@unscientificjszhai/howto 1.0.0 → 1.0.1

package/dist/init/index.js

@@ -1,37 +1,30 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import React from "react";
 import { render } from "ink";
 import { loadConfig } from "../config.js";
 import { getConfigFilePath, writeUserConfigFile } from "../config-file.js";
+import { InteractiveSessionProvider } from "../ui/InteractiveSessionProvider.js";
 import { InteractionCancelledError } from "../ui/tty.js";
 import { InitializationApp } from "./InitializationApp.js";
-export function initializeConfig(_a) {
-    return __awaiter(this, arguments, void 0, function* ({ cliOptions, env, input, output, }) {
-        return yield new Promise((resolve, reject) => {
-            let settled = false;
-            const settle = (result) => {
-                if (settled) {
-                    return;
-                }
-                settled = true;
-                instance.clear();
-                instance.unmount();
-                void instance.waitUntilExit().then(result, result);
-            };
-            const instance = render(React.createElement(InitializationApp, { onSubmit: (values) => __awaiter(this, void 0, void 0, function* () {
-                    const fileConfig = createFileConfig(values);
-                    const configFilePath = getConfigFilePath(env);
-                    yield writeUserConfigFile(fileConfig, configFilePath);
-                    return loadConfig(cliOptions, env, fileConfig);
-                }), onComplete: (config) => {
+export async function initializeConfig({ cliOptions, env, session, }) {
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let unsubscribe = () => { };
+        const settle = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            session.suspendViewInput();
+            unsubscribe();
+            const exitPromise = instance.waitUntilExit();
+            instance.clear();
+            instance.unmount();
+            void exitPromise.then(result, result);
+        };
+        const instance = render(React.createElement(InteractiveSessionProvider, { session: session },
+            React.createElement(InitializationApp, { onSubmit: async (values) => {
+                    return validateAndPersistInitializationConfig(values, cliOptions, env);
+                }, onComplete: (config) => {
                     settle(() => {
                         resolve(config);
                     });
@@ -43,14 +36,23 @@ export function initializeConfig(_a) {
                     settle(() => {
                         reject(error);
                     });
-                } }), {
-                stdin: input,
-                stdout: output,
-                exitOnCtrlC: false,
-            });
+                } })), {
+            stdin: session.input,
+            stdout: session.output,
+            exitOnCtrlC: false,
+            // 会话已确认 TTY，避免 CI 环境关闭 Ink 的实时渲染。
+            interactive: true,
         });
+        unsubscribe = session.subscribeFailure((error) => settle(() => reject(error)));
     });
 }
+export async function validateAndPersistInitializationConfig(values, cliOptions, env) {
+    const fileConfig = createFileConfig(values);
+    const config = loadConfig(cliOptions, env, fileConfig);
+    const configFilePath = getConfigFilePath(env);
+    await writeUserConfigFile(fileConfig, configFilePath);
+    return config;
+}
 export function clearInitializationOutput(output, rows) {
     if (output.isTTY) {
         output.write(erasePreviousTerminalRows(rows));

package/dist/init/state.js

@@ -1,4 +1,6 @@
 import { DEFAULT_GEMINI_MODEL, DEFAULT_OPENAI_MODEL } from "../config.js";
+import { hasUnsafeTerminalControlCharacters } from "../terminal-text.js";
+import { deleteLastGrapheme, isTextInputEvent } from "../ui/text-input.js";
 const PROVIDERS = ["openai", "gemini"];
 export function createInitialInitializationState() {
     return {
@@ -10,6 +12,14 @@ export function getProviderOptions() {
     return PROVIDERS;
 }
 export function applyInitializationInput(state, event) {
+    if (event.type === "paste") {
+        if (state.step !== "input" || hasUnsafeTerminalControlCharacters(event.input)) {
+            return { state };
+        }
+        return updateCurrentField(state, (value) => value + event.input);
+    }
+    if (event.key.eventType === "release")
+        return { state };
     if (event.key.ctrl && event.input === "c") {
         return { state, cancelled: true };
     }
@@ -22,7 +32,9 @@ function applyProviderInput(state, event) {
     if (event.key.escape) {
         return { state, cancelled: true };
     }
-    const numericSelection = getNumericProviderSelection(event.input);
+    const numericSelection = isTextInputEvent(event.input, event.key)
+        ? getNumericProviderSelection(event.input)
+        : null;
     if (numericSelection !== null) {
         return {
             state: createInputState(PROVIDERS[numericSelection]),
@@ -30,14 +42,20 @@ function applyProviderInput(state, event) {
     }
     if (event.key.upArrow) {
         return {
-            state: Object.assign(Object.assign({}, state), { selectedIndex: state.selectedIndex === null
+            state: {
+                ...state,
+                selectedIndex: state.selectedIndex === null
                     ? PROVIDERS.length - 1
-                    : (state.selectedIndex - 1 + PROVIDERS.length) % PROVIDERS.length }),
+                    : (state.selectedIndex - 1 + PROVIDERS.length) % PROVIDERS.length,
+            },
         };
     }
     if (event.key.downArrow) {
         return {
-            state: Object.assign(Object.assign({}, state), { selectedIndex: state.selectedIndex === null ? 0 : (state.selectedIndex + 1) % PROVIDERS.length }),
+            state: {
+                ...state,
+                selectedIndex: state.selectedIndex === null ? 0 : (state.selectedIndex + 1) % PROVIDERS.length,
+            },
         };
     }
     if (event.key.return && state.selectedIndex !== null) {
@@ -64,7 +82,10 @@ function applyFieldInput(state, event) {
         const validationError = validateCurrentField(state);
         if (validationError !== undefined) {
             return {
-                state: Object.assign(Object.assign({}, state), { errorMessage: validationError }),
+                state: {
+                    ...state,
+                    errorMessage: validationError,
+                },
             };
         }
         if (state.fieldIndex === state.fields.length - 1) {
@@ -74,26 +95,21 @@ function applyFieldInput(state, event) {
             };
         }
         return {
-            state: Object.assign(Object.assign({}, state), { fieldIndex: state.fieldIndex + 1, errorMessage: undefined }),
+            state: {
+                ...state,
+                fieldIndex: state.fieldIndex + 1,
+                errorMessage: undefined,
+            },
         };
     }
     if (event.key.backspace || event.key.delete) {
-        return updateCurrentField(state, (value) => value.slice(0, -1));
+        return updateCurrentField(state, deleteLastGrapheme);
     }
-    if (event.input !== "" && !hasControlKey(event)) {
+    if (isTextInputEvent(event.input, event.key)) {
         return updateCurrentField(state, (value) => value + event.input);
     }
     return { state };
 }
-function hasControlKey(event) {
-    return (event.key.upArrow ||
-        event.key.downArrow ||
-        event.key.return ||
-        event.key.escape ||
-        event.key.ctrl ||
-        event.key.backspace ||
-        event.key.delete);
-}
 function createInputState(provider) {
     return {
         step: "input",
@@ -140,8 +156,16 @@ function createInputState(provider) {
 }
 function updateCurrentField(state, updateValue) {
     return {
-        state: Object.assign(Object.assign({}, state), { fields: state.fields.map((field, index) => index === state.fieldIndex
-                ? Object.assign(Object.assign({}, field), { value: updateValue(field.value) }) : field), errorMessage: undefined }),
+        state: {
+            ...state,
+            fields: state.fields.map((field, index) => index === state.fieldIndex
+                ? {
+                    ...field,
+                    value: updateValue(field.value),
+                }
+                : field),
+            errorMessage: undefined,
+        },
     };
 }
 function validateCurrentField(state) {
@@ -152,20 +176,19 @@ function validateCurrentField(state) {
     return undefined;
 }
 function createInitializationValues(state) {
-    var _a, _b, _c;
     const fieldValues = new Map(state.fields.map((field) => [field.name, field.value]));
-    const modelValue = (_a = fieldValues.get("model")) === null || _a === void 0 ? void 0 : _a.trim();
+    const modelValue = fieldValues.get("model")?.trim();
     if (state.provider === "gemini") {
         return {
             provider: "gemini",
-            apiKey: (_b = fieldValues.get("apiKey")) !== null && _b !== void 0 ? _b : "",
+            apiKey: fieldValues.get("apiKey") ?? "",
             model: modelValue === "" || modelValue === undefined ? DEFAULT_GEMINI_MODEL : modelValue,
         };
     }
     const baseUrl = fieldValues.get("openaiBaseUrl");
     return {
         provider: "openai",
-        apiKey: (_c = fieldValues.get("apiKey")) !== null && _c !== void 0 ? _c : "",
+        apiKey: fieldValues.get("apiKey") ?? "",
         model: modelValue === "" || modelValue === undefined ? DEFAULT_OPENAI_MODEL : modelValue,
         openaiBaseUrl: baseUrl === undefined || baseUrl.trim() === "" ? undefined : baseUrl,
     };

package/dist/prompt.js

@@ -17,11 +17,13 @@ The JSON object must match this schema:
 }
 The commands array must contain 1 to 3 items. Do not return more than 3 candidate commands.
 Detect the primary natural language of the user's question. Return title, description, and placeholders[].description in that language. Keep placeholder name values English-compatible ASCII using only letters, numbers, underscores, or hyphens.
-Use placeholders in commands only as {{name}}, and declare every placeholder in the placeholders array. User may provide argument. If the user's intent is clear, try to use the provided arguments as parameters in the generated commands instead of placeholders. If the intent is unclear, do not fill them.`;
+Do not include terminal control characters in string fields. CR and LF are the only allowed control characters.
+Use placeholders in commands only as {{name}}, and declare every placeholder in the placeholders array. Each placeholder name must be declared exactly once per candidate; multiple references to the same name share one input value. User may provide argument. If the user's intent is clear, try to use the provided arguments as parameters in the generated commands instead of placeholders. If the intent is unclear, do not fill them.`;
 export const STRUCTURED_OUTPUT_CONTRACT = `Return only the JSON object requested by the response schema. Do not include a natural-language body, markdown, or code fences.
 The commands array must contain 1 to 3 items. Do not return more than 3 candidate commands.
 Detect the primary natural language of the user's question. Return title, description, and placeholders[].description in that language. Keep placeholder name values English-compatible ASCII using only letters, numbers, underscores, or hyphens.
-Use placeholders in commands only as {{name}}, and declare every placeholder in the placeholders array. User may provide argument. If the user's intent is clear, try to use the provided arguments as parameters in the generated commands instead of placeholders. If the intent is unclear, do not fill them.`;
+Do not include terminal control characters in string fields. CR and LF are the only allowed control characters.
+Use placeholders in commands only as {{name}}, and declare every placeholder in the placeholders array. Each placeholder name must be declared exactly once per candidate; multiple references to the same name share one input value. User may provide argument. If the user's intent is clear, try to use the provided arguments as parameters in the generated commands instead of placeholders. If the intent is unclear, do not fill them.`;
 export const SAFETY_CONSTRAINTS = `Prefer read-only, reversible, and low-risk commands.
 When a task could involve deletion, overwrite, privilege escalation, network download, or executing downloaded content, prefer a safer alternative or inspection command when possible.
 Do not include safety metadata or claim that a command is safe; the local CLI will perform its own validation and dangerous-command checks.`;

package/dist/safety/dangerous-command.js

@@ -1,104 +1,273 @@
-const SHELL_COMMAND_PREFIX = String.raw `(?:^|[;&|]\s*|\|\s*)`;
-const SUDO_PREFIX = String.raw `(?:sudo\s+)?`;
-const COMMAND_PREFIX = `${SHELL_COMMAND_PREFIX}${SUDO_PREFIX}`;
-const RISKY_TARGET_PATTERN = /(^|\s)(?:\/|~(?:\/|\s|$)|\*|\.\.\/|\.\/\*|\/(?:bin|boot|dev|etc|home|lib|opt|private|sbin|System|usr|var)(?:\/|\s|$))/;
-const RULES = [
-    {
-        name: "destructive-rm",
-        reason: "recursive or forced rm against a high-risk target",
-        matches(command) {
-            return findCommandSegments(command, "rm").some((segment) => {
-                const hasDangerousFlag = /(^|\s)(?:-[A-Za-z]*[rRfF][A-Za-z]*|--recursive|--force)(\s|$)/.test(segment);
-                return hasDangerousFlag && RISKY_TARGET_PATTERN.test(segment);
-            });
-        },
-    },
-    {
-        name: "disk-filesystem-operation",
-        reason: "disk, partition, filesystem, or raw block-device operation",
-        matches(command) {
-            return (new RegExp(`${COMMAND_PREFIX}(?:mkfs(?:\\.[\\w-]+)?|fdisk|parted)(?:\\s|$)`).test(command) ||
-                new RegExp(`${COMMAND_PREFIX}diskutil\\s+erase\\w*\\b`).test(command) ||
-                new RegExp(`${COMMAND_PREFIX}dd\\s+[^;&|]*\\bif=\\S+\\s+[^;&|]*\\bof=/dev/\\S*`).test(command));
-        },
-    },
-    {
-        name: "recursive-permission-ownership-change",
-        reason: "recursive chmod or chown against a high-risk target",
-        matches(command) {
-            return findCommandSegments(command, "(?:chmod|chown)").some((segment) => {
-                const hasRecursiveFlag = /(^|\s)(?:-[A-Za-z]*R[A-Za-z]*|--recursive)(\s|$)/.test(segment);
-                return hasRecursiveFlag && RISKY_TARGET_PATTERN.test(segment);
-            });
-        },
-    },
-    {
-        name: "download-and-execute",
-        reason: "network download piped or redirected directly into a shell",
-        matches(command) {
-            return (/\b(?:curl|wget)\b[^|;&]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b/.test(command) ||
-                /\b(?:sh|bash|zsh)\s+<\(\s*(?:curl|wget)\b/.test(command) ||
-                /\bwget\b[^|;&]*\s+-O-\s*\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b/.test(command));
-        },
-    },
-    {
-        name: "package-manager-high-impact-operation",
-        reason: "package manager upgrade, uninstall, or global install operation",
-        matches(command) {
-            return (new RegExp(`${COMMAND_PREFIX}(?:apt|apt-get|yum|dnf)\\s+(?:dist-upgrade|full-upgrade|upgrade|remove|purge|autoremove)\\b`).test(command) ||
-                new RegExp(`${COMMAND_PREFIX}brew\\s+(?:upgrade|uninstall|remove)\\b`).test(command) ||
-                new RegExp(`${COMMAND_PREFIX}npm\\s+(?:install|uninstall|remove|rm)\\b[^;&|]*(?:^|\\s)(?:-g|--global)(?:\\s|$)`).test(command) ||
-                new RegExp(`${COMMAND_PREFIX}(?:pip|pip3)\\s+(?:install|uninstall)\\b[^;&|]*(?:^|\\s)(?:-g|--user|--break-system-packages)(?:\\s|$)`).test(command));
-        },
-    },
-    {
-        name: "system-service-high-impact-operation",
-        reason: "system service stop, disable, restart, or configuration operation",
-        matches(command) {
-            return new RegExp(`${COMMAND_PREFIX}(?:systemctl|service|launchctl)\\s+(?:stop|disable|restart|reload|unload|bootout|remove)\\b`).test(command);
-        },
-    },
-];
+import { posix } from "node:path";
+import { isShellExecutable, parseShellCommand, resolveCommandPrefix, } from "../shell/command-analysis.js";
+const INDETERMINATE = {
+    rule: "indeterminate-shell-command",
+    reason: "command structure cannot be assessed locally; additional confirmation required",
+};
+const DESTRUCTIVE_RM = {
+    rule: "destructive-rm",
+    reason: "recursive or forced rm against a high-risk target",
+};
+const DISK_OPERATION = {
+    rule: "disk-filesystem-operation",
+    reason: "disk, partition, filesystem, or raw block-device operation",
+};
+const PERMISSION_CHANGE = {
+    rule: "recursive-permission-ownership-change",
+    reason: "recursive chmod or chown against a high-risk target",
+};
+const DOWNLOAD_EXECUTION = {
+    rule: "download-and-execute",
+    reason: "network download piped or redirected directly into a shell",
+};
+const PACKAGE_OPERATION = {
+    rule: "package-manager-high-impact-operation",
+    reason: "package manager upgrade, uninstall, or global install operation",
+};
+const SERVICE_OPERATION = {
+    rule: "system-service-high-impact-operation",
+    reason: "system service stop, disable, restart, or configuration operation",
+};
+const RISKY_TARGET = /^(?:\/|~(?:\/|$)|\*|\.\.(?:\/|$))/;
+const RM_FLAGS = /^(?:-[A-Za-z]*[rRfF][A-Za-z]*|--recursive|--force)$/;
+const RECURSIVE_FLAGS = /^(?:-[A-Za-z]*R[A-Za-z]*|--recursive)$/;
+const PACKAGE_MANAGERS = new Set(["apt", "apt-get", "yum", "dnf", "brew", "npm", "pip", "pip3"]);
+const PACKAGE_ACTIONS = new Set([
+    "dist-upgrade",
+    "full-upgrade",
+    "upgrade",
+    "remove",
+    "purge",
+    "autoremove",
+]);
+// update 等动作在不同管理器中含义不同，只在对应工具内归一化。
+const PACKAGE_ACTION_ALIASES = new Map([
+    [
+        "brew",
+        new Map([
+            ["remove", "uninstall"],
+            ["rm", "uninstall"],
+            ["uninstal", "uninstall"],
+        ]),
+    ],
+    [
+        "yum",
+        new Map([
+            ["update", "upgrade"],
+            ["update-to", "upgrade"],
+            ["upgrade-to", "upgrade"],
+            ["localupdate", "upgrade"],
+            ["erase", "remove"],
+        ]),
+    ],
+    [
+        "dnf",
+        new Map([
+            ["up", "upgrade"],
+            ["update", "upgrade"],
+            ["upgrade-to", "upgrade"],
+            ["update-to", "upgrade"],
+            ["localupdate", "upgrade"],
+            ["rm", "remove"],
+            ["erase", "remove"],
+            ["remove-n", "remove"],
+            ["remove-na", "remove"],
+            ["remove-nevra", "remove"],
+            ["erase-n", "remove"],
+            ["erase-na", "remove"],
+            ["erase-nevra", "remove"],
+        ]),
+    ],
+]);
+const SERVICE_ACTIONS = new Set([
+    "start",
+    "stop",
+    "enable",
+    "disable",
+    "restart",
+    "reload",
+    "unload",
+    "bootout",
+    "remove",
+]);
+const PACKAGE_ZERO_OPTIONS = new Set([
+    "-g",
+    "--global",
+    "--user",
+    "--break-system-packages",
+    "-y",
+    "--yes",
+    "-q",
+    "--quiet",
+    "--verbose",
+]);
+const SERVICE_ZERO_OPTIONS = new Set(["--user", "--system"]);
+const NPM_ACTION_ALIASES = new Map([
+    ["install", "install"],
+    ["add", "install"],
+    ["i", "install"],
+    ["in", "install"],
+    ["ins", "install"],
+    ["inst", "install"],
+    ["insta", "install"],
+    ["instal", "install"],
+    ["isnt", "install"],
+    ["isnta", "install"],
+    ["isntal", "install"],
+    ["isntall", "install"],
+    ["install-test", "install"],
+    ["installTest", "install"],
+    ["it", "install"],
+    ["uninstall", "uninstall"],
+    ["unlink", "uninstall"],
+    ["remove", "uninstall"],
+    ["rm", "uninstall"],
+    ["r", "uninstall"],
+    ["un", "uninstall"],
+]);
 export function detectDangerousCommand(command) {
-    const normalizedCommand = normalizeCommand(command);
-    const commandsToCheck = [normalizedCommand, ...extractSudoShellCommands(normalizedCommand)];
-    for (const commandToCheck of commandsToCheck) {
-        for (const rule of RULES) {
-            if (rule.matches(commandToCheck)) {
-                return {
-                    rule: rule.name,
-                    reason: rule.reason,
-                };
-            }
-        }
-    }
-    return undefined;
+    return inspectCommand(command, false);
 }
 export function isDangerousCommand(command) {
     return detectDangerousCommand(command) !== undefined;
 }
-function normalizeCommand(command) {
-    return command.replace(/\s+/g, " ").trim();
+function inspectCommand(command, insideShell) {
+    const parsed = parseShellCommand(command);
+    if (parsed.kind === "unsupported")
+        return INDETERMINATE;
+    const resolved = parsed.commands.map((segment) => resolveCommandPrefix(segment.words));
+    let uncertain = false;
+    for (let index = 0; index < resolved.length; index += 1) {
+        const current = resolved[index];
+        if (current.kind === "unsupported") {
+            uncertain = true;
+            continue;
+        }
+        const name = posix.basename(current.executable.value);
+        const next = resolved[index + 1];
+        if ((name === "curl" || name === "wget") &&
+            parsed.commands[index].separator === "|" &&
+            next?.kind === "parsed" &&
+            isShellExecutable(next.executable.value))
+            return DOWNLOAD_EXECUTION;
+        const match = isShellExecutable(current.executable.value)
+            ? inspectShellBody(name, current.args, insideShell)
+            : inspectSimpleCommand(name, current.args);
+        if (match?.rule === INDETERMINATE.rule)
+            uncertain = true;
+        else if (match !== undefined)
+            return match;
+    }
+    return uncertain ? INDETERMINATE : undefined;
 }
-function extractSudoShellCommands(command) {
-    var _a, _b;
-    const matcher = /\bsudo\s+(?:sh|bash|zsh)\s+-c\s+(?:"([^"]*)"|'([^']*)'|(\S+))/g;
-    const commands = [];
-    let match;
-    while ((match = matcher.exec(command)) !== null) {
-        const shellCommand = (_b = (_a = match[1]) !== null && _a !== void 0 ? _a : match[2]) !== null && _b !== void 0 ? _b : match[3];
-        if (shellCommand !== undefined) {
-            commands.push(normalizeCommand(shellCommand));
+function inspectShellBody(shell, args, insideShell) {
+    if (insideShell ||
+        !["sh", "bash", "zsh"].includes(shell) ||
+        args[0]?.hasExpansion ||
+        (args[0]?.value !== "-c" && args[0]?.value !== "-lc") ||
+        args[1] === undefined ||
+        args[1].hasExpansion)
+        return INDETERMINATE;
+    // 只展开一层已是字面量的 shell 命令体；不模拟变量或嵌套解释器。
+    return inspectCommand(args[1].value, true);
+}
+function inspectSimpleCommand(name, args) {
+    const values = args.map((word) => word.value);
+    const dynamic = args.some((word) => word.hasExpansion);
+    if (name === "rm" || name === "chmod" || name === "chown") {
+        const flagPattern = name === "rm" ? RM_FLAGS : RECURSIVE_FLAGS;
+        const endOptions = values.indexOf("--");
+        const flags = endOptions < 0 ? values : values.slice(0, endOptions);
+        if (flags.some((value) => flagPattern.test(value)) &&
+            values.some((value) => RISKY_TARGET.test(normalizeRiskPath(value)))) {
+            return name === "rm" ? DESTRUCTIVE_RM : PERMISSION_CHANGE;
         }
+        if (dynamic ||
+            flags.some((value) => value.startsWith("--") && !["--recursive", "--force", "--verbose"].includes(value)))
+            return INDETERMINATE;
+        return undefined;
+    }
+    if (/^mkfs(?:\.[\w-]+)?$/.test(name) || name === "fdisk" || name === "parted")
+        return DISK_OPERATION;
+    if (name === "dd") {
+        if (values.some((value) => {
+            if (!value.startsWith("of="))
+                return false;
+            const target = normalizeRiskPath(value.slice(3));
+            return target === "/dev" || target.startsWith("/dev/");
+        }))
+            return DISK_OPERATION;
+        return dynamic ? INDETERMINATE : undefined;
+    }
+    if (name === "diskutil") {
+        if (args[0]?.hasExpansion || values[0]?.startsWith("-"))
+            return INDETERMINATE;
+        return /^erase\w*$/.test(values[0] ?? "") ? DISK_OPERATION : undefined;
+    }
+    if (PACKAGE_MANAGERS.has(name))
+        return inspectPackageCommand(name, args);
+    if (name === "service" || name === "systemctl" || name === "launchctl") {
+        const action = name === "service" ? serviceAction(args) : leadingAction(args, SERVICE_ZERO_OPTIONS);
+        if (action === null)
+            return INDETERMINATE;
+        return action !== undefined && SERVICE_ACTIONS.has(action) ? SERVICE_OPERATION : undefined;
     }
-    return commands;
+    return undefined;
+}
+function normalizeRiskPath(value) {
+    // 只整理分析副本的分隔符和点段；保留 ..，避免忽略符号链接的实际解析语义。
+    const segments = value.split("/").filter((segment) => segment !== "" && segment !== ".");
+    return (value.startsWith("/") ? "/" : "") + segments.join("/");
+}
+function inspectPackageCommand(name, args) {
+    const parsedAction = leadingAction(args, PACKAGE_ZERO_OPTIONS);
+    if (parsedAction === null)
+        return INDETERMINATE;
+    if (parsedAction === undefined)
+        return undefined;
+    const action = name === "npm"
+        ? resolveNpmAction(parsedAction)
+        : (PACKAGE_ACTION_ALIASES.get(name)?.get(parsedAction) ?? parsedAction);
+    if (action === null)
+        return INDETERMINATE;
+    if (name === "brew")
+        return ["upgrade", "uninstall"].includes(action) ? PACKAGE_OPERATION : undefined;
+    if (name !== "npm" && name !== "pip" && name !== "pip3") {
+        return PACKAGE_ACTIONS.has(action) ? PACKAGE_OPERATION : undefined;
+    }
+    if (!["install", "uninstall", "remove", "rm"].includes(action))
+        return undefined;
+    const globalFlags = name === "npm" ? ["-g", "--global"] : ["-g", "--user", "--break-system-packages"];
+    if (args.some((word) => globalFlags.includes(word.value)))
+        return PACKAGE_OPERATION;
+    return args.some((word) => word.hasExpansion ||
+        (word.value.startsWith("-") && word.value !== "--" && !PACKAGE_ZERO_OPTIONS.has(word.value)))
+        ? INDETERMINATE
+        : undefined;
 }
-function findCommandSegments(command, commandNamePattern) {
-    const matcher = new RegExp(`${COMMAND_PREFIX}${commandNamePattern}\\b([^;&|]*)`, "g");
-    const segments = [];
-    let match;
-    while ((match = matcher.exec(command)) !== null) {
-        segments.push(match[0]);
+function resolveNpmAction(action) {
+    const canonical = NPM_ACTION_ALIASES.get(action);
+    if (canonical !== undefined)
+        return canonical;
+    // npm 也接受唯一前缀缩写；不复制完整命令表，相关前缀统一要求额外确认。
+    for (const knownAction of NPM_ACTION_ALIASES.keys()) {
+        if (knownAction.startsWith(action))
+            return null;
     }
-    return segments;
+    return action;
+}
+function serviceAction(args) {
+    if (args[0]?.hasExpansion || args[0]?.value.startsWith("-"))
+        return null;
+    return args[1]?.hasExpansion || args[1]?.value.startsWith("-") ? null : args[1]?.value;
+}
+function leadingAction(args, zeroOptions) {
+    for (const word of args) {
+        if (word.hasExpansion)
+            return null;
+        if (zeroOptions.has(word.value) || word.value === "--")
+            continue;
+        return word.value.startsWith("-") ? null : word.value;
+    }
+    return undefined;
 }