@dreki-gg/pi-plan-mode 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @dreki-gg/pi-plan-mode
 
+## 0.6.1
+
+### Patch Changes
+
+- [`d95dad2`](https://github.com/dreki-gg/pi-extensions/commit/d95dad2ac85c4e5428252ee691152a0db83a0ced) Thanks [@jalbarrang](https://github.com/jalbarrang)! - fix(plan-mode): replace Bun-specific APIs with Node.js `fs/promises`
+
+  `pi` runs under Node.js (`#!/usr/bin/env node`), so `Bun.file()` and `Bun.write()` are unavailable at runtime. Replaced all usages with `readFile` and `writeFile` from `node:fs/promises`, which work in both runtimes.
+
+## 0.6.0
+
+### Minor Changes
+
+- [`2a08c1d`](https://github.com/dreki-gg/pi-extensions/commit/2a08c1d0b10a1ca74dfab74f93dd200570537e0f) Thanks [@jalbarrang](https://github.com/jalbarrang)! - feat(ask-mode, plan-mode): support concatenated shell commands in sandbox validation
+
+  Commands using `&&`, `||`, and `;` operators are now parsed and validated per-segment instead of being blocked outright. Uses `shell-quote` for proper shell tokenization that respects quoted strings, subshells, and redirects.
+
+  Previously, safe commands like `cd src && ls -la` or `git status && git log` were incorrectly blocked because the sandbox only split on pipes (`|`). Now each segment is validated independently against the safe/destructive pattern lists.
+
+  Also adds `cd`, `basename`, `dirname`, `realpath`, `readlink`, and `bun pm ls` to the safe commands list, and blocks command substitution (`$(...)` and backticks) by default.
+
+  Shared sandbox logic extracted to private `@dreki-gg/pi-command-sandbox` package (bundled into published tarballs via `bundledDependencies`).
+
 ## 0.5.1
 
 ### Patch Changes

package/extensions/plan-mode/index.ts

@@ -22,13 +22,8 @@ import type { AgentMessage } from '@earendil-works/pi-agent-core';
 import type { AssistantMessage, TextContent } from '@earendil-works/pi-ai';
 import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
 import { Key } from '@earendil-works/pi-tui';
-import { mkdir } from 'node:fs/promises';
-import {
-  extractTodoItems,
-  isSafeCommand,
-  markCompletedSteps,
-  type TodoItem,
-} from './utils.js';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { extractTodoItems, isSafeCommand, markCompletedSteps, type TodoItem } from './utils.js';
 import {
   extractPlanTitle,
   readPlansJson,
@@ -125,7 +120,7 @@ export default function planMode(pi: ExtensionAPI): void {
 
     await mkdir('.plans', { recursive: true });
     const content = serializePlansJson(manifest);
-    await Bun.write('.plans/plans.json', content);
+    await writeFile('.plans/plans.json', content, 'utf-8');
   }
 
   // ── UI updates ────────────────────────────────────────────────────────────
@@ -253,9 +248,7 @@ export default function planMode(pi: ExtensionAPI): void {
         ctx.ui.notify('No plan yet. Use /plan to start planning.', 'info');
         return;
       }
-      const list = todos
-        .map((t, i) => `${i + 1}. ${t.completed ? '✓' : '○'} ${t.text}`)
-        .join('\n');
+      const list = todos.map((t, i) => `${i + 1}. ${t.completed ? '✓' : '○'} ${t.text}`).join('\n');
       ctx.ui.notify(`Plan Progress:\n${list}`, 'info');
     },
   });
@@ -419,7 +412,7 @@ Execute each step in order. You MUST include [DONE:n] in your response after com
       let title = 'Untitled plan';
       if (path.endsWith('PLAN.md')) {
         try {
-          const content = await Bun.file(path).text();
+          const content = await readFile(path, 'utf-8');
           title = extractPlanTitle(content);
         } catch {
           // Fall through
@@ -430,7 +423,7 @@ Execute each step in order. You MUST include [DONE:n] in your response after com
     } else if (match && planDir && path.endsWith('PLAN.md')) {
       // planDir already set but PLAN.md just written — update title
       try {
-        const content = await Bun.file(path).text();
+        const content = await readFile(path, 'utf-8');
         const title = extractPlanTitle(content);
         await updatePlansManifest(match[1], 'in-progress', title);
       } catch {
@@ -496,7 +489,7 @@ Execute each step in order. You MUST include [DONE:n] in your response after com
       // Read the plan to extract todos
       let planContent = '';
       try {
-        planContent = await Bun.file(planMdPath).text();
+        planContent = await readFile(planMdPath, 'utf-8');
       } catch {
         // Fall through — will use empty plan content
       }
@@ -509,7 +502,7 @@ Execute each step in order. You MUST include [DONE:n] in your response after com
       // Read the start prompt for clean handoff
       let startPrompt = '';
       try {
-        startPrompt = (await Bun.file(startPromptPath).text()).trim();
+        startPrompt = (await readFile(startPromptPath, 'utf-8')).trim();
       } catch {
         // Fall through
       }

package/extensions/plan-mode/plans-json.ts

@@ -23,17 +23,16 @@ export interface PlanEntry {
 
 export type PlansManifest = Record<string, PlanEntry>;
 
+import { readFile } from 'node:fs/promises';
+
 const PLANS_JSON = '.plans/plans.json';
 
 /** Read plans.json, returning current manifest (empty object if missing). */
 export async function readPlansJson(): Promise<PlansManifest> {
   try {
-    const file = Bun.file(PLANS_JSON);
-    if (await file.exists()) {
-      const text = await file.text();
-      if (text.trim()) {
-        return JSON.parse(text) as PlansManifest;
-      }
+    const text = await readFile(PLANS_JSON, 'utf-8');
+    if (text.trim()) {
+      return JSON.parse(text) as PlansManifest;
     }
   } catch {
     // File doesn't exist or isn't valid JSON

package/extensions/plan-mode/utils.ts

@@ -1,187 +1,45 @@
 /**
  * Pure utility functions for plan mode.
+ *
+ * Command sandboxing is delegated to @dreki-gg/pi-command-sandbox.
  */
 
+import { isSafeCommand as baseSafeCommand } from '@dreki-gg/pi-command-sandbox';
+
 export interface TodoItem {
   step: number;
   text: string;
   completed: boolean;
 }
 
-// ── Destructive bash patterns (blocked in plan mode) ────────────────────────
-const DESTRUCTIVE_PATTERNS = [
-  /\brm\b/i,
-  /\brmdir\b/i,
-  /\bmv\b/i,
-  /\bcp\b/i,
-  /\bmkdir\b/i,
-  /\btouch\b/i,
-  /\bchmod\b/i,
-  /\bchown\b/i,
-  /\bchgrp\b/i,
-  /\bln\b/i,
-  /\btee\b/i,
-  /\btruncate\b/i,
-  /\bdd\b/i,
-  /\bshred\b/i,
-  // stdout redirect — but NOT stderr redirects like 2>/dev/null or 2>&1
-  /(?<!\d)>(?!>|&)/,
-  />>/,
-  /\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
-  /\byarn\s+(add|remove|install|publish)/i,
-  /\bpnpm\s+(add|remove|install|publish)/i,
-  /\bpip\s+(install|uninstall)/i,
-  /\bapt(-get)?\s+(install|remove|purge|update|upgrade)/i,
-  /\bbrew\s+(install|uninstall|upgrade)/i,
-  /\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-[dD]|stash|cherry-pick|revert|tag|init|clone)/i,
-  /\bsudo\b/i,
-  /\bsu\b/i,
-  /\bkill\b/i,
-  /\bpkill\b/i,
-  /\bkillall\b/i,
-  /\breboot\b/i,
-  /\bshutdown\b/i,
-  /\bsystemctl\s+(start|stop|restart|enable|disable)/i,
-  /\bservice\s+\S+\s+(start|stop|restart)/i,
-  /\b(vim?|nano|emacs|code|subl)\b/i,
-  // Windows equivalents
-  /\bdel\b/i,
-  /\brd\b/i,
-  /\bcopy\b/i,
-  /\bmove\b/i,
-  /\bren\b/i,
-  /\brename\b/i,
-  /\bicacls\b/i,
-  /\battrib\b/i,
-  /\bpowershell\b/i,
-  /\bpwsh\b/i,
-];
-
-// ── Safe read-only bash patterns (allowed in plan mode) ─────────────────────
-const SAFE_PATTERNS = [
-  /^\s*cat\b/,
-  /^\s*head\b/,
-  /^\s*tail\b/,
-  /^\s*less\b/,
-  /^\s*more\b/,
-  /^\s*grep\b/,
-  /^\s*find\b/,
-  /^\s*ls\b/,
-  /^\s*pwd\b/,
-  /^\s*echo\b/,
-  /^\s*printf\b/,
-  /^\s*wc\b/,
-  /^\s*sort\b/,
-  /^\s*uniq\b/,
-  /^\s*diff\b/,
-  /^\s*file\b/,
-  /^\s*stat\b/,
-  /^\s*du\b/,
-  /^\s*df\b/,
-  /^\s*tree\b/,
-  /^\s*which\b/,
-  /^\s*whereis\b/,
-  /^\s*type\b/,
-  /^\s*env\b/,
-  /^\s*printenv\b/,
-  /^\s*uname\b/,
-  /^\s*whoami\b/,
-  /^\s*id\b/,
-  /^\s*date\b/,
-  /^\s*cal\b/,
-  /^\s*uptime\b/,
-  /^\s*ps\b/,
-  /^\s*top\b/,
-  /^\s*htop\b/,
-  /^\s*free\b/,
-  /^\s*git\s+(status|log|diff|show|branch|remote|config\s+--get)/i,
-  /^\s*git\s+ls-/i,
-  /^\s*npm\s+(list|ls|view|info|search|outdated|audit)/i,
-  /^\s*yarn\s+(list|info|why|audit)/i,
-  /^\s*pnpm\s+(list|ls|why|audit|outdated)/i,
-  /^\s*node\s+--version/i,
-  /^\s*python\s+--version/i,
-  /^\s*curl\s/i,
-  /^\s*wget\s+-O\s*-/i,
-  /^\s*jq\b/,
-  /^\s*sed\s+-n/i,
-  /^\s*awk\b/,
-  /^\s*rg\b/,
-  /^\s*fd\b/,
-  /^\s*bat\b/,
-  /^\s*eza\b/,
-  // Windows equivalents
-  /^\s*dir\b/,
-  /^\s*where\b/,
-  /^\s*set\b/,
-  /^\s*systeminfo\b/,
-  /^\s*tasklist\b/,
-];
-
 /**
  * Check if a command is safe for plan mode.
  *
- * For simple commands, checks that the command starts with a safe pattern and
- * doesn't contain destructive patterns. For piped commands, each segment is
- * checked individually. Special exceptions allow `mkdir -p` for `.plans/` paths.
+ * Delegates to the shared command sandbox with a custom allow rule
+ * for `mkdir -p .plans/` (planner needs to create plan directories).
  */
 export function isSafeCommand(command: string): boolean {
-  // Special case: allow mkdir for .plans/ directory (planner needs this)
-  if (/^\s*mkdir\s+(-p\s+)?\.plans(\/|\\|\s|$)/.test(command)) {
-    return true;
-  }
-
-  // Split piped commands and check each segment independently
-  const segments = splitPipeSegments(command);
-  return segments.every((seg) => {
-    const trimmed = seg.trim();
-    const isDestructive = DESTRUCTIVE_PATTERNS.some((p) => p.test(trimmed));
-    const isSafe = SAFE_PATTERNS.some((p) => p.test(trimmed));
-    return !isDestructive && isSafe;
+  return baseSafeCommand(command, {
+    allowCommand: (cmd) => isMkdirPlans(cmd) || isCurlWithStderrRedirect(cmd),
   });
 }
 
+/** Allow mkdir only for .plans/ directory paths. */
+function isMkdirPlans(command: string): boolean {
+  return /^\s*mkdir\s+(-p\s+)?\.plans(\/|\\|\s|$)/.test(command);
+}
+
 /**
- * Split a command on unquoted pipe (`|`) characters.
- * Respects single/double quotes and escaped characters.
+ * Allow curl commands that only redirect stderr to /dev/null.
+ * shell-quote parses `2>/dev/null` as a stdout redirect, but it's
+ * actually a stderr redirect which is safe for read-only mode.
  */
-function splitPipeSegments(command: string): string[] {
-  const segments: string[] = [];
-  let current = '';
-  let inSingle = false;
-  let inDouble = false;
-  let escaped = false;
-
-  for (const ch of command) {
-    if (escaped) {
-      current += ch;
-      escaped = false;
-      continue;
-    }
-    if (ch === '\\') {
-      current += ch;
-      escaped = true;
-      continue;
-    }
-    if (ch === "'" && !inDouble) {
-      inSingle = !inSingle;
-      current += ch;
-      continue;
-    }
-    if (ch === '"' && !inSingle) {
-      inDouble = !inDouble;
-      current += ch;
-      continue;
-    }
-    if (ch === '|' && !inSingle && !inDouble) {
-      segments.push(current);
-      current = '';
-      continue;
-    }
-    current += ch;
-  }
-  if (current) segments.push(current);
-  return segments;
+function isCurlWithStderrRedirect(command: string): boolean {
+  return (
+    /^\s*curl\b/.test(command) &&
+    /2>\/dev\/null/.test(command) &&
+    !/>(?!\/dev\/null)/.test(command.replace(/2>\/dev\/null/g, ''))
+  );
 }
 
 // ── Plan extraction ─────────────────────────────────────────────────────────

package/node_modules/@dreki-gg/pi-command-sandbox/dist/index.d.mts

@@ -0,0 +1,104 @@
+//#region src/sandbox.d.ts
+/**
+ * Core sandbox logic — determines whether a shell command is safe to execute.
+ */
+interface SandboxOptions {
+  /**
+   * Extra patterns to allow beyond the built-in SAFE_PATTERNS.
+   * Checked against the reconstructed command string for each segment.
+   */
+  extraSafe?: RegExp[];
+  /**
+   * Extra patterns to block beyond the built-in DESTRUCTIVE_PATTERNS.
+   * Checked against the reconstructed command string for each segment.
+   */
+  extraDestructive?: RegExp[];
+  /**
+   * Custom predicate to allow specific full commands before normal checks.
+   * Return `true` to allow the command, `false` to continue with normal checks.
+   */
+  allowCommand?: (command: string) => boolean;
+  /**
+   * Whether to allow stdout redirects (`>`, `>>`).
+   * Default: false (blocked).
+   */
+  allowRedirects?: boolean;
+  /**
+   * Whether to allow command substitution ($(...) and backticks).
+   * Default: false (blocked).
+   */
+  allowCommandSubstitution?: boolean;
+}
+/**
+ * Check if a shell command is safe to execute in a sandboxed mode.
+ *
+ * The command is parsed into segments using shell-quote, and each segment
+ * is checked independently against the destructive and safe pattern lists.
+ * A command is safe only if ALL segments pass.
+ *
+ * For a segment to pass:
+ * 1. It must NOT match any destructive pattern
+ * 2. It MUST match at least one safe pattern
+ * 3. It must NOT contain redirects (unless explicitly allowed)
+ *
+ * Additionally, command substitution ($() and backticks) is blocked by default.
+ */
+declare function isSafeCommand(command: string, options?: SandboxOptions): boolean;
+//#endregion
+//#region src/parser.d.ts
+/**
+ * Shell command parser using shell-quote.
+ *
+ * Splits a full shell command string into individual command segments,
+ * properly handling &&, ||, ;, |, pipes, quotes, and subshells.
+ */
+interface ParsedSegment {
+  /** The reconstructed command string for this segment. */
+  command: string;
+  /** Whether this segment contains a redirect operator. */
+  hasRedirect: boolean;
+}
+/**
+ * Parse a shell command into individual command segments.
+ *
+ * Uses shell-quote to properly tokenize the input, then splits on
+ * command separators (&&, ||, ;, |). Each segment is returned as a
+ * reconstructed command string.
+ *
+ * Subshell grouping operators `(` and `)` are stripped — the inner
+ * commands are still validated individually.
+ *
+ * @example
+ * ```ts
+ * parseCommandSegments('cd foo && ls -la')
+ * // → [{ command: 'cd foo', hasRedirect: false },
+ * //    { command: 'ls -la', hasRedirect: false }]
+ *
+ * parseCommandSegments('echo "hello && world"')
+ * // → [{ command: 'echo "hello && world"', hasRedirect: false }]
+ *
+ * parseCommandSegments('curl -s url 2>/dev/null | head')
+ * // → [{ command: 'curl -s url 2>/dev/null', hasRedirect: false },
+ * //    { command: 'head', hasRedirect: false }]
+ * ```
+ */
+declare function parseCommandSegments(input: string): ParsedSegment[];
+/**
+ * Check if the parsed tokens contain command substitution patterns.
+ *
+ * Command substitution ($(...) or `...`) can hide arbitrary commands
+ * and should be blocked in sandboxed modes.
+ */
+declare function hasCommandSubstitution(input: string): boolean;
+//#endregion
+//#region src/patterns.d.ts
+/**
+ * Destructive and safe command patterns for shell sandboxing.
+ *
+ * DESTRUCTIVE_PATTERNS — if any segment matches, the command is blocked.
+ * SAFE_PATTERNS — a segment must match at least one to be allowed.
+ */
+declare const DESTRUCTIVE_PATTERNS: RegExp[];
+declare const SAFE_PATTERNS: RegExp[];
+//#endregion
+export { DESTRUCTIVE_PATTERNS, type ParsedSegment, SAFE_PATTERNS, type SandboxOptions, hasCommandSubstitution, isSafeCommand, parseCommandSegments };

package/node_modules/@dreki-gg/pi-command-sandbox/dist/index.mjs

@@ -0,0 +1,396 @@
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+//#endregion
+//#region ../../node_modules/shell-quote/quote.js
+var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function quote(xs) {
+		return xs.map(function(s) {
+			if (s === "") return "''";
+			if (s && typeof s === "object") return s.op.replace(/(.)/g, "\\$1");
+			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
+			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+		}).join(" ");
+	};
+}));
+//#endregion
+//#region ../../node_modules/shell-quote/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var CONTROL = "(?:" + [
+		"\\|\\|",
+		"\\&\\&",
+		";;",
+		"\\|\\&",
+		"\\<\\(",
+		"\\<\\<\\<",
+		">>",
+		">\\&",
+		"<\\&",
+		"[&;()|<>]"
+	].join("|") + ")";
+	var controlRE = new RegExp("^" + CONTROL + "$");
+	var META = "|&;()<> \\t";
+	var SINGLE_QUOTE = "\"((\\\\\"|[^\"])*?)\"";
+	var DOUBLE_QUOTE = "'((\\\\'|[^'])*?)'";
+	var hash = /^#$/;
+	var SQ = "'";
+	var DQ = "\"";
+	var DS = "$";
+	var TOKEN = "";
+	var mult = 4294967296;
+	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
+	var startsWithToken = new RegExp("^" + TOKEN);
+	function matchAll(s, r) {
+		var origIndex = r.lastIndex;
+		var matches = [];
+		var matchObj;
+		while (matchObj = r.exec(s)) {
+			matches.push(matchObj);
+			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
+		}
+		r.lastIndex = origIndex;
+		return matches;
+	}
+	function getVar(env, pre, key) {
+		var r = typeof env === "function" ? env(key) : env[key];
+		if (typeof r === "undefined" && key != "") r = "";
+		else if (typeof r === "undefined") r = "$";
+		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
+		return pre + r;
+	}
+	function parseInternal(string, env, opts) {
+		if (!opts) opts = {};
+		var BS = opts.escape || "\\";
+		var BAREWORD = "(\\" + BS + "['\"" + META + "]|[^\\s'\"" + META + "])+";
+		var matches = matchAll(string, new RegExp(["(" + CONTROL + ")", "(" + BAREWORD + "|" + SINGLE_QUOTE + "|" + DOUBLE_QUOTE + ")+"].join("|"), "g"));
+		if (matches.length === 0) return [];
+		if (!env) env = {};
+		var commented = false;
+		return matches.map(function(match) {
+			var s = match[0];
+			if (!s || commented) return;
+			if (controlRE.test(s)) return { op: s };
+			var quote = false;
+			var esc = false;
+			var out = "";
+			var isGlob = false;
+			var i;
+			function parseEnvVar() {
+				i += 1;
+				var varend;
+				var varname;
+				var char = s.charAt(i);
+				if (char === "{") {
+					i += 1;
+					if (s.charAt(i) === "}") throw new Error("Bad substitution: " + s.slice(i - 2, i + 1));
+					varend = s.indexOf("}", i);
+					if (varend < 0) throw new Error("Bad substitution: " + s.slice(i));
+					varname = s.slice(i, varend);
+					i = varend;
+				} else if (/[*@#?$!_-]/.test(char)) {
+					varname = char;
+					i += 1;
+				} else {
+					var slicedFromI = s.slice(i);
+					varend = slicedFromI.match(/[^\w\d_]/);
+					if (!varend) {
+						varname = slicedFromI;
+						i = s.length;
+					} else {
+						varname = slicedFromI.slice(0, varend.index);
+						i += varend.index - 1;
+					}
+				}
+				return getVar(env, "", varname);
+			}
+			for (i = 0; i < s.length; i++) {
+				var c = s.charAt(i);
+				isGlob = isGlob || !quote && (c === "*" || c === "?");
+				if (esc) {
+					out += c;
+					esc = false;
+				} else if (quote) if (c === quote) quote = false;
+				else if (quote == SQ) out += c;
+				else if (c === BS) {
+					i += 1;
+					c = s.charAt(i);
+					if (c === DQ || c === BS || c === DS) out += c;
+					else out += BS + c;
+				} else if (c === DS) out += parseEnvVar();
+				else out += c;
+				else if (c === DQ || c === SQ) quote = c;
+				else if (controlRE.test(c)) return { op: s };
+				else if (hash.test(c)) {
+					commented = true;
+					var commentObj = { comment: string.slice(match.index + i + 1) };
+					if (out.length) return [out, commentObj];
+					return [commentObj];
+				} else if (c === BS) esc = true;
+				else if (c === DS) out += parseEnvVar();
+				else out += c;
+			}
+			if (isGlob) return {
+				op: "glob",
+				pattern: out
+			};
+			return out;
+		}).reduce(function(prev, arg) {
+			return typeof arg === "undefined" ? prev : prev.concat(arg);
+		}, []);
+	}
+	module.exports = function parse(s, env, opts) {
+		var mapped = parseInternal(s, env, opts);
+		if (typeof env !== "function") return mapped;
+		return mapped.reduce(function(acc, s) {
+			if (typeof s === "object") return acc.concat(s);
+			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
+			if (xs.length === 1) return acc.concat(xs[0]);
+			return acc.concat(xs.filter(Boolean).map(function(x) {
+				if (startsWithToken.test(x)) return JSON.parse(x.split(TOKEN)[1]);
+				return x;
+			}));
+		}, []);
+	};
+}));
+//#endregion
+//#region src/parser.ts
+var import_shell_quote = (/* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.quote = require_quote();
+	exports.parse = require_parse();
+})))();
+/** Operators that separate independent commands. */
+const COMMAND_SEPARATORS = new Set([
+	"&&",
+	"||",
+	";",
+	"|"
+]);
+/** Operators that indicate potentially dangerous constructs. */
+const DANGEROUS_OPS = new Set([">", ">>"]);
+/** Grouping operators (subshells) — we strip them and validate inner commands. */
+const GROUPING_OPS = new Set(["(", ")"]);
+/**
+* Parse a shell command into individual command segments.
+*
+* Uses shell-quote to properly tokenize the input, then splits on
+* command separators (&&, ||, ;, |). Each segment is returned as a
+* reconstructed command string.
+*
+* Subshell grouping operators `(` and `)` are stripped — the inner
+* commands are still validated individually.
+*
+* @example
+* ```ts
+* parseCommandSegments('cd foo && ls -la')
+* // → [{ command: 'cd foo', hasRedirect: false },
+* //    { command: 'ls -la', hasRedirect: false }]
+*
+* parseCommandSegments('echo "hello && world"')
+* // → [{ command: 'echo "hello && world"', hasRedirect: false }]
+*
+* parseCommandSegments('curl -s url 2>/dev/null | head')
+* // → [{ command: 'curl -s url 2>/dev/null', hasRedirect: false },
+* //    { command: 'head', hasRedirect: false }]
+* ```
+*/
+function parseCommandSegments(input) {
+	const tokens = (0, import_shell_quote.parse)(input);
+	const segments = [];
+	let currentTokens = [];
+	let hasRedirect = false;
+	function flushSegment() {
+		if (currentTokens.length > 0) {
+			segments.push({
+				command: currentTokens.join(" "),
+				hasRedirect
+			});
+			currentTokens = [];
+			hasRedirect = false;
+		}
+	}
+	for (const token of tokens) {
+		if (typeof token === "string") {
+			currentTokens.push(token);
+			continue;
+		}
+		if (!("op" in token)) {
+			currentTokens.push(String(token));
+			continue;
+		}
+		const { op } = token;
+		if (COMMAND_SEPARATORS.has(op)) {
+			flushSegment();
+			continue;
+		}
+		if (DANGEROUS_OPS.has(op)) {
+			hasRedirect = true;
+			currentTokens.push(op);
+			continue;
+		}
+		if (GROUPING_OPS.has(op)) continue;
+		currentTokens.push(op);
+	}
+	flushSegment();
+	return segments;
+}
+/**
+* Check if the parsed tokens contain command substitution patterns.
+*
+* Command substitution ($(...) or `...`) can hide arbitrary commands
+* and should be blocked in sandboxed modes.
+*/
+function hasCommandSubstitution(input) {
+	return /\$\(/.test(input) || /`[^`]+`/.test(input);
+}
+//#endregion
+//#region src/patterns.ts
+/**
+* Destructive and safe command patterns for shell sandboxing.
+*
+* DESTRUCTIVE_PATTERNS — if any segment matches, the command is blocked.
+* SAFE_PATTERNS — a segment must match at least one to be allowed.
+*/
+const DESTRUCTIVE_PATTERNS = [
+	/\brm\b/i,
+	/\brmdir\b/i,
+	/\bmv\b/i,
+	/\bcp\b/i,
+	/\bmkdir\b/i,
+	/\btouch\b/i,
+	/\bchmod\b/i,
+	/\bchown\b/i,
+	/\bchgrp\b/i,
+	/\bln\b/i,
+	/\btee\b/i,
+	/\btruncate\b/i,
+	/\bdd\b/i,
+	/\bshred\b/i,
+	/\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
+	/\byarn\s+(add|remove|install|publish)/i,
+	/\bpnpm\s+(add|remove|install|publish)/i,
+	/\bpip\s+(install|uninstall)/i,
+	/\bapt(-get)?\s+(install|remove|purge|update|upgrade)/i,
+	/\bbrew\s+(install|uninstall|upgrade)/i,
+	/\bgit\s+(add|commit|push|pull|merge|rebase|reset|checkout|branch\s+-[dD]|stash|cherry-pick|revert|tag|init|clone)/i,
+	/\bsudo\b/i,
+	/\bsu\b/i,
+	/\bkill\b/i,
+	/\bpkill\b/i,
+	/\bkillall\b/i,
+	/\breboot\b/i,
+	/\bshutdown\b/i,
+	/\bsystemctl\s+(start|stop|restart|enable|disable)/i,
+	/\bservice\s+\S+\s+(start|stop|restart)/i,
+	/\b(vim?|nano|emacs|code|subl)\b/i,
+	/\bdel\b/i,
+	/\brd\b/i,
+	/\bcopy\b/i,
+	/\bmove\b/i,
+	/\bren\b/i,
+	/\brename\b/i,
+	/\bicacls\b/i,
+	/\battrib\b/i,
+	/\bpowershell\b/i,
+	/\bpwsh\b/i
+];
+const SAFE_PATTERNS = [
+	/^\s*cat\b/,
+	/^\s*head\b/,
+	/^\s*tail\b/,
+	/^\s*less\b/,
+	/^\s*more\b/,
+	/^\s*grep\b/,
+	/^\s*find\b/,
+	/^\s*ls\b/,
+	/^\s*pwd\b/,
+	/^\s*echo\b/,
+	/^\s*printf\b/,
+	/^\s*wc\b/,
+	/^\s*sort\b/,
+	/^\s*uniq\b/,
+	/^\s*diff\b/,
+	/^\s*file\b/,
+	/^\s*stat\b/,
+	/^\s*du\b/,
+	/^\s*df\b/,
+	/^\s*tree\b/,
+	/^\s*which\b/,
+	/^\s*whereis\b/,
+	/^\s*type\b/,
+	/^\s*env\b/,
+	/^\s*printenv\b/,
+	/^\s*uname\b/,
+	/^\s*whoami\b/,
+	/^\s*id\b/,
+	/^\s*date\b/,
+	/^\s*cal\b/,
+	/^\s*uptime\b/,
+	/^\s*ps\b/,
+	/^\s*top\b/,
+	/^\s*htop\b/,
+	/^\s*free\b/,
+	/^\s*cd\b/,
+	/^\s*git\s+(status|log|diff|show|branch|remote|config\s+--get)/i,
+	/^\s*git\s+ls-/i,
+	/^\s*npm\s+(list|ls|view|info|search|outdated|audit)/i,
+	/^\s*yarn\s+(list|info|why|audit)/i,
+	/^\s*pnpm\s+(list|ls|why|audit|outdated)/i,
+	/^\s*bun\s+(pm\s+ls)/i,
+	/^\s*node\s+--version/i,
+	/^\s*python\s+--version/i,
+	/^\s*curl\s/i,
+	/^\s*wget\s+-O\s*-/i,
+	/^\s*jq\b/,
+	/^\s*sed\s+-n/i,
+	/^\s*awk\b/,
+	/^\s*rg\b/,
+	/^\s*fd\b/,
+	/^\s*bat\b/,
+	/^\s*eza\b/,
+	/^\s*basename\b/,
+	/^\s*dirname\b/,
+	/^\s*realpath\b/,
+	/^\s*readlink\b/,
+	/^\s*dir\b/,
+	/^\s*where\b/,
+	/^\s*set\b/,
+	/^\s*systeminfo\b/,
+	/^\s*tasklist\b/
+];
+//#endregion
+//#region src/sandbox.ts
+/**
+* Core sandbox logic — determines whether a shell command is safe to execute.
+*/
+/**
+* Check if a shell command is safe to execute in a sandboxed mode.
+*
+* The command is parsed into segments using shell-quote, and each segment
+* is checked independently against the destructive and safe pattern lists.
+* A command is safe only if ALL segments pass.
+*
+* For a segment to pass:
+* 1. It must NOT match any destructive pattern
+* 2. It MUST match at least one safe pattern
+* 3. It must NOT contain redirects (unless explicitly allowed)
+*
+* Additionally, command substitution ($() and backticks) is blocked by default.
+*/
+function isSafeCommand(command, options = {}) {
+	const { extraSafe = [], extraDestructive = [], allowCommand, allowRedirects = false, allowCommandSubstitution = false } = options;
+	if (allowCommand?.(command)) return true;
+	if (!allowCommandSubstitution && hasCommandSubstitution(command)) return false;
+	const allDestructive = [...DESTRUCTIVE_PATTERNS, ...extraDestructive];
+	const allSafe = [...SAFE_PATTERNS, ...extraSafe];
+	const segments = parseCommandSegments(command);
+	if (segments.length === 0) return false;
+	return segments.every((segment) => {
+		if (!allowRedirects && segment.hasRedirect) return false;
+		const cmd = segment.command;
+		const isDestructive = allDestructive.some((p) => p.test(cmd));
+		const isSafe = allSafe.some((p) => p.test(cmd));
+		return !isDestructive && isSafe;
+	});
+}
+//#endregion
+export { DESTRUCTIVE_PATTERNS, SAFE_PATTERNS, hasCommandSubstitution, isSafeCommand, parseCommandSegments };

package/node_modules/@dreki-gg/pi-command-sandbox/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@dreki-gg/pi-command-sandbox",
+  "private": true,
+  "version": "0.1.0",
+  "description": "Shared command sandboxing utilities for pi extensions — validates shell commands against safe/destructive pattern lists using proper shell parsing",
+  "author": "Juan Albarran <jalbarrandev@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dreki-gg/pi-extensions",
+    "directory": "packages/command-sandbox"
+  },
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "types": "./dist/index.d.mts"
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsdown",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint src",
+    "format": "oxfmt --write src",
+    "format:check": "oxfmt --check src"
+  },
+  "dependencies": {
+    "shell-quote": "^1.8.3"
+  },
+  "devDependencies": {
+    "@types/node": "24",
+    "@types/shell-quote": "^1.7.5",
+    "bun-types": "latest",
+    "oxfmt": "^0.43.0",
+    "oxlint": "^1.58.0",
+    "tsdown": "^0.22.0",
+    "typescript": "^6.0.0"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreki-gg/pi-plan-mode",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Two-phase planning workflow for pi — plan with claude-opus-4-6:medium, execute with gpt-5.5:low, with .plans/ file-based handoff",
   "keywords": [
     "pi-package"
@@ -24,6 +24,8 @@
     "package.json"
   ],
   "scripts": {
+    "prepack": "node --experimental-strip-types scripts/prepack.js",
+    "postpack": "rm -rf node_modules/@dreki-gg",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint extensions bin",
     "format": "oxfmt --write extensions bin",
@@ -34,6 +36,12 @@
       "./extensions/plan-mode"
     ]
   },
+  "bundledDependencies": [
+    "@dreki-gg/pi-command-sandbox"
+  ],
+  "dependencies": {
+    "@dreki-gg/pi-command-sandbox": "workspace:*"
+  },
   "devDependencies": {
     "@types/node": "24",
     "bun-types": "latest",