howtofixcli 0.7.24 → 0.7.26

package/dist/read-only-commands.js

@@ -0,0 +1,597 @@
+/**
+ * Which shell commands are read-only, ported from Claude Code's bash classifier.
+ *
+ * The predecessor of this file was a single loose regex:
+ *
+ *   /^(?:cd\s+\S+\s*&&\s*)?(?:ls|cat|…|git\s+(?:status|diff|log|show|branch|remote))\b/
+ *
+ * which was wrong in both directions, and both directions cost the user:
+ *
+ * 1. **Too strict.** Any `|`, `;`, `&`, `<`, `>` or `$(` bailed out to "ask".
+ *    `ls | head`, `git log --oneline | head -20`, `grep -rn x src | wc -l` —
+ *    the bread and butter of reading a codebase — each raised a prompt. That is
+ *    the "it asks for permission just to look at my code" complaint.
+ * 2. **Too loose.** `\b` after `git\s+(?:…|branch|remote)` matched the
+ *    subcommand only, so `git branch -D main` and `git remote remove origin`
+ *    were auto-allowed as read-only. Those are writes.
+ *
+ * The reference's model fixes both: a command is read-only only if **every**
+ * segment of the compound is read-only, and a segment is read-only only if its
+ * flags are all in a per-subcommand allowlist. That is what this file ports.
+ *
+ * Deliberately not ported: the git-hook sandbox-escape guards
+ * (`cd X && git status` where X contains a malicious `hooks/pre-commit`). They
+ * exist because Claude Code runs git inside a sandbox it wants to escape-proof.
+ * The equivalent guard here is simpler and stricter — see `cdWithGit`.
+ */
+// ---------------------------------------------------------------------------
+// Flag validation
+// ---------------------------------------------------------------------------
+const FLAG_PATTERN = /^-[a-zA-Z0-9_-]/;
+function flagArgumentIsValid(value, type) {
+    switch (type) {
+        case "number":
+            return /^\d+$/.test(value);
+        case "string":
+            return true;
+        default:
+            return false;
+    }
+}
+/**
+ * Expand a short-flag cluster or an attached value: `-d:`, `-f1`, `-nr`, `-U3`.
+ *
+ * The allowlist is written one flag per entry, but a user types the getopt
+ * forms: `cut -d: -f1` attaches the value to the flag, and `sort -nr` clusters
+ * two `none` flags. Without this, both read as an unknown flag and every one of
+ * them raises an approval prompt — a read-only command asking permission, which
+ * is the complaint this fixes.
+ *
+ * getopt semantics, and the reason it stays safe: a value-taking flag consumes
+ * the **rest of its own token** and never reaches into the next one, so a
+ * cluster cannot smuggle a value past the check.
+ */
+function expandShortCluster(token, safeFlags) {
+    if (!/^-[^-]/.test(token) || token.includes("="))
+        return false;
+    for (let index = 1; index < token.length; index++) {
+        const type = safeFlags[`-${token[index]}`];
+        if (!type)
+            return false;
+        if (type === "none")
+            continue;
+        return flagArgumentIsValid(token.slice(index + 1), type);
+    }
+    // Every character was a known flag that takes no value.
+    return true;
+}
+/**
+ * Walk a tokenized command's flags against a subcommand's allowlist.
+ *
+ * Positional arguments are accepted (they are usually paths or refs). A flag
+ * that is not in `safeFlags` fails the whole check, which is what turns
+ * `git branch -D main` into a prompt while `git branch -a` stays silent.
+ */
+export function validateFlags(tokens, startIndex, config) {
+    let index = startIndex;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (!token) {
+            index++;
+            continue;
+        }
+        if (token === "--")
+            break; // Everything after `--` is a positional argument.
+        if (FLAG_PATTERN.test(token)) {
+            // git's count shorthand: `git log -5` means `--max-count=5`. It reads as
+            // a flag to every other rule here, so it needs its own branch, and it is
+            // only meaningful where the command already accepts `-n`.
+            if (/^-\d+$/.test(token) && config.safeFlags["-n"]) {
+                index++;
+                continue;
+            }
+            // `--flag=value` is validated against the attached value, never by
+            // consuming the next token: `-E=` with an empty value must not be able to
+            // reach into the following argument.
+            const hasEquals = token.includes("=");
+            const [flag = "", ...valueParts] = token.split("=");
+            const type = config.safeFlags[flag];
+            if (!type) {
+                // Not a flag on its own: try the getopt forms before refusing.
+                if (!expandShortCluster(token, config.safeFlags))
+                    return false;
+                index++;
+                continue;
+            }
+            if (type === "none") {
+                // A `none` flag must not carry a value in either form.
+                if (hasEquals)
+                    return false;
+                index++;
+                continue;
+            }
+            // `optional` is git's PARSE_OPT_OPTARG: the value may be attached
+            // (`--porcelain=v2`, `--abbrev=10`) but is never taken from the next
+            // token, which would swallow a path or a ref.
+            if (type === "optional") {
+                index++;
+                continue;
+            }
+            if (hasEquals) {
+                if (!flagArgumentIsValid(valueParts.join("="), type))
+                    return false;
+                index++;
+                continue;
+            }
+            const next = tokens[index + 1];
+            if (next === undefined || !flagArgumentIsValid(next, type))
+                return false;
+            index += 2;
+            continue;
+        }
+        // A bare argument. Usually a path or a ref, but for an interpreter or a
+        // package runner it names code to execute, so those reject it.
+        if (config.allowPositional === false)
+            return false;
+        index++;
+    }
+    return true;
+}
+// ---------------------------------------------------------------------------
+// git
+// ---------------------------------------------------------------------------
+const GIT_REF_SELECTION = { "--all": "none", "--branches": "none", "--tags": "none", "--remotes": "none" };
+const GIT_LOG_DISPLAY = { "--oneline": "none", "--graph": "none", "--decorate": "none", "--no-decorate": "none", "--date": "string", "--relative-date": "none" };
+const GIT_COUNT = { "--max-count": "number", "-n": "number" };
+const GIT_STAT = { "--stat": "none", "--numstat": "none", "--shortstat": "none", "--name-only": "none", "--name-status": "none" };
+const GIT_COLOR = { "--color": "none", "--no-color": "none" };
+const GIT_PATCH = { "--patch": "none", "-p": "none", "--no-patch": "none", "--no-ext-diff": "none", "-s": "none" };
+const GIT_AUTHOR = { "--author": "string", "--committer": "string", "--grep": "string" };
+/** Flags that only ever *list*, shared by `branch` and `tag`. */
+const GIT_LIST_ONLY = { "-l": "none", "--list": "none", "-a": "none", "-r": "none", "-v": "none", "-vv": "none", "-i": "none" };
+/**
+ * git subcommands that only read, with the flags each may take.
+ *
+ * `config` is deliberately `--get` only: `git config user.email x` writes the
+ * config file, and the reference splits it into its own entry for that reason.
+ */
+export const GIT_READ_ONLY = {
+    "git status": { safeFlags: { "-s": "none", "--short": "none", "-b": "none", "--branch": "none", "-u": "optional", "--untracked-files": "optional", "--porcelain": "optional", "--ignored": "none", "--long": "none", "--no-renames": "none", ...GIT_COLOR } },
+    "git diff": {
+        safeFlags: {
+            ...GIT_STAT,
+            ...GIT_COLOR,
+            ...GIT_PATCH,
+            "--cached": "none",
+            "--staged": "none",
+            "--word-diff": "none",
+            "--check": "none",
+            "--quiet": "none",
+            "--exit-code": "none",
+            "--no-renames": "none",
+            "--diff-filter": "string",
+            "--relative": "string",
+            "--full-index": "none",
+            "--binary": "none",
+            "--abbrev": "number",
+            "--unified": "number",
+            "-U": "number",
+            "--ignore-all-space": "none",
+            "--ignore-space-change": "none",
+            "--ignore-blank-lines": "none",
+        },
+    },
+    "git log": {
+        safeFlags: {
+            ...GIT_LOG_DISPLAY,
+            ...GIT_COUNT,
+            ...GIT_STAT,
+            ...GIT_COLOR,
+            ...GIT_PATCH,
+            ...GIT_AUTHOR,
+            ...GIT_REF_SELECTION,
+            "--since": "string",
+            "--after": "string",
+            "--until": "string",
+            "--before": "string",
+            "--follow": "none",
+            "--no-merges": "none",
+            "--merges": "none",
+            "--first-parent": "none",
+            "--reverse": "none",
+            "--skip": "number",
+            "--all": "none",
+            "--format": "string",
+            "--pretty": "string",
+            "--abbrev-commit": "none",
+            "--no-abbrev-commit": "none",
+            "--left-right": "none",
+        },
+    },
+    "git show": { safeFlags: { ...GIT_STAT, ...GIT_COLOR, ...GIT_PATCH, ...GIT_LOG_DISPLAY, "--format": "string", "--pretty": "string", "--abbrev-commit": "none", "--no-patch": "none", "-q": "none" } },
+    "git shortlog": { safeFlags: { ...GIT_COUNT, "-s": "none", "--summary": "none", "-n": "none", "--numbered": "none", "-e": "none", "--email": "none", "-sn": "none", "-ns": "none", "--all": "none" } },
+    "git reflog": { safeFlags: { ...GIT_COUNT, ...GIT_LOG_DISPLAY, ...GIT_AUTHOR, "--all": "none", "--date": "string" } },
+    "git blame": { safeFlags: { "-L": "string", "-w": "none", "-c": "none", "-n": "none", "-s": "none", "-e": "none", "-p": "none", "--porcelain": "none", "--line-porcelain": "none", "--date": "string", "--since": "string", "-C": "none", "-M": "none" } },
+    "git ls-files": {
+        safeFlags: {
+            "-m": "none",
+            "--modified": "none",
+            "-o": "none",
+            "--others": "none",
+            "-i": "none",
+            "--ignored": "none",
+            "-s": "none",
+            "--stage": "none",
+            "-d": "none",
+            "--deleted": "none",
+            "-c": "none",
+            "--cached": "none",
+            "-u": "none",
+            "--unmerged": "none",
+            "--exclude-standard": "none",
+            "--error-unmatch": "none",
+            "-z": "none",
+        },
+    },
+    "git ls-remote": { safeFlags: { "--heads": "none", "--tags": "none", "--refs": "none", "--symref": "none" } },
+    "git rev-parse": {
+        safeFlags: {
+            "--short": "optional",
+            "--abbrev-ref": "none",
+            "--verify": "none",
+            "--quiet": "none",
+            "--git-dir": "none",
+            "--show-toplevel": "none",
+            "--show-cdup": "none",
+            "--is-inside-work-tree": "none",
+            "--is-bare-repository": "none",
+            "--symbolic-full-name": "none",
+            "--abbrev": "optional",
+        },
+    },
+    "git rev-list": { safeFlags: { ...GIT_COUNT, "--count": "none", "--all": "none", "--objects": "none", "--reverse": "none", "--max-parents": "number", "--min-parents": "number", "--no-merges": "none", "--first-parent": "none", "--abbrev-commit": "none" } },
+    "git describe": { safeFlags: { "--tags": "none", "--all": "none", "--long": "none", "--always": "none", "--dirty": "none", "--abbrev": "number", "--match": "string", "--exclude": "string", "--first-parent": "none" } },
+    "git cat-file": { safeFlags: { "-p": "none", "-t": "none", "-s": "none", "-e": "none", "--batch-check": "none" } },
+    "git for-each-ref": { safeFlags: { "--format": "string", "--count": "number", "--sort": "string", "--points-at": "string", "--merged": "string", "--no-merged": "string" } },
+    "git grep": {
+        safeFlags: {
+            "-n": "none",
+            "--line-number": "none",
+            "-i": "none",
+            "--ignore-case": "none",
+            "-l": "none",
+            "--files-with-matches": "none",
+            "-c": "none",
+            "--count": "none",
+            "-w": "none",
+            "--word-regexp": "none",
+            "-E": "none",
+            "--extended-regexp": "none",
+            "-F": "none",
+            "--fixed-strings": "none",
+            "--cached": "none",
+            "--untracked": "none",
+            "-e": "string",
+            "--and": "none",
+            "--or": "none",
+            "--not": "none",
+        },
+    },
+    "git merge-base": { safeFlags: { "--all": "none", "--is-ancestor": "none", "--fork-point": "none", "--octopus": "none" } },
+    "git stash list": { safeFlags: { ...GIT_LOG_DISPLAY } },
+    "git worktree list": { safeFlags: { "--porcelain": "none", "-v": "none", "--verbose": "none", "-z": "none" } },
+    "git branch": {
+        safeFlags: { ...GIT_LIST_ONLY, "--merged": "string", "--no-merged": "string", "--contains": "string", "--no-contains": "string", "--sort": "string", "--format": "string", "--points-at": "string", "--column": "none", "--show-current": "none" },
+        // A positional argument to `git branch` is not a filter, it is a *new
+        // branch*: `git branch foo` writes `.git/refs/heads/foo`. Listing accepts
+        // only ref filters, and those take a value, so any bare word is a write.
+        dangerous: (args) => {
+            const takesValue = new Set(["--merged", "--no-merged", "--contains", "--no-contains", "--sort", "--format", "--points-at"]);
+            let expectValue = false;
+            for (const arg of args) {
+                if (expectValue) {
+                    expectValue = false;
+                    continue;
+                }
+                if (takesValue.has(arg)) {
+                    expectValue = true;
+                    continue;
+                }
+                if (!arg.startsWith("-"))
+                    return true; // A branch name being created.
+            }
+            return false;
+        },
+    },
+    "git tag": {
+        safeFlags: { "-l": "none", "--list": "none", "-n": "number", "--contains": "string", "--no-contains": "string", "--merged": "string", "--sort": "string", "--points-at": "string", "--column": "none" },
+        // Same shape as `branch`: `git tag v1` creates `.git/refs/tags/v1`.
+        dangerous: (args) => {
+            const takesValue = new Set(["--contains", "--no-contains", "--merged", "--sort", "--points-at"]);
+            let expectValue = false;
+            for (const arg of args) {
+                if (expectValue) {
+                    expectValue = false;
+                    continue;
+                }
+                if (takesValue.has(arg)) {
+                    expectValue = true;
+                    continue;
+                }
+                if (!arg.startsWith("-"))
+                    return true; // A tag name being created.
+            }
+            return false;
+        },
+    },
+    "git remote": {
+        safeFlags: { "-v": "none", "--verbose": "none" },
+        // Every other `git remote` verb (`add`, `remove`, `rename`, `set-url`,
+        // `prune`, `update`) changes the repository.
+        dangerous: (args) => args.some((arg) => !arg.startsWith("-")),
+    },
+    "git config --get": { safeFlags: { "--local": "none", "--global": "none", "--system": "none", "--get-all": "none", "--get-regexp": "none", "--list": "none", "-l": "none", "--show-origin": "none", "--null": "none", "-z": "none" } },
+};
+// ---------------------------------------------------------------------------
+// Everything else
+// ---------------------------------------------------------------------------
+/**
+ * Commands whose whole flag surface is read-only, so no flag list is needed.
+ * `env` and `printenv` are deliberately absent: this process holds provider API
+ * keys, and the reference removed them for exactly that reason.
+ */
+export const READ_ONLY_COMMANDS = [
+    "ls",
+    "pwd",
+    "cat",
+    "head",
+    "tail",
+    "wc",
+    "which",
+    "whoami",
+    "date",
+    "echo",
+    "sleep",
+    "true",
+    "false",
+    "type",
+    "test",
+    "seq",
+    "basename",
+    "dirname",
+    "realpath",
+    "stat",
+    "file",
+    "du",
+    "df",
+    "tree",
+    "uname",
+    "hostname",
+    "id",
+    "groups",
+    "tty",
+    "cal",
+    "uptime",
+    "free",
+    "locale",
+    "printf",
+    "grep",
+    "rg",
+    "fd",
+    "jq",
+    "bat",
+    "column",
+    "paste",
+    "nl",
+    "expand",
+    "fold",
+    "fmt",
+    // Hashing and comparing read their input and write nothing to it: `md5sum`
+    // and its sha siblings only print a digest, and `diff`/`cmp` only report a
+    // difference. `xxd` is NOT here — its `-r` form writes a file — so it lives
+    // in FLAGGED_READ_ONLY where the flag surface is checked.
+    "md5sum",
+    "sha1sum",
+    "sha256sum",
+    "sha512sum",
+    "b2sum",
+    "cksum",
+    "diff",
+    "cmp",
+];
+/** Commands that read, but only with the right flags. */
+export const FLAGGED_READ_ONLY = {
+    find: {
+        safeFlags: {
+            "-name": "string",
+            "-iname": "string",
+            "-type": "string",
+            "-maxdepth": "number",
+            "-mindepth": "number",
+            "-newer": "string",
+            "-path": "string",
+            "-not": "none",
+            "-print": "none",
+            "-print0": "none",
+            "-empty": "none",
+            "-size": "string",
+            "-mtime": "number",
+            "-atime": "number",
+            "-perm": "string",
+            "-L": "none",
+            "-H": "none",
+            "-P": "none",
+        },
+        // `-delete`, `-exec`, `-execdir`, `-ok`, `-fprint`, `-fls` and `-fprintf`
+        // all write or run code; the flag list above already rejects them, and this
+        // states the intent so a future addition cannot reintroduce one.
+        dangerous: (args) => args.some((arg) => /^-(delete|exec|execdir|ok|okdir|fprint0?|fls|fprintf)$/.test(arg)),
+    },
+    sort: { safeFlags: { "-n": "none", "-r": "none", "-u": "none", "-k": "string", "-t": "string", "-f": "none", "-h": "none", "-V": "none", "-s": "none", "-c": "none", "-m": "none", "-b": "none", "-z": "none" } },
+    uniq: { safeFlags: { "-c": "none", "-d": "none", "-u": "none", "-i": "none", "-f": "number", "-s": "number", "-w": "number" } },
+    cut: { safeFlags: { "-d": "string", "-f": "string", "-c": "string", "-b": "string", "-s": "none", "--complement": "none", "-z": "none" } },
+    tr: { safeFlags: { "-d": "none", "-s": "none", "-c": "none" } },
+    node: { safeFlags: { "-v": "none", "--version": "none" }, allowPositional: false },
+    python: { safeFlags: { "--version": "none" }, allowPositional: false },
+    python3: { safeFlags: { "--version": "none" }, allowPositional: false },
+    npm: { safeFlags: { "--version": "none", "-v": "none" }, allowPositional: false },
+    // `sed` and `awk` are programs, not filters: `sed -i` edits in place and a
+    // `sed` script can `w` a file. Only the pure-stream forms are allowed, and
+    // the script is checked for the commands that write.
+    sed: {
+        safeFlags: { "-n": "none", "--quiet": "none", "-e": "string", "-E": "none", "-r": "none", "--regexp-extended": "none", "-s": "none", "-u": "none", "-z": "none", "--posix": "none" },
+        dangerous: (args) => args.some((arg) => /^-i|^--in-place/.test(arg) || /\b[we]\s/.test(arg) || /^[we]$/.test(arg)),
+    },
+    awk: {
+        safeFlags: { "-F": "string", "-v": "string", "-f": "string" },
+        dangerous: (args) => args.some((arg) => /\bsystem\s*\(|\|\s*"|>\s*"/.test(arg)),
+    },
+    // `xxd file` dumps hex and only reads. `xxd -r` is the reverse: it writes a
+    // file from hex, so it must ask.
+    xxd: {
+        safeFlags: { "-l": "number", "-s": "string", "-c": "number", "-g": "number", "-p": "none", "-i": "none", "-u": "none", "-b": "none", "-e": "none", "-o": "number" },
+        dangerous: (args) => args.some((arg) => arg === "-r" || /^-[a-z]*r/.test(arg)),
+    },
+};
+/**
+ * Multi-word commands that read only while they take no further argument:
+ * `npm ls` lists, but `npm ls --json > f` and `docker ps --format …` are fine
+ * too, so these are matched as subcommands with the same flag walk.
+ */
+export const SUBCOMMAND_CONFIGS = {
+    "npm ls": { safeFlags: { "--depth": "number", "--json": "none", "--long": "none", "--parseable": "none", "--all": "none", "--prod": "none", "--dev": "none", "--omit": "string", "--link": "none", "--global": "none", "-g": "none", "--silent": "none" } },
+    "npm view": { safeFlags: { "--json": "none", "--registry": "string" } },
+    "docker ps": { safeFlags: { "-a": "none", "--all": "none", "-q": "none", "--quiet": "none", "--no-trunc": "none", "--format": "string", "-n": "number", "--last": "number", "-s": "none", "--size": "none", "--filter": "string" } },
+    "docker images": { safeFlags: { "-a": "none", "--all": "none", "-q": "none", "--quiet": "none", "--no-trunc": "none", "--format": "string", "--filter": "string", "--digests": "none" } },
+    "docker inspect": { safeFlags: { "--format": "string", "-f": "string", "-s": "none", "--size": "none", "--type": "string" } },
+    "kubectl get": {
+        safeFlags: {
+            "-o": "string",
+            "--output": "string",
+            "-n": "string",
+            "--namespace": "string",
+            "-A": "none",
+            "--all-namespaces": "none",
+            "--no-headers": "none",
+            "-l": "string",
+            "--selector": "string",
+            "--show-labels": "none",
+            "-w": "none",
+            "--watch": "none",
+            "--sort-by": "string",
+        },
+    },
+    "kubectl describe": { safeFlags: { "-n": "string", "--namespace": "string", "-l": "string", "--selector": "string" } },
+    "cargo tree": { safeFlags: { "--depth": "number", "-e": "string", "--edges": "string", "--no-dev-dependencies": "none", "--prefix": "string", "-i": "string", "--invert": "string", "-p": "string", "--package": "string" } },
+    "go version": { safeFlags: {} },
+};
+/**
+ * Commands that are read-only when run through `git`, but are shell built-ins
+ * or paths that need no validation.
+ */
+export const SHELL_BUILTINS = ["cd", "alias", "history", "arch", "ip addr", "ifconfig"];
+// ---------------------------------------------------------------------------
+// Compound commands
+// ---------------------------------------------------------------------------
+/** Split a compound command into its segments, or `undefined` if it cannot be
+ *  split safely. A `$(…)`, backtick or redirect anywhere makes the whole thing
+ *  non-read-only, because it can write or substitute a value. */
+export function splitCompound(command) {
+    if (/\$\(|`|\$\{|>|</.test(command))
+        return undefined;
+    // `||` and `&&` and `;` and `|` all separate commands that each must be
+    // read-only. `&` alone backgrounds, which is not a read of anything.
+    if (/(?<!&)&(?!&)/.test(command))
+        return undefined;
+    return command
+        .split(/\|\||&&|;|\|/)
+        .map((segment) => segment.trim())
+        .filter((segment) => segment.length > 0);
+}
+/** `cd X && git …` is refused: the git invocation would run in a directory the
+ *  caller chose, where a planted `hooks/pre-commit` executes. The reference
+ *  guards this because it sandboxes git; here the simpler answer is to ask. */
+export function cdWithGit(segments) {
+    const hasCd = segments.some((segment) => /^cd\b/.test(segment));
+    const hasGit = segments.some((segment) => /^git\b/.test(segment));
+    return hasCd && hasGit;
+}
+/** Tokenize on whitespace, keeping quoted runs together. */
+export function tokenize(segment) {
+    const tokens = [];
+    const pattern = /'[^']*'|"[^"]*"|\S+/g;
+    for (const match of segment.match(pattern) ?? []) {
+        tokens.push(match.length >= 2 && /^['"]/.test(match) ? match.slice(1, -1) : match);
+    }
+    return tokens;
+}
+/** The longest command name a segment starts with, from a set of candidates. */
+function matchCommand(tokens) {
+    if (tokens.length === 0)
+        return undefined;
+    const [first = "", second = ""] = tokens;
+    const twoWord = `${first} ${second}`;
+    // `git config --get` is three words, and is the only read-only config form.
+    // `-l`/`--list` are the same read: they print the config instead of writing it.
+    if (first === "git" && second === "config") {
+        const verb = tokens[2];
+        const reads = verb === "--get" || verb === "--get-all" || verb === "--get-regexp" || verb === "-l" || verb === "--list";
+        return reads ? { name: "git config --get", rest: tokens.slice(3) } : undefined;
+    }
+    if (first === "git" && second === "stash") {
+        return tokens[2] === "list" ? { name: "git stash list", rest: tokens.slice(3) } : undefined;
+    }
+    if (first === "git" && second === "worktree") {
+        return tokens[2] === "list" ? { name: "git worktree list", rest: tokens.slice(3) } : undefined;
+    }
+    if (first === "git" && GIT_READ_ONLY[`git ${second}`])
+        return { name: `git ${second}`, rest: tokens.slice(2) };
+    if (SUBCOMMAND_CONFIGS[twoWord])
+        return { name: twoWord, rest: tokens.slice(2) };
+    return { name: first, rest: tokens.slice(1) };
+}
+/** Commands whose output is exactly their own arguments, so they only read if
+ *  nothing in them can be expanded. */
+const ECHO_LIKE = new Set(["echo", "printf"]);
+/**
+ * Is one segment read-only? The decision is per segment, so a pipe is fine as
+ * long as both sides only read.
+ */
+export function isReadOnlySegment(segment) {
+    const tokens = tokenize(segment);
+    const matched = matchCommand(tokens);
+    if (!matched)
+        return false;
+    const { name, rest } = matched;
+    // `echo $SECRET` prints whatever the variable holds — and this process holds
+    // provider API keys in its environment. Claude Code removed `env`/`printenv`
+    // and rejects `$` in `echo` for the same reason: printing is a read of the
+    // process, not of the workspace.
+    if (ECHO_LIKE.has(name) && rest.some((token) => token.includes("$") || token.includes("`")))
+        return false;
+    const config = GIT_READ_ONLY[name] ?? FLAGGED_READ_ONLY[name] ?? SUBCOMMAND_CONFIGS[name];
+    if (config) {
+        if (config.dangerous?.(rest))
+            return false;
+        return validateFlags(rest, 0, config);
+    }
+    if (READ_ONLY_COMMANDS.includes(name))
+        return true;
+    if (SHELL_BUILTINS.includes(name))
+        return true;
+    return false;
+}
+/**
+ * The whole check: every segment of the compound must be read-only.
+ *
+ * `ls | head` → both segments read → true. `ls | tee out` → `tee` is not in any
+ * list → false, so it prompts.
+ */
+export function isReadOnlyCommand(command) {
+    const segments = splitCompound(command);
+    if (!segments || segments.length === 0)
+        return false;
+    if (cdWithGit(segments))
+        return false;
+    return segments.every(isReadOnlySegment);
+}