@machina.ai/cell-cli-core 1.38.1-rc2 → 1.40.1-rc2

package/dist/src/tools/shell.test.js

@@ -61,6 +61,7 @@ describe('ShellTool', () => {
     let mockShellOutputCallback;
     let resolveExecutionPromise;
     let tempRootDir;
+    let extractedTmpFile;
     beforeEach(() => {
         vi.clearAllMocks();
         tempRootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-test-'));
@@ -146,9 +147,14 @@ describe('ShellTool', () => {
         vi.mocked(crypto.randomBytes).mockReturnValue(Buffer.from('abcdef', 'hex'));
         process.env['ComSpec'] =
             'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+        extractedTmpFile = '';
         // Capture the output callback to simulate streaming events from the service
-        mockShellExecutionService.mockImplementation((_cmd, _cwd, callback) => {
+        mockShellExecutionService.mockImplementation((cmd, _cwd, callback) => {
             mockShellOutputCallback = callback;
+            const match = cmd.match(/pgrep -g 0 >([^ ]+)/);
+            if (match) {
+                extractedTmpFile = match[1].replace(/['"]/g, '');
+            }
             return {
                 pid: 12345,
                 result: new Promise((resolve) => {
@@ -226,39 +232,33 @@ describe('ShellTool', () => {
         };
         it('should wrap command on linux and parse pgrep output', async () => {
             const invocation = shellTool.build({ command: 'my-command &' });
-            const promise = invocation.execute(mockAbortSignal);
-            resolveShellExecution({ pid: 54321 });
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             // Simulate pgrep output file creation by the shell command
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            fs.writeFileSync(tmpFile, `54321${os.EOL}54322${os.EOL}`);
+            fs.writeFileSync(extractedTmpFile, `54321${os.EOL}54322${os.EOL}`);
+            resolveShellExecution({ pid: 54321 });
             const result = await promise;
-            const wrappedCommand = `(\n${'my-command &'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
             }));
             expect(result.llmContent).toContain('Background PIDs: 54322');
             // The file should be deleted by the tool
-            expect(fs.existsSync(tmpFile)).toBe(false);
+            expect(fs.existsSync(extractedTmpFile)).toBe(false);
         });
         it('should add a space when command ends with a backslash to prevent escaping newline', async () => {
             const invocation = shellTool.build({ command: 'ls\\' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\nls\\ \n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
         });
         it('should handle trailing comments correctly by placing them on their own line', async () => {
             const invocation = shellTool.build({ command: 'ls # comment' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\nls # comment\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
         });
         it('should use the provided absolute directory as cwd', async () => {
             const subdir = path.join(tempRootDir, 'subdir');
@@ -266,12 +266,10 @@ describe('ShellTool', () => {
                 command: 'ls',
                 dir_path: subdir,
             });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\n${'ls'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, subdir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), subdir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
@@ -282,12 +280,10 @@ describe('ShellTool', () => {
                 command: 'ls',
                 dir_path: 'subdir',
             });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\n${'ls'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, path.join(tempRootDir, 'subdir'), expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), path.join(tempRootDir, 'subdir'), expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
@@ -299,7 +295,7 @@ describe('ShellTool', () => {
                 command: 'sleep 10',
                 is_background: true,
             });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             // We need to provide a PID for the background logic to trigger
             resolveShellExecution({ pid: 12345 });
             // Advance time to trigger the background timeout
@@ -310,7 +306,7 @@ describe('ShellTool', () => {
         itWindowsOnly('should not wrap command on windows', async () => {
             mockPlatform.mockReturnValue('win32');
             const invocation = shellTool.build({ command: 'dir' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({
                 rawOutput: Buffer.from(''),
                 output: '',
@@ -328,10 +324,21 @@ describe('ShellTool', () => {
                 sandboxManager: expect.any(NoopSandboxManager),
             }));
         }, 20000);
+        it('should correctly wrap heredoc commands', async () => {
+            const command = `cat << 'EOF'
+hello world
+EOF`;
+            const invocation = shellTool.build({ command });
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
+            resolveShellExecution();
+            await promise;
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService.mock.calls[0][0]).toMatch(/\nEOF\n\)\n/);
+        });
         it('should format error messages correctly', async () => {
             const error = new Error('wrapped command failed');
             const invocation = shellTool.build({ command: 'user-command' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({
                 error,
                 exitCode: 1,
@@ -349,7 +356,7 @@ describe('ShellTool', () => {
         it('should return a SHELL_EXECUTE_ERROR for a command failure', async () => {
             const error = new Error('command failed');
             const invocation = shellTool.build({ command: 'user-command' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({
                 error,
                 exitCode: 1,
@@ -368,7 +375,7 @@ describe('ShellTool', () => {
             });
             vi.mocked(summarizer.summarizeToolOutput).mockResolvedValue('summarized output');
             const invocation = shellTool.build({ command: 'ls' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveExecutionPromise({
                 output: 'long output',
                 rawOutput: Buffer.from('long output'),
@@ -389,7 +396,7 @@ describe('ShellTool', () => {
             mockConfig.getShellToolInactivityTimeout.mockReturnValue(0);
             vi.useFakeTimers();
             const invocation = shellTool.build({ command: 'sleep 10' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             // Verify no timeout logic is triggered even after a long time
             resolveShellExecution({
                 output: 'finished',
@@ -403,16 +410,18 @@ describe('ShellTool', () => {
         });
         it('should clean up the temp file on synchronous execution error', async () => {
             const error = new Error('sync spawn error');
-            mockShellExecutionService.mockImplementation(() => {
-                // Create the temp file before throwing to simulate it being left behind
-                const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-                fs.writeFileSync(tmpFile, '');
+            mockShellExecutionService.mockImplementation((cmd) => {
+                const match = cmd.match(/pgrep -g 0 >([^ ]+)/);
+                if (match) {
+                    extractedTmpFile = match[1].replace(/['"]/g, ''); // remove any quotes if present
+                    // Create the temp file before throwing to simulate it being left behind
+                    fs.writeFileSync(extractedTmpFile, '');
+                }
                 throw error;
             });
             const invocation = shellTool.build({ command: 'a-command' });
-            await expect(invocation.execute(mockAbortSignal)).rejects.toThrow(error);
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            expect(fs.existsSync(tmpFile)).toBe(false);
+            await expect(invocation.execute({ abortSignal: mockAbortSignal })).rejects.toThrow(error);
+            expect(fs.existsSync(extractedTmpFile)).toBe(false);
         });
         it('should not log "missing pgrep output" when process is backgrounded', async () => {
             vi.useFakeTimers();
@@ -421,7 +430,7 @@ describe('ShellTool', () => {
                 command: 'sleep 10',
                 is_background: true,
             });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             // Advance time to trigger backgrounding
             await vi.advanceTimersByTimeAsync(200);
             await promise;
@@ -438,7 +447,10 @@ describe('ShellTool', () => {
             });
             it('should immediately show binary detection message and throttle progress', async () => {
                 const invocation = shellTool.build({ command: 'cat img' });
-                const promise = invocation.execute(mockAbortSignal, updateOutputMock);
+                const promise = invocation.execute({
+                    abortSignal: mockAbortSignal,
+                    updateOutput: updateOutputMock,
+                });
                 mockShellOutputCallback({ type: 'binary_detected' });
                 expect(updateOutputMock).toHaveBeenCalledOnce();
                 expect(updateOutputMock).toHaveBeenCalledWith('[Binary output detected. Halting stream...]');
@@ -474,7 +486,10 @@ describe('ShellTool', () => {
                     command: 'sleep 10',
                     is_background: true,
                 });
-                const promise = invocation.execute(mockAbortSignal, updateOutputMock);
+                const promise = invocation.execute({
+                    abortSignal: mockAbortSignal,
+                    updateOutput: updateOutputMock,
+                });
                 mockShellOutputCallback({ type: 'data', chunk: 'some output' });
                 expect(updateOutputMock).not.toHaveBeenCalled();
                 // We need to provide a PID for the background logic to trigger
@@ -549,6 +564,41 @@ describe('ShellTool', () => {
             const shellTool = new ShellTool(mockConfig, createMockMessageBus());
             expect(shellTool.description).not.toContain('Efficiency Guidelines:');
         });
+        it('should return the command if description is not provided', () => {
+            const invocation = shellTool.build({
+                command: 'echo "hello"',
+            });
+            expect(invocation.getDescription()).toBe('echo "hello"');
+        });
+        it('should return the command if it is short (<= 150 chars), even if description is provided', () => {
+            const invocation = shellTool.build({
+                command: 'echo "hello"',
+                description: 'Prints a friendly greeting.',
+            });
+            expect(invocation.getDescription()).toBe('echo "hello"');
+        });
+        it('should return the description if the command is long (> 150 chars)', () => {
+            const longCommand = 'echo "hello" && '.repeat(15) + 'echo "world"'; // Length > 150
+            const invocation = shellTool.build({
+                command: longCommand,
+                description: 'Prints multiple greetings.',
+            });
+            expect(invocation.getDescription()).toBe('Prints multiple greetings.');
+        });
+        it('should return the raw command if description is an empty string', () => {
+            const invocation = shellTool.build({
+                command: 'echo hello',
+                description: '',
+            });
+            expect(invocation.getDescription()).toBe('echo hello');
+        });
+        it('should return the raw command if description is just whitespace', () => {
+            const invocation = shellTool.build({
+                command: 'echo hello',
+                description: '   ',
+            });
+            expect(invocation.getDescription()).toBe('echo hello');
+        });
     });
     describe('getDisplayTitle and getExplanation', () => {
         it('should return only the command for getDisplayTitle', () => {
@@ -576,29 +626,6 @@ describe('ShellTool', () => {
             expect(invocation.getExplanation?.()).toBe(`[current working directory ${process.cwd()}]`);
         });
     });
-    describe('invocation getDescription', () => {
-        it('should return the description if it is present and not empty whitespace', () => {
-            const invocation = shellTool.build({
-                command: 'echo hello',
-                description: 'prints hello',
-            });
-            expect(invocation.getDescription()).toBe('prints hello');
-        });
-        it('should return the raw command if description is an empty string', () => {
-            const invocation = shellTool.build({
-                command: 'echo hello',
-                description: '',
-            });
-            expect(invocation.getDescription()).toBe('echo hello');
-        });
-        it('should return the raw command if description is just whitespace', () => {
-            const invocation = shellTool.build({
-                command: 'echo hello',
-                description: '   ',
-            });
-            expect(invocation.getDescription()).toBe('echo hello');
-        });
-    });
     describe('llmContent output format', () => {
         const mockAbortSignal = new AbortController().signal;
         const resolveShellExecution = (result = {}) => {
@@ -617,42 +644,42 @@ describe('ShellTool', () => {
         };
         it('should not include Command in output', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0 });
             const result = await promise;
             expect(result.llmContent).not.toContain('Command:');
         });
         it('should not include Directory in output', async () => {
             const invocation = shellTool.build({ command: 'ls', dir_path: 'subdir' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'file.txt', exitCode: 0 });
             const result = await promise;
             expect(result.llmContent).not.toContain('Directory:');
         });
         it('should not include Exit Code when command succeeds (exit code 0)', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0 });
             const result = await promise;
             expect(result.llmContent).not.toContain('Exit Code:');
         });
         it('should include Exit Code when command fails (non-zero exit code)', async () => {
             const invocation = shellTool.build({ command: 'false' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: '', exitCode: 1 });
             const result = await promise;
             expect(result.llmContent).toContain('Exit Code: 1');
         });
         it('should not include Error when there is no process error', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0, error: null });
             const result = await promise;
             expect(result.llmContent).not.toContain('Error:');
         });
         it('should include Error when there is a process error', async () => {
             const invocation = shellTool.build({ command: 'bad-command' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({
                 output: '',
                 exitCode: 1,
@@ -663,14 +690,14 @@ describe('ShellTool', () => {
         });
         it('should not include Signal when there is no signal', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0, signal: null });
             const result = await promise;
             expect(result.llmContent).not.toContain('Signal:');
         });
         it('should include Signal when process was killed by signal', async () => {
             const invocation = shellTool.build({ command: 'sleep 100' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({
                 output: '',
                 exitCode: null,
@@ -681,21 +708,21 @@ describe('ShellTool', () => {
         });
         it('should not include Background PIDs when there are none', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0 });
             const result = await promise;
             expect(result.llmContent).not.toContain('Background PIDs:');
         });
         it('should not include Process Group PGID when pid is not set', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0, pid: undefined });
             const result = await promise;
             expect(result.llmContent).not.toContain('Process Group PGID:');
         });
         it('should have minimal output for successful command', async () => {
             const invocation = shellTool.build({ command: 'echo hello' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution({ output: 'hello', exitCode: 0, pid: undefined });
             const result = await promise;
             // Should only contain Output field
@@ -759,7 +786,7 @@ describe('ShellTool', () => {
             };
             mockSandboxManager = sandboxManager;
             const invocation = shellTool.build({ command: 'npm install' });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveExecutionPromise({
                 exitCode: 1,
                 output: 'npm error code EPERM',
@@ -809,7 +836,7 @@ describe('ShellTool', () => {
             };
             mockSandboxManager = sandboxManager;
             const invocation = shellTool.build({ command: `ls ${homeDir}` });
-            const promise = invocation.execute(mockAbortSignal);
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveExecutionPromise({
                 exitCode: 1,
                 output: 'Permission denied',
@@ -863,5 +890,381 @@ describe('ShellTool', () => {
             expect(schema.description).toMatchSnapshot();
         });
     });
+    describe('command injection detection', () => {
+        it('should block $() command substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo $(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block backtick command substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo `whoami`' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow normal commands without substitution', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'hello',
+                    rawOutput: Buffer.from('hello'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo hello' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow single quoted strings with special chars', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(not substituted)',
+                    rawOutput: Buffer.from('$(not substituted)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(not substituted)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped backtick outside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'hello',
+                    rawOutput: Buffer.from('hello'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\`hello\\`' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block $() inside double quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block >() process substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo >(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow $() inside single quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(whoami)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block PowerShell @() array subexpression', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo @(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block PowerShell $() subexpression', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo $(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow PowerShell single quoted strings', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(whoami)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped substitution outside quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\$(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow process substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '<(whoami)',
+                    rawOutput: Buffer.from('<(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "<(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block process substitution without quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo <(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow escaped $() outside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\$(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow output process substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '<(whoami)',
+                    rawOutput: Buffer.from('<(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "<(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block <() process substitution without quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo <(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block PowerShell bare () grouping operator', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo (whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow escaped $() inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "\\$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "\\$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow PowerShell keyword with flag e.g. switch -regex ($x)', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'result',
+                    rawOutput: Buffer.from('result'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: 'switch -regex ($x) { "a" { 1 } }',
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow PowerShell nested parentheses e.g. if ((condition))', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'result',
+                    rawOutput: Buffer.from('result'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: 'if ((condition)) { Write-Host ok }',
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+    });
 });
 //# sourceMappingURL=shell.test.js.map