### `cal` (https://man7.org/linux/man-pages/man1/cal.1.html)

- Allowed standalone flags: --help, --monday, --sunday, --three, --version, --year, -1, -3, -V, -h, -j, -m, -s, -w, -y
- Allowed valued flags: -A, -B, -d, -n
- Bare invocation allowed

### `cargo` (https://doc.rust-lang.org/cargo/commands/)

- Allowed standalone flags: --help, --version, -V, -h
- **audit**: Flags: --deny, --help, --json, --no-fetch, --stale, -h, -n, -q, -v. Valued: --color, --db, --file, --ignore, --target-arch, --target-os, -f
- **bench**: Flags: --all-features, --all-targets, --benches, --bins, --doc, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-fail-fast, --no-run, --offline, --release, --tests, --timings, --unit-graph, -h, -q, -v. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test, -Z, -j, -p
- **build**: Flags: --all-features, --all-targets, --benches, --bins, --build-plan, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --offline, --release, --tests, --timings, --unit-graph, -h, -q, -v. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test, -Z, -j, -p
- **check**: Flags: --all-features, --all-targets, --benches, --bins, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --offline, --release, --tests, --timings, --unit-graph, -h, -q, -v. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test, -Z, -j, -p
- **clippy**: Flags: --all-features, --all-targets, --benches, --bins, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-deps, --offline, --release, --tests, --timings, --unit-graph, -h, -q, -v. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test, -Z, -j, -p
- **deny**: Flags: --all-features, --help, --no-default-features, -h, -q, -v. Valued: --color, --config, --exclude, --features, --format, --manifest-path, --target, --workspace
- **doc**: Flags: --all-features, --bins, --document-private-items, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --locked, --no-default-features, --no-deps, --offline, --open, --release, --timings, --unit-graph, -h, -q, -v. Valued: --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, -Z, -j, -p
- **fmt** (requires --check): Flags: --all, --check, --help, -h, -q, -v. Valued: --manifest-path, --message-format, --package, -p
- **help**: Positional args accepted
- **info**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --index, --registry
- **install**: Flags: --help, -h
- **license**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --manifest-path
- **locate-project**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --manifest-path
- **metadata**: Flags: --all-features, --frozen, --help, --locked, --no-default-features, --no-deps, --offline, -h, -q, -v. Valued: --color, --config, --features, --filter-platform, --format-version, --manifest-path
- **package** (requires --list): Flags: --all-features, --frozen, --help, --keep-going, --list, --locked, --no-default-features, --no-metadata, --offline, --workspace, -h, -l, -q, -v. Valued: --color, --config, --exclude, --features, --jobs, --manifest-path, --message-format, --package, --target, --target-dir, -F, -Z, -j, -p
- **pkgid**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --manifest-path
- **publish** (requires --dry-run): Flags: --all-features, --dry-run, --frozen, --help, --keep-going, --locked, --no-default-features, --offline, --workspace, -h, -n, -q, -v. Valued: --color, --config, --exclude, --features, --index, --jobs, --manifest-path, --package, --registry, --target, --target-dir, -F, -Z, -j, -p
- **read-manifest**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --manifest-path
- **run**: Flags: --help, -h
- **search**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --index, --limit, --registry
- **test**: Flags: --all-features, --all-targets, --benches, --bins, --doc, --examples, --frozen, --future-incompat-report, --help, --ignore-rust-version, --keep-going, --lib, --locked, --no-default-features, --no-fail-fast, --no-run, --offline, --release, --tests, --timings, --unit-graph, -h, -q, -v. Valued: --bench, --bin, --color, --config, --example, --features, --jobs, --manifest-path, --message-format, --package, --profile, --target, --target-dir, --test, -Z, -j, -p
- **tree**: Flags: --all-features, --duplicates, --frozen, --help, --ignore-rust-version, --locked, --no-dedupe, --no-default-features, --offline, -d, -e, -h, -i, -q, -v. Valued: --charset, --color, --config, --depth, --edges, --features, --format, --invert, --manifest-path, --package, --prefix, --prune, --target, -p
- **verify-project**: Flags: --frozen, --help, --locked, --offline, -h, -q, -v. Valued: --color, --config, --manifest-path

+toolchain selectors (e.g. +nightly) are skipped.

### `cat` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cat-invocation)

- Allowed standalone flags: --help, --number, --number-nonblank, --show-all, --show-ends, --show-nonprinting, --show-tabs, --squeeze-blank, --version, -A, -E, -T, -V, -b, -e, -h, -l, -n, -s, -t, -u, -v
- Bare invocation allowed

### `cd` (https://man7.org/linux/man-pages/man1/cd.1p.html)

- Allowed standalone flags: --help, --version, -L, -P, -V, -e, -h
- Bare invocation allowed

### `cksum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cksum-invocation)

- Allowed standalone flags: --base64, --check, --help, --raw, --strict, --tag, --untagged, --version, --warn, --zero, -V, -c, -h, -w, -z
- Allowed valued flags: --algorithm, --length, -a, -l
- Bare invocation allowed

### `claude` (https://docs.anthropic.com/en/docs/claude-code)

- Allowed standalone flags: --help, --version, -V, -h

### `cloc` (https://github.com/AlDanial/cloc#readme)

- Allowed standalone flags: --3, --autoconf, --by-file, --by-file-by-lang, --by-percent, --categorized, --counted, --diff, --diff-list-file, --docstring-as-code, --follow-links, --force-lang-def, --found-langs, --git, --help, --hide-rate, --ignored, --include-content, --json, --md, --no-autogen, --no3, --opt-match-d, --opt-match-f, --opt-not-match-d, --opt-not-match-f, --original-dir, --progress-rate, --quiet, --sdir, --show-ext, --show-lang, --show-os, --show-stored-lang, --skip-uniqueness, --sql-append, --strip-comments, --sum-one, --sum-reports, --unicode, --use-sloccount, --v, --vcs, --version, --xml, --yaml, -V, -h, -v
- Allowed valued flags: --config, --csv-delimiter, --diff-alignment, --diff-timeout, --exclude-content, --exclude-dir, --exclude-ext, --exclude-lang, --exclude-list-file, --force-lang, --fullpath, --include-ext, --include-lang, --lang-no-ext, --list-file, --match-d, --match-f, --not-match-d, --not-match-f, --out, --read-binary-files, --read-lang-def, --report-file, --script-lang, --skip-archive, --sql, --sql-project, --sql-style, --timeout, --write-lang-def

### `cmake` (https://cmake.org/cmake/help/latest/manual/cmake.1.html)

- Allowed standalone flags: --help, --system-information, --version, -V, -h

### `cmp` (https://man7.org/linux/man-pages/man1/cmp.1.html)

- Allowed standalone flags: --help, --print-bytes, --quiet, --silent, --verbose, --version, -V, -b, -h, -l, -s
- Allowed valued flags: --bytes, --ignore-initial, -i, -n

### `codesign` (https://ss64.com/mac/codesign.html)

- Requires --display/-d or --verify/-v.

### `codex` (https://github.com/openai/codex)

- Allowed standalone flags: --help, --version, -V, -h
- **completion**: Flags: --help, -h. Valued: --shell, -s
- **features list**: Flags: --help, -h

### `col` (https://man7.org/linux/man-pages/man1/col.1.html)

- Allowed standalone flags: --help, --version, -V, -b, -f, -h, -p, -x
- Allowed valued flags: -l
- Bare invocation allowed

### `colordiff` (https://www.colordiff.org/)

- Allowed standalone flags: --brief, --ed, --expand-tabs, --help, --initial-tab, --left-column, --minimal, --normal, --paginate, --rcs, --report-identical-files, --side-by-side, --speed-large-files, --strip-trailing-cr, --suppress-blank-empty, --suppress-common-lines, --text, --version, -B, -E, -N, -P, -T, -V, -Z, -a, -b, -c, -d, -e, -f, -h, -i, -l, -n, -p, -q, -r, -s, -t, -u, -v, -w, -y
- Allowed valued flags: --changed-group-format, --color, --context, --from-file, --horizon-lines, --ifdef, --ignore-matching-lines, --label, --line-format, --new-group-format, --new-line-format, --old-group-format, --old-line-format, --show-function-line, --starting-file, --tabsize, --to-file, --unchanged-group-format, --unchanged-line-format, --unified, --width, -C, -D, -F, -I, -L, -S, -U, -W

### `column` (https://man7.org/linux/man-pages/man1/column.1.html)

- Allowed standalone flags: --fillrows, --help, --json, --keep-empty-lines, --table, --table-noextreme, --table-noheadings, --table-right-all, --version, -J, -L, -R, -V, -e, -h, -n, -t, -x
- Allowed valued flags: --output-separator, --separator, --table-columns, --table-empty-lines, --table-hide, --table-name, --table-order, --table-right, --table-truncate, --table-wrap, -E, -H, -O, -W, -c, -d, -o, -r, -s
- Bare invocation allowed

### `comm` (https://www.gnu.org/software/coreutils/manual/coreutils.html#comm-invocation)

- Allowed standalone flags: --check-order, --help, --nocheck-order, --total, --version, --zero-terminated, -1, -2, -3, -V, -h, -i, -z
- Allowed valued flags: --output-delimiter

### `command` (https://man7.org/linux/man-pages/man1/command.1p.html)

- Allowed: --help, --version, -h, -v, -V (check if command exists).

### `composer` (https://getcomposer.org/doc/03-cli.md)

- Allowed standalone flags: --help, --version, -V, -h
- **about**: Flags: --help, -h
- **audit**: Flags: --abandoned, --help, --locked, --no-dev, -h. Valued: --format, -f
- **check-platform-reqs**: Flags: --help, -h
- **diagnose**: Flags: --help, -h
- **fund**: Flags: --help, -h
- **help**: Flags: --help, -h
- **info**: Flags: --all, --available, --direct, --help, --installed, --latest, --locked, --minor-only, --name-only, --no-dev, --outdated, --path, --platform, --self, --strict, --tree, --versions, -D, -H, -N, -P, -a, -h, -i, -l, -o, -s, -t. Valued: --format, --ignore, -f
- **licenses**: Flags: --help, -h
- **outdated**: Flags: --all, --direct, --help, --locked, --minor-only, --no-dev, --strict, -D, -a, -h, -m. Valued: --format, --ignore, -f
- **show**: Flags: --all, --available, --direct, --help, --installed, --latest, --locked, --minor-only, --name-only, --no-dev, --outdated, --path, --platform, --self, --strict, --tree, --versions, -D, -H, -N, -P, -a, -h, -i, -l, -o, -s, -t. Valued: --format, --ignore, -f
- **suggests**: Flags: --help, -h

### `conda` (https://docs.conda.io/projects/conda/en/stable/commands/index.html)

- Allowed standalone flags: --help, --version, -V, -h
- **config**: config (--show/--show-sources only).
- **info**: Flags: --all, --envs, --help, --json, --verbose, -a, -e, -h, -v
- **list**: Flags: --explicit, --export, --full-name, --help, --json, --no-pip, --revisions, -e, -f, -h. Valued: --name, --prefix, -n, -p

### `craft` (https://craftcms.com/docs/5.x/reference/cli.html)

- Allowed standalone flags: --help, --version, -V, -h
- **env/show**: Flags: --help, -h
- **graphql/list-schemas**: Flags: --help, -h
- **graphql/print-schema**: Flags: --help, -h
- **help**: Flags: --help, -h
- **install/check**: Flags: --help, -h
- **migrate/history**: Flags: --help, -h
- **migrate/new**: Flags: --help, -h
- **pc/diff**: Flags: --help, -h
- **pc/export**: Flags: --help, -h
- **pc/get**: Flags: --help, -h
- **plugin/list**: Flags: --help, -h
- **queue/info**: Flags: --help, -h
- **update/info**: Flags: --help, -h
- **users/list-admins**: Flags: --help, -h

### `crontab` (https://ss64.com/mac/crontab.html)

- Allowed: -l (list), -l -u <user>.

### `csrutil` (https://ss64.com/mac/csrutil.html)

- Allowed standalone flags: --help, --version, -V, -h
- **authenticated-root**: Flags: --help, -h
- **report**: Flags: --help, -h
- **status**: Flags: --help, -h

### `cucumber` (https://cucumber.io/docs/cucumber/api/#running-cucumber)

- Allowed standalone flags: --backtrace, --color, --dry-run, --expand, --guess, --help, --i18n-keywords, --i18n-languages, --init, --no-color, --no-diff, --no-multiline, --no-snippets, --no-source, --no-strict, --publish, --publish-quiet, --quiet, --retry, --snippets, --strict, --verbose, --version, --wip, -V, -b, -d, -e, -h, -q
- Allowed valued flags: --ci-environment, --format, --format-options, --language, --lines, --name, --order, --out, --profile, --require, --require-module, --retry, --tags, -f, -i, -l, -n, -o, -p, -r, -t
- Bare invocation allowed

### `curl` (https://curl.se/docs/manpage.html)

- Allowed standalone flags: --compressed, --fail, --globoff, --head, --insecure, --ipv4, --ipv6, --location, --no-buffer, --no-progress-meter, --show-error, --silent, --verbose, -4, -6, -I, -L, -N, -S, -f, -g, -k, -s, -v.
- Allowed valued flags: --connect-timeout, --max-time, --write-out, -m, -w.
- Allowed methods (-X/--request): GET, HEAD, OPTIONS.
- -H/--header allowed with safe headers (Accept, User-Agent, Authorization, Cookie, Cache-Control, Range, etc.).
- -o/--output and -O/--remote-name allowed (writes files).

### `cut` (https://www.gnu.org/software/coreutils/manual/coreutils.html#cut-invocation)

- Allowed standalone flags: --complement, --help, --only-delimited, --version, --zero-terminated, -V, -h, -n, -s, -w, -z
- Allowed valued flags: --bytes, --characters, --delimiter, --fields, --output-delimiter, -b, -c, -d, -f

### `date` (https://www.gnu.org/software/coreutils/manual/coreutils.html#date-invocation)

- Allowed standalone flags: --help, --rfc-2822, --rfc-email, --universal, --utc, --version, -R, -V, -h, -j, -n, -u
- Allowed valued flags: --date, --iso-8601, --reference, --rfc-3339, -I, -d, -f, -r, -v, -z
- Bare invocation allowed

### `dcli` (https://cli.dashlane.com/)

- Allowed standalone flags: --help, --version, -V, -h
- **accounts whoami**: Flags: --help, -h
- **devices list**: Flags: --help, --json, -h
- **lock**: Flags: --help, -h
- **sync**: Flags: --help, -h
- **team credentials list**: Flags: --help, --json, -h
- **team dark-web-insights**: Flags: --help, -h. Valued: --count, --offset, --order-by
- **team logs**: Flags: --csv, --help, --human-readable, -h. Valued: --end, --start
- **team members**: Flags: --csv, --help, --human-readable, -h
- **team public-api list-keys**: Flags: --help, --json, -h
- **team report**: Flags: --help, -h

### `ddev` (https://ddev.readthedocs.io/en/stable/users/usage/commands/)

- Allowed standalone flags: --help, --version, -V, -h
- **aliases**: Flags: --help, -h
- **debug configyaml**: Flags: --help, -h
- **debug diagnose**: Flags: --help, -h
- **debug mutagen**: Flags: --help, -h
- **debug test**: Flags: --help, -h
- **describe**: Flags: --help, --json-output, -h, -j
- **list**: Flags: --help, --json-output, -h, -j
- **logs**: Flags: --follow, --help, --time, --timestamps, -f, -h. Valued: --service, --tail, -s, -t
- **snapshot** (requires --list): Flags: --all, --help, --list, -h
- **status**: Flags: --help, --json-output, -h, -j
- **version**: Flags: --help, -h

### `defaults` (https://ss64.com/mac/defaults.html)

- Allowed standalone flags: --help, --version, -V, -h
- **domains**: Flags: --help, -h
- **export**: Flags: --help, -g, -globalDomain, -h. Valued: -app
- **find**: Flags: --help, -g, -globalDomain, -h. Valued: -app
- **read**: Flags: --help, -g, -globalDomain, -h. Valued: -app
- **read-type**: Flags: --help, -g, -globalDomain, -h. Valued: -app

### `delta` (https://dandavison.github.io/delta/)

- Allowed standalone flags: --blame-code-style, --blame-palette, --color-only, --dark, --diff-highlight, --diff-so-fancy, --help, --hyperlinks, --keep-plus-minus-markers, --light, --line-numbers, --list-languages, --list-syntax-themes, --navigate, --no-gitconfig, --raw, --relative-paths, --show-config, --show-syntax-themes, --side-by-side, --version, -V, -h, -n, -s
- Allowed valued flags: --commit-decoration-style, --commit-style, --config, --diff-stat-align-width, --features, --file-added-label, --file-decoration-style, --file-modified-label, --file-removed-label, --file-renamed-label, --file-style, --file-transformation, --hunk-header-decoration-style, --hunk-header-file-style, --hunk-header-line-number-style, --hunk-header-style, --hunk-label, --inline-hint-style, --inspect-raw-lines, --line-buffer-size, --line-fill-method, --line-numbers-left-format, --line-numbers-left-style, --line-numbers-minus-style, --line-numbers-plus-style, --line-numbers-right-format, --line-numbers-right-style, --line-numbers-zero-style, --map-styles, --max-line-distance, --max-line-length, --merge-conflict-begin-symbol, --merge-conflict-end-symbol, --merge-conflict-ours-diff-header-decoration-style, --merge-conflict-ours-diff-header-style, --merge-conflict-theirs-diff-header-decoration-style, --merge-conflict-theirs-diff-header-style, --minus-emph-style, --minus-empty-line-marker-style, --minus-non-emph-style, --minus-style, --paging, --plus-emph-style, --plus-empty-line-marker-style, --plus-non-emph-style, --plus-style, --syntax-theme, --tabs, --true-color, --whitespace-error-style, --width, -w
- Bare invocation allowed

### `deno` (https://docs.deno.com/runtime/reference/cli/)

- Allowed standalone flags: --help, --version, -V, -h
- **check**: Flags: --help, --json, --no-lock, --quiet, --unstable, -h, -q. Valued: --config, --import-map, -c
- **doc**: Flags: --help, --json, --no-lock, --quiet, --unstable, -h, -q. Valued: --config, --import-map, -c
- **fmt** (requires --check): Flags: --check, --help, --no-semicolons, --single-quote, --unstable, -h, -q. Valued: --config, --ext, --ignore, --indent-width, --line-width, --log-level, --prose-wrap, -c
- **info**: Flags: --help, --json, --no-lock, --quiet, --unstable, -h, -q. Valued: --config, --import-map, -c
- **lint**: Flags: --help, --json, --no-lock, --quiet, --unstable, -h, -q. Valued: --config, --import-map, -c
- **test**: Flags: --help, --json, --no-lock, --quiet, --unstable, -h, -q. Valued: --config, --import-map, -c

### `detekt` (https://detekt.dev/docs/gettingstarted/cli/)

- Allowed standalone flags: --build-upon-default-config, --debug, --help, --parallel, --version, -V, -h
- Allowed valued flags: --baseline, --classpath, --config, --config-resource, --excludes, --includes, --input, --jvm-target, --language-version, --plugins, --report
- Bare invocation allowed

### `df` (https://www.gnu.org/software/coreutils/manual/coreutils.html#df-invocation)

- Allowed standalone flags: --all, --help, --human-readable, --inodes, --local, --no-sync, --portability, --print-type, --si, --sync, --total, --version, -H, -P, -T, -V, -a, -h, -i, -k, -l
- Allowed valued flags: --block-size, --exclude-type, --output, --type, -B, -t, -x
- Bare invocation allowed

### `diff` (https://www.gnu.org/software/diffutils/manual/diffutils.html)

- Allowed standalone flags: --brief, --ed, --expand-tabs, --help, --ignore-all-space, --ignore-blank-lines, --ignore-case, --ignore-space-change, --ignore-tab-expansion, --left-column, --minimal, --new-file, --no-dereference, --no-ignore-file-name-case, --normal, --paginate, --rcs, --recursive, --report-identical-files, --show-c-function, --side-by-side, --speed-large-files, --strip-trailing-cr, --suppress-blank-empty, --suppress-common-lines, --text, --unidirectional-new-file, --version, -B, -E, -N, -P, -T, -V, -a, -b, -c, -d, -e, -f, -h, -i, -l, -n, -p, -q, -r, -s, -t, -u, -w, -y
- Allowed valued flags: --changed-group-format, --color, --context, --exclude, --exclude-from, --from-file, --ifdef, --ignore-matching-lines, --label, --line-format, --new-group-format, --new-line-format, --old-group-format, --old-line-format, --show-function-line, --starting-file, --tabsize, --to-file, --unchanged-group-format, --unchanged-line-format, --unified, --width, -C, -D, -F, -I, -L, -S, -U, -W, -X, -x

### `dig` (https://man7.org/linux/man-pages/man1/dig.1.html)

- Allowed standalone flags: --help, --version, -4, -6, -V, -h, -m, -r, -u, -v
- Allowed valued flags: -b, -c, -f, -k, -p, -q, -t, -x, -y
- Bare invocation allowed

### `dirname` (https://www.gnu.org/software/coreutils/manual/coreutils.html#dirname-invocation)

- Allowed standalone flags: --help, --version, --zero, -V, -h, -z

### `diskutil` (https://ss64.com/mac/diskutil.html)

- Allowed standalone flags: --help, --version, -V, -h
- **activity**: Flags: --help, -h
- **apfs list**: Flags: --help, -h
- **apfs listCryptoUsers**: Flags: --help, -h
- **apfs listSnapshots**: Flags: --help, -h
- **apfs listVolumeGroups**: Flags: --help, -h
- **info**: Flags: --help, -all, -h, -plist
- **list**: Flags: --help, -h, -plist
- **listFilesystems**: Flags: --help, -h, -plist

### `docker` (https://docs.docker.com/reference/cli/docker/)

- Allowed standalone flags: --help, --version, -V, -h
- **buildx --version**
- **buildx inspect**: Flags: --help, -h
- **buildx ls**: Flags: --help, -h
- **buildx version**: Flags: --help, -h
- **compose --version**
- **compose config**: Flags: --dry-run, --hash, --help, --images, --no-consistency, --no-interpolate, --no-normalize, --no-path-resolution, --profiles, --quiet, --resolve-image-digests, --services, --volumes, -h, -q. Valued: --format, --output, -o
- **compose images**: Flags: --help, -h
- **compose ls**: Flags: --help, -h
- **compose ps**: Flags: --all, --help, --no-trunc, --orphans, --quiet, --services, -a, -h, -q. Valued: --filter, --format, --status
- **compose top**: Flags: --help, -h
- **compose version**: Flags: --help, -h
- **container diff**: Flags: --help, -h
- **container inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **container list**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **container logs**: Flags: --details, --follow, --help, --timestamps, -f, -h, -t. Valued: --since, --tail, --until, -n
- **container ls**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **container port**: Flags: --help, -h
- **container stats**: Flags: --all, --help, --no-stream, --no-trunc, -a, -h. Valued: --format
- **container top**: Flags: --help, -h
- **context inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **context ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **context show**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **diff**: Flags: --help, -h
- **history**: Flags: --help, --human, --no-trunc, --quiet, -H, -h, -q. Valued: --format
- **image history**: Flags: --help, --human, --no-trunc, --quiet, -H, -h, -q. Valued: --format
- **image inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **image list**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **image ls**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **images**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **info**: Flags: --help, -h. Valued: --format, -f
- **inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **logs**: Flags: --details, --follow, --help, --timestamps, -f, -h, -t. Valued: --since, --tail, --until, -n
- **manifest inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **network inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **network ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **port**: Flags: --help, -h
- **ps**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **stats**: Flags: --all, --help, --no-stream, --no-trunc, -a, -h. Valued: --format
- **system df**: Flags: --help, -h. Valued: --format, -f
- **system info**: Flags: --help, -h. Valued: --format, -f
- **top**: Flags: --help, -h
- **version**: Flags: --help, -h. Valued: --format, -f
- **volume inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **volume ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f

### `dotenv` (https://github.com/bkeepers/dotenv)

- Skips flags (-e, -f, -c, -v), then recursively validates the inner command.

### `dotnet` (https://learn.microsoft.com/en-us/dotnet/core/tools/)

- Allowed standalone flags: --help, --info, --list-runtimes, --list-sdks, --version, -V, -h
- **build**: Flags: --force, --help, --no-dependencies, --no-incremental, --no-restore, --nologo, --self-contained, --tl, --use-current-runtime, -h. Valued: --arch, --artifacts-path, --configuration, --framework, --os, --output, --property, --runtime, --source, --verbosity, --version-suffix, -a, -c, -f, -o, -p, -r, -s, -v
- **list**: Flags: --deprecated, --help, --highest-minor, --highest-patch, --include-prerelease, --include-transitive, --outdated, --vulnerable, -h. Valued: --config, --format, --framework, --source, --verbosity, -v
- **test**: Flags: --blame, --blame-crash, --blame-hang, --force, --help, --list-tests, --no-build, --no-dependencies, --no-restore, --nologo, -h. Valued: --arch, --artifacts-path, --blame-crash-collect-always, --blame-crash-dump-type, --blame-hang-dump-type, --blame-hang-timeout, --collect, --configuration, --diag, --environment, --filter, --framework, --logger, --os, --output, --property, --results-directory, --runtime, --settings, --test-adapter-path, --verbosity, -a, -c, -d, -e, -f, -l, -o, -r, -s, -v

### `du` (https://www.gnu.org/software/coreutils/manual/coreutils.html#du-invocation)

- Allowed standalone flags: --all, --apparent-size, --bytes, --count-links, --dereference, --dereference-args, --help, --human-readable, --inodes, --no-dereference, --null, --one-file-system, --separate-dirs, --si, --summarize, --total, --version, -0, -D, -H, -L, -P, -S, -V, -a, -b, -c, -h, -k, -l, -m, -s, -x
- Allowed valued flags: --block-size, --exclude, --files0-from, --max-depth, --threshold, --time, --time-style, -B, -d, -t
- Bare invocation allowed

### `dust` (https://github.com/bootandy/dust#readme)

- Allowed standalone flags: --bars-on-right, --files0-from, --help, --ignore-all-in-file, --invert-filter, --no-colors, --no-percent-bars, --only-dir, --only-file, --skip-total, --version, -D, -F, -H, -P, -R, -S, -V, -b, -c, -f, -h, -i, -p, -r, -s
- Allowed valued flags: --depth, --exclude, --filter, --terminal_width, -M, -X, -d, -e, -n, -t, -v, -w, -z
- Bare invocation allowed

### `echo` (https://www.gnu.org/software/coreutils/manual/coreutils.html#echo-invocation)

- Allowed standalone flags: -E, -e, -n
- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `emulator` (https://developer.android.com/studio/run/emulator-commandline)

- Allowed standalone flags: --help, --version, -V, -h, -help, -list-avds, -version

### `env` (https://www.gnu.org/software/coreutils/manual/coreutils.html#env-invocation)

- Strips flags (-i, -u) and KEY=VALUE pairs, then recursively validates the inner command. Bare invocation allowed.

### `expand` (https://www.gnu.org/software/coreutils/manual/coreutils.html#expand-invocation)

- Allowed standalone flags: --help, --initial, --version, -V, -h, -i
- Allowed valued flags: --tabs, -t
- Bare invocation allowed

### `export` (https://man7.org/linux/man-pages/man1/export.1p.html)

- Allowed standalone flags: -f, -n, -p
- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `expr` (https://www.gnu.org/software/coreutils/manual/coreutils.html#expr-invocation)

- Hyphen-prefixed positional arguments accepted

### `eza` (https://eza.rocks/)

Aliases: `exa`

- Allowed standalone flags: --accessed, --all, --binary, --blocks, --blocksize, --bytes, --changed, --classify, --color-scale, --color-scale-mode, --context, --created, --dereference, --extended, --flags, --follow-symlinks, --git, --git-ignore, --git-repos, --git-repos-no-status, --group, --group-directories-first, --header, --help, --hyperlink, --icons, --inode, --links, --list-dirs, --long, --modified, --mounts, --no-filesize, --no-git, --no-icons, --no-permissions, --no-quotes, --no-time, --no-user, --numeric, --octal-permissions, --oneline, --only-dirs, --only-files, --recurse, --reverse, --tree, --version, -1, -@, -A, -B, -D, -F, -G, -H, -I, -M, -R, -S, -T, -U, -V, -Z, -a, -b, -d, -f, -g, -h, -i, -l, -m, -r, -s, -u, -x
- Allowed valued flags: --color, --colour, --git-ignore-glob, --grid-columns, --group-directories-first-dirs, --ignore-glob, --level, --smart-group, --sort, --time, --time-style, --total-size, --width, -L, -X, -t, -w
- Bare invocation allowed

### `factor` (https://www.gnu.org/software/coreutils/manual/coreutils.html#factor-invocation)

- Allowed standalone flags: --exponents, --help, --version, -V, -h
- Bare invocation allowed

### `false` (https://www.gnu.org/software/coreutils/manual/coreutils.html#false-invocation)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `fastlane` (https://docs.fastlane.tools/)

- Allowed standalone flags: --help, --version, -V, -h
- **action**: Flags: --help, -h
- **actions**: Flags: --help, -h
- **env**: Flags: --help, -h
- **lanes**: Flags: --help, -h

### `fd` (https://github.com/sharkdp/fd#readme)

- Safe unless --exec/-x or --exec-batch/-X flags (execute arbitrary commands).

### `file` (https://man7.org/linux/man-pages/man1/file.1.html)

- Allowed standalone flags: --brief, --debug, --dereference, --extension, --help, --keep-going, --list, --mime, --mime-encoding, --mime-type, --no-buffer, --no-dereference, --no-pad, --no-sandbox, --preserve-date, --print0, --raw, --special-files, --uncompress, --uncompress-noreport, --version, -0, -D, -I, -L, -N, -S, -V, -Z, -b, -d, -h, -i, -k, -l, -n, -p, -r, -s, -z
- Allowed valued flags: --exclude, --exclude-quiet, --files-from, --magic-file, --parameter, --separator, -F, -P, -e, -f, -m

### `find` (https://www.gnu.org/software/findutils/manual/html_mono/find.html)

- Positional predicates allowed. -exec/-execdir allowed when the executed command is itself safe.

### `firebase` (https://firebase.google.com/docs/cli)

- Allowed standalone flags: --help, --version, -V, -h
- **apps:list**: Flags: --help, -h
- **functions:log**: Flags: --help, -h. Valued: --only
- **login:list**: Flags: --help, -h
- **projects:list**: Flags: --help, -h

### `flyctl` (https://fly.io/docs/flyctl/)

Aliases: `fly`

- Allowed standalone flags: --help, --version, -V, -h
- **apps list**: Flags: --help, -h
- **config show**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **ips list**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **logs**: Flags: --help, -h. Valued: --app, --instance, --region, -a, -i, -r
- **platform regions**: Flags: --help, -h
- **regions list**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **releases**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **services list**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **status**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **version**: Flags: --help, -h

### `fmt` (https://www.gnu.org/software/coreutils/manual/coreutils.html#fmt-invocation)

- Allowed standalone flags: --crown-margin, --help, --split-only, --tagged-paragraph, --uniform-spacing, --version, -V, -c, -h, -m, -n, -s, -u
- Allowed valued flags: --goal, --prefix, --width, -d, -g, -l, -p, -t, -w
- Bare invocation allowed

### `fnm` (https://github.com/Schniz/fnm#readme)

- Allowed standalone flags: --help, --version, -V, -h
- **current**: Flags: --help, -h
- **default**: Flags: --help, -h
- **list**: Flags: --help, -h
- **ls-remote**: Flags: --help, -h

### `fold` (https://www.gnu.org/software/coreutils/manual/coreutils.html#fold-invocation)

- Allowed standalone flags: --bytes, --help, --spaces, --version, -V, -b, -h, -s
- Allowed valued flags: --width, -w
- Bare invocation allowed

### `free` (https://man7.org/linux/man-pages/man1/free.1.html)

- Allowed standalone flags: --bytes, --gibi, --giga, --help, --human, --kibi, --kilo, --lohi, --mebi, --mega, --si, --tebi, --tera, --total, --version, --wide, -V, -b, -g, -h, -k, -l, -m, -t, -v, -w
- Allowed valued flags: --count, --seconds, -c, -s
- Bare invocation allowed

### `gem` (https://guides.rubygems.org/command-reference/)

- Allowed standalone flags: --help, --version, -V, -h
- **contents**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **dependency**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **environment**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **help**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **info**: Flags: --help, --installed, --prerelease, -h, -i. Valued: --version, -v
- **list**: Flags: --all, --help, --installed, --local, --no-details, --no-versions, --prerelease, --remote, --versions, -a, -d, -h, -i, -l, -r
- **outdated**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **pristine**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **search**: Flags: --all, --details, --exact, --help, --local, --prerelease, --remote, --versions, -a, -d, -e, -h, -i, -l, -r
- **sources**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **specification**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **stale**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v
- **which**: Flags: --all, --help, --local, --prerelease, --remote, --versions, -a, -h, -i, -l, -r. Valued: --version, -v

### `getconf` (https://man7.org/linux/man-pages/man1/getconf.1.html)

- Allowed standalone flags: --help, --version, -V, -a, -h
- Allowed valued flags: -v
- Bare invocation allowed

### `gh` (https://cli.github.com/manual/)

- Subcommands attestation, cache, codespace, extension, gpg-key, issue, label, pr, release, repo, run, ssh-key, variable, workflow are allowed with actions: checks, diff, list, status, verify, view, watch.
- Always safe: --version, search, status.
- auth status, browse (requires --no-browser), release download (requires --output), api (read-only: implicit GET or explicit -X GET, with --paginate, --slurp, --jq, --template, --cache, --preview, --include, --silent, --verbose, --hostname, -H for Accept and X-GitHub-Api-Version headers).

### `git` (https://git-scm.com/docs)

- Allowed standalone flags: --help, --version, -V, -h
- **blame**: Flags: --color-by-age, --color-lines, --help, --incremental, --line-porcelain, --minimal, --porcelain, --progress, --root, --show-email, --show-name, --show-number, --show-stats, -b, -c, -e, -f, -h, -k, -l, -n, -p, -s, -t, -w. Valued: --abbrev, --contents, --ignore-rev, --ignore-revs-file, -C, -L, -M, -S
- **branch**: branch (read-only flags).
- **cat-file**: Flags: --batch-all-objects, --buffer, --filters, --follow-symlinks, --help, --mailmap, --textconv, --unordered, --use-mailmap, -Z, -e, -h, -p, -s, -t. Valued: --batch, --batch-check, --batch-command, --filter, --path
- **check-ignore**: Flags: --help, --no-index, --non-matching, --quiet, --stdin, --verbose, -h, -n, -q, -v, -z
- **config**: config (--get, --get-all, --get-regexp, --list, -l only).
- **count-objects**: Flags: --help, --human-readable, --verbose, -H, -h, -v
- **describe**: Flags: --all, --always, --contains, --debug, --exact-match, --first-parent, --help, --long, --tags, -h. Valued: --abbrev, --broken, --candidates, --dirty, --exclude, --match
- **diff**: Flags: --cached, --check, --compact-summary, --cumulative, --dirstat-by-file, --exit-code, --find-copies-harder, --full-index, --help, --ignore-all-space, --ignore-blank-lines, --ignore-cr-at-eol, --ignore-space-at-eol, --ignore-space-change, --merge-base, --minimal, --name-only, --name-status, --no-color, --no-ext-diff, --no-index, --no-patch, --no-prefix, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --patience, --pickaxe-all, --raw, --shortstat, --staged, --stat, --summary, --text, -B, -C, -M, -R, -a, -b, -h, -p, -u, -w, -z. Valued: --abbrev, --color, --diff-algorithm, --diff-filter, --dirstat, --dst-prefix, --inter-hunk-context, --line-prefix, --output-indicator-new, --output-indicator-old, --relative, --src-prefix, --stat-width, --unified, --word-diff, --word-diff-regex, -G, -O, -S, -U
- **diff-tree**: Flags: --cc, --combined-all-paths, --find-copies-harder, --full-index, --help, --ignore-all-space, --ignore-space-at-eol, --ignore-space-change, --merge-base, --minimal, --name-only, --name-status, --no-commit-id, --no-ext-diff, --no-patch, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --pickaxe-all, --raw, --root, --shortstat, --stat, --stdin, --summary, --text, -B, -C, -M, -R, -a, -c, -h, -m, -p, -r, -s, -t, -u, -v, -z. Valued: --abbrev, --diff-algorithm, --diff-filter, --pretty, -O, -S
- **fetch**: Flags: --all, --append, --atomic, --dry-run, --force, --help, --ipv4, --ipv6, --keep, --multiple, --negotiate-only, --no-auto-gc, --no-auto-maintenance, --no-show-forced-updates, --no-tags, --no-write-fetch-head, --porcelain, --prefetch, --progress, --prune, --prune-tags, --quiet, --refetch, --set-upstream, --show-forced-updates, --stdin, --tags, --unshallow, --update-head-ok, --update-shallow, --verbose, --write-commit-graph, --write-fetch-head, -4, -6, -P, -a, -f, -h, -k, -m, -n, -p, -q, -t, -u, -v. Valued: --deepen, --depth, --filter, --jobs, --negotiation-tip, --recurse-submodules, --refmap, --server-option, --shallow-exclude, --shallow-since, -j, -o
- **for-each-ref**: Flags: --help, --ignore-case, --include-root-refs, --omit-empty, --perl, --python, --shell, --stdin, --tcl, -h, -p, -s. Valued: --color, --contains, --count, --exclude, --format, --merged, --no-contains, --no-merged, --points-at, --sort
- **grep**: Flags: --all-match, --and, --basic-regexp, --break, --cached, --column, --count, --exclude-standard, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --full-name, --function-context, --heading, --help, --ignore-case, --index, --invert-match, --line-number, --name-only, --no-color, --no-index, --null, --only-matching, --perl-regexp, --quiet, --recurse-submodules, --recursive, --show-function, --text, --textconv, --untracked, --word-regexp, -E, -F, -G, -H, -I, -L, -P, -W, -a, -c, -h, -i, -l, -n, -o, -p, -q, -r, -v, -w, -z. Valued: --after-context, --before-context, --color, --context, --max-count, --max-depth, --open-files-in-pager, --threads, -A, -B, -C, -O, -e, -f, -m
- **help**
- **log**: Flags: --abbrev-commit, --all, --ancestry-path, --author-date-order, --bisect, --boundary, --branches, --cherry, --cherry-mark, --cherry-pick, --children, --clear-decorations, --compact-summary, --cumulative, --date-order, --dense, --do-walk, --early-output, --first-parent, --follow, --full-diff, --full-history, --graph, --help, --ignore-missing, --invert-grep, --left-only, --left-right, --log-size, --mailmap, --merges, --minimal, --name-only, --name-status, --no-abbrev-commit, --no-color, --no-decorate, --no-expand-tabs, --no-ext-diff, --no-merges, --no-notes, --no-patch, --no-prefix, --no-renames, --no-walk, --numstat, --oneline, --parents, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --reflog, --regexp-ignore-case, --relative-date, --remotes, --reverse, --shortstat, --show-linear-break, --show-notes, --show-pulls, --show-signature, --simplify-by-decoration, --simplify-merges, --source, --sparse, --stat, --stdin, --summary, --tags, --text, --topo-order, --use-mailmap, -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, -h, -i, -p, -q, -u. Valued: --abbrev, --after, --author, --before, --color, --committer, --date, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --exclude, --format, --glob, --grep, --max-count, --max-parents, --min-parents, --pretty, --since, --skip, --until, -L, -n
- **ls-files**: Flags: --cached, --debug, --deduplicate, --deleted, --directory, --empty-directory, --eol, --error-unmatch, --exclude-standard, --full-name, --help, --ignored, --killed, --modified, --no-empty-directory, --others, --recurse-submodules, --resolve-undo, --sparse, --stage, --unmerged, -c, -d, -f, -h, -i, -k, -m, -o, -r, -s, -t, -u, -v, -z. Valued: --abbrev, --exclude, --exclude-from, --exclude-per-directory, --format, --with-tree, -X, -x
- **ls-remote**: Flags: --branches, --exit-code, --get-url, --help, --quiet, --refs, --symref, --tags, -b, -h, -q, -t. Valued: --server-option, --sort, -o
- **ls-tree**: Flags: --full-name, --full-tree, --help, --long, --name-only, --name-status, --object-only, -d, -h, -l, -r, -t, -z. Valued: --abbrev, --format
- **merge-base**: Flags: --all, --fork-point, --help, --independent, --is-ancestor, --octopus, -a, -h
- **merge-tree**: Flags: --allow-unrelated-histories, --help, --messages, --name-only, --quiet, --stdin, --trivial-merge, --write-tree, -h, -z. Valued: --merge-base, -X
- **name-rev**: Flags: --all, --always, --annotate-stdin, --help, --name-only, --tags, --undefined, -h. Valued: --exclude, --refs
- **notes**: notes (list, show only).
- **reflog**: Flags: --abbrev-commit, --all, --ancestry-path, --author-date-order, --bisect, --boundary, --branches, --cherry, --cherry-mark, --cherry-pick, --children, --clear-decorations, --compact-summary, --cumulative, --date-order, --dense, --do-walk, --early-output, --first-parent, --follow, --full-diff, --full-history, --graph, --help, --ignore-missing, --invert-grep, --left-only, --left-right, --log-size, --mailmap, --merges, --minimal, --name-only, --name-status, --no-abbrev-commit, --no-color, --no-decorate, --no-expand-tabs, --no-ext-diff, --no-merges, --no-notes, --no-patch, --no-prefix, --no-renames, --no-walk, --numstat, --oneline, --parents, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --reflog, --regexp-ignore-case, --relative-date, --remotes, --reverse, --shortstat, --show-linear-break, --show-notes, --show-pulls, --show-signature, --simplify-by-decoration, --simplify-merges, --source, --sparse, --stat, --stdin, --summary, --tags, --text, --topo-order, --use-mailmap, -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, -h, -i, -p, -q, -u. Valued: --abbrev, --after, --author, --before, --color, --committer, --date, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --exclude, --format, --glob, --grep, --max-count, --max-parents, --min-parents, --pretty, --since, --skip, --until, -L, -n
- **remote**: remote (read-only actions).
- **rev-parse**: Flags: --absolute-git-dir, --all, --branches, --git-common-dir, --git-dir, --git-path, --help, --is-bare-repository, --is-inside-git-dir, --is-inside-work-tree, --is-shallow-repository, --local-env-vars, --quiet, --remotes, --shared-index-path, --show-cdup, --show-prefix, --show-superproject-working-tree, --show-toplevel, --symbolic, --symbolic-full-name, --tags, --verify, -h, -q. Valued: --abbrev-ref, --after, --before, --default, --exclude, --glob, --prefix, --resolve-git-dir, --short, --since, --until. Positional args accepted
- **shortlog**: Flags: --committer, --email, --help, --numbered, --summary, -c, -e, -h, -n, -s. Valued: --format, --group
- **show**: Flags: --abbrev-commit, --compact-summary, --cumulative, --expand-tabs, --full-index, --help, --ignore-all-space, --ignore-blank-lines, --ignore-space-at-eol, --ignore-space-change, --mailmap, --minimal, --name-only, --name-status, --no-color, --no-ext-diff, --no-notes, --no-patch, --no-prefix, --no-renames, --numstat, --patch, --patch-with-raw, --patch-with-stat, --patience, --raw, --shortstat, --show-notes, --show-signature, --source, --stat, --summary, --text, --use-mailmap, -h, -p, -q, -u, -w. Valued: --abbrev, --color, --decorate, --decorate-refs, --decorate-refs-exclude, --diff-algorithm, --diff-filter, --encoding, --format, --notes, --pretty, -O
- **stash**: stash (list, show only).
- **status**: Flags: --ahead-behind, --branch, --help, --ignore-submodules, --long, --no-ahead-behind, --no-renames, --null, --renames, --short, --show-stash, --verbose, -b, -h, -s, -v, -z. Valued: --column, --find-renames, --ignored, --porcelain, --untracked-files, -M, -u
- **tag**: tag (list only).
- **verify-commit**: Flags: --help, --raw, --verbose, -h, -v
- **verify-tag**: Flags: --help, --raw, --verbose, -h, -v. Valued: --format
- **worktree**: worktree (list only).

Supports `-C <dir>` prefix.

### `glab` (https://glab.readthedocs.io/en/latest/)

- Subcommands ci, cluster, deploy-key, gpg-key, incident, issue, iteration, label, milestone, mr, release, repo, schedule, snippet, ssh-key, stack, variable are allowed with actions: diff, issues, list, status, view.
- Always safe: --version, -v, check-update, version.
- auth status, api (GET only).

### `go` (https://pkg.go.dev/cmd/go)

- Allowed standalone flags: --help, --version, -V, -h
- **build**: Flags: --help, -a, -asan, -cover, -h, -linkshared, -modcacherw, -msan, -n, -race, -trimpath, -v, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -compiler, -covermode, -coverpkg, -gccgoflags, -gcflags, -installsuffix, -ldflags, -mod, -modfile, -o, -overlay, -p, -pgo, -pkgdir, -tags
- **doc**: Flags: --help, -all, -c, -cmd, -h, -short, -src, -u
- **env**: Flags: --help, -h, -json
- **help**
- **list**: Flags: --help, -a, -asan, -compiled, -cover, -deps, -e, -export, -find, -h, -linkshared, -m, -modcacherw, -msan, -n, -race, -retract, -test, -trimpath, -u, -v, -versions, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -compiler, -covermode, -coverpkg, -f, -gccgoflags, -gcflags, -installsuffix, -json, -ldflags, -mod, -modfile, -overlay, -p, -pgo, -pkgdir, -reuse, -tags
- **test**: Flags: --help, -a, -asan, -benchmem, -cover, -failfast, -h, -json, -linkshared, -modcacherw, -msan, -n, -race, -short, -trimpath, -v, -work, -x. Valued: -asmflags, -bench, -benchtime, -blockprofile, -blockprofilerate, -buildmode, -buildvcs, -compiler, -count, -covermode, -coverpkg, -coverprofile, -cpu, -cpuprofile, -fuzz, -fuzzminimizetime, -fuzztime, -gccgoflags, -gcflags, -installsuffix, -ldflags, -list, -memprofile, -memprofilerate, -mod, -modfile, -mutexprofile, -mutexprofilefraction, -o, -outputdir, -overlay, -p, -parallel, -pgo, -pkgdir, -run, -shuffle, -skip, -tags, -timeout, -trace
- **version**: Flags: --help, -h, -m, -v
- **vet**: Flags: --help, -a, -asan, -cover, -h, -json, -linkshared, -modcacherw, -msan, -n, -race, -trimpath, -v, -work, -x. Valued: -asmflags, -buildmode, -buildvcs, -c, -compiler, -covermode, -coverpkg, -gccgoflags, -gcflags, -installsuffix, -ldflags, -mod, -modfile, -overlay, -p, -pgo, -pkgdir, -tags

### `gradle` (https://docs.gradle.org/current/userguide/command_line_interface.html)

Aliases: `gradlew`

- Allowed standalone flags: --help, --version, -V, -h
- **build**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --help, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode, -h, -q. Valued: --exclude-task, --max-workers, -x
- **check**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --help, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode, -h, -q. Valued: --exclude-task, --max-workers, -x
- **dependencies**: Flags: --console, --help, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode, -h, -q. Valued: --configuration
- **properties**: Flags: --console, --help, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode, -h, -q
- **tasks**: Flags: --all, --console, --help, --info, --no-rebuild, --quiet, --stacktrace, --warning-mode, -h, -q. Valued: --group
- **test**: Flags: --build-cache, --configure-on-demand, --console, --continue, --dry-run, --help, --info, --no-build-cache, --no-daemon, --no-parallel, --no-rebuild, --parallel, --profile, --quiet, --rerun-tasks, --scan, --stacktrace, --warning-mode, -h, -q. Valued: --exclude-task, --max-workers, -x

### `grep` (https://www.gnu.org/software/grep/manual/grep.html)

Aliases: `egrep`, `fgrep`

- Allowed standalone flags: --basic-regexp, --binary, --byte-offset, --color, --colour, --count, --dereference-recursive, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --help, --ignore-case, --initial-tab, --invert-match, --line-buffered, --line-number, --line-regexp, --no-filename, --no-messages, --null, --null-data, --only-matching, --perl-regexp, --quiet, --recursive, --silent, --text, --version, --with-filename, --word-regexp, -E, -F, -G, -H, -I, -J, -L, -P, -R, -S, -T, -U, -V, -Z, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -r, -s, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --binary-files, --color, --colour, --context, --devices, --directories, --exclude, --exclude-dir, --exclude-from, --file, --group-separator, --include, --label, --max-count, --regexp, -A, -B, -C, -D, -d, -e, -f, -m

### `groups` (https://www.gnu.org/software/coreutils/manual/coreutils.html#groups-invocation)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `gzip` (https://man7.org/linux/man-pages/man1/gzip.1.html)

- Info/test modes only (requires -l/--list or -t/--test).
- Flags: -v/--verbose.

### `head` (https://www.gnu.org/software/coreutils/manual/coreutils.html#head-invocation)

- Allowed standalone flags: --help, --quiet, --silent, --verbose, --version, --zero-terminated, -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, -V, -h, -q, -v, -z
- Allowed valued flags: --bytes, --lines, -c, -n
- Bare invocation allowed

### `heroku` (https://devcenter.heroku.com/articles/heroku-cli-commands)

- Allowed standalone flags: --help, --version, -V, -h
- **addons**: Flags: --all, --help, --json, -A, -h. Valued: --app, -a
- **apps**: Flags: --all, --help, --json, -a, -h. Valued: --space, --team, -s, -t
- **apps:info**: Flags: --help, --json, --shell, -h, -s. Valued: --app, -a
- **buildpacks**: Flags: --help, -h. Valued: --app, -a
- **config**: Flags: --help, --json, --shell, -h, -j, -s. Valued: --app, -a
- **logs**: Flags: --force-colors, --help, --tail, -h, -t. Valued: --app, --dyno, --num, --source, -a, -d, -n, -s
- **ps**: Flags: --help, --json, -h, -j. Valued: --app, -a
- **regions**: Flags: --help, --json, -h
- **releases**: Flags: --help, --json, -h, -j. Valued: --app, --num, -a, -n
- **status**: Flags: --help, --json, -h

### `hexdump` (https://man7.org/linux/man-pages/man1/hexdump.1.html)

- Allowed standalone flags: --help, --version, -C, -V, -b, -c, -d, -h, -o, -v, -x
- Allowed valued flags: -L, -e, -f, -n, -s
- Bare invocation allowed

### `hf` (https://huggingface.co/docs/huggingface_hub/guides/cli)

- Allowed standalone flags: --help, --version, -V, -h
- **cache ls**: Flags: --help, -h
- **cache verify**: Flags: --help, -h
- **collections info**: Flags: --help, -h
- **collections ls**: Flags: --help, -h. Valued: --limit, --owner
- **datasets info**: Flags: --help, -h
- **datasets ls**: Flags: --help, -h. Valued: --author, --filter, --limit, --search, --sort
- **datasets parquet**: Flags: --help, -h
- **discussions diff**: Flags: --help, -h
- **discussions info**: Flags: --help, -h
- **discussions list**: Flags: --help, -h
- **env**: Flags: --help, -h
- **jobs logs**: Flags: --help, -h. Valued: --tail
- **jobs ps**: Flags: --help, -h
- **models info**: Flags: --help, -h
- **models ls**: Flags: --help, -h. Valued: --author, --filter, --limit, --search, --sort
- **spaces info**: Flags: --help, -h
- **spaces ls**: Flags: --help, -h. Valued: --author, --filter, --limit, --search, --sort
- **version**: Flags: --help, -h

### `host` (https://man7.org/linux/man-pages/man1/host.1.html)

- Allowed standalone flags: --help, --version, -4, -6, -C, -V, -a, -c, -d, -h, -l, -r, -s, -v
- Allowed valued flags: -D, -N, -R, -T, -W, -i, -m, -t

### `hostname` (https://man7.org/linux/man-pages/man1/hostname.1.html)

- Flags: --help, --version, -A, -I, -V, -d, -f, -h, -i, -s

### `htop` (https://htop.dev/)

- Allowed standalone flags: --help, --no-color, --no-mouse, --no-unicode, --tree, --version, -C, -H, -M, -V, -h, -t
- Allowed valued flags: --delay, --filter, --highlight-changes, --pid, --sort-key, --user, -F, -d, -p, -s, -u
- Bare invocation allowed

### `hyperfine` (https://github.com/sharkdp/hyperfine#readme)

- Recursively validates each benchmarked command.

### `iconv` (https://man7.org/linux/man-pages/man1/iconv.1.html)

- Allowed standalone flags: --help, --list, --silent, --version, -V, -c, -h, -l, -s
- Allowed valued flags: --from-code, --to-code, -f, -t

### `id` (https://www.gnu.org/software/coreutils/manual/coreutils.html#id-invocation)

- Allowed standalone flags: --context, --group, --groups, --help, --name, --real, --user, --version, --zero, -G, -V, -Z, -g, -h, -n, -p, -r, -u, -z
- Bare invocation allowed

### `identify` (https://imagemagick.org/script/identify.php)

- Allowed standalone flags: --help, --verbose, --version, -V, -h, -ping, -quiet, -regard-warnings, -verbose
- Allowed valued flags: -channel, -define, -density, -depth, -features, -format, -fuzz, -interlace, -limit, -list, -log, -moments, -monitor, -precision, -seed, -set, -size, -strip, -unique, -virtual-pixel

### `ifconfig` (https://man7.org/linux/man-pages/man8/ifconfig.8.html)

- Allowed standalone flags: --help, --version, -L, -V, -a, -h, -l, -s, -v
- Bare invocation allowed

### `ionice` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nice-invocation)

- Skips priority flags (-n/--adjustment), then recursively validates the inner command.

### `ioreg` (https://ss64.com/mac/ioreg.html)

- Allowed standalone flags: --help, --version, -S, -V, -a, -b, -f, -h, -i, -l, -r, -t, -x
- Allowed valued flags: -c, -d, -k, -n, -p, -w
- Bare invocation allowed

### `iotop` (https://man7.org/linux/man-pages/man8/iotop.8.html)

- Allowed standalone flags: --accumulated, --batch, --help, --kilobytes, --only, --processes, --quiet, --version, -P, -V, -a, -b, -h, -k, -o, -q, -t
- Allowed valued flags: --delay, --iter, --pid, --user, -d, -n, -p, -u
- Bare invocation allowed

### `jar` (https://docs.oracle.com/en/java/javase/21/docs/specs/man/jar.html)

- List mode only: tf, tvf, --list, -t. Also --version, --help.

### `jarsigner` (https://docs.oracle.com/en/java/javase/21/docs/specs/man/jarsigner.html)

- Verify mode only (requires -verify). Flags: -certs, -strict, -verbose.

### `javap` (https://docs.oracle.com/en/java/javase/21/docs/specs/man/javap.html)

- Allowed standalone flags: --help, --version, -V, -c, -constants, -h, -l, -p, -private, -protected, -public, -s, -sysinfo, -v, -verbose
- Allowed valued flags: --module, -bootclasspath, -classpath, -cp, -m

### `jj` (https://jj-vcs.github.io/jj/latest/cli-reference/)

- Subcommands: bookmark list, cat, config get, config list, diff, file list, file show, git fetch, git remote list, help, log, op log, resolve --list, root, show, st, status, tag list, version, workspace list
- Flags: --help, --version, -h
- Skips global flags: standalone (--debug, --ignore-immutable, --ignore-working-copy, --no-pager, --quiet, --verbose), valued (--at-op, --at-operation, --color, --repository, -R).

### `jjpr` (https://github.com/michaeldhopkins/jjpr)

- Bare invocation allowed (displays stack status).
- status allowed.
- auth (test, setup).
- submit (requires --dry-run), merge (requires --dry-run).
- --help allowed on all subcommands.

### `jq` (https://jqlang.github.io/jq/manual/)

- Allowed standalone flags: --ascii-output, --color-output, --compact-output, --exit-status, --help, --join-output, --monochrome-output, --null-input, --raw-input, --raw-output, --raw-output0, --seq, --slurp, --sort-keys, --tab, --version, -C, -M, -R, -S, -V, -c, -e, -g, -h, -j, -n, -r, -s
- Allowed valued flags: --arg, --argjson, --args, --from-file, --indent, --jsonargs, --rawfile, --slurpfile, -f
- Bare invocation allowed

### `keytool` (https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html)

- Allowed standalone flags: --help, --version, -V, -h
- **-list**: Flags: --help, -h, -rfc, -v. Valued: -alias, -keystore, -storepass, -storetype
- **-printcert**: Flags: --help, -h, -rfc, -v. Valued: -file, -jarfile

### `ktlint` (https://pinterest.github.io/ktlint/latest/)

- Allowed standalone flags: --color, --color-name, --help, --relative, --verbose, --version, -V, -h
- Allowed valued flags: --editorconfig, --reporter
- Bare invocation allowed

### `kubectl` (https://kubernetes.io/docs/reference/kubectl/)

- Allowed standalone flags: --help, --version, -V, -h
- **api-resources**: Flags: --help, --namespaced, --no-headers, -h. Valued: --api-group, --output, --sort-by, --verbs, -o
- **api-versions**: Flags: --help, -h
- **auth can-i**: Flags: --help, -h
- **auth whoami**: Flags: --help, -h
- **cluster-info**: Flags: --help, -h
- **config current-context**: Flags: --help, -h
- **config get-contexts**: Flags: --help, --no-headers, -h. Valued: --output, -o
- **config view**: Flags: --flatten, --help, --minify, --raw, -h. Valued: --output, -o
- **describe**: Flags: --all-namespaces, --help, --show-events, -A, -h. Valued: --namespace, --selector, -l, -n
- **events**: Flags: --all-namespaces, --help, --watch, -A, -h, -w. Valued: --for, --namespace, --output, --types, -n, -o
- **explain**: Flags: --help, --recursive, -h. Valued: --api-version
- **get**: Flags: --all-namespaces, --help, --no-headers, --show-labels, --watch, -A, -h, -w. Valued: --field-selector, --label-selector, --namespace, --output, --selector, --sort-by, -l, -n, -o
- **logs**: Flags: --all-containers, --follow, --help, --previous, --timestamps, -f, -h, -p. Valued: --container, --namespace, --since, --tail, -c, -n
- **top node**: Flags: --help, --no-headers, -h. Valued: --selector, --sort-by, -l
- **top pod**: Flags: --all-namespaces, --containers, --help, --no-headers, -A, -h. Valued: --namespace, --selector, --sort-by, -l, -n
- **version**: Flags: --client, --help, --short, -h. Valued: --output, -o

### `last` (https://man7.org/linux/man-pages/man1/last.1.html)

- Allowed standalone flags: --dns, --fullnames, --fulltimes, --help, --hostlast, --ip, --nohostname, --system, --time-format, --version, -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, -F, -R, -V, -a, -d, -h, -i, -w, -x
- Allowed valued flags: --limit, --present, --since, --time-format, --until, -f, -n, -p, -s, -t
- Bare invocation allowed

### `lastlog` (https://man7.org/linux/man-pages/man8/lastlog.8.html)

- Allowed standalone flags: --help, --version, -V, -h
- Allowed valued flags: --before, --time, --user, -b, -t, -u
- Bare invocation allowed

### `launchctl` (https://ss64.com/mac/launchctl.html)

- Allowed standalone flags: --help, --version, -V, -h
- **blame**: Flags: --help, -h
- **dumpstate**: Flags: --help, -h
- **error**: Flags: --help, -h
- **examine**: Flags: --help, -h
- **help**: Flags: --help, -h
- **hostinfo**: Flags: --help, -h
- **list**: Flags: --help, -h
- **print**: Flags: --help, -h
- **print-cache**: Flags: --help, -h
- **print-disabled**: Flags: --help, -h
- **resolveport**: Flags: --help, -h
- **version**: Flags: --help, -h

### `less` (https://man7.org/linux/man-pages/man1/less.1.html)

- Allowed standalone flags: --QUIT-AT-EOF, --RAW-CONTROL-CHARS, --chop-long-lines, --help, --ignore-case, --no-init, --quiet, --quit-at-eof, --quit-if-one-screen, --raw-control-chars, --silent, --squeeze-blank-lines, --version, -E, -F, -G, -I, -J, -K, -L, -M, -N, -Q, -R, -S, -V, -W, -X, -a, -c, -e, -f, -g, -i, -m, -n, -q, -r, -s, -w
- Allowed valued flags: --LINE-NUMBERS, --LONG-PROMPT, --pattern, --prompt, --shift, --tabs, --tag, --window, -P, -b, -h, -j, -p, -t, -x, -y, -z
- Bare invocation allowed

### `lint` (https://developer.android.com/studio/write/lint)

- Allowed standalone flags: --help, --list, --quiet, --show, --version, -V, -h
- Allowed valued flags: --check, --config, --disable, --enable
- Bare invocation allowed

### `lipo` (https://ss64.com/mac/lipo.html)

- Requires a read-only flag (-info, -archs, -detailed_info, -verify_arch).

### `llm` (https://llm.datasette.io/en/stable/)

- Allowed standalone flags: --help, --version, -V, -h
- **aliases**: Flags: --help, --json, -h
- **collections**: Flags: --help, --json, -h
- **logs**: Flags: --conversation, --help, --json, --no-truncate, --response, --truncate, -h. Valued: --cid, --count, --id, --model, --search, -c, -m, -n
- **models**: Flags: --help, --json, --options, -h
- **plugins**: Flags: --all, --help, --json, -h
- **templates**: Flags: --help, --json, -h

### `locale` (https://man7.org/linux/man-pages/man1/locale.1.html)

- Allowed standalone flags: --all-locales, --category-name, --charmaps, --help, --keyword-name, --verbose, --version, -V, -a, -c, -h, -k, -m, -v
- Bare invocation allowed

### `locate` (https://man7.org/linux/man-pages/man1/locate.1.html)

Aliases: `mlocate`, `plocate`

- Allowed standalone flags: --all, --basename, --count, --existing, --follow, --help, --ignore-case, --null, --quiet, --statistics, --version, --wholename, -0, -A, -S, -V, -b, -c, -e, -h, -i, -q, -w
- Allowed valued flags: --database, --limit, -d, -l, -n

### `log` (https://ss64.com/mac/log.html)

- Allowed standalone flags: --help, --version, -V, -h
- **help**: Flags: --help, -h
- **show**: Flags: --backtrace, --debug, --help, --info, --loss, --mach-continuous-time, --no-pager, --signpost, -h. Valued: --color, --end, --last, --predicate, --process, --source, --start, --style, --type
- **stats**: Flags: --help, -h
- **stream**: Flags: --backtrace, --debug, --help, --info, --loss, --mach-continuous-time, --signpost, -h. Valued: --color, --level, --predicate, --process, --source, --style, --timeout, --type

### `ls` (https://www.gnu.org/software/coreutils/manual/coreutils.html#ls-invocation)

- Allowed standalone flags: --all, --almost-all, --author, --classify, --context, --dereference, --dereference-command-line, --dereference-command-line-symlink-to-dir, --directory, --escape, --file-type, --full-time, --group-directories-first, --help, --hide-control-chars, --human-readable, --indicator-style, --inode, --kibibytes, --literal, --no-group, --numeric-uid-gid, --quote-name, --recursive, --reverse, --show-control-chars, --si, --size, --version, -1, -A, -B, -C, -F, -G, -H, -L, -N, -Q, -R, -S, -U, -V, -X, -Z, -a, -c, -d, -f, -g, -h, -i, -k, -l, -m, -n, -o, -p, -q, -r, -s, -t, -u, -v, -x
- Allowed valued flags: --block-size, --color, --format, --hide, --hyperlink, --ignore, --quoting-style, --sort, --tabsize, --time, --time-style, --width, -I, -T, -w
- Bare invocation allowed

### `lsblk` (https://man7.org/linux/man-pages/man8/lsblk.8.html)

- Allowed standalone flags: --all, --ascii, --bytes, --dedup, --discard, --fs, --help, --inverse, --json, --list, --merge, --nodeps, --noheadings, --output-all, --pairs, --paths, --perms, --raw, --scsi, --topology, --tree, --version, --zoned, -A, -J, -O, -P, -S, -T, -V, -a, -b, -d, -f, -h, -i, -l, -m, -n, -p, -r, -s, -t, -z
- Allowed valued flags: --exclude, --include, --output, --sort, --width, -E, -I, -e, -o, -w, -x
- Bare invocation allowed

### `lsof` (https://man7.org/linux/man-pages/man8/lsof.8.html)

- Allowed standalone flags: --help, --version, -C, -G, -M, -N, -O, -P, -R, -U, -V, -X, -b, -h, -l, -n, -t, -w, -x
- Allowed valued flags: -F, -S, -T, -a, -c, -d, -g, -i, -k, -o, -p, -r, -s, -u
- Bare invocation allowed

### `magick` (https://imagemagick.org/script/command-line-tools.php)

- Allowed standalone flags: --help, --version, -V, -h
- **identify**: Flags: --help, -h, -matte, -moments, -ping, -quiet, -regard-warnings, -unique, -verbose. Valued: -alpha, -colorspace, -define, -density, -depth, -endian, -format, -interlace, -limit, -precision, -sampling-factor, -size, -units, -virtual-pixel

### `man` (https://man7.org/linux/man-pages/man1/man.1.html)

- Allowed standalone flags: --all, --apropos, --default, --help, --local-file, --regex, --update, --version, --whatis, --where, --where-cat, --wildcard, -V, -a, -f, -h, -k, -l, -u, -w
- Allowed valued flags: --config-file, --encoding, --extension, --locale, --manpath, --sections, --systems, -C, -E, -L, -M, -S, -e, -m

### `md5` (https://man7.org/linux/man-pages/man1/md5sum.1.html)

- Allowed standalone flags: --help, --version, -V, -h, -n, -p, -q, -r, -t
- Allowed valued flags: -s
- Bare invocation allowed

### `md5sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#md5sum-invocation)

- Allowed standalone flags: --binary, --check, --help, --ignore-missing, --quiet, --status, --strict, --tag, --text, --version, --warn, --zero, -V, -b, -c, -h, -t, -w, -z
- Bare invocation allowed

### `mdfind` (https://ss64.com/mac/mdfind.html)

- Allowed standalone flags: --help, --version, -0, -V, -count, -h, -interpret, -literal, -live
- Allowed valued flags: -attr, -name, -onlyin, -s

### `mdls` (https://ss64.com/mac/mdls.html)

- Allowed standalone flags: --help, --raw, --version, -V, -h, -r
- Allowed valued flags: --name, --nullMarker, -n

### `mise` (https://mise.jdx.dev/cli/)

- Allowed standalone flags: --help, --version, -V, -h
- **activate**: Flags: --help, -h
- **backends**: Bare invocation allowed. Subcommands: list, ls.
- **bin-paths**: Flags: --help, -h, -q, -v
- **cache**: Bare invocation allowed. Subcommands: path.
- **completion**: Flags: --help, -h, -q, -v
- **config**: Bare invocation allowed. Subcommands: get, list, ls.
- **current**: Flags: --help, -h, -q, -v
- **deactivate**: Flags: --help, -h
- **doctor**: Flags: --help, -h, -q, -v
- **edit**: Flags: --help, -h
- **en**: Flags: --help, -h
- **env**: Flags: --help, --json, -J, -h. Valued: --shell, -s
- **exec**: exec delegates after --.
- **fmt**: Flags: --check, --help, -h
- **generate**: Flags: --help, -h
- **implode**: Flags: --help, -h
- **install**: Flags: --help, -h
- **latest**: Flags: --help, -h, -q, -v
- **link**: Flags: --help, -h
- **list**: Flags: --current, --help, --installed, --json, --missing, --no-header, --prefix, -J, -c, -h, -i, -m
- **lock**: Flags: --help, -h
- **ls**: Flags: --current, --help, --installed, --json, --missing, --no-header, --prefix, -J, -c, -h, -i, -m
- **ls-remote**: Flags: --all, --help, -h
- **outdated**: Flags: --help, --json, --no-header, -J, -h
- **plugins**: Bare invocation allowed. Subcommands: list, ls, ls-remote.
- **prepare**: Flags: --help, -h
- **prune**: Flags: --help, -h
- **registry**: Flags: --help, -h. Valued: --backend, -b
- **reshim**: Flags: --force, --help, -h
- **run**: Flags: --help, -h
- **search**: Flags: --help, -h
- **self-update**: Flags: --help, -h
- **set**: Flags: --help, --json, -J, -h
- **settings**: Bare invocation allowed. Subcommands: get, list, ls.
- **shell**: Flags: --help, -h
- **shell-alias**: Bare invocation allowed. Subcommands: get, list, ls.
- **sync**: Flags: --help, -h
- **tasks**: Bare invocation allowed. Subcommands: deps, info, list, ls.
- **tool**: Flags: --help, -h, -q, -v
- **tool-alias**: Bare invocation allowed. Subcommands: get, list, ls.
- **trust**: Flags: --help, --show, -h
- **uninstall**: Flags: --help, -h
- **unset**: Flags: --help, -h
- **unuse**: Flags: --help, -h
- **upgrade**: Flags: --help, -h
- **use**: Flags: --help, -h
- **watch**: Flags: --help, -h
- **where**: Flags: --help, -h, -q, -v
- **which**: Flags: --help, -h, -q, -v

### `more` (https://man7.org/linux/man-pages/man1/more.1.html)

- Allowed standalone flags: --help, --version, -V, -c, -d, -f, -h, -l, -p, -s, -u
- Allowed valued flags: --lines, -n
- Bare invocation allowed

### `mvn / mvnw` (https://maven.apache.org/ref/current/maven-embedder/cli.html)

- Phases: compile, dependency:list, dependency:tree, help:describe, test, test-compile, validate, verify.

### `netstat` (https://man7.org/linux/man-pages/man8/netstat.8.html)

- Allowed standalone flags: --all, --continuous, --extend, --groups, --help, --interfaces, --listening, --masquerade, --numeric, --numeric-hosts, --numeric-ports, --numeric-users, --program, --route, --statistics, --symbolic, --tcp, --timers, --udp, --unix, --verbose, --version, --wide, -A, -C, -L, -M, -N, -R, -S, -V, -W, -Z, -a, -b, -c, -d, -e, -f, -g, -h, -i, -l, -m, -n, -o, -p, -q, -r, -s, -t, -u, -v, -w, -x
- Allowed valued flags: -I
- Bare invocation allowed

### `networksetup` (https://ss64.com/mac/networksetup.html)

- Allowed: subcommands starting with -list, -get, -show, -print, plus -version and -help.

### `nice` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nice-invocation)

- Skips priority flags (-n/--adjustment), then recursively validates the inner command.

### `nl` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nl-invocation)

- Allowed standalone flags: --help, --no-renumber, --version, -V, -p
- Allowed valued flags: --body-numbering, --footer-numbering, --header-numbering, --join-blank-lines, --line-increment, --number-format, --number-separator, --number-width, --section-delimiter, --starting-line-number, -b, -d, -f, -h, -i, -l, -n, -s, -v, -w
- Bare invocation allowed

### `nm` (https://man7.org/linux/man-pages/man1/nm.1.html)

- Allowed standalone flags: --debug-syms, --defined-only, --demangle, --dynamic, --extern-only, --help, --line-numbers, --no-demangle, --no-llvm-bc, --no-sort, --numeric-sort, --portability, --print-armap, --print-file-name, --print-size, --reverse-sort, --special-syms, --undefined-only, --version, -A, -B, -C, -D, -P, -S, -V, -a, -g, -h, -j, -l, -m, -n, -o, -p, -r, -s, -u, -v, -x
- Allowed valued flags: --format, --radix, --size-sort, --target, -f, -t

### `npm` (https://docs.npmjs.com/cli)

- Allowed standalone flags: --help, --version, -V, -h
- **audit**: Flags: --help, --json, --omit, --production, -h. Valued: --audit-level
- **config get**: Flags: --help, --json, --long, -h, -l
- **config list**: Flags: --help, --json, --long, -h, -l
- **doctor**: Flags: --help, --json, -h
- **explain**: Flags: --help, --json, -h
- **fund**: Flags: --help, --json, -h
- **info**: Flags: --help, --json, -h
- **list**: Flags: --all, --help, --json, --link, --long, --omit, --parseable, --production, --unicode, -a, -h, -l. Valued: --depth, --prefix
- **ls**: Flags: --all, --help, --json, --link, --long, --omit, --parseable, --production, --unicode, -a, -h, -l. Valued: --depth, --prefix
- **outdated**: Flags: --help, --json, -h
- **prefix**: Flags: --help, --json, -h
- **root**: Flags: --help, --json, -h
- **run**: run/run-script (test only).
- **test**: Flags: --help, -h
- **view**: Flags: --help, --json, -h
- **why**: Flags: --help, --json, -h

### `nproc` (https://www.gnu.org/software/coreutils/manual/coreutils.html#nproc-invocation)

- Allowed standalone flags: --all, --help, --version, -V, -h
- Allowed valued flags: --ignore
- Bare invocation allowed

### `npx` (https://docs.npmjs.com/cli/commands/npx)

- Allowed packages: @herb-tools/linter, eslint, karma.
- tsc allowed with --noEmit.
- Skips flags: --yes/-y/--no/--package/-p.

### `nroff` (https://man7.org/linux/man-pages/man1/nroff.1.html)

- Allowed standalone flags: --help, --version, -S, -V, -c, -h, -i, -k, -p, -q, -t
- Allowed valued flags: -M, -P, -T, -d, -m, -n, -o, -r, -w

### `nslookup` (https://man7.org/linux/man-pages/man1/nslookup.1.html)

- Allowed: positional args, -debug, -nodebug, -d2, and valued options (-type=, -query=, -port=, -timeout=, -retry=, -class=, -domain=, -querytype=).

### `nvm` (https://github.com/nvm-sh/nvm#readme)

- Allowed standalone flags: --help, --version, -V, -h
- **current**: Flags: --help, --lts, --no-colors, -h
- **list**: Flags: --help, --lts, --no-colors, -h
- **ls**: Flags: --help, --lts, --no-colors, -h
- **ls-remote**: Flags: --help, --lts, --no-colors, -h
- **version**: Flags: --help, --lts, --no-colors, -h
- **which**: Flags: --help, --lts, --no-colors, -h

### `od` (https://www.gnu.org/software/coreutils/manual/coreutils.html#od-invocation)

- Allowed standalone flags: --help, --output-duplicates, --traditional, --version, -V, -b, -c, -d, -f, -h, -i, -l, -o, -s, -v, -x
- Allowed valued flags: --address-radix, --endian, --format, --read-bytes, --skip-bytes, --strings, --width, -A, -N, -S, -j, -t, -w
- Bare invocation allowed

### `ollama` (https://github.com/ollama/ollama/blob/main/docs/api.md)

- Allowed standalone flags: --help, --version, -V, -h
- **list**: Flags: --help, --json, -h
- **ps**: Flags: --help, --json, -h
- **show**: Flags: --help, --json, --license, --modelfile, --parameters, --system, --template, --verbose, -h

### `opencode` (https://opencode.ai/docs/)

- Allowed standalone flags: --help, --version, -V, -h
- **models**: Flags: --help, -h
- **session list**: Flags: --help, -h
- **stats**: Flags: --help, -h

### `orbctl` (https://docs.orbstack.dev/cli)

Aliases: `orb`

- Allowed standalone flags: --help, --version, -V, -h
- **config get**: Flags: --help, -h
- **config show**: Flags: --help, -h
- **default**: bare invocation only (reads current default)
- **doctor**: read-only check (rejects --fix)
- **info**: Flags: --help, -h. Valued: --format, -f
- **list**: Flags: --help, --quiet, --running, -h, -q, -r. Valued: --format, -f
- **logs**: Flags: --all, --help, -a, -h
- **status**: Flags: --help, -h
- **update** (requires --check): Flags: --check, --help, -h
- **version**: Flags: --help, -h

### `otool` (https://ss64.com/mac/otool.html)

- Allowed standalone flags: --help, --version, -D, -I, -L, -V, -X, -a, -c, -d, -f, -h, -l, -o, -r, -t, -v, -x
- Allowed valued flags: -p, -s

### `paste` (https://www.gnu.org/software/coreutils/manual/coreutils.html#paste-invocation)

- Allowed standalone flags: --help, --serial, --version, --zero-terminated, -V, -h, -s, -z
- Allowed valued flags: --delimiters, -d
- Bare invocation allowed

### `periphery` (https://github.com/peripheryapp/periphery)

- Allowed standalone flags: --help, --version, -V, -h
- **scan**: Flags: --help, --quiet, --skip-build, --strict, --verbose, -h. Valued: --config, --format, --index-store-path, --project, --schemes, --targets
- **version**: Flags: --help, -h

### `perl` (https://perldoc.perl.org/perl)

- Allowed: -e/-E inline one-liners with safe built-in functions, --version, --help, -v, -V. Requires -e/-E flag. Code is validated against a safe identifier allowlist.

### `pg_isready` (https://www.postgresql.org/docs/current/app-pg-isready.html)

- Allowed standalone flags: --help, --quiet, --version, -V, -q
- Allowed valued flags: --dbname, --host, --port, --timeout, --username, -U, -d, -h, -p, -t
- Bare invocation allowed

### `pgrep` (https://man7.org/linux/man-pages/man1/pgrep.1.html)

- Allowed standalone flags: --count, --delimiter, --full, --help, --inverse, --lightweight, --list-full, --list-name, --newest, --oldest, --version, -L, -V, -a, -c, -f, -h, -i, -l, -n, -o, -v, -w, -x
- Allowed valued flags: --euid, --group, --parent, --pgroup, --pidfile, --session, --terminal, --uid, -F, -G, -P, -U, -d, -g, -s, -t, -u

### `ping` (https://man7.org/linux/man-pages/man8/ping.8.html)

- Requires -c/--count to prevent infinite ping.
- Flags: -4, -6, -D, -O, -R, -a, -d, -n, -q, -v.
- Valued: -I, -Q, -S, -W, -c, -i, -l, -s, -t, -w, --deadline, --interface, --interval, --ttl.

### `pip` (https://pip.pypa.io/en/stable/cli/)

Aliases: `pip3`

- Allowed standalone flags: --help, --version, -V, -h
- **check**: Flags: --help, -h
- **config get**: Flags: --help, -h
- **config list**: Flags: --help, -h
- **debug**: Flags: --help, -h
- **freeze**: Flags: --all, --exclude-editable, --help, --local, --user, -h, -l. Valued: --exclude, --path
- **help**: Flags: --help, -h
- **index**: Flags: --help, -h
- **inspect**: Flags: --help, -h
- **list**: Flags: --editable, --exclude-editable, --help, --include-editable, --local, --not-required, --outdated, --pre, --uptodate, --user, -e, -h, -i, -l, -o. Valued: --exclude, --format, --index-url, --path
- **show**: Flags: --files, --help, --verbose, -f, -h, -v

### `pkgutil` (https://ss64.com/mac/pkgutil.html)

- Requires a read-only flag (--pkgs, --files, --pkg-info, etc.).

### `plutil` (https://ss64.com/mac/plutil.html)

- Allowed standalone flags: --help, --version, -V, -h, -help
- **-lint**: Flags: --help, -h, -s
- **-p**: Flags: --help, -h
- **-type**: Flags: --help, -h

### `pmset` (https://ss64.com/mac/pmset.html)

- Allowed: -g (get/display settings only).

### `pnpm` (https://pnpm.io/pnpm-cli)

- Allowed standalone flags: --help, --version, -V, -h
- **audit**: Flags: --help, --json, --recursive, -h, -r. Valued: --filter
- **list**: Flags: --dev, --help, --json, --long, --no-optional, --parseable, --production, --recursive, -P, -h, -r. Valued: --depth, --filter
- **ls**: Flags: --dev, --help, --json, --long, --no-optional, --parseable, --production, --recursive, -P, -h, -r. Valued: --depth, --filter
- **outdated**: Flags: --help, --json, --recursive, -h, -r. Valued: --filter
- **why**: Flags: --help, --json, --recursive, -h, -r. Valued: --filter

### `pod` (https://guides.cocoapods.org/terminal/commands.html)

- Allowed standalone flags: --help, --version, -V, -h
- **env**: Flags: --help, -h
- **info**: Flags: --help, -h
- **list**: Flags: --help, -h
- **search**: Flags: --help, --simple, --stats, --web, -h
- **spec cat**: Flags: --help, -h. Valued: --version
- **spec which**: Flags: --help, -h. Valued: --version

### `podman` (https://docs.podman.io/en/latest/Commands.html)

- Allowed standalone flags: --help, --version, -V, -h
- **buildx --version**
- **buildx inspect**: Flags: --help, -h
- **buildx ls**: Flags: --help, -h
- **buildx version**: Flags: --help, -h
- **compose --version**
- **compose config**: Flags: --dry-run, --hash, --help, --images, --no-consistency, --no-interpolate, --no-normalize, --no-path-resolution, --profiles, --quiet, --resolve-image-digests, --services, --volumes, -h, -q. Valued: --format, --output, -o
- **compose images**: Flags: --help, -h
- **compose ls**: Flags: --help, -h
- **compose ps**: Flags: --all, --help, --no-trunc, --orphans, --quiet, --services, -a, -h, -q. Valued: --filter, --format, --status
- **compose top**: Flags: --help, -h
- **compose version**: Flags: --help, -h
- **container diff**: Flags: --help, -h
- **container inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **container list**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **container logs**: Flags: --details, --follow, --help, --timestamps, -f, -h, -t. Valued: --since, --tail, --until, -n
- **container ls**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **container port**: Flags: --help, -h
- **container stats**: Flags: --all, --help, --no-stream, --no-trunc, -a, -h. Valued: --format
- **container top**: Flags: --help, -h
- **context inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **context ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **context show**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **diff**: Flags: --help, -h
- **history**: Flags: --help, --human, --no-trunc, --quiet, -H, -h, -q. Valued: --format
- **image history**: Flags: --help, --human, --no-trunc, --quiet, -H, -h, -q. Valued: --format
- **image inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **image list**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **image ls**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **images**: Flags: --all, --digests, --help, --no-trunc, --quiet, -a, -h, -q. Valued: --filter, --format, -f
- **info**: Flags: --help, -h. Valued: --format, -f
- **inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **logs**: Flags: --details, --follow, --help, --timestamps, -f, -h, -t. Valued: --since, --tail, --until, -n
- **manifest inspect**: Flags: --help, --size, -h, -s. Valued: --format, --type, -f
- **network inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **network ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **port**: Flags: --help, -h
- **ps**: Flags: --all, --help, --last, --latest, --no-trunc, --quiet, --size, -a, -h, -l, -n, -q, -s. Valued: --filter, --format, -f
- **stats**: Flags: --all, --help, --no-stream, --no-trunc, -a, -h. Valued: --format
- **system df**: Flags: --help, -h. Valued: --format, -f
- **system info**: Flags: --help, -h. Valued: --format, -f
- **top**: Flags: --help, -h
- **version**: Flags: --help, -h. Valued: --format, -f
- **volume inspect**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f
- **volume ls**: Flags: --help, --no-trunc, --quiet, -h, -q. Valued: --filter, --format, -f

### `poetry` (https://python-poetry.org/docs/cli/)

- Allowed standalone flags: --help, --version, -V, -h
- **check**: Flags: --help, --lock, -h
- **env info**: Flags: --full-path, --help, -h
- **env list**: Flags: --full-path, --help, -h
- **show**: Flags: --all, --help, --latest, --no-dev, --outdated, --top-level, --tree, -T, -h, -l, -o. Valued: --why

### `printenv` (https://www.gnu.org/software/coreutils/manual/coreutils.html#printenv-invocation)

- Allowed standalone flags: --help, --null, --version, -0, -V, -h
- Bare invocation allowed

### `printf` (https://www.gnu.org/software/coreutils/manual/coreutils.html#printf-invocation)

- Allowed standalone flags: --help, --version, -V, -h

### `procs` (https://github.com/dalance/procs#readme)

- Allowed standalone flags: --help, --no-header, --or, --tree, --version, --watch-interval, -V, -h, -l, -t
- Allowed valued flags: --color, --completion, --config, --gen-completion, --insert, --only, --pager, --sorta, --sortd, --theme, -i, -w
- Bare invocation allowed

### `ps` (https://man7.org/linux/man-pages/man1/ps.1.html)

- Allowed standalone flags: --cumulative, --deselect, --forest, --headers, --help, --info, --no-headers, --version, -A, -C, -H, -L, -M, -N, -S, -T, -V, -Z, -a, -c, -d, -e, -f, -h, -j, -l, -m, -r, -v, -w, -x
- Allowed valued flags: --cols, --columns, --format, --group, --pid, --ppid, --rows, --sid, --sort, --tty, --user, --width, -G, -O, -U, -g, -n, -o, -p, -s, -t, -u
- Bare invocation allowed

### `psql` (https://www.postgresql.org/docs/current/app-psql.html)

- Allowed standalone flags: --help, --version, -V, -h

### `pwd` (https://www.gnu.org/software/coreutils/manual/coreutils.html#pwd-invocation)

- Allowed standalone flags: --help, --version, -L, -P, -V, -h
- Bare invocation allowed

### `pyenv` (https://github.com/pyenv/pyenv#readme)

- Allowed standalone flags: --help, --version, -V, -h
- **help**: Flags: --bare, --help, -h
- **root**: Flags: --bare, --help, -h
- **shims**: Flags: --bare, --help, -h
- **version**: Flags: --bare, --help, -h
- **versions**: Flags: --bare, --help, -h
- **which**: Flags: --bare, --help, -h

### `qemu-img` (https://www.qemu.org/docs/master/tools/qemu-img.html)

- Allowed standalone flags: --help, --version, -V, -h
- **check**: Flags: --force-share, --help, --image-opts, --quiet, -U, -h, -q. Valued: --cache, --format, --object, --output, -T, -f
- **compare**: Flags: --force-share, --help, --image-opts, --progress, --quiet, --strict, -U, -h, -p, -q, -s. Valued: --a-format, --b-format, --cache, --object, -F, -T, -f
- **info**: Flags: --backing-chain, --force-share, --help, --image-opts, --limits, -U, -h. Valued: --cache, --format, --object, --output, -f, -t
- **map**: Flags: --force-share, --help, --image-opts, -U, -h. Valued: --format, --max-length, --object, --output, --start-offset, -f, -l, -s
- **measure**: Flags: --force-share, --help, --image-opts, -U, -h. Valued: --format, --object, --output, --size, --snapshot, --target-format, -O, -f, -l, -o, -s
- **snapshot**: list-only (rejects -a, -c, -d)

### `R` (https://cran.r-project.org/manuals.html)

- CMD check <package> (with --as-cran, --no-tests, --no-examples, --no-vignettes, --no-build-vignettes, --no-manual, --output)
- CMD config <var>

### `rbenv` (https://github.com/rbenv/rbenv#readme)

- Allowed standalone flags: --help, --version, -V, -h
- **help**: Flags: --help, -h
- **root**: Flags: --help, -h
- **shims**: Flags: --help, -h
- **version**: Flags: --help, -h
- **versions**: Flags: --help, -h
- **which**: Flags: --help, -h

### `read` (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/read.html)

- Allowed standalone flags: -r, -s
- Allowed valued flags: -a, -d, -n, -p, -t, -u
- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `readlink` (https://www.gnu.org/software/coreutils/manual/coreutils.html#readlink-invocation)

- Allowed standalone flags: --canonicalize, --canonicalize-existing, --canonicalize-missing, --help, --no-newline, --verbose, --version, --zero, -V, -e, -f, -h, -m, -n, -v, -z

### `realpath` (https://www.gnu.org/software/coreutils/manual/coreutils.html#realpath-invocation)

- Allowed standalone flags: --canonicalize-existing, --canonicalize-missing, --help, --logical, --no-symlinks, --physical, --quiet, --strip, --version, --zero, -L, -P, -V, -e, -h, -m, -q, -s, -z
- Allowed valued flags: --relative-base, --relative-to

### `rev` (https://man7.org/linux/man-pages/man1/rev.1.html)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `rg` (https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md)

- Allowed standalone flags: --binary, --block-buffered, --byte-offset, --case-sensitive, --column, --count, --count-matches, --crlf, --debug, --files, --files-with-matches, --files-without-match, --fixed-strings, --follow, --glob-case-insensitive, --heading, --help, --hidden, --ignore-case, --ignore-file-case-insensitive, --include-zero, --invert-match, --json, --line-buffered, --line-number, --line-regexp, --max-columns-preview, --mmap, --multiline, --multiline-dotall, --no-config, --no-filename, --no-heading, --no-ignore, --no-ignore-dot, --no-ignore-exclude, --no-ignore-files, --no-ignore-global, --no-ignore-messages, --no-ignore-parent, --no-ignore-vcs, --no-line-number, --no-messages, --no-mmap, --no-pcre2-unicode, --no-require-git, --no-unicode, --null, --null-data, --one-file-system, --only-matching, --passthru, --pcre2, --pcre2-version, --pretty, --quiet, --search-zip, --smart-case, --sort-files, --stats, --text, --trim, --type-list, --unicode, --unrestricted, --version, --vimgrep, --with-filename, --word-regexp, -F, -H, -I, -L, -N, -P, -S, -U, -V, -a, -b, -c, -h, -i, -l, -n, -o, -p, -q, -s, -u, -v, -w, -x, -z
- Allowed valued flags: --after-context, --before-context, --color, --colors, --context, --context-separator, --dfa-size-limit, --encoding, --engine, --field-context-separator, --field-match-separator, --file, --glob, --iglob, --ignore-file, --max-columns, --max-count, --max-depth, --max-filesize, --path-separator, --regex-size-limit, --regexp, --replace, --sort, --sortr, --threads, --type, --type-add, --type-clear, --type-not, -A, -B, -C, -E, -M, -T, -e, -f, -g, -j, -m, -r, -t

### `ri` (https://ruby.github.io/rdoc/RI_md.html)

- Allowed standalone flags: --all, --interactive, --list, --no-pager, -a, -i, -l
- Allowed valued flags: --format, --width, -f, -w
- Bare invocation allowed

### `route` (https://man7.org/linux/man-pages/man8/route.8.html)

- Allowed subcommands: get, monitor, print, show
- Allowed flags: -4, -6, -n, -v
- Bare invocation allowed

### `Rscript` (https://cran.r-project.org/manuals.html)

- --version
- --help

### `ruby` (https://www.ruby-lang.org/en/documentation/)

- Allowed standalone flags: --help, --version, -V, -h, -v

### `rustup` (https://rust-lang.github.io/rustup/)

- Allowed standalone flags: --help, --version, -V, -h
- **component list**: Flags: --help, --installed, -h, -v. Valued: --toolchain
- **doc**: Flags: --alloc, --book, --cargo, --core, --edition-guide, --embedded-book, --help, --nomicon, --path, --proc_macro, --reference, --rust-by-example, --rustc, --rustdoc, --std, --test, --unstable-book, -h. Valued: --toolchain
- **run**: run <toolchain> delegates to inner command.
- **show**: Flags: --help, --installed, -h, -v
- **target list**: Flags: --help, --installed, -h, -v. Valued: --toolchain
- **toolchain list**: Flags: --help, --installed, -h, -v. Valued: --toolchain
- **which**: Flags: --help, -h. Valued: --toolchain

### `safe-chains` (https://github.com/michaeldhopkins/safe-chains#readme)

- Any arguments allowed (safe-chains is this tool).

### `sdkmanager` (https://developer.android.com/tools/sdkmanager)

- Allowed standalone flags: --help, --list, --version, -V, -h
- Allowed valued flags: --channel, --sdk_root

### `security` (https://ss64.com/mac/security.html)

- Allowed standalone flags: --help, --version, -V, -h
- **cms**: Flags: --help, -h
- **dump-keychain**: Flags: --help, -h
- **dump-trust-settings**: Flags: --help, -h
- **find-certificate**: Flags: --help, -Z, -a, -h, -p. Valued: -c, -e
- **find-generic-password**: Flags: --help, -h. Valued: -D, -a, -c, -d, -j, -l, -r, -s, -t
- **find-identity**: Flags: --help, -h, -v. Valued: -p, -s
- **find-internet-password**: Flags: --help, -h. Valued: -D, -a, -c, -d, -j, -l, -r, -s, -t
- **list-keychains**: Flags: --help, -d, -h
- **show-keychain-info**: Flags: --help, -h
- **smartcard**: Flags: --help, -h
- **verify-cert**: Flags: --help, -L, -h, -l, -q. Valued: -c, -k, -n, -p, -r

### `sed` (https://www.gnu.org/software/sed/manual/sed.html)

- Allowed standalone flags: --debug, --help, --posix, --quiet, --sandbox, --silent, --unbuffered, --version, -E, -V, -h, -n, -r, -u, -z
- Allowed valued flags: --expression, --file, --line-length, -e, -f, -l
- Inline expressions validated for safety

### `seq` (https://www.gnu.org/software/coreutils/manual/coreutils.html#seq-invocation)

- Allowed standalone flags: --equal-width, --help, --version, -V, -h, -w
- Allowed valued flags: --format, --separator, -f, -s, -t

### `sha1sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha1sum-invocation)

- Allowed standalone flags: --binary, --check, --help, --ignore-missing, --quiet, --status, --strict, --tag, --text, --version, --warn, --zero, -V, -b, -c, -h, -t, -w, -z
- Bare invocation allowed

### `sha256sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha2-utilities)

- Allowed standalone flags: --binary, --check, --help, --ignore-missing, --quiet, --status, --strict, --tag, --text, --version, --warn, --zero, -V, -b, -c, -h, -t, -w, -z
- Bare invocation allowed

### `sha512sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sha2-utilities)

- Allowed standalone flags: --binary, --check, --help, --ignore-missing, --quiet, --status, --strict, --tag, --text, --version, --warn, --zero, -V, -b, -c, -h, -t, -w, -z
- Bare invocation allowed

### `shasum` (https://perldoc.perl.org/shasum)

- Allowed standalone flags: --binary, --check, --help, --portable, --status, --strict, --tag, --text, --version, --warn, -0, -V, -b, -c, -h, -p, -s, -t
- Allowed valued flags: --algorithm, -a
- Bare invocation allowed

### `shellcheck` (https://www.shellcheck.net/wiki/)

- Allowed standalone flags: --color, --external-sources, --help, --list-optional, --norc, --severity, --version, --wiki-link-count, -C, -V, -a, -h, -x
- Allowed valued flags: --enable, --exclude, --format, --include, --rcfile, --severity, --shell, --source-path, --wiki-link-count, -P, -S, -W, -e, -f, -i, -o, -s

### `shuf` (https://www.gnu.org/software/coreutils/manual/coreutils.html#shuf-invocation)

- Allowed standalone flags: --echo, --help, --repeat, --version, --zero-terminated, -V, -e, -h, -r, -z
- Allowed valued flags: --head-count, --input-range, --random-source, -i, -n
- Bare invocation allowed

### `simctl` (https://developer.apple.com/documentation/xcode/simctl)

- **list**: Flags: --help, --json, --verbose, -h, -j, -v

### `sips` (https://ss64.com/mac/sips.html)

- Allowed standalone flags: --help, --version, -V, -h
- Allowed valued flags: --getProperty, -g

### `size` (https://man7.org/linux/man-pages/man1/size.1.html)

- Allowed standalone flags: --common, --help, --totals, --version, -A, -B, -G, -V, -d, -h, -o, -t, -x
- Allowed valued flags: --format, --radix, --target

### `sleep` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sleep-invocation)

- Allowed standalone flags: --help, --version, -V, -h

### `sort` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sort-invocation)

- Allowed standalone flags: --check, --debug, --dictionary-order, --general-numeric-sort, --help, --human-numeric-sort, --ignore-case, --ignore-leading-blanks, --ignore-nonprinting, --merge, --month-sort, --numeric-sort, --random-sort, --reverse, --stable, --unique, --version, --version-sort, --zero-terminated, -C, -M, -R, -V, -b, -c, -d, -f, -g, -h, -i, -m, -n, -r, -s, -u, -z
- Allowed valued flags: --batch-size, --buffer-size, --field-separator, --files0-from, --key, --parallel, --random-source, --sort, --temporary-directory, -S, -T, -k, -t
- Bare invocation allowed

### `spctl` (https://ss64.com/mac/spctl.html)

- Requires --assess/-a.

### `ss` (https://man7.org/linux/man-pages/man8/ss.8.html)

- Allowed standalone flags: --all, --dccp, --extended, --family, --help, --info, --ipv4, --ipv6, --listening, --memory, --no-header, --numeric, --oneline, --options, --packet, --processes, --raw, --resolve, --sctp, --summary, --tcp, --tipc, --udp, --unix, --version, --vsock, -0, -4, -6, -E, -H, -O, -V, -a, -e, -h, -i, -l, -m, -n, -o, -p, -r, -s, -t, -u, -w, -x
- Allowed valued flags: --filter, --query, -A, -F, -f
- Bare invocation allowed

### `stat` (https://www.gnu.org/software/coreutils/manual/coreutils.html#stat-invocation)

- Allowed standalone flags: --dereference, --file-system, --help, --terse, --version, -F, -L, -V, -h, -l, -n, -q, -r, -s, -x
- Allowed valued flags: --format, --printf, -c, -f, -t

### `strings` (https://man7.org/linux/man-pages/man1/strings.1.html)

- Allowed standalone flags: --all, --help, --include-all-whitespace, --print-file-name, --version, -V, -a, -f, -h, -w
- Allowed valued flags: --bytes, --encoding, --output-separator, --radix, --target, -T, -e, -n, -o, -s, -t

### `sum` (https://www.gnu.org/software/coreutils/manual/coreutils.html#sum-invocation)

- Allowed standalone flags: --help, --sysv, --version, -V, -h, -r, -s
- Bare invocation allowed

### `sw_vers` (https://ss64.com/mac/sw_vers.html)

- Allowed standalone flags: --buildVersion, --help, --productName, --productVersion, --productVersionExtra, --version, -V, -h
- Bare invocation allowed

### `swift` (https://www.swift.org/documentation/swift-compiler/)

- Allowed standalone flags: --help, --version, -V, -h
- **build**: Flags: --enable-code-coverage, --help, --show-bin-path, --skip-update, --static-swift-stdlib, --verbose, -h, -v. Valued: --arch, --build-path, --configuration, --jobs, --package-path, --product, --sanitize, --swift-sdk, --target, --triple, -c, -j
- **package describe**: Flags: --help, -h. Valued: --package-path, --type
- **package dump-package**: Flags: --help, -h. Valued: --package-path
- **package show-dependencies**: Flags: --help, -h. Valued: --format, --package-path
- **test**: Flags: --enable-code-coverage, --help, --list-tests, --parallel, --show-codecov-path, --skip-build, --skip-update, --verbose, -h, -l, -v. Valued: --arch, --build-path, --configuration, --filter, --jobs, --num-workers, --package-path, --sanitize, --skip-tests, --swift-sdk, --target, --triple, --xunit-output, -c, -j

### `swiftformat` (https://github.com/nicklockwood/SwiftFormat)

- Requires --lint or --dryrun.

### `swiftlint` (https://github.com/realm/SwiftLint)

- Allowed standalone flags: --help, --version, -V, -h
- **analyze**: Flags: --help, --quiet, --strict, -h. Valued: --compiler-log-path, --config, --path, --reporter
- **lint**: Flags: --help, --no-cache, --quiet, --strict, -h. Valued: --config, --path, --reporter
- **reporters**: Flags: --help, -h
- **rules**: Flags: --disabled, --enabled, --help, -h. Valued: --config, --reporter
- **version**: Flags: --help, -h

### `sysctl` (https://man7.org/linux/man-pages/man8/sysctl.8.html)

- Read-only usage.

### `system_profiler` (https://ss64.com/mac/system_profiler.html)

- Allowed standalone flags: --help, --json, --version, --xml, -V, -h, -json, -listDataTypes, -nospinner, -xml
- Allowed valued flags: -detailLevel, -timeout
- Bare invocation allowed

### `tac` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tac-invocation)

- Allowed standalone flags: --before, --help, --regex, --version, -V, -b, -h, -r
- Allowed valued flags: --separator, -s
- Bare invocation allowed

### `tail` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tail-invocation)

- Allowed standalone flags: --follow, --help, --quiet, --retry, --silent, --verbose, --version, --zero-terminated, -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, -F, -V, -f, -h, -q, -r, -v, -z
- Allowed valued flags: --bytes, --lines, --max-unchanged-stats, --pid, --sleep-interval, -b, -c, -n
- Bare invocation allowed

### `tar` (https://man7.org/linux/man-pages/man1/tar.1.html)

- Listing mode only (requires -t or --list). Old-style flags accepted (e.g. tar tf, tar tzf).
- Flags: -f, -j, -J, -v, -z, -O, --bzip2, --file, --gzip, --xz, --zstd.

### `tea` (https://gitea.com/gitea/tea)

- Subcommands b, branch, branches, i, issue, issues, label, labels, milestone, milestones, ms, n, notification, notifications, org, organization, organizations, pr, pull, pulls, r, release, releases, repo, repos, t, time, times are allowed with actions: list, view or bare invocation.
- Always safe: --version, -v, whoami.
- logins/login (list only).

### `terraform` (https://developer.hashicorp.com/terraform/cli/commands)

- Allowed standalone flags: --help, --version, -V, -h
- **fmt** (requires --check): Flags: --check, --diff, --help, --no-color, --recursive, -h
- **graph**: Flags: --draw-cycles, --help, -h. Valued: --plan, --type
- **output**: Flags: --help, --json, --no-color, --raw, -h. Valued: --state
- **providers**: Flags: --help, -h
- **show**: Flags: --help, --json, --no-color, -h
- **state list**: Flags: --help, -h. Valued: --id, --state
- **state show**: Flags: --help, -h. Valued: --state
- **validate**: Flags: --help, --json, --no-color, -h
- **version**: Flags: --help, --json, -h

### `test` (https://www.gnu.org/software/coreutils/manual/coreutils.html#test-invocation)

Aliases: `[`

- Bare invocation allowed
- Hyphen-prefixed positional arguments accepted

### `time` (https://man7.org/linux/man-pages/man1/time.1.html)

- Skips -p flag, then recursively validates the inner command.

### `timeout` (https://www.gnu.org/software/coreutils/manual/coreutils.html#timeout-invocation)

- Skips timeout flags (-s/--signal, -k/--kill-after, --preserve-status), then recursively validates the inner command.

### `tokei` (https://github.com/XAMPPRocky/tokei#readme)

- Allowed standalone flags: --compact, --files, --help, --hidden, --no-ignore, --no-ignore-dot, --no-ignore-parent, --no-ignore-vcs, --verbose, --version, -C, -V, -f, -h
- Allowed valued flags: --columns, --exclude, --input, --languages, --num-format, --output, --sort, --type, -c, -e, -i, -l, -o, -s, -t
- Bare invocation allowed

### `top` (https://man7.org/linux/man-pages/man1/top.1.html)

- Allowed standalone flags: --help, --version, -1, -B, -E, -H, -S, -V, -b, -c, -e, -h, -i
- Allowed valued flags: -F, -O, -U, -d, -f, -l, -n, -o, -p, -s, -u, -w
- Bare invocation allowed

### `tr` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tr-invocation)

- Allowed standalone flags: --complement, --delete, --help, --squeeze-repeats, --truncate-set1, --version, -C, -V, -c, -d, -h, -s

### `tree` (https://man7.org/linux/man-pages/man1/tree.1.html)

- Allowed standalone flags: --dirsfirst, --du, --fromfile, --gitignore, --help, --inodes, --matchdirs, --noreport, --prune, --si, --version, -A, -C, -D, -F, -J, -N, -Q, -S, -V, -X, -a, -d, -f, -g, -h, -i, -l, -n, -p, -q, -r, -s, -t, -u, -v, -x
- Allowed valued flags: --charset, --filelimit, --filesfrom, --sort, --timefmt, -H, -I, -L, -P, -T
- Bare invocation allowed

### `true` (https://www.gnu.org/software/coreutils/manual/coreutils.html#true-invocation)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `tty` (https://www.gnu.org/software/coreutils/manual/coreutils.html#tty-invocation)

- Allowed standalone flags: --help, --quiet, --silent, --version, -V, -h, -s
- Bare invocation allowed

### `tuist` (https://docs.tuist.dev/en/cli/)

- Allowed standalone flags: --help, --version, -V, -h
- **dump**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **graph**: Flags: --help, --json, --verbose, -h. Valued: --format, --path, -f, -p
- **hash cache**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **hash selective-testing**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect build**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect bundle**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect dependencies**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect implicit-imports**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect redundant-imports**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **inspect test**: Flags: --help, --json, --verbose, -h. Valued: --path, -p
- **migration check-empty-settings**: Flags: --help, -h. Valued: --path, -p
- **migration list-targets**: Flags: --help, -h. Valued: --path, -p
- **scaffold list**: Flags: --help, --json, -h. Valued: --path, -p
- **version**: Flags: --help, -h

### `type` (https://man7.org/linux/man-pages/man1/type.1p.html)

- Allowed standalone flags: --help, --version, -P, -V, -a, -f, -h, -p, -t

### `uname` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uname-invocation)

- Allowed standalone flags: --all, --help, --kernel-name, --kernel-release, --kernel-version, --machine, --nodename, --operating-system, --processor, --version, -V, -a, -h, -m, -n, -o, -p, -r, -s, -v
- Bare invocation allowed

### `unexpand` (https://www.gnu.org/software/coreutils/manual/coreutils.html#unexpand-invocation)

- Allowed standalone flags: --all, --first-only, --help, --version, -V, -a, -h
- Allowed valued flags: --tabs, -t
- Bare invocation allowed

### `uniq` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uniq-invocation)

- Allowed standalone flags: --count, --help, --ignore-case, --repeated, --unique, --version, --zero-terminated, -D, -V, -c, -d, -h, -i, -u, -z
- Allowed valued flags: --all-repeated, --check-chars, --group, --skip-chars, --skip-fields, -f, -s, -w
- Bare invocation allowed

### `unset` (https://man7.org/linux/man-pages/man1/unset.1p.html)

- Allowed standalone flags: --help, --version, -V, -f, -h, -n, -v
- Bare invocation allowed

### `unzip` (https://linux.die.net/man/1/unzip)

- List/test modes only (requires -l, -t, or -Z).
- Flags: -1, -2, -C, -M, -T, -h, -m, -q, -s, -v, -z.

### `uptime` (https://www.gnu.org/software/coreutils/manual/coreutils.html#uptime-invocation)

- Allowed standalone flags: --help, --pretty, --since, --version, -V, -h, -p, -s
- Bare invocation allowed

### `uuidgen` (https://man7.org/linux/man-pages/man1/uuidgen.1.html)

- Allowed standalone flags: --help, --random, --time, --version, -V, -h, -r, -t
- Allowed valued flags: --md5, --name, --namespace, --sha1, -N, -m, -n, -s
- Bare invocation allowed

### `uv` (https://docs.astral.sh/uv/reference/cli/)

- Allowed standalone flags: --help, --version, -V, -h
- **pip check**: Flags: --help, --verbose, -h, -v. Valued: --python
- **pip freeze**: Flags: --help, --verbose, -h, -v. Valued: --python
- **pip list**: Flags: --editable, --exclude-editable, --help, --outdated, --strict, -h. Valued: --exclude, --format, --python
- **pip show**: Flags: --files, --help, --verbose, -h, -v. Valued: --python
- **python list**: Flags: --help, --verbose, -h, -v. Valued: --python
- **tool list**: Flags: --help, --verbose, -h, -v. Valued: --python

### `vercel` (https://vercel.com/docs/cli)

- Allowed standalone flags: --help, --version, -V, -h
- **inspect**: Flags: --help, --json, -h, -j. Valued: --scope, --timeout, -S, -T
- **list**: Flags: --help, --json, -h, -j. Valued: --meta, --next, --scope, -S, -m
- **project ls**: Flags: --help, --json, -h, -j. Valued: --scope, -S
- **whoami**: Flags: --help, -h

### `vibe` (https://docs.mistral.ai/mistral-vibe/)

- Allowed standalone flags: --help, --version, -V, -h

### `vm_stat` (https://ss64.com/mac/vm_stat.html)

- Allowed standalone flags: --help, --version, -V, -h
- Allowed valued flags: -c
- Bare invocation allowed

### `volta` (https://docs.volta.sh/reference)

- Allowed standalone flags: --help, --version, -V, -h
- **list**: Flags: --current, --default, --help, -c, -d, -h. Valued: --format
- **which**: Flags: --current, --default, --help, -c, -d, -h. Valued: --format

### `w` (https://man7.org/linux/man-pages/man1/w.1.html)

- Allowed standalone flags: --from, --help, --ip-addr, --no-current, --no-header, --old-style, --short, --version, -V, -f, -h, -i, -o, -s, -u
- Bare invocation allowed

### `wait` (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/wait.html)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `wc` (https://www.gnu.org/software/coreutils/manual/coreutils.html#wc-invocation)

- Allowed standalone flags: --bytes, --chars, --help, --lines, --max-line-length, --version, --words, --zero-terminated, -L, -V, -c, -h, -l, -m, -w
- Allowed valued flags: --files0-from
- Bare invocation allowed

### `whereis` (https://man7.org/linux/man-pages/man1/whereis.1.html)

- Allowed standalone flags: --help, --version, -V, -b, -h, -l, -m, -s, -u
- Allowed valued flags: -B, -M, -S, -f

### `which` (https://man7.org/linux/man-pages/man1/which.1.html)

- Allowed standalone flags: --all, --help, --version, -V, -a, -h, -s

### `who` (https://www.gnu.org/software/coreutils/manual/coreutils.html#who-invocation)

- Allowed standalone flags: --all, --boot, --count, --dead, --heading, --help, --login, --lookup, --mesg, --message, --process, --runlevel, --short, --time, --users, --version, --writable, -H, -S, -T, -V, -a, -b, -d, -h, -l, -m, -p, -q, -r, -s, -t, -u, -w
- Bare invocation allowed

### `whoami` (https://www.gnu.org/software/coreutils/manual/coreutils.html#whoami-invocation)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `whois` (https://man7.org/linux/man-pages/man1/whois.1.html)

- Allowed standalone flags: --help, --version, -A, -B, -G, -H, -I, -K, -L, -M, -Q, -R, -S, -a, -b, -c, -d, -f, -g, -l, -m, -r, -x
- Allowed valued flags: -T, -V, -h, -i, -p, -s, -t

### `workon` (https://github.com/michaeldhopkins/workon)

- Allowed standalone flags: --help, --version, -V, -h
- Bare invocation allowed

### `xargs` (https://www.gnu.org/software/findutils/manual/html_mono/find.html#Invoking-xargs)

- Recursively validates the inner command. Skips xargs-specific flags (-I, -L, -n, -P, -s, -E, -d, -0, -r, -t, -p, -x).

### `xcbeautify` (https://github.com/cpisciotta/xcbeautify)

- Allowed standalone flags: --help, --is-ci, --quiet, --quieter, --version, -V, -h, -q
- Allowed valued flags: --renderer
- Bare invocation allowed

### `xcode-select` (https://ss64.com/mac/xcode-select.html)

- Allowed standalone flags: --help, --print-path, --version, -V, -h, -p, -v

### `xcodebuild` (https://developer.apple.com/documentation/xcode/xcodebuild)

- Allowed standalone flags: --help, --version, -V, -h
- **-list**: Flags: --help, -h, -json. Valued: -project, -workspace
- **-showBuildSettings**: Flags: --help, -h, -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-showdestinations**: Flags: --help, -h, -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-showsdks**: Flags: --help, -h, -json. Valued: -configuration, -destination, -project, -scheme, -sdk, -target, -workspace
- **-version**: Flags: --help, -h

### `xcodegen` (https://github.com/yonaskolb/XcodeGen)

- Allowed standalone flags: --help, --version, -V, -h
- **dump**: Flags: --help, --no-env, --quiet, -h, -n, -q. Valued: --project-root, --spec, --type, -r, -s, -t
- **version**: Flags: --help, -h

### `xcrun` (https://ss64.com/mac/xcrun.html)

- Allowed: --find, --show-sdk-*, --show-toolchain-path. Multi-level: notarytool history/info/log, simctl list, stapler validate. Prefix flags --sdk/--toolchain (with arg), -v/-l/-n are skipped.

### `xmllint` (https://gnome.pages.gitlab.gnome.org/libxml2/xmllint.html)

- Allowed standalone flags: --auto, --catalogs, --compress, --copy, --debug, --debugent, --dropdtd, --format, --help, --html, --htmlout, --huge, --load-trace, --loaddtd, --memory, --noblanks, --nocatalogs, --nocdata, --nocompact, --nodefdtd, --noenc, --noent, --nonet, --noout, --nowarning, --nowrap, --nsclean, --oldxml10, --postvalid, --push, --pushsmall, --quiet, --recover, --repeat, --sax, --sax1, --stream, --testIO, --timing, --valid, --version, --walker, --xinclude, --xmlout, -V, -h
- Allowed valued flags: --dtdvalid, --dtdvalidfpi, --encode, --maxmem, --path, --pattern, --pretty, --relaxng, --schema, --schematron, --xpath

### `xxd` (https://man7.org/linux/man-pages/man1/xxd.1.html)

- Allowed standalone flags: --autoskip, --bits, --capitalize, --decimal, --ebcdic, --help, --include, --little-endian, --plain, --postscript, --revert, --uppercase, --version, -C, -E, -V, -a, -b, -d, -e, -h, -i, -p, -r, -u
- Allowed valued flags: --color, --cols, --groupsize, --len, --name, --offset, --seek, -R, -c, -g, -l, -n, -o, -s
- Bare invocation allowed

### `yarn` (https://yarnpkg.com/cli)

- Subcommands: info, list, ls, test, test:*, why.

### `yq` (https://mikefarah.gitbook.io/yq)

- Allowed standalone flags: --colors, --exit-status, --help, --no-colors, --no-doc, --null-input, --prettyPrint, --version, -C, -M, -N, -P, -V, -e, -h, -r
- Allowed valued flags: --arg, --argjson, --expression, --front-matter, --indent, --input-format, --output-format, -I, -p

### `zcat` (https://man7.org/linux/man-pages/man1/zcat.1.html)

Aliases: `gzcat`

- Allowed standalone flags: --force, --help, --quiet, --verbose, --version, -V, -f, -h, -q, -v
- Bare invocation allowed

### `zgrep` (https://man7.org/linux/man-pages/man1/zgrep.1.html)

Aliases: `zegrep`, `zfgrep`

- Allowed standalone flags: --count, --extended-regexp, --files-with-matches, --files-without-match, --fixed-strings, --help, --ignore-case, --invert-match, --line-number, --no-filename, --only-matching, --quiet, --silent, --version, --with-filename, --word-regexp, -E, -F, -G, -H, -L, -V, -Z, -c, -h, -i, -l, -n, -o, -q, -s, -v, -w, -x
- Allowed valued flags: --after-context, --before-context, --context, --file, --max-count, --regexp, -A, -B, -C, -e, -f, -m

### `zipalign` (https://developer.android.com/tools/zipalign)

- Check mode only (requires -c). Flags: -p, -v.

### `zipinfo` (https://linux.die.net/man/1/zipinfo)

- Allowed standalone flags: --help, --version, -1, -2, -C, -M, -T, -V, -Z, -h, -l, -m, -s, -t, -v, -z