@nexrall/code-core 1.4.65 → 1.4.67

package/dist/permissions/destructive.d.ts

@@ -24,18 +24,22 @@ export interface DestructiveMatch {
     category: string;
     /** Short human-readable reason shown in the confirmation prompt. */
     reason: string;
+    /** Contained harm — `auto` mode may skip the confirmation (see TokenMatch.lowRisk). */
+    lowRisk?: boolean;
 }
 /**
  * Classify a bash command. Returns the FIRST matching destructive category, or
  * null when the command is not recognised as destructive.
  *
- * Two passes with different data-stripping:
- *  - RAW_RULES run on the heredoc-stripped but quote-PRESERVING string, because
- *    real SQL lives inside quotes (`psql -c "DROP TABLE"`); they are gated on a
- *    DB-client token so a mention can't match.
- *  - STRIPPED_RULES run on the fully stripped string (quotes + heredocs gone) so
- *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
- *    never trip the bare-command rules (git/infra/cloud/container/publish).
+ * Two layers:
+ *  1. Regex rules (above). RAW_RULES run on the heredoc-stripped but quote-PRESERVING
+ *     string (real SQL lives inside quotes) and are gated on a DB-client token;
+ *     STRIPPED_RULES run on the fully stripped string so mentions in commit messages /
+ *     echoes / heredoc'd docs never trip them.
+ *  2. A token pass (destructiveTokens.ts) that splits the command like a shell, peels
+ *     wrappers (sudo/env/xargs/bash -c/ssh/docker exec …) and judges the real command.
+ *     It catches what a regex cannot: `git -C x reset --hard`, `git push -fu`,
+ *     `git push origin +main`, `rm -rf src`, `find . -delete`, `> file`.
  */
 export declare function classifyDestructiveCommand(command: string): DestructiveMatch | null;
 /** True when the given tool + input represents a destructive bash command. */

package/dist/permissions/destructive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAsMD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAenF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../src/permissions/destructive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAGnF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAQvG"}

package/dist/permissions/destructive.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyDestructiveCommand = classifyDestructiveCommand;
 exports.isDestructiveBash = isDestructiveBash;
+const destructiveTokens_1 = require("./destructiveTokens");
 // ── Data-section stripping (naive; feeds a heuristic, not an executor) ────────
 function stripHeredocs(command) {
     return command.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ');
@@ -66,6 +67,16 @@ const RAW_RULES = [
         reason: 'drops a Postgres/MySQL role or user',
         re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdrop\s+(?:role|user)\b`, 'i'),
     },
+    {
+        category: 'database',
+        reason: 'UPDATE without a WHERE clause (rewrites every row)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bupdate\s+[\w.` + '`' + String.raw `"]+\s+set\b(?![\s\S]*\bwhere\b)`, 'i'),
+    },
+    {
+        category: 'database',
+        reason: 'DELETE with a WHERE clause that is always true (deletes every row)',
+        re: new RegExp(CMD_POS + DB_CLIENT + String.raw `\b[\s\S]*?\bdelete\s+from\b[\s\S]*?\bwhere\s+(?:1\s*=\s*1|true)\b`, 'i'),
+    },
     {
         category: 'database',
         reason: 'drops a MongoDB database or collection',
@@ -106,11 +117,6 @@ const STRIPPED_RULES = [
         reason: 'deletes untracked files (git clean)',
         re: /\bgit\s+clean\s+-[a-z]*f/i,
     },
-    {
-        category: 'git-history',
-        reason: 'force-deletes a git branch',
-        re: /\bgit\s+branch\s+-[a-z]*D/i,
-    },
     {
         category: 'git-history',
         reason: 'rewrites git history (filter-branch/filter-repo)',
@@ -213,9 +219,7 @@ const STRIPPED_RULES = [
  *    mentions inside commit messages / echoes / grep patterns / heredoc'd docs
  *    never trip the bare-command rules (git/infra/cloud/container/publish).
  */
-function classifyDestructiveCommand(command) {
-    if (!command || typeof command !== 'string')
-        return null;
+function classifyRegex(command) {
     const raw = stripHeredocs(command);
     for (const rule of RAW_RULES) {
         if (rule.re.test(raw)) {
@@ -230,6 +234,53 @@ function classifyDestructiveCommand(command) {
     }
     return null;
 }
+/** Only the quote-preserving SQL rules — used for SQL a wrapper (ssh/docker exec/env) hid from CMD_POS. */
+function classifyRawSql(command) {
+    const raw = stripHeredocs(command);
+    for (const rule of RAW_RULES) {
+        if (rule.re.test(raw))
+            return { category: rule.category, reason: rule.reason };
+    }
+    return null;
+}
+const MAX_DEPTH = 4;
+function classify(command, depth) {
+    if (depth > MAX_DEPTH)
+        return null;
+    const viaRegex = classifyRegex(command);
+    if (viaRegex)
+        return viaRegex;
+    // Token pass: understands option order, bundled flags, wrappers and `bash -c "…"`.
+    // A low-risk hit (scratch-file truncation) must not mask a real one later in the chain.
+    let soft = null;
+    for (const tokens of (0, destructiveTokens_1.tokenize)(stripHeredocs(command))) {
+        const m = (0, destructiveTokens_1.classifyTokens)(tokens, (inner) => classify(inner, depth + 1), classifyRawSql);
+        if (m && !m.lowRisk)
+            return m;
+        if (m && !soft)
+            soft = m;
+    }
+    return soft;
+}
+/**
+ * Classify a bash command. Returns the FIRST matching destructive category, or
+ * null when the command is not recognised as destructive.
+ *
+ * Two layers:
+ *  1. Regex rules (above). RAW_RULES run on the heredoc-stripped but quote-PRESERVING
+ *     string (real SQL lives inside quotes) and are gated on a DB-client token;
+ *     STRIPPED_RULES run on the fully stripped string so mentions in commit messages /
+ *     echoes / heredoc'd docs never trip them.
+ *  2. A token pass (destructiveTokens.ts) that splits the command like a shell, peels
+ *     wrappers (sudo/env/xargs/bash -c/ssh/docker exec …) and judges the real command.
+ *     It catches what a regex cannot: `git -C x reset --hard`, `git push -fu`,
+ *     `git push origin +main`, `rm -rf src`, `find . -delete`, `> file`.
+ */
+function classifyDestructiveCommand(command) {
+    if (!command || typeof command !== 'string')
+        return null;
+    return classify(command, 0);
+}
 /** True when the given tool + input represents a destructive bash command. */
 function isDestructiveBash(tool, input) {
     if (tool !== 'bash' && tool !== 'run_command' && tool !== 'execute_command')

package/dist/permissions/destructiveTokens.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Token-level half of the destructive-command classifier.
+ *
+ * destructive.ts started life as a pile of regexes run over the command STRING. That
+ * missed most real-world spellings, because a regex does not understand shell:
+ *   - global options between the tool and its verb:  git -C repo reset --hard
+ *   - combined short flags:                           git push -fu origin main
+ *   - refspec force syntax:                           git push origin +main
+ *   - wrappers that hide the real command:            sudo / env X=1 / xargs / nohup
+ *   - interpreters that take the command as a string: bash -c "…", eval "…", ssh host "…"
+ *   - containers that run it elsewhere:               docker exec db psql … / kubectl exec -- …
+ * and it could not express "rm -rf node_modules is fine, rm -rf src is not".
+ *
+ * So this module splits the command into simple commands the way a shell would (honouring
+ * quotes, so a commit message that MENTIONS `git push --force` is one argument of
+ * `git commit`, never a command), peels wrappers off, and judges (binary, args).
+ *
+ * It is a heuristic, not a shell: no variable expansion, no aliases, no functions. When it
+ * cannot tell (an `rm -rf $DIR`), it errs toward asking — the cost of a false positive is
+ * one confirmation, the cost of a false negative is unrecoverable.
+ */
+export interface TokenMatch {
+    category: string;
+    reason: string;
+    /**
+     * True when the harm is contained (e.g. truncating a scratch file under /tmp or a
+     * relative path). `auto` mode may run these without asking; every other mode still does.
+     */
+    lowRisk?: boolean;
+}
+/** Split `src` into simple commands, each a list of unquoted words. */
+export declare function tokenize(src: string): string[][];
+export declare function classifyTokens(tokens: string[], recurse: (command: string) => TokenMatch | null, rawSql: (command: string) => TokenMatch | null): TokenMatch | null;
+//# sourceMappingURL=destructiveTokens.d.ts.map

package/dist/permissions/destructiveTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA2BhD;AAgQD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA8DnB"}

package/dist/permissions/destructiveTokens.js

@@ -0,0 +1,475 @@
+"use strict";
+/**
+ * Token-level half of the destructive-command classifier.
+ *
+ * destructive.ts started life as a pile of regexes run over the command STRING. That
+ * missed most real-world spellings, because a regex does not understand shell:
+ *   - global options between the tool and its verb:  git -C repo reset --hard
+ *   - combined short flags:                           git push -fu origin main
+ *   - refspec force syntax:                           git push origin +main
+ *   - wrappers that hide the real command:            sudo / env X=1 / xargs / nohup
+ *   - interpreters that take the command as a string: bash -c "…", eval "…", ssh host "…"
+ *   - containers that run it elsewhere:               docker exec db psql … / kubectl exec -- …
+ * and it could not express "rm -rf node_modules is fine, rm -rf src is not".
+ *
+ * So this module splits the command into simple commands the way a shell would (honouring
+ * quotes, so a commit message that MENTIONS `git push --force` is one argument of
+ * `git commit`, never a command), peels wrappers off, and judges (binary, args).
+ *
+ * It is a heuristic, not a shell: no variable expansion, no aliases, no functions. When it
+ * cannot tell (an `rm -rf $DIR`), it errs toward asking — the cost of a false positive is
+ * one confirmation, the cost of a false negative is unrecoverable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenize = tokenize;
+exports.classifyTokens = classifyTokens;
+const hit = (category, reason) => ({ category, reason });
+/** Split `src` into simple commands, each a list of unquoted words. */
+function tokenize(src) {
+    const cmds = [];
+    let cur = [];
+    let word = '';
+    let has = false;
+    let q = null;
+    const pushWord = () => { if (has)
+        cur.push(word); word = ''; has = false; };
+    const pushCmd = () => { pushWord(); if (cur.length)
+        cmds.push(cur); cur = []; };
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (q === "'") {
+            if (ch === "'")
+                q = null;
+            else
+                word += ch;
+            continue;
+        }
+        if (q === '"') {
+            if (ch === '\\' && i + 1 < src.length) {
+                word += src[++i];
+                continue;
+            }
+            if (ch === '"') {
+                q = null;
+                continue;
+            }
+            word += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            q = ch;
+            has = true;
+            continue;
+        }
+        if (ch === '\\') {
+            if (i + 1 < src.length) {
+                word += src[++i];
+                has = true;
+            }
+            continue;
+        }
+        // Command separators. `(` `)` and backtick make $(…) / `…` bodies their own commands.
+        if (ch === ';' || ch === '&' || ch === '|' || ch === '\n' || ch === '(' || ch === ')' || ch === '`') {
+            pushCmd();
+            continue;
+        }
+        if (ch === ' ' || ch === '\t') {
+            pushWord();
+            continue;
+        }
+        word += ch;
+        has = true;
+    }
+    pushCmd();
+    return cmds;
+}
+const ENV_ASSIGN = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const CONTROL_WORDS = new Set(['{', '}', '!', 'if', 'then', 'else', 'elif', 'do', 'while', 'until', 'fi', 'done']);
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+const base = (w) => {
+    const b = w.includes('/') ? w.slice(w.lastIndexOf('/') + 1) : w;
+    return b;
+};
+/** Drop leading options from `args`, consuming a value for those named in `withArg`. */
+function dropOpts(args, withArg = new Set()) {
+    let i = 0;
+    while (i < args.length && args[i].startsWith('-') && args[i] !== '--') {
+        i += withArg.has(args[i]) ? 2 : 1;
+    }
+    if (args[i] === '--')
+        i++;
+    return args.slice(i);
+}
+/** True if `args` carries the long flag (or `--flag=value`) or a short-flag bundle containing `short`. */
+function has(args, long, short) {
+    return args.some((a) => (long !== null && (a === long || a.startsWith(long + '='))) ||
+        (short !== null && /^-[A-Za-z]+$/.test(a) && a.includes(short)));
+}
+const BROAD = new Set(['.', './', '*', './*', ':/', ':/', '..', '../', '/', '~', '~/', '$HOME', '${HOME}', '.*']);
+/** Directories that are regenerated by a build/install and are routine to delete. */
+const DISPOSABLE = new Set([
+    'node_modules', 'dist', 'build', 'out', '.next', '.nuxt', '.svelte-kit', '.turbo', '.cache', '.parcel-cache',
+    'coverage', '.nyc_output', 'target', '__pycache__', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.tox',
+    'venv', '.venv', '.gradle', '.dart_tool', 'tmp', '.tmp', '.vite', '.angular', '.expo', 'DerivedData',
+]);
+const SCRATCH_PREFIXES = ['/tmp/', '/private/tmp/', '/var/folders/', '/private/var/folders/'];
+function isDisposableTarget(raw) {
+    let t = raw;
+    if (t === '')
+        return false;
+    // Anything we cannot resolve statically is treated as unsafe.
+    if (/[$~`]/.test(t) || t.includes('..'))
+        return false;
+    if (t.startsWith('/'))
+        return SCRATCH_PREFIXES.some((p) => t.startsWith(p) && t.length > p.length);
+    t = t.replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+    if (t === '' || t === '.')
+        return false;
+    const segs = t.split('/').filter(Boolean);
+    if (segs.length === 0)
+        return false;
+    return DISPOSABLE.has(segs[0]) || DISPOSABLE.has(segs[segs.length - 1]);
+}
+function checkGit(argsIn) {
+    // Skip git's GLOBAL options so `git -C repo reset --hard` is seen as `reset --hard`.
+    let i = 0;
+    while (i < argsIn.length && argsIn[i].startsWith('-')) {
+        const a = argsIn[i];
+        i += ['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path'].includes(a) ? 2 : 1;
+    }
+    const sub = argsIn[i];
+    const args = argsIn.slice(i + 1);
+    const operands = args.filter((a) => !a.startsWith('-'));
+    switch (sub) {
+        case 'push': {
+            if (has(args, '--force', 'f') || operands.some((a) => a.startsWith('+'))) {
+                return hit('git-history', 'force-pushes (can overwrite/destroy remote history)');
+            }
+            if (has(args, '--delete', 'd') || operands.some((a) => a.startsWith(':'))) {
+                return hit('git-history', 'deletes a remote branch or tag');
+            }
+            if (has(args, '--mirror', null)) {
+                return hit('git-history', 'mirror-pushes (overwrites and deletes remote refs to match local)');
+            }
+            return null;
+        }
+        case 'reset':
+            if (has(args, '--hard', null) || has(args, '--keep', null) || has(args, '--merge', null)) {
+                return hit('git-history', 'hard-resets the working tree (discards uncommitted work)');
+            }
+            return null;
+        case 'clean':
+            if (has(args, '--force', 'f') && !has(args, '--dry-run', 'n')) {
+                return hit('git-history', 'deletes untracked files (git clean)');
+            }
+            return null;
+        case 'branch':
+            if (args.some((a) => /^-[A-Za-z]*D/.test(a)) ||
+                ((has(args, '--delete', 'd')) && has(args, '--force', 'f'))) {
+                return hit('git-history', 'force-deletes a git branch');
+            }
+            return null;
+        case 'checkout':
+            if (has(args, '--force', 'f'))
+                return hit('git-history', 'git checkout --force discards local changes');
+            if (args.some((a) => BROAD.has(a)))
+                return hit('git-history', 'discards every uncommitted change in the working tree');
+            return null;
+        case 'restore': {
+            const stagedOnly = has(args, '--staged', 'S') && !has(args, '--worktree', 'W');
+            if (!stagedOnly && args.some((a) => BROAD.has(a))) {
+                return hit('git-history', 'discards every uncommitted change in the working tree');
+            }
+            return null;
+        }
+        case 'stash':
+            if (args[0] === 'drop' || args[0] === 'clear')
+                return hit('git-history', 'drops stashed work (not recoverable without the commit hash)');
+            return null;
+        case 'update-ref':
+            if (has(args, '-d', 'd') || has(args, '--delete', null))
+                return hit('git-history', 'deletes a git ref');
+            return null;
+        case 'reflog':
+            if (args[0] === 'delete' || args[0] === 'expire')
+                return hit('git-history', 'reflog expire / gc prune (permanently drops recoverable commits)');
+            return null;
+        case 'gc':
+            if (args.some((a) => /^--prune=(?:now|all)$/.test(a)))
+                return hit('git-history', 'reflog expire / gc prune (permanently drops recoverable commits)');
+            return null;
+        case 'worktree':
+            if (args[0] === 'remove' && has(args, '--force', 'f'))
+                return hit('git-history', 'force-removes a worktree (discards its uncommitted work)');
+            return null;
+        case 'filter-branch':
+        case 'filter-repo':
+            return hit('git-history', 'rewrites git history (filter-branch/filter-repo)');
+        case 'rm':
+            // `git rm -r <dir>` is routine and recoverable from HEAD; only a bare `.`/`*` is a wipe.
+            if (operands.some((a) => BROAD.has(a))) {
+                return hit('git-history', 'removes every tracked file from the working tree and index');
+            }
+            return null;
+        default:
+            return null;
+    }
+}
+function checkRm(args) {
+    const targets = [];
+    let recursive = false;
+    let endOpts = false;
+    for (const a of args) {
+        if (!endOpts && a === '--') {
+            endOpts = true;
+            continue;
+        }
+        if (!endOpts && a.startsWith('-')) {
+            if (a === '--recursive' || /^-[A-Za-z]*[rR]/.test(a))
+                recursive = true;
+            continue;
+        }
+        targets.push(a);
+    }
+    if (targets.some((t) => BROAD.has(t)))
+        return hit('filesystem', 'deletes the current directory, home, or everything matching a bare glob');
+    if (recursive && targets.some((t) => !isDisposableTarget(t))) {
+        return hit('filesystem', 'recursively deletes files or directories that are not a known build artefact');
+    }
+    return null;
+}
+function checkFind(args) {
+    if (args.includes('-delete'))
+        return hit('filesystem', 'find -delete removes every match');
+    for (let i = 0; i < args.length - 1; i++) {
+        if ((args[i] === '-exec' || args[i] === '-execdir' || args[i] === '-ok') && ['rm', 'shred', 'unlink'].includes(base(args[i + 1]))) {
+            return hit('filesystem', 'find -exec rm removes every match');
+        }
+    }
+    return null;
+}
+/** Judge one already-unwrapped command. `recurse` re-enters the string classifier. */
+function judge(bin, args) {
+    switch (bin) {
+        case 'git': return checkGit(args);
+        case 'rm':
+        case 'unlink': return checkRm(args);
+        case 'find': return checkFind(args);
+        case 'rsync':
+            if (args.some((a) => a === '--del' || /^--delete(?:-[a-z]+)?$/.test(a)))
+                return hit('filesystem', 'rsync --delete removes destination files that are absent from the source');
+            return null;
+        case 'truncate': return hit('filesystem', 'truncate cuts a file (contents lost)');
+        case 'shred': return hit('filesystem', 'shred irrecoverably overwrites a file');
+        case 'dd':
+            if (args.some((a) => /^of=\/dev\//.test(a)))
+                return hit('filesystem', 'dd writing to a device (overwrites the disk)');
+            return null;
+        case 'diskutil':
+            if (/^(?:erase|secureErase|zeroDisk|randomDisk|partitionDisk|reformat)/i.test(args[0] ?? ''))
+                return hit('filesystem', 'diskutil erases or repartitions a disk');
+            return null;
+        case 'chmod': {
+            if (!has(args, '--recursive', 'R'))
+                return null;
+            const operands = args.filter((a) => !a.startsWith('-'));
+            if (operands.slice(1).some((t) => BROAD.has(t)))
+                return hit('filesystem', 'recursive chmod over the current directory / home / root');
+            return null;
+        }
+        case 'terraform':
+        case 'tofu':
+        case 'terragrunt':
+            if (args.includes('destroy') || (args.includes('apply') && (args.includes('-destroy') || args.includes('-auto-approve')))) {
+                return hit('infra', 'destroys or applies Terraform-managed infrastructure without a plan review');
+            }
+            return null;
+        case 'kubectl':
+        case 'oc': {
+            const a = dropOpts(args, new Set(['-n', '--namespace', '--context', '--cluster', '--kubeconfig', '-s', '--server', '--user']));
+            if (a[0] === 'delete')
+                return hit('infra', 'deletes Kubernetes resources');
+            if (a[0] === 'drain')
+                return hit('infra', 'drains a node (evicts every pod)');
+            if (a[0] === 'replace' && has(a, '--force', null))
+                return hit('infra', 'kubectl replace --force deletes and recreates the resource');
+            return null;
+        }
+        case 'helm': {
+            const a = dropOpts(args, new Set(['-n', '--namespace', '--kube-context', '--kubeconfig']));
+            if (a[0] === 'uninstall' || a[0] === 'delete')
+                return hit('infra', 'helm uninstall / delete (removes a release)');
+            return null;
+        }
+        case 'aws':
+            if (args[0] === 's3' && args[1] === 'sync' && has(args, '--delete', null))
+                return hit('cloud', 'aws s3 sync --delete removes bucket objects missing locally');
+            return null;
+        case 'vercel':
+            if (args[0] === 'remove' || args[0] === 'rm')
+                return hit('cloud', 'removes a Vercel project or deployment');
+            return null;
+        case 'fly':
+        case 'flyctl':
+            if (args.includes('destroy'))
+                return hit('cloud', 'destroys a Fly.io app, volume or machine');
+            return null;
+        case 'heroku':
+            if (args.some((a) => /:destroy$/.test(a) || a === 'pg:reset'))
+                return hit('cloud', 'destroys a Heroku app or resets its database');
+            return null;
+        case 'supabase':
+            if ((args[0] === 'db' && args[1] === 'reset') || (args[0] === 'projects' && args[1] === 'delete'))
+                return hit('cloud', 'resets a Supabase database or deletes a project');
+            return null;
+        case 'firebase':
+            if (args.some((a) => /:delete$/.test(a)))
+                return hit('cloud', 'deletes Firebase data or a project');
+            return null;
+        case 'netlify':
+            if (args.some((a) => /:delete$/.test(a)))
+                return hit('cloud', 'deletes a Netlify site');
+            return null;
+        case 'npm':
+        case 'pnpm':
+        case 'yarn':
+            if (args[0] === 'unpublish')
+                return hit('publish', 'unpublishes a package version');
+            if (args[0] === 'dist-tag' && (args[1] === 'rm' || args[1] === 'remove'))
+                return hit('publish', 'removes an npm dist-tag (can break `npm i pkg@latest`)');
+            return null;
+        case 'gh': {
+            if ((args[0] === 'repo' || args[0] === 'release') && args[1] === 'delete')
+                return hit('cloud', 'deletes a GitHub repository or release');
+            if (args[0] === 'api') {
+                const m = args.findIndex((a) => a === '-X' || a === '--method');
+                const inline = args.find((a) => /^(?:-X|--method=)DELETE$/i.test(a));
+                if ((m >= 0 && /^delete$/i.test(args[m + 1] ?? '')) || inline)
+                    return hit('cloud', 'sends an HTTP DELETE to the GitHub API');
+            }
+            return null;
+        }
+        case 'docker':
+        case 'docker-compose':
+        case 'podman': {
+            const a = bin === 'docker-compose' ? ['compose', ...args] : dropOpts(args, new Set(['-H', '--host', '--context', '-c']));
+            const verb = a[0] === 'container' ? a[1] : a[0];
+            const rest = a.slice(a[0] === 'container' ? 2 : 1);
+            if (verb === 'rm' && has(rest, '--force', 'f') && rest.some((x) => x.startsWith('$')))
+                return hit('container', 'force-removes many containers at once');
+            if (a[0] === 'compose' && rest.includes('down') && (has(rest, '--volumes', 'v')))
+                return hit('container', 'docker compose down with -v (deletes named volumes)');
+            return null;
+        }
+        case 'dropdb':
+        case 'dropuser': return hit('database', 'drops a Postgres database or role');
+        default:
+            if (bin.startsWith('mkfs'))
+                return hit('filesystem', 'mkfs formats a filesystem (destroys its contents)');
+            return null;
+    }
+}
+/**
+ * Peel wrappers off one simple command and judge what is really being run.
+ * `recurse` classifies a nested command STRING (bash -c "…", ssh host "…", eval …).
+ */
+const DB_BINS = new Set([
+    'psql', 'mysql', 'mariadb', 'mongo', 'mongosh', 'sqlite3', 'cockroach', 'clickhouse-client', 'pgcli', 'mycli', 'usql', 'sqlcmd', 'redis-cli',
+]);
+function classifyTokens(tokens, recurse, rawSql) {
+    let t = tokens.slice();
+    for (let guard = 0; guard < 12; guard++) {
+        while (t.length && (ENV_ASSIGN.test(t[0]) || CONTROL_WORDS.has(t[0])))
+            t = t.slice(1);
+        if (t.length === 0)
+            return null;
+        // A bare redirect with no command (`> file`, `: > file`, `true > file`) truncates the file.
+        {
+            const r = /^>(?![>&])/.test(t[0]) ? t : ((t[0] === ':' || t[0] === 'true') && /^>(?![>&])/.test(t[1] ?? '')) ? t.slice(1) : null;
+            if (r) {
+                const target = r[0].length > 1 ? r[0].slice(1) : (r[1] ?? '');
+                if (target.startsWith('/dev/'))
+                    return null;
+                const m = hit('filesystem', 'a bare `>` redirect truncates the file (contents lost)');
+                // Scratch/relative targets only: no `$var`, `~`, `..`; absolute paths must be under a temp dir.
+                const scratch = target !== '' && !/[$`~]|(^|\/)\.\.(\/|$)/.test(target)
+                    && (!target.startsWith('/') || /^\/(?:private\/)?(?:tmp|var\/folders)\//.test(target));
+                if (scratch)
+                    m.lowRisk = true;
+                return m;
+            }
+        }
+        const bin = base(t[0]);
+        const args = t.slice(1);
+        // Real SQL lives inside quotes, which the tokenizer has already unwrapped; hand it back
+        // to the quote-preserving SQL rules as a normal `client "arg" "arg"` string.
+        if (DB_BINS.has(bin)) {
+            return rawSql(bin + ' ' + args.map((a) => JSON.stringify(a)).join(' '));
+        }
+        if (bin === 'sudo' || bin === 'doas') {
+            t = dropOpts(args, new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']));
+            continue;
+        }
+        if (bin === 'env') {
+            t = dropOpts(args, new Set(['-u', '-C', '-S']));
+            continue;
+        }
+        if (bin === 'nice') {
+            t = dropOpts(args, new Set(['-n']));
+            continue;
+        }
+        if (bin === 'ionice') {
+            t = dropOpts(args, new Set(['-c', '-n', '-p']));
+            continue;
+        }
+        if (bin === 'timeout') {
+            t = dropOpts(args, new Set(['-s', '-k'])).slice(1);
+            continue;
+        }
+        if (bin === 'xargs') {
+            t = dropOpts(args, new Set(['-I', '-n', '-P', '-L', '-s', '-d', '-E', '-a', '-J']));
+            continue;
+        }
+        if (['command', 'builtin', 'nohup', 'exec', 'time', 'setsid', 'caffeinate', 'stdbuf', 'unbuffer'].includes(bin)) {
+            t = dropOpts(args);
+            continue;
+        }
+        if (SHELLS.has(bin)) {
+            const i = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a));
+            if (i >= 0 && args[i + 1] !== undefined)
+                return recurse(args[i + 1]);
+            return null;
+        }
+        if (bin === 'eval')
+            return recurse(args.join(' '));
+        if (bin === 'ssh') {
+            const a = dropOpts(args, new Set(['-p', '-i', '-l', '-o', '-F', '-J', '-L', '-R', '-D', '-b', '-c', '-E', '-e', '-I', '-m', '-O', '-Q', '-S', '-w', '-W']));
+            return a.length > 1 ? recurse(a.slice(1).join(' ')) : null;
+        }
+        if (bin === 'docker' || bin === 'podman' || bin === 'docker-compose') {
+            const a0 = bin === 'docker-compose' ? ['compose', ...args] : dropOpts(args, new Set(['-H', '--host', '--context', '-c']));
+            const isExec = a0[0] === 'exec' || (a0[0] === 'compose' && dropOpts(a0.slice(1), new Set(['-f', '-p', '--project-name', '--file', '--profile']))[0] === 'exec');
+            if (isExec) {
+                const afterVerb = a0[0] === 'exec'
+                    ? a0.slice(1)
+                    : dropOpts(a0.slice(1), new Set(['-f', '-p', '--project-name', '--file', '--profile'])).slice(1);
+                const inner = dropOpts(afterVerb, new Set(['-e', '-u', '-w', '--env', '--user', '--workdir', '--env-file', '--detach-keys', '--index']));
+                if (inner.length > 1) {
+                    t = inner.slice(1);
+                    continue;
+                }
+                return null;
+            }
+        }
+        if (bin === 'kubectl' || bin === 'oc') {
+            const i = args.indexOf('--');
+            if (i >= 0 && args.includes('exec') && i + 1 < args.length) {
+                t = args.slice(i + 1);
+                continue;
+            }
+        }
+        return judge(bin, args);
+    }
+    return null;
+}
+//# sourceMappingURL=destructiveTokens.js.map