@garyr/pt-cli 0.32.1 → 0.36.4

package/README.md

@@ -1,6 +1,6 @@
 # pt - Project Template CLI
 
-A CLI tool to record directory structures as templates and initialize new projects from them.
+A CLI tool to record directory structures as templates and initialize new projects from them. A [GUI](https://garylritchie.gumroad.com/l/pt-gui) is also in development.
 
 ```mermaid
 graph LR
@@ -133,4 +133,4 @@ Always back up these directories before installing new versions or making signif
 
 ## Example Templates
 
-There are a couple of [example templates](https://github.com/search?q=topic%3Atemplate-project+org%3Agaryritchie&type=Repositories) for you to try. These include utilities written in python to help streamline common file management tasks.
+[Example templates](https://github.com/search?q=topic%3Atemplate-project+org%3Agaryritchie&type=Repositories) are available. These include useful python scripts to help streamline common file management tasks.

package/dist/commands/defaultPostConfigCommand.js

@@ -21,6 +21,7 @@ export function defaultPostConfigCommand(options = {}) {
         console.error('You must provide --json <data> to set the default post-config array.');
     }
     else {
-        console.log('Current default post-config tasks:', config.default_post_config || []);
+        const tasks = config.default_post_config || [];
+        console.log(JSON.stringify(tasks, null, 2));
     }
 }

package/dist/commands/initCommand.js

@@ -153,25 +153,26 @@ export async function init(targetName, destPath, options = {}) {
             if (fs.existsSync(srcPath)) {
                 if (options.dryRun) {
                     console.log(chalk.gray(`  [DRY RUN] Would copy ${file.src} → ${file.dest || file.src}`));
-                    const ext = path.extname(file.src);
-                    if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-                        console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
-                    }
+                    console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
                     continue;
                 }
-                const fileContent = fs.readFileSync(srcPath, 'utf-8');
+                let fileContent = fs.readFileSync(srcPath, 'utf-8');
+                // Substitute variables in post_copy files if template has variables
+                if (template.variables && template.variables.length > 0) {
+                    const { substituteVariables } = await import('../substitute.js');
+                    fileContent = substituteVariables(fileContent, variables);
+                }
                 const destDir = path.dirname(destPath);
                 fs.mkdirSync(destDir, { recursive: true });
                 fs.writeFileSync(destPath, fileContent);
-                // Auto-chmod for executables
-                const ext = path.extname(file.src);
-                if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-                    try {
-                        fs.chmodSync(destPath, 0o755);
-                    }
-                    catch (e) {
-                        // chmod not available (Windows)
-                    }
+                // post_copy files are executables by definition — always chmod
+                try {
+                    // Check if source had execute permissions, otherwise default to 0o755
+                    const srcStat = fs.statSync(srcPath);
+                    fs.chmodSync(destPath, srcStat.mode & 0o111 ? srcStat.mode : 0o755);
+                }
+                catch (e) {
+                    // chmod not available (Windows)
                 }
                 console.log(chalk.green("  ✓ " + (file.dest || file.src)));
             }
@@ -190,7 +191,38 @@ export async function init(targetName, destPath, options = {}) {
     }
     // Use template post_config tasks
     const allTasks = template.post_config?.filter(t => !t.type || t.type === typeName) || [];
-    if (allTasks.length > 0) {
+    if (allTasks.length > 0 && !options.skipPostConfig) {
+        // SECURITY CHECK: Validate template safety before running post_config tasks
+        const { validateTemplateSecurity } = await import('../safety.js');
+        const { valid, errors, warnings } = validateTemplateSecurity(template);
+        if (!valid) {
+            console.error(chalk.red("\n❌ SECURITY ERROR: Aborting post_config execution due to blocked commands:"));
+            for (const err of errors) {
+                console.error(chalk.red(`   - ${err}`));
+            }
+            process.exit(1);
+        }
+        if (warnings.length > 0) {
+            console.warn(chalk.yellow("\n⚠️  SECURITY WARNING: Post-config contains dangerous or suspicious commands:"));
+            for (const warn of warnings) {
+                console.warn(chalk.yellow(`   - ${warn}`));
+            }
+            if (!options.yes) {
+                const { proceed } = await inquirer.prompt({
+                    type: 'confirm',
+                    name: 'proceed',
+                    message: chalk.red('Are you sure you want to run these post-config tasks?'),
+                    default: false
+                });
+                if (!proceed) {
+                    console.log(chalk.yellow("Post-config tasks aborted by user."));
+                    return;
+                }
+            }
+            else {
+                console.warn(chalk.yellow("Proceeding anyway (non-interactive mode with auto-confirm enabled)."));
+            }
+        }
         // Determine which tasks to include
         let selectedTaskNames = [];
         if (options.skipPostConfig) {

package/dist/commands/learnCommand.js

@@ -9,7 +9,7 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
     // Phase 1: Remote Check
     if (sourcePath.startsWith('http')) {
         console.log(chalk.cyan(`Downloading remote template from: ${sourcePath}...`));
-        resolvedPath = await downloadAndExtract(sourcePath);
+        resolvedPath = await downloadAndExtract(sourcePath, options.json || false, options.allowUntrusted || false);
     }
     else {
         resolvedPath = path.resolve(sourcePath);

package/dist/commands/securityResponseCommand.js

@@ -0,0 +1,12 @@
+// pt-cli/src/commands/securityResponseCommand.ts
+// CLI command to handle security responses from GUI
+import { handleSecurityResponse } from '../safety.js';
+export async function securityResponseCommand(response, options = { response: '' }) {
+    const result = await handleSecurityResponse(response);
+    if (result) {
+        console.log('SECURITY_RESPONSE:ALLOWED');
+    }
+    else {
+        console.log('SECURITY_RESPONSE:DENIED');
+    }
+}

package/dist/config.js

@@ -156,6 +156,23 @@ export function getDefaultPostConfig(config) {
         checked: t.checked !== false // default to true if not explicitly false
     }));
 }
+/**
+ * Get security policy from config or use defaults
+ */
+export function getSecurityPolicy(config) {
+    const defaultPolicy = {
+        maxExecutionTime: 30000, // 30 seconds
+        enableAuditLogging: true,
+        trustedSources: [
+            'github.com/garyritchie',
+            'gitea.lyonritchie.com/garyritchie',
+            'github.com/lyonritchie',
+        ],
+        maxCommandsPerRun: 50,
+        securityLevel: 'warn',
+    };
+    return config.security || defaultPolicy;
+}
 // Default exclusions for template scanning
 export const DEFAULT_EXCLUDES = [
     '.git',

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import chalk from 'chalk';
 // Command imports
 import { learn } from './commands/learnCommand.js';
 import { init } from './commands/initCommand.js';
@@ -9,6 +10,7 @@ import { variablesCommand } from './commands/variablesCommand.js';
 import { addCommand } from './commands/addCommand.js';
 import { removeCommand } from './commands/removeCommand.js';
 import { defaultPostConfigCommand } from './commands/defaultPostConfigCommand.js';
+import { securityResponseCommand } from './commands/securityResponseCommand.js';
 import pkg from '../package.json' with { type: 'json' };
 const program = new Command();
 program
@@ -23,8 +25,23 @@ program
     .option('--name <name>', 'Template name (skip prompt)')
     .option('--desc <description>', 'Template description (skip prompt)')
     .option('--json', 'Output template structure as JSON for sharing instead of saving')
+    .option('--allow-untrusted', 'Bypass the trusted-source check for remote URLs (set by GUI after user confirmation)')
     .action(async (pathArg, options) => {
-    await learn(pathArg || '.', null, options);
+    try {
+        await learn(pathArg || '.', null, options);
+    }
+    catch (err) {
+        if (options.json) {
+            console.log(JSON.stringify({
+                type: 'error',
+                message: err.message || String(err)
+            }));
+        }
+        else {
+            console.error(chalk.red(`Error: ${err.message || err}`));
+        }
+        process.exit(1);
+    }
 });
 program
     .command('update <templateName> [sourcePath]')
@@ -33,7 +50,13 @@ program
     .option('-y, --yes', 'Automatically confirm prompts')
     .option('--desc <description>', 'Template description (skip prompt)')
     .action(async (templateName, sourcePath, options) => {
-    await learn(sourcePath || '.', templateName, options);
+    try {
+        await learn(sourcePath || '.', templateName, options);
+    }
+    catch (err) {
+        console.error(chalk.red(`Error: ${err.message || err}`));
+        process.exit(1);
+    }
 });
 program
     .command('init [templateName] [destPath]')
@@ -80,4 +103,10 @@ program
     .description('Remove a learned template from the config')
     .option('-y, --yes', 'Automatically confirm removal')
     .action(removeCommand);
+program
+    .command('security-response <response>')
+    .description('Handle security response from GUI')
+    .action(async (response) => {
+    await securityResponseCommand(response);
+});
 program.parse(process.argv);

package/dist/postconfig.js

@@ -1,12 +1,22 @@
-import { execSync } from 'child_process';
+import path from 'path';
+import os from 'os';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
+import { isBlockedCommand, isDangerousCommand, executeWithTimeout, logSecurityEvent, canExecute, showDangerousCommandWarning, getSecurityPolicy, } from './safety.js';
 /**
  * Runs post-configuration tasks for a project.
  */
 export async function runPostConfig(destPath, tasks, projectType, options = {}) {
     if (options.skipPostConfig)
         return;
+    // Load security policy
+    const configPath = path.join(process.env.HOME || os.homedir(), '.pt', 'config.yaml');
+    const securityPolicy = getSecurityPolicy(configPath);
+    // Check rate limiting
+    if (!canExecute('init', securityPolicy.maxCommandsPerRun)) {
+        console.log(chalk.yellow('⚠️  Rate limit reached: max commands per run exceeded'));
+        return;
+    }
     // 1. Filter tasks by type
     const applicableTasks = tasks.filter(t => !t.type || t.type === projectType);
     if (applicableTasks.length === 0) {
@@ -37,20 +47,53 @@ export async function runPostConfig(destPath, tasks, projectType, options = {})
         const task = applicableTasks[i];
         const progress = `[${i + 1}/${applicableTasks.length}]`;
         if (task.command) {
+            // SECURITY CHECK 1: Blocklist check (NEVER allow these)
+            if (isBlockedCommand(task.command)) {
+                console.log(chalk.red(`${progress} ⚠️  BLOCKED: ${task.command}`));
+                logSecurityEvent('command_blocked', task.command, projectType, 'blocked');
+                continue;
+            }
+            // SECURITY CHECK 2: Dangerous command warning (but allow execution)
+            if (isDangerousCommand(task.command)) {
+                console.log(chalk.yellow(`${progress} ⚠️  WARNING: This command may be dangerous: ${task.command}`));
+                console.log(chalk.yellow(`   Press CTRL+C to cancel, or wait 5s to continue...`));
+                // Wait for user to cancel or timeout
+                const allowContinue = await showDangerousCommandWarning(task.command, 5);
+                if (!allowContinue) {
+                    console.log(chalk.yellow(`${progress} ⊘ Command cancelled by user`));
+                    logSecurityEvent('command_blocked', task.command, projectType, 'blocked');
+                    continue;
+                }
+            }
+            // SECURITY CHECK 3: Rate limiting
+            if (!canExecute(task.command, securityPolicy.maxCommandsPerRun)) {
+                console.log(chalk.red(`${progress} ⚠️  Rate limited: too many commands executed`));
+                continue;
+            }
             if (options.dryRun) {
                 console.log(chalk.gray(`  [DRY RUN] Would run: ${task.command}`));
             }
             else {
                 try {
                     console.log(chalk.yellow(`\n${progress} Running: ${task.command}`));
-                    execSync(task.command, {
-                        cwd: destPath,
-                        stdio: 'inherit'
-                    });
-                    console.log(chalk.green('  ✓ Command completed successfully'));
+                    // SECURITY CHECK 4: Execution timeout
+                    const result = await executeWithTimeout(task.command, destPath, securityPolicy.maxExecutionTime);
+                    if (result.timedOut) {
+                        console.log(chalk.red(`  ✗ Command timed out after ${securityPolicy.maxExecutionTime / 1000}s`));
+                        logSecurityEvent('command_timed_out', task.command, projectType, 'timedout');
+                    }
+                    else if (result.success) {
+                        console.log(chalk.green('  ✓ Command completed successfully'));
+                        logSecurityEvent('command_executed', task.command, projectType, 'success');
+                    }
+                    else {
+                        console.log(chalk.red(`  ✗ Command failed: ${result.stderr}`));
+                        logSecurityEvent('command_executed', task.command, projectType, 'failed');
+                    }
                 }
                 catch (err) {
                     console.log(chalk.red('  ✗ Command failed'));
+                    logSecurityEvent('command_executed', task.command, projectType, 'failed');
                 }
             }
         }

package/dist/remote.js

@@ -5,7 +5,47 @@ import os from 'os';
 import { Readable } from 'stream';
 import { finished } from 'stream/promises';
 import { extract } from 'tar'; // You'll need: npm install tar
-export async function downloadAndExtract(url) {
+import chalk from 'chalk';
+import { isTrustedSource, logSecurityEvent } from './safety.js';
+import { loadConfig } from './config.js';
+export async function downloadAndExtract(url, isJsonMode = false, allowUntrusted = false) {
+    // Load security policy
+    const configPath = path.join(process.env.HOME || os.homedir(), '.pt', 'config.yaml');
+    const config = loadConfig();
+    const securityPolicy = config.security || {
+        trustedSources: ['github.com/garyritchie', 'gitea.lyonritchie.com/garyritchie', 'github.com/lyonritchie'],
+    };
+    // SECURITY CHECK: Verify source is trusted (skipped when --allow-untrusted is passed)
+    if (!allowUntrusted && !isTrustedSource(url, securityPolicy.trustedSources)) {
+        if (isJsonMode) {
+            // In JSON mode, output warning as JSON for GUI consumption.
+            // The GUI will show a confirmation dialog and, if the user says YES,
+            // re-run `pt learn <url> --json --yes --allow-untrusted`.
+            console.log(JSON.stringify({
+                type: 'security_warning',
+                url: url,
+                message: `Template from untrusted source: ${url}`,
+                warning: 'Only use templates from trusted sources.',
+                prompt: 'Continue anyway?',
+                default: false
+            }));
+            process.exit(1);
+        }
+        else {
+            console.log(chalk.yellow(`⚠️  Warning: Template from untrusted source: ${url}`));
+            console.log(chalk.yellow('   Only use templates from trusted sources'));
+            const inquirer = (await import('inquirer')).default;
+            const response = await inquirer.prompt({
+                type: 'confirm',
+                name: 'proceed',
+                message: chalk.red('Continue anyway?'),
+                default: false
+            });
+            if (!response.proceed) {
+                throw new Error('Download cancelled by user due to untrusted source');
+            }
+        }
+    }
     const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pt-template-'));
     let downloadUrl = url;
     // Strip trailing slash and .git suffix before converting to archive URL
@@ -23,9 +63,17 @@ export async function downloadAndExtract(url) {
     const dest = path.join(tempDir, 'template.tar.gz');
     const fileStream = fs.createWriteStream(dest);
     await finished(Readable.fromWeb(response.body).pipe(fileStream));
+    // SECURITY: Validate downloaded file before extraction
+    const stats = fs.statSync(dest);
+    if (stats.size > 50 * 1024 * 1024) { // 50MB limit
+        throw new Error('Downloaded template is too large (>50MB)');
+    }
     // Extract tarball
     await extract({ file: dest, cwd: tempDir });
     // Find the actual content folder (archives usually wrap content in a folder)
     const dirs = fs.readdirSync(tempDir).filter(f => fs.statSync(path.join(tempDir, f)).isDirectory());
-    return path.join(tempDir, dirs[0]);
+    const extractedPath = path.join(tempDir, dirs[0]);
+    // SECURITY: Log successful download
+    logSecurityEvent('template_loaded', downloadUrl, 'remote', 'success');
+    return extractedPath;
 }

package/dist/safety.js

@@ -0,0 +1,280 @@
+// pt-cli/src/safety.ts
+// Security warnings and safeguards for post_config command execution
+import crypto from 'crypto';
+import os from 'os';
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+// === BLOCKLIST ===
+// Commands that are NEVER allowed (safety-critical operations)
+const BLOCKED_COMMANDS = [
+    // Privilege escalation
+    'sudo', 'su', 'su -', 'su root',
+    // Disk operations that could destroy data
+    'dd', 'mkfs', 'fdisk', 'mount', 'umount',
+    // Shell injection patterns - removed from blocklist to allow command chaining.
+    // These are validated as warnings instead.
+    // Dangerous chmod
+    'chmod 777', 'chmod -R 777', 'chmod 666',
+    // System commands that could kill processes
+    'kill', 'killall', 'pkill', 'fuser',
+    // Network operations that could exfiltrate data
+    'nc', 'netcat', 'socat',
+    // Package manager with dangerous flags
+    'apt purge', 'apt remove', 'yum remove', 'brew uninstall',
+];
+// === DANGEROUS PATTERNS ===
+// Commands that should trigger a warning but are NOT blocked
+const DANGEROUS_PATTERNS = [
+    // Remote downloads + execution
+    'curl', 'wget', 'wget -O', 'curl |', 'wget |',
+    // Script execution
+    'bash', 'sh', 'python', 'python3', 'node -e', 'node -p',
+    // Shell operations
+    'eval', 'exec', 'source',
+    // File system manipulation
+    'chmod -R', 'chown -R', 'chgrp -R',
+    // PowerShell (Windows)
+    'powershell', 'pwsh', 'Invoke-Expression', 'IEX',
+    // macOS-specific
+    'diskutil', 'hdiutil', 'csrutil',
+];
+// Default security policy - warning focused
+const DEFAULT_SECURITY_POLICY = {
+    maxExecutionTime: 30000, // 30 seconds
+    enableAuditLogging: true,
+    trustedSources: [
+        'github.com/garyritchie',
+        'git.lyonritchie.com',
+        'github.com/lyonritchie',
+    ],
+    maxCommandsPerRun: 50,
+    securityLevel: 'warn', // Warning-focused mode
+};
+/**
+ * Check if a command is in the blocklist (NEVER allowed)
+ * Only truly dangerous operations that could destroy data
+ */
+export function isBlockedCommand(command) {
+    for (const blocked of BLOCKED_COMMANDS) {
+        if (command.includes(blocked)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a command should trigger a warning (but is allowed)
+ */
+export function isDangerousCommand(command) {
+    // Check for destructive file operations targeting absolute paths
+    // Regex matches 'rm', 'rmdir', or Windows 'del' followed by optional flags and then an absolute path.
+    // Absolute path matches:
+    // - Unix: starting with '/' (e.g. /tmp, /usr)
+    // - Windows: starting with drive letter (e.g. C:\) or UNC path (\\) or drive-relative '\'
+    const parts = command.split(/\s+/);
+    const rmIndex = parts.findIndex(p => p === 'rm' || p === 'rmdir' || p === 'del');
+    if (rmIndex !== -1) {
+        // Check subsequent arguments
+        for (let i = rmIndex + 1; i < parts.length; i++) {
+            const arg = parts[i];
+            if (!arg)
+                continue;
+            // Skip flags (starting with - or /flag on Windows)
+            if (arg.startsWith('-') || (process.platform === 'win32' && arg.startsWith('/'))) {
+                continue;
+            }
+            // Check absolute path patterns
+            const isAbsolute = arg.startsWith('/') ||
+                (process.platform === 'win32' && (/^[a-zA-Z]:\\/.test(arg) || arg.startsWith('\\\\') || arg.startsWith('\\')));
+            if (isAbsolute) {
+                return true;
+            }
+        }
+    }
+    for (const pattern of DANGEROUS_PATTERNS) {
+        if (command.includes(pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Execute a command with timeout and error handling
+ */
+export async function executeWithTimeout(command, cwd, timeoutMs = 30000) {
+    const { execSync } = await import('child_process');
+    try {
+        const output = execSync(command, {
+            cwd,
+            stdio: 'pipe',
+            timeout: timeoutMs,
+            encoding: 'utf-8',
+        });
+        return { success: true, stdout: output };
+    }
+    catch (err) {
+        if (err.code === 'ETIMEDOUT') {
+            return { success: false, timedOut: true };
+        }
+        return {
+            success: false,
+            stderr: err.stderr || err.message,
+        };
+    }
+}
+/**
+ * Log a security event to audit log
+ */
+export function logSecurityEvent(eventType, command, templateName, result) {
+    const logEntry = {
+        timestamp: new Date().toISOString(),
+        eventType,
+        command,
+        template: templateName,
+        user: os.userInfo().username,
+        result,
+        hostname: os.hostname(),
+    };
+    const logDir = path.join(os.homedir(), '.pt');
+    const logFile = path.join(logDir, 'security-audit.log');
+    try {
+        // Ensure log directory exists
+        if (!fs.existsSync(logDir)) {
+            fs.mkdirSync(logDir, { recursive: true });
+        }
+        // Append to audit log
+        fs.appendFileSync(logFile, JSON.stringify(logEntry) + '\n');
+    }
+    catch (err) {
+        // Silently fail if logging fails
+        console.warn('Warning: Failed to write security audit log');
+    }
+}
+/**
+ * Check if a URL is from a trusted source
+ */
+export function isTrustedSource(url, trustedSources = DEFAULT_SECURITY_POLICY.trustedSources) {
+    return trustedSources.some(source => url.includes(source));
+}
+/**
+ * Rate limiting: track the last execution timestamp per command hash
+ */
+const lastExecutionTimes = new Map();
+const RATE_LIMIT_MS = 1000; // 1 second between identical commands
+export function canExecute(command, maxCommandsPerRun = 50) {
+    // Check total commands executed this run
+    const totalExecuted = lastExecutionTimes.size;
+    if (totalExecuted >= maxCommandsPerRun) {
+        return false;
+    }
+    // Check rate limit for this specific command
+    const hash = crypto.createHash('md5').update(command).digest('hex');
+    const lastTime = lastExecutionTimes.get(hash) || 0;
+    if (Date.now() - lastTime < RATE_LIMIT_MS) {
+        return false;
+    }
+    // Record execution timestamp
+    lastExecutionTimes.set(hash, Date.now());
+    return true;
+}
+/**
+ * Reset execution timestamps (for testing or between runs)
+ */
+export function resetExecutionCounts() {
+    lastExecutionTimes.clear();
+}
+/**
+ * Validate a template's security before execution
+ */
+export function validateTemplateSecurity(templateConfig, securityPolicy = DEFAULT_SECURITY_POLICY) {
+    const errors = [];
+    const warnings = [];
+    // Check post_config tasks
+    const postConfigTasks = templateConfig.post_config || [];
+    for (const task of postConfigTasks) {
+        const command = task.command;
+        if (!command)
+            continue;
+        // Check for blocked commands
+        if (isBlockedCommand(command)) {
+            errors.push(`Blocked command in template: ${command}`);
+        }
+        // Warn about dangerous commands
+        if (isDangerousCommand(command)) {
+            warnings.push(`Dangerous command in template: ${command}`);
+        }
+        // Check for shell injection patterns
+        if (command.includes(';') || command.includes('|') || command.includes('&')) {
+            warnings.push(`Shell injection pattern in command: ${command}`);
+        }
+        // Check for remote downloads
+        if (command.includes('curl') || command.includes('wget')) {
+            warnings.push(`Remote download in command: ${command}`);
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Get security policy from config or use defaults
+ */
+export function getSecurityPolicy(configPath) {
+    // Try to load from config
+    if (configPath) {
+        try {
+            const YAML = require('yaml');
+            const config = YAML.parse(fs.readFileSync(configPath, 'utf-8'));
+            if (config.security) {
+                return { ...DEFAULT_SECURITY_POLICY, ...config.security };
+            }
+        }
+        catch (err) {
+            // Fall back to defaults
+        }
+    }
+    return DEFAULT_SECURITY_POLICY;
+}
+/**
+ * Show warning about dangerous command and wait for user to cancel.
+ * Resolves true after the timeout (continue), or false immediately on CTRL+C (cancel).
+ */
+export async function showDangerousCommandWarning(command, timeoutSeconds = 5) {
+    const readline = await import('readline');
+    console.log(chalk.red('\n⚠️  DANGEROUS COMMAND DETECTED'));
+    console.log(chalk.red(`   Command: ${command}`));
+    console.log(chalk.red('   This could potentially harm your system.'));
+    console.log(chalk.yellow(`   Press CTRL+C to cancel, or wait ${timeoutSeconds}s to continue...`));
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            rl.close();
+            resolve(true);
+        }, timeoutSeconds * 1000);
+        rl.on('SIGINT', () => {
+            clearTimeout(timer);
+            rl.close();
+            console.log(chalk.yellow('\n⚠️  Command cancelled by user'));
+            resolve(false);
+        });
+    });
+}
+// Security response handling for GUI integration
+export async function handleSecurityResponse(response) {
+    // Normalize response
+    const normalized = response.trim().toLowerCase();
+    // Accept 'y' or 'yes' as positive response
+    if (normalized === 'y' || normalized === 'yes') {
+        console.log('Security response: ALLOWED');
+        return true;
+    }
+    // Reject any other response
+    console.log('Security response: DENIED');
+    return false;
+}