howtofixcli 0.7.7 → 0.7.9

package/dist/read-only-commands.js

@@ -1,597 +0,0 @@
-/**
- * Which shell commands are read-only, ported from Claude Code's bash classifier.
- *
- * The predecessor of this file was a single loose regex:
- *
- *   /^(?:cd\s+\S+\s*&&\s*)?(?:ls|cat|…|git\s+(?:status|diff|log|show|branch|remote))\b/
- *
- * which was wrong in both directions, and both directions cost the user:
- *
- * 1. **Too strict.** Any `|`, `;`, `&`, `<`, `>` or `$(` bailed out to "ask".
- *    `ls | head`, `git log --oneline | head -20`, `grep -rn x src | wc -l` —
- *    the bread and butter of reading a codebase — each raised a prompt. That is
- *    the "it asks for permission just to look at my code" complaint.
- * 2. **Too loose.** `\b` after `git\s+(?:…|branch|remote)` matched the
- *    subcommand only, so `git branch -D main` and `git remote remove origin`
- *    were auto-allowed as read-only. Those are writes.
- *
- * The reference's model fixes both: a command is read-only only if **every**
- * segment of the compound is read-only, and a segment is read-only only if its
- * flags are all in a per-subcommand allowlist. That is what this file ports.
- *
- * Deliberately not ported: the git-hook sandbox-escape guards
- * (`cd X && git status` where X contains a malicious `hooks/pre-commit`). They
- * exist because Claude Code runs git inside a sandbox it wants to escape-proof.
- * The equivalent guard here is simpler and stricter — see `cdWithGit`.
- */
-// ---------------------------------------------------------------------------
-// Flag validation
-// ---------------------------------------------------------------------------
-const FLAG_PATTERN = /^-[a-zA-Z0-9_-]/;
-function flagArgumentIsValid(value, type) {
-    switch (type) {
-        case "number":
-            return /^\d+$/.test(value);
-        case "string":
-            return true;
-        default:
-            return false;
-    }
-}
-/**
- * Expand a short-flag cluster or an attached value: `-d:`, `-f1`, `-nr`, `-U3`.
- *
- * The allowlist is written one flag per entry, but a user types the getopt
- * forms: `cut -d: -f1` attaches the value to the flag, and `sort -nr` clusters
- * two `none` flags. Without this, both read as an unknown flag and every one of
- * them raises an approval prompt — a read-only command asking permission, which
- * is the complaint this fixes.
- *
- * getopt semantics, and the reason it stays safe: a value-taking flag consumes
- * the **rest of its own token** and never reaches into the next one, so a
- * cluster cannot smuggle a value past the check.
- */
-function expandShortCluster(token, safeFlags) {
-    if (!/^-[^-]/.test(token) || token.includes("="))
-        return false;
-    for (let index = 1; index < token.length; index++) {
-        const type = safeFlags[`-${token[index]}`];
-        if (!type)
-            return false;
-        if (type === "none")
-            continue;
-        return flagArgumentIsValid(token.slice(index + 1), type);
-    }
-    // Every character was a known flag that takes no value.
-    return true;
-}
-/**
- * Walk a tokenized command's flags against a subcommand's allowlist.
- *
- * Positional arguments are accepted (they are usually paths or refs). A flag
- * that is not in `safeFlags` fails the whole check, which is what turns
- * `git branch -D main` into a prompt while `git branch -a` stays silent.
- */
-export function validateFlags(tokens, startIndex, config) {
-    let index = startIndex;
-    while (index < tokens.length) {
-        const token = tokens[index];
-        if (!token) {
-            index++;
-            continue;
-        }
-        if (token === "--")
-            break; // Everything after `--` is a positional argument.
-        if (FLAG_PATTERN.test(token)) {
-            // git's count shorthand: `git log -5` means `--max-count=5`. It reads as
-            // a flag to every other rule here, so it needs its own branch, and it is
-            // only meaningful where the command already accepts `-n`.
-            if (/^-\d+$/.test(token) && config.safeFlags["-n"]) {
-                index++;
-                continue;
-            }
-            // `--flag=value` is validated against the attached value, never by
-            // consuming the next token: `-E=` with an empty value must not be able to
-            // reach into the following argument.
-            const hasEquals = token.includes("=");
-            const [flag = "", ...valueParts] = token.split("=");
-            const type = config.safeFlags[flag];
-            if (!type) {
-                // Not a flag on its own: try the getopt forms before refusing.
-                if (!expandShortCluster(token, config.safeFlags))
-                    return false;
-                index++;
-                continue;
-            }
-            if (type === "none") {
-                // A `none` flag must not carry a value in either form.
-                if (hasEquals)
-                    return false;
-                index++;
-                continue;
-            }
-            // `optional` is git's PARSE_OPT_OPTARG: the value may be attached
-            // (`--porcelain=v2`, `--abbrev=10`) but is never taken from the next
-            // token, which would swallow a path or a ref.
-            if (type === "optional") {
-                index++;
-                continue;
-            }
-            if (hasEquals) {
-                if (!flagArgumentIsValid(valueParts.join("="), type))
-                    return false;
-                index++;
-                continue;
-            }
-            const next = tokens[index + 1];
-            if (next === undefined || !flagArgumentIsValid(next, type))
-                return false;
-            index += 2;
-            continue;
-        }
-        // A bare argument. Usually a path or a ref, but for an interpreter or a
-        // package runner it names code to execute, so those reject it.
-        if (config.allowPositional === false)
-            return false;
-        index++;
-    }
-    return true;
-}
-// ---------------------------------------------------------------------------
-// git
-// ---------------------------------------------------------------------------
-const GIT_REF_SELECTION = { "--all": "none", "--branches": "none", "--tags": "none", "--remotes": "none" };
-const GIT_LOG_DISPLAY = { "--oneline": "none", "--graph": "none", "--decorate": "none", "--no-decorate": "none", "--date": "string", "--relative-date": "none" };
-const GIT_COUNT = { "--max-count": "number", "-n": "number" };
-const GIT_STAT = { "--stat": "none", "--numstat": "none", "--shortstat": "none", "--name-only": "none", "--name-status": "none" };
-const GIT_COLOR = { "--color": "none", "--no-color": "none" };
-const GIT_PATCH = { "--patch": "none", "-p": "none", "--no-patch": "none", "--no-ext-diff": "none", "-s": "none" };
-const GIT_AUTHOR = { "--author": "string", "--committer": "string", "--grep": "string" };
-/** Flags that only ever *list*, shared by `branch` and `tag`. */
-const GIT_LIST_ONLY = { "-l": "none", "--list": "none", "-a": "none", "-r": "none", "-v": "none", "-vv": "none", "-i": "none" };
-/**
- * git subcommands that only read, with the flags each may take.
- *
- * `config` is deliberately `--get` only: `git config user.email x` writes the
- * config file, and the reference splits it into its own entry for that reason.
- */
-export const GIT_READ_ONLY = {
-    "git status": { safeFlags: { "-s": "none", "--short": "none", "-b": "none", "--branch": "none", "-u": "optional", "--untracked-files": "optional", "--porcelain": "optional", "--ignored": "none", "--long": "none", "--no-renames": "none", ...GIT_COLOR } },
-    "git diff": {
-        safeFlags: {
-            ...GIT_STAT,
-            ...GIT_COLOR,
-            ...GIT_PATCH,
-            "--cached": "none",
-            "--staged": "none",
-            "--word-diff": "none",
-            "--check": "none",
-            "--quiet": "none",
-            "--exit-code": "none",
-            "--no-renames": "none",
-            "--diff-filter": "string",
-            "--relative": "string",
-            "--full-index": "none",
-            "--binary": "none",
-            "--abbrev": "number",
-            "--unified": "number",
-            "-U": "number",
-            "--ignore-all-space": "none",
-            "--ignore-space-change": "none",
-            "--ignore-blank-lines": "none",
-        },
-    },
-    "git log": {
-        safeFlags: {
-            ...GIT_LOG_DISPLAY,
-            ...GIT_COUNT,
-            ...GIT_STAT,
-            ...GIT_COLOR,
-            ...GIT_PATCH,
-            ...GIT_AUTHOR,
-            ...GIT_REF_SELECTION,
-            "--since": "string",
-            "--after": "string",
-            "--until": "string",
-            "--before": "string",
-            "--follow": "none",
-            "--no-merges": "none",
-            "--merges": "none",
-            "--first-parent": "none",
-            "--reverse": "none",
-            "--skip": "number",
-            "--all": "none",
-            "--format": "string",
-            "--pretty": "string",
-            "--abbrev-commit": "none",
-            "--no-abbrev-commit": "none",
-            "--left-right": "none",
-        },
-    },
-    "git show": { safeFlags: { ...GIT_STAT, ...GIT_COLOR, ...GIT_PATCH, ...GIT_LOG_DISPLAY, "--format": "string", "--pretty": "string", "--abbrev-commit": "none", "--no-patch": "none", "-q": "none" } },
-    "git shortlog": { safeFlags: { ...GIT_COUNT, "-s": "none", "--summary": "none", "-n": "none", "--numbered": "none", "-e": "none", "--email": "none", "-sn": "none", "-ns": "none", "--all": "none" } },
-    "git reflog": { safeFlags: { ...GIT_COUNT, ...GIT_LOG_DISPLAY, ...GIT_AUTHOR, "--all": "none", "--date": "string" } },
-    "git blame": { safeFlags: { "-L": "string", "-w": "none", "-c": "none", "-n": "none", "-s": "none", "-e": "none", "-p": "none", "--porcelain": "none", "--line-porcelain": "none", "--date": "string", "--since": "string", "-C": "none", "-M": "none" } },
-    "git ls-files": {
-        safeFlags: {
-            "-m": "none",
-            "--modified": "none",
-            "-o": "none",
-            "--others": "none",
-            "-i": "none",
-            "--ignored": "none",
-            "-s": "none",
-            "--stage": "none",
-            "-d": "none",
-            "--deleted": "none",
-            "-c": "none",
-            "--cached": "none",
-            "-u": "none",
-            "--unmerged": "none",
-            "--exclude-standard": "none",
-            "--error-unmatch": "none",
-            "-z": "none",
-        },
-    },
-    "git ls-remote": { safeFlags: { "--heads": "none", "--tags": "none", "--refs": "none", "--symref": "none" } },
-    "git rev-parse": {
-        safeFlags: {
-            "--short": "optional",
-            "--abbrev-ref": "none",
-            "--verify": "none",
-            "--quiet": "none",
-            "--git-dir": "none",
-            "--show-toplevel": "none",
-            "--show-cdup": "none",
-            "--is-inside-work-tree": "none",
-            "--is-bare-repository": "none",
-            "--symbolic-full-name": "none",
-            "--abbrev": "optional",
-        },
-    },
-    "git rev-list": { safeFlags: { ...GIT_COUNT, "--count": "none", "--all": "none", "--objects": "none", "--reverse": "none", "--max-parents": "number", "--min-parents": "number", "--no-merges": "none", "--first-parent": "none", "--abbrev-commit": "none" } },
-    "git describe": { safeFlags: { "--tags": "none", "--all": "none", "--long": "none", "--always": "none", "--dirty": "none", "--abbrev": "number", "--match": "string", "--exclude": "string", "--first-parent": "none" } },
-    "git cat-file": { safeFlags: { "-p": "none", "-t": "none", "-s": "none", "-e": "none", "--batch-check": "none" } },
-    "git for-each-ref": { safeFlags: { "--format": "string", "--count": "number", "--sort": "string", "--points-at": "string", "--merged": "string", "--no-merged": "string" } },
-    "git grep": {
-        safeFlags: {
-            "-n": "none",
-            "--line-number": "none",
-            "-i": "none",
-            "--ignore-case": "none",
-            "-l": "none",
-            "--files-with-matches": "none",
-            "-c": "none",
-            "--count": "none",
-            "-w": "none",
-            "--word-regexp": "none",
-            "-E": "none",
-            "--extended-regexp": "none",
-            "-F": "none",
-            "--fixed-strings": "none",
-            "--cached": "none",
-            "--untracked": "none",
-            "-e": "string",
-            "--and": "none",
-            "--or": "none",
-            "--not": "none",
-        },
-    },
-    "git merge-base": { safeFlags: { "--all": "none", "--is-ancestor": "none", "--fork-point": "none", "--octopus": "none" } },
-    "git stash list": { safeFlags: { ...GIT_LOG_DISPLAY } },
-    "git worktree list": { safeFlags: { "--porcelain": "none", "-v": "none", "--verbose": "none", "-z": "none" } },
-    "git branch": {
-        safeFlags: { ...GIT_LIST_ONLY, "--merged": "string", "--no-merged": "string", "--contains": "string", "--no-contains": "string", "--sort": "string", "--format": "string", "--points-at": "string", "--column": "none", "--show-current": "none" },
-        // A positional argument to `git branch` is not a filter, it is a *new
-        // branch*: `git branch foo` writes `.git/refs/heads/foo`. Listing accepts
-        // only ref filters, and those take a value, so any bare word is a write.
-        dangerous: (args) => {
-            const takesValue = new Set(["--merged", "--no-merged", "--contains", "--no-contains", "--sort", "--format", "--points-at"]);
-            let expectValue = false;
-            for (const arg of args) {
-                if (expectValue) {
-                    expectValue = false;
-                    continue;
-                }
-                if (takesValue.has(arg)) {
-                    expectValue = true;
-                    continue;
-                }
-                if (!arg.startsWith("-"))
-                    return true; // A branch name being created.
-            }
-            return false;
-        },
-    },
-    "git tag": {
-        safeFlags: { "-l": "none", "--list": "none", "-n": "number", "--contains": "string", "--no-contains": "string", "--merged": "string", "--sort": "string", "--points-at": "string", "--column": "none" },
-        // Same shape as `branch`: `git tag v1` creates `.git/refs/tags/v1`.
-        dangerous: (args) => {
-            const takesValue = new Set(["--contains", "--no-contains", "--merged", "--sort", "--points-at"]);
-            let expectValue = false;
-            for (const arg of args) {
-                if (expectValue) {
-                    expectValue = false;
-                    continue;
-                }
-                if (takesValue.has(arg)) {
-                    expectValue = true;
-                    continue;
-                }
-                if (!arg.startsWith("-"))
-                    return true; // A tag name being created.
-            }
-            return false;
-        },
-    },
-    "git remote": {
-        safeFlags: { "-v": "none", "--verbose": "none" },
-        // Every other `git remote` verb (`add`, `remove`, `rename`, `set-url`,
-        // `prune`, `update`) changes the repository.
-        dangerous: (args) => args.some((arg) => !arg.startsWith("-")),
-    },
-    "git config --get": { safeFlags: { "--local": "none", "--global": "none", "--system": "none", "--get-all": "none", "--get-regexp": "none", "--list": "none", "-l": "none", "--show-origin": "none", "--null": "none", "-z": "none" } },
-};
-// ---------------------------------------------------------------------------
-// Everything else
-// ---------------------------------------------------------------------------
-/**
- * Commands whose whole flag surface is read-only, so no flag list is needed.
- * `env` and `printenv` are deliberately absent: this process holds provider API
- * keys, and the reference removed them for exactly that reason.
- */
-export const READ_ONLY_COMMANDS = [
-    "ls",
-    "pwd",
-    "cat",
-    "head",
-    "tail",
-    "wc",
-    "which",
-    "whoami",
-    "date",
-    "echo",
-    "sleep",
-    "true",
-    "false",
-    "type",
-    "test",
-    "seq",
-    "basename",
-    "dirname",
-    "realpath",
-    "stat",
-    "file",
-    "du",
-    "df",
-    "tree",
-    "uname",
-    "hostname",
-    "id",
-    "groups",
-    "tty",
-    "cal",
-    "uptime",
-    "free",
-    "locale",
-    "printf",
-    "grep",
-    "rg",
-    "fd",
-    "jq",
-    "bat",
-    "column",
-    "paste",
-    "nl",
-    "expand",
-    "fold",
-    "fmt",
-    // Hashing and comparing read their input and write nothing to it: `md5sum`
-    // and its sha siblings only print a digest, and `diff`/`cmp` only report a
-    // difference. `xxd` is NOT here — its `-r` form writes a file — so it lives
-    // in FLAGGED_READ_ONLY where the flag surface is checked.
-    "md5sum",
-    "sha1sum",
-    "sha256sum",
-    "sha512sum",
-    "b2sum",
-    "cksum",
-    "diff",
-    "cmp",
-];
-/** Commands that read, but only with the right flags. */
-export const FLAGGED_READ_ONLY = {
-    find: {
-        safeFlags: {
-            "-name": "string",
-            "-iname": "string",
-            "-type": "string",
-            "-maxdepth": "number",
-            "-mindepth": "number",
-            "-newer": "string",
-            "-path": "string",
-            "-not": "none",
-            "-print": "none",
-            "-print0": "none",
-            "-empty": "none",
-            "-size": "string",
-            "-mtime": "number",
-            "-atime": "number",
-            "-perm": "string",
-            "-L": "none",
-            "-H": "none",
-            "-P": "none",
-        },
-        // `-delete`, `-exec`, `-execdir`, `-ok`, `-fprint`, `-fls` and `-fprintf`
-        // all write or run code; the flag list above already rejects them, and this
-        // states the intent so a future addition cannot reintroduce one.
-        dangerous: (args) => args.some((arg) => /^-(delete|exec|execdir|ok|okdir|fprint0?|fls|fprintf)$/.test(arg)),
-    },
-    sort: { safeFlags: { "-n": "none", "-r": "none", "-u": "none", "-k": "string", "-t": "string", "-f": "none", "-h": "none", "-V": "none", "-s": "none", "-c": "none", "-m": "none", "-b": "none", "-z": "none" } },
-    uniq: { safeFlags: { "-c": "none", "-d": "none", "-u": "none", "-i": "none", "-f": "number", "-s": "number", "-w": "number" } },
-    cut: { safeFlags: { "-d": "string", "-f": "string", "-c": "string", "-b": "string", "-s": "none", "--complement": "none", "-z": "none" } },
-    tr: { safeFlags: { "-d": "none", "-s": "none", "-c": "none" } },
-    node: { safeFlags: { "-v": "none", "--version": "none" }, allowPositional: false },
-    python: { safeFlags: { "--version": "none" }, allowPositional: false },
-    python3: { safeFlags: { "--version": "none" }, allowPositional: false },
-    npm: { safeFlags: { "--version": "none", "-v": "none" }, allowPositional: false },
-    // `sed` and `awk` are programs, not filters: `sed -i` edits in place and a
-    // `sed` script can `w` a file. Only the pure-stream forms are allowed, and
-    // the script is checked for the commands that write.
-    sed: {
-        safeFlags: { "-n": "none", "--quiet": "none", "-e": "string", "-E": "none", "-r": "none", "--regexp-extended": "none", "-s": "none", "-u": "none", "-z": "none", "--posix": "none" },
-        dangerous: (args) => args.some((arg) => /^-i|^--in-place/.test(arg) || /\b[we]\s/.test(arg) || /^[we]$/.test(arg)),
-    },
-    awk: {
-        safeFlags: { "-F": "string", "-v": "string", "-f": "string" },
-        dangerous: (args) => args.some((arg) => /\bsystem\s*\(|\|\s*"|>\s*"/.test(arg)),
-    },
-    // `xxd file` dumps hex and only reads. `xxd -r` is the reverse: it writes a
-    // file from hex, so it must ask.
-    xxd: {
-        safeFlags: { "-l": "number", "-s": "string", "-c": "number", "-g": "number", "-p": "none", "-i": "none", "-u": "none", "-b": "none", "-e": "none", "-o": "number" },
-        dangerous: (args) => args.some((arg) => arg === "-r" || /^-[a-z]*r/.test(arg)),
-    },
-};
-/**
- * Multi-word commands that read only while they take no further argument:
- * `npm ls` lists, but `npm ls --json > f` and `docker ps --format …` are fine
- * too, so these are matched as subcommands with the same flag walk.
- */
-export const SUBCOMMAND_CONFIGS = {
-    "npm ls": { safeFlags: { "--depth": "number", "--json": "none", "--long": "none", "--parseable": "none", "--all": "none", "--prod": "none", "--dev": "none", "--omit": "string", "--link": "none", "--global": "none", "-g": "none", "--silent": "none" } },
-    "npm view": { safeFlags: { "--json": "none", "--registry": "string" } },
-    "docker ps": { safeFlags: { "-a": "none", "--all": "none", "-q": "none", "--quiet": "none", "--no-trunc": "none", "--format": "string", "-n": "number", "--last": "number", "-s": "none", "--size": "none", "--filter": "string" } },
-    "docker images": { safeFlags: { "-a": "none", "--all": "none", "-q": "none", "--quiet": "none", "--no-trunc": "none", "--format": "string", "--filter": "string", "--digests": "none" } },
-    "docker inspect": { safeFlags: { "--format": "string", "-f": "string", "-s": "none", "--size": "none", "--type": "string" } },
-    "kubectl get": {
-        safeFlags: {
-            "-o": "string",
-            "--output": "string",
-            "-n": "string",
-            "--namespace": "string",
-            "-A": "none",
-            "--all-namespaces": "none",
-            "--no-headers": "none",
-            "-l": "string",
-            "--selector": "string",
-            "--show-labels": "none",
-            "-w": "none",
-            "--watch": "none",
-            "--sort-by": "string",
-        },
-    },
-    "kubectl describe": { safeFlags: { "-n": "string", "--namespace": "string", "-l": "string", "--selector": "string" } },
-    "cargo tree": { safeFlags: { "--depth": "number", "-e": "string", "--edges": "string", "--no-dev-dependencies": "none", "--prefix": "string", "-i": "string", "--invert": "string", "-p": "string", "--package": "string" } },
-    "go version": { safeFlags: {} },
-};
-/**
- * Commands that are read-only when run through `git`, but are shell built-ins
- * or paths that need no validation.
- */
-export const SHELL_BUILTINS = ["cd", "alias", "history", "arch", "ip addr", "ifconfig"];
-// ---------------------------------------------------------------------------
-// Compound commands
-// ---------------------------------------------------------------------------
-/** Split a compound command into its segments, or `undefined` if it cannot be
- *  split safely. A `$(…)`, backtick or redirect anywhere makes the whole thing
- *  non-read-only, because it can write or substitute a value. */
-export function splitCompound(command) {
-    if (/\$\(|`|\$\{|>|</.test(command))
-        return undefined;
-    // `||` and `&&` and `;` and `|` all separate commands that each must be
-    // read-only. `&` alone backgrounds, which is not a read of anything.
-    if (/(?<!&)&(?!&)/.test(command))
-        return undefined;
-    return command
-        .split(/\|\||&&|;|\|/)
-        .map((segment) => segment.trim())
-        .filter((segment) => segment.length > 0);
-}
-/** `cd X && git …` is refused: the git invocation would run in a directory the
- *  caller chose, where a planted `hooks/pre-commit` executes. The reference
- *  guards this because it sandboxes git; here the simpler answer is to ask. */
-export function cdWithGit(segments) {
-    const hasCd = segments.some((segment) => /^cd\b/.test(segment));
-    const hasGit = segments.some((segment) => /^git\b/.test(segment));
-    return hasCd && hasGit;
-}
-/** Tokenize on whitespace, keeping quoted runs together. */
-export function tokenize(segment) {
-    const tokens = [];
-    const pattern = /'[^']*'|"[^"]*"|\S+/g;
-    for (const match of segment.match(pattern) ?? []) {
-        tokens.push(match.length >= 2 && /^['"]/.test(match) ? match.slice(1, -1) : match);
-    }
-    return tokens;
-}
-/** The longest command name a segment starts with, from a set of candidates. */
-function matchCommand(tokens) {
-    if (tokens.length === 0)
-        return undefined;
-    const [first = "", second = ""] = tokens;
-    const twoWord = `${first} ${second}`;
-    // `git config --get` is three words, and is the only read-only config form.
-    // `-l`/`--list` are the same read: they print the config instead of writing it.
-    if (first === "git" && second === "config") {
-        const verb = tokens[2];
-        const reads = verb === "--get" || verb === "--get-all" || verb === "--get-regexp" || verb === "-l" || verb === "--list";
-        return reads ? { name: "git config --get", rest: tokens.slice(3) } : undefined;
-    }
-    if (first === "git" && second === "stash") {
-        return tokens[2] === "list" ? { name: "git stash list", rest: tokens.slice(3) } : undefined;
-    }
-    if (first === "git" && second === "worktree") {
-        return tokens[2] === "list" ? { name: "git worktree list", rest: tokens.slice(3) } : undefined;
-    }
-    if (first === "git" && GIT_READ_ONLY[`git ${second}`])
-        return { name: `git ${second}`, rest: tokens.slice(2) };
-    if (SUBCOMMAND_CONFIGS[twoWord])
-        return { name: twoWord, rest: tokens.slice(2) };
-    return { name: first, rest: tokens.slice(1) };
-}
-/** Commands whose output is exactly their own arguments, so they only read if
- *  nothing in them can be expanded. */
-const ECHO_LIKE = new Set(["echo", "printf"]);
-/**
- * Is one segment read-only? The decision is per segment, so a pipe is fine as
- * long as both sides only read.
- */
-export function isReadOnlySegment(segment) {
-    const tokens = tokenize(segment);
-    const matched = matchCommand(tokens);
-    if (!matched)
-        return false;
-    const { name, rest } = matched;
-    // `echo $SECRET` prints whatever the variable holds — and this process holds
-    // provider API keys in its environment. Claude Code removed `env`/`printenv`
-    // and rejects `$` in `echo` for the same reason: printing is a read of the
-    // process, not of the workspace.
-    if (ECHO_LIKE.has(name) && rest.some((token) => token.includes("$") || token.includes("`")))
-        return false;
-    const config = GIT_READ_ONLY[name] ?? FLAGGED_READ_ONLY[name] ?? SUBCOMMAND_CONFIGS[name];
-    if (config) {
-        if (config.dangerous?.(rest))
-            return false;
-        return validateFlags(rest, 0, config);
-    }
-    if (READ_ONLY_COMMANDS.includes(name))
-        return true;
-    if (SHELL_BUILTINS.includes(name))
-        return true;
-    return false;
-}
-/**
- * The whole check: every segment of the compound must be read-only.
- *
- * `ls | head` → both segments read → true. `ls | tee out` → `tee` is not in any
- * list → false, so it prompts.
- */
-export function isReadOnlyCommand(command) {
-    const segments = splitCompound(command);
-    if (!segments || segments.length === 0)
-        return false;
-    if (cdWithGit(segments))
-        return false;
-    return segments.every(isReadOnlySegment);
-}