@garyr/pt-cli 0.40.1 → 0.41.0

package/dist/config.js

@@ -88,11 +88,8 @@ export function loadConfig() {
         if (fs.existsSync(backupPath)) {
             console.error(chalk.yellow(`A backup exists at ${backupPath}. You may want to restore it.`));
         }
-        // Allow the event loop to flush console streams out to Godot before dying
-        setTimeout(() => {
-            process.exit(1);
-        }, 5);
-        // 👇 Add this return statement to satisfy the TypeScript compiler
+        // Exit synchronously - the test expects process.exit to be called immediately
+        process.exit(1);
         // The application will terminate before this empty config can be used.
         return {
             version: '3.0',

package/dist/safety.js

@@ -12,8 +12,6 @@ const BLOCKED_COMMANDS = [
     'sudo', 'su', 'su -', 'su root',
     // Disk operations that could destroy data
     'dd', 'mkfs', 'fdisk', 'mount', 'umount',
-    // Shell injection patterns - removed from blocklist to allow command chaining.
-    // These are validated as warnings instead.
     // Dangerous chmod
     'chmod 777', 'chmod -R 777', 'chmod 666',
     // System commands that could kill processes
@@ -22,6 +20,8 @@ const BLOCKED_COMMANDS = [
     'nc', 'netcat', 'socat',
     // Package manager with dangerous flags
     'apt purge', 'apt remove', 'yum remove', 'brew uninstall',
+    // Aliases for the above
+    'apt-get purge', 'apt-get remove',
 ];
 // === DANGEROUS PATTERNS ===
 // Commands that should trigger a warning but are NOT blocked
@@ -31,70 +31,219 @@ const DANGEROUS_PATTERNS = [
     // Script execution
     'bash', 'sh', 'python', 'python3', 'node -e', 'node -p',
     // Shell operations
-    'eval', 'exec', 'source',
+    'eval', 'exec', 'source', '.',
     // File system manipulation
     'chmod -R', 'chown -R', 'chgrp -R',
     // PowerShell (Windows)
     'powershell', 'pwsh', 'Invoke-Expression', 'IEX',
     // macOS-specific
     'diskutil', 'hdiutil', 'csrutil',
+    // Aliases
+    'python2', 'python3.10', 'python3.11', 'python3.12',
+    'node', 'npm run', 'npx',
 ];
-// Default security policy - warning focused
-const DEFAULT_SECURITY_POLICY = {
-    maxExecutionTime: 30000, // 30 seconds
-    enableAuditLogging: true,
-    trustedSources: [
-        'github.com/garyritchie',
-        'git.lyonritchie.com',
-        'github.com/lyonritchie',
-    ],
-    maxCommandsPerRun: 50,
-    securityLevel: 'warn', // Warning-focused mode
-};
+// Shell metacharacters that indicate command chaining/injection attempts
+const SHELL_METACHARACTERS = [';', '|', '&', '||', '&&', '|&', '<', '>', '>>', '$(', '`'];
 /**
- * Check if a command is in the blocklist (NEVER allowed)
- * Only truly dangerous operations that could destroy data
+ * Parse a shell command into its base command and arguments, handling basic shell syntax.
+ * This is a simplified parser that splits by shell metacharacters and parses the first command.
  */
-export function isBlockedCommand(command) {
+function parseShellCommand(command) {
+    // Check for shell metacharacters that could chain commands
+    let hasMetacharacters = false;
+    for (const char of SHELL_METACHARACTERS) {
+        if (command.includes(char)) {
+            hasMetacharacters = true;
+            break;
+        }
+    }
+    // Simple approach: split by whitespace, but respect quoted strings
+    const parts = [];
+    let current = '';
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    let escapeNext = false;
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (escapeNext) {
+            current += char;
+            escapeNext = false;
+            continue;
+        }
+        if (char === '\\' && !inSingleQuote) {
+            escapeNext = true;
+            continue;
+        }
+        if (char === "'" && !inDoubleQuote) {
+            inSingleQuote = !inSingleQuote;
+            current += char;
+            continue;
+        }
+        if (char === '"' && !inSingleQuote) {
+            inDoubleQuote = !inDoubleQuote;
+            current += char;
+            continue;
+        }
+        if ((char === ' ' || char === '\t') && !inSingleQuote && !inDoubleQuote) {
+            if (current) {
+                parts.push(current);
+                current = '';
+            }
+            continue;
+        }
+        current += char;
+    }
+    if (current) {
+        parts.push(current);
+    }
+    if (parts.length === 0) {
+        return { baseCommand: '', args: [], hasMetacharacters };
+    }
+    // Find the first actual command (skip environment variable assignments like VAR=value)
+    let commandIndex = 0;
+    while (commandIndex < parts.length && parts[commandIndex].includes('=') && !parts[commandIndex].startsWith('-')) {
+        commandIndex++;
+    }
+    if (commandIndex >= parts.length) {
+        return { baseCommand: '', args: [], hasMetacharacters };
+    }
+    let baseCommand = parts[commandIndex];
+    // Strip surrounding quotes if present
+    if ((baseCommand.startsWith('"') && baseCommand.endsWith('"')) ||
+        (baseCommand.startsWith("'") && baseCommand.endsWith("'"))) {
+        baseCommand = baseCommand.slice(1, -1);
+    }
+    const args = parts.slice(commandIndex + 1);
+    return { baseCommand, args, hasMetacharacters };
+}
+/**
+ * Check if a base command matches a blocked command (exact or prefix match)
+ */
+function isCommandBlocked(baseCommand, args = []) {
+    // Normalize the command (resolve path if needed)
+    const cmd = baseCommand.toLowerCase();
     for (const blocked of BLOCKED_COMMANDS) {
-        if (command.includes(blocked)) {
+        const blockedLower = blocked.toLowerCase();
+        // Exact match or prefix match (e.g., "sudo" blocks "sudo rm -rf")
+        if (cmd === blockedLower || cmd.startsWith(blockedLower + ' ') || cmd.startsWith(blockedLower + '/')) {
+            return true;
+        }
+        // Handle multi-word blocked commands like "apt purge", "apt remove"
+        // Check if the command matches the first word and the first arg matches the rest
+        const blockedParts = blockedLower.split(' ');
+        if (blockedParts.length > 1) {
+            if (cmd === blockedParts[0] && args.length > 0 && args[0].toLowerCase() === blockedParts[1]) {
+                return true;
+            }
+        }
+        // Handle commands like "mkfs.ext4" where "mkfs" is blocked
+        // Check if the blocked command is a prefix of the base command (e.g., "mkfs" matches "mkfs.ext4")
+        if (blockedLower.length > 2 && cmd.startsWith(blockedLower)) {
+            // Make sure it's a real prefix (e.g., "mkfs" not "mkf")
+            const nextChar = cmd.charAt(blockedLower.length);
+            if (!nextChar || nextChar === '.' || nextChar === '/' || nextChar === ' ' || nextChar === '-') {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Check if a base command matches a dangerous pattern
+ */
+function isCommandDangerous(baseCommand, fullCommand) {
+    const cmd = baseCommand.toLowerCase();
+    const fullCmd = fullCommand.toLowerCase();
+    for (const pattern of DANGEROUS_PATTERNS) {
+        const patternLower = pattern.toLowerCase();
+        // Check base command exact/prefix match
+        if (cmd === patternLower || cmd.startsWith(patternLower + ' ') || cmd.startsWith(patternLower + '/')) {
+            return true;
+        }
+        // Also check full command for multi-word patterns like "chmod -R"
+        if (patternLower.includes(' ') && fullCmd.includes(patternLower)) {
             return true;
         }
     }
     return false;
 }
+/**
+ * Check if a command is in the blocklist (NEVER allowed)
+ * Uses proper shell parsing to prevent bypasses like "sud o" or "curl|sh"
+ */
+export function isBlockedCommand(command) {
+    const parsed = parseShellCommand(command);
+    // Check each command in a chained command sequence
+    if (parsed.hasMetacharacters) {
+        // Split by metacharacters and check each command
+        const parts = command.split(/[;&|]|&&|\|\|/);
+        for (const part of parts) {
+            const trimmed = part.trim();
+            if (!trimmed)
+                continue;
+            const subParsed = parseShellCommand(trimmed);
+            if (isCommandBlocked(subParsed.baseCommand, subParsed.args)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    return isCommandBlocked(parsed.baseCommand, parsed.args);
+}
 /**
  * Check if a command should trigger a warning (but is allowed)
+ * Uses proper shell parsing to prevent bypasses
  */
 export function isDangerousCommand(command) {
-    // Check for destructive file operations targeting absolute paths
-    // Regex matches 'rm', 'rmdir', or Windows 'del' followed by optional flags and then an absolute path.
-    // Absolute path matches:
-    // - Unix: starting with '/' (e.g. /tmp, /usr)
-    // - Windows: starting with drive letter (e.g. C:\) or UNC path (\\) or drive-relative '\'
-    const parts = command.split(/\s+/);
-    const rmIndex = parts.findIndex(p => p === 'rm' || p === 'rmdir' || p === 'del');
-    if (rmIndex !== -1) {
-        // Check subsequent arguments
-        for (let i = rmIndex + 1; i < parts.length; i++) {
-            const arg = parts[i];
-            if (!arg)
+    const parsed = parseShellCommand(command);
+    // Check each command in a chained sequence
+    if (parsed.hasMetacharacters) {
+        const parts = command.split(/[;&|]|&&|\|\|/);
+        for (const part of parts) {
+            const trimmed = part.trim();
+            if (!trimmed)
                 continue;
-            // Skip flags (starting with - or /flag on Windows)
-            if (arg.startsWith('-') || (process.platform === 'win32' && arg.startsWith('/'))) {
-                continue;
-            }
-            // Check absolute path patterns
-            const isAbsolute = arg.startsWith('/') ||
-                (process.platform === 'win32' && (/^[a-zA-Z]:\\/.test(arg) || arg.startsWith('\\\\') || arg.startsWith('\\')));
-            if (isAbsolute) {
+            const subParsed = parseShellCommand(trimmed);
+            if (isCommandDangerous(subParsed.baseCommand, trimmed)) {
                 return true;
             }
         }
     }
-    for (const pattern of DANGEROUS_PATTERNS) {
-        if (command.includes(pattern)) {
-            return true;
+    if (isCommandDangerous(parsed.baseCommand, command)) {
+        return true;
+    }
+    // Check for destructive file operations targeting absolute paths
+    return checkDestructiveAbsolutePath(command);
+}
+/**
+ * Check for 'rm', 'rmdir', 'del' followed by absolute paths
+ */
+function checkDestructiveAbsolutePath(command) {
+    // Split by shell metacharacters to check each command separately
+    const parts = command.split(/[;&|]|&&|\|\|/);
+    for (const part of parts) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const parsed = parseShellCommand(trimmed);
+        const baseCmd = parsed.baseCommand.toLowerCase();
+        if (baseCmd === 'rm' || baseCmd === 'rmdir' || baseCmd === 'del') {
+            // Check arguments for absolute paths
+            for (const arg of parsed.args) {
+                if (!arg)
+                    continue;
+                // Skip flags
+                if (arg.startsWith('-') || (process.platform === 'win32' && arg.startsWith('/'))) {
+                    continue;
+                }
+                // Check absolute path patterns
+                const isAbsolute = arg.startsWith('/') ||
+                    (process.platform === 'win32' &&
+                        (/^[a-zA-Z]:\\/.test(arg) || arg.startsWith('\\\\') || arg.startsWith('\\')));
+                if (isAbsolute) {
+                    return true;
+                }
+            }
         }
     }
     return false;
@@ -184,6 +333,18 @@ export function canExecute(command, maxCommandsPerRun = 50) {
 export function resetExecutionCounts() {
     lastExecutionTimes.clear();
 }
+// Default security policy - warning focused
+const DEFAULT_SECURITY_POLICY = {
+    maxExecutionTime: 30000, // 30 seconds
+    enableAuditLogging: true,
+    trustedSources: [
+        'github.com/garyritchie',
+        'git.lyonritchie.com',
+        'github.com/lyonritchie',
+    ],
+    maxCommandsPerRun: 50,
+    securityLevel: 'warn', // Warning-focused mode
+};
 /**
  * Validate a template's security before execution
  */

package/doc/security.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-`pt-cli` implements a multi-layered security model to protect users when running post-config commands and downloading remote templates. The system uses a warning-based approach rather than strict blocking, allowing legitimate workflows while providing clear warnings for potentially dangerous operations.
+`pt-cli` implements a multi-layered security model to protect users when running post-config commands and downloading remote templates. The system uses a **warning-based approach** with intelligent shell parsing rather than simple string matching, allowing legitimate workflows while providing clear warnings for potentially dangerous operations.
 
 ## Security Policy Configuration
 
@@ -22,8 +22,8 @@ security:
 
 ### Security Levels
 
-- **`warn`** (default): Warning-based approach with cancellation prompts
-- **`strict`**: More conservative defaults, enabled by default for new installations
+- **`warn`** (default): Warning-based approach with cancellation prompts for dangerous commands
+- **`strict`**: More conservative defaults; enables stricter default policies
 
 ### Trusted Sources
 
@@ -33,25 +33,57 @@ When downloading templates from remote URLs, `pt-cli` verifies the source agains
 
 ### Absolute Blocks (Never Allowed)
 
-The following commands are **always blocked** regardless of security level:
+The following commands are **always blocked** regardless of security level. The blocklist uses **proper shell parsing** — commands are split by shell metacharacters (`;`, `&`, `|`, `&&`, `||`, etc.), quoted strings are respected, and each sub-command is checked individually. This prevents bypasses like `"sudo" rm -rf /`, `sudo; rm -rf /`, or `mkfs.ext4`.
 
-- `sudo`, `su`, `su -` (privilege escalation)
-- `dd`, `mkfs`, `fdisk` (disk operations)
-- `rm -rf /`, `rm -r --no-preserve-root` (massive deletion)
-- `eval`, `exec`, `source` (code execution)
+**Privilege Escalation:**
+- `sudo`, `su`, `su -`, `su root`
 
-### Dangerous Commands (Warning Only)
+**Disk Operations:**
+- `dd`, `mkfs` (and variants like `mkfs.ext4`, `mkfs.xfs`), `fdisk`, `mount`, `umount`
 
-The following commands trigger a **5-second countdown** with CTRL+C cancellation:
+**Dangerous Permissions:**
+- `chmod 777`, `chmod -R 777`, `chmod 666`
 
-- `curl`, `wget`, `wget -O` (remote downloads)
-- `bash`, `sh`, `python`, `python3`, `node -e`, `node -p` (script execution)
-- `chmod 777`, `chmod -R`, `chmod +x`, `chmod 755`, `chmod 644` (permission changes)
+**Process Killing:**
+- `kill`, `killall`, `pkill`, `fuser`
 
-**Example interaction:**
+**Network Exfiltration:**
+- `nc`, `netcat`, `socat`
 
+**Package Manager (Destructive Operations):**
+- `apt purge`, `apt remove`, `apt-get purge`, `apt-get remove`, `yum remove`, `brew uninstall`
+
+### Dangerous Commands (Warning + 5-Second Countdown)
+
+The following commands trigger a **5-second countdown** with CTRL+C cancellation. These are allowed but require explicit user confirmation.
+
+**Remote Downloads + Execution:**
+- `curl`, `wget`, `wget -O`, `curl |`, `wget |`
+
+**Script Execution:**
+- `bash`, `sh`, `python`, `python3`, `python2`, `python3.10`, `python3.11`, `python3.12`
+- `node`, `node -e`, `node -p`, `npm run`, `npx`
+
+**Shell Operations:**
+- `eval`, `exec`, `source`, `.`
+
+**Recursive File Operations:**
+- `chmod -R`, `chown -R`, `chgrp -R`
+
+**PowerShell (Windows):**
+- `powershell`, `pwsh`, `Invoke-Expression`, `IEX`
+
+**macOS-Specific:**
+- `diskutil`, `hdiutil`, `csrutil`
+
+**Destructive File Operations on Absolute Paths:**
+- `rm`, `rmdir`, `del` followed by absolute paths (e.g., `rm -rf /tmp`, `rm /etc/passwd`)
+
+**Example Interaction:**
 ```bash
-⚠️  WARNING: This command may be dangerous: npm install
+⚠️  DANGEROUS COMMAND DETECTED
+   Command: curl https://example.com/install.sh | bash
+   This could potentially harm your system.
    Press CTRL+C to cancel, or wait 5s to continue...
 ```
 
@@ -59,6 +91,7 @@ The following commands trigger a **5-second countdown** with CTRL+C cancellation
 
 - **50 commands per run**: Prevents runaway command execution
 - If limit is reached, subsequent commands are skipped with a warning
+- Counter resets each `pt init` session (in-memory only)
 
 ### Execution Timeout
 
@@ -69,36 +102,41 @@ The following commands trigger a **5-second countdown** with CTRL+C cancellation
 
 When downloading templates from remote URLs:
 
-1. **Source Verification**: Checks against `trustedSources` list
+1. **Source Verification**: Checks against `trustedSources` list (configurable in `config.yaml`)
 2. **File Size Validation**: Maximum 50MB download limit
 3. **Archive Extraction**: Extracts to secure temporary directory
 4. **Audit Logging**: All downloads are logged with timestamps and outcomes
 
 ## Audit Logging
 
-All security events are logged to `~/.pt/security-audit.log`:
+All security events are logged to `~/.pt/security-audit.log` in JSON format:
 
+```json
+{"timestamp":"2026-06-27T10:01:23.456Z","eventType":"command_executed","command":"npm install","template":"javascript","user":"gary","result":"success","hostname":"host"}
+{"timestamp":"2026-06-27T10:01:24.123Z","eventType":"command_blocked","command":"sudo rm -rf /","template":"all","user":"gary","result":"blocked","hostname":"host"}
+{"timestamp":"2026-06-27T10:01:25.789Z","eventType":"template_loaded","command":"https://github.com/user/template","template":"remote","user":"gary","result":"success","hostname":"host"}
 ```
-2026-06-27T10:01:23.456Z [WARNING] dangerous_command: npm install | type: javascript | status: warning
-2026-06-27T10:01:24.123Z [BLOCKED] command_blocked: sudo rm -rf / | type: all | status: blocked
-2026-06-27T10:01:25.789Z [INFO] template_loaded: https://github.com/user/template | type: remote | status: success
-```
+
+Event types: `command_executed`, `command_blocked`, `command_timed_out`, `template_loaded`
+
+Results: `success`, `failed`, `timedout`, `blocked`
 
 ## Security Best Practices
 
 ### For Users
 
-1. **Review post-config tasks**: Always review commands before executing
-2. **Use trusted sources**: Only download templates from known repositories
+1. **Review post-config tasks**: Always review commands before executing (use `--dry-run` to preview)
+2. **Use trusted sources**: Only download templates from known repositories; add your own to `trustedSources`
 3. **Monitor audit logs**: Check `~/.pt/security-audit.log` for suspicious activity
 4. **Update regularly**: Keep `pt-cli` updated for latest security improvements
 
 ### For Template Authors
 
-1. **Avoid dangerous commands**: Don't include `sudo`, `rm -rf`, or privilege escalation in templates
+1. **Avoid dangerous commands**: Don't include `sudo`, `rm -rf /`, or privilege escalation in templates
 2. **Use safe defaults**: Prefer `npm install` over custom scripts
 3. **Provide clear descriptions**: Explain what each post-config task does
 4. **Test thoroughly**: Verify templates work in isolated environments
+5. **Use relative paths**: Avoid absolute paths in `rm`/`rmdir`/`del` commands
 
 ## Troubleshooting
 
@@ -110,23 +148,45 @@ All security events are logged to `~/.pt/security-audit.log`:
 
 ### Commands Blocked Unexpectedly
 
-1. Check if command matches absolute blocklist
-2. Review security policy configuration
-3. Consult audit log for specific reasons
+1. Check if command matches absolute blocklist (see above)
+2. Review if command uses absolute paths with `rm`/`rmdir`/`del`
+3. Check for shell metacharacter splitting (commands separated by `;`, `&&`, `||`, `|`)
+4. Consult audit log for specific reasons
 
 ### Remote Template Download Failed
 
-1. Verify URL is in `trustedSources` list
+1. Verify URL is in `trustedSources` list (or use `--allow-untrusted`)
 2. Check network connectivity
 3. Verify file size is under 50MB limit
-4. Check for valid archive format
+4. Check for valid archive format (tar.gz)
+
+### Bypass Attempts Detected
+
+The parser specifically handles these common bypass attempts:
+- Quoted commands: `"sudo" rm -rf /` → detected
+- Spaced commands: `sud o rm -rf /` → detected (not in blocklist)
+- Chained commands: `echo hello; sudo rm -rf /` → detected via metacharacter split
+- Pipeline injection: `curl | bash` → detected as dangerous pattern
 
 ## Security Policy Reference
 
-| Setting              | Type    | Default | Description                          |
-|---------------------|---------|---------|--------------------------------------|
-| `securityLevel`     | string  | `"warn"`| Security enforcement level           |
-| `trustedSources`    | array   | []      | List of trusted template sources     |
-| `maxExecutionTime`  | number  | 30000   | Max seconds per command (30s default)|
-| `maxCommandsPerRun` | number  | 50      | Rate limit per init session          |
-| `enableAuditLogging`| boolean | true    | Enable security event logging        |
+| Setting | Type | Default | Description |
+|---------|------|---------|-------------|
+| `securityLevel` | string | `"warn"` | Security enforcement level |
+| `trustedSources` | array | See above | List of trusted template sources |
+| `maxExecutionTime` | number | 30000 | Max milliseconds per command (30s) |
+| `maxCommandsPerRun` | number | 50 | Rate limit per init session |
+| `enableAuditLogging` | boolean | true | Enable security event logging |
+
+## Implementation Details
+
+The security model is implemented in `src/safety.ts` with these key functions:
+
+- `parseShellCommand()` — Splits commands by shell metacharacters, respects quotes/escapes, extracts base command and args
+- `isCommandBlocked(baseCommand, args)` — Checks blocklist with multi-word matching (e.g., `apt remove`) and prefix matching (e.g., `mkfs.ext4` matches `mkfs`)
+- `isDangerousCommand(command)` — Checks dangerous patterns with full-command substring matching for multi-word patterns
+- `checkDestructiveAbsolutePath()` — Detects `rm`/`rmdir`/`del` targeting absolute paths
+- `validateTemplateSecurity()` — Validates all `post_config` tasks in a template
+- `isTrustedSource()` — Checks URL against trusted sources list
+- `canExecute()` — Rate limiting per command hash
+- `logSecurityEvent()` — Writes structured JSON audit entries

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@garyr/pt-cli",
-  "version": "0.40.1",
+  "version": "0.41.0",
   "description": "Project Template CLI - Learn structures and initialize projects",
   "main": "dist/index.js",
   "bin": {

package/skills/agency-pt-operator/SKILL.md

@@ -160,8 +160,8 @@ security:
 
 ### Security Levels
 
-- **`warn`** (default): Warning-based approach with cancellation prompts
-- **`strict`**: More conservative defaults, enabled by default for new installations
+- **`warn`** (default): Warning-based approach with cancellation prompts for dangerous commands
+- **`strict`**: More conservative defaults
 
 ### Trusted Sources
 
@@ -169,20 +169,65 @@ When downloading templates from remote URLs, `pt-cli` verifies the source agains
 
 ### Command Security
 
-- **Absolute blocks**: Commands like `sudo`, `rm -rf`, `dd` are always blocked
-- **Dangerous commands**: Commands like `curl`, `python`, `chmod` trigger warnings
-- **Rate limiting**: 50 commands per run prevents runaway execution
-- **Execution timeout**: 30 seconds per command prevents hung processes
+#### Absolute Blocks (Never Allowed)
+
+The following commands are **always blocked** regardless of security level. The blocklist uses **proper shell parsing** — commands are split by shell metacharacters (`;`, `&`, `|`, `&&`, `||`, etc.), quoted strings are respected, and each sub-command is checked individually. This prevents bypasses like `"sudo" rm -rf /`, `sudo; rm -rf /`, or `mkfs.ext4`.
+
+**Privilege Escalation:** `sudo`, `su`, `su -`, `su root`
+
+**Disk Operations:** `dd`, `mkfs` (and variants like `mkfs.ext4`, `mkfs.xfs`), `fdisk`, `mount`, `umount`
+
+**Dangerous Permissions:** `chmod 777`, `chmod -R 777`, `chmod 666`
+
+**Process Killing:** `kill`, `killall`, `pkill`, `fuser`
+
+**Network Exfiltration:** `nc`, `netcat`, `socat`
+
+**Package Manager (Destructive Operations):** `apt purge`, `apt remove`, `apt-get purge`, `apt-get remove`, `yum remove`, `brew uninstall`
+
+#### Dangerous Commands (Warning + 5-Second Countdown)
+
+The following commands trigger a **5-second countdown** with CTRL+C cancellation. These are allowed but require explicit user confirmation.
+
+**Remote Downloads + Execution:** `curl`, `wget`, `wget -O`, `curl |`, `wget |`
+
+**Script Execution:** `bash`, `sh`, `python`, `python3`, `python2`, `python3.10`, `python3.11`, `python3.12`, `node`, `node -e`, `node -p`, `npm run`, `npx`
+
+**Shell Operations:** `eval`, `exec`, `source`, `.`
+
+**Recursive File Operations:** `chmod -R`, `chown -R`, `chgrp -R`
+
+**PowerShell (Windows):** `powershell`, `pwsh`, `Invoke-Expression`, `IEX`
+
+**macOS-Specific:** `diskutil`, `hdiutil`, `csrutil`
+
+**Destructive File Operations on Absolute Paths:** `rm`, `rmdir`, `del` followed by absolute paths (e.g., `rm -rf /tmp`, `rm /etc/passwd`)
+
+### Rate Limiting
+
+- **50 commands per run**: Prevents runaway command execution (in-memory only, resets each `pt init` session)
+
+### Execution Timeout
+
+- **30 seconds per command**: Prevents hung processes
 
 ### Audit Logging
 
-All security events are logged to `~/.pt/security-audit.log` for monitoring and troubleshooting.
+All security events are logged to `~/.pt/security-audit.log` in JSON format with event types: `command_executed`, `command_blocked`, `command_timed_out`, `template_loaded` and results: `success`, `failed`, `timedout`, `blocked`.
+
+### Bypass Protection
+
+The parser specifically handles these common bypass attempts:
+- Quoted commands: `"sudo" rm -rf /` → detected (quotes stripped)
+- Chained commands: `echo hello; sudo rm -rf /` → detected via metacharacter split
+- Pipeline injection: `curl | bash` → detected as dangerous pattern
+- Multi-word commands: `apt remove`, `mkfs.ext4`, `chmod -R` → properly matched
 
-## Security Testing
+### Security Testing
 
 Security features can be tested by:
 
-1. **Testing command blocks**: Try running templates with dangerous commands like `sudo rm -rf` or `dd`
+1. **Testing command blocks**: Try running templates with dangerous commands like `sudo rm -rf /` or `dd`
 2. **Testing remote downloads**: Use untrusted URLs to verify source verification
 3. **Testing rate limiting**: Execute more than 50 commands in a single init session
 4. **Testing timeouts**: Run commands that hang to verify timeout behavior