@orion-agents/orion-code 0.1.2 → 0.1.4

package/dist/tools/bash_security.d.ts

@@ -8,6 +8,15 @@
  * These commands only read data and do not modify the filesystem.
  */
 export declare const READ_ONLY_COMMANDS: string[];
+/**
+ * Sub-commands that only read state, keyed by the driver that runs them.
+ *
+ * The drivers themselves must never appear in READ_ONLY_COMMANDS: `npm run`,
+ * `npm exec`, `yarn <script>`, `pnpm run`, `cargo run` and `npx <pkg>` all
+ * execute arbitrary project-defined or freshly downloaded code, so the safe
+ * surface has to be enumerated rather than subtracted.
+ */
+export declare const READ_ONLY_SUBCOMMANDS: Record<string, readonly string[]>;
 /**
  * Validation commands that are safe enough to run without an interactive
  * confirmation prompt. They may read the project and execute local test code,
@@ -25,14 +34,55 @@ export declare const DANGEROUS_PATTERNS: {
  * Potentially destructive patterns that should ask for confirmation.
  */
 export declare const POTENTIALLY_DESTRUCTIVE_PATTERNS: RegExp[];
+/**
+ * Result of a quote-aware scan over a whole command line.
+ */
+export interface ShellCommandScan {
+    /** The individual commands on the line, split on unquoted separators. */
+    segments: string[];
+    /**
+     * False when the line uses a construct this scanner cannot reason about --
+     * command substitution, process substitution or an unbalanced quote. Such a
+     * line can hide an arbitrary command and must never be auto-approved.
+     */
+    supported: boolean;
+    /** True when the line redirects output somewhere other than /dev/null. */
+    writesFile: boolean;
+}
+/**
+ * Split a command line into the individual commands it will actually run.
+ *
+ * The classifier below hands out "run without confirmation" verdicts, so it has
+ * to see every command on the line rather than just the leading token. Quote
+ * state is tracked so `echo "a && b"` stays one segment, and substitutions are
+ * reported as unsupported instead of being silently skipped over.
+ */
+export declare function scanShellCommand(cmd: string): ShellCommandScan;
 /**
  * Check if a command is read-only and safe to execute without confirmation.
+ *
+ * Every command on the line must be independently read-only.
  */
 export declare function isReadOnlyCommand(cmd: string): boolean;
 /**
  * Check if a command is a bounded validation command.
+ *
+ * Segment-aware for the same reason as `isReadOnlyCommand`: without it,
+ * `npm test && rm -rf /tmp/x` matches the leading validation pattern and is
+ * auto-approved in full.
  */
 export declare function isValidationCommand(cmd: string): boolean;
+/**
+ * Structured replacement for the literal `rm -rf /` patterns.
+ *
+ * Returns the normalised target that makes the command catastrophic, or null.
+ * Matching on parsed flags and canonicalised operands closes the rewrites that
+ * defeat the anchored patterns: `rm -fr /`, `rm -r -f /`,
+ * `rm --recursive --force /`, `rm -rf /*` and, most importantly,
+ * `rm -rf / --no-preserve-root` -- the only form that actually deletes anything
+ * on GNU coreutils.
+ */
+export declare function findDestructiveRmTarget(cmd: string): string | null;
 /**
  * Check if a command matches dangerous patterns.
  * Returns the first matched dangerous pattern, or null if safe.
@@ -53,22 +103,4 @@ export declare function assessCommandSecurity(cmd: string): {
     reason?: string;
     isReadOnly: boolean;
 };
-/**
- * Sandbox execution options.
- */
-export interface SandboxOptions {
-    mode: 'none' | 'docker' | 'bubblewrap';
-    container?: string;
-    timeout?: number;
-    network?: boolean;
-}
-/**
- * Default sandbox options (disabled).
- */
-export declare const DEFAULT_SANDBOX_OPTIONS: SandboxOptions;
-/**
- * Wrap command for sandbox execution.
- * Returns the modified command for sandbox execution.
- */
-export declare function wrapForSandbox(cmd: string, options: SandboxOptions): string;
 //# sourceMappingURL=bash_security.d.ts.map

package/dist/tools/bash_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash_security.d.ts","sourceRoot":"","sources":["../../src/tools/bash_security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAiI9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAOvC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;GAiC9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,UAW5C,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2DtD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAO7F;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB,CA2CA;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAErC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB3E"}
+{"version":3,"file":"bash_security.d.ts","sourceRoot":"","sources":["../../src/tools/bash_security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UA4H9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAmBnE,CAAC;AAuBF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAOvC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;GAoC9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,UAW5C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAuG9D;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAuFD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxD;AAkID;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBlE;AAiBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe7F;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB,CA2CA"}

package/dist/tools/bash_security.js

@@ -5,13 +5,14 @@
  * Provides safety checks and sandbox options for command execution.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_SANDBOX_OPTIONS = exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = exports.DANGEROUS_PATTERNS = exports.VALIDATION_COMMAND_PATTERNS = exports.READ_ONLY_COMMANDS = void 0;
+exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = exports.DANGEROUS_PATTERNS = exports.VALIDATION_COMMAND_PATTERNS = exports.READ_ONLY_SUBCOMMANDS = exports.READ_ONLY_COMMANDS = void 0;
+exports.scanShellCommand = scanShellCommand;
 exports.isReadOnlyCommand = isReadOnlyCommand;
 exports.isValidationCommand = isValidationCommand;
+exports.findDestructiveRmTarget = findDestructiveRmTarget;
 exports.checkDangerousCommand = checkDangerousCommand;
 exports.isPotentiallyDestructive = isPotentiallyDestructive;
 exports.assessCommandSecurity = assessCommandSecurity;
-exports.wrapForSandbox = wrapForSandbox;
 /**
  * Commands that are considered read-only and safe to execute without confirmation.
  * These commands only read data and do not modify the filesystem.
@@ -112,16 +113,11 @@ exports.READ_ONLY_COMMANDS = [
     'htop',
     'lsof',
     'pgrep',
-    // Package managers (checking/listing is read-only)
-    'npm',
-    'npx',
-    'yarn',
-    'pnpm',
-    'pip',
-    'pip3',
-    'cargo',
-    'top',
-    'htop',
+    // Job control
+    // NOTE: the package-manager drivers (npm/npx/yarn/pnpm/pip/cargo) are
+    // deliberately NOT listed here. Whether they read or execute depends entirely
+    // on the sub-command, so they are allow-listed per sub-command in
+    // READ_ONLY_SUBCOMMANDS instead.
     'jobs',
     // JSON/YAML processing (read-only when no file write)
     'jq',
@@ -136,6 +132,51 @@ exports.READ_ONLY_COMMANDS = [
     '--version',
     '-V',
 ];
+/**
+ * Sub-commands that only read state, keyed by the driver that runs them.
+ *
+ * The drivers themselves must never appear in READ_ONLY_COMMANDS: `npm run`,
+ * `npm exec`, `yarn <script>`, `pnpm run`, `cargo run` and `npx <pkg>` all
+ * execute arbitrary project-defined or freshly downloaded code, so the safe
+ * surface has to be enumerated rather than subtracted.
+ */
+exports.READ_ONLY_SUBCOMMANDS = {
+    git: [
+        'status',
+        'log',
+        'diff',
+        'show',
+        'branch',
+        'tag',
+        'remote',
+        'rev-parse',
+        'ls-files',
+        'ls-tree',
+    ],
+    npm: ['list', 'ls', 'info', 'view', 'search', 'outdated', 'why'],
+    yarn: ['list', 'info', 'why'],
+    pnpm: ['list', 'ls', 'info', 'why', 'outdated'],
+    cargo: ['tree', 'metadata', 'search'],
+    pip: ['list', 'show', 'freeze'],
+    pip3: ['list', 'show', 'freeze'],
+};
+/**
+ * git options that hand execution to an external program or write a file,
+ * whichever sub-command they are attached to.
+ */
+const GIT_UNSAFE_OPTIONS = /(^|\s)--(ext-diff|extcmd|output|exec-path|upload-pack|receive-pack)\b/;
+/**
+ * `git branch` / `git tag` only list when they are given nothing but these
+ * flags. Any other argument may create, move or delete a ref, so the allow-list
+ * is deliberately valueless flags only -- `git branch --contains HEAD` reads,
+ * but prompting for it is far cheaper than letting `git branch -D main` through.
+ */
+const GIT_LISTING_FLAGS = {
+    branch: /^(-a|--all|-r|--remotes|-v|-vv|--verbose|-l|--list|--no-color|--color(=.+)?|--sort=.+|--format=.+)$/,
+    tag: /^(-l|--list|-n\d*|-i|--ignore-case|--no-color|--color(=.+)?|--sort=.+|--format=.+)$/,
+};
+/** `git remote` reads with no argument, or via these two sub-sub-commands. */
+const GIT_REMOTE_READ_ONLY_ACTIONS = new Set(['show', 'get-url']);
 /**
  * Validation commands that are safe enough to run without an interactive
  * confirmation prompt. They may read the project and execute local test code,
@@ -153,7 +194,10 @@ exports.VALIDATION_COMMAND_PATTERNS = [
  * Dangerous command patterns that should always be blocked or require confirmation.
  */
 exports.DANGEROUS_PATTERNS = [
-    // Filesystem destruction
+    // Filesystem destruction.
+    // NOTE: these literal forms are a backstop only. Flag order, long options and
+    // trailing arguments all defeat them, so the authoritative check is the
+    // structured one in findDestructiveRmTarget(); see checkDangerousCommand().
     { pattern: /rm\s+-rf\s+\/$/, reason: 'Attempting to delete root directory' },
     { pattern: /rm\s+-rf\s+~$/, reason: 'Attempting to delete home directory' },
     { pattern: /rm\s+-rf\s+\*/, reason: 'Attempting to delete all files in current directory' },
@@ -195,11 +239,136 @@ exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = [
     /curl.*>\s*\//,
     /wget.*-O\s*\//,
 ];
+/** The one redirect target that does not count as writing to the filesystem. */
+const DISCARD_REDIRECT_TARGET = '/dev/null';
+/**
+ * Split a command line into the individual commands it will actually run.
+ *
+ * The classifier below hands out "run without confirmation" verdicts, so it has
+ * to see every command on the line rather than just the leading token. Quote
+ * state is tracked so `echo "a && b"` stays one segment, and substitutions are
+ * reported as unsupported instead of being silently skipped over.
+ */
+function scanShellCommand(cmd) {
+    const segments = [];
+    let current = '';
+    let supported = true;
+    let writesFile = false;
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    const pushSegment = () => {
+        const segment = current.trim();
+        if (segment.length > 0) {
+            segments.push(segment);
+        }
+        current = '';
+    };
+    for (let i = 0; i < cmd.length; i++) {
+        const ch = cmd[i];
+        const next = cmd[i + 1];
+        if (ch === '\\' && !inSingleQuote && next !== undefined) {
+            current += ch + next;
+            i++;
+            continue;
+        }
+        if (ch === "'" && !inDoubleQuote) {
+            inSingleQuote = !inSingleQuote;
+            current += ch;
+            continue;
+        }
+        if (ch === '"' && !inSingleQuote) {
+            inDoubleQuote = !inDoubleQuote;
+            current += ch;
+            continue;
+        }
+        if (inSingleQuote || inDoubleQuote) {
+            current += ch;
+            continue;
+        }
+        // Command and process substitution can hide an arbitrary command inside an
+        // otherwise innocent-looking line, and neither is worth modelling here.
+        if (ch === '`' || (ch === '$' && next === '(') || ((ch === '<' || ch === '>') && next === '(')) {
+            supported = false;
+            current += ch;
+            continue;
+        }
+        if (ch === ';' || ch === '\n') {
+            pushSegment();
+            continue;
+        }
+        if ((ch === '&' && next === '&') || (ch === '|' && next === '|')) {
+            pushSegment();
+            i++;
+            continue;
+        }
+        if (ch === '&' || ch === '|') {
+            pushSegment();
+            continue;
+        }
+        if (ch === '>') {
+            let cursor = i + 1;
+            if (cmd[cursor] === '>') {
+                cursor++;
+            }
+            if (cmd[cursor] === '&') {
+                // `>&1` / `2>&1` duplicate a descriptor and `>&-` closes one; nothing
+                // reaches the filesystem. Consume the whole reference so its `&` is not
+                // mistaken for a background-job separator.
+                let end = cursor + 1;
+                while (end < cmd.length && cmd[end] >= '0' && cmd[end] <= '9') {
+                    end++;
+                }
+                if (cmd[end] === '-') {
+                    end++;
+                }
+                current += cmd.slice(i, end);
+                i = end - 1;
+                continue;
+            }
+            while (cursor < cmd.length && (cmd[cursor] === ' ' || cmd[cursor] === '\t')) {
+                cursor++;
+            }
+            const target = cmd.slice(cursor).split(/[\s;&|<>]/)[0];
+            if (target !== DISCARD_REDIRECT_TARGET) {
+                writesFile = true;
+            }
+            current += ch;
+            continue;
+        }
+        current += ch;
+    }
+    pushSegment();
+    return {
+        segments,
+        supported: supported && !inSingleQuote && !inDoubleQuote,
+        writesFile,
+    };
+}
+/**
+ * Require every command on the line to satisfy `predicate`.
+ *
+ * A single unrecognised segment is enough to withhold the auto-approval, which
+ * is what stops `echo hi && rm -rf ~` from inheriting `echo`'s verdict.
+ */
+function everySegmentSatisfies(cmd, predicate) {
+    const scan = scanShellCommand(cmd.trim());
+    if (!scan.supported || scan.writesFile || scan.segments.length === 0) {
+        return false;
+    }
+    return scan.segments.every(predicate);
+}
 /**
  * Check if a command is read-only and safe to execute without confirmation.
+ *
+ * Every command on the line must be independently read-only.
  */
 function isReadOnlyCommand(cmd) {
-    const trimmedCmd = cmd.trim();
+    return everySegmentSatisfies(cmd, isReadOnlySegment);
+}
+/**
+ * Check whether a single command -- with no separators left in it -- is read-only.
+ */
+function isReadOnlySegment(trimmedCmd) {
     // Check exact matches first
     if (exports.READ_ONLY_COMMANDS.includes(trimmedCmd)) {
         return true;
@@ -230,42 +399,217 @@ function isReadOnlyCommand(cmd) {
         if (baseCmd === 'sort' && (/(^|\s)-o\b/.test(trimmedCmd) || trimmedCmd.includes('>'))) {
             return false; // sort -o / redirect writes a file
         }
-        // npm/pip/cargo/yarn install commands have side effects
-        if ((baseCmd === 'npm' || baseCmd === 'yarn' || baseCmd === 'pnpm') &&
-            /\b(install|add|remove|uninstall|publish|link|unlink|deprecate|audit fix|fund)\b/.test(trimmedCmd)) {
-            return false;
-        }
-        if ((baseCmd === 'pip' || baseCmd === 'pip3') && /\binstall\b/.test(trimmedCmd)) {
-            return false; // pip install modifies system
-        }
-        if (baseCmd === 'cargo' && /\b(install|publish|update|remove)\b/.test(trimmedCmd)) {
-            return false;
-        }
         return true;
     }
-    // Check for git read commands
-    if (trimmedCmd.startsWith('git ')) {
-        const gitCmd = trimmedCmd.slice(4).trim();
-        for (const roGitCmd of exports.READ_ONLY_COMMANDS.filter(c => c.startsWith('git '))) {
-            if (gitCmd.startsWith(roGitCmd.slice(4))) {
-                return true;
-            }
-        }
+    // Driver commands are read-only only for an explicitly allow-listed
+    // sub-command, matched on the exact token.
+    return isReadOnlyDriverInvocation(trimmedCmd);
+}
+/**
+ * Classify `git`, `npm`, `cargo` and friends by their sub-command.
+ *
+ * Matching is on the exact sub-command token. The previous implementation used
+ * `startsWith`, which let `git difftool --extcmd=...` match the `git diff`
+ * entry and run an arbitrary program.
+ */
+function isReadOnlyDriverInvocation(segment) {
+    const tokens = segment.split(/\s+/).filter(token => token.length > 0);
+    const driver = tokens[0];
+    const subcommand = tokens[1];
+    const allowed = driver ? exports.READ_ONLY_SUBCOMMANDS[driver] : undefined;
+    if (!allowed || !subcommand || !allowed.includes(subcommand)) {
+        return false;
     }
-    return false;
+    if (driver !== 'git') {
+        return true;
+    }
+    if (GIT_UNSAFE_OPTIONS.test(segment)) {
+        return false;
+    }
+    const args = tokens.slice(2);
+    if (subcommand === 'remote') {
+        // `git remote [-v]` lists; `git remote show|get-url <name>` reads.
+        // Everything else -- add, remove, rename, set-url, prune -- mutates.
+        const positional = args.filter(arg => arg !== '-v' && arg !== '--verbose');
+        return positional.length === 0 || GIT_REMOTE_READ_ONLY_ACTIONS.has(positional[0]);
+    }
+    const listingFlags = GIT_LISTING_FLAGS[subcommand];
+    if (listingFlags) {
+        return args.every(arg => listingFlags.test(arg));
+    }
+    return true;
 }
 /**
  * Check if a command is a bounded validation command.
+ *
+ * Segment-aware for the same reason as `isReadOnlyCommand`: without it,
+ * `npm test && rm -rf /tmp/x` matches the leading validation pattern and is
+ * auto-approved in full.
  */
 function isValidationCommand(cmd) {
-    const trimmedCmd = cmd.trim();
-    return exports.VALIDATION_COMMAND_PATTERNS.some(pattern => pattern.test(trimmedCmd));
+    return everySegmentSatisfies(cmd, segment => exports.VALIDATION_COMMAND_PATTERNS.some(pattern => pattern.test(segment)));
+}
+/** Wrappers that may precede `rm` without changing what it deletes. */
+const COMMAND_WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', 'nohup', 'time', 'exec']);
+/**
+ * Targets whose deletion is never a legitimate agent action, in the normalised
+ * form produced by {@link normalizeRmTarget}.
+ */
+const CATASTROPHIC_RM_TARGETS = new Set([
+    '/',
+    '~',
+    '.',
+    '..',
+    '*',
+    // System roots: wiping any of these bricks the machine just as thoroughly as
+    // `/` does, and no build or cleanup step has a reason to touch them.
+    '/bin',
+    '/boot',
+    '/dev',
+    '/etc',
+    '/lib',
+    '/lib64',
+    '/opt',
+    '/proc',
+    '/root',
+    '/sbin',
+    '/srv',
+    '/sys',
+    '/usr',
+    '/var',
+    '/home',
+    '/Users',
+    '/System',
+    '/Library',
+    '/Applications',
+]);
+/**
+ * Reduce an `rm` operand to a canonical path so that every spelling of the same
+ * catastrophic target collapses onto one key: `/`, `/*`, `/**` and `///` all
+ * become `/`, and `~/`, `~/*`, `$HOME`, `${HOME}/` all become `~`.
+ */
+function normalizeRmTarget(raw) {
+    let target = raw.trim();
+    const quote = target[0];
+    if ((quote === "'" || quote === '"') && target.endsWith(quote) && target.length > 1) {
+        target = target.slice(1, -1).trim();
+    }
+    target = target.replace(/^\$\{HOME\}/, '~').replace(/^\$HOME/, '~');
+    // A trailing glob deletes the directory's contents, which is the same disaster
+    // as deleting the directory itself.
+    target = target.replace(/\/\*+$/, '/');
+    target = target.replace(/\/{2,}/g, '/');
+    if (target.length > 1) {
+        target = target.replace(/\/+$/, '');
+    }
+    return target;
+}
+/**
+ * Parse a single command segment as an `rm` invocation.
+ *
+ * Returns null when the segment does not run `rm`. Flags are collected
+ * order-independently, so `-rf`, `-fr`, `-r -f` and `--recursive --force` are
+ * all recognised as the same request.
+ */
+function parseRmInvocation(segment) {
+    const tokens = segment.split(/\s+/).filter(token => token.length > 0);
+    let index = 0;
+    while (index < tokens.length && COMMAND_WRAPPERS.has(tokens[index])) {
+        index++;
+    }
+    const binary = tokens[index];
+    if (!binary || !/(^|\/)rm$/.test(binary)) {
+        return null;
+    }
+    index++;
+    const invocation = {
+        recursive: false,
+        force: false,
+        noPreserveRoot: false,
+        targets: [],
+    };
+    let endOfOptions = false;
+    for (; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (!endOfOptions && token === '--') {
+            endOfOptions = true;
+            continue;
+        }
+        if (!endOfOptions && token.startsWith('--')) {
+            if (token === '--recursive')
+                invocation.recursive = true;
+            else if (token === '--force')
+                invocation.force = true;
+            else if (token === '--no-preserve-root')
+                invocation.noPreserveRoot = true;
+            continue;
+        }
+        if (!endOfOptions && token.length > 1 && token.startsWith('-')) {
+            for (const flag of token.slice(1)) {
+                if (flag === 'r' || flag === 'R')
+                    invocation.recursive = true;
+                else if (flag === 'f')
+                    invocation.force = true;
+            }
+            continue;
+        }
+        invocation.targets.push(token);
+    }
+    return invocation;
+}
+/**
+ * Structured replacement for the literal `rm -rf /` patterns.
+ *
+ * Returns the normalised target that makes the command catastrophic, or null.
+ * Matching on parsed flags and canonicalised operands closes the rewrites that
+ * defeat the anchored patterns: `rm -fr /`, `rm -r -f /`,
+ * `rm --recursive --force /`, `rm -rf /*` and, most importantly,
+ * `rm -rf / --no-preserve-root` -- the only form that actually deletes anything
+ * on GNU coreutils.
+ */
+function findDestructiveRmTarget(cmd) {
+    for (const segment of scanShellCommand(cmd).segments) {
+        const invocation = parseRmInvocation(segment);
+        if (!invocation)
+            continue;
+        // `rm /` without -r or -f cannot remove a directory, so it is noise rather
+        // than a threat. Either flag turns the same operand into a real deletion.
+        if (!invocation.recursive && !invocation.force)
+            continue;
+        for (const target of invocation.targets) {
+            if (CATASTROPHIC_RM_TARGETS.has(normalizeRmTarget(target))) {
+                return target;
+            }
+        }
+    }
+    return null;
+}
+/** Reported when the structured `rm` check fires rather than a literal pattern. */
+const DESTRUCTIVE_RM_PATTERN = /\brm\b/;
+/** Human-readable description of why a normalised target is off-limits. */
+function describeCatastrophicTarget(raw) {
+    const normalized = normalizeRmTarget(raw);
+    if (normalized === '/')
+        return 'the root directory';
+    if (normalized === '~')
+        return 'the home directory';
+    if (normalized === '.' || normalized === '..' || normalized === '*') {
+        return 'the current directory contents';
+    }
+    return `the system directory ${normalized}`;
 }
 /**
  * Check if a command matches dangerous patterns.
  * Returns the first matched dangerous pattern, or null if safe.
  */
 function checkDangerousCommand(cmd) {
+    const rmTarget = findDestructiveRmTarget(cmd);
+    if (rmTarget) {
+        return {
+            pattern: DESTRUCTIVE_RM_PATTERN,
+            reason: `Attempting to delete ${describeCatastrophicTarget(rmTarget)} (${rmTarget})`,
+        };
+    }
     for (const { pattern, reason } of exports.DANGEROUS_PATTERNS) {
         if (pattern.test(cmd)) {
             return { pattern, reason };
@@ -327,30 +671,19 @@ function assessCommandSecurity(cmd) {
         isReadOnly: false,
     };
 }
-/**
- * Default sandbox options (disabled).
- */
-exports.DEFAULT_SANDBOX_OPTIONS = {
-    mode: 'none',
-};
-/**
- * Wrap command for sandbox execution.
- * Returns the modified command for sandbox execution.
+/*
+ * The `SandboxOptions` / `DEFAULT_SANDBOX_OPTIONS` / `wrapForSandbox` trio that
+ * used to live here has been removed.
+ *
+ * `wrapForSandbox` advertised network isolation it never delivered: it emitted
+ * `docker exec --network none <container> sh -c '<cmd>'`, but `--network` is a
+ * `docker run` flag and `docker exec` rejects it with `unknown flag`. With
+ * `network: true` the flag was dropped altogether, so neither configuration
+ * isolated anything. Building the wrapper as a shell string was unsound anyway:
+ * every layer re-parses the command, so a quoting bug becomes a sandbox escape.
+ *
+ * `src/tools/sandbox.ts` supersedes it with an argv-based implementation that
+ * probes backend availability and fails closed. Use `planSandboxedCommand()`
+ * from there instead.
  */
-function wrapForSandbox(cmd, options) {
-    if (options.mode === 'none') {
-        return cmd;
-    }
-    if (options.mode === 'docker') {
-        const container = options.container || 'orion-code-sandbox';
-        const networkFlag = options.network ? '' : '--network none';
-        return `docker exec ${networkFlag} ${container} sh -c '${cmd.replace(/'/g, "'\\''")}'`;
-    }
-    if (options.mode === 'bubblewrap') {
-        // bubblewrap (bwrap) for Linux sandboxing
-        const networkFlag = options.network ? '' : '--unshare-net';
-        return `bwrap ${networkFlag} --ro-bind /usr /usr --ro-bind /lib /lib --ro-bind /bin /bin --bind /tmp /tmp --proc /proc --dev-bind /dev /dev sh -c '${cmd.replace(/'/g, "'\\''")}'`;
-    }
-    return cmd;
-}
 //# sourceMappingURL=bash_security.js.map