# packs/evidence/binaries.txt — binaries that count as command evidence.
#
# Used by no-vibes.sh `has_command_evidence` to decide whether a backtick-
# quoted token in the model's outgoing message represents an actual command
# the model claims to have run. The hook still requires proximity + an
# action verb (issue #4 fix); this pack only governs WHICH binaries are
# recognized as commands.
#
# Default behavior: all sections are loaded. Operators who want a tighter
# allowlist can subset via env:
#   LLM_DARK_PATTERNS_EVIDENCE_CATEGORIES=app-dev,devops,shell-tools
#
# Native speakers / domain experts: PRs welcome. Add binaries to the
# section that fits, or open a new section if needed.

# Application development — language toolchains, package managers, test
# runners, formatters, linters.
[app-dev]
bash
sh
zsh
fish
git
gh
glab
make
cmake
just
task
ninja
bazel
node
npm
pnpm
yarn
bun
deno
python
python3
pip
uv
poetry
pipx
ruff
black
mypy
pylint
pytest
unittest
tox
nox
ruby
gem
bundle
rake
rspec
rubocop
go
cargo
rustc
rustup
java
javac
mvn
gradle
swift
swiftc
xcodebuild
dart
flutter
elixir
mix
erl
rebar3
php
composer
phpunit
dotnet
csc
nuget

# Containers, registries, runtimes.
[containers]
docker
docker-compose
podman
podman-compose
buildah
skopeo
crane
nerdctl
ctr
containerd

# Kubernetes and adjacent.
[k8s]
kubectl
helm
kustomize
k9s
kind
minikube
k3s
k3d
kubeadm
kubectx
kubens
stern
argocd
flux

# Infrastructure as code, configuration management, secrets, service mesh.
[devops]
terraform
tofu
pulumi
ansible
ansible-playbook
ansible-vault
packer
nomad
consul
vault
istioctl
linkerd
opa
conftest
pre-commit

# Cloud provider CLIs.
[cloud]
aws
gcloud
gsutil
bq
az
doctl
linode-cli
ibmcloud
oci
vultr-cli
flyctl
heroku
supabase
firebase
netlify
vercel
railway

# Database clients.
[database]
psql
pg_dump
pg_restore
mysql
mysqldump
mariadb
mongosh
mongo
mongodump
mongorestore
redis-cli
sqlite3
cqlsh
clickhouse-client
duckdb
usql
dynein
influx

# Generic shell tools — text processing, search, data transformation.
[shell-tools]
jq
yq
miller
mlr
sed
awk
gawk
grep
egrep
fgrep
rg
ag
ack
fd
find
xargs
sort
uniq
head
tail
cat
tac
cut
paste
tr
wc
diff
patch
comm
column
fold
fmt
expand
unexpand
nl
tee

# System administration on Linux/Unix.
[system]
systemctl
journalctl
service
update-alternatives
dpkg
apt
apt-get
yum
dnf
rpm
pacman
zypper
brew
snap
flatpak
ip
ifconfig
ss
netstat
ping
traceroute
mtr
dig
nslookup
host
arp
iptables
nft
ufw
firewall-cmd
ufw
dmesg
lscpu
lsblk
lsof
lspci
lsusb
top
htop
btop
ps
pgrep
pkill
free
vmstat
iostat
mpstat
sar
uptime
uname
hostname
hostnamectl
timedatectl
localectl
chmod
chown
chgrp
chattr
lsattr
mount
umount
df
du
fdisk
parted
mkfs
fsck

# Archive and compression.
[archive]
tar
gzip
gunzip
bzip2
bunzip2
xz
unxz
zstd
zip
unzip
7z
rar
unrar
cpio

# HTTP, transfer, networking clients.
[http]
curl
wget
http
httpie
xh
ab
wrk
hey
nc
ncat
socat
rsync
scp
sftp
ssh
mosh
sshpass
gpg
openssl
keytool
