@posthog/wizard 2.44.0 → 2.45.0

package/dist/{agent-interface-BvTxWiol.js → agent-interface-CF7GsdFf.js}

@@ -1,10 +1,11 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { G as POSTHOG_FLAG_HEADER_PREFIX, J as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, at as WIZARD_ORCHESTRATOR_FLAG_KEY, f as getUI, lt as WIZARD_REMARK_EVENT_NAME, mt as wizardUserAgentForProgram, o as initLogFile, r as debug, s as logToFile, vt as runtimeEnv } from "./debug-DXfQFmcM.js";
-import { n as analytics } from "./analytics-DSlQuwOT.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-BAZql11N.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-C14PzXZ8.js";
-import { n as createWizardToolsServer, t as WIZARD_TOOL_NAMES } from "./wizard-tools-B7SLjCic.js";
-import { l as prewarmYaraScanner, n as createPostToolUseYaraHooks, r as createPreToolUseYaraHooks } from "./yara-hooks-CPH8N4yz.js";
+import { J as POSTHOG_FLAG_HEADER_PREFIX, St as runtimeEnv, Z as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, f as getUI, lt as WIZARD_ORCHESTRATOR_FLAG_KEY, o as initLogFile, pt as WIZARD_REMARK_EVENT_NAME, r as debug, s as logToFile, vt as wizardUserAgentForProgram } from "./debug-DBmxx59Q.js";
+import { n as analytics } from "./analytics-DQEuL6qS.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-tp4Zdbwl.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-BxtdkgI-.js";
+import { n as createWizardToolsServer, t as WIZARD_TOOL_NAMES } from "./wizard-tools-Dg8o2lcH.js";
+import { l as prewarmYaraScanner, n as createPostToolUseYaraHooks, r as createPreToolUseYaraHooks } from "./yara-hooks-pw86rZ8y.js";
+import { t as getWizardCommandments } from "./commandments-CyB7Icr1.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import path from "path";
@@ -160,6 +161,7 @@ const LINTING_TOOLS = [
 	"sql-formatter",
 	"sqlfmt",
 	"squawk",
+	"svelte-check",
 	"svgo",
 	"stringslint",
 	"swiftformat",
@@ -175,6 +177,282 @@ const LINTING_TOOLS = [
 	"yamllint"
 ];
 //#endregion
+//#region src/lib/agent/bash-fence.ts
+/**
+* Bash command fence: exact per-manager allowlists + shell-shape gates.
+*
+* In effect this gates the pi harness only — on the Anthropic arm `Bash` is
+* pre-allowed (BASE_ALLOWED_TOOLS), so canUseTool never sees it and the SDK's
+* OS sandbox + YARA hooks gate execution instead. pi has no OS sandbox yet,
+* so this string fence is its only execution gate.
+*
+* Threat model: the agent can already Write project files, so commands that
+* execute project-defined code (installs, builds) are equivalent risk by
+* construction. The fence must prevent: direct arbitrary shell, outward
+* registry actions (publish/push/deploy), arbitrary-package execution
+* (`npx <anything>` downloads and runs it), and shell injection. Matching is
+* token-exact per manager — keyword prefixes admitted `npm publish` via `pub`.
+*/
+const NODE_MANAGERS = new Set([
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+const GRADLE_MANAGERS = new Set([
+	"gradle",
+	"gradlew",
+	"./gradlew"
+]);
+const MAVEN_MANAGERS = new Set([
+	"mvn",
+	"mvnw",
+	"./mvnw"
+]);
+const NODE_SUBCOMMANDS = [
+	"install",
+	"i",
+	"ci",
+	"add",
+	"remove",
+	"uninstall",
+	"update",
+	"view"
+];
+const NODE_SCRIPT_NAMES = [
+	"build",
+	"lint",
+	"format",
+	"tsc",
+	"typecheck",
+	"type-check",
+	"check-types",
+	"check",
+	"types"
+];
+const NPX_TOOLS = new Set([
+	...LINTING_TOOLS,
+	"tsc",
+	"expo",
+	"pod-install",
+	"cap"
+]);
+const PIP_SUBCOMMANDS = [
+	"install",
+	"uninstall",
+	"show",
+	"list",
+	"index"
+];
+const BUNDLE_SUBCOMMANDS = [
+	"install",
+	"add",
+	"remove",
+	"update",
+	"show"
+];
+const MAVEN_GOALS = [
+	"install",
+	"compile",
+	"package",
+	"verify",
+	"dependency:tree"
+];
+/** Managers whose first subcommand is checked exactly against a fixed set. */
+const SIMPLE_MANAGERS = {
+	pip: PIP_SUBCOMMANDS,
+	pip3: PIP_SUBCOMMANDS,
+	poetry: [
+		"install",
+		"add",
+		"remove",
+		"show",
+		"lock",
+		"update"
+	],
+	pipenv: ["install", "uninstall"],
+	uv: [
+		"add",
+		"remove",
+		"sync"
+	],
+	pdm: [
+		"install",
+		"add",
+		"remove"
+	],
+	conda: ["install", "remove"],
+	composer: [
+		"install",
+		"require",
+		"update",
+		"remove",
+		"show"
+	],
+	bundle: BUNDLE_SUBCOMMANDS,
+	bundler: BUNDLE_SUBCOMMANDS,
+	gem: [
+		"install",
+		"uninstall",
+		"list",
+		"search"
+	],
+	swift: ["package", "build"],
+	pod: [
+		"install",
+		"update",
+		"search"
+	],
+	carthage: ["bootstrap", "update"]
+};
+const GRADLE_EXACT_TASKS = new Set([
+	"build",
+	"clean",
+	"dependencies"
+]);
+const GRADLE_TASK_VERBS = [
+	"assemble",
+	"compile",
+	"bundle",
+	"lint"
+];
+const XCODEBUILD_DENIED_ACTIONS = new Set(["test", "test-without-building"]);
+const DANGEROUS_OPERATORS = /[;`$()]/;
+const ALLOWED_TOOLS_SUMMARY = "Allowed: npm/pnpm/yarn/bun (install|i|ci|add|remove|uninstall|update|view, run <build/lint/typecheck script>), npx <lint tool|tsc|expo|pod-install|cap>, pip/pip3/poetry/pipenv/uv/pdm/conda (install/add/remove/...), composer (install|require|update|remove|show), bundle (install|add|remove|update|show|exec <lint tool>), gem (install|uninstall|list|search), swift (package|build), pod (install|update|search), carthage (bootstrap|update), xcodebuild (build/clean/archive actions), gradle/gradlew (build|clean|dependencies|assemble*/compile*/bundle*/lint* tasks), mvn (install|compile|package|verify|dependency:tree).";
+function deny(analyticsReason, message) {
+	return {
+		allowed: false,
+		message,
+		analyticsReason
+	};
+}
+function denyCommand(command, feedback) {
+	return deny("not in allowlist", `Bash command not allowed: \`${command.length > 120 ? command.slice(0, 117) + "..." : command}\`. ${feedback}`);
+}
+function isNodeScriptName(token) {
+	return NODE_SCRIPT_NAMES.some((name) => token === name || token.startsWith(name + ":"));
+}
+function isLintingTool(token) {
+	return LINTING_TOOLS.includes(token) || token === "tsc";
+}
+function nodeDecision(parts, command) {
+	const bin = parts[0];
+	let i = 1;
+	if (bin === "yarn" && parts[i] === "workspace" && parts[i + 1]) i += 2;
+	for (;;) {
+		const t = parts[i];
+		if (t === "-r" || t === "--recursive") i++;
+		else if (t && (t.startsWith("--filter=") || t.startsWith("--workspace="))) i++;
+		else if ((t === "--filter" || t === "--workspace" || t === "-w" && bin === "npm") && parts[i + 1]) i += 2;
+		else if (t === "-w" && bin === "pnpm") i++;
+		else break;
+	}
+	const sub = parts[i];
+	const feedback = `Allowed ${bin} usage: ${bin} ${NODE_SUBCOMMANDS.join("|")} [args], ${bin} run <script named ${NODE_SCRIPT_NAMES.join("/")}>, ${bin} exec <lint tool>, or ${bin} <that script name or lint tool> directly.`;
+	if (!sub) return denyCommand(command, feedback);
+	if (sub === "run") {
+		const target = parts[i + 1];
+		if (target && isNodeScriptName(target)) return { allowed: true };
+		return denyCommand(command, feedback);
+	}
+	if (sub === "exec") {
+		const target = parts[i + 1];
+		if (target && isLintingTool(target)) return { allowed: true };
+		return denyCommand(command, feedback);
+	}
+	if (NODE_SUBCOMMANDS.includes(sub)) return { allowed: true };
+	if (isNodeScriptName(sub) || isLintingTool(sub)) return { allowed: true };
+	return denyCommand(command, feedback);
+}
+function npxDecision(parts, command) {
+	const target = parts[1];
+	if (!target || target.startsWith("-")) return denyCommand(command, "npx may only run a known tool directly: tsc, expo, pod-install, cap, or a lint/format tool (eslint, prettier, biome, ...).");
+	const name = target.replace(/@[^@/]*$/, "");
+	if (NPX_TOOLS.has(name)) return { allowed: true };
+	return denyCommand(command, "npx may only run a known tool directly: tsc, expo, pod-install, cap, or a lint/format tool (eslint, prettier, biome, ...).");
+}
+function gradleDecision(parts, command) {
+	let sawTask = false;
+	for (const raw of parts.slice(1)) {
+		if (raw.startsWith("-")) continue;
+		const task = raw.replace(/^(?::[\w.-]+)+:/, "");
+		if (!(GRADLE_EXACT_TASKS.has(task) || GRADLE_TASK_VERBS.some((verb) => task.startsWith(verb) && /^[A-Z]/.test(task.slice(verb.length))))) return denyCommand(command, "Allowed gradle tasks: build, clean, dependencies, or assemble*/compile*/bundle*/lint* variants (flags OK).");
+		sawTask = true;
+	}
+	return sawTask ? { allowed: true } : denyCommand(command, "Give gradle an allowed task: build, clean, dependencies, assembleDebug, ...");
+}
+function mavenDecision(parts, command) {
+	let sawGoal = false;
+	for (const raw of parts.slice(1)) {
+		if (raw.startsWith("-")) continue;
+		if (!MAVEN_GOALS.includes(raw)) return denyCommand(command, `Allowed mvn goals: ${MAVEN_GOALS.join(", ")} (flags OK).`);
+		sawGoal = true;
+	}
+	return sawGoal ? { allowed: true } : denyCommand(command, `Give mvn an allowed goal: ${MAVEN_GOALS.join(", ")}.`);
+}
+function xcodebuildDecision(parts, command) {
+	for (const t of parts.slice(1)) if (XCODEBUILD_DENIED_ACTIONS.has(t)) return denyCommand(command, "xcodebuild test actions are not allowed; build, clean, and archive are.");
+	return { allowed: true };
+}
+/** Grammar decision for a single operator-free, pipe-free command. */
+function commandDecision(command) {
+	const parts = command.split(/\s+/).filter(Boolean);
+	const bin = parts[0];
+	if (!bin) return denyCommand(command, ALLOWED_TOOLS_SUMMARY);
+	if (NODE_MANAGERS.has(bin)) return nodeDecision(parts, command);
+	if (bin === "npx") return npxDecision(parts, command);
+	if (GRADLE_MANAGERS.has(bin)) return gradleDecision(parts, command);
+	if (MAVEN_MANAGERS.has(bin)) return mavenDecision(parts, command);
+	if (bin === "xcodebuild") return xcodebuildDecision(parts, command);
+	if ((bin === "python" || bin === "python3") && parts[1] === "manage.py" && parts[2] === "check") return { allowed: true };
+	if (bin === "uv" && parts[1] === "pip") {
+		if (parts[2] && PIP_SUBCOMMANDS.includes(parts[2])) return { allowed: true };
+		return denyCommand(command, `Allowed uv pip subcommands: ${PIP_SUBCOMMANDS.join(", ")}.`);
+	}
+	if ((bin === "bundle" || bin === "bundler") && parts[1] === "exec") {
+		if (parts[2] && isLintingTool(parts[2])) return { allowed: true };
+		return denyCommand(command, `bundle exec may only run a lint/format tool (rubocop, ...). Allowed bundle subcommands: ${BUNDLE_SUBCOMMANDS.join(", ")}, exec <lint tool>.`);
+	}
+	const subs = SIMPLE_MANAGERS[bin];
+	if (subs) {
+		if (parts[1] && subs.includes(parts[1])) return { allowed: true };
+		const exec = bin === "bundle" || bin === "bundler" ? ", exec <lint tool>" : "";
+		return denyCommand(command, `Allowed ${bin} subcommands: ${subs.join(", ")}${exec}.`);
+	}
+	return denyCommand(command, `\`${bin}\` is not an allowed tool. ${ALLOWED_TOOLS_SUMMARY}`);
+}
+function tailArgsAreSafe(argStr) {
+	const args = argStr.trim().split(/\s+/).filter(Boolean);
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (/^-[nc]$/.test(a)) {
+			if (!/^[+-]?\d+$/.test(args[i + 1] ?? "")) return false;
+			i++;
+		} else if (!/^-[nc]?\+?\d+$/.test(a)) return false;
+	}
+	return true;
+}
+/**
+* Full fence decision for a Bash command: shell-shape gates (separators,
+* redirects, pipes) first, then the per-manager grammar.
+*/
+function evaluateBashCommand(rawCommand) {
+	const command = rawCommand.trim();
+	if (/[\r\n]/.test(command)) return deny("dangerous operators", "Bash command not allowed. Multi-line commands are not permitted — run one command at a time.");
+	if (DANGEROUS_OPERATORS.test(command)) return deny("dangerous operators", "Bash command not allowed. Shell operators like ; ` $ ( ) are not permitted.");
+	const normalized = command.replace(/\s*\d*>&\d+\s*/g, " ").replace(/\s*\d*>\s*\/dev\/null\s*/g, " ").trim();
+	if (/[<>]/.test(normalized)) return deny("disallowed redirect", "Bash command not allowed. Redirects are not permitted (only 2>&1 and >/dev/null).");
+	const pipeMatch = normalized.match(/^(.+?)\s*\|\s*(?:tail|head)((?:\s+\S+)*)\s*$/);
+	if (pipeMatch) {
+		const base = pipeMatch[1].trim();
+		if (/[|&]/.test(base)) return deny("multiple pipes", "Bash command not allowed. Only a single pipe to tail/head is permitted.");
+		if (!tailArgsAreSafe(pipeMatch[2])) return deny("disallowed pipe", "Bash command not allowed. tail/head may only take numeric flags (-n 50, -c 200) — no file arguments.");
+		return commandDecision(base);
+	}
+	if (/[|&]/.test(normalized)) return deny("disallowed pipe", "Bash command not allowed. Pipes are only permitted as a single | tail/head for output limiting.");
+	return commandDecision(normalized);
+}
+//#endregion
 //#region src/lib/agent/triage-provider.ts
 /**
 * LLM provider for warlock security-scan triage.
@@ -231,44 +509,6 @@ function createTriageLLMProvider(auth) {
 	};
 }
 //#endregion
-//#region src/lib/agent/commandments.ts
-/**
-* Wizard-wide commandments that are always appended as a system prompt.
-*
-* Keep this as a simple string so it can be inlined into the compiled bundle
-* without extra files, copying, or runtime I/O.
-*/
-const WIZARD_COMMANDMENTS = [
-	"Never hallucinate a PostHog project token, host, or any other secret. Always use the real values that have been configured for this project (for example via environment variables).",
-	"Never write API keys, access tokens, or other secrets directly into source code. Always reference environment variables instead, and rely on the wizard-tools MCP server (check_env_keys / set_env_values) to create or update .env files.",
-	"Always use the detect_package_manager tool from the wizard-tools MCP server to determine the package manager. Do not guess based on lockfiles or hard-code npm, yarn, pnpm, bun, pip, etc.",
-	"Before writing to any file, you MUST read that exact file immediately beforehand using the Read tool, even if you have already read it earlier in the run. This avoids tool failures and stale edits.",
-	"Treat feature flags, custom properties, and event names as part of an analytics contract. Prefer reusing existing names and patterns in the project. When you must introduce new ones, make them clear, descriptive, and consistent with existing conventions, and avoid scattering the same flag or property across many unrelated callsites.",
-	"Keep PostHog data capture at its defaults unless the user explicitly asks otherwise. Do not disable autocapture, do not disable session recording, and never set opt_out_capturing (or opted_out) to true in the SDK init config — these turn off data the user almost always wants. Note: posthog.opt_out_capturing() called at runtime for GDPR consent flows is legitimate; the rule is about the init configuration.",
-	"Never put personally identifiable information — emails, full or partial names, phone numbers, physical or IP addresses, or other user-entered PII — in capture() event properties. PII belongs on the PERSON: send it via identify()/$set (or the SDK's person-property API), and capture events with a stable distinct id derived from the authenticated user or session, never a raw email or name. This holds for every SDK, client and server.",
-	"Prefer minimal, targeted edits that achieve the requested behavior while preserving existing structure and style. Avoid large refactors, broad reformatting, or unrelated changes unless explicitly requested.",
-	"When you change a file that already exists, edit it in place. If an edit fails because the text you are matching is not unique, add just enough surrounding context to make it unique, or apply the change to each occurrence — never fall back to rewriting the whole file. Write a file in full only when you are creating it, never to modify one that already exists.",
-	"Before you overwrite or delete anything that already exists, look at what you would remove. This integration only adds instrumentation, so keep every part of the project unrelated to PostHog exactly as it was — never drop existing code, comments, or markup to make room for a change.",
-	"Do not spawn subagents unless explicitly instructed to do so.",
-	"Create tasks as soon as you understand the work you are going to carry out. Break the list into distinct stages of work that the user can follow through. Create all tasks in a single tool call, in the order you will be performing them. Drive the work with TaskUpdate: status in_progress when you begin a task, completed when done.",
-	"Keep task titles broad and stage-oriented — describe the purpose or area of work, not the specific files, paths, or symbols involved. Do not name individual files, modules, or directories inside task titles, and do not include illustrative examples within a task title.",
-	"Do not assume \"PostHog provider\" or \"PostHogProvider\" in task labels, status messages, or code. Only use a provider if the skill workflow explicitly requires one for the specific framework.",
-	"If you see a [YARA WARNING] or [YARA VIOLATION] message, handle it silently. Fix the issue (revert the write, avoid the flagged pattern) without mentioning security warnings or YARA to the user. These are internal guardrails, not user-facing alerts. Never show scary security language to the user.",
-	[
-		"When a skill instructs you to gather information from the user, use the `wizard_ask` MCP tool from the wizard-tools server. Never inline questions in your text output expecting a reply — the user has no way to answer text.",
-		"When a skill provides a numbered or bulleted list of questions, translate the entire list into a single `wizard_ask` tool call:",
-		"  - One tool call per skill step. Batch every question from that step into the `questions` array — never split into multiple calls.",
-		"  - Infer `kind` from the question phrasing: comma-separated alternatives (\"React, Vue, or vanilla JS?\") → `single`; phrasing like \"all that apply\" or \"any of\" → `multi`; everything else → `text`.",
-		"  - For `single` and `multi`, extract the alternatives from the prose into `options` as `{ label, value }` pairs. Use the human phrase as `label` and a lowercase-hyphenated form as `value` (e.g., `label: \"Vanilla JS\"`, `value: \"vanilla-js\"`).",
-		"  - Use a kebab-case slug of the question label as `id` (e.g., \"Tech stack\" → `tech-stack`, \"Show frequency\" → `show-frequency`).",
-		"  - Do not invent fields the schema does not define (no `source`, `category`, `priority`, etc.) — the tool rejects unknown fields and the wizard already knows which skill is running.",
-		"After `wizard_ask` returns, use the answers directly — do not re-ask in text or call `wizard_ask` again for the same fields."
-	].join("\n")
-].join("\n");
-function getWizardCommandments() {
-	return WIZARD_COMMANDMENTS;
-}
-//#endregion
 //#region src/lib/agent/agent-phase.ts
 /** Maps a Claude SDK tool name to the phase that tool implies. Returns null
 *  when the tool doesn't drive the visualizer (Task*, TodoWrite, etc.). */
@@ -959,62 +1199,9 @@ function buildAgentEnv(wizardMetadata, wizardFlags) {
 	return encoded;
 }
 /**
-* Package managers that can be used to run commands.
-*/
-const PACKAGE_MANAGERS = [
-	"npm",
-	"pnpm",
-	"yarn",
-	"bun",
-	"npx",
-	"pip",
-	"pip3",
-	"poetry",
-	"pipenv",
-	"uv"
-];
-/**
-* Safe scripts/commands that can be run with any package manager.
-* Uses startsWith matching, so 'build' matches 'build', 'build:prod', etc.
-* Note: Linting tools are in LINTING_TOOLS and checked separately.
-*/
-const SAFE_SCRIPTS = [
-	"install",
-	"add",
-	"ci",
-	"build",
-	"tsc",
-	"typecheck",
-	"type-check",
-	"check-types",
-	"types",
-	"lint",
-	"format"
-];
-/**
-* Dangerous shell operators that could allow command injection.
-* Note: We handle `2>&1` and `| tail/head` separately as safe patterns.
-*/
-const DANGEROUS_OPERATORS = /[;`$()]/;
-/**
-* Check if command is an allowed package manager command.
-* Matches: <pkg-manager> [run|exec] <safe-script> [args...]
-*/
-function matchesAllowedPrefix(command) {
-	const parts = command.split(/\s+/);
-	if (parts.length === 0 || !PACKAGE_MANAGERS.includes(parts[0])) return false;
-	let scriptIndex = 1;
-	if (parts[scriptIndex] === "run" || parts[scriptIndex] === "exec") scriptIndex++;
-	if (parts[scriptIndex] === "i") return true;
-	const scriptPart = parts.slice(scriptIndex).join(" ");
-	return SAFE_SCRIPTS.some((safe) => scriptPart.startsWith(safe)) || LINTING_TOOLS.some((tool) => scriptPart.startsWith(tool));
-}
-/**
-* Permission hook that allows only safe commands.
-* - Package manager install commands
-* - Build/typecheck/lint commands for verification
-* - Piping to tail/head for output limiting is allowed
-* - Stderr redirection (2>&1) is allowed
+* Permission hook that allows only safe commands. Bash commands are gated by
+* the exact per-manager fence in bash-fence.ts (install/build/typecheck/lint
+* commands, single | tail/head, 2>&1).
 *
 * `wizardAskPending` is true while a wizard_ask overlay is open — when set,
 * Write/Edit calls are denied as a defense-in-depth measure against a
@@ -1040,7 +1227,8 @@ function wizardCanUseTool(toolName, input, context = {}) {
 	if (toolName === "Read" || toolName === "Write" || toolName === "Edit") {
 		const filePath = typeof input.file_path === "string" ? input.file_path : "";
 		const basename = path.basename(filePath);
-		if (basename.startsWith(".env")) {
+		const isEnvExample = /^\.env\.(example|sample|template|dist)$/.test(basename);
+		if (basename.startsWith(".env") && !isEnvExample) {
 			logToFile(`Denying ${toolName} on env file: ${filePath}`);
 			return {
 				behavior: "deny",
@@ -1071,56 +1259,8 @@ function wizardCanUseTool(toolName, input, context = {}) {
 		updatedInput: input
 	};
 	const command = (typeof input.command === "string" ? input.command : "").trim();
-	if (DANGEROUS_OPERATORS.test(command)) {
-		logToFile(`Denying bash command with dangerous operators: ${command}`);
-		debug(`Denying bash command with dangerous operators: ${command}`);
-		analytics.wizardCapture("bash denied", {
-			reason: "dangerous operators",
-			command
-		});
-		return {
-			behavior: "deny",
-			message: `Bash command not allowed. Shell operators like ; \` $ ( ) are not permitted.`
-		};
-	}
-	const normalized = command.replace(/\s*\d*>&\d+\s*/g, " ").trim();
-	const pipeMatch = normalized.match(/^(.+?)\s*\|\s*(tail|head)(\s+\S+)*\s*$/);
-	if (pipeMatch) {
-		const baseCommand = pipeMatch[1].trim();
-		if (/[|&]/.test(baseCommand)) {
-			logToFile(`Denying bash command with multiple pipes: ${command}`);
-			debug(`Denying bash command with multiple pipes: ${command}`);
-			analytics.wizardCapture("bash denied", {
-				reason: "multiple pipes",
-				command
-			});
-			return {
-				behavior: "deny",
-				message: `Bash command not allowed. Only single pipe to tail/head is permitted.`
-			};
-		}
-		if (matchesAllowedPrefix(baseCommand)) {
-			logToFile(`Allowing bash command with output limiter: ${command}`);
-			debug(`Allowing bash command with output limiter: ${command}`);
-			return {
-				behavior: "allow",
-				updatedInput: input
-			};
-		}
-	}
-	if (/[|&]/.test(normalized)) {
-		logToFile(`Denying bash command with pipe/&: ${command}`);
-		debug(`Denying bash command with pipe/&: ${command}`);
-		analytics.wizardCapture("bash denied", {
-			reason: "disallowed pipe",
-			command
-		});
-		return {
-			behavior: "deny",
-			message: `Bash command not allowed. Pipes are only permitted with tail/head for output limiting.`
-		};
-	}
-	if (matchesAllowedPrefix(normalized)) {
+	const decision = evaluateBashCommand(command);
+	if (decision.allowed) {
 		logToFile(`Allowing bash command: ${command}`);
 		debug(`Allowing bash command: ${command}`);
 		return {
@@ -1128,15 +1268,15 @@ function wizardCanUseTool(toolName, input, context = {}) {
 			updatedInput: input
 		};
 	}
-	logToFile(`Denying bash command: ${command}`);
-	debug(`Denying bash command: ${command}`);
+	logToFile(`Denying bash command (${decision.analyticsReason}): ${command}`);
+	debug(`Denying bash command (${decision.analyticsReason}): ${command}`);
 	analytics.wizardCapture("bash denied", {
-		reason: "not in allowlist",
+		reason: decision.analyticsReason,
 		command
 	});
 	return {
 		behavior: "deny",
-		message: `Bash command not allowed. Only install, build, typecheck, lint, and formatting commands are permitted.`
+		message: decision.message
 	};
 }
 /**
@@ -1807,6 +1947,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { wizardCanUseTool as a, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, createTriageLLMProvider as g, getWizardCommandments as h, runAgent as i, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u };
+export { wizardCanUseTool as a, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, createTriageLLMProvider as h, runAgent as i, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u };
 
-//# sourceMappingURL=agent-interface-BvTxWiol.js.map
+//# sourceMappingURL=agent-interface-CF7GsdFf.js.map