@qduc/term2 0.7.3 → 0.8.0

package/dist/utils/shell/command-safety/find-helpers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Check if a find command has dangerous execution flags (-exec, -execdir, -ok, -okdir, -delete)
+ */
+export declare function hasFindDangerousExecution(args: any[]): {
+    dangerous: boolean;
+    reason?: string;
+};
+/**
+ * Check for suspicious find flags that warrant YELLOW classification
+ */
+export declare function hasFindSuspiciousFlags(args: any[]): {
+    suspicious: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=find-helpers.d.ts.map

package/dist/utils/shell/command-safety/find-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-helpers.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/find-helpers.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuEA;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;IACnD,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA+DA"}

package/dist/utils/shell/command-safety/find-helpers.js

@@ -0,0 +1,131 @@
+import { extractWordText } from './utils.js';
+/**
+ * Check if a find command has dangerous execution flags (-exec, -execdir, -ok, -okdir, -delete)
+ */
+export function hasFindDangerousExecution(args) {
+    for (let i = 0; i < args.length; i++) {
+        const argText = extractWordText(args[i]);
+        if (!argText)
+            continue;
+        // Check for -delete flag
+        if (argText === '-delete') {
+            return { dangerous: true, reason: 'find -delete (destructive)' };
+        }
+        // Check for execution flags
+        const execFlags = ['-exec', '-execdir', '-ok', '-okdir'];
+        if (!execFlags.includes(argText))
+            continue;
+        // Found an exec flag - analyze the command it executes
+        // Find the terminator (; or +)
+        let terminatorIndex = -1;
+        for (let j = i + 1; j < args.length; j++) {
+            const term = extractWordText(args[j]);
+            if (term === ';' || term === '+' || term === '\\;' || term === '\\+') {
+                terminatorIndex = j;
+                break;
+            }
+        }
+        if (terminatorIndex === -1)
+            continue;
+        // Extract the command between exec flag and terminator
+        const execArgs = args.slice(i + 1, terminatorIndex);
+        // Check for redirects (which indicate shell operations). These are suspicious,
+        // but not necessarily destructive without knowing the surrounding task.
+        const hasRedirect = execArgs.some((a) => a?.type === 'Redirect');
+        if (hasRedirect)
+            continue;
+        const execCommand = execArgs.map((a) => extractWordText(a)).filter(Boolean);
+        if (execCommand.length === 0)
+            continue;
+        const cmdName = execCommand[0];
+        if (!cmdName) {
+            return {
+                dangerous: true,
+                reason: `find ${argText} with undefined command`,
+            };
+        }
+        // Check if {} is the command itself (executing found files)
+        if (cmdName === '{}') {
+            return {
+                dangerous: true,
+                reason: `find ${argText} {} (executes found files directly)`,
+            };
+        }
+        // Check for destructive commands
+        const destructiveCmds = ['rm', 'shred', 'dd', 'mkfs', 'truncate'];
+        if (destructiveCmds.includes(cmdName)) {
+            return {
+                dangerous: true,
+                reason: `find ${argText} ${cmdName} (destructive)`,
+            };
+        }
+        // Check for shell metacharacters in command. These make the command harder to
+        // reason about, so they should remain YELLOW through hasFindSuspiciousFlags.
+        const fullExecCmd = execCommand.join(' ');
+        if (/[|&;$`<>]/.test(fullExecCmd))
+            continue;
+    }
+    return { dangerous: false };
+}
+/**
+ * Check for suspicious find flags that warrant YELLOW classification
+ */
+export function hasFindSuspiciousFlags(args) {
+    for (const arg of args) {
+        const argText = extractWordText(arg);
+        if (!argText)
+            continue;
+        // File output flags
+        if (['-fprint', '-fprint0', '-fprintf', '-fls'].some((flag) => argText.startsWith(flag))) {
+            return {
+                suspicious: true,
+                reason: `find ${argText} (file output)`,
+            };
+        }
+        // Symlink following
+        if (['-L', '-follow', '-H'].includes(argText)) {
+            return {
+                suspicious: true,
+                reason: `find ${argText} (symlink following)`,
+            };
+        }
+        // SUID/SGID permission searches
+        if (argText === '-perm') {
+            // Check the next argument for dangerous permission patterns
+            const nextIdx = args.indexOf(arg) + 1;
+            if (nextIdx < args.length) {
+                const permValue = extractWordText(args[nextIdx]);
+                if (permValue) {
+                    // Numeric SUID/SGID patterns (e.g., -4000, /6000)
+                    const hasNumericSuid = /[-\/]?[2467]000/.test(permValue);
+                    // Symbolic SUID/SGID patterns (e.g., -u+s, /g+s, +s)
+                    const hasSymbolicSuid = /[ug]?\+s/.test(permValue);
+                    if (hasNumericSuid || hasSymbolicSuid) {
+                        return {
+                            suspicious: true,
+                            reason: `find -perm ${permValue} (SUID/SGID search)`,
+                        };
+                    }
+                }
+            }
+        }
+        // Inode-based searches (can bypass path restrictions)
+        if (argText === '-inum') {
+            return {
+                suspicious: true,
+                reason: 'find -inum (inode-based access bypasses path checks)',
+            };
+        }
+        // Read-only exec (still suspicious, requires approval)
+        if (['-exec', '-execdir', '-ok', '-okdir'].includes(argText)) {
+            // If we reach here, hasFindDangerousExecution already passed (not RED)
+            // but any -exec usage should still be YELLOW
+            return {
+                suspicious: true,
+                reason: `find ${argText} (command execution)`,
+            };
+        }
+    }
+    return { suspicious: false };
+}
+//# sourceMappingURL=find-helpers.js.map

package/dist/utils/shell/command-safety/find-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-helpers.js","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/find-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAW;IAInD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,yBAAyB;QACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QACnE,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAE3C,uDAAuD;QACvD,+BAA+B;QAC/B,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACrE,eAAe,GAAG,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,eAAe,KAAK,CAAC,CAAC;YAAE,SAAS;QAErC,uDAAuD;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,wEAAwE;QACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,WAAW;YAAE,SAAS;QAE1B,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEvC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,yBAAyB;aACjD,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,qCAAqC;aAC7D,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,IAAI,OAAO,gBAAgB;aACnD,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;IAC9C,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAW;IAIhD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,oBAAoB;QACpB,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,gBAAgB;aACxC,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,sBAAsB;aAC9C,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,4DAA4D;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjD,IAAI,SAAS,EAAE,CAAC;oBACd,kDAAkD;oBAClD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACzD,qDAAqD;oBACrD,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAEnD,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;wBACtC,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,MAAM,EAAE,cAAc,SAAS,qBAAqB;yBACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,sDAAsD;aAC/D,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,uEAAuE;YACvE,6CAA6C;YAC7C,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,sBAAsB;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/utils/shell/command-safety/handlers/find-handler.d.ts

@@ -0,0 +1,6 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Handler for find command safety analysis
+ */
+export declare const findHandler: CommandHandler;
+//# sourceMappingURL=find-handler.d.ts.map

package/dist/utils/shell/command-safety/handlers/find-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-handler.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/find-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AAE9F;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,cA6GzB,CAAC"}

package/dist/utils/shell/command-safety/handlers/find-handler.js

@@ -0,0 +1,106 @@
+import { SafetyStatus } from '../constants.js';
+/**
+ * Handler for find command safety analysis
+ */
+export const findHandler = {
+    handle(node, helpers) {
+        const { extractWordText, analyzePathRisk, hasFindDangerousExecution, hasFindSuspiciousFlags } = helpers;
+        const reasons = [];
+        let status = SafetyStatus.GREEN;
+        if (!node.suffix) {
+            return { status, reasons };
+        }
+        // Check for dangerous find operations first (RED)
+        const dangerResult = hasFindDangerousExecution(node.suffix);
+        if (dangerResult.dangerous) {
+            return {
+                status: SafetyStatus.RED,
+                reasons: [dangerResult.reason || 'find with dangerous flags'],
+            };
+        }
+        // Check for suspicious find flags (YELLOW)
+        const suspiciousResult = hasFindSuspiciousFlags(node.suffix);
+        if (suspiciousResult.suspicious) {
+            status = SafetyStatus.YELLOW;
+            reasons.push(suspiciousResult.reason || 'find with suspicious flags');
+        }
+        // Check path arguments for find
+        // Track if previous arg was a pattern flag like -name, -regex
+        let previousArgWasPatternFlag = false;
+        for (const arg of node.suffix) {
+            if (arg?.type === 'Redirect')
+                continue;
+            const argText = extractWordText(arg);
+            if (!argText)
+                continue;
+            // Track pattern flags
+            if (['-name', '-iname', '-path', '-ipath', '-regex', '-iregex'].includes(argText)) {
+                previousArgWasPatternFlag = true;
+                continue;
+            }
+            // Skip flags
+            if (argText.startsWith('-')) {
+                previousArgWasPatternFlag = false;
+                continue;
+            }
+            // Skip pattern arguments (the values after -name, -regex, etc.)
+            if (previousArgWasPatternFlag) {
+                previousArgWasPatternFlag = false;
+                continue;
+            }
+            // Skip glob patterns (contain wildcards)
+            if (/[*?[\]]/.test(argText))
+                continue;
+            // Skip safe relative paths (. and ./)
+            if (argText === '.' || argText === './')
+                continue;
+            // Skip patterns with backslashes (regex patterns)
+            if (argText.includes('\\'))
+                continue;
+            // Root traversal detection (DoS + information disclosure)
+            if (argText === '/' || argText === '//') {
+                status = SafetyStatus.YELLOW;
+                reasons.push('find / (root traversal - resource intensive)');
+                continue;
+            }
+            // For find, analyzing paths is more lenient:
+            // - System paths like /etc are YELLOW (not RED)
+            // - Home directories and dotfiles are still RED
+            const pathStatus = analyzePathRisk(argText);
+            if (pathStatus === SafetyStatus.RED) {
+                // Keep RED for home directories, dotfiles, and traversal
+                // Downgrade system paths to YELLOW
+                const homeRelatedPatterns = [
+                    /^~/, // Tilde
+                    /^\$/, // Variables like $HOME, $USER
+                    /^\/home\//, // Linux home
+                    /^\/Users\//, // macOS home
+                    /^\/root/, // Root's home
+                    /\/\.ssh/, // SSH keys
+                    /\/\.env/, // Environment files
+                    /\/\.git/, // Git config
+                    /\/\.aws/, // AWS credentials
+                    /\/\.kube/, // Kubernetes config
+                    /\/\.gnupg/, // GPG keys
+                    /\.\./, // Directory traversal
+                ];
+                const isHomeRelated = homeRelatedPatterns.some((pattern) => pattern.test(argText));
+                if (isHomeRelated) {
+                    status = SafetyStatus.RED;
+                    reasons.push(`find dangerous path: ${argText}`);
+                }
+                else {
+                    // System paths like /etc get downgraded to YELLOW
+                    status = SafetyStatus.YELLOW;
+                    reasons.push(`find system path: ${argText}`);
+                }
+            }
+            else if (pathStatus === SafetyStatus.YELLOW) {
+                status = pathStatus;
+                reasons.push(`find path argument ${argText}`);
+            }
+        }
+        return { status, reasons };
+    },
+};
+//# sourceMappingURL=find-handler.js.map

package/dist/utils/shell/command-safety/handlers/find-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-handler.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/find-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,MAAM,CAAC,IAAS,EAAE,OAA8B;QAC9C,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC;QACxG,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAiB,YAAY,CAAC,KAAK,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QAED,kDAAkD;QAClD,MAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,YAAY,CAAC,GAAG;gBACxB,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,2BAA2B,CAAC;aAC9D,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;QACxE,CAAC;QAED,gCAAgC;QAChC,8DAA8D;QAC9D,IAAI,yBAAyB,GAAG,KAAK,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU;gBAAE,SAAS;YACvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,sBAAsB;YACtB,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClF,yBAAyB,GAAG,IAAI,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,aAAa;YACb,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,yBAAyB,GAAG,KAAK,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,gEAAgE;YAChE,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,yBAAyB,GAAG,KAAK,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,yCAAyC;YACzC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YAEtC,sCAAsC;YACtC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAElD,kDAAkD;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAErC,0DAA0D;YAC1D,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,6CAA6C;YAC7C,gDAAgD;YAChD,gDAAgD;YAChD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACpC,yDAAyD;gBACzD,mCAAmC;gBACnC,MAAM,mBAAmB,GAAG;oBAC1B,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,8BAA8B;oBACrC,WAAW,EAAE,aAAa;oBAC1B,YAAY,EAAE,aAAa;oBAC3B,SAAS,EAAE,cAAc;oBACzB,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,oBAAoB;oBAC/B,SAAS,EAAE,aAAa;oBACxB,SAAS,EAAE,kBAAkB;oBAC7B,UAAU,EAAE,oBAAoB;oBAChC,WAAW,EAAE,WAAW;oBACxB,MAAM,EAAE,sBAAsB;iBAC/B,CAAC;gBAEF,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEnF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,kDAAkD;oBAClD,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,IAAI,UAAU,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBAC9C,MAAM,GAAG,UAAU,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;CACF,CAAC"}

package/dist/utils/shell/command-safety/handlers/git-handler.d.ts

@@ -0,0 +1,6 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Handler for git command safety analysis
+ */
+export declare const gitHandler: CommandHandler;
+//# sourceMappingURL=git-handler.d.ts.map

package/dist/utils/shell/command-safety/handlers/git-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-handler.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/git-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AAe9F;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAkFxB,CAAC"}

package/dist/utils/shell/command-safety/handlers/git-handler.js

@@ -0,0 +1,92 @@
+import { SafetyStatus, SAFE_GIT_COMMANDS, DANGEROUS_GIT_COMMANDS } from '../constants.js';
+// Git global options that consume the following argument as their value
+// (e.g. `git -C <path> status`, `git -c <name>=<value> log`). Without skipping
+// their value, that value is mistaken for the subcommand and flagged YELLOW.
+const VALUE_TAKING_GIT_GLOBALS = new Set([
+    '-C',
+    '-c',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--exec-path',
+    '--super-prefix',
+]);
+/**
+ * Handler for git command safety analysis
+ */
+export const gitHandler = {
+    handle(node, helpers) {
+        const { extractWordText } = helpers;
+        const reasons = [];
+        let status = SafetyStatus.GREEN;
+        // Extract the git subcommand (first non-flag argument), skipping global
+        // options and any values they consume.
+        let gitSubcommand;
+        if (node.suffix) {
+            let skipNext = false;
+            for (const arg of node.suffix) {
+                const argText = extractWordText(arg);
+                if (skipNext) {
+                    // This arg is the value of a preceding global option.
+                    skipNext = false;
+                    continue;
+                }
+                if (argText && argText.startsWith('-')) {
+                    // Long options with an inline value (`--git-dir=...`) are self-contained.
+                    if (VALUE_TAKING_GIT_GLOBALS.has(argText)) {
+                        skipNext = true;
+                    }
+                    continue;
+                }
+                if (argText) {
+                    gitSubcommand = argText;
+                    break;
+                }
+            }
+        }
+        if (!gitSubcommand) {
+            // No subcommand found (e.g., just "git" or "git --version")
+            return {
+                status: SafetyStatus.YELLOW,
+                reasons: ['git without subcommand'],
+            };
+        }
+        // Check if it's a known dangerous command
+        if (DANGEROUS_GIT_COMMANDS.has(gitSubcommand)) {
+            return {
+                status: SafetyStatus.YELLOW,
+                reasons: [`git ${gitSubcommand} (write operation)`],
+            };
+        }
+        // Check if it's a known safe command
+        if (SAFE_GIT_COMMANDS.has(gitSubcommand)) {
+            // Check for dangerous flags that might make it unsafe
+            const hasDangerousFlags = node.suffix.some((arg) => {
+                const argText = extractWordText(arg);
+                if (!argText)
+                    return false;
+                // Flags that might modify repository state
+                return (argText.startsWith('--force') ||
+                    argText.startsWith('-f') ||
+                    argText.startsWith('--hard') ||
+                    argText.startsWith('--delete') ||
+                    argText.startsWith('-d') ||
+                    argText.startsWith('-D'));
+            });
+            if (hasDangerousFlags) {
+                return {
+                    status: SafetyStatus.YELLOW,
+                    reasons: [`git ${gitSubcommand} with potentially dangerous flags`],
+                };
+            }
+            // Otherwise stays GREEN - safe read-only git command
+            return { status, reasons };
+        }
+        // Unknown git subcommand
+        return {
+            status: SafetyStatus.YELLOW,
+            reasons: [`git ${gitSubcommand} (unknown subcommand)`],
+        };
+    },
+};
+//# sourceMappingURL=git-handler.js.map

package/dist/utils/shell/command-safety/handlers/git-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-handler.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/git-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAG1F,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,IAAI;IACJ,IAAI;IACJ,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB;IACxC,MAAM,CAAC,IAAS,EAAE,OAA8B;QAC9C,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAiB,YAAY,CAAC,KAAK,CAAC;QAE9C,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,aAAiC,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,QAAQ,EAAE,CAAC;oBACb,sDAAsD;oBACtD,QAAQ,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvC,0EAA0E;oBAC1E,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC1C,QAAQ,GAAG,IAAI,CAAC;oBAClB,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,EAAE,CAAC;oBACZ,aAAa,GAAG,OAAO,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,4DAA4D;YAC5D,OAAO;gBACL,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,CAAC,wBAAwB,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,CAAC,OAAO,aAAa,oBAAoB,CAAC;aACpD,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,sDAAsD;YACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE;gBACtD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAE3B,2CAA2C;gBAC3C,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;oBAC7B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC5B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO;oBACL,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,OAAO,EAAE,CAAC,OAAO,aAAa,mCAAmC,CAAC;iBACnE,CAAC;YACJ,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QAED,yBAAyB;QACzB,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,CAAC,OAAO,aAAa,uBAAuB,CAAC;SACvD,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/utils/shell/command-safety/handlers/index.d.ts

@@ -0,0 +1,13 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Registry of command-specific handlers
+ */
+export declare const commandHandlers: Map<string, CommandHandler>;
+/**
+ * Get a handler for a specific command
+ * @param commandName The command name
+ * @returns The handler if one exists, undefined otherwise
+ */
+export declare function getCommandHandler(commandName: string): CommandHandler | undefined;
+export type { CommandHandler, CommandHandlerHelpers, CommandHandlerResult } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/shell/command-safety/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;GAEG;AACH,eAAO,MAAM,eAAe,6BAI1B,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEjF;AAGD,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/utils/shell/command-safety/handlers/index.js

@@ -0,0 +1,20 @@
+import { gitHandler } from './git-handler.js';
+import { findHandler } from './find-handler.js';
+import { sedHandler } from './sed-handler.js';
+/**
+ * Registry of command-specific handlers
+ */
+export const commandHandlers = new Map([
+    ['git', gitHandler],
+    ['find', findHandler],
+    ['sed', sedHandler],
+]);
+/**
+ * Get a handler for a specific command
+ * @param commandName The command name
+ * @returns The handler if one exists, undefined otherwise
+ */
+export function getCommandHandler(commandName) {
+    return commandHandlers.get(commandName);
+}
+//# sourceMappingURL=index.js.map

package/dist/utils/shell/command-safety/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAyB;IAC7D,CAAC,KAAK,EAAE,UAAU,CAAC;IACnB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,KAAK,EAAE,UAAU,CAAC;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C,CAAC"}

package/dist/utils/shell/command-safety/handlers/sed-handler.d.ts

@@ -0,0 +1,6 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Handler for sed command safety analysis
+ */
+export declare const sedHandler: CommandHandler;
+//# sourceMappingURL=sed-handler.d.ts.map

package/dist/utils/shell/command-safety/handlers/sed-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sed-handler.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/sed-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AAE9F;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAkGxB,CAAC"}

package/dist/utils/shell/command-safety/handlers/sed-handler.js

@@ -0,0 +1,95 @@
+import { SafetyStatus } from '../constants.js';
+/**
+ * Handler for sed command safety analysis
+ */
+export const sedHandler = {
+    handle(node, helpers) {
+        const { extractWordText, analyzePathRisk } = helpers;
+        const reasons = [];
+        let status = SafetyStatus.GREEN;
+        if (!node.suffix) {
+            return { status, reasons };
+        }
+        let hasOutputRedirect = false;
+        let hasInPlaceEdit = false;
+        const suffix = node.suffix ?? [];
+        const redirects = node.redirects ?? [];
+        const args = [...suffix, ...redirects];
+        // First pass: detect dangerous sed patterns
+        for (const arg of args) {
+            if (arg?.type === 'Redirect' || arg?.operator) {
+                // Check if it's an output redirect (>, >>)
+                const op = arg.operator || arg.op?.text || arg.op;
+                if (op === '>' || op === '>>') {
+                    hasOutputRedirect = true;
+                }
+            }
+            const argText = extractWordText(arg);
+            if (argText && argText.startsWith('-')) {
+                if (argText.startsWith('-i')) {
+                    hasInPlaceEdit = true;
+                }
+            }
+        }
+        // Second pass: classify arguments
+        for (const arg of args) {
+            // Redirects: analyze path risk. For `sed`, only mark output redirects as YELLOW
+            if (arg?.type === 'Redirect' || arg?.operator) {
+                const fileText = extractWordText(arg.target ?? arg.file ?? arg);
+                const op = arg.operator || arg.op?.text || arg.op;
+                if (op === '>' || op === '>>') {
+                    status = SafetyStatus.YELLOW;
+                    reasons.push(`sed with output redirection to ${fileText ?? '<unknown>'}`);
+                }
+                const pathStatus = analyzePathRisk(fileText);
+                if (pathStatus !== SafetyStatus.GREEN) {
+                    status = pathStatus;
+                    reasons.push(`redirect to ${fileText ?? '<unknown>'}`);
+                }
+                continue;
+            }
+            const argText = extractWordText(arg);
+            // Flags are normally ignored, but for `sed` the -i flag is dangerous
+            // because it performs in-place edits. Detect -i and variants (e.g. -i, -i.bak, -i'')
+            if (argText && argText.startsWith('-')) {
+                if (argText.startsWith('-i')) {
+                    status = SafetyStatus.YELLOW;
+                    reasons.push(`sed in-place edit detected: ${argText}`);
+                }
+                continue; // other flags ignored
+            }
+            const pathStatus = analyzePathRisk(argText);
+            // For `sed`, file arguments are only risky if combined with dangerous operations
+            if (argText) {
+                // If there's an in-place edit or output redirect, path risk matters
+                // Otherwise, reading files with sed is safe (GREEN)
+                if (hasInPlaceEdit || hasOutputRedirect) {
+                    if (pathStatus === SafetyStatus.RED) {
+                        status = pathStatus;
+                        reasons.push(`sed file argument ${argText}`);
+                    }
+                    else {
+                        status = SafetyStatus.YELLOW;
+                        reasons.push(`sed file argument ${argText}`);
+                    }
+                }
+                else {
+                    // Read-only sed: only escalate if path itself is risky
+                    if (pathStatus !== SafetyStatus.GREEN) {
+                        status = pathStatus;
+                        reasons.push(`sed file argument ${argText}`);
+                    }
+                    // Otherwise GREEN - read-only sed is safe
+                }
+                continue;
+            }
+            // Unknown/opaque args fall back to YELLOW
+            if (!argText) {
+                status = SafetyStatus.YELLOW;
+                reasons.push('opaque or unparseable argument');
+            }
+        }
+        return { status, reasons };
+    },
+};
+//# sourceMappingURL=sed-handler.js.map

package/dist/utils/shell/command-safety/handlers/sed-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sed-handler.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/sed-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB;IACxC,MAAM,CAAC,IAAS,EAAE,OAA8B;QAC9C,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACrD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAiB,YAAY,CAAC,KAAK,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;QAEvC,4CAA4C;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;gBAC9C,2CAA2C;gBAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC9B,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,gFAAgF;YAChF,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;gBAChE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAElD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;oBACtC,MAAM,GAAG,UAAU,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,eAAe,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,qEAAqE;YACrE,qFAAqF;YACrF,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,SAAS,CAAC,sBAAsB;YAClC,CAAC;YAED,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,iFAAiF;YACjF,IAAI,OAAO,EAAE,CAAC;gBACZ,oEAAoE;gBACpE,oDAAoD;gBACpD,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;oBACxC,IAAI,UAAU,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;wBACpC,MAAM,GAAG,UAAU,CAAC;wBACpB,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;oBAC/C,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,uDAAuD;oBACvD,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;wBACtC,MAAM,GAAG,UAAU,CAAC;wBACpB,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;oBAC/C,CAAC;oBACD,0CAA0C;gBAC5C,CAAC;gBACD,SAAS;YACX,CAAC;YAED,0CAA0C;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;CACF,CAAC"}

package/dist/utils/shell/command-safety/handlers/types.d.ts

@@ -0,0 +1,36 @@
+import { SafetyStatus } from '../constants.js';
+/**
+ * Result from a command handler
+ */
+export interface CommandHandlerResult {
+    status: SafetyStatus;
+    reasons: string[];
+}
+/**
+ * Helper functions passed to command handlers
+ */
+export interface CommandHandlerHelpers {
+    extractWordText: (arg: any) => string | undefined;
+    analyzePathRisk: (path: string | undefined) => SafetyStatus;
+    hasFindDangerousExecution: (suffix: any[]) => {
+        dangerous: boolean;
+        reason?: string;
+    };
+    hasFindSuspiciousFlags: (suffix: any[]) => {
+        suspicious: boolean;
+        reason?: string;
+    };
+}
+/**
+ * Interface for command-specific safety handlers
+ */
+export interface CommandHandler {
+    /**
+     * Handle command-specific safety analysis
+     * @param node The AST node representing the command
+     * @param helpers Helper functions for analysis
+     * @returns Safety status and reasons
+     */
+    handle(node: any, helpers: CommandHandlerHelpers): CommandHandlerResult;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/utils/shell/command-safety/handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;IAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,YAAY,CAAC;IAC5D,yBAAyB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK;QAC5C,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK;QACzC,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,CAAC;CACzE"}

package/dist/utils/shell/command-safety/handlers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/utils/shell/command-safety/handlers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/types.ts"],"names":[],"mappings":""}

package/dist/utils/shell/command-safety/index.d.ts

@@ -0,0 +1,23 @@
+import { SafetyStatus } from './constants.js';
+import type { ILoggingService } from '../../../services/service-interfaces.js';
+export interface ClassifyCommandResult {
+    status: SafetyStatus;
+    reasons: string[];
+}
+/**
+ * Classify command into a SafetyStatus (GREEN/YELLOW/RED)
+ */
+export declare function classifyCommand(commandString: string, loggingService?: ILoggingService): SafetyStatus;
+/**
+ * Classify command and return both the status and the list of reasons
+ * that contributed to the final status.
+ */
+export declare function classifyCommandDetailed(commandString: string, loggingService?: ILoggingService): ClassifyCommandResult;
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval (YELLOW or RED).
+ * Throws for invalid/empty inputs.
+ */
+export declare function validateCommandSafety(command: string, loggingService?: ILoggingService): boolean;
+export { SafetyStatus } from './constants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/shell/command-safety/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAsC,MAAM,gBAAgB,CAAC;AAMlF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAwB/E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAErG;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,eAAe,GAC/B,qBAAqB,CAsKvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,eAAe,GAAG,OAAO,CAuBhG;AAGD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}