@principles/core 1.296.2 → 1.297.1

package/dist/runtime-v2/internalization/bash-risk.js

@@ -0,0 +1,785 @@
+/**
+ * bash-risk.ts — PRI-1047/R8: 宿主 bash 命令风险分类的单一实现（P4）。
+ *
+ * 契约（SPEC-PRI-1047 §R8 修订，Owner 评审 2026-10-27）：
+ *   safe     = 正面证据确认整条命令链只读（显式只读白名单 + 参数形状核验
+ *              + 结构核验：管道/组合/换行/重定向/命令替换全部确认）。
+ *   normal   = 确认发生变更（已知变更命令/子命令、写文件选项、输出重定向、
+ *              内联任意代码执行）。
+ *   dangerous= 确认高破坏性变更（rm -rf / chmod / chown）。
+ *   unknown  = 无法可靠解释（未识别命令/子命令/全局选项、不支持的结构、
+ *              解释器执行不可分析输入）。unknown 不获得只读豁免，
+ *              但与审批事实 unknown/missing 的中性降级是两个概念。
+ *
+ * 能力边界（如实声明，不假装完整 shell 语义）：
+ *   - 仅 POSIX 风格 tokenizer（单/双引号、结构算子、重定向、$()/``）；
+ *     不实现变量展开、glob 语义、进程替换（>(  <( → unknown）。
+ *   - 只读是显式白名单子集；清单外的命令一律 unknown（不是 safe）。
+ *   - git 仅识别显式全局选项集；未识别的子命令前选项 → unknown。
+ *   - 命令替换递归深度上限 3。
+ *
+ * 三方共用（保持零调用方改动）：host-runtime 生产 gate（无 provider 时的
+ * 确定性默认）、OpenClaw 插件 enrichment、golden-trace 回放推导。
+ */
+const LITERAL_OPERATOR_MARKER = '\u0001';
+const SHELL_OPERATORS = '|;&<>()';
+function literalShellChar(ch) {
+    return SHELL_OPERATORS.includes(ch) ? `${LITERAL_OPERATOR_MARKER}${ch}` : ch;
+}
+function restoreLiteralShellChars(token) {
+    return token.replaceAll(LITERAL_OPERATOR_MARKER, '');
+}
+// ── 结构层 tokenizer ─────────────────────────────────────────────────────────
+/** 引号感知的 tokenizer；无法解析（引号未闭合等）返回 null。 */
+function tokenize(input) {
+    if (input.includes(LITERAL_OPERATOR_MARKER))
+        return null;
+    const tokens = [];
+    let current = '';
+    let hasCurrent = false;
+    let i = 0;
+    const n = input.length;
+    let state = 'plain';
+    while (i < n) {
+        const ch = input[i];
+        if (ch === undefined)
+            break;
+        if (state === 'single') {
+            if (ch === "'")
+                state = 'plain';
+            else
+                current += literalShellChar(ch);
+            i += 1;
+            continue;
+        }
+        if (state === 'double') {
+            if (ch === '"')
+                state = 'plain';
+            else if (ch === '\\' && i + 1 < n && '"\\$`'.includes(input[i + 1] ?? '')) {
+                current += literalShellChar(input[i + 1] ?? '');
+                i += 2;
+                continue;
+            }
+            else
+                current += literalShellChar(ch);
+            i += 1;
+            continue;
+        }
+        if (ch === "'") {
+            state = 'single';
+            hasCurrent = true;
+            i += 1;
+            continue;
+        }
+        if (ch === '"') {
+            state = 'double';
+            hasCurrent = true;
+            i += 1;
+            continue;
+        }
+        if (ch === '\\' && i + 1 < n) {
+            current += literalShellChar(input[i + 1] ?? '');
+            hasCurrent = true;
+            i += 2;
+            continue;
+        }
+        if (ch === '\r' || ch === '\n') {
+            if (hasCurrent || current) {
+                tokens.push(current);
+                current = '';
+                hasCurrent = false;
+            }
+            // A physical newline terminates a simple command, unlike horizontal space.
+            if (ch === '\r' && input[i + 1] === '\n')
+                i += 1;
+            tokens.push('\n');
+            i += 1;
+            continue;
+        }
+        if (' \t'.includes(ch)) {
+            if (hasCurrent || current) {
+                tokens.push(current);
+                current = '';
+                hasCurrent = false;
+            }
+            i += 1;
+            continue;
+        }
+        // Structural operators become standalone tokens (newline included).
+        if ('|;&<>()'.includes(ch)) {
+            if (hasCurrent || current) {
+                tokens.push(current);
+                current = '';
+                hasCurrent = false;
+            }
+            let op = ch;
+            const next = input[i + 1];
+            if (ch === '<' && next === '>')
+                op = '<>';
+            else if ((ch === '|' || ch === '&' || ch === '>' || ch === '<') && next === ch)
+                op += next;
+            if ((ch === '>' || ch === '<') && next === '(')
+                op += next; // process substitution marker
+            tokens.push(op);
+            i += op.length;
+            continue;
+        }
+        current += ch;
+        hasCurrent = true;
+        i += 1;
+    }
+    if (state !== 'plain')
+        return null;
+    if (hasCurrent || current)
+        tokens.push(current);
+    return tokens;
+}
+const REDIRECT_OUT_OPS = new Set(['>', '>>', '<>', '&>', '&>>', '2>', '2>>']);
+/**
+ * 把 token 流切成段。遇到 `|`、`;`、`&&`、`||` 结束当前段；重定向算子吞掉
+ * 其目标 token。无法解释的结构（`(`、`)`、`>(`、`<(`、裸 `&`）标记
+ * unsupported。命令替换在 tokenize 前已被提取（见 classifyCommandRisk）。
+ */
+function splitSegments(tokens) {
+    const segments = [];
+    let args = [];
+    let hasOut = false;
+    let hasIn = false;
+    let unsupported = false;
+    const flush = (allowEmpty = false) => {
+        if (args.length === 0 && !hasOut && !hasIn && !unsupported) {
+            if (allowEmpty)
+                unsupported = true;
+            else
+                return;
+        }
+        segments.push({
+            command: args[0] === undefined ? null : restoreLiteralShellChars(args[0]),
+            hasOutputRedirect: hasOut,
+            hasInputRedirect: hasIn,
+            unsupported,
+            args: args.slice(1).map(restoreLiteralShellChars),
+            substitutions: [],
+        });
+        args = [];
+        hasOut = false;
+        hasIn = false;
+        unsupported = false;
+    };
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '\n') {
+            flush();
+            continue;
+        }
+        if (token === '|' || token === ';' || token === '&&' || token === '||') {
+            flush(true);
+            continue;
+        }
+        if (REDIRECT_OUT_OPS.has(token)) {
+            hasOut = true;
+            i += 1; // swallow the redirect target token
+            continue;
+        }
+        if (token === '<' || token === '<<' || token === '<<<') {
+            hasIn = true;
+            i += 1; // swallow the target word (heredoc body is data)
+            continue;
+        }
+        if (token.startsWith('2>') || token.startsWith('&>') || token.startsWith('>>') || token.startsWith('>')) {
+            // Glued forms like `2>x`, `>x`, `>>x`.
+            hasOut = true;
+            continue;
+        }
+        if (token === '(' || token === ')' || token === '>(' || token === '<(' || token === '&' || token === '>' || token === '<' || token === '>>') {
+            unsupported = true;
+            continue;
+        }
+        args.push(token);
+    }
+    flush();
+    return segments;
+}
+// ── 命令级白名单/已知集合 ────────────────────────────────────────────────────
+/** Commands whose stdout-only forms have a bounded option grammar below. */
+const STDOUT_QUERY_COMMANDS = new Set(['cat', 'ls', 'printf', 'head', 'tail', 'grep', 'rg', 'echo', 'wc']);
+/** git 显式全局选项集（带参 vs 布尔）。 */
+const GIT_GLOBAL_WITH_VALUE = new Set(['-C', '--git-dir', '--work-tree']);
+const GIT_GLOBAL_BOOLEAN = new Set([
+    '--no-pager', '-P', '--no-replace-objects', '--bare', '--literal-pathspecs',
+    '--glob-pathspecs', '--noglob-pathspecs', '--icase-pathspecs', '--no-optional-locks', '--no-lazy-fetch',
+    '--no-advice',
+]);
+/** git 查询子命令（需再核写文件选项）。 */
+const GIT_READONLY_SUBCOMMANDS = new Set(['status', 'log', 'show', 'diff', 'grep']);
+const GIT_MUTATING_SUBCOMMANDS = new Set([
+    'add', 'am', 'apply', 'bisect', 'checkout', 'cherry-pick', 'clean', 'clone', 'commit', 'fetch', 'gc',
+    'init', 'merge', 'mv', 'pull', 'push', 'rebase', 'reset', 'restore', 'revert', 'rm', 'sparse-checkout',
+    'submodule', 'switch', 'worktree', 'update-index', 'hash-object',
+]);
+/** git 查询子命令中的写文件选项（--output=FILE / --output FILE / -o FILE）。 */
+function gitArgsHaveWriteOption(args) {
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === '--output' || a === '-o' || a.startsWith('-o') && a.length > 2)
+            return true;
+        if (a.startsWith('--output='))
+            return true;
+    }
+    return false;
+}
+/** 列表形状子命令（branch/tag/remote/stash/config）逐个判定；返回 true/false/'unknown'。 */
+function isReadonlyGitListShape(sub, args) {
+    const positional = args.filter((a) => !a.startsWith('-'));
+    const flags = args.filter((a) => a.startsWith('-'));
+    if (sub === 'branch' || sub === 'tag') {
+        const writes = ['-d', '-D', '-m', '-M', '-c', '-C', '--delete', '--move', '--copy', '--unset-upstream', '--set-upstream-to', '--set-upstream'];
+        if (flags.some((f) => writes.some((w) => f === w || f.startsWith(`${w}=`))))
+            return false;
+        const allowed = sub === 'branch'
+            ? new Set(['-a', '-r', '-v', '-vv', '--all', '--remotes', '--verbose', '--no-abbrev', '--no-color', '--color', '--contains', '--no-contains', '--merged', '--no-merged', '--list', '--show-current'])
+            : new Set(['-l', '--list', '-n', '--contains', '--no-contains', '--merged', '--no-merged', '--sort', '--format', '--column', '--no-column', '--points-at', '--format']);
+        if (flags.some((f) => !allowed.has(f) && ![...allowed].some((w) => f.startsWith(`${w}=`))))
+            return 'unknown';
+        if (positional.length === 0 || flags.includes('--list') || flags.includes('-l'))
+            return true;
+        return false;
+    }
+    if (sub === 'remote') {
+        if (positional.length === 0 && flags.every((f) => f === '-v' || f === '--verbose'))
+            return true;
+        return false; // add/rename/remove/set-url/prune/rm → 变更
+    }
+    if (sub === 'stash') {
+        // stash list / stash show are queries; other verbs mutate or are unsupported.
+        if (args.length === 0 || positional[0] === 'push' || positional[0] === 'pop' || positional[0] === 'drop' || positional[0] === 'clear')
+            return false;
+        if (positional[0] === 'list' || positional[0] === 'show')
+            return flags.length === 0 ? true : 'unknown';
+        return false;
+    }
+    if (sub === 'config') {
+        // 仅查询形状：--list/-l/--get*/--get-regexp + 可选 pattern。
+        const queryFlags = ['--list', '-l', '--get', '--get-all', '--get-regexp', '--get-urlmatch'];
+        const hasQuery = flags.some((f) => queryFlags.includes(f));
+        if (flags.some((f) => !queryFlags.includes(f)))
+            return 'unknown';
+        if (hasQuery && !positional.some((p) => p.includes('=')))
+            return true;
+        return 'unknown';
+    }
+    return 'unknown';
+}
+function isReadonlyGitQueryShape(sub, args) {
+    const allowed = {
+        status: ['--short', '--branch', '--porcelain', '--untracked-files', '--ignore-submodules', '-s', '-b'],
+        log: ['--oneline', '--stat', '--format', '--pretty', '--max-count', '-n', '--grep', '--author', '--since', '--until', '--date', '--graph', '--decorate', '--no-decorate', '--abbrev-commit', '--reverse', '--name-only', '--name-status'],
+        show: ['--stat', '--format', '--pretty', '--no-ext-diff', '--no-textconv'],
+        diff: ['--stat', '--name-only', '--name-status', '--check', '--cached', '--staged', '--patch', '-p', '--no-ext-diff', '--no-textconv'],
+        grep: ['--no-index', '--cached', '--untracked', '--ignore-case', '--line-number', '--regexp', '-n', '-i', '-e'],
+    };
+    const withValue = {
+        status: ['--porcelain', '--untracked-files', '--ignore-submodules'],
+        log: ['--format', '--pretty', '--max-count', '-n', '--grep', '--author', '--since', '--until', '--date'],
+        show: ['--format', '--pretty'],
+        diff: [],
+        grep: ['--regexp', '-e'],
+    };
+    if (allowed[sub] === undefined)
+        return 'unknown';
+    let positionalOnly = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const token = args[i];
+        if (token === '--') {
+            positionalOnly = true;
+            continue;
+        }
+        if (positionalOnly || token === '-' || !token.startsWith('-'))
+            continue;
+        if (sub === 'log' && /^-\d+$/.test(token))
+            continue;
+        const name = token.startsWith('--') && token.includes('=') ? token.slice(0, token.indexOf('=')) : token;
+        if (!allowed[sub]?.includes(name))
+            return 'unknown';
+        if (withValue[sub]?.includes(name) && !token.includes('=')) {
+            if (args[i + 1] === undefined)
+                return 'unknown';
+            i += 1;
+        }
+    }
+    return true;
+}
+function isReadonlyStdoutShape(command, args) {
+    const noValue = {
+        cat: { long: ['--number', '--show-ends', '--show-tabs', '--show-nonprinting'], short: 'nvet' },
+        ls: { long: ['--all', '--almost-all', '--directory', '--long', '--human-readable'], short: '1adhlrt' },
+        head: { long: ['--quiet', '--silent', '--verbose'], short: 'qv' },
+        tail: { long: ['--follow', '--quiet', '--silent', '--verbose'], short: 'fqv' },
+        grep: { long: ['--line-number', '--ignore-case', '--word-regexp', '--invert-match', '--recursive', '--files-with-matches', '--count', '--extended-regexp', '--fixed-strings'], short: 'EinwvrclF' },
+        rg: { long: ['--line-number', '--hidden', '--column', '--fixed-strings', '--ignore-case', '--smart-case', '--invert-match', '--word-regexp', '--files', '--count', '--only-matching'], short: 'nchFivw' },
+        printf: { long: [], short: '' },
+        echo: { long: [], short: '' },
+        wc: { long: [], short: 'lwmLc' },
+    };
+    const withValue = {
+        cat: { long: [], short: '' },
+        ls: { long: ['--color', '--sort', '--width'], short: 'w' },
+        head: { long: ['--lines', '--bytes'], short: 'nc' },
+        tail: { long: ['--lines', '--bytes'], short: 'nc' },
+        grep: { long: ['--regexp', '--file', '--max-count', '--after-context', '--before-context', '--context', '--include', '--exclude', '--exclude-dir'], short: 'efABmC' },
+        rg: { long: ['--glob', '--type', '--regexp', '--max-count', '--max-depth', '--after-context', '--before-context', '--context'], short: 'egmC' },
+        printf: { long: [], short: '' },
+        echo: { long: [], short: '' },
+        wc: { long: [], short: '' },
+    };
+    const allowed = noValue[command];
+    const values = withValue[command];
+    if (allowed === undefined || values === undefined)
+        return 'unknown';
+    if (command === 'printf' || command === 'echo') {
+        if (command === 'echo')
+            return true;
+        const format = args[0] === '--' ? args[1] : args[0];
+        const unverifiedOption = args[0] !== '--' && args[0]?.startsWith('-');
+        return unverifiedOption || /%[^%]*n/.test(format ?? '') ? 'unknown' : true;
+    }
+    let positionalOnly = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const token = args[i];
+        if (positionalOnly || token === '-' || !token.startsWith('-'))
+            continue;
+        if (token === '--') {
+            positionalOnly = true;
+            continue;
+        }
+        if (token.startsWith('--')) {
+            const equal = token.indexOf('=');
+            const name = equal === -1 ? token : token.slice(0, equal);
+            if (allowed.long.includes(name))
+                continue;
+            if (!values.long.includes(name))
+                return 'unknown';
+            if (equal === -1) {
+                if (args[i + 1] === undefined)
+                    return 'unknown';
+                i += 1;
+            }
+            continue;
+        }
+        const letters = token.slice(1);
+        if ((command === 'head' || command === 'tail') && /^\d+$/.test(letters))
+            continue;
+        for (let j = 0; j < letters.length; j += 1) {
+            const letter = letters[j];
+            if (values.short.includes(letter)) {
+                if (j + 1 === letters.length) {
+                    if (args[i + 1] === undefined)
+                        return 'unknown';
+                    i += 1;
+                }
+                break;
+            }
+            if (!allowed.short.includes(letter))
+                return 'unknown';
+        }
+    }
+    if (command === 'uniq' && args.filter((a) => !a.startsWith('-')).length > 1)
+        return false;
+    return true;
+}
+function isReadonlyGit(args) {
+    let i = 0;
+    // 跳过显式全局选项，找到子命令。
+    while (i < args.length) {
+        const a = args[i];
+        if (GIT_GLOBAL_WITH_VALUE.has(a)) {
+            i += 2;
+            continue;
+        }
+        if (a.startsWith('--git-dir=') || a.startsWith('--work-tree=')) {
+            i += 1;
+            continue;
+        }
+        if (GIT_GLOBAL_BOOLEAN.has(a)) {
+            i += 1;
+            continue;
+        }
+        break; // first non-global token = subcommand
+    }
+    const sub = args[i];
+    if (sub === undefined)
+        return 'unknown'; // `git` bare prints help — but conservative: unknown
+    const rest = args.slice(i + 1);
+    if (GIT_READONLY_SUBCOMMANDS.has(sub)) {
+        if (gitArgsHaveWriteOption(rest))
+            return false;
+        return isReadonlyGitQueryShape(sub, rest);
+    }
+    if (['branch', 'tag', 'remote', 'stash', 'config'].includes(sub)) {
+        return isReadonlyGitListShape(sub, rest);
+    }
+    if (sub.startsWith('-'))
+        return 'unknown'; // unrecognized global option → cannot confirm
+    if (GIT_MUTATING_SUBCOMMANDS.has(sub))
+        return false;
+    if (sub === 'reflog') {
+        if (rest[0] === 'delete' || rest[0] === 'expire' || rest[0] === 'drop')
+            return false;
+        return rest.length === 0 || rest.length === 1 && rest[0] === 'show' ? true : 'unknown';
+    }
+    return 'unknown';
+}
+/** 只读命令 + 参数形状约束；未识别命令 → 'unknown'（不默认 safe 也不默认变更）。 */
+function isReadonlyWithArgShape(command, args) {
+    // find supports only simple predicates and stdout listing; actions stay unknown.
+    if (command === 'find') {
+        const takesValue = new Set(['-name', '-iname', '-type', '-maxdepth', '-mindepth']);
+        for (let i = 0; i < args.length; i += 1) {
+            const token = args[i];
+            if (!token.startsWith('-'))
+                continue;
+            if (!takesValue.has(token) && token !== '-print')
+                return 'unknown';
+            if (takesValue.has(token)) {
+                if (args[i + 1] === undefined)
+                    return 'unknown';
+                i += 1;
+            }
+        }
+        return true;
+    }
+    // env：裸 env / 仅赋值与 flag → 打印环境（只读）；带命令 → 不可确认。
+    if (command === 'env')
+        return args.length === 0 ? true : 'unknown';
+    // git：全局选项核验 + 子命令白名单。
+    if (command === 'git')
+        return isReadonlyGit(args);
+    // sort/uniq are excluded from the read-only subset because their output
+    // operand/options can name a file; classify their explicit write form only.
+    if (command === 'sort')
+        return args.some((a) => a === '-o' || a === '--output' || a.startsWith('--output=') || a.startsWith('-o')) ? false : 'unknown';
+    if (command === 'uniq')
+        return args.filter((a) => !a.startsWith('-')).length > 1 ? false : 'unknown';
+    if (STDOUT_QUERY_COMMANDS.has(command))
+        return isReadonlyStdoutShape(command, args);
+    // Positive evidence is limited to the audited command families above.
+    return 'unknown';
+}
+/** 确认变更（非破坏级）的已知命令/解释器内联代码。 */
+const KNOWN_MUTATING = new Set([
+    'npm', 'yarn', 'pnpm', 'pip', 'pip3', 'cargo', 'gem', 'brew', 'apt', 'apt-get', 'choco', 'winget',
+    'docker', 'kubectl', 'make', 'cmake', 'gcc', 'g++', 'touch', 'tee', 'truncate', 'shred', 'patch', 'ln',
+    'kill', 'pkill', 'killall', 'dd', 'mount', 'umount', 'useradd', 'userdel', 'groupadd', 'systemctl',
+    'service', 'crontab', 'scp', 'rsync', 'cp', 'mv', 'rm', 'mkdir', 'rmdir', 'install', 'chgrp', 'openssl',
+    'gzip', 'gunzip', 'tar', 'zip', 'unzip', 'chmod', 'chown', 'aws', 'gcloud', 'az', 'ssh-keygen', 'watch',
+]);
+/** 危险级：显式破坏模式。 */
+function isDangerousShape(command, args) {
+    if (command === 'rm')
+        return args.some((a) => /^-[a-zA-Z]*[rf][a-zA-Z]*$/.test(a) && /[rf]/.test(a));
+    return command === 'chmod' || command === 'chown' || command === 'mkfs' || command === 'fdisk' || command === 'shred';
+}
+/** 内联任意代码执行（确认具备变更能力）与原地写入特判。 */
+function isInlineCodeExecution(command, args) {
+    if (command === 'node' || command === 'deno' || command === 'bun')
+        return args.some((a) => a === '-e' || a === '--eval' || a === 'eval');
+    if (command === 'python' || command === 'python3')
+        return args.some((a) => a === '-c' || a === '--command');
+    if (command === 'ruby' || command === 'perl')
+        return args.some((a) => a === '-e' || a === '--eval');
+    // sed/perl 原地写入是确认的文件变更；流式形态则不可确认（归 unknown）。
+    if (command === 'sed' || command === 'perl') {
+        return args.some((a) => a === '-i' || a === '--in-place' || a.startsWith('-i') && /^-[ip]/.test(a));
+    }
+    return false;
+}
+// ── 段级与链级判定 ──────────────────────────────────────────────────────────
+const SEVERITY = { normal: 2, dangerous: 3, unknown: 1 };
+function worstLevel(a, b) {
+    if (a === 'safe')
+        return b;
+    if (b === 'safe')
+        return a;
+    return SEVERITY[a] >= SEVERITY[b] ? a : b;
+}
+/** 命令替换提取：把 $(…) 与 `…` 的内部文本收集出来并替换为占位（保留结构）。 */
+function extractBalanced(input, start, close) {
+    let depth = 0;
+    let inner = '';
+    for (let i = start - 1; i < input.length; i += 1) {
+        const ch = input[i];
+        if (ch === '(')
+            depth += 1;
+        if (ch === ')') {
+            depth -= 1;
+            if (depth === 0)
+                return { inner, end: i + 1 };
+        }
+        if (depth >= 1 && i >= start)
+            inner += ch;
+    }
+    void close;
+    return null;
+}
+function findDoubleEnd(input, start) {
+    for (let i = start; i < input.length; i += 1) {
+        if (input[i] === '"')
+            return i;
+    }
+    return -1;
+}
+function extractSubstitutions(input) {
+    const subs = [];
+    let out = '';
+    let unknownExpansion = false;
+    let i = 0;
+    const n = input.length;
+    let depth = 0;
+    let current = '';
+    let mode = 'none';
+    while (i < n) {
+        const ch = input[i];
+        if (mode === 'single') {
+            if (ch === "'")
+                mode = 'none';
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (mode === 'double') {
+            if (ch === '"') {
+                mode = 'none';
+                out += ch;
+                i += 1;
+                continue;
+            }
+            if (ch === '\\' && i + 1 < n && '"\\$`'.includes(input[i + 1] ?? '')) {
+                out += ch + (input[i + 1] ?? '');
+                i += 2;
+                continue;
+            }
+            if (ch === '$' && input[i + 1] === '(') {
+                // command substitution inside double quotes
+                const sub = extractBalanced(input, i + 2, ')');
+                if (sub === null)
+                    return null;
+                subs.push(sub.inner);
+                out += '"SUB"';
+                i = sub.end;
+                continue;
+            }
+            if (ch === '`') {
+                let end = i + 1;
+                while (end < n) {
+                    if (input[end] === '\\') {
+                        end += 2;
+                        continue;
+                    }
+                    if (input[end] === '`')
+                        break;
+                    end += 1;
+                }
+                if (end >= n)
+                    return null;
+                subs.push(input.slice(i + 1, end));
+                out += '"SUB"';
+                i = end + 1;
+                continue;
+            }
+            if (ch === '$')
+                unknownExpansion = true;
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (mode === 'paren') {
+            if (ch === "'") {
+                current += ch;
+                i += 1;
+                const close = input.indexOf("'", i);
+                if (close === -1)
+                    return null;
+                current += input.slice(i, close + 1);
+                i = close + 1;
+                continue;
+            }
+            if (ch === '"') {
+                current += ch;
+                i += 1;
+                const close = findDoubleEnd(input, i);
+                if (close === -1)
+                    return null;
+                current += input.slice(i, close + 1);
+                i = close + 1;
+                continue;
+            }
+            if (ch === '(') {
+                depth += 1;
+                current += ch;
+                i += 1;
+                continue;
+            }
+            if (ch === ')') {
+                depth -= 1;
+                if (depth === 0) {
+                    mode = 'none';
+                    subs.push(current);
+                    out += 'SUB';
+                    i += 1;
+                    continue;
+                }
+                current += ch;
+                i += 1;
+                continue;
+            }
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (mode === 'backtick') {
+            if (ch === '\\' && i + 1 < n) {
+                current += ch + (input[i + 1] ?? '');
+                i += 2;
+                continue;
+            }
+            if (ch === '`') {
+                mode = 'none';
+                subs.push(current);
+                out += 'SUB';
+                i += 1;
+                continue;
+            }
+            current += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === "'" && depth === 0) {
+            mode = 'single';
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '"') {
+            mode = 'double';
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === '\\') {
+            if (i + 1 >= n || input[i + 1] === '\n' || input[i + 1] === '\r')
+                return null;
+            out += ch + (input[i + 1] ?? '');
+            i += 2;
+            continue;
+        }
+        if (ch === '$' && input[i + 1] === '(') {
+            mode = 'paren';
+            depth = 1;
+            current = '';
+            i += 2;
+            continue;
+        }
+        if (ch === '$' || ch === '*' || ch === '?' || ch === '[' || ch === '{' || ch === '}')
+            unknownExpansion = true;
+        if (ch === '`') {
+            mode = 'backtick';
+            current = '';
+            i += 1;
+            continue;
+        }
+        if (ch === '>' && input[i + 1] === '(')
+            return null; // process substitution unsupported
+        if (ch === '<' && input[i + 1] === '(')
+            return null;
+        out += ch;
+        i += 1;
+    }
+    if (mode !== 'none' && mode !== 'double' && mode !== 'single')
+        return null;
+    if (mode === 'double' || mode === 'single')
+        return null; // unterminated quote
+    return { text: out, subs, unknownExpansion };
+}
+function classifySegment(segment, subLevels) {
+    let level = 'safe';
+    for (const s of subLevels)
+        level = worstLevel(level, s);
+    if (segment.unsupported)
+        return worstLevel(level, 'unknown');
+    if (segment.hasOutputRedirect)
+        return worstLevel(level, 'normal');
+    const { command } = segment;
+    if (command === null || command === '')
+        return 'unknown';
+    // 原地写入（sed -i 等）在 isInlineCodeExecution 内特判为确认变更。
+    if (isInlineCodeExecution(command, segment.args))
+        return worstLevel(level, 'normal');
+    // 解释器执行不可分析输入：无法确认只读。
+    if (['sh', 'bash', 'zsh', 'dash', 'ksh', 'powershell', 'pwsh', 'cmd', 'eval', 'source', '.', 'xargs', 'awk', 'sed', 'perl', 'expect', 'ssh'].includes(command)) {
+        return worstLevel(level, 'unknown');
+    }
+    if (isDangerousShape(command, segment.args))
+        return 'dangerous';
+    if (KNOWN_MUTATING.has(command))
+        return worstLevel(level, 'normal');
+    const readonly = isReadonlyWithArgShape(command, segment.args);
+    if (readonly === true)
+        return level;
+    if (readonly === false)
+        return worstLevel(level, 'normal');
+    return worstLevel(level, 'unknown');
+}
+function classifyCommandChain(input, depth) {
+    if (depth > 3)
+        return 'unknown';
+    const extracted = extractSubstitutions(input);
+    if (extracted === null)
+        return 'unknown';
+    const subLevels = extracted.subs.map((sub) => classifyCommandChain(sub, depth + 1));
+    const tokens = tokenize(extracted.text);
+    if (tokens === null)
+        return 'unknown';
+    if (tokens.length === 0)
+        return 'unknown';
+    const segments = splitSegments(tokens);
+    if (segments === null)
+        return 'unknown';
+    let level = 'safe';
+    for (const segment of segments) {
+        const segLevel = classifySegment(segment, subLevels);
+        level = worstLevel(level, segLevel);
+    }
+    if (extracted.unknownExpansion || extracted.subs.length > 0)
+        level = worstLevel(level, 'unknown');
+    return level;
+}
+/** 纯命令文本分类；空串 → unknown（与既有行为一致）。 */
+export function classifyCommandRisk(command) {
+    if (command.trim() === '')
+        return 'unknown';
+    try {
+        return classifyCommandChain(command, 0);
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * 按 (工具是否 execute 类, 参数) 分类。非 execute 类工具的 bashRisk 恒为
+ * unknown——该字段只描述 shell 命令。
+ */
+export function classifyBashRisk(isExecuteKind, params) {
+    if (!isExecuteKind)
+        return 'unknown';
+    try {
+        const p = typeof params === 'object' && params !== null && !Array.isArray(params) ? params : {};
+        const command = typeof p.command === 'string' ? p.command : typeof p.args === 'string' ? p.args : '';
+        if (command === '')
+            return 'unknown';
+        return classifyCommandRisk(command);
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=bash-risk.js.map