@linghun/tui 0.1.0

package/dist/chunk-LHHKPGLX.js

@@ -0,0 +1,903 @@
+// src/permission-policy-engine.ts
+import { isAbsolute, relative, resolve } from "path";
+var SENSITIVE_FILE_BASENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  "provider.env",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  ".pgpass",
+  "credentials",
+  "credentials.json",
+  "id_rsa",
+  "id_ed25519",
+  "id_ecdsa"
+]);
+var SENSITIVE_BASENAME_KEYWORDS = [
+  "secret",
+  "token",
+  "password",
+  "credential",
+  "apikey",
+  "api_key"
+];
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([".ssh", ".gnupg", ".aws", ".azure", ".gcloud"]);
+var COMPOSITION_OPERATORS_REGEX = (
+  // ; && || | > >> < `...` $(...) — we only need to detect *presence*.
+  // Plain quoted strings stay safe; engine errs toward require_permission on match.
+  /[;|&<>`]|\$\(/u
+);
+var ENCODED_OR_NESTED_SHELL_REGEX = /(?:^|\s)(?:powershell|pwsh)(?:\.exe)?\s+.*?(?:-enc(?:odedcommand)?|-e\b)|(?:^|\s)cmd(?:\.exe)?\s+\/c\b|(?:^|\s)(?:bash|sh)\s+-c\b/iu;
+function hasUnquotedSubshell(command) {
+  let inSingle = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (ch === "'" && !inSingle) {
+      inSingle = true;
+      continue;
+    }
+    if (ch === "'" && inSingle) {
+      inSingle = false;
+      continue;
+    }
+    if (inSingle) continue;
+    if (ch === "`") return true;
+    if (ch === "$" && command[i + 1] === "(") return true;
+  }
+  return false;
+}
+var NETWORK_HEADS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "irm",
+  "iwr",
+  "invoke-restmethod",
+  "invoke-webrequest",
+  "scp",
+  "sftp",
+  "ssh",
+  "ftp",
+  "tftp"
+]);
+var INSTALL_PAIRS = [
+  ["npm", /* @__PURE__ */ new Set(["install", "i", "add", "uninstall", "un", "rm", "remove", "ci", "exec"])],
+  ["pnpm", /* @__PURE__ */ new Set(["install", "i", "add", "remove", "rm", "uninstall", "dlx", "exec", "deploy"])],
+  ["yarn", /* @__PURE__ */ new Set(["add", "remove", "install", "global"])],
+  ["bun", /* @__PURE__ */ new Set(["add", "remove", "install", "i", "x"])],
+  ["pip", /* @__PURE__ */ new Set(["install", "uninstall", "wheel", "download"])],
+  ["pip3", /* @__PURE__ */ new Set(["install", "uninstall", "wheel", "download"])],
+  ["pipx", /* @__PURE__ */ new Set(["install", "uninstall", "inject", "upgrade", "run"])],
+  ["uv", /* @__PURE__ */ new Set(["pip", "tool", "add", "remove", "sync"])],
+  ["cargo", /* @__PURE__ */ new Set(["install", "uninstall", "add", "remove"])],
+  ["gem", /* @__PURE__ */ new Set(["install", "uninstall"])],
+  ["go", /* @__PURE__ */ new Set(["install", "get"])],
+  ["brew", /* @__PURE__ */ new Set(["install", "uninstall", "reinstall", "upgrade", "tap"])],
+  ["apt", /* @__PURE__ */ new Set(["install", "remove", "purge", "upgrade", "update"])],
+  ["apt-get", /* @__PURE__ */ new Set(["install", "remove", "purge", "upgrade", "update"])],
+  ["dnf", /* @__PURE__ */ new Set(["install", "remove", "upgrade", "update"])],
+  ["yum", /* @__PURE__ */ new Set(["install", "remove", "upgrade", "update"])],
+  ["choco", /* @__PURE__ */ new Set(["install", "uninstall", "upgrade"])],
+  ["scoop", /* @__PURE__ */ new Set(["install", "uninstall", "update"])],
+  ["winget", /* @__PURE__ */ new Set(["install", "uninstall", "upgrade"])]
+];
+var DESTRUCTIVE_HEADS = /* @__PURE__ */ new Set([
+  "rm",
+  "rmdir",
+  "del",
+  "erase",
+  "remove-item",
+  "rd",
+  "mkfs",
+  "shutdown",
+  "reboot",
+  "halt",
+  "poweroff",
+  "format",
+  "diskpart",
+  "fdisk",
+  "dd",
+  "kill",
+  "taskkill",
+  "pkill"
+]);
+var MUTATING_HEADS = /* @__PURE__ */ new Set([
+  "mv",
+  "move",
+  "cp",
+  "copy",
+  "copy-item",
+  "ren",
+  "rename",
+  "rename-item",
+  "mkdir",
+  "md",
+  "new-item",
+  "touch",
+  "ln",
+  "new-symlink",
+  "set-content",
+  "out-file",
+  "add-content",
+  "clear-content",
+  "chmod",
+  "chown",
+  "icacls",
+  "attrib",
+  "setx",
+  "regedit",
+  "sc"
+]);
+var READONLY_HEADS = /* @__PURE__ */ new Set([
+  "pwd",
+  "ls",
+  "dir",
+  "where",
+  "where.exe",
+  "which",
+  "whoami",
+  "hostname",
+  "echo",
+  "printf",
+  "true",
+  "false",
+  "date",
+  "uptime",
+  "uname",
+  "id",
+  "get-location",
+  "get-childitem",
+  "gci",
+  "get-content",
+  "gc",
+  "get-process",
+  "get-service",
+  "get-date",
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "git",
+  "cargo",
+  "go",
+  "rustc",
+  "docker"
+]);
+var EXECUTABLE_RUNTIME_HEADS = /* @__PURE__ */ new Set([
+  "deno",
+  "python",
+  "python3",
+  "tsc",
+  "javac",
+  "java",
+  "ruby"
+]);
+var ENV_PRINTING_HEADS = /* @__PURE__ */ new Set(["env", "set"]);
+var PATH_READ_HEADS = /* @__PURE__ */ new Set([
+  "cat",
+  "type",
+  "head",
+  "tail",
+  "less",
+  "more",
+  "view",
+  "wc",
+  "get-content",
+  "gc"
+]);
+var GIT_READONLY_SUBS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "show",
+  "diff",
+  "branch",
+  "tag",
+  "shortlog",
+  "reflog",
+  "blame",
+  "rev-parse",
+  "describe",
+  "config",
+  // only when read; we check below for `--unset` / set-style writes
+  "worktree",
+  // worktree list is readonly; add/remove are mutating — check below
+  "remote",
+  // remote -v / remote get-url readonly; add/set-url mutating — check below
+  "stash",
+  // stash list / show readonly; pop/push/drop mutating — check below
+  "ls-files",
+  "ls-tree",
+  "ls-remote"
+]);
+var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V"]);
+function classifyToolRequest(req) {
+  if (req.isDeferred) {
+    return classifyDeferredRequest(req);
+  }
+  switch (req.toolName) {
+    case "Bash":
+      return classifyBashRequest(req);
+    case "Read":
+      return classifyReadRequest(req);
+    case "Write":
+    case "Edit":
+    case "MultiEdit":
+      return {
+        decision: "require_permission",
+        semantic: "mutating",
+        pathSafety: classifyInputPath(req),
+        reason: `${req.toolName} \u8D70\u539F\u6709\u6743\u9650\u6D41\u7A0B\uFF1B\u672C\u5F15\u64CE\u4E0D\u81EA\u52A8\u653E\u884C\u5199\u5165\u3002`,
+        redactedSummary: `${req.toolName} ${redactPathFromInput(req.input)}`
+      };
+    case "Grep":
+    case "Glob":
+    case "Diff":
+    case "Todo":
+      return {
+        decision: "auto_allow_readonly",
+        semantic: "readonly",
+        pathSafety: "workspace_safe",
+        reason: `${req.toolName} \u5728\u5185\u7F6E\u5DE5\u5177\u5B9A\u4E49\u4E2D\u5373\u4E3A\u53EA\u8BFB\uFF1Bengine \u590D\u8FF0\u5176\u5224\u65AD\u3002`,
+        redactedSummary: req.toolName
+      };
+    default:
+      return {
+        decision: "require_permission",
+        semantic: "unknown",
+        pathSafety: "unknown_path",
+        reason: `\u672A\u8BC6\u522B\u7684\u5DE5\u5177 ${req.toolName}\uFF0C\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`,
+        redactedSummary: req.toolName
+      };
+  }
+}
+function classifyBashRequest(req) {
+  const command = readBashCommand(req.input);
+  const redactedSummary = redactBashCommand(command);
+  if (!command.trim()) {
+    return {
+      decision: "require_permission",
+      semantic: "unknown",
+      pathSafety: "unknown_path",
+      reason: "\u7A7A Bash \u547D\u4EE4\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002",
+      redactedSummary
+    };
+  }
+  if (containsBareSensitiveTokenInCommand(command)) {
+    return {
+      decision: "require_permission",
+      semantic: "secret_read",
+      pathSafety: "sensitive_path",
+      reason: "\u547D\u4EE4\u5F15\u7528\u654F\u611F\u8DEF\u5F84\u6216\u5BC6\u94A5\u547D\u540D\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+      redactedSummary
+    };
+  }
+  if (ENV_EXPANSION_REGEX.test(command)) {
+    return {
+      decision: "require_permission",
+      semantic: "secret_read",
+      pathSafety: "unknown_path",
+      reason: "\u547D\u4EE4\u5305\u542B\u73AF\u5883\u53D8\u91CF\u5C55\u5F00\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+      redactedSummary
+    };
+  }
+  if (COMPOSITION_OPERATORS_REGEX.test(command) || ENCODED_OR_NESTED_SHELL_REGEX.test(command)) {
+    if (ENCODED_OR_NESTED_SHELL_REGEX.test(command)) {
+      return {
+        decision: "require_permission",
+        semantic: "unknown",
+        pathSafety: "unknown_path",
+        reason: "\u547D\u4EE4\u542B\u5D4C\u5957 shell / \u7F16\u7801\u547D\u4EE4\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+        redactedSummary
+      };
+    }
+    if (hasUnquotedSubshell(command)) {
+      return {
+        decision: "require_permission",
+        semantic: "unknown",
+        pathSafety: "unknown_path",
+        reason: "\u547D\u4EE4\u542B\u5B50 shell \u6267\u884C\uFF08$() / \u53CD\u5F15\u53F7\uFF09\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+        redactedSummary
+      };
+    }
+    const compound = classifyCompoundCommand(command, req.workspaceRoot);
+    if (compound.aggregateDecision === "auto_allow_readonly") {
+      return {
+        decision: "auto_allow_readonly",
+        semantic: "readonly",
+        pathSafety: "workspace_safe",
+        reason: "\u7BA1\u9053/\u94FE\u5F0F\u547D\u4EE4\u5404\u6BB5\u5747\u4E3A\u53EA\u8BFB\uFF1B\u81EA\u52A8\u653E\u884C\u3002",
+        redactedSummary
+      };
+    }
+    return {
+      decision: "require_permission",
+      semantic: "unknown",
+      pathSafety: "unknown_path",
+      reason: compound.riskySummary ? `\u547D\u4EE4\u542B\u975E\u53EA\u8BFB\u6BB5\uFF1A${compound.riskySummary}\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002` : "\u547D\u4EE4\u542B\u7EC4\u5408\u7B26 / \u91CD\u5B9A\u5411\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+      redactedSummary
+    };
+  }
+  const tokens = tokenizeShellCommand(command);
+  if (tokens.length === 0) {
+    return {
+      decision: "require_permission",
+      semantic: "unknown",
+      pathSafety: "unknown_path",
+      reason: "\u65E0\u6CD5\u89E3\u6790 Bash \u547D\u4EE4 token\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002",
+      redactedSummary
+    };
+  }
+  const head = tokens[0]?.toLowerCase() ?? "";
+  const args = tokens.slice(1);
+  const semantic = classifyBashHead(head, args);
+  const stableSummary = head === "git" ? buildStableGitSummary(args) : null;
+  const finalSummary = stableSummary ?? redactedSummary;
+  if (semantic === "readonly") {
+    if (head === "node") {
+      const scriptArg = getSafeNodeLocalScriptArg(args);
+      if (scriptArg) {
+        const pathSafety = classifyPathString(scriptArg, req.workspaceRoot);
+        if (pathSafety !== "workspace_safe") {
+          return {
+            decision: "require_permission",
+            semantic: pathSafety === "sensitive_path" ? "secret_read" : "outside_workspace",
+            pathSafety,
+            reason: "node \u672C\u5730\u811A\u672C\u8DEF\u5F84\u4E0D\u5728\u5DE5\u4F5C\u533A\u666E\u901A\u6587\u4EF6\u8303\u56F4\u5185\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+            redactedSummary
+          };
+        }
+      }
+    }
+    if (PATH_READ_HEADS.has(head)) {
+      const pathArgs = getPathReadArgs(head, args);
+      if (pathArgs.length > 0) {
+        const pathSafeties = pathArgs.map((arg) => classifyPathString(arg, req.workspaceRoot));
+        const unsafePathSafety = pathSafeties.find((pathSafety) => pathSafety === "sensitive_path") ?? pathSafeties.find((pathSafety) => pathSafety !== "workspace_safe");
+        if (!unsafePathSafety) {
+          return {
+            decision: "auto_allow_readonly",
+            semantic: "readonly",
+            pathSafety: "workspace_safe",
+            reason: `${head} \u8BFB\u53D6\u5DE5\u4F5C\u533A\u5185\u6587\u4EF6\uFF0C\u81EA\u52A8\u653E\u884C\u3002`,
+            redactedSummary
+          };
+        }
+        return {
+          decision: "require_permission",
+          semantic: unsafePathSafety === "sensitive_path" ? "secret_read" : "outside_workspace",
+          pathSafety: unsafePathSafety,
+          reason: unsafePathSafety === "sensitive_path" ? `${head} \u547D\u4E2D\u654F\u611F\u8DEF\u5F84\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002` : `${head} \u8DEF\u5F84\u5728\u5DE5\u4F5C\u533A\u5916\u6216\u65E0\u6CD5\u5224\u5B9A\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002`,
+          redactedSummary
+        };
+      }
+      if (head === "wc") {
+        return {
+          decision: "require_permission",
+          semantic: "unknown",
+          pathSafety: "unknown_path",
+          reason: "wc \u672A\u63D0\u4F9B\u53EF\u5224\u5B9A\u7684\u5DE5\u4F5C\u533A\u6587\u4EF6\u8DEF\u5F84\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+          redactedSummary
+        };
+      }
+    }
+    return {
+      decision: "auto_allow_readonly",
+      semantic: "readonly",
+      pathSafety: "workspace_safe",
+      reason: `${head} \u662F\u53EA\u8BFB\u547D\u4EE4\uFF1B\u81EA\u52A8\u653E\u884C\u3002`,
+      redactedSummary
+    };
+  }
+  return {
+    decision: "require_permission",
+    semantic,
+    pathSafety: "unknown_path",
+    reason: bashReasonFor(semantic, head),
+    redactedSummary: finalSummary
+  };
+}
+function getPathReadArgs(head, args) {
+  const pathArgs = args.filter((arg) => !arg.startsWith("-"));
+  if (head === "wc") return pathArgs;
+  const firstPath = pathArgs[0];
+  return firstPath ? [firstPath] : [];
+}
+function buildStableGitSummary(args) {
+  const sub = args.find((a) => !a.startsWith("-"))?.toLowerCase() ?? "";
+  if (!sub) return "git";
+  if (sub === "worktree" || sub === "remote" || sub === "stash" || sub === "config") {
+    const verb = args.filter((a) => !a.startsWith("-"))[1]?.toLowerCase();
+    return verb ? `git ${sub} ${verb}` : `git ${sub}`;
+  }
+  return `git ${sub}`;
+}
+function bashReasonFor(semantic, head) {
+  switch (semantic) {
+    case "destructive":
+      return `${head} \u5C5E\u4E8E\u7834\u574F\u6027\u547D\u4EE4\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    case "network":
+      return `${head} \u4F1A\u53D1\u8D77\u7F51\u7EDC\u8BBF\u95EE\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    case "install":
+      return `${head} \u4F1A\u5B89\u88C5/\u5378\u8F7D\u6216\u62C9\u53D6\u4F9D\u8D56\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    case "mutating":
+      return `${head} \u4F1A\u6539\u5199\u672C\u5730\u6587\u4EF6\u6216\u7CFB\u7EDF\u72B6\u6001\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    case "secret_read":
+      return `${head} \u89E6\u53CA\u654F\u611F\u6570\u636E\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    case "outside_workspace":
+      return `${head} \u8D8A\u754C\u8BBF\u95EE\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+    default:
+      return `${head} \u5F53\u524D\u672A\u5217\u5165\u53EA\u8BFB\u767D\u540D\u5355\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002`;
+  }
+}
+function classifyBashHead(head, args) {
+  if (DESTRUCTIVE_HEADS.has(head)) return "destructive";
+  if (MUTATING_HEADS.has(head)) return "mutating";
+  if (NETWORK_HEADS.has(head)) return "network";
+  if (ENV_PRINTING_HEADS.has(head)) {
+    return "secret_read";
+  }
+  if (head === "echo" || head === "printf") {
+    return classifyEchoPrintf(args);
+  }
+  if (head === "git") {
+    return classifyGitSubcommand(args);
+  }
+  if (head === "gh") {
+    return "network";
+  }
+  if (head === "docker") {
+    return classifyDockerSubcommand(args);
+  }
+  if (isVersionQuery(args)) return "readonly";
+  if (head === "node") {
+    return classifyNodeSubcommand(args);
+  }
+  if (EXECUTABLE_RUNTIME_HEADS.has(head)) {
+    return "unknown";
+  }
+  for (const [pkgHead, verbs] of INSTALL_PAIRS) {
+    if (head === pkgHead) {
+      const verb = args.find((a) => !a.startsWith("-"))?.toLowerCase();
+      if (verb && verbs.has(verb)) return "install";
+      return "unknown";
+    }
+  }
+  if (PATH_READ_HEADS.has(head)) return "readonly";
+  if (READONLY_HEADS.has(head)) return "readonly";
+  return "unknown";
+}
+function classifyNodeSubcommand(args) {
+  if (args.length === 0) return "readonly";
+  if (isVersionQuery(args)) return "readonly";
+  if (args.some((arg) => arg === "-e" || arg === "--eval")) return "unknown";
+  if (getSafeNodeLocalScriptArg(args)) return "readonly";
+  return "unknown";
+}
+function getSafeNodeLocalScriptArg(args) {
+  const script = args[0];
+  if (!script) return void 0;
+  if (script.startsWith("-")) return void 0;
+  const normalized = script.replaceAll("\\", "/");
+  if (!/\.(?:mjs|cjs|js)$/iu.test(normalized)) return void 0;
+  if (!/^(?:test|tests|scripts)\//iu.test(normalized)) return void 0;
+  return script;
+}
+function classifyGitSubcommand(args) {
+  const sub = args.find((a) => !a.startsWith("-"))?.toLowerCase();
+  if (!sub) return "readonly";
+  if (!GIT_READONLY_SUBS.has(sub)) return "unknown";
+  if (sub === "config") {
+    const setLike = args.some(
+      (a) => [
+        "--unset",
+        "--unset-all",
+        "--add",
+        "--replace-all",
+        "--rename-section",
+        "--remove-section"
+      ].includes(a)
+    );
+    return setLike ? "mutating" : "readonly";
+  }
+  if (sub === "worktree") {
+    const verb = args.filter((a) => !a.startsWith("-"))[1]?.toLowerCase();
+    return verb && verb !== "list" ? "mutating" : "readonly";
+  }
+  if (sub === "remote") {
+    const verb = args.filter((a) => !a.startsWith("-"))[1]?.toLowerCase();
+    if (!verb || verb === "show" || verb === "get-url") return "readonly";
+    return "mutating";
+  }
+  if (sub === "stash") {
+    const verb = args.filter((a) => !a.startsWith("-"))[1]?.toLowerCase();
+    if (!verb || verb === "list" || verb === "show") return "readonly";
+    return "mutating";
+  }
+  return "readonly";
+}
+function classifyDockerSubcommand(args) {
+  const sub = args.find((a) => !a.startsWith("-"))?.toLowerCase();
+  if (!sub) return "readonly";
+  if (["ps", "images", "version", "info"].includes(sub)) {
+    return "readonly";
+  }
+  if (sub === "image") {
+    const verb = args.filter((a) => !a.startsWith("-"))[1]?.toLowerCase();
+    return !verb || verb === "ls" || verb === "list" ? "readonly" : "unknown";
+  }
+  return "unknown";
+}
+var ENV_EXPANSION_REGEX = /\$\{?[A-Za-z_][\w:]*\}?|%[A-Za-z_][\w]*%/u;
+var ECHO_SENSITIVE_KEYWORDS = [
+  "secret",
+  "token",
+  "password",
+  "credential",
+  "api_key",
+  "apikey",
+  // Standalone "key" as a whole word — e.g. `echo $key` after we already
+  // catch $key, but also covers `echo my_key value`. Boundary-checked so
+  // benign strings like "monkey" don't trip.
+  "key"
+];
+function classifyEchoPrintf(args) {
+  for (const arg of args) {
+    if (ENV_EXPANSION_REGEX.test(arg)) return "secret_read";
+    if (containsSensitiveEchoKeyword(arg)) return "secret_read";
+  }
+  return "readonly";
+}
+function containsSensitiveEchoKeyword(arg) {
+  const lower = arg.toLowerCase();
+  for (const kw of ECHO_SENSITIVE_KEYWORDS) {
+    const re = new RegExp(`(?:^|[^a-z0-9_])${kw}(?:$|[^a-z0-9_])`, "iu");
+    if (re.test(lower)) return true;
+  }
+  return false;
+}
+function isVersionQuery(args) {
+  return args.length > 0 && args.every((a) => VERSION_FLAGS.has(a) || !a.startsWith("-")) ? args.some((a) => VERSION_FLAGS.has(a)) : false;
+}
+function classifyReadRequest(req) {
+  const path = readStringField(req.input, "path");
+  if (!path) {
+    return {
+      decision: "require_permission",
+      semantic: "unknown",
+      pathSafety: "unknown_path",
+      reason: "Read \u7F3A\u5C11 path \u5B57\u6BB5\uFF1B\u4FDD\u5B88\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002",
+      redactedSummary: "Read"
+    };
+  }
+  const pathSafety = classifyPathString(path, req.workspaceRoot);
+  if (pathSafety === "workspace_safe") {
+    return {
+      decision: "auto_allow_readonly",
+      semantic: "readonly",
+      pathSafety,
+      reason: "Read \u5DE5\u4F5C\u533A\u5185\u666E\u901A\u6587\u4EF6\uFF1B\u81EA\u52A8\u653E\u884C\u3002",
+      redactedSummary: `Read ${redactPathForSummary(path, req.workspaceRoot)}`
+    };
+  }
+  return {
+    decision: "require_permission",
+    semantic: pathSafety === "sensitive_path" ? "secret_read" : "outside_workspace",
+    pathSafety,
+    reason: pathSafety === "sensitive_path" ? "Read \u547D\u4E2D\u654F\u611F\u8DEF\u5F84\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002" : "Read \u8DEF\u5F84\u5728\u5DE5\u4F5C\u533A\u5916\u6216\u65E0\u6CD5\u5224\u5B9A\uFF1B\u4E0D\u81EA\u52A8\u653E\u884C\u3002",
+    redactedSummary: `Read ${redactPathForSummary(path, req.workspaceRoot)}`
+  };
+}
+function classifyDeferredRequest(req) {
+  if (req.manifestReadOnly) {
+    return {
+      decision: "auto_allow_readonly",
+      semantic: "readonly",
+      pathSafety: "workspace_safe",
+      reason: "deferred \u5DE5\u5177 manifest \u58F0\u660E\u53EA\u8BFB\uFF1B\u81EA\u52A8\u653E\u884C\u3002",
+      redactedSummary: redactDeferredSummary(req.toolName)
+    };
+  }
+  return {
+    decision: "require_permission",
+    semantic: "unknown",
+    pathSafety: "unknown_path",
+    reason: "deferred / MCP / ExecuteExtraTool \u9ED8\u8BA4\u8981\u6C42\u6743\u9650\u786E\u8BA4\u3002",
+    redactedSummary: redactDeferredSummary(req.toolName)
+  };
+}
+function classifyPathString(pathArg, workspaceRoot) {
+  if (!pathArg) return "unknown_path";
+  if (pathArg.startsWith("\\\\") || pathArg.startsWith("//") || /@SSL@\d+|@\d+@SSL/i.test(pathArg)) {
+    return "outside_workspace";
+  }
+  if (pathArg.includes("..")) {
+  }
+  const absolute = isAbsolute(pathArg) ? pathArg : resolve(workspaceRoot, pathArg);
+  const lower = absolute.toLowerCase();
+  const basename = lower.split(/[\\/]/).pop() ?? "";
+  if (SENSITIVE_FILE_BASENAMES.has(basename)) return "sensitive_path";
+  if (basename.startsWith(".env.")) return "sensitive_path";
+  for (const kw of SENSITIVE_BASENAME_KEYWORDS) {
+    if (basename.includes(kw)) return "sensitive_path";
+  }
+  const segments = lower.split(/[\\/]+/);
+  for (const seg of segments) {
+    if (SENSITIVE_DIR_SEGMENTS.has(seg)) return "sensitive_path";
+  }
+  if (segments.includes(".linghun") && (basename === "provider.env" || basename.endsWith(".env"))) {
+    return "sensitive_path";
+  }
+  const rel = relative(resolve(workspaceRoot), absolute);
+  if (!rel || rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+    return rel === "" ? "workspace_safe" : "outside_workspace";
+  }
+  return "workspace_safe";
+}
+function classifyInputPath(req) {
+  const path = readStringField(req.input, "path");
+  if (!path) return "unknown_path";
+  return classifyPathString(path, req.workspaceRoot);
+}
+function readBashCommand(input) {
+  if (input && typeof input === "object" && "command" in input) {
+    const value = input.command;
+    if (typeof value === "string") return value;
+  }
+  return "";
+}
+function readStringField(input, field) {
+  if (input && typeof input === "object" && field in input) {
+    const value = input[field];
+    if (typeof value === "string") return value;
+  }
+  return "";
+}
+function tokenizeShellCommand(input) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < input.length; i += 1) {
+    const ch = input[i] ?? "";
+    if (ch === "\\" && quote !== "'" && i + 1 < input.length) {
+      const next = input[i + 1] ?? "";
+      if (/[\s"'`$#\\]/u.test(next)) {
+        cur += next;
+        i += 1;
+        continue;
+      }
+      cur += ch;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else {
+        cur += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/u.test(ch)) {
+      if (cur.length > 0) {
+        out.push(cur);
+        cur = "";
+      }
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur.length > 0) out.push(cur);
+  return out;
+}
+function containsBareSensitiveTokenInCommand(command) {
+  const lower = command.toLowerCase();
+  if (lower.includes("provider.env")) return true;
+  if (/(?:^|[\s\\/])\.env(?:[\s$.]|\.[\w-]+)/u.test(lower)) return true;
+  if (/(?:^|[\\/.])\.ssh[\\/]/u.test(lower)) return true;
+  for (const kw of SENSITIVE_BASENAME_KEYWORDS) {
+    const re = new RegExp(`(?:^|[\\s/\\\\])[\\w./-]*${kw}[\\w./-]*`, "iu");
+    if (re.test(lower)) return true;
+  }
+  return false;
+}
+function redactBashCommand(command) {
+  if (!command) return "Bash";
+  let out = command.length > 200 ? `${command.slice(0, 200)}\u2026` : command;
+  out = out.replace(/(=)([\w./+=-]{12,})/gu, "$1***").replace(/\b(?:sk|pk|api|token)[-_][\w.-]{6,}/giu, "***").replace(/\bBearer\s+[\w.-]+/giu, "Bearer ***");
+  out = out.replace(/\S+/gu, (token) => maskTokenIfSensitive(token));
+  return out;
+}
+function maskTokenIfSensitive(token) {
+  const stripped = token.replace(/^["']|["']$/gu, "");
+  const lower = stripped.toLowerCase();
+  const basename = lower.split(/[\\/]/).pop() ?? "";
+  if (SENSITIVE_FILE_BASENAMES.has(basename) || basename.startsWith(".env.") || SENSITIVE_BASENAME_KEYWORDS.some((kw) => basename.includes(kw))) {
+    return "(sensitive)";
+  }
+  if (ENV_EXPANSION_REGEX.test(stripped)) return "(sensitive)";
+  if (containsSensitiveEchoKeyword(stripped)) return "(sensitive)";
+  for (const seg of SENSITIVE_DIR_SEGMENTS) {
+    const re = new RegExp(`(?:^|[\\\\/])${seg.replace(/\./gu, "\\.")}(?:[\\\\/]|$)`, "iu");
+    if (re.test(lower)) return "(sensitive)";
+  }
+  return token;
+}
+function redactPathFromInput(input) {
+  const path = readStringField(input, "path");
+  if (!path) return "(no path)";
+  return redactPathForSummary(path, "");
+}
+function redactPathForSummary(pathArg, workspaceRoot) {
+  const lower = pathArg.toLowerCase();
+  const basename = lower.split(/[\\/]/).pop() ?? "";
+  if (SENSITIVE_FILE_BASENAMES.has(basename) || basename.startsWith(".env.") || SENSITIVE_BASENAME_KEYWORDS.some((kw) => basename.includes(kw))) {
+    return "(sensitive)";
+  }
+  if (workspaceRoot && isAbsolute(pathArg)) {
+    const rel = relative(resolve(workspaceRoot), pathArg);
+    if (rel && !rel.startsWith("..")) return rel.replaceAll("\\", "/");
+    return basename || "(outside workspace)";
+  }
+  return pathArg.length > 80 ? `${pathArg.slice(0, 80)}\u2026` : pathArg;
+}
+function redactDeferredSummary(toolName) {
+  return toolName.length > 64 ? `${toolName.slice(0, 64)}\u2026` : toolName;
+}
+
+// src/bash-subcommand-parser.ts
+function parseCompoundCommand(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  let parenDepth = 0;
+  let i = 0;
+  function pushSegment(operator) {
+    const trimmed2 = current.trim();
+    if (trimmed2.length > 0) {
+      segments.push({ command: trimmed2, operator, index: segments.length });
+    }
+    current = "";
+  }
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "\\" && quote !== "'" && i + 1 < command.length) {
+      current += ch + command[i + 1];
+      i += 2;
+      continue;
+    }
+    if (quote) {
+      current += ch;
+      if (ch === quote) {
+        quote = null;
+      }
+      i += 1;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      current += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === "$" && command[i + 1] === "(") {
+      parenDepth += 1;
+      current += "$(";
+      i += 2;
+      continue;
+    }
+    if (ch === ")" && parenDepth > 0) {
+      parenDepth -= 1;
+      current += ch;
+      i += 1;
+      continue;
+    }
+    if (parenDepth > 0) {
+      current += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === "&" && command[i + 1] === "&") {
+      pushSegment("&&");
+      i += 2;
+      continue;
+    }
+    if (ch === "|" && command[i + 1] === "|") {
+      pushSegment("||");
+      i += 2;
+      continue;
+    }
+    if (ch === "|") {
+      pushSegment("|");
+      i += 1;
+      continue;
+    }
+    if (ch === ";") {
+      pushSegment(";");
+      i += 1;
+      continue;
+    }
+    current += ch;
+    i += 1;
+  }
+  const trimmed = current.trim();
+  if (trimmed.length > 0) {
+    segments.push({ command: trimmed, operator: null, index: segments.length });
+  }
+  return segments;
+}
+function hasOutputRedirect(segment) {
+  let stripped = "";
+  let quote = null;
+  for (let i = 0; i < segment.length; i += 1) {
+    const ch = segment[i];
+    if (ch === "\\" && quote !== "'" && i + 1 < segment.length) {
+      if (!quote) stripped += ch + segment[i + 1];
+      i += 1;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    stripped += ch;
+  }
+  return /(?<![<])\d*>/u.test(stripped);
+}
+function classifyCompoundCommand(command, _workspacePath) {
+  const parsed = parseCompoundCommand(command);
+  if (parsed.length === 0) {
+    return {
+      segments: [],
+      aggregateDecision: "require_permission",
+      riskySummary: "empty command"
+    };
+  }
+  const classified = [];
+  let aggregateDecision = "auto_allow_readonly";
+  let riskySummary;
+  for (const seg of parsed) {
+    const tokens = tokenizeShellCommand(seg.command);
+    const head = (tokens[0] ?? "").toLowerCase();
+    const args = tokens.slice(1);
+    let semanticClass;
+    if (head.length === 0) {
+      semanticClass = "unknown";
+    } else {
+      semanticClass = classifyBashHead(head, args);
+    }
+    if (semanticClass === "readonly" && hasOutputRedirect(seg.command)) {
+      semanticClass = "mutating";
+    }
+    const decision = semanticClass === "readonly" ? "auto_allow_readonly" : "require_permission";
+    classified.push({
+      segment: seg,
+      headToken: head,
+      semanticClass,
+      decision
+    });
+    if (decision === "require_permission" && aggregateDecision === "auto_allow_readonly") {
+      aggregateDecision = "require_permission";
+      riskySummary = `segment ${seg.index}: ${head || "<empty>"} is ${semanticClass}`;
+    }
+  }
+  return {
+    segments: classified,
+    aggregateDecision,
+    riskySummary
+  };
+}
+
+export {
+  parseCompoundCommand,
+  classifyCompoundCommand,
+  classifyToolRequest,
+  classifyBashHead,
+  classifyPathString,
+  tokenizeShellCommand
+};