@dreki-gg/pi-plan-mode 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @dreki-gg/pi-plan-mode
 
+## 0.6.0
+
+### Minor Changes
+
+- [`2a08c1d`](https://github.com/dreki-gg/pi-extensions/commit/2a08c1d0b10a1ca74dfab74f93dd200570537e0f) Thanks [@jalbarrang](https://github.com/jalbarrang)! - feat(ask-mode, plan-mode): support concatenated shell commands in sandbox validation
+
+  Commands using `&&`, `||`, and `;` operators are now parsed and validated per-segment instead of being blocked outright. Uses `shell-quote` for proper shell tokenization that respects quoted strings, subshells, and redirects.
+
+  Previously, safe commands like `cd src && ls -la` or `git status && git log` were incorrectly blocked because the sandbox only split on pipes (`|`). Now each segment is validated independently against the safe/destructive pattern lists.
+
+  Also adds `cd`, `basename`, `dirname`, `realpath`, `readlink`, and `bun pm ls` to the safe commands list, and blocks command substitution (`$(...)` and backticks) by default.
+
+  Shared sandbox logic extracted to private `@dreki-gg/pi-command-sandbox` package (bundled into published tarballs via `bundledDependencies`).
+
+## 0.5.1
+
+### Patch Changes
+
+- [`8e9aa09`](https://github.com/dreki-gg/pi-extensions/commit/8e9aa0963fe81286e9c5972f6a9d666645807f1a) Thanks [@jalbarrang](https://github.com/jalbarrang)! - fix(plan-mode): allow safe bash commands that were incorrectly blocked in plan mode
+
+  Three fixes to `isSafeCommand`:
+
+  - Allow `mkdir -p .plans/` since the planner needs to create plan directories
+  - Fix redirect pattern to not false-positive on stderr redirects like `2>/dev/null`
+  - Split piped commands and validate each segment independently, so `curl ... | grep ... | head` works correctly
+
 ## 0.5.0
 
 ### Minor Changes

package/extensions/plan-mode/utils.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, test } from 'bun:test';
+import { isSafeCommand } from './utils.js';
+
+describe('isSafeCommand', () => {
+  // ── Commands that SHOULD be allowed ──────────────────────────────────────
+  describe('allowed commands', () => {
+    test('mkdir -p .plans/<name>', () => {
+      expect(isSafeCommand('mkdir -p .plans/monorepo-src-migration')).toBe(true);
+    });
+
+    test('mkdir .plans/<name>', () => {
+      expect(isSafeCommand('mkdir .plans/my-plan')).toBe(true);
+    });
+
+    test('curl with 2>/dev/null pipe chain', () => {
+      expect(
+        isSafeCommand(
+          `curl -sL "https://effect.website/docs/platform/introduction/" 2>/dev/null | grep -oP '(?<=href=")[^"]*' | grep -iE "(http|server|rpc)" | head -20`,
+        ),
+      ).toBe(true);
+    });
+
+    test('curl with 2>/dev/null simple', () => {
+      expect(
+        isSafeCommand(
+          `curl -s "https://raw.githubusercontent.com/Effect-TS/effect/main/packages/platform/README.md" 2>/dev/null | head -100`,
+        ),
+      ).toBe(true);
+    });
+
+    test('simple ls', () => {
+      expect(isSafeCommand('ls -la')).toBe(true);
+    });
+
+    test('git status', () => {
+      expect(isSafeCommand('git status')).toBe(true);
+    });
+
+    test('git log', () => {
+      expect(isSafeCommand('git log --oneline -10')).toBe(true);
+    });
+
+    test('find piped to grep', () => {
+      expect(isSafeCommand('find . -name "*.ts" | grep -v node_modules')).toBe(true);
+    });
+
+    test('cat piped to head', () => {
+      expect(isSafeCommand('cat README.md | head -50')).toBe(true);
+    });
+
+    test('rg (ripgrep)', () => {
+      expect(isSafeCommand('rg "pattern" src/')).toBe(true);
+    });
+
+    test('grep with context', () => {
+      expect(isSafeCommand('grep -rn "export" src/ | head -20')).toBe(true);
+    });
+
+    test('npm list', () => {
+      expect(isSafeCommand('npm list --depth=0')).toBe(true);
+    });
+
+    test('curl piped to jq', () => {
+      expect(isSafeCommand('curl -s https://api.example.com | jq .name')).toBe(true);
+    });
+  });
+
+  // ── Commands that SHOULD be blocked ──────────────────────────────────────
+  describe('blocked commands', () => {
+    test('rm -rf', () => {
+      expect(isSafeCommand('rm -rf node_modules')).toBe(false);
+    });
+
+    test('mkdir outside .plans/', () => {
+      expect(isSafeCommand('mkdir -p src/new-dir')).toBe(false);
+    });
+
+    test('stdout redirect to file', () => {
+      expect(isSafeCommand('echo "hello" > file.txt')).toBe(false);
+    });
+
+    test('append redirect', () => {
+      expect(isSafeCommand('echo "hello" >> file.txt')).toBe(false);
+    });
+
+    test('git commit', () => {
+      expect(isSafeCommand('git commit -m "test"')).toBe(false);
+    });
+
+    test('npm install', () => {
+      expect(isSafeCommand('npm install lodash')).toBe(false);
+    });
+
+    test('mv file', () => {
+      expect(isSafeCommand('mv old.ts new.ts')).toBe(false);
+    });
+
+    test('sudo anything', () => {
+      expect(isSafeCommand('sudo ls')).toBe(false);
+    });
+
+    test('cp file', () => {
+      expect(isSafeCommand('cp a.ts b.ts')).toBe(false);
+    });
+
+    test('touch file', () => {
+      expect(isSafeCommand('touch newfile.ts')).toBe(false);
+    });
+  });
+});

package/extensions/plan-mode/utils.ts

@@ -1,126 +1,45 @@
 /**
  * Pure utility functions for plan mode.
+ *
+ * Command sandboxing is delegated to @dreki-gg/pi-command-sandbox.
  */
 
+import { isSafeCommand as baseSafeCommand } from '@dreki-gg/pi-command-sandbox';
+
 export interface TodoItem {
   step: number;
   text: string;
   completed: boolean;
 }
 
-// ── Destructive bash patterns (blocked in plan mode) ────────────────────────
-const DESTRUCTIVE_PATTERNS = [
-  /\brm\b/i,
-  /\brmdir\b/i,
-  /\bmv\b/i,
-  /\bcp\b/i,
-  /\bmkdir\b/i,
-  /\btouch\b/i,
-  /\bchmod\b/i,
-  /\bchown\b/i,
-  /\bchgrp\b/i,
-  /\bln\b/i,
-  /\btee\b/i,
-  /\btruncate\b/i,
-  /\bdd\b/i,
-  /\bshred\b/i,
-  /(^|[^<])>(?!>)/,
-  />>/,
-  /\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
-  /\byarn\s+(add|remove|install|publish)/i,
-  /\bpnpm\s+(add|remove|install|publish)/i,
-  /\bpip\s+(install|uninstall)/i,
-  /\bapt(-get)?\s+(install|remove|purge|update|upgrade)/i,
-  /\bbrew\s+(install|uninstall|upgrade)/i,
-  /\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-[dD]|stash|cherry-pick|revert|tag|init|clone)/i,
-  /\bsudo\b/i,
-  /\bsu\b/i,
-  /\bkill\b/i,
-  /\bpkill\b/i,
-  /\bkillall\b/i,
-  /\breboot\b/i,
-  /\bshutdown\b/i,
-  /\bsystemctl\s+(start|stop|restart|enable|disable)/i,
-  /\bservice\s+\S+\s+(start|stop|restart)/i,
-  /\b(vim?|nano|emacs|code|subl)\b/i,
-  // Windows equivalents
-  /\bdel\b/i,
-  /\brd\b/i,
-  /\bcopy\b/i,
-  /\bmove\b/i,
-  /\bren\b/i,
-  /\brename\b/i,
-  /\bicacls\b/i,
-  /\battrib\b/i,
-  /\bpowershell\b/i,
-  /\bpwsh\b/i,
-];
-
-// ── Safe read-only bash patterns (allowed in plan mode) ─────────────────────
-const SAFE_PATTERNS = [
-  /^\s*cat\b/,
-  /^\s*head\b/,
-  /^\s*tail\b/,
-  /^\s*less\b/,
-  /^\s*more\b/,
-  /^\s*grep\b/,
-  /^\s*find\b/,
-  /^\s*ls\b/,
-  /^\s*pwd\b/,
-  /^\s*echo\b/,
-  /^\s*printf\b/,
-  /^\s*wc\b/,
-  /^\s*sort\b/,
-  /^\s*uniq\b/,
-  /^\s*diff\b/,
-  /^\s*file\b/,
-  /^\s*stat\b/,
-  /^\s*du\b/,
-  /^\s*df\b/,
-  /^\s*tree\b/,
-  /^\s*which\b/,
-  /^\s*whereis\b/,
-  /^\s*type\b/,
-  /^\s*env\b/,
-  /^\s*printenv\b/,
-  /^\s*uname\b/,
-  /^\s*whoami\b/,
-  /^\s*id\b/,
-  /^\s*date\b/,
-  /^\s*cal\b/,
-  /^\s*uptime\b/,
-  /^\s*ps\b/,
-  /^\s*top\b/,
-  /^\s*htop\b/,
-  /^\s*free\b/,
-  /^\s*git\s+(status|log|diff|show|branch|remote|config\s+--get)/i,
-  /^\s*git\s+ls-/i,
-  /^\s*npm\s+(list|ls|view|info|search|outdated|audit)/i,
-  /^\s*yarn\s+(list|info|why|audit)/i,
-  /^\s*pnpm\s+(list|ls|why|audit|outdated)/i,
-  /^\s*node\s+--version/i,
-  /^\s*python\s+--version/i,
-  /^\s*curl\s/i,
-  /^\s*wget\s+-O\s*-/i,
-  /^\s*jq\b/,
-  /^\s*sed\s+-n/i,
-  /^\s*awk\b/,
-  /^\s*rg\b/,
-  /^\s*fd\b/,
-  /^\s*bat\b/,
-  /^\s*eza\b/,
-  // Windows equivalents
-  /^\s*dir\b/,
-  /^\s*where\b/,
-  /^\s*set\b/,
-  /^\s*systeminfo\b/,
-  /^\s*tasklist\b/,
-];
-
+/**
+ * Check if a command is safe for plan mode.
+ *
+ * Delegates to the shared command sandbox with a custom allow rule
+ * for `mkdir -p .plans/` (planner needs to create plan directories).
+ */
 export function isSafeCommand(command: string): boolean {
-  const isDestructive = DESTRUCTIVE_PATTERNS.some((p) => p.test(command));
-  const isSafe = SAFE_PATTERNS.some((p) => p.test(command));
-  return !isDestructive && isSafe;
+  return baseSafeCommand(command, {
+    allowCommand: (cmd) => isMkdirPlans(cmd) || isCurlWithStderrRedirect(cmd),
+  });
+}
+
+/** Allow mkdir only for .plans/ directory paths. */
+function isMkdirPlans(command: string): boolean {
+  return /^\s*mkdir\s+(-p\s+)?\.plans(\/|\\|\s|$)/.test(command);
+}
+
+/**
+ * Allow curl commands that only redirect stderr to /dev/null.
+ * shell-quote parses `2>/dev/null` as a stdout redirect, but it's
+ * actually a stderr redirect which is safe for read-only mode.
+ */
+function isCurlWithStderrRedirect(command: string): boolean {
+  return (
+    /^\s*curl\b/.test(command) &&
+    /2>\/dev\/null/.test(command) &&
+    !/>(?!\/dev\/null)/.test(command.replace(/2>\/dev\/null/g, ''))
+  );
 }
 
 // ── Plan extraction ─────────────────────────────────────────────────────────

package/node_modules/@dreki-gg/pi-command-sandbox/dist/index.d.mts

@@ -0,0 +1,104 @@
+//#region src/sandbox.d.ts
+/**
+ * Core sandbox logic — determines whether a shell command is safe to execute.
+ */
+interface SandboxOptions {
+  /**
+   * Extra patterns to allow beyond the built-in SAFE_PATTERNS.
+   * Checked against the reconstructed command string for each segment.
+   */
+  extraSafe?: RegExp[];
+  /**
+   * Extra patterns to block beyond the built-in DESTRUCTIVE_PATTERNS.
+   * Checked against the reconstructed command string for each segment.
+   */
+  extraDestructive?: RegExp[];
+  /**
+   * Custom predicate to allow specific full commands before normal checks.
+   * Return `true` to allow the command, `false` to continue with normal checks.
+   */
+  allowCommand?: (command: string) => boolean;
+  /**
+   * Whether to allow stdout redirects (`>`, `>>`).
+   * Default: false (blocked).
+   */
+  allowRedirects?: boolean;
+  /**
+   * Whether to allow command substitution ($(...) and backticks).
+   * Default: false (blocked).
+   */
+  allowCommandSubstitution?: boolean;
+}
+/**
+ * Check if a shell command is safe to execute in a sandboxed mode.
+ *
+ * The command is parsed into segments using shell-quote, and each segment
+ * is checked independently against the destructive and safe pattern lists.
+ * A command is safe only if ALL segments pass.
+ *
+ * For a segment to pass:
+ * 1. It must NOT match any destructive pattern
+ * 2. It MUST match at least one safe pattern
+ * 3. It must NOT contain redirects (unless explicitly allowed)
+ *
+ * Additionally, command substitution ($() and backticks) is blocked by default.
+ */
+declare function isSafeCommand(command: string, options?: SandboxOptions): boolean;
+//#endregion
+//#region src/parser.d.ts
+/**
+ * Shell command parser using shell-quote.
+ *
+ * Splits a full shell command string into individual command segments,
+ * properly handling &&, ||, ;, |, pipes, quotes, and subshells.
+ */
+interface ParsedSegment {
+  /** The reconstructed command string for this segment. */
+  command: string;
+  /** Whether this segment contains a redirect operator. */
+  hasRedirect: boolean;
+}
+/**
+ * Parse a shell command into individual command segments.
+ *
+ * Uses shell-quote to properly tokenize the input, then splits on
+ * command separators (&&, ||, ;, |). Each segment is returned as a
+ * reconstructed command string.
+ *
+ * Subshell grouping operators `(` and `)` are stripped — the inner
+ * commands are still validated individually.
+ *
+ * @example
+ * ```ts
+ * parseCommandSegments('cd foo && ls -la')
+ * // → [{ command: 'cd foo', hasRedirect: false },
+ * //    { command: 'ls -la', hasRedirect: false }]
+ *
+ * parseCommandSegments('echo "hello && world"')
+ * // → [{ command: 'echo "hello && world"', hasRedirect: false }]
+ *
+ * parseCommandSegments('curl -s url 2>/dev/null | head')
+ * // → [{ command: 'curl -s url 2>/dev/null', hasRedirect: false },
+ * //    { command: 'head', hasRedirect: false }]
+ * ```
+ */
+declare function parseCommandSegments(input: string): ParsedSegment[];
+/**
+ * Check if the parsed tokens contain command substitution patterns.
+ *
+ * Command substitution ($(...) or `...`) can hide arbitrary commands
+ * and should be blocked in sandboxed modes.
+ */
+declare function hasCommandSubstitution(input: string): boolean;
+//#endregion
+//#region src/patterns.d.ts
+/**
+ * Destructive and safe command patterns for shell sandboxing.
+ *
+ * DESTRUCTIVE_PATTERNS — if any segment matches, the command is blocked.
+ * SAFE_PATTERNS — a segment must match at least one to be allowed.
+ */
+declare const DESTRUCTIVE_PATTERNS: RegExp[];
+declare const SAFE_PATTERNS: RegExp[];
+//#endregion
+export { DESTRUCTIVE_PATTERNS, type ParsedSegment, SAFE_PATTERNS, type SandboxOptions, hasCommandSubstitution, isSafeCommand, parseCommandSegments };

package/node_modules/@dreki-gg/pi-command-sandbox/dist/index.mjs

@@ -0,0 +1,396 @@
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+//#endregion
+//#region ../../node_modules/shell-quote/quote.js
+var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function quote(xs) {
+		return xs.map(function(s) {
+			if (s === "") return "''";
+			if (s && typeof s === "object") return s.op.replace(/(.)/g, "\\$1");
+			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
+			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+		}).join(" ");
+	};
+}));
+//#endregion
+//#region ../../node_modules/shell-quote/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var CONTROL = "(?:" + [
+		"\\|\\|",
+		"\\&\\&",
+		";;",
+		"\\|\\&",
+		"\\<\\(",
+		"\\<\\<\\<",
+		">>",
+		">\\&",
+		"<\\&",
+		"[&;()|<>]"
+	].join("|") + ")";
+	var controlRE = new RegExp("^" + CONTROL + "$");
+	var META = "|&;()<> \\t";
+	var SINGLE_QUOTE = "\"((\\\\\"|[^\"])*?)\"";
+	var DOUBLE_QUOTE = "'((\\\\'|[^'])*?)'";
+	var hash = /^#$/;
+	var SQ = "'";
+	var DQ = "\"";
+	var DS = "$";
+	var TOKEN = "";
+	var mult = 4294967296;
+	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
+	var startsWithToken = new RegExp("^" + TOKEN);
+	function matchAll(s, r) {
+		var origIndex = r.lastIndex;
+		var matches = [];
+		var matchObj;
+		while (matchObj = r.exec(s)) {
+			matches.push(matchObj);
+			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
+		}
+		r.lastIndex = origIndex;
+		return matches;
+	}
+	function getVar(env, pre, key) {
+		var r = typeof env === "function" ? env(key) : env[key];
+		if (typeof r === "undefined" && key != "") r = "";
+		else if (typeof r === "undefined") r = "$";
+		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
+		return pre + r;
+	}
+	function parseInternal(string, env, opts) {
+		if (!opts) opts = {};
+		var BS = opts.escape || "\\";
+		var BAREWORD = "(\\" + BS + "['\"" + META + "]|[^\\s'\"" + META + "])+";
+		var matches = matchAll(string, new RegExp(["(" + CONTROL + ")", "(" + BAREWORD + "|" + SINGLE_QUOTE + "|" + DOUBLE_QUOTE + ")+"].join("|"), "g"));
+		if (matches.length === 0) return [];
+		if (!env) env = {};
+		var commented = false;
+		return matches.map(function(match) {
+			var s = match[0];
+			if (!s || commented) return;
+			if (controlRE.test(s)) return { op: s };
+			var quote = false;
+			var esc = false;
+			var out = "";
+			var isGlob = false;
+			var i;
+			function parseEnvVar() {
+				i += 1;
+				var varend;
+				var varname;
+				var char = s.charAt(i);
+				if (char === "{") {
+					i += 1;
+					if (s.charAt(i) === "}") throw new Error("Bad substitution: " + s.slice(i - 2, i + 1));
+					varend = s.indexOf("}", i);
+					if (varend < 0) throw new Error("Bad substitution: " + s.slice(i));
+					varname = s.slice(i, varend);
+					i = varend;
+				} else if (/[*@#?$!_-]/.test(char)) {
+					varname = char;
+					i += 1;
+				} else {
+					var slicedFromI = s.slice(i);
+					varend = slicedFromI.match(/[^\w\d_]/);
+					if (!varend) {
+						varname = slicedFromI;
+						i = s.length;
+					} else {
+						varname = slicedFromI.slice(0, varend.index);
+						i += varend.index - 1;
+					}
+				}
+				return getVar(env, "", varname);
+			}
+			for (i = 0; i < s.length; i++) {
+				var c = s.charAt(i);
+				isGlob = isGlob || !quote && (c === "*" || c === "?");
+				if (esc) {
+					out += c;
+					esc = false;
+				} else if (quote) if (c === quote) quote = false;
+				else if (quote == SQ) out += c;
+				else if (c === BS) {
+					i += 1;
+					c = s.charAt(i);
+					if (c === DQ || c === BS || c === DS) out += c;
+					else out += BS + c;
+				} else if (c === DS) out += parseEnvVar();
+				else out += c;
+				else if (c === DQ || c === SQ) quote = c;
+				else if (controlRE.test(c)) return { op: s };
+				else if (hash.test(c)) {
+					commented = true;
+					var commentObj = { comment: string.slice(match.index + i + 1) };
+					if (out.length) return [out, commentObj];
+					return [commentObj];
+				} else if (c === BS) esc = true;
+				else if (c === DS) out += parseEnvVar();
+				else out += c;
+			}
+			if (isGlob) return {
+				op: "glob",
+				pattern: out
+			};
+			return out;
+		}).reduce(function(prev, arg) {
+			return typeof arg === "undefined" ? prev : prev.concat(arg);
+		}, []);
+	}
+	module.exports = function parse(s, env, opts) {
+		var mapped = parseInternal(s, env, opts);
+		if (typeof env !== "function") return mapped;
+		return mapped.reduce(function(acc, s) {
+			if (typeof s === "object") return acc.concat(s);
+			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
+			if (xs.length === 1) return acc.concat(xs[0]);
+			return acc.concat(xs.filter(Boolean).map(function(x) {
+				if (startsWithToken.test(x)) return JSON.parse(x.split(TOKEN)[1]);
+				return x;
+			}));
+		}, []);
+	};
+}));
+//#endregion
+//#region src/parser.ts
+var import_shell_quote = (/* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.quote = require_quote();
+	exports.parse = require_parse();
+})))();
+/** Operators that separate independent commands. */
+const COMMAND_SEPARATORS = new Set([
+	"&&",
+	"||",
+	";",
+	"|"
+]);
+/** Operators that indicate potentially dangerous constructs. */
+const DANGEROUS_OPS = new Set([">", ">>"]);
+/** Grouping operators (subshells) — we strip them and validate inner commands. */
+const GROUPING_OPS = new Set(["(", ")"]);
+/**
+* Parse a shell command into individual command segments.
+*
+* Uses shell-quote to properly tokenize the input, then splits on
+* command separators (&&, ||, ;, |). Each segment is returned as a
+* reconstructed command string.
+*
+* Subshell grouping operators `(` and `)` are stripped — the inner
+* commands are still validated individually.
+*
+* @example
+* ```ts
+* parseCommandSegments('cd foo && ls -la')
+* // → [{ command: 'cd foo', hasRedirect: false },
+* //    { command: 'ls -la', hasRedirect: false }]
+*
+* parseCommandSegments('echo "hello && world"')
+* // → [{ command: 'echo "hello && world"', hasRedirect: false }]
+*
+* parseCommandSegments('curl -s url 2>/dev/null | head')
+* // → [{ command: 'curl -s url 2>/dev/null', hasRedirect: false },
+* //    { command: 'head', hasRedirect: false }]
+* ```
+*/
+function parseCommandSegments(input) {
+	const tokens = (0, import_shell_quote.parse)(input);
+	const segments = [];
+	let currentTokens = [];
+	let hasRedirect = false;
+	function flushSegment() {
+		if (currentTokens.length > 0) {
+			segments.push({
+				command: currentTokens.join(" "),
+				hasRedirect
+			});
+			currentTokens = [];
+			hasRedirect = false;
+		}
+	}
+	for (const token of tokens) {
+		if (typeof token === "string") {
+			currentTokens.push(token);
+			continue;
+		}
+		if (!("op" in token)) {
+			currentTokens.push(String(token));
+			continue;
+		}
+		const { op } = token;
+		if (COMMAND_SEPARATORS.has(op)) {
+			flushSegment();
+			continue;
+		}
+		if (DANGEROUS_OPS.has(op)) {
+			hasRedirect = true;
+			currentTokens.push(op);
+			continue;
+		}
+		if (GROUPING_OPS.has(op)) continue;
+		currentTokens.push(op);
+	}
+	flushSegment();
+	return segments;
+}
+/**
+* Check if the parsed tokens contain command substitution patterns.
+*
+* Command substitution ($(...) or `...`) can hide arbitrary commands
+* and should be blocked in sandboxed modes.
+*/
+function hasCommandSubstitution(input) {
+	return /\$\(/.test(input) || /`[^`]+`/.test(input);
+}
+//#endregion
+//#region src/patterns.ts
+/**
+* Destructive and safe command patterns for shell sandboxing.
+*
+* DESTRUCTIVE_PATTERNS — if any segment matches, the command is blocked.
+* SAFE_PATTERNS — a segment must match at least one to be allowed.
+*/
+const DESTRUCTIVE_PATTERNS = [
+	/\brm\b/i,
+	/\brmdir\b/i,
+	/\bmv\b/i,
+	/\bcp\b/i,
+	/\bmkdir\b/i,
+	/\btouch\b/i,
+	/\bchmod\b/i,
+	/\bchown\b/i,
+	/\bchgrp\b/i,
+	/\bln\b/i,
+	/\btee\b/i,
+	/\btruncate\b/i,
+	/\bdd\b/i,
+	/\bshred\b/i,
+	/\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
+	/\byarn\s+(add|remove|install|publish)/i,
+	/\bpnpm\s+(add|remove|install|publish)/i,
+	/\bpip\s+(install|uninstall)/i,
+	/\bapt(-get)?\s+(install|remove|purge|update|upgrade)/i,
+	/\bbrew\s+(install|uninstall|upgrade)/i,
+	/\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-[dD]|stash|cherry-pick|revert|tag|init|clone)/i,
+	/\bsudo\b/i,
+	/\bsu\b/i,
+	/\bkill\b/i,
+	/\bpkill\b/i,
+	/\bkillall\b/i,
+	/\breboot\b/i,
+	/\bshutdown\b/i,
+	/\bsystemctl\s+(start|stop|restart|enable|disable)/i,
+	/\bservice\s+\S+\s+(start|stop|restart)/i,
+	/\b(vim?|nano|emacs|code|subl)\b/i,
+	/\bdel\b/i,
+	/\brd\b/i,
+	/\bcopy\b/i,
+	/\bmove\b/i,
+	/\bren\b/i,
+	/\brename\b/i,
+	/\bicacls\b/i,
+	/\battrib\b/i,
+	/\bpowershell\b/i,
+	/\bpwsh\b/i
+];
+const SAFE_PATTERNS = [
+	/^\s*cat\b/,
+	/^\s*head\b/,
+	/^\s*tail\b/,
+	/^\s*less\b/,
+	/^\s*more\b/,
+	/^\s*grep\b/,
+	/^\s*find\b/,
+	/^\s*ls\b/,
+	/^\s*pwd\b/,
+	/^\s*echo\b/,
+	/^\s*printf\b/,
+	/^\s*wc\b/,
+	/^\s*sort\b/,
+	/^\s*uniq\b/,
+	/^\s*diff\b/,
+	/^\s*file\b/,
+	/^\s*stat\b/,
+	/^\s*du\b/,
+	/^\s*df\b/,
+	/^\s*tree\b/,
+	/^\s*which\b/,
+	/^\s*whereis\b/,
+	/^\s*type\b/,
+	/^\s*env\b/,
+	/^\s*printenv\b/,
+	/^\s*uname\b/,
+	/^\s*whoami\b/,
+	/^\s*id\b/,
+	/^\s*date\b/,
+	/^\s*cal\b/,
+	/^\s*uptime\b/,
+	/^\s*ps\b/,
+	/^\s*top\b/,
+	/^\s*htop\b/,
+	/^\s*free\b/,
+	/^\s*cd\b/,
+	/^\s*git\s+(status|log|diff|show|branch|remote|config\s+--get)/i,
+	/^\s*git\s+ls-/i,
+	/^\s*npm\s+(list|ls|view|info|search|outdated|audit)/i,
+	/^\s*yarn\s+(list|info|why|audit)/i,
+	/^\s*pnpm\s+(list|ls|why|audit|outdated)/i,
+	/^\s*bun\s+(pm\s+ls)/i,
+	/^\s*node\s+--version/i,
+	/^\s*python\s+--version/i,
+	/^\s*curl\s/i,
+	/^\s*wget\s+-O\s*-/i,
+	/^\s*jq\b/,
+	/^\s*sed\s+-n/i,
+	/^\s*awk\b/,
+	/^\s*rg\b/,
+	/^\s*fd\b/,
+	/^\s*bat\b/,
+	/^\s*eza\b/,
+	/^\s*basename\b/,
+	/^\s*dirname\b/,
+	/^\s*realpath\b/,
+	/^\s*readlink\b/,
+	/^\s*dir\b/,
+	/^\s*where\b/,
+	/^\s*set\b/,
+	/^\s*systeminfo\b/,
+	/^\s*tasklist\b/
+];
+//#endregion
+//#region src/sandbox.ts
+/**
+* Core sandbox logic — determines whether a shell command is safe to execute.
+*/
+/**
+* Check if a shell command is safe to execute in a sandboxed mode.
+*
+* The command is parsed into segments using shell-quote, and each segment
+* is checked independently against the destructive and safe pattern lists.
+* A command is safe only if ALL segments pass.
+*
+* For a segment to pass:
+* 1. It must NOT match any destructive pattern
+* 2. It MUST match at least one safe pattern
+* 3. It must NOT contain redirects (unless explicitly allowed)
+*
+* Additionally, command substitution ($() and backticks) is blocked by default.
+*/
+function isSafeCommand(command, options = {}) {
+	const { extraSafe = [], extraDestructive = [], allowCommand, allowRedirects = false, allowCommandSubstitution = false } = options;
+	if (allowCommand?.(command)) return true;
+	if (!allowCommandSubstitution && hasCommandSubstitution(command)) return false;
+	const allDestructive = [...DESTRUCTIVE_PATTERNS, ...extraDestructive];
+	const allSafe = [...SAFE_PATTERNS, ...extraSafe];
+	const segments = parseCommandSegments(command);
+	if (segments.length === 0) return false;
+	return segments.every((segment) => {
+		if (!allowRedirects && segment.hasRedirect) return false;
+		const cmd = segment.command;
+		const isDestructive = allDestructive.some((p) => p.test(cmd));
+		const isSafe = allSafe.some((p) => p.test(cmd));
+		return !isDestructive && isSafe;
+	});
+}
+//#endregion
+export { DESTRUCTIVE_PATTERNS, SAFE_PATTERNS, hasCommandSubstitution, isSafeCommand, parseCommandSegments };

package/node_modules/@dreki-gg/pi-command-sandbox/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@dreki-gg/pi-command-sandbox",
+  "private": true,
+  "version": "0.1.0",
+  "description": "Shared command sandboxing utilities for pi extensions — validates shell commands against safe/destructive pattern lists using proper shell parsing",
+  "author": "Juan Albarran <jalbarrandev@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dreki-gg/pi-extensions",
+    "directory": "packages/command-sandbox"
+  },
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "types": "./dist/index.d.mts"
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsdown",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint src",
+    "format": "oxfmt --write src",
+    "format:check": "oxfmt --check src"
+  },
+  "dependencies": {
+    "shell-quote": "^1.8.3"
+  },
+  "devDependencies": {
+    "@types/node": "24",
+    "@types/shell-quote": "^1.7.5",
+    "bun-types": "latest",
+    "oxfmt": "^0.43.0",
+    "oxlint": "^1.58.0",
+    "tsdown": "^0.22.0",
+    "typescript": "^6.0.0"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreki-gg/pi-plan-mode",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Two-phase planning workflow for pi — plan with claude-opus-4-6:medium, execute with gpt-5.5:low, with .plans/ file-based handoff",
   "keywords": [
     "pi-package"
@@ -24,6 +24,8 @@
     "package.json"
   ],
   "scripts": {
+    "prepack": "node --experimental-strip-types scripts/prepack.js",
+    "postpack": "rm -rf node_modules/@dreki-gg",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint extensions bin",
     "format": "oxfmt --write extensions bin",
@@ -34,6 +36,12 @@
       "./extensions/plan-mode"
     ]
   },
+  "bundledDependencies": [
+    "@dreki-gg/pi-command-sandbox"
+  ],
+  "dependencies": {
+    "@dreki-gg/pi-command-sandbox": "workspace:*"
+  },
   "devDependencies": {
     "@types/node": "24",
     "bun-types": "latest",